Professional Documents
Culture Documents
Enterprise Routers
V200R003C01
04
Date
2014-01-16
Notice
The purchased products, services and features are stipulated by the contract made between Huawei and the
customer. All or part of the products, services and features described in this document may not be within the
purchase scope or the usage scope. Unless otherwise specified in the contract, all statements, information,
and recommendations in this document are provided "AS IS" without warranties, guarantees or representations
of any kind, either express or implied.
The information in this document is subject to change without notice. Every effort has been made in the
preparation of this document to ensure accuracy of the contents, but all statements, information, and
recommendations in this document do not constitute a warranty of any kind, express or implied.
Website:
http://enterprise.huawei.com
Issue 04 (2014-01-16)
Commissioning engineers
Symbol Conventions
The symbols that may be found in this document are defined as follows.
Symbol
Description
Indicates an imminently hazardous situation
which, if not avoided, will result in death or
serious injury.
Indicates a potentially hazardous situation
which, if not avoided, could result in death or
serious injury.
Indicates a potentially hazardous situation
which, if not avoided, may result in minor or
moderate injury.
Indicates a potentially hazardous situation
which, if not avoided, could result in
equipment damage, data loss, performance
deterioration, or unanticipated results.
NOTICE is used to address practices not
related to personal injury.
Issue 04 (2014-01-16)
ii
Symbol
Description
Calls attention to important information, best
practices and tips.
NOTE
Command Conventions
The command conventions that may be found in this document are defined as follows.
Convention
Description
Boldface
Italic
[]
{ x | y | ... }
[ x | y | ... ]
{ x | y | ... }*
[ x | y | ... ]*
&<1-n>
Change History
Updates between document issues are cumulative. Therefore, the latest document issue contains
all the updates made in previous issues.
Issue 04 (2014-01-16)
iii
Issue 04 (2014-01-16)
iv
Contents
Contents
About This Document.....................................................................................................................ii
1 IP Address Configuration............................................................................................................1
1.1 IPv4 Overview................................................................................................................................................................2
1.2 Principles........................................................................................................................................................................2
1.2.1 IPv4 Protocol Suite......................................................................................................................................................2
1.2.2 IPv4 Address................................................................................................................................................................3
1.2.3 IPv4 Packet Format.....................................................................................................................................................5
1.2.4 Subnetting....................................................................................................................................................................7
1.2.5 IP Address Resolution.................................................................................................................................................8
1.3 Configuring IP Address..................................................................................................................................................9
1.3.1 Configuring IP Addresses for Interfaces.....................................................................................................................9
1.3.1.1 Configuring a Primary IP Address for an Interface..................................................................................................9
1.3.1.2 (Optional) Configuring a Secondary IP Address for an Interface..........................................................................10
1.3.1.3 Checking the Configuration....................................................................................................................................10
1.3.2 Configuring an IP Unnumbered Interface.................................................................................................................11
1.3.2.1 Configuring a Primary IP Address for the IP Numbered Interface........................................................................11
1.3.2.2 Configuring an IP address Unnumbered Interface.................................................................................................11
1.3.2.3 Checking the Configuration....................................................................................................................................12
1.4 Configuration Examples...............................................................................................................................................12
1.4.1 Example for Configuring Primary and Secondary IP Addresses for an Interface.....................................................12
1.4.2 Example for Configuring an IP Unnumbered Interface............................................................................................14
1.5 Common Configuration Errors.....................................................................................................................................18
1.5.1 IP Address Configuration Fails on an Interface........................................................................................................18
1.6 References....................................................................................................................................................................20
2 ARP Configuration......................................................................................................................21
2.1 ARP Overview..............................................................................................................................................................22
2.2 Principles......................................................................................................................................................................22
2.2.1 ARP Principles..........................................................................................................................................................22
2.2.2 Proxy ARP.................................................................................................................................................................25
2.2.3 Gratuitous ARP..........................................................................................................................................................28
2.2.4 ARP-Ping...................................................................................................................................................................28
2.3 Configuration Task Summary......................................................................................................................................29
Issue 04 (2014-01-16)
Contents
3 DHCP Configuration..................................................................................................................57
3.1 DHCP Overview...........................................................................................................................................................58
3.2 Principles......................................................................................................................................................................58
3.2.1 DHCP Overview........................................................................................................................................................58
3.2.2 Introduction to DHCP Messages...............................................................................................................................59
3.2.3 DHCP Options...........................................................................................................................................................62
3.2.4 DHCP Principles........................................................................................................................................................65
3.2.5 DHCP Relay Principles.............................................................................................................................................68
3.2.6 IP Address Assignment and Renewal........................................................................................................................70
3.3 Application...................................................................................................................................................................71
3.3.1 DHCP Server Application.........................................................................................................................................71
3.3.2 DHCP Relay Application..........................................................................................................................................72
3.3.3 DHCP/BOOTP Client Application............................................................................................................................72
3.4 Default Configuration...................................................................................................................................................73
Issue 04 (2014-01-16)
vi
Contents
vii
Contents
3.8.1 DHCP Client Cannot Obtain IP Addresses When router Functions as the DHCP Server......................................114
3.8.2 DHCP Client Cannot Obtain IP Addresses When router Functions as the DHCP Relay Agent............................116
3.9 FAQ............................................................................................................................................................................117
3.9.1 How Can I Prevent the Auto-Config Function from Periodically Clearing DHCP-related Configurations on the
Device?.............................................................................................................................................................................117
3.9.2 How Can the Device Function as a DHCP Server to Dynamically Allocate IP Addresses to Multiple DHCP Clients?
..........................................................................................................................................................................................117
3.9.3 DHCP Clients Cannot Obtain IP Addresses. How Do I Solve This Problem?.......................................................117
3.9.4 How Do I View IP Address Allocation in the DHCP Server Address Pool?..........................................................117
3.9.5 When the Device Functions as the Access Device, It Takes a Long Time for Users to Obtain IP Addresses Through
DHCP? Why?...................................................................................................................................................................118
3.10 References................................................................................................................................................................118
4 DNS Configuration...................................................................................................................119
4.1 DNS Overview...........................................................................................................................................................120
4.2 Principles....................................................................................................................................................................120
4.2.1 Working Principle of DNS......................................................................................................................................120
4.2.2 Working Principle of DNS Proxy or Relay.............................................................................................................122
4.2.3 Working Principle of DNS Spoofing.......................................................................................................................123
4.2.4 Working Principle of DDNS...................................................................................................................................125
4.3 Applications................................................................................................................................................................126
4.3.1 DNS Client Application...........................................................................................................................................126
4.3.2 DNS Proxy Application...........................................................................................................................................126
4.4 Configuring DNS........................................................................................................................................................127
4.4.1 Configuring the DNS Client....................................................................................................................................127
4.4.1.1 Configuring the Static DNS..................................................................................................................................127
4.4.1.2 Configuring the Dynamic DNS............................................................................................................................128
4.4.1.3 Checking the Configuration..................................................................................................................................129
4.4.2 Configuring DNS Proxy or Relay...........................................................................................................................130
4.4.2.1 Configuring the Destination DNS Server.............................................................................................................130
4.4.2.2 (Optional) Configuring DNS Spoofing................................................................................................................131
4.4.2.3 Checking the Configuration..................................................................................................................................132
4.4.3 Configuring the DDNS Client.................................................................................................................................132
4.4.3.1 Configuring a DDNS Policy.................................................................................................................................132
4.4.3.2 Binding a DDNS Policy to an Interface...............................................................................................................134
4.4.3.3 Checking the Configuration..................................................................................................................................135
4.5 Maintaining DNS........................................................................................................................................................135
4.5.1 Deleting Dynamic DNS Entries..............................................................................................................................135
4.5.2 Deleting DNS Entries of the DNS Proxy or Relay..................................................................................................136
4.5.3 Clearing Statistics on Sent and Received DNS Packets..........................................................................................136
4.5.4 Manually Updating a DDNS Policy........................................................................................................................136
4.5.5 Monitoring the Running Status of DNS..................................................................................................................137
4.6 Configuration Examples.............................................................................................................................................137
Issue 04 (2014-01-16)
viii
Contents
5 NAT Configuration...................................................................................................................152
5.1 Introduction to NAT...................................................................................................................................................153
5.2 Principles....................................................................................................................................................................153
5.2.1 Overview.................................................................................................................................................................153
5.2.2 NAT Implementation...............................................................................................................................................155
5.2.3 NAT ALG................................................................................................................................................................158
5.2.4 DNS Mapping..........................................................................................................................................................159
5.2.5 NAT Associated with VPNs....................................................................................................................................160
5.2.6 Twice NAT..............................................................................................................................................................162
5.2.7 NAT Filtering and NAT Mapping...........................................................................................................................163
5.3 Applications................................................................................................................................................................165
5.3.1 Private Network Hosts Accessing Public Network.................................................................................................165
5.3.2 Public Network Hosts Accessing Private Network Servers....................................................................................166
5.3.3 Private Network Hosts Accessing Private Network Servers Using the Domain Name..........................................167
5.3.4 NAT Multi-instance.................................................................................................................................................167
5.4 Configuration Tasks...................................................................................................................................................168
5.5 Configuration Notes...................................................................................................................................................170
5.6 Configuring NAT.......................................................................................................................................................170
5.6.1 Configuring Dynamic NAT.....................................................................................................................................170
5.6.1.1 Configuring ACL Rules........................................................................................................................................171
5.6.1.2 Configuring Outbound NAT................................................................................................................................171
5.6.1.3 (Optional) Enabling NAT ALG............................................................................................................................172
5.6.1.4 (Optional) Configuring NAT Filtering and NAT Mapping..................................................................................173
5.6.1.5 (Optional) Configuring Twice NAT.....................................................................................................................174
5.6.1.6 (Optional) Configuring NAT Log Output............................................................................................................174
5.6.1.7 (Optional) Configuring the Aging Time of NAT Mapping Entries.....................................................................176
5.6.1.8 Checking the Configuration..................................................................................................................................176
Issue 04 (2014-01-16)
ix
Contents
Contents
5.10.9 What Is the Difference Between NAT Server and NAT Static?...........................................................................212
5.10.10 An External Phone Fails to Register With the SIP Server After a NAT Server Is Configured on the Outbound
Interfaces of the Device Functioning as a SIP Server......................................................................................................212
5.10.11 What Are Differences of Easy IP and Address Pool?.........................................................................................213
5.10.12 Which Interfaces Support NAT?.........................................................................................................................214
5.10.13 Public Address Cannot Be Pinged When NAT Is Configured on the Device as the Egress Gateway. How Do I
Solve the Problem?...........................................................................................................................................................214
5.11 References................................................................................................................................................................214
7 IP Performance Configuration................................................................................................223
7.1 IP Performance Overview..........................................................................................................................................224
7.2 Default Configuration.................................................................................................................................................224
7.3 Optimizing IP Performance........................................................................................................................................224
7.3.1 Configuring Source IP Addresses Verification.......................................................................................................225
7.3.2 Configuring an Outbound Interface to Fragment IP Packets...................................................................................225
7.3.3 Configuring Unequal Cost Multiple Path................................................................................................................226
7.3.4 Configuring the Device to Process IP Packets with Options...................................................................................227
7.3.5 Configuring an Interface to Forward Broadcast Packet..........................................................................................228
7.3.6 Configuring the Enhanced Forwarding Function for Control Packets Generated by the Device...........................228
7.3.7 Disabling the Routing and Forwarding Function on High-end LAN Cards............................................................229
7.3.8 Configuring ICMP properties..................................................................................................................................230
7.3.9 Configuring TCP Properties....................................................................................................................................232
7.3.10 Checking the Configuration...................................................................................................................................233
7.4 Maintaining IP Performance.......................................................................................................................................234
7.4.1 Clearing IP Performance Statistics..........................................................................................................................234
7.5 FAQ............................................................................................................................................................................234
7.5.1 Why Do I Need to Consider the Interface MTU When Setting the MSS of TCP Packets?....................................234
7.5.2 How Can I Determine Whether a Socket is Successfully Created?........................................................................235
xi
Contents
9 DHCPv6 Configuration............................................................................................................278
9.1 DHCPv6 Overview.....................................................................................................................................................279
9.2 Principles....................................................................................................................................................................279
9.2.1 DHCPv6 Overview..................................................................................................................................................279
9.2.2 DHCPv6 Packets.....................................................................................................................................................282
9.2.3 DHCPv6 Working Principles..................................................................................................................................284
9.2.4 Working Principle of DHCPv6 PD.........................................................................................................................287
9.2.5 Working Principle of the DHCPv6 Relay Agent.....................................................................................................288
9.2.6 IPv6 Address/Prefix Allocation and Lease Updating..............................................................................................289
9.3 Application.................................................................................................................................................................292
9.3.1 Typical Networking of the DHCPv6 Server............................................................................................................292
Issue 04 (2014-01-16)
xii
Contents
xiii
Contents
9.7.3 Example for Configuring a DHCPv6 Relay to Assign IPv6 Addresses to the Clients in One Network Segment
Connected to the Relay.....................................................................................................................................................321
9.7.4 Example for Configuring a DHCPv6 PD Client.....................................................................................................323
9.7.5 Example for Configuring a DHCPv6 Client............................................................................................................325
9.8 References..................................................................................................................................................................327
xiv
Contents
Issue 04 (2014-01-16)
xv
1 IP Address Configuration
IP Address Configuration
Issue 04 (2014-01-16)
1 IP Address Configuration
Purpose
IPv4 is used on the network layer between the data link layer and the transport layer. IPv4 shields
the differences at the link layer and provides a uniform format for the data packets transmitted
at the transport layer.
1.2 Principles
1.2.1 IPv4 Protocol Suite
Internet Protocol Version 4 (IPv4) is the core protocol in the TCP/IP protocol suite. IPv4 protocol
suite includes Address Resolution Protocol (ARP), Reverse Address Resolution Protocol
(RARP), Internet Control Message Protocol (ICMP), Transmission Control Protocol (TCP), and
User Datagram Protocol (UDP).
Figure 1-1 IPv4 protocol suite
Transport
layer
Network
layer
Data link
layer
TCPUDP
ICMP
IP
RARPARP
Various network
interfaces
As shown in Figure 1-1, ARP and RARP work between the data link layer and the network
layer for address resolution. ICMP works between the network layer and the transport layer to
ensure correct forwarding of IP datagrams.
ARP
ARP maps an IP address to a MAC address. ARP can be implemented in dynamic or static mode.
ARP provides some extended functions, such as proxy ARP, gratuitous ARP, ARP security, and
ARP-Ping.
Issue 04 (2014-01-16)
1 IP Address Configuration
RARP
RARP maps a MAC address to an IP address.
ICMP
ICMP works at the network layer to ensure correct forwarding of IP datagrams. ICMP allows
hosts and devices to report errors during packet transmission. An ICMP message is encapsulated
in an IP datagram as the data, and a header is added to the ICMP message to form an IP datagram.
Network ID (Net-id).The network ID identifies a network. The leftmost several bits of the
network ID identify the class of IP addresses.
IP addresses do not show any geographical information. The network ID represents the
network to which a host belongs.
When a host connects to two networks simultaneously, it must have two IP addresses with
different network IDs. In this case, the host is called a multihomed host.
Issue 04 (2014-01-16)
1 IP Address Configuration
0
A 0
15
31
23
Host-id
Net-id
B 1 0
Host-id
Net-id
C 1 1 0
Host-id
Net-id
D 1 1 1 0
Multicast-address
E 1 1 1 1
Reserved
At present, most IP addresses in use belong to Class A, Class B, or Class C. Class D addresses
are multicast addresses and Class E addresses are reserved. The easiest way to determine the
class of an IP address is to check the first bits in its network ID. The class fields of Class A,
Class B, Class C, Class D, and Class E are binary digits 0, 10, 110, 1110, and 1111 respectively.
For details about IP address classification, see RFC 1166 (Internet Numbers).
Certain IP addresses are reserved, and they cannot be allocated to users. Table 1-1 lists the ranges
of IP addresses for the five classes.
Table 1-1 IP address classes and ranges
Issue 04 (2014-01-16)
Class
Range
Description
0.0.0.0 to
127.255.255.255
128.0.0.0 to
191.255.255.255
192.0.0.0 to
223.255.255.255
224.0.0.0 to
239.255.255.255
240.0.0.0 to
255.255.255.255
1 IP Address Configuration
Host ID
Used as a
Source
Address
Used as a
Destination
Address
Description
All 0s
All 0s
Yes
No
All 0s
Host ID
Yes
No
127
Any value
except all
0s or all 1s
Yes
Yes
All 1s
All 1s
No
Yes
Net-id
All 1s
No
Yes
NOTE
Range
10.0.0.0 to 10.255.255.255
172.16.0.0 to 172.31.255.255
192.168.0.0 to 192.168.255.255
1 IP Address Configuration
16 19
Tos
31
Total length
identifier
Header
TTL
24
Flags
Protocol
Fragment offset
Header checksum
Source IP address
Destination IP address
Options (variable length)
Data
An IPv4 datagram consists of a header and a data field. The first 20 bytes in the header are
mandatory for all IPv4 datagrams. The Options field following the 20 bytes has a variable length.
Table 1-4 describes the meaning of each field in an IPv4 packet.
Table 1-4 Description of each field in an IPv4 packet
Issue 04 (2014-01-16)
Field
Length
Description
Version
4 bits
Header Length
4 bits
Type of Service
(ToS)
8 bits
Total Length
16 bits
Identification
16 bits
Flags
3 bits
Only the rightmost two bits are valid. The rightmost bit
indicates whether the datagram is not the last data fragment.
The value 1 indicates the last fragment, and the value 0
indicates non-last fragment. The middle bit is the
fragmentation flag. The value 1 indicates that the datagram
cannot be fragmented, and the value 0 indicates that the
datagram can be fragmented.
Fragment Offset
13 bits
Time to Live
(TTL)
8 bits
Protocol
8 bits
1 IP Address Configuration
Field
Length
Description
Header
Checksum
16 bits
Source IP
Address
32 bits
Destination IP
Address
32 bits
Options (variable
length)
0-40
bytes
Data
Variable
Pads an IP datagram .
1.2.4 Subnetting
A network can be divided into multiple subnets to conserve IP address space and support flexible
IP addressing.
When many hosts are distributed on an internal network, the internal host IDs can be divided
into multiple subnet IDs to facilitate management. Then the entire network contains multiple
small networks.
Subnetting is implemented within the internal network. The internal network has only one
network ID for the external network. When packets are transmitted from the external network
to the internal network, the device on the internal network selects a route for the packets based
on the subnet ID and finds the destination host.
Figure 1-4 shows subnetting of a Class B IP address. The subnet mask consists of a string of
continuous 1s and 0s. 1s indicate the network ID and the subnet ID field, and 0s indicate the
host ID.
Figure 1-4 Subnetting of IP addresses
Class B
address
Mask
Subnet
Mask
7
Net-id
15
31
20
Host-id
1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
Net-id
Subnet-id
Host-id
1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 0 0 0 0 0 0 0 0 0 0 0
As shown in Figure 1-4, the first 5 bits of the host ID is used as the subnet ID. The subnet ID
ranges from 00000 to 11111, allowing a maximum of 32 (25) subnets. Each subnet ID has a
Issue 04 (2014-01-16)
1 IP Address Configuration
subnet mask. For example, the subnet mask of the subnet ID 11111 is 255.255.248.0. After
performing an AND operation on the IP address and the subnet mask, you can obtain the network
address.
Subnetting reduces the available IP addresses. For example, a Class B IP address contains 65534
host IDs. After 5 bits in the host ID are used as the subnet ID, there can be a maximum of 32
subnets, each having an 11-bit host ID. Each subnet has a maximum of 2046 host IDs (211 - 2,
excluding the host IDs with all 1s and all 0s). Therefore, the IP address has a maximum of 65472
(32 x 2046) host IDs, 62 less than the maximum number of host IDs before subnetting.
To implement efficient network planning, subnetting and IP addressing should abide by the
following rules.
Hierarchy
To divide a network into multiple layers, you need to consider geographic and service factors.
Use a top-down subnetting mode to facilitate network management and simplify routing tables.
In most cases:
l
Consecutiveness
Consecutive addresses facilitate route summarization on a hierarchical network, which greatly
reduces the number of routing entries and improves route search efficiency.
l
Allocate consecutive IP addresses to devices that have the same services and functions.
Scalability
When allocating addresses, reserve certain addresses on each layer to ensure consecutive address
allocation in future network expansion.
A backbone network must have enough consecutive addresses for independent autonomous
systems (ASs) and further network expansion.
Efficiency
When planning subnets, fully utilize address resources to ensure that the subnets are sufficient
for hosts.
l
Allocate IP addresses by using variable-length subnet masking (VLSM) to fully use address
resources.
1 IP Address Configuration
A host name is easier to remember than an IP address. Therefore, the host name needs to
be resolved to the IP address.
On Ethernet, the physical address of a host is the MAC address. The DNS server resolves a host
name to an IP address. ARP resolves an IP address to a MAC address. For details, see 4 DNS
Configuration and 2 ARP Configuration.
Pre-configuration Tasks
Before configuring IP addresses for interfaces, complete the following tasks:
l
Setting link layer parameters for the interfaces to ensure that the link layer protocol status
of the interfaces is Up
Procedure
Step 1 Run:
system-view
1 IP Address Configuration
Each interface has only one primary IP address. If you configure multiple primary IP addresses
for an interface, the last configured IP address becomes the primary IP address of the interface.
----End
Procedure
Step 1 Run:
system-view
Issue 04 (2014-01-16)
10
1 IP Address Configuration
----End
Pre-configuration Tasks
Before configuring an IP unnumbered interface, complete the following tasks:
l
Setting link layer parameters for the interfaces to ensure that the link layer protocol status
of the interfaces is Up
Procedure
Step 1 Run:
system-view
11
1 IP Address Configuration
Procedure
Step 1 Run:
system-view
----End
12
1 IP Address Configuration
172.16.1.3/24
172.16.1.2/24
Router
GE1/0/0
172.16.1.1/24
172.16.2.1/24 sub
172.16.2.3/24
172.16.2.2/24
Configuration Roadmap
The configuration roadmap is as follows:
Configure a primary IP address and a secondary IP address for the interface.
NOTE
Procedure
Step 1 Configure a primary IP address and a secondary IP address for GE1/0/0.
<Huawei> system-view
[Huawei] interface gigabitethernet 1/0/0
[Huawei-GigabitEthernet1/0/0] ip address 172.16.1.1 24
[Huawei-GigabitEthernet1/0/0] ip address 172.16.2.1 24 sub
time=25
time=27
time=26
time=26
time=26
ms
ms
ms
ms
ms
# Ping a host on network segment 172.16.2.0 from the Router. The ping operation succeeds.
<Huawei> ping 172.16.2.2
PING 172.16.2.2: 56 data bytes, press CTRL_C to break
Reply from 172.16.2.2: bytes=56 Sequence=1 ttl=128 time=25 ms
Issue 04 (2014-01-16)
13
1 IP Address Configuration
ttl=128
ttl=128
ttl=128
ttl=128
time=26
time=26
time=26
time=26
ms
ms
ms
ms
----End
Configuration Files
Configuration file of the Router
#
interface GigabitEthernet1/0/0
ip address 172.16.1.1 255.255.255.0
ip address 172.16.2.1 255.255.255.0 sub
#
return
RouterB
GE2/0/0
30.1.1.1/24
RouterA GE1/0/0
GE1/0/0 RouterC
30.1.1.2/24
20.1.1.1/24
Tunnel
Tunnel
Tunnel
0/0/15
0/0/15
PC 1
Loopback 0
117.117.117.117/24
Loopback 0
116.116.116.116/24
GE1/0/0
20.1.1.2/24
PC 2
Configuration Roadmap
The configuration roadmap is as follows:
Issue 04 (2014-01-16)
14
1 IP Address Configuration
1.
Configure OSPF to ensure that there are reachable routes between RouterA and RouterC.
2.
Create tunnel interfaces on RouterA and RouterC and configure the tunnel interfaces to
borrow IP addresses from loopback interfaces to save IP addresses.
Procedure
Step 1 Configure IP addresses for physical interfaces.
# Configure RouterA.
<Huawei> system-view
[Huawei] sysname RouterA
[RouterA] interface loopback 0
[RouterA-LoopBack0] ip address 116.116.116.116 255.255.255.0
[RouterA-LoopBack0] quit
[RouterA] interface gigabitethernet 1/0/0
[RouterA-GigabitEthernet1/0/0] ip address 20.1.1.1 255.255.255.0
[RouterA-GigabitEthernet1/0/0] quit
# Configure RouterB.
<Huawei> system-view
[Huawei] sysname RouterB
[RouterB] interface gigabitethernet 1/0/0
[RouterB-GigabitEthernet1/0/0] ip address 20.1.1.2 255.255.255.0
[RouterB-GigabitEthernet1/0/0] quit
[RouterB] interface gigabitethernet 2/0/0
[RouterB-GigabitEthernet2/0/0] ip address 30.1.1.1 255.255.255.0
[RouterB-GigabitEthernet2/0/0] quit
# Configure RouterC.
<Huawei> system-view
[Huawei] sysname RouterC
[RouterC] interface loopback 0
[RouterC-LoopBack0] ip address 117.117.117.117 255.255.255.0
[RouterC-LoopBack0] quit
[RouterC] interface gigabitethernet 1/0/0
[RouterC-GigabitEthernet1/0/0] ip address 30.1.1.2 255.255.255.0
[RouterC-GigabitEthernet1/0/0] quit
# Configure RouterB.
[RouterB] ospf 1
[RouterB-ospf-1] area 0
[RouterB-ospf-1-area-0.0.0.0] network 20.1.1.0 0.0.0.255
[RouterB-ospf-1-area-0.0.0.0] network 30.1.1.0 0.0.0.255
[RouterB-ospf-1-area-0.0.0.0] quit
[RouterB-ospf-1] quit
# Configure RouterC.
[RouterC] ospf 1
[RouterC-ospf-1] area 0
[RouterC-ospf-1-area-0.0.0.0] network 30.1.1.0 0.0.0.255
[RouterC-ospf-1-area-0.0.0.0] quit
[RouterC-ospf-1] quit
Issue 04 (2014-01-16)
15
1 IP Address Configuration
# After the preceding configurations, run the display ip routing-table command on RouterA
and RouterC. The command output shows that RouterA and RouterC have learned OSPF routes
to the network segment of the peer.
# The following uses the display on RouterA as an example.
[RouterA] display ip routing-table protocol ospf
Route Flags: R - relay, D - download to
fib
-----------------------------------------------------------------------------Public routing table :
OSPF
Destinations : 1
1
Routes :
Proto
30.1.1.0/24 OSPF
GigabitEthernet1/0/0
OSPF routing table status :
<Inactive>
Destinations : 0
0
Routes :
Pre
Cost
10
Flags NextHop
20.1.1.2
Routes :
# Configure RouterC.
[RouterC] interface tunnel 0/0/15
[RouterC-Tunnel0/0/15] tunnel-protocol gre
[RouterC-Tunnel0/0/15] ip address unnumbered interface loopback 0
[RouterC-Tunnel0/0/15] source 30.1.1.2
[RouterC-Tunnel0/0/15] destination 20.1.1.1
[RouterC-Tunnel0/0/15] quit
# Configure RouterC.
[RouterC] ip route-static 116.116.116.0 24 tunnel 0/0/15
16
1 IP Address Configuration
ms
ms
ms
ms
ms
----End
Configuration Files
l
Issue 04 (2014-01-16)
17
1 IP Address Configuration
Procedure
Step 1 Check the error message and rectify the fault according to Table 1-5.
Table 1-5 Error messages and ways to rectify faults
Error Message
Description
Troubleshooting Method
Issue 04 (2014-01-16)
18
1 IP Address Configuration
Error Message
Description
Troubleshooting Method
NOTE
Each interface has only one
primary IP address. If you
configure multiple primary
IP addresses for an interface,
the last configured IP
address becomes the
primary IP address of the
interface.
NOTE
Each interface can have a
maximum of 32 IP
addresses, including one
primary IP address and 31
secondary IP addresses.
Issue 04 (2014-01-16)
19
1 IP Address Configuration
Error Message
Description
Troubleshooting Method
----End
1.6 References
The following table lists the references of the IPv4 feature.
Issue 04 (2014-01-16)
Document
Description
Remarks
RFC1166
Internet Numbers
RFC1918
20
2 ARP Configuration
ARP Configuration
Issue 04 (2014-01-16)
21
2 ARP Configuration
Purpose
On a local area network (LAN), a host or a network device must learn the IP address of the
destination host or device before sending data to it. Additionally, the host or network device
must learn the physical address of the destination host or device because IP packets must be
encapsulated into frames for transmission over a physical network. Therefore, the mapping from
an IP address into a physical address is required. ARP is used to map IP addresses into physical
addresses.
2.2 Principles
2.2.1 ARP Principles
Format of ARP Packets
Figure 2-1 shows the format of an ARP Request or Reply packet.
Figure 2-1 Format of an ARP Request or Reply packet
0
15
23
31 bit
Hardware Type
Protocol Type
Hardware Length
OP
Protocol Length
IP Address of destination(0-15)
IP Address of destination(16-31)
Issue 04 (2014-01-16)
Hardware Type: indicates the hardware address type. For an Ethernet, the value of this field
is 1.
Huawei Proprietary and Confidential
Copyright Huawei Technologies Co., Ltd.
22
2 ARP Configuration
Protocol Type: indicates the type of the protocol address to be mapped. For an IP address,
the value of this field is 0x0800.
Hardware Length: indicates the hardware address length. For an ARP Request or Reply
packet, the value of this field is 6.
Protocol Length: indicates the protocol address length. For an ARP Request or Reply
packet, the value of this field is 4.
OP: indicates the operation type. The value 1 indicates ARP requesting, and the value 2
indicates ARP replying.
ARP Request
HOSTA
HOSTB
As shown in Figure 2-2, HOSTA and HOSTB are on the same network segment. HOSTA needs
to send IP packets to HOSTB.
HOSTA searches the local ARP table for the ARP entry corresponding to HOSTB. If the
corresponding ARP entry is found, HOSTA encapsulates the IP packets into Ethernet frames
and forwards them to HOSTB based on its MAC address.
If the corresponding APR entry is not found, HOSTA caches the IP packets and broadcasts an
ARP Request packet. In the ARP Request packet, the IP address and MAC address of the sender
are the IP address and MAC address of HOSTA. The destination IP address is the IP address of
HOSTB, and the destination MAC address contains all 0s. All hosts on the same network
segment can receive the ARP Request packet, but only HOSTB processes the packet.
Issue 04 (2014-01-16)
23
2 ARP Configuration
ARP Reply
HOSTA
HOSTB
HOSTB compares its IP address with the destination IP address in the ARP Request packet. If
HOSTB finds that its IP address is the same as the destination IP address, HOSTB adds the IP
address and MAC address of the sender (HOSTA) to the local ARP table. Then HOSTB unicasts
an ARP Reply packet, which contains its MAC address, to HOSTA, as shown in Figure 2-3.
After receiving the ARP Reply packet, HOSTA adds HOSTB's MAC address into the local ARP
table. Meanwhile, HOSTA encapsulates the IP packets and forwards them to HOSTB.
Issue 04 (2014-01-16)
24
2 ARP Configuration
seconds, the sender can detect the fault on the receiver after N seconds. During the N
seconds, the cache on the sender is not updated.
l
Dynamic ARP
Dynamic ARP entries are generated and maintained dynamically by using ARP packets. They
can be aged out, updated, or overwritten by static ARP entries. When the aging time expires or
the interface is Down, the corresponding dynamic ARP entries are deleted.
Static ARP
Static ARP entries record fixed mapping between IP addresses and MAC addresses and are
configured manually by network administrators.
Issue 04 (2014-01-16)
Proxy ARP is implemented on the ARP subnet gateway without any modifications on any
hosts.
Huawei Proprietary and Confidential
Copyright Huawei Technologies Co., Ltd.
25
2 ARP Configuration
Proxy ARP can shield topologies of physical networks so that hosts on different physical
networks can use the same network ID to communicate. Proxy ARP enables hosts that are
on the same network segment but on different physical networks to communicate.
Proxy ARP affects only the ARP caches on hosts but does not affect the ARP cache or
routing table on the gateway.
After proxy ARP is enabled, the aging time of ARP entries on hosts should be shortened
so that invalid ARP entries can be deleted as soon as possible. Then IP packet forwarding
failures decrease on the router.
Resolved Issue
Allows hosts in different VLANs or hosts in different subVLANs of the same VLAN to communicate at Layer 3.
HOSTA
VLANIF10
172.16.2.9/24
172.16.1.20/16
VLANIF20
172.16.1.9/24
HOSTB
The IP addresses of HOSTA and HOSTB are on the same network segment. When HOSTA
needs to communicate with HOSTB, HOSTA broadcasts an ARP Request packet, requesting
the MAC address of HOSTB. However, HOSTA and HOSTB are on different physical networks
(in different broadcast domains). Therefore, HOSTB cannot receive the ARP Request packet
sent from HOSTA and does not respond with an ARP Reply packet.
To solve this problem, enable proxy ARP on RouterA. After receiving an ARP Request packet,
RouterA enabled with proxy ARP searches for the routing table corresponding to HOSTB. If
Issue 04 (2014-01-16)
26
2 ARP Configuration
the router corresponding to HOSTB exists, RouterA responds to the ARP Request packet with
its own MAC address. HOSTA forwards data based on the MAC address of RouterA.
RouterA functions as the proxy of HOSTB.
HOSTA
172.16.2.20/24
HOSTB
172.16.2.30/24
VLAN10
HOSTA and HOSTB cannot communicate at Layer 2 because interface isolation in a VLAN is
configured on RouterA.
To solve this problem, enable intra-VLAN proxy ARP on the interfaces of RouterA. After
RouterA's interface connected to HOSTA receives an ARP Request packet whose destination
address is not its own address, RouterA does not discard the packet but searches for the ARP
entry corresponding to HOSTB. If the ARP entry corresponding to HOSTB exists, RouterA
sends its MAC address to HOSTA and forwards packets sent from HOSTA to HOSTB.
RouterA functions as the proxy of HOSTB.
VLAN10
HOSTA
172.16.2.20/24
Issue 04 (2014-01-16)
RouterA
VLAN20
HOSTB
172.16.2.30/24
27
2 ARP Configuration
The interfaces connected to HOSTA and HOSTB belong to different VLANs. Therefore, HOST
A and HOSTB cannot communicate at Layer 2.
To solve this problem, enable inter-VLAN proxy ARP on the interfaces of RouterA. After
RouterA's interface connected to HOSTA receives an ARP Request packet whose destination
address is not its own address, RouterA does not discard the packet but searches for the ARP
entry corresponding to HOSTB. If the ARP entry corresponding to HOSTB exists, RouterA
sends its MAC address to HOSTA and forwards packets sent from HOSTA to HOSTB.
RouterA functions as the proxy of HOSTB.
Checks duplicate IP addresses: Normally, a host does not receive an ARP Reply packet
after sending an ARP Request packet with the destination address being its own IP address.
If the host receives an ARP Reply packet, another host has the same IP address.
Advertises a new MAC address. If the MAC address of a host changes because its network
adapter is replaced, the host sends a gratuitous ARP packet to notify all hosts of the change
before the ARP entry is aged out.
2.2.4 ARP-Ping
ARP-Ping includes ARP-Ping IP and ARP-Ping MAC. ARP-Ping sends ARP Request packets
or ICMP Echo Request packets to check whether a specified IP address or MAC address is used.
ARP-Ping IP
ARP-Ping IP checks whether an IP address is used by another device on the LAN by sending
ARP packets.
Before configuring an IP address for a device, configure ARP-Ping IP on the device to check
whether this IP address has been used by sending ARP Request packets.
You can also run the ping command to check whether this IP address is used by another device
on the network. However, if the router or host that uses the IP address is enabled with the firewall
function and the firewall is configured not to respond to ping packets, you may be misled into
thinking that this IP address is not used. To solve the problem, use ARP-Ping IP. ARP is a Layer
2 protocol. Therefore, ARP packets can pass through the firewall that is configured not to respond
to ping packets.
ARP-Ping IP sends ARP Request packets. ARP-Ping IP is implemented as follows:
1.
Issue 04 (2014-01-16)
After an IP address is specified for a host using the arp-ping ip command, the host sends
an ARP Request packet and starts a timer of waiting for an ARP Reply packet.
Huawei Proprietary and Confidential
Copyright Huawei Technologies Co., Ltd.
28
2 ARP Configuration
2.
After receiving the ARP Request packet, the router or host that uses this IP address in the
LAN returns an ARP Reply packet.
3.
The sender performs the following two operations based on whether it receives the ARP
packet:
l If the sender receives an ARP Reply packet, the sender compares the source IP address
carried in the ARP Reply packet with the IP address specified using the arp-ping ip
command. If the two IP addresses are the same, the MAC address corresponding to the
specified IP address is displayed and the timer is disabled.
l If the sender does not receive an ARP Reply packet before the timer of waiting for an
ARP Reply packet expires, the sender displays a message indicating that the IP address
is not used by another router device or host.
ARP-Ping MAC
The ARP-Ping MAC process is similar to the ping process. The difference is that ARP-Ping
MAC applies only to directly connected Ethernet LANs or Layer 2 VPN Ethernet networks.
ARP-Ping MAC sends ICMP Echo Request packets. ARP-Ping MAC is implemented as follows:
1.
After a MAC address is specified for a host using the arp-ping mac command, the host
sends an ICMP Echo Request packet and starts a timer of waiting for an ICMP Echo Reply
packet.
2.
After receiving the ICMP Echo Request packet, the router device or host that uses this
MAC address in the LAN returns an ICMP Echo Reply packet.
3.
The sender performs the following two operations based on whether it receives the ICMP
packet:
l If the sender receives an ICMP Echo Reply packet, the sender compares the source
MAC address carried in the ICMP Echo Reply packet with the MAC address specified
using the arp-ping mac command. If the two MAC addresses are the same, the sender
displays the source IP address of the ICMP Echo Reply packet and displays a message
indicating that the MAC address is used by another router device or host. The timer is
disabled.
l If the sender does not receive an ARP Reply packet before the timer of waiting for an
ICMP Echo Reply packet expires, the sender displays a message indicating that the
MAC address is not used by another router device or host.
Issue 04 (2014-01-16)
29
2 ARP Configuration
Description
Task
Configurin
g Static
ARP
Issue 04 (2014-01-16)
30
2 ARP Configuration
Scenario
Description
Task
Configurin
g Proxy
ARP
l The ARP-Ping IP
function checks
whether an IP
address is used by
another device on the
network.
31
2 ARP Configuration
Default Configuration
1200 seconds
3 times
ARP proxy
Context
Static ARP entries are manually configured and maintained. They cannot be aged and overridden
by dynamic ARP entries. Therefore, static ARP entries improve communication security. Static
ARP entries ensure communication between the local device and a specified device by using a
specified MAC address so that attackers cannot modify mappings between IP addresses and
MAC addresses in static ARP entries.
NOTE
Static ARP entries cannot be modified. However, the configuration workload is heavy. Static ARP entries
cannot apply to a network where IP addresses of hosts may change or a small-sized network.
Procedure
Step 1 Run:
system-view
32
2 ARP Configuration
l For VLANIF interfaces and Dot1q termination sub-interfaces, run the arp static ipaddress mac-address vid vlan-id interface interface-type interface-number command to
configure static ARP entries.
l For QinQ termination sub-interfaces, run the arp static ip-address mac-address vid vlanid cevid ce-vid interface interface-type interface-number command to configure static ARP
mapping entries with double tags. vid specified in this command must be the same as pevid in the qinq termination pe-vid ce-vid command, and ce-vid must be within the value
range of ce-vid in the qinq termination pe-vid ce-vid command.
l For interfaces bound to a VPN instance:
For Layer 3 physical interfaces and Layer 3 Eth-Trunk interfaces, run the arp static ipaddress mac-address vpn-instance vpn-instance-name command to configure static ARP
entries.
For VLANIF interfaces and Dot1q termination sub-interfaces, run the arp static ipaddress mac-address vid vlan-id interface interface-type interface-number command to
configure static ARP entries.
For QinQ termination sub-interfaces, run the arp static ip-address mac-address vid vlanid cevid ce-vid interface interface-type interface-number command to configure static
ARP mapping entries with double tags. vid specified in this command must be the same
as pe-vid in the qinq termination pe-vid ce-vid command, and ce-vid must be within the
value range of ce-vid in the qinq termination pe-vid ce-vid command.
----End
Run the display arp [ all | brief ] command to check all ARP mapping entries.
Run the display arp network net-number net-mask [ dynamic | static ] command to check
ARP mapping entries of a specified network segment.
Run the display arp static command to check static ARP mapping entries.
Run the display arp interface interface-type interface-number [ vid vlan-id [ cevid cevlanid ] ] command to check ARP mapping entries of a specified interface.
Run the display arp vpn-instance vpn-instance-name static command to check static ARP
mapping entries of a specified VPN instance.
Pre-configuration Tasks
Before optimizing dynamic ARP, complete the following tasks:
l
Issue 04 (2014-01-16)
Setting link layer protocol parameters for interfaces to ensure that the link layer protocol
status of the interfaces is Up
Huawei Proprietary and Confidential
Copyright Huawei Technologies Co., Ltd.
33
2 ARP Configuration
Aging time of dynamic ARP entries: When the aging time of a dynamic ARP entry is
reached, the device sends an ARP Request packet to the corresponding outbound interface
and starts ARP aging detection.If the value of the aging time is set too small (for example,
1 minute), the system consumes most resources on updating dynamic ARP entries and
cannot process other services.
Number of probes to dynamic ARP entries: Before aging a dynamic ARP entry, the system
first performs probes. If no answer is received after the times of probes reach the upper
limit, the ARP entry is deleted.
Aging detection modes of dynamic ARP entries: Before an ARP entry is aged, an interface
sends an ARP aging probe packet.
NOTE
l If the IP address of the peer device remains the same but the MAC address changes frequently,
it is recommended that you configure ARP aging probe packets to be broadcast.
l If the MAC address of the peer device remains the same, and the network bandwidth is
insufficient, it is recommended that you configure ARP aging probe packets to be unicast.
Procedure
Step 1 Run:
system-view
34
2 ARP Configuration
Procedure
Step 1 Run:
system-view
Run the display arp [ all | brief ] command to check all ARP mapping entries.
Run the display arp interface interface-type interface-number [ vid vlan-id [ cevid cevlanid ] ] command to check ARP mapping entries of a specified interface.
Run the display arp network net-number net-mask [ dynamic | static ] command to check
ARP mapping entries of a specified network segment.
Run the display arp dynamic command to check dynamic ARP mapping entries.
Run the display arp vpn-instance vpn-instance-name static command to check static ARP
mapping entries of a specified VPN instance.
Pre-configuration Tasks
Before configuring proxy ARP, complete the following task:
l
Issue 04 (2014-01-16)
Setting link layer protocol parameters for interfaces to ensure that the link layer protocol
status of the interfaces is Up
Huawei Proprietary and Confidential
Copyright Huawei Technologies Co., Ltd.
35
2 ARP Configuration
172.16.1.20/16
GE1/0/0
172.16.2.9/24
GE2/0/0
172.16.1.9/24
RouterA
HOSTB
HOST A sends an ARP Request packet, requesting the MAC address of HOST B. After receiving
the packet, RouterA uses its MAC address to reply the Request packet. HOST A then forwards
data using the MAC address of RouterA.
NOTICE
IP addresses of the STAhosts on a subnet have the same network ID. Therefore, the default
gateway address does not need to be configured on the STAhosts.
Procedure
Step 1 Run:
system-view
Issue 04 (2014-01-16)
36
2 ARP Configuration
Run the display arp interface interface-type interface-number [ vid vlan-id [ cevid cevlanid ] ] command to check ARP mapping entries of a specified interface.
HOSTA
172.16.2.20/24
VLAN10
HOSTB
172.16.2.30/24
HOSTA and HOSTB cannot communicate at Layer 2 because interface isolation in a VLAN is
configured on RouterA.
To solve this problem, enable intra-VLAN proxy ARP on the interfaces of RouterA. After an
interface of RouterA receives an ARP Request packet whose destination address is not its own
address, RouterA does not discard the packet but searches for the ARP entry. If the ARP entry
matching HOSTB exists, RouterA sends its MAC address to HOSTA and forwards packets sent
from HOSTA to HOSTB. RouterA functions as the proxy of HOSTB.
Issue 04 (2014-01-16)
37
2 ARP Configuration
Procedure
Step 1 Run:
system-view
Run the display arp interface interface-type interface-number [ vid vlan-id [ cevid cevlanid ] ] command to check ARP mapping entries of a specified interface.
HOSTA
172.16.2.20/24
RouterA
VLAN20
HOSTB
172.16.2.30/24
Interfaces connecting HOSTA and HOSTB to RouterA belong to different VLANs. Therefore,
HOSTA and HOSTB cannot communicate at Layer 2.
Issue 04 (2014-01-16)
38
2 ARP Configuration
To solve this problem, inter-VLAN proxy ARP needs to be enabled on interfaces of RouterA.
After an interface of RouterA receives an ARP Request packet whose destination address is not
its own address, RouterA does not discard the packet but searches for the ARP entry. If the ARP
entry matching HOSTB exists, RouterA sends its MAC address to HOSTA and forwards packets
sent from HOSTA to HOSTB. RouterA functions as the proxy of HOSTB.
Inter-VLAN proxy ARP implements the following functions:
l
Procedure
Step 1 Run:
system-view
Run the display arp interface interface-type interface-number [ vid vlan-id [ cevid cevlanid ] ] command to check ARP mapping entries of a specified interface.
Pre-configuration Tasks
Before configuring ARP-Ping, complete the following task:
l
Issue 04 (2014-01-16)
Configuring link layer protocol parameters and IP addresses for interfaces to ensure that
the link layer protocol status of the interfaces is Up.
Huawei Proprietary and Confidential
Copyright Huawei Technologies Co., Ltd.
39
2 ARP Configuration
Procedure
l
Run:
arp-ping ip ip-address [ interface interface-type interface-number ]
----End
Procedure
l
Run:
arp-ping mac mac-address { ip-address [ vpn-instance vpn-instance-name ] |
interface interface-type interface-number }
Check whether the MAC address is used. If the MAC address is in use, query the IP address
mapping the MAC address.
If the following information is displayed, the MAC address is not used.
<Huawei> arp-ping mac 00e0-517d-f201 interface gigabitethernet 1/0/0
OutInterface: GigabitEthernet1/0/0 MAC[00-E0-51-7D-F2-01], press CTRL_C
to break
Request timed out
Issue 04 (2014-01-16)
40
2 ARP Configuration
If the following information is displayed, it means that the MAC address is used.
<Huawei> arp-ping mac 00e0-517d-f202 interface gigabitethernet 1/0/0
OutInterface: GigabitEthernet1/0/0 MAC[00-E0-51-7D-F2-02], press CTRL_C
to break
----- ARP-Ping MAC statistics ----1 packet(s) transmitted
1 packet(s) received
IP ADDRESS
MAC ADDRESS
128.1.1.1
00-E0-51-7D-F2-02
----End
NOTICE
ARP entries cannot be restored after being cleared. When you delete static ARP entries, the
( arp static ) command is also deleted. Exercise caution when you delete the ARP entries.
Procedure
l
Run the reset arp { all | dynamic | interface interface-type interface-number | packet
statistics | static } command to clear ARP entries in the ARP mapping table.
Run the reset arp packet statistics command in user view to clear ARP packet statistics.
----End
Procedure
l
Issue 04 (2014-01-16)
Run the display arp [ all | brief ] command in any view to check all ARP mapping entries.
Huawei Proprietary and Confidential
Copyright Huawei Technologies Co., Ltd.
41
2 ARP Configuration
Run the display arp interface interface-type interface-number [ vid vlan-id [ cevid cevlanid ] ] command in any view to check ARP mapping entries of a specified interface.
Run the display arp network net-number net-mask [ dynamic | static ] command in any
view to check ARP mapping entries of a specified network segment.
Run the display arp vpn-instance vpn-instance-name static command in any view to
check static ARP mapping entries of a specified VPN instance.
Run the display arp statistics { all | interface interface-type interface-number } command
in any view to check ARP entry statistics.
Run the display arp packet statistics command in any view to check ARP packet statistics.
----End
Issue 04 (2014-01-16)
42
2 ARP Configuration
10.164.10.1/24
0df0-fc01-003a
GE3/0/0
10.164.10.10 /24
Etherent2/0/0
VLANIF10
10.164.1.20/24
10.164.1.1/24
00e0-fc01-0001
PC A
Router
10.164.2.0/24
10.164.1.0/24
VLAN20
VLAN10
10.164.3.0/24
VLAN30
Configuration Roadmap
The configuration roadmap is as follows:
1.
Configure static ARP entries for hosts in the headquarters office on the router to prevent
ARP entries of the hosts in the headquarters office from being modified in ARP attack
packets.
2.
Configure a static ARP entry for the file backup server on the router to prevent the ARP
entry of the file backup server from being modified in ARP attack packets.
Procedure
Step 1 Configure static ARP entries for the host in the headquarters office on the router.
# Create VLAN10.
<Huawei> system-view
[Huawei] sysname Router
[Router] vlan 10
[Router-vlan10] quit
43
2 ARP Configuration
# Configure static ARP entries for the host in the headquarters office. PC A is used as an example.
The IP address of PC A is 10.164.1.1 and maps the MAC address 00e0-fc01-0001; the VLAN
ID is 10 and the outbound interface is Ethernet2/0/0.
[Router] arp static 10.164.1.1 00e0-fc01-0001 vid 10 interface ethernet 2/0/0
# Configure static ARP entries for other hosts in the headquarters office. The configuration
method is similar to that of PC A.
Step 2 Configure a static ARP entry for the file backup server on the router.
# Configure an IP address for GE3/0/0.
[Router] interface gigabitethernet 3/0/0
[Router-GigabitEthernet3/0/0] ip address 10.164.10.10 255.255.255.0
[Router-GigabitEthernet3/0/0] quit
# Configure a static ARP entry for the file backup server: The IP address 10.164.10.1/24 maps
the MAC address 0df0-fc01-003a.
[Router] arp static 10.164.10.1 0df0-fc01-003a
[Router] quit
----End
Configuration Files
Only the configuration file of the router is provided.
#
sysname Router
#
vlan batch 10 20 30
#
interface Ethernet2/0/0
port hybrid tagged vlan 10
#
interface Vlanif10
ip address 10.164.1.20 255.255.255.0
#
interface GigabitEthernet3/0/0
ip address 10.164.10.10 255.255.255.0
#
arp static 10.164.1.1 00e0-fc01-0001 vid 10 interface Ethernet 2/0/0
arp static 10.164.10.1 0df0-fc01-003a
#
return
Issue 04 (2014-01-16)
44
2 ARP Configuration
RouterA
RouterD
RouterC
RouterB
Internet
Etherent2/0/0
Etherent2/0/0
VLAN10
Branch A
VLAN20
Branch B
Host A
172.16.1.2/16
0000-5e33-ee20
Host B
172.16.2.2/16
0000-5e33-ee10
Configuration Roadmap
The configuration roadmap is as follows:
1.
Add the interface connecting RouterA and branch A to VLAN10 and add the interface
connecting RouterB and branch B to VLAN20.
2.
Enable routed proxy ARP on VLANIF interfaces of branch A and branch B to implement
communication between the two branches.
Procedure
Step 1 Configure RouterA.
# Create VLAN10.
<Huawei> system-view
[Huawei] sysname RouterA
[RouterA] vlan 10
[RouterA-vlan10] quit
Issue 04 (2014-01-16)
45
2 ARP Configuration
ms
ms
ms
ms
ms
# View the ARP mapping table of HostA. You can see that the MAC address of HostB is the
MAC address of VLANIF10.
C:\Documents and Settings\Administrator> arp -a
Interface: 172.16.1.2 --- 0x2
Internet Address
Physical Address
Type
172.16.2.2
00e0-fc39-80aa
dynamic
----End
Configuration Files
l
Issue 04 (2014-01-16)
46
2 ARP Configuration
Router
Ethernet2/0/0
PC B
PC A
100.1.1.100/24
100.1.1.10/24
VLAN10
Accounting department
Configuration Roadmap
The configuration roadmap is as follows:
Issue 04 (2014-01-16)
47
2 ARP Configuration
1.
Configure interface isolation on the downstream interface of the switch to forbid Layer 2
communication and remove broadcast storms.
2.
Enable intra-VLAN proxy ARP on the VLANIF interface to prevent broadcast storms and
implement Layer 3 communication between hosts in the accounting department.
Procedure
Step 1 Add Etherent2/0/0 to VLAN10.
# Create VLAN10.
<Huawei> system-view
[Huawei] sysname Router
[Router] vlan 10
[Router-vlan10] quit
to break
ttl=255 time=10
ttl=255 time=10
ttl=255 time=10
ttl=255 time=10
ttl=255 time=10
ms
ms
ms
ms
ms
Issue 04 (2014-01-16)
48
2 ARP Configuration
----End
Configuration Files
Configuration file of the router
#
sysname Router
#
vlan batch 10
#
interface Vlanif10
ip address 100.1.1.12 255.255.255.0
arp-proxy inner-sub-vlan-proxy enable
#
interface Ethernet2/0/0
port hybrid tagged vlan 10
#
return
Router
VLAN2
VLAN3
VLAN4
VLAN2
VLAN3
Configuration Roadmap
The configuration roadmap is as follows:
Issue 04 (2014-01-16)
49
2 ARP Configuration
1.
2.
3.
4.
Procedure
Step 1 Configure a super-VLAN and sub-VLANs.
# Configure sub-VLAN2.
<Huawei> system-view
[Huawei] sysname Router
[Router] vlan 2
[Router-vlan2] quit
2/0/0
link-type access
default vlan 2
2/0/1
link-type access
default vlan 2
# Create sub-VLAN3.
[Router] vlan 3
[Router-vlan3] quit
2/0/2
link-type access
default vlan 3
2/0/3
link-type access
default vlan 3
Issue 04 (2014-01-16)
50
2 ARP Configuration
EXPIRE(M) TYPE
INTERFACE
VPN-INSTANCE
VLAN/CEVLAN
-----------------------------------------------------------------------------10.10.10.1
0018-2000-0083
I Vlanif4
10.10.10.2
00e0-fc00-0002 19
D-0
Ethernet2/0/0
2/10.10.10.3
00e0-fc00-0003 19
D-0
Ethernet2/0/1
2/10.10.10.4
00e0-fc00-0004 19
D-0
Ethernet2/0/2
3/10.10.10.5
00e0-fc00-0005 19
D-0
Ethernet2/0/3
3/-----------------------------------------------------------------------------Total:5
Dynamic:4
Static:0
Interface:1
----End
Configuration Files
Only the configuration file of the router is provided.
#
sysname Router
#
vlan batch 2 to 4
#
vlan 4
aggregate-vlan
access-vlan 2 to 3
#
interface Vlanif4
ip address 10.10.10.1 255.255.255.0
arp-proxy inter-sub-vlan-proxy enable
#
interface Ethernet2/0/0
port link-type access
port default vlan 2
#
interface Ethernet2/0/1
port link-type access
port default vlan 2
#
interface Ethernet2/0/2
port link-type access
port default vlan 3
#
interface Ethernet2/0/3
port link-type access
port default vlan 3
#
return
Issue 04 (2014-01-16)
51
2 ARP Configuration
Router
Etherent 2/0/0
PC A
10.1.1.1/24
Etherent 2/0/1
VLANIF100
10.1.1.2/24
VLAN100
PC B
10.1.1.3/24
Configuration Roadmap
The configuration roadmap is as follows:
1.
2.
Procedure
Step 1 Create VLAN100 and add two Ethernet interfaces to VLAN100 in default mode.
# Create VLAN100 and configure an IP address for the VLANIF interface.
<Huawei> system-view
[Huawei] sysname Router
[Router] vlan 100
[Router-vlan100] quit
[Router] interface vlanif 100
[Router-Vlanif100] ip address 10.1.1.2 24
[Router-Vlanif100] quit
Issue 04 (2014-01-16)
2/0/0
link-type access
default vlan 100
2/0/1
link-type access
default vlan 100
52
2 ARP Configuration
Step 3 Restart Ethernet2/0/0 and view changes of ARP entries and aging time.
# View ARP entries on the router. You can find the router has learned the MAC address of the
PC.
[Router] display arp all
IP ADDRESS
MAC ADDRESS
INSTANCE
EXPIRE(M)
TYPE
INTERFACE
VPN-
VLAN/CEVLAN PVC
----------------------------------------------------------------------------10.1.1.2
00e0-c01a-4900
I Vlanif100
10.1.1.1
00e0-c01a-4901 20
D-0
Ethernet2/0/0
10.1.1.3
00e0-de24-bf04 20
D-0
Ethernet2/0/1
----------------------------------------------------------------------------Total:3
Dynamic:2
Static:0
Interface:1
After 1 minute, run the shutdown command to shut down Ethernet2/0/0, simulate an interface
fault, and check the aging time of ARP entries. The command output shows that the ARP entries
learned from Ethernet2/0/0 are deleted after Ethernet2/0/0 is shut down.
[Router] interface ethernet 2/0/0
[Router-Ethernet2/0/0] shutdown
[Router-Ethernet2/0/0] display arp all
IP ADDRESS
MAC ADDRESS
EXPIRE(M) TYPE
INTERFACE
VPN-INSTANCE
VLAN/CEVLAN PVC
---------------------------------------------------------------------------10.1.1.2
00e0-c01a-4900
I Vlanif100
10.1.1.3
00e0-de24-bf04 19
D-0
Ethernet2/0/1
-----------------------------------------------------------------------------Total:2
Dynamic:1
Static:0
Interface:1
# Run the undo shutdown command to restart Ethernet2/0/0 and check the aging time of ARP
entries. The command output shows that Ethernet2/0/0 and Ethernet2/0/1 in VLAN100 update
ARP entries after Ethernet2/0/0 is restarted and becomes Up.
[Router] display arp all
IP ADDRESS
MAC ADDRESS
INSTANCE
EXPIRE(M)
TYPE
INTERFACE
VPN-
VLAN/CEVLAN PVC
----------------------------------------------------------------------------10.1.1.2
00e0-c01a-4900
I Vlanif100
10.1.1.1
00e0-c01a-4901 20
D-0
Ethernet2/0/0
10.1.1.3
00e0-de24-bf04 20
D-0
Ethernet2/0/1
----------------------------------------------------------------------------Total:3
Dynamic:2
Static:0
Interface:1
----End
Configuration Files
Configuration file of the router
#
sysname Router
#
l2-topolgy detect enable
#
vlan batch 100
#
interface Vlanif100
ip address 10.1.1.2 255.255.255.0
Issue 04 (2014-01-16)
53
2 ARP Configuration
#
interface Ethernet2/0/0
port link-type access
port default vlan 100
#
interface Ethernet2/0/1
port link-type access
port default vlan 100
#
return
2.8 FAQ
2.8.1 How Can I Configure Static ARP Entries on an Interface?
Based on the interface type, you can configure static ARP entries in the following methods:
l
For Layer 3 physical interfaces and Layer 3 Eth-Trunk interfaces, run the arp static ipaddress mac-address command to configure static ARPentries.
For example:
<Huawei> system-view
[Huawei] arp static 1.1.1.1 0000-1111-1111
For Dot1q termination sub-interfaces, run the arp static ip-address mac-address vid vlanid interface interface-type interface-number command to configure static ARP entries.
For example: # Configure a static ARP entry for a sub-interface for dot1q VLAN tag
termination. The static ARP entry's IP address 2.1.1.1 maps the MAC address 0edc-15e5f7e4. GE1/0/0.1 is added to VLAN 20.
# Configure a sub-interface for dot1q VLAN tag termination and add the sub-interface
to VLAN 20.
<Huawei> system-view
[Huawei] interface gigabitethernet 1/0/0.1
[Huawei-GigabitEthernet1/0/0.1] control-vid 100 dot1q-termination
[Huawei-GigabitEthernet1/0/0.1] dot1q termination vid 20
[Huawei-GigabitEthernet1/0/0.1] ip address 2.1.1.2 24
[Huawei-GigabitEthernet1/0/0.1] quit
NOTE
# Configure a static ARP entry for the sub-interface for dot1q VLAN tag termination.
[Huawei] arp static 2.1.1.1 0edc-15e5-f7e4 vid 20 interface
gigabitethernet1/0/0.1
For QinQ termination sub-interfaces, run the arp static ip-address mac-address vid vlanid cevid ce-vid interface interface-type interface-number command to configure static
ARP mapping entries with double tags.
For example: # Configure a static ARP entry for a sub-interface for QinQ VLAN tag
termination. The static ARP entry's IP address 2.1.1.1 maps the MAC address 0edc-15e5f7e4. The inner and outer VLAN IDs of the outbound interface GE1/0/0.1 are 20 and 10
respectively.
# Configure a sub-interface for QinQ VLAN tag termination and the inner and outer
VLAN IDs of the outbound interface GE1/0/0.1 are 20 and 10 respectively.
<Huawei> system-view
Issue 04 (2014-01-16)
54
2 ARP Configuration
# Configure a static ARP entry for the sub-interface for QinQ VLAN tag termination.
[Huawei] arp static 2.1.1.1 0edc-15e5-f7e4 vid 10 cevid 20 interface
gigabitethernet1/0/0.1
For VLANIF interfaces, run the arp static ip-address mac-address vid vlan-id interface
interface-type interface-number command to configure static ARP entries.
For example:
<Huawei> system-view
[Huawei] arp static 192.168.1.88 0000-1111-1111 vid 4094 interface ethernet
0/0/7
NOTE
The outbound interface here indicates the Layer 2 interface bound to the VLAN.
In AR V2R2C01 or later versions, the VLANIF interface supports short ARP entries. You
can directly configure the mapping between the IP address and MAC address without
specifying the VID and outbound interface.
For example:
<Huawei> system-view
[Huawei] arp static 192.168.1.88 0000-1111-1111
2.9 References
The following table lists the references of this document.
Issue 04 (2014-01-16)
Docume
nt
Description
Remarks
RFC826
RFC903
RFC1027
55
Issue 04 (2014-01-16)
2 ARP Configuration
Docume
nt
Description
Remarks
RFC1042
56
3 DHCP Configuration
DHCP Configuration
Issue 04 (2014-01-16)
57
3 DHCP Configuration
Purpose
As the network expands and becomes complex, the number of hosts often exceeds the number
of available IP addresses. As portable computers and wireless networks are widely used, the
positions of computers often change, causing IP addresses of the computers to be changed
accordingly. As a result, network configurations become increasingly complex. To properly and
dynamically assign IP addresses to hosts, DHCP is used.
DHCP is developed based on the BOOTstrap Protocol (BOOTP). BOOTP runs on networks
where each host has a fixed network connection. The administrator configures a BOOTP
parameter file for each host, and the file remains unchanged for a long period of time. DHCP
has the following new features compared with BOOTP:
l
Enables a host to obtain an IP address dynamically, but does not specify an IP address for
each host.
DHCP rapidly and dynamically allocates IP addresses, which improves IP address usage.
3.2 Principles
3.2.1 DHCP Overview
DHCP uses the client/server model. A DHCP client sends a packet to a DHCP server to request
configuration parameters such as the IP address, subnet mask, and default gateway address. The
DHCP server responds with a packet carrying the requested configurations based on a policy.
DHCP Architecture
Figure 3-1 shows the DHCP architecture.
Figure 3-1 DHCP architecture
DHCP Client
DHCP Server
DHCP Relay
IP Network
58
3 DHCP Configuration
DHCP Client
A DHCP client exchanges messages with a DHCP server to obtain an IP address and other
configuration parameters. On the device, an interface can function as a DHCP client to
dynamically obtain configuration parameters such as an IP address from a DHCP server.
This facilitates configurations and centralized management.
DHCP Relay
A DHCP relay agent forwards DHCP packets exchanged between a DHCP client and a
DHCP server that are located on different network segments so that they can complete their
address configuration. Using a DHCP relay agent eliminates the need for deploying a DHCP
server on each network segment. This feature reduces network deployment costs and
facilitates device management.
In the DHCP architecture, the DHCP relay agent is optional. A DHCP relay agent is required
only when the server and client are located on different network segments.
DHCP Server
A DHCP server processes requests of address allocation, address lease extending, and
address releasing from a DHCP client or a DHCP relay agent, and allocates IP addresses
and other network configuration parameters to the DHCP client.
0
op(1)
23
15
7
htype (1)
hlen (1)
31
hops (1)
xid (4)
secs (2)
flags (2)
ciaddr (4)
yiaddr (4)
siaddr (4)
giaddr (4)
chaddr (16)
sname (64)
file (128)
options (variable)
Issue 04 (2014-01-16)
59
3 DHCP Configuration
In Figure 3-2, numbers in the round brackets indicate the field length, expressed in bytes.
Table 3-1 Description of each field in a DHCP message
Field
Length
Description
op(op code)
1 byte
htype
(hardware
type)
1 byte
Indicates the hardware address type. For Ethernet, the value of this
field is 1.
hlen
(hardware
length)
1 byte
hops
1 byte
xid
4 bytes
secs
(seconds)
2 bytes
flags
2 bytes
Indicates the Flags field. Only the leftmost bit of the Flags field is
valid and other bits are set to 0. The leftmost bit determines whether
the DHCP server unicasts or broadcasts a DHCP Reply message.
The options are as follows:
l 0: The DHCP server unicasts a DHCP Reply message.
l 1: The DHCP server broadcasts a DHCP Reply message.
ciaddr
(client ip
address)
4 bytes
yiaddr
(your client
ip address)
Issue 04 (2014-01-16)
4 bytes
60
3 DHCP Configuration
Field
Length
Description
siaddr
(server ip
address)
4 bytes
giaddr
(gateway ip
address)
4 bytes
Indicates the IP address of the first DHCP relay agent. If the DHCP
server and client are located on different network segments, the first
DHCP relay agent fills its IP address into this field of the DHCP
Request message sent by the client and forwards the message to the
DHCP server. The DHCP server determines the network segment
where the client resides based on this field, and assigns an IP address
on this network segment from an address pool.
The DHCP server also returns a DHCP Reply message to the first
DHCP relay agent. The DHCP relay agent then forwards the DHCP
Reply message to the client.
NOTE
If the DHCP Request message passes through multiple DHCP Relay agents
before reaching the DHCP server, the value of this field is the IP address of
the first DHCP relay agent and remains unchanged. However, the value of
the Hops field increases by 1 each time a DHCP Request message passes
through a DHCP relay agent.
chaddr
(client
hardware
address)
16 bytes Indicates the client MAC address. This field must be consistent with
the hardware type and hardware length fields. When sending a
DHCP Request message, the client fills its hardware address into
this field. For Ethernet, a 6-byte Ethernet MAC address must be
filled in this field when the hardware type and hardware length fields
are set to 1 and 6 respectively.
sname
(server host
name)
64 bytes Indicates the name of the server from which a client obtains
configuration parameters. This field is optional and is filled in by
the DHCP server. The field must be filled in with a character string
that ends with 0.
file (file
name)
128
bytes
options
Variabl
e
61
3 DHCP Configuration
Description
DHCP
DISCOVER
DHCP OFFER
DHCP
REQUEST
DHCP ACK
DHCP NAK
DHCP
DECLINE
DHCP
RELEASE
DHCP
INFORM
62
3 DHCP Configuration
15
Length
Type
Value
The Options field consists of Type, Length, and Value. The following table provides the details.
Table 3-3 Description of the Options field
Field
Length
Description
Type
1 byte
Length
1 byte
Value
The value of the Options field ranges from 1 to 255. Table 3-4 lists common DHCP options.
Table 3-4 Description of the Options field in DHCP packets
Issue 04 (2014-01-16)
Options No.
Function
12
15
33
44
46
50
51
63
3 DHCP Configuration
Options No.
Function
52
53
54
55
58
Specifies the lease renewal time (T1), which is 50% of the lease
time.
59
60
61
66
67
77
121
The objects of this field vary with the functions of the Options field. For example, Option 77 is
used on a DHCP client to identify user types of the DHCP client. The DHCP server selects an
address pool to allocate an IP address and configuration parameters to the DHCP client based
on the User Class in the Option field. Option 77 is manually configured only on the DHCP client
but not on the server.
NOTE
When the device functions as the DHCP client, the client can identify the Option121 field describing static routes
in the DHCP packet sent by the DHCP server.
For more information about common DHCP options, see RFC 2132.
64
3 DHCP Configuration
Option 82 field to a DHCP Request message sent from a DHCP client, and then forwards the
DHCP Request message to a DHCP server.
You can use the Option 82 field to locate a DHCP client and implement control security and
accounting of the DHCP client. The DHCP server that supports the Option 82 field can determine
allocation of IP addresses and other parameters according to the information in the Option 82
field. IP addresses can be assigned flexibly.
The Option 82 field contains a maximum of 255 suboptions. If the Option 82 field is defined,
at least one suboption must be defined. Currently, the device supports only two suboptions: suboption 1 (circuit ID) and suboption 2 (remote ID).
The content of the Option 82 field is not defined uniformly, and various vendors fill in the Option
82 field as required.
Client
Step1
Server
DHCP DISCOVER
broadcast
DHCP OFFER
Step3
Step2
DHCP REQUEST
broadcast
Step4
As shown in Figure 3-4, when a DHCP client accesses the network for the first time, the
DHCP client sets up a connection with a DHCP server through the following four stages.
Discovery stage: The DHCP client searches for the DHCP server.
In this stage, the DHCP client sends a DHCP Discover message to search for the DHCP
server. The DHCP server address is unknown to the client, so the DHCP client
broadcasts the DHCP Discover message. All the DHCP servers send Reply messages
after they receive the Discover message. In this way, the DHCP client knows locations
of the DHCP servers on the network.
Issue 04 (2014-01-16)
65
3 DHCP Configuration
Offer stage: The DHCP server offers an IP address to the DHCP client.
The DHCP server receives the DHCP Discover message, selects an IP address from the
address pool, and sends a DHCP Offer message to the DHCP client. The Offer message
carries information such as the IP address, lease of the IP address, gateway address, and
DNS server address.
Request stage: The DHCP client selects an IP address.
If multiple DHCP servers send DHCP Offer messages to the DHCP client, the client
receives the first DHCP Offer message. Then the client broadcasts a DHCP Request
message including the information about the DHCP server address (Option 54 field).
The client broadcasts a DHCP Request message to notify all the DHCP servers that the
client uses the IP address provided by the DHCP server in the Option 54 field and that
all the other servers can use the assigned IP addresses.
Acknowledgment stage: The DHCP server acknowledges the IP address that is offered.
When the DHCP server receives the DHCP Request message from the DHCP client,
the server searches the lease record based on the MAC address in the Request message.
If there is the IP address record, the server sends a DHCP ACK message to the client,
carrying the IP address and other configurations. After receiving the DHCP ACK
message, the DHCP client broadcasts gratuitous ARP packets to detect whether any
host is using the IP address assigned by the DHCP server. If no response is received
within the specified time, the DHCP client uses the IP address.
If there is no IP address record or the server cannot assign IP addresses, the server sends
a DHCP NAK message to notify the DHCP client that the server cannot assign IP
addresses. The DHCP client needs to send a new DHCP Discover message to request
a new IP address.
After obtaining the IP address, the DHCP client checks the status of the gateway in use
before the client goes online. If the gateway address is incorrect or the gateway device
fails, the DHCP client requests a new IP address using the four modes for interaction.
l
Client
Step1
Server
DHCP REQUEST
broadcast
Step2
As shown in Figure 3-5, when the DHCP client accesses a network for the second time, it
set ups a connection with the DHCP server in the following procedure.
The client accesses a network for the second time with the IP address that does not
expire. The client does not need to send a DHCP Discover message again. It directly
Issue 04 (2014-01-16)
66
3 DHCP Configuration
sends a DHCP Request message carrying the IP address assigned in the first time,
namely, the Option 50 field in the message.
After receiving the DHCP Request message, if the requested IP address is not assigned
to another DHCP client, the DHCP server sends a DHCP ACK message to instruct the
DHCP client to use the IP address again.
If the IP address cannot be assigned to the DHCP client, for example, it has been assigned
to another DHCP client, the DHCP server sends a DHCP NAK message to the DHCP
client. After receiving the DHCP NAK message, the DHCP client sends a DHCP
Discover message to request a new IP address.
l
Default Value
Lease renewal
Rebinding
Lease expiration
Overall lease
Figure 3-6 Procedure for a DHCP client to renew the IP address lease
Client
T1
T2
Server
DHCP REQUEST
unicast
DHCP REQUEST
broadcast
Issue 04 (2014-01-16)
67
3 DHCP Configuration
As shown in Figure 3-6, when the DHCP client renews the IP address lease, it set ups a
connection with the DHCP server in the following procedures:
When 50% of the IP address lease (T1) has passed, the DHCP client unicasts a DHCP
Request message to the DHCP server to renew the lease. If the client receives a DHCP
ACK message, the address lease is successfully renewed. If the client receives a DHCP
NAK message, it sends a request again.
When 87.5% of the IP address lease (T2) has passed and the client has not received the
Reply message, the DHCP client automatically sends a broadcast message to the DHCP
server to renew the IP address lease. If the client receives a DHCP ACK message, the
address lease is successfully renewed. If the client receives a DHCP NAK message, it
sends a request again.
If the client has not received a Reply message from the server when the IP address lease
expires, the client must stop using the current IP address and send a DHCP Discover
message to request a new IP address.
l
Client
Step1
Step2
Step3
Step4
Issue 04 (2014-01-16)
DHCP Server
DHCP Relay
DHCP DISCOVER
(Broadcast)
DHCP DISCOVER
(Unicast)
DHCP OFFER
DHCP OFFER
(Unicast)
DHCP REQUEST
(Broadcast)
DHCP REQUEST
(Unicast)
DHCP ACK/DHCPNAK
DHCP ACK/DHCPNAK
(Unicast)
68
3 DHCP Configuration
Figure 3-7 shows the working process of a DHCP relay agent. The DHCP client sends a Request
message to the DHCP server. When receiving the message, the DHCP relay agent processes and
unicasts the message to the specified DHCP server on the other network segment. The DHCP
server sends requested configurations to the client through the DHCP relay agent based on
information in the Request message.
1.
After receiving a DHCP Discover message or a Request message, the DHCP relay agent
performs the following operations:
l Discards DHCP Request messages whose number of hops is larger than the hop limit
to prevent loops. Or, increases the value of the hop by 1, indicating that the message
passes through a DHCP relay agent.
l Checks the giaddr field. If the value is 0, set the value of the giaddr field to the IP address
of the interface which receives the Request message. Selects one IP address if the
interface has multiple IP addresses. All the Request messages received by the interface
later use this IP address to fill the giaddr field. If the value is not 0, do not change the
value.
l Sets the TTL in the request packets to the default value in the DHCP relay device, not
the value calculated by decreasing the original TTL by 1. You can change the value of
the hops field to prevent loops and limit hops.
l Changes the destination IP address of the DHCP Request message to the IP address of
the DHCP server or the IP address of the next DHCP relay agent. In this way, the DHCP
Request message can be forwarded to the DHCP server or the next DHCP relay agent.
2.
The DHCP server assigns IP addresses to the client based on the Relay Agent IP Address
field and sends the DHCP Reply message to the DHCP relay agent specified in the Relay
Agent IP Address field. After receiving the DHCP Reply message, the DHCP relay agent
performs the following operations:
l The DHCP relay agent assumes that all the Reply messages are sent to the directlyconnected DHCP clients. The Relay Agent IP Address field identifies the interface
directly connected to the client. If the value of the Relay Agent IP Address field is not
the IP address of a local interface, the DHCP relay agent discards the Reply message.
l The DHCP relay agent checks the broadcast flag bit of the message. If the broadcast
flag bit is 1, the DHCP relay agent broadcasts the DHCP Reply message to the DHCP
client; otherwise, the DHCP relay agent unicasts the DHCP Reply message to the DHCP
client. The destination IP address is the value in the Your (Client) IP Address field, and
the MAC address is the value in the Client Hardware Address field.
Figure 3-8 shows how a DHCP client extends the IP address lease through the DHCP relay
agent.
Figure 3-8 Extending the IP address lease through the DHCP relay agent
DHCP Client
Step1
DHCP Relay
DHCP RESQUEST(Unicast)
DHCP ACK/DHCPNAK (Unicast)
Issue 04 (2014-01-16)
DHCP Server
Step2
69
3 DHCP Configuration
1.
After accessing the network for the first time, the DHCP client only needs to unicast a
DHCP Request message to the DHCP server that assigned its currently-used IP address.
2.
The DHCP server then directly unicasts a DHCP ACK message or a DHCP NAK message
to the client.
DHCP Releasing
The DHCP relay agent, instead of the client, can send a Release message to the DHCP server to
release the IP addresses that assigned to the DHCP clients. You can configure a command on
the DHCP relay agent to release the IP addresses that the DHCP server assigns to the DHCP
client.
IP address that is in the database of the DHCP server and is statically bound to the MAC
address of the client
IP address that has been assigned to the client before, that is, IP address in the Requested
IP Addr Option of the DHCP Discover message sent by the client
IP address that is first found when the DHCP server searches the DHCP address pool for
available IP addresses
If the DHCP address pool has no available IP address, the DHCP server searches the expired
IP addresses and conflicting IP addresses, and then assigns a valid IP address to the client.
If all the IP addresses are in use, an error is reported.
IP Address Reservation
DHCP supports IP address reservation for clients. The reserved IP addresses can be those in the
address pool or not. If an address in the address pool is reserved, it is no longer assignable.
Addresses are usually reserved for DNS servers.
70
3 DHCP Configuration
3.3 Application
3.3.1 DHCP Server Application
As it is shown in Figure 3-9, a DHCP server and multiple DHCP clients (such as PCs and
portable computers) are deployed.
Figure 3-9 Typical networking of the DHCP server
DHCP Clients
DHCP Server
DHCP Clients
Generally, the DHCP server is used to assign IP addresses in the following scenarios:
Issue 04 (2014-01-16)
71
3 DHCP Configuration
On a large network, manual configurations take a long time and bring difficulties to
centralized management over the entire network.
Hosts on the network are more than available IP addresses. Thus, not every host has a fixed
IP address. Many hosts need to dynamically obtain IP addresses through the DHCP server.
In addition, network administrators hope that there is a limit to the number of users of online at the same time.
Internet
DHCP Relay
DHCP Server
DHCP Clients
The earlier DHCP protocol applies to only the scenario that the DHCP client and DHCP server
are on the same network segment. To dynamically assign IP addresses to hosts on network
segments, the network administrator needs to configure a DHCP server on each network
segment, which increases costs.
The DHCP relay function is introduced to solve this problem. A DHCP client can apply to the
DHCP server on another network segment to obtain a valid IP address. In this manner, DHCP
clients on multiple network segments can share one DHCP server. This reduces costs and
facilitates centralized management.
RouterA
DHCP Client
RouterC
DHCP Server
RouterB
BOOTP Client
Issue 04 (2014-01-16)
72
3 DHCP Configuration
As it is shown in Figure 3-11, when the DHCP/BOOTP client function is configured on the
device Layer 3 interface, the device dynamically obtains IP addresses and other network
configuration parameters from the DHCP server. This operation facilitates user configurations
and management.
The DHCP server can communicate with the BOOTP client, so you do not need to configure
the BOOTP server. The DHCP server allocates IP addresses to BOOTP clients.
Default Value
500 ms
IP address lease
1 day
300s
100 pps
Pre-configuration Tasks
Before configuring a DHCP server based on the global address pool, complete the following
tasks:
l
Ensuring that the link between the DHCP client and the device works properly and the
DHCP client can communicate with the device
Configuring routes from the device to the DNS server and the NetBIOS server (The routes
are required only when the servers are configured.)
Issue 04 (2014-01-16)
73
3 DHCP Configuration
Procedure
Step 1 Run:
system-view
A global address pool is created and the global address pool view is displayed.
By default, no global address pool exists on the router.
Step 3 Run:
network ip-address [ mask { mask | mask-length } ]
The range of IP addresses that can be allocated dynamically in the global address pool is
specified.
By default, no network segment address for a global address pool is specified.
An address pool can contain only one address segment. The address range of the address pool
is set by the mask.
NOTE
When configuring the range of dynamically assignable IP addresses in the global address pool, ensure that the
range is the same as the network segment on which the DHCP server interface address or the DHCP relay agent
interface address resides. This avoids incorrect assignment of IP addresses.
The IP addresses that cannot be automatically allocated in the global address pool are configured.
By default, all IP addresses in the address pool can be automatically assigned to clients.
Some IP addresses in the global address pool are reserved for other services, for example, the
IP address of the DNS server cannot be allocated to clients. If you run this command multiple
Issue 04 (2014-01-16)
74
3 DHCP Configuration
times, you can set multiple IP address ranges that cannot be automatically allocated in the DHCP
address pool.
Step 6 (Optional) Run:
gateway-list ip-address &<1-8>
An IP address in the global address pool is statically bound to the MAC address of a DHCP
client.
By default, the IP address in a global address pool is not bound to any MAC address.
When a client requires a fixed IP address, bind an idle IP address in the address pool to the client
MAC address.
NOTE
When the IP address in the global address pool is statically bound to a MAC address, the IP address must be in
the range of IP addresses that can be allocated dynamically.
Issue 04 (2014-01-16)
75
3 DHCP Configuration
DHCP is enabled.
NOTE
When the device functions as the DHCP server and the STP function is enabled, address allocation may be slow.
By default, the STP function is enabled. If the STP function is not required, run the undo stp enable command
to disable it.
Step 3 Run:
interface interface-type interface-number [.subinterface-number ]
76
3 DHCP Configuration
DHCP Request message to obtain an IP address. If the IP address does not match the
corresponding address pool, the user cannot get online.
Step 5 Run:
dhcp select global
3.5.1.3 (Optional) Configuring the DNS Service and NetBIOS Service on the DHCP
Client
Context
To ensure normal operations of DHCP clients, you can specify the DNS server address and the
NetBIOS server address when the DHCP server assigns an IP address to the DHCP client. If
you do not have the configurations assigned by the carrier, the DHCP server dynamically assigns
the DNS and NetBIOS configurations to the DHCP client.
NOTE
The configuration of the DNS server and NetBIOS server can be obtained statically or dynamically. If both
static and dynamic configurations are available, the static configurations takes effect.
NetBIOS:Network Basic Input Output System. When a DHCP client uses the NetBIOS protocol
for communication, host names must be mapped to IP addresses. Based on the modes of
obtaining mapping, NetBIOS nodes are classified into the following types:
l
b-node: indicates a node in broadcast mode. This node obtains mappings in broadcast mode.
m-node: indicates a node in mixed mode. An m-node is a p-node that has some broadcast
features.
h-node: indicates a node in hybrid mode. An h-node is a b-type node enabled with the endto-end communication mechanism.
Procedure
Step 1 Run:
system-view
The DNS and NetBIOS configurations used by the DHCP client are dynamically configured.
Issue 04 (2014-01-16)
77
3 DHCP Configuration
NOTE
If you want to use a specified DNS server and NetBIOS server, you can statically configure parameters of
the DNS server and NetBIOS server for the DHCP client.
Step 4 Run:
domain-name domain-name
The IP address of the NetBIOS server used by the DHCP client is assigned.
Each address pool can be configured with a maximum of eight NetBIOS server address.
Step 7 Run:
netbios-type { b-node | h-node | m-node | p-node }
3.5.1.4 (Optional) Configuring a Customized DHCP Option for the Global Address
Pool
Context
DHCP provides various options. To use these options, add them to the attribute list of the DHCP
server manually. If the DHCP server is configured with the Options field, the DHCP client
obtains the configuration of the Options field from the DHCP packet replied by the DHCP server
when the client requests an IP address from the server.
Procedure
Step 1 Run:
system-view
78
3 DHCP Configuration
option code [ sub-option sub-code ] { ascii ascii-string | hex hex-string | ipaddress ip-address &<1-8> }
Procedure
Step 1 Run:
system-view
The period in which the router waits for the response is set.
By default, the period in which the router waits for the response is 500 ms.
----End
Issue 04 (2014-01-16)
79
3 DHCP Configuration
Procedure
Step 1 Run:
system-view
The function that saves DHCP data to the storage device is enabled.
By default, DHCP data is not saved to the storage device.
After this command is executed, the system generates the lease.txt and conflict.txt files and
saves them in the dhcp folder of the storage device. The two files save the address lease
information and address conflict information. Run the command display dhcp server
database to check the storage device for saving DHCP data.
Step 3 Run:
dhcp server database write-delay interval
80
3 DHCP Configuration
Step 2 Run:
dhcp server trust option82
Run the display dhcp server database command to check information about the DHCP
database.
Run the display ip pool import all command to check parameters that the DHCP server
dynamically allocates to the DHCP client, such as DNS parameters.
----End
Pre-configuration Tasks
Before configuring a DHCP server based on an interface address pool, complete the following
tasks:
l
Ensuring that the link between the DHCP client and the device works properly and the
DHCP client can communicate with the device
Configuring routes from the device to the DNS server and the NetBIOS server (The routes
are required only when the servers are configured.)
81
3 DHCP Configuration
Procedure
Step 1 Run:
system-view
DHCP is enabled.
NOTE
When the device functions as the DHCP server and the STP function is enabled, address allocation may be slow.
By default, the STP function is enabled. If the STP function is not required, run the undo stp enable command
to disable it.
Step 3 Run:
interface interface-type interface-number [.subinterface-number ]
The IP addresses that cannot be automatically allocated in the interface address pool are
configured.
Some IP addresses in the interface address pool are reserved for other services, for example, the
IP address of the DNS server cannot be allocated to clients. If you run this command multiple
times, you can set multiple IP address ranges that cannot be automatically allocated in the DHCP
address pool.
Step 8 (Optional) Run:
dhcp server static-bind ip-address ip-address mac-address mac-address
An IP address in the interface address pool is statically bound to the MAC address of a DHCP
client.
Issue 04 (2014-01-16)
82
3 DHCP Configuration
When a client requires a fixed IP address, bind an idle IP address in the address pool to the client
MAC address.
NOTE
When the IP address in the interface address pool is statically bound to a MAC address, the IP address must be
in the range of IP addresses that can be allocated dynamically.
Step 9 Run:
dhcp server next-server ip-address
The IP address of a server is configured for the client after the client automatically obtains the
IP address.
By default, the IP address of a server is not configured for the client after the client automatically
obtains the IP address.
Step 10 Run:
quit
3.5.2.2 (Optional) Configuring the DNS Service and NetBIOS Service on the DHCP
Client
Context
The DNS and NetBIOS configurations must be specified before the DHPC server assigns IP
addresses to the DHCP client. If you do not have the configurations assigned by the carrier, the
DHCP server dynamically assigns the DNS and NetBIOS configurations to the DHCP client.
NOTE
When both dynamic and static configurations of DNS and NetBIOS are available in the IP address pool,
the static configurations take effect.
Issue 04 (2014-01-16)
83
3 DHCP Configuration
Procedure
Step 1 Run:
system-view
The DNS and NetBIOS configurations used by the DHCP client are dynamically configured.
NOTE
If you want to use a specified DNS server and NetBIOS server, you can statically configure parameters of
the DNS server and NetBIOS server for the DHCP client.
Step 4 Run:
dhcp server domain-name domain-name
The IP address of the NetBIOS server used by the DHCP client is assigned.
Each address pool can be configured with a maximum of eight NetBIOS server addresses.
Step 7 Run:
dhcp server netbios-type { b-node | h-node | m-node | p-node }
84
3 DHCP Configuration
Procedure
Step 1 Run:
system-view
Procedure
Step 1 Run:
system-view
85
3 DHCP Configuration
Step 3 Run:
dhcp server ping timeout milliseconds
The period in which the router waits for the response is set.
By default, the period in which the router waits for the response is 500 ms.
----End
Procedure
Step 1 Run:
system-view
The function that saves DHCP data to the storage device is enabled.
By default, DHCP data is not saved to the storage device.
After this command is executed, the system generates the lease.txt and conflict.txt files and
saves them in the dhcp folder of the storage device. The two files save the address lease
information and address conflict information. Run the command display dhcp server
database to check the storage device for saving DHCP data.
Step 3 Run:
dhcp server database write-delay interval
86
3 DHCP Configuration
Run the display ip pool [ interface interface-pool-name [ start-ip-address [ end-ipaddress ] | all | conflict | expired | used ] ] command to view information about the IP
address pool.
----End
Pre-configuration Tasks
Before configuring a DHCP relay agent, complete the following tasks:
l
Configuring a route from the device used as the DHCP relay agent to the DHCP server
Configuration Process
Figure 3-12 shows the configuration process.
Issue 04 (2014-01-16)
87
3 DHCP Configuration
Configuring a Destination
DHCP Server Group
Binding an Interface to a
DHCP Server Group
A DHCP message is forwarded between a DHCP client and a DHCP server at most 16 times, and then the
DHCP message is discarded.
If DHCP relay is enabled in a super-VLAN, DHCP snooping cannot be enabled in this super-VLAN.
Procedure
Step 1 Run:
system-view
DHCP is enabled.
NOTE
When the device functions as a DHCP relay agent and the STP function is enabled, address allocation may be
slow. By default, the STP function is enabled. If the STP function is not required, run the undo stp enable
command to disable it.
Issue 04 (2014-01-16)
88
3 DHCP Configuration
When the DHCP relay function is enabled on the sub-interface, run arp broadcast enable to enable the ARP
broadcast function on a sub-interface. By default, ARP broadcast is disabled on a VLAN tag termination subinterface.
Step 7 Run:
quit
Follow-up Procedure
When the DHCP relay function is enabled on an interface, specify the DHCP server IP address
on the interface in either of the following ways:
l
Configure a destination DHCP server group and bind the group to the interface. For details,
see 3.5.3.2 Configuring a Destination DHCP Server Group and 3.5.3.3 Binding an
Interface to a DHCP Server Group.
Run the dhcp relay server-ip ip-address command in the interface view to configure the
destination DHCP server address.
89
3 DHCP Configuration
Procedure
Step 1 Run:
system-view
A DHCP server group is created and the DHCP server group view is displayed.
You can configure a maximum of 64 DHCP server groups in the system, and a maximum of 8
DHCP servers in a DHCP server group.
Step 3 Run:
dhcp-server ip-address [ ip-address-index ]
Procedure
Step 1 Run:
system-view
90
3 DHCP Configuration
One interface can be configured with only one DHCP server group.
----End
3.5.3.4 (Optional) Configuring the DHCP Relay Agent to Send DHCP Release
Messages
Context
If a user is forcibly disconnected, you can manually release the IP address assigned to the user
on the DHCP server. You can configure the DHCP relay agent to actively send DHCP Release
messages to the DHCP server. The DHCP server then releases the specified IP addresses.
Procedure
Step 1 Run:
system-view
The DHCP relay agent is configured to send DHCP Release messages to the DHCP server.
l When you use the dhcp relay release command in the system view:
If no DHCP server is specified, the DHCP relay agent will send DHCP Release messages
to the servers in all DHCP server groups bound to the DHCP relay interfaces.
If a DHCP server is specified, the DHCP relay agent sends DHCP Release messages to
only the specified DHCP server.
l When you use the dhcp relay release command in the interface view:
If no DHCP server is specified, the DHCP relay agent will send DHCP Release messages
to all the servers in the DHCP server group bound to this interface.
If a DHCP server is specified, the DHCP relay agent sends DHCP Release messages to
only the specified DHCP server.
NOTE
----End
Issue 04 (2014-01-16)
91
3 DHCP Configuration
Run the display dhcp relay { all | interface interface-type interface-number } command
to view the DHCP server group or the DHCP servers on the DHCP relay interface.
Run the display dhcp server group [ group-name ] command to view the DHCP server
group configuration.
----End
Pre-configuration Tasks
Before configuring the DHCP/BOOTP client function, complete the following tasks:
l
Configuring a route from the router to the DHCP relay agent or server
Procedure
l
Run:
system-view
Run:
dhcp enable
DHCP is enabled.
3.
Run:
dhcp client class-id class-id
The Option60 field in the DHCP request packet sent by the DHCP client is set.
By default, the default value of the Option60 field depends on the device type, which
is huawei-device name. The device name is configured using the sysname command.
4.
Issue 04 (2014-01-16)
Run:
Huawei Proprietary and Confidential
Copyright Huawei Technologies Co., Ltd.
92
3 DHCP Configuration
Run:
dhcp client hostname hostname
Run:
dhcp client client-id client-id
Run:
dhcp client class-id class-id
The Option60 field in the DHCP request packet sent by the DHCP client is set.
8.
Run:
dhcp client gateway-detect period period retransmit retransmit timeout time
Run:
dhcp client expected-lease time
Run:
system-view
Run:
dhcp enable
DHCP is enabled.
3.
Run:
interface interface-type interface-number
Run:
dhcp client hostname hostname
Issue 04 (2014-01-16)
93
3 DHCP Configuration
Procedure
Step 1 Run:
system-view
The priority of the routing entry delivered by the DHCP server to a DHCP client is set.
By default, the priority of the routing entry delivered by the DHCP server to a DHCP client is
60.
----End
Procedure
l
Run:
system-view
Run:
Huawei Proprietary and Confidential
Copyright Huawei Technologies Co., Ltd.
94
3 DHCP Configuration
dhcp enable
DHCP is enabled.
3.
Run:
interface interface-type interface-number
Run:
ip address dhcp-alloc
Run:
system-view
Run:
dhcp enable
DHCP is enabled.
3.
Run:
interface interface-type interface-number
Run:
ip address bootp-alloc
Run the display this command on the interface enabled with the DHCP client function to
view configurations of DHCP/BOOTP clients.
Run the display dhcp client command to view the DHCP/BOOTP client information.
----End
Pre-configuration Tasks
Before limiting the rate of sending packets, complete the following tasks:
l
Issue 04 (2014-01-16)
95
3 DHCP Configuration
Configure the highest rate at which DHCP packets are sent to the protocol stack in the
system view.
Procedure
1.
Run:
system-view
Run:
dhcp enable
Run:
dhcp check dhcp-rate enable [ vlan { vlan-id1 [ to vlan-id2 ] } &<1-10> ]
Run:
dhcp check dhcp-rate rate [ vlan { vlan-id1 [ to vlan-id2 ] } &<1-10> ]
The checking rate of DHCP messages sent to the DHCP protocol stack is configured.
By default, the rate does not exceed 100 pps. The DHCP messages that exceed the
rate are discarded.
l
Configure the highest rate at which DHCP packets are sent to the protocol stack in the
VLAN view.
1.
Run:
system-view
Run:
dhcp enable
Run:
vlan vlan-id
Run:
dhcp check dhcp-rate enable
Run:
dhcp check dhcp-rate rate
The checking rate of DHCP messages sent to the DHCP protocol stack is configured.
Issue 04 (2014-01-16)
96
3 DHCP Configuration
By default, the checking rate of DHCP messages sent to the DHCP protocol stack is
not configured.
l
Configure the highest rate at which DHCP packets are sent to the protocol stack in the
interface view.
1.
Run:
system-view
Run:
interface interface-type interface-number
Run:
dhcp check dhcp-rate enable
Run:
dhcp check dhcp-rate rate
The checking rate of DHCP messages sent to the DHCP protocol stack is configured.
By default, the checking rate of DHCP messages sent to the DHCP protocol stack is
not configured.
5.
(Optional) Run:
dhcp alarm dhcp-rate enable
(Optional) Run:
dhcp alarm dhcp-rate threshold threshold
The alarm threshold for the DHCP message checking on an interface is configured.
By default, the alarm threshold for the DHCP message checking on an interface is not
configured.
NOTE
You can set the maximum rate of sending DHCP messages globally, in a VLAN, or on an interface.
If the maximum rate of sending DHCP messages is set globally, in a VLAN, and on an interface
simultaneously, the maximum rate of sending DHCP messages takes effect on an interface, in a
VLAN, and globally in descending order.
----End
Issue 04 (2014-01-16)
97
3 DHCP Configuration
NOTICE
DHCP statistics cannot be restored after they are cleared. Exercise caution when running the
reset commands.
Procedure
l
Run the reset dhcp server statistics command in the user view to clear DHCP server
statistics.
Run the reset dhcp statistics command in the user view to clear the DHCP message
statistics.
Run the reset dhcp relay statistics [ server-group group-name ] command in the user
view to clear DHCP relay agent statistics.
----End
Run the reset ip pool { interface interface-name | name ip-pool-name } { low-ipaddress [ high-ip-address ] | all | conflict | expired | used } command to reset the configured
IP address pool on the device.
Run the reset ip pool import { all | dns | domain-name | nbns } command to clear the
configuration parameters of the DHCP address pool.
----End
98
3 DHCP Configuration
Procedure
l
Run the display dhcp statistics command to view DHCP message statistics.
Run the display dhcp relay statistics [ server-group group-name ] command to view
statistics on the DHCP Relay Agent.
Run the display dhcp server statistics command to view statistics on the DHCP Server.
----End
Issue 04 (2014-01-16)
99
3 DHCP Configuration
Figure 3-13 Networking diagram for configuring a DHCP server based on the global address
pool
DHCP
Client
Etherent2/0/0
VLANIF10
10.1.1.1/25
DHCP
Client
Etherent2/0/1
VLANIF20
10.1.1.129/25
Router
DHCP Server
DHCP
Client
DHCP
Client
Network: 10.1.1.128/25
Office 2
Configuration Roadmap
The configuration roadmap is as follows:
1.
Create two global address pools on the router and set attributes of the pools. Assign IP
addresses to Office1 and Office2 as required.
2.
Configure VLANIF interfaces to use the global address pool to assign IP addresses to
clients.
Procedure
Step 1 Enable DHCP.
<Huawei> system-view
[Huawei] sysname Router
[Router] dhcp enable
Step 2 Create address pools and set the attributes of the address pools.
# Set the attributes of IP address pool 1, including the address pool range, DNS server address,
gateway address, and address lease.
[Router] ip pool pool1
[Router-ip-pool-pool1]
[Router-ip-pool-pool1]
[Router-ip-pool-pool1]
[Router-ip-pool-pool1]
[Router-ip-pool-pool1]
[Router-ip-pool-pool1]
[Router-ip-pool-pool1]
# Set the attributes of IP address pool 2, including the address pool range, DNS server address,
egress gateway address, NetBIOS server address, and address lease.
Issue 04 (2014-01-16)
100
3 DHCP Configuration
2/0/0
hybrid pvid vlan 10
hybrid untagged vlan 10
2/0/1
hybrid pvid vlan 20
hybrid untagged vlan 20
# Configure clients on VLANIF 10 to obtain IP addresses from the global address pool.
[Router] interface vlanif 10
[Router-Vlanif10] ip address 10.1.1.1 255.255.255.128
[Router-Vlanif10] dhcp select global
[Router-Vlanif10] quit
# Configure clients on VLANIF 20 to obtain IP addresses from the global address pool.
[Router] interface vlanif 20
[Router-Vlanif20] ip address 10.1.1.129 255.255.255.128
[Router-Vlanif20] dhcp select global
[Router-Vlanif20] quit
IP address Statistic
Total
:250
Used
:0
Expired
:0
Idle
Conflict
:248
:0
Disable
:2
----End
Issue 04 (2014-01-16)
101
3 DHCP Configuration
Configuration Files
Configuration file of the router
#
sysname Router
#
vlan batch 10 20
#
dhcp enable
#
ip pool pool1
gateway-list 10.1.1.1
network 10.1.1.0 mask 255.255.255.128
excluded-ip-address 10.1.1.2
excluded-ip-address 10.1.1.4
lease day 10 hour 0 minute 0
dns-list 10.1.1.2
#
ip pool pool2
gateway-list 10.1.1.129
network 10.1.1.128 mask 255.255.255.128
lease day 2 hour 0 minute 0
dns-list 10.1.1.2
nbns-list 10.1.1.4
#
interface Vlanif10
ip address 10.1.1.1 255.255.255.128
dhcp select global
#
interface Vlanif20
ip address 10.1.1.129 255.255.255.128
dhcp select global
#
interface Ethernet 2/0/0
port hybrid pvid vlan 10
port hybrid untagged vlan 10
#
interface Ethernet 2/0/1
port hybrid pvid vlan 20
port hybrid untagged vlan 20
#
return
102
3 DHCP Configuration
Figure 3-14 Networking diagram for configuring a DHCP server based on the interface address
pool
NetBIOS
Server
10.1.1.3/24
DNS
Server
10.1.1.2/24
DHCP
Client
DHCP
Client
DHCP
Client
DHCP
Client
DHCP
Client
Office1
DHCP
Client
Office2
Configuration Roadmap
The configuration roadmap is as follows:
1.
Create two interface address pools on the router and set attributes of the address pool.
Configure the interface address pools to enable the DHCP server to assign IP addresses and
configuration parameters to hosts from different interface address pools.
2.
Configure VLANIF interfaces to assign IP addresses to hosts from the interface address
pool.
Procedure
Step 1 Enable DHCP.
<Huawei> system-view
[Huawei] sysname Router
[Router] dhcp enable
2/0/0
hybrid pvid vlan 10
hybrid untagged vlan 10
2/0/1
hybrid pvid vlan 20
hybrid untagged vlan 20
# Configure clients on VLANIF 10 to obtain IP addresses from the interface address pool.
[Router] interface vlanif 10
[Router-Vlanif10] ip address 10.1.1.1 255.255.255.0
Issue 04 (2014-01-16)
103
3 DHCP Configuration
# Configure clients on VLANIF 20 to obtain IP addresses from the interface address pool.
[Router] interface vlanif 20
[Router-Vlanif20] ip address 10.1.2.1 255.255.255.0
[Router-Vlanif20] dhcp select interface
[Router-Vlanif20] quit
Step 3 Configure the DNS service and NetBIOS service for the interface address pool.
# Configure the DNS service and NetBIOS service for the interface address pool on VLANIF
10.
[Router] interface vlanif 10
[Router-Vlanif10] dhcp server
[Router-Vlanif10] dhcp server
[Router-Vlanif10] dhcp server
[Router-Vlanif10] dhcp server
[Router-Vlanif10] dhcp server
[Router-Vlanif10] dhcp server
domain-name huawei.com
dns-list 10.1.1.2
nbns-list 10.1.1.3
excluded-ip-address 10.1.1.2
excluded-ip-address 10.1.1.3
netbios-type b-node
Issue 04 (2014-01-16)
104
3 DHCP Configuration
Position
: Interface
Status
: Unlocked
Gateway-0
: 10.1.2.1
Mask
: 255.255.255.0
VPN instance
: -----------------------------------------------------------------------------Start
End
Total Used Idle(Expired) Conflict Disable
----------------------------------------------------------------------------10.1.2.1
10.1.2.254
253
0
253(0)
0
0
-----------------------------------------------------------------------------
----End
Example
Configuration file of the router
#
sysname Router
#
vlan batch 10 20
#
dhcp enable
#
interface Vlanif10
ip address 10.1.1.1 255.255.255.0
dhcp select interface
dhcp server excluded-ip-address 10.1.1.2 10.1.1.3
dhcp server lease day 3 hour 0 minute 0
dhcp server dns-list 10.1.1.2
dhcp server netbios-type b-node
dhcp server nbns-list 10.1.1.3
dhcp server domain-name huawei.com
#
interface Vlanif20
ip address 10.1.2.1 255.255.255.0
dhcp select interface
dhcp server lease day 2 hour 0 minute 0
#
interface Ethernet 2/0/0
port hybrid pvid vlan 10
port hybrid untagged vlan 10
#
interface Ethernet 2/0/1
port hybrid pvid vlan 20
port hybrid untagged vlan 20
#
return
105
3 DHCP Configuration
Hosts in OfficeA are on 20.20.20.0/24 and the DHCP server is on 100.10.10.0/24. By using
RouterA enabled with DHCP relay, the DHCP clients can obtain IP addresses from the DHCP
server.
On RouterA, the public address of GE1/0/0 is 100.10.20.1/24 and the interface address of
RouterA connected to the carrier device is 100.10.20.2/24.
On RouterB, the public address of GE1/0/0 is 100.10.10.1/24 and the interface address of
RouterB connected to the carrier device is 100.10.10.2/24.
Figure 3-15 DHCP relay agent
GE1/0/0 RouterB
100.10.10.1/24
DHCP Server
Internet
GE1/0/0
100.10.20.1/24
RouterA
DHCP Relay
Etherent2/0/0
VLANIF100
20.20.20.1/24
DHCP
Client
DHCP
Client
DHCP
Client
VLAN100
OfficeA
Configuration Roadmap
The configuration roadmap is as follows:
1.
Configure DHCP relay on RouterA to enable RouterA to forward DHCP messages from
different network segments.
2.
Configure a global address pool at 20.20.20.0/24 to enable the DHCP server to assign IP
address to clients on different network segments.
Issue 04 (2014-01-16)
106
3 DHCP Configuration
Procedure
Step 1 Configure DHCP relay on RouterA.
1.
Create a DHCP server group and add DHCP servers to the group.
# Create a DHCP server group.
<Huawei> system-view
[Huawei] sysname RouterA
[RouterA] dhcp server group dhcpgroup1
2.
3.
Step 3 Configure the DHCP server based on the global address pool on RouterB.
# Enable DHCP.
<Huawei> system-view
[Huawei] sysname RouterB
[RouterB] dhcp enable
# Create an address pool and set the attributes of the address pool.
Issue 04 (2014-01-16)
107
3 DHCP Configuration
# Run the display ip pool command on RouterB to view the IP address pool configuration.
[RouterB] display ip pool
----------------------------------------------------------------------Pool-name
: pool1
Pool-No
: 0
Position
: Local
Status
: Unlocked
Gateway-0
: 20.20.20.1
Mask
: 255.255.255.0
VPN instance
: --
IP address Statistic
Total
:253
Used
:3
Expired
:0
Idle
Conflict
:250
:0
Disable
:0
----End
Configuration Files
l
Issue 04 (2014-01-16)
108
3 DHCP Configuration
#
return
3.7.4 Example for Configuring the DHCP Client and BOOTP Client
Networking Requirements
Users want to configure the DHCP/BOOTP client function on the Layer 3 interface to
dynamically obtain IP addresses and other configurations from the DHCP server using DHCP.
This facilitates user configuration and management.
As shown in Figure 3-16, RouterA functions as a DHCP client, RouterB as a BOOTP client,
and RouterC as the DHCP server. RouterA obtains the dynamically bound IP address, DNS
server address, and gateway address from RouterC, and RouterB obtains the statically bound IP
address, DNS server address, and gateway address from RouterC.
Figure 3-16 Example for configuring the DHCP client and BOOTP client
Gateway
10.1.1.126/24
Eth1/0/0
10.1.1.1/24
10.1.1.2/24
RouterC
DHCP
Server
Issue 04 (2014-01-16)
DNS Server
Eth1/0/0
Eth1/0/0
RouterB
RouterA
BOOTP Client DHCP Client
109
3 DHCP Configuration
Configuration Roadmap
The configuration roadmap is as follows:
1.
Enable the DHCP client function on RouterA so that RouterA can dynamically obtains an
IP address from the DHCP server.
2.
Enable the BOOTP client function on RouterB so that RouterB can dynamically obtains
an IP address from the DHCP server.
3.
Create a global address pool for the DHCP server on RouterC and set attributes of the
address pool.
Procedure
Step 1 Enable the DHCP client function on RouterA.
# Enable DHCP.
<Huawei> system-view
[Huawei] sysname RouterA
[RouterA] dhcp enable
Step 3 Create a global address pool for the DHCP server on RouterC and set attributes of the address
pool.
1.
Enable DHCP.
<Huawei> system-view
[Huawei] sysname RouterC
[RouterC] dhcp enable
[RouterC] dhcp server bootp
[RouterC] dhcp server bootp automatic
2.
3.
Create address pools and set the attributes of the address pools.
[RouterC] ip pool pool1
[RouterC-ip-pool-pool1]
[RouterC-ip-pool-pool1]
[RouterC-ip-pool-pool1]
a256
[RouterC-ip-pool-pool1]
[RouterC-ip-pool-pool1]
[RouterC-ip-pool-pool1]
Issue 04 (2014-01-16)
110
3 DHCP Configuration
# When the IP address is assigned to the interface, run the display dhcp client command on
RouterA to check the IP address.
[RouterA] display dhcp client
DHCP client lease information on
Current machine state
:
Internet address assigned via :
Physical address
:
IP address
:
Subnet mask
:
Gateway ip address
:
DHCP server
:
Lease obtained at
:
Lease expires at
:
Lease renews at
:
Lease rebinds at
:
DNS
:
interface Ethernet1/0/0 :
Bound
DHCP
80fb-0635-45b6
10.1.1.254
255.255.255.0
10.1.1.1
10.1.1.1
2013-12-28 10:58:07
2013-12-29 10:58:07
2013-12-28 22:58:07
2013-12-29 07:58:07
10.1.1.2
# Run the display current-configuration command on RouterB to view the BOOTP client
configuration.
[RouterB] display current-configuration
...
#
interface Ethernet1/0/0
ip address bootp-alloc
#
...
# When the IP address is assigned to the interface, run the display dhcp client command on
RouterB to check the IP address.
[RouterB] display dhcp client
BOOTP client lease information
Current machine state
Internet address assigned via
Physical address
IP address
Subnet mask
Gateway ip address
Lease obtained at
on interface Ethernet1/0/0 :
: Bound
: BOOTP
: a234-e211-a256
: 10.1.1.3
: 255.255.255.0
: 10.1.1.1
: 2013-12-28 12:53:17
# Run the display ip pool command on RouterC to view the IP address pool configuration.
[RouterC] display ip pool
----------------------------------------------------------------------Pool-name
: pool1
Pool-No
: 0
Position
: Local
Status
: Unlocked
Gateway-0
: 10.1.1.126
Mask
: 255.255.255.0
VPN instance
: --
Issue 04 (2014-01-16)
111
IP address Statistic
Total
:253
Used
:2
Expired
:0
Idle
Conflict
3 DHCP Configuration
:250
:0
Disable
:1
----End
Example
l
112
3 DHCP Configuration
the attacker sends a large number of DHCP packets to RouterA, the CPU resources of RouterA
will become insufficient. As a result, the requests of authorized users cannot be processed in
time. To avoid this problem, network administrators limit the rate at which DHCP packets are
sent to RouterA. This allows RouterA to effectively defend against DHCP attack packets, and
to process requests of authorized users in time.
Figure 3-17 Configuring DHCP rate limit
DHCP Server
Internet
RouterB
DHCP Relay
RouterA
DHCP
Client
DHCP
Client
Attacker
Configuration Roadmap
The configuration roadmap is as follows:
l
Configure the highest rate at which DHCP packets are sent to RouterA in the system view.
This allows RouterA to limit the rate at which DHCP packets are received within a normal
range.
Procedure
Step 1 Enable the DHCP service.
<Huawei> system-view
[Huawei] sysname RouterA
[RouterA] dhcp enable
Step 2 Configure the highest rate at which DHCP packets are sent to the protocol stack.
# Enable the system to check the rate at which DHCP packets are sent to the protocol stack.
[RouterA] dhcp check dhcp-rate enable
# Configure the highest rate at which DHCP packets are sent to the protocol stack.
[RouterA] dhcp check dhcp-rate 90
Issue 04 (2014-01-16)
113
3 DHCP Configuration
----End
Configuration Files
Configuration file of RouterA
#
sysname RouterA
#
dhcp enable
dhcp check dhcp-rate
dhcp check dhcp-rate
dhcp alarm dhcp-rate
dhcp alarm dhcp-rate
#
return
enable
90
enable
threshold 80
Procedure
Step 1 Run the display current-configuration | include dhcp enable command to check whether
DHCP is enabled. By default, DHCP is disabled.
Issue 04 (2014-01-16)
114
3 DHCP Configuration
l If no DHCP information is displayed, DHCP is disabled. Run the dhcp enable command to
enable DHCP.
l If dhcp enable is displayed, DHCP is enabled. Go to step 2.
Step 2 In the router interface view, run the display this command to check whether the DHCP address
assignment mode is set.
Command Output
Description
Follow-up Operation
Go to step 3.
Go to step 4.
Step 3 Run the display ip pool command to check whether the global address pool has been created.
l If the global address pool has not been created, run the ip pool ip-pool-name and network
ip-address [ mask { mask | mask-length } ] commands to create a global address pool and
set the range of IP addresses that can be dynamically assigned.
l If the global address pool has been created, obtain the value of ip-pool-name. Then run the
display ip pool name ip-pool-name command to check whether the IP addresses in the global
address pool are on the same network segment with the IP address on the interface.
If the client and server are located on the same network segment and no relay agent is
deployed:
If IP addresses in the global address pool and the VLANIF interface IP address are
located on different network segments, run the ip address ip-address { mask | masklength } [ sub ] command to change the VLANIF interface IP address to be on the
same network segment as IP addresses in the global address pool.
If IP addresses in the global address pool and the router interface IP address are located
on the same network segment, go to step 4.
If the client and server are located on different network segments and a relay agent is
deployed:
If IP addresses in the global address pool and the relay agent IP address are located
on different network segments, run the ip address ip-address { mask | mask-length }
[ sub ] command to change the IP address to be on the same network segment as IP
addresses in the global address pool.
If IP addresses in the global address pool and the relay agent interface IP address are
located on the same network segment, go to step 4.
Issue 04 (2014-01-16)
115
3 DHCP Configuration
Step 4 Run the display ip pool [ { interface interface-pool-name | name ip-pool-name } [ start-ipaddress [ end-ip-address ] | all | conflict | expired | used ] ] command to check the usage of IP
addresses in the global or interface address pool. If the value of Idle (Expired) is 0, IP addresses
in the address pool have been used up.
l If the server assigns IP addresses to clients from the global address pool on the interface, recreate a global address pool where the network segment can be connected to the previous
network segment but cannot overlap with the previous network segment.
l If the DHCP server allocates IP addresses to clients from the interface address pool, you can
reduce the mask length of IP address so that more IP addresses can be allocated.
----End
Procedure
Step 1 Run the display current-configuration | include dhcp enable command to check whether
DHCP is enabled. By default, DHCP is disabled.
l If no DHCP information is displayed, DHCP is disabled. Run the dhcp enable command to
enable DHCP.
l If dhcp enable is displayed, DHCP is enabled.
Step 2 In the router interface view, run the display this command to check whether the DHCP relay
function is enabled.
l If dhcp select relay is displayed, the DHCP relay function is enabled. Go to step 3.
l If no information is displayed, the DHCP relay function is disabled. Then run the dhcp select
relay command to enable the DHCP relay function.
Step 3 In the router interface view, run the display this command to check whether the DHCP server
is configured on the DHCP relay agent.
l If dhcp relay server-ip ip-address is displayed, the DHCP server IP address is configured
on the DHCP relay agent.
l If dhcp relay server-select group-name is displayed, the interface on the DHCP relay agent
is bound to a DHCP server group. Go to step 4.
l If no information is displayed, the DHCP server IP address is not configured on the DHCP
relay agent. Configure the DHCP server using either of the following methods:
Run the dhcp relay server-ip ip-address command to configure the DHCP server IP
address on the DHCP relay agent.
Run the dhcp-server command to add DHCP servers to the DHCP server group and run
the dhcp relay server-select group-name command to bind the VLANIF interface to a
DHCP server group.
Step 4 Run the display dhcp server group group-name command to check whether DHCP servers are
configured in the DHCP server group.
Issue 04 (2014-01-16)
116
3 DHCP Configuration
l If the Server-IP field is displayed, DHCP servers are configured in the DHCP server group.
l If the Server-IP field is not displayed, DHCP servers are not configured in the DHCP server
group. Then run the dhcp-server command to add DHCP servers to the DHCP server group.
----End
3.9 FAQ
3.9.1 How Can I Prevent the Auto-Config Function from
Periodically Clearing DHCP-related Configurations on the Device?
When a device with empty configuration starts, the auto-config function allows the device to
automatically obtain the configuration file and restart for the configuration to take effect. The
device enabled with the auto-config function periodically clears all DHCP-related configurations
on the device.
To solve this problem, proceed as follows:
1.
Run the undo autoconfig enable command to disable the auto-config function.
2.
Wait 4 to 5 minutes and run the display autoconfig-status command to check the autoconfig status. If the Running status is NO, the auto-config function has been disabled.
3.
Reconfigure the device as required by the customer and save the configuration.
Issue 04 (2014-01-16)
117
3 DHCP Configuration
3.10 References
The following table lists the references of this document.
Issue 04 (2014-01-16)
Document
Description
Remarks
RFC951
RFC1533
RFC1534
RFC2131
RFC2132
RFC3046
118
4 DNS Configuration
DNS Configuration
Issue 04 (2014-01-16)
119
4 DNS Configuration
Purpose
Each host on the network is identified by an IP address. To access a host, a user must obtain the
host IP address first. It is difficult for users to remember IP addresses of hosts. Therefore, host
names in the format of strings are designed. Each host name maps an IP address. In this way,
users can use the simple and meaningful domain names instead of the complicated IP addresses
to access hosts.
4.2 Principles
4.2.1 Working Principle of DNS
Domain name resolution is classified into dynamic resolution and static resolution that
complement each other. During domain name resolution, static resolution is preferentially used.
If static resolution fails, dynamic resolution is used. Dynamic DNS resolution takes a period of
time, and the cooperation of the DNS server is required. To improve the domain name resolution
efficiency, you are advised to add commonly used domain names to a static domain name
resolution table.
Static DNS
A static domain name resolution table is manually set up, describing the mappings between
domain names and IP addresses. Some common domain names are added to the table. To obtain
the IP address by resolving a domain name,domain names are resolved based on the static domain
name resolution table. In this manner, the efficiency of domain name resolution is improved.
Dynamic DNS
User programs, such as ping and tracert, access the DNS server using the resolver of the DNS
client.
Figure 4-1 shows the relationship between user programs, the resolver, the DNS server, and the
cache on the resolver.
Issue 04 (2014-01-16)
120
4 DNS Configuration
User
program
Request
Resolver
Response
Response
Save
Local
host
DNS
Client
Request
Read
DNS
Server
Cache
The DNS client, consisting of the resolver and the cache, is used to accept and respond to the
DNS queries from user programs. Generally, user programs(ping,Tracert), the cache, and the
resolver are on the same host; whereas the DNS server is on another host.
When a user accesses some applications by domain name, the user program sends a request
to the resolver on the DNS client.
2.
After receiving the request, the resolver searches the local domain name cache.
l If the domain name matches an entry in the local cache, the resolver sends the
corresponding IP address to the user program.
l If the domain name matches no entry in the local cache, the resolver sends a query
message to the DNS server.
3.
When receiving the query message, the DNS server first checks whether the domain name
to be resolved is in an authorized sub-domain. Then, the DNS server sends a response packet
according to the check result.
l If the domain name is in an authorized sub-domain, the DNS server searches for the
corresponding IP address in the local database.
l If the domain name is out of authorized sub-domains, the DNS server sends a query
message to a higher-level DNS server. This process continues until the DNS server finds
the corresponding IP address or detects that the corresponding IP address of the domain
name does not exist. Then the DNS server returns a result to the DNS client.
4.
After receiving the response packet from the DNS server, the DNS client sends the
resolution result to the user program.
Mappings between domain names and IP addresses are stored in the dynamic domain name
cache. When resolving a domain name that is stored in the cache, the DNS client obtains
the corresponding IP address from the cache directly and does not send a query message
to the DNS server. Mappings stored in the cache will be deleted when the aging time expires
to ensure that the latest mappings can be obtained from the DNS server. The aging time is
set by the DNS server. The DNS client obtains the aging time from protocol packets.
121
4 DNS Configuration
a suffix to the domain name for resolution. For example, a user has set the domain name suffix
com in the suffix list. To visit huawei.com, the user only needs to enter huawei. The system
adds the suffix com to the domain name.
When the domain name suffix list is used, the resolution modes vary according to domain names
entered by users.
l
If a user enters a domain name without a dot (.), for example, huawei, the system identifies
it as a host name and adds a suffix to the domain name for resolution. If the resolution fails,
the system resolves the entered domain name.
If a user enters a domain name with a dot (.), for example, www.huawei or huawei.com.,
the system resolves the domain name. If the resolution fails, the system adds a suffix to the
domain name for resolution.
Query Type
Class-A query is a common type of query, which is used to obtain the IP address corresponding
to a specified domain name. For example, when you ping or tracert a domain name, the ping or
tracert, as a user program, sends a query to the DNS client for the IP address corresponding to
the domain name. If the corresponding IP address does not exist on the DNS client, the DNS
client sends a Class-A query to the DNS server to obtain the corresponding IP address.
Issue 04 (2014-01-16)
122
4 DNS Configuration
DNS
Proxy
Internet
DNS Client
DNS Client
The DNS client sends a request packet to the DNS proxy. The DNS proxy IP address is the
destination address of the request packet.
2.
After receiving the request packet, the DNS proxy searches for DNS entries saved in the
local domain name resolution tables. If mapping information exists, the DNS proxy sends
a reply packet carrying the resolution result to the DNS client.
3.
If no mapping information exists, the DNS proxy sends the request packet to the DNS server
for resolution.
4.
After receiving the reply packet from the DNS server, the DNS proxy records the resolution
result and forwards the reply packet to the DNS client.
Only when the IP address of the DNS server and the route to the DNS server exist on the DNS
proxy, the DNS proxy sends domain name resolution requests to the DNS server. Otherwise,
the DNS proxy neither sends any domain name resolution request to the DNS server nor replies
any request from the DNS client.
Issue 04 (2014-01-16)
123
4 DNS Configuration
Host A
DNS Client
DNS Server
Dialer Interface
ISP
DNS Proxy
DNS Spoofing
Host B
DNS Client
HTTP Server
As shown in Figure 4-3, the device functions as the DNS proxy and connects to the network
using the dial-up interface. The dial-up interface is triggered to set up a connection only when
data packets are forwarded by the dial-up interface. When the device functions as the DNS proxy,
hosts A and B consider the device as the DNS server. When the dial-up connection is set up, the
device obtains the DNS server IP address using DHCP.
When receiving a DNS query message from a DNS client, the device not enabled with DNS
spoofing sends a DNS query message to the DNS server when no matching entry is found. If
the dial-up connection is not set up, the device cannot obtain the DNS server IP address. The
device does not send a DNS query message to the DNS server or respond to the request from
the DNS client. The domain name resolution fails. No data packet traffic triggers the dial-up
interface to set up a connection.
DNS spoofing enables the device to send a spoofing IP address to the DNS client that sends a
DNS query message regardless of whether the DNS server IP address is configured or the route
to the DNS server exists on the device. Data packets sent by the DNS client triggers the dial-up
interface to set up a connection.
As shown in Figure 4-3, a DNS client wants to access the HTTP server. The process is described
as follows:
1.
A DNS client sends a DNS query message to the DNS proxy for resolving the HTTP server
domain name to an IP address.
2.
After receiving the DNS query message, the DNS proxy cannot send the correct IP address
to the DNS client because no matching entry is found locally, no dial-up connection is set
up, and the DNS server IP address is not obtained. The DNS proxy sends the spoofing IP
address as the resolution result to the DNS client. The aging time of a DNS resolution
response message is 0. A reachable route between the DNS client and the IP address in the
response message must exist. The outbound interface of the route is the dial-up interface.
3.
After receiving the response message, the host sends an HTTP request to the IP address in
the response message.
4.
The DNS proxy forwards the HTTP request using the dial-up interface. The traffic triggers
the dial-up interface to set up a connection with the DNS server. Then the DNS proxy
obtains the DNS server IP address using DHCP.
Issue 04 (2014-01-16)
124
4 DNS Configuration
5.
After the DNS resolution response message is aged, the DNS client sends a DNS query
message again.
6.
The DNS proxy sends the correct IP address to the DNS client.
7.
After obtaining the correct HTTP server IP address, the DNS client can access the HTTP
server.
DNS Server
HTTP Server
DDNS Client
2
Internet
HTTP Client
1
DDNS Server
Issue 04 (2014-01-16)
When an IP address changes, the DDNS updates the mapping between the domain name
and IP address on the DNS server. Internet users use domain names to access servers that
provide application-layer services, such as HTTP and FTP servers. When the IP address of
a server changes, the server functions as a DDNS client and sends a request for updating
Huawei Proprietary and Confidential
Copyright Huawei Technologies Co., Ltd.
125
4 DNS Configuration
the mapping between the domain name and the IP address to the DDNS server. This ensures
that Internet users can still access a server when the server IP address changes.
l
The DDNS server instructs the DNS server to dynamically update the mapping between
the domain name and the IP address on the DNS server to ensure that the IP address can
be resolved correctly and Internet users can access the DDNS client using the domain name.
No unified standard is defined for the DDNS update process. DDNS update processes are
different on different DDNS servers. DDNS servers provided at www.oray.cn, www.3322.org,
and www.dyndns.com.
4.3 Applications
4.3.1 DNS Client Application
Figure 4-5 shows typical networking of a DNS client.
Figure 4-5 Typical networking of a DNS client
RouterA
DNS Client
DNS Server
RouterB
DNS Client
As shown in Figure 4-5, the device functions as a DNS client and can dynamically obtain the
corresponding IP address of a domain name from a DNS server. This facilitates user
communication.
Issue 04 (2014-01-16)
126
4 DNS Configuration
DNS
Proxy
Internet
DNS Client
DNS Client
The device functions as an egress router and is configured with DNS proxy in an enterprise. The
device can forward DNS request and reply packets between DNS clients in the enterprise and
DNS servers out of the enterprise. When the IP address of a DNS server changes, you only need
to change the configuration on the DNS proxy,this will be beneficial to Network management.
Pre-configuration Tasks
Before configuring a DNS client, complete the following tasks:
l
Configuring link layer protocol parameters for interfaces to ensure that the link layer
protocol status on the interfaces is Up
127
4 DNS Configuration
Procedure
Step 1 Run:
system-view
Follow-up Procedure
Each host name can be mapped to only one IP address. When multiple IP addresses are mapped
to a host name, only the latest configuration takes effect. If multiple host names need to be
resolved, repeat step 2.
Procedure
Step 1 Run:
system-view
Issue 04 (2014-01-16)
128
4 DNS Configuration
The source IP address is configured for the local device to function as the DNS client to send
and receive DNS packets.
By default, no source IP address is configured for the device.
The local device uses the specified IP address to communicate with the DNS server. This ensures
communication security.
Step 5 (Optional) Run:
dns-server-select-algorithm { fixed | auto }
The number of times for retransmitting Query packets to the destination DNS server is set.
By default, the device retransmits Query packets to the destination DNS server twice.
Step 7 (Optional) Run:
dns forward retry-timeout time
The retransmission timeout period that the device sends Query packets to the destination DNS
server is set.
By default, the retransmission timeout period is 3 seconds.
Step 8 (Optional) Run:
dns domain domain-name
Follow-up Procedure
The system supports a maximum of six DNS servers, one specified source address, and ten
domain name suffixes. If multiple DNS servers are required, repeat step 3. If multiple domain
name suffixes are required, repeat step 8.
Run the display dns configuration command to display the global DNS configurations.
Run the display dns server [ verbose ] command to check the DNS server configuration.
Run the display dns domain [ verbose ] command to check the domain name suffix
configuration.
----End
Issue 04 (2014-01-16)
129
4 DNS Configuration
Pre-configuration Tasks
Before configuring DNS proxy or relay, complete the following tasks:
l
Configuring link layer protocol parameters for interfaces to ensure that the link layer
protocol status on the interfaces is Up
Configuring routes between the device and the DNS server and between the device and the
DNS client
Procedure
Step 1 Run:
system-view
Run:
dns resolve
Issue 04 (2014-01-16)
130
4 DNS Configuration
Run:
dns server ip-address
The DNS server that the DNS Proxy or Relay connects to is configured.
By default, no IP address is configured for the DNS server.
3.
(Optional) Run:
dns server source-ip ip-address
The source IP address that the device uses to exchange packets with the DNS server is
configured.
By default, no source IP address is configured for the device.
4.
(Optional) Run:
dns-server-select-algorithm { fixed | auto }
An algorithm used by the DNS Proxy or Relay to access the destination DNS server is
configured.
By default, the auto algorithm is used.
5.
(Optional) Run:
dns forward retry-number
number
The number of times for the DNS Proxy or Relay to retransmit query requests to the
destination DNS server is set.
By default, the number of times for the DNS Proxy or Relay to retransmit query requests
to the destination DNS server is 2.
6.
(Optional) Run:
dns forward retry-timeout time
The retransmission timeout period that the DNS proxy or DNS relay agent sends Query
packets to the destination DNS server is set.
By default, the retransmission timeout period is 3 seconds.
----End
131
4 DNS Configuration
No source IP address is available for the outbound interface connected to the DNS server.
If one of the preceding requirements is met, when receiving an address record query, the DNS
proxy or relay return Spoofing reply messages using the configured IP address.
Procedure
Step 1 Run:
system-view
Run the display dns configuration command to display the global DNS configurations.
Run the display dns server [ verbose ] command to check the DNS server configuration.
----End
Pre-configuration Tasks
Before configuring a DDNS client, complete the following tasks:
l
132
4 DNS Configuration
server dynamically updates the mapping between the domain name and the IP address on the
DNS server to ensure that the IP address can be resolved correctly.
After the DDNS policy is configured on an interface whose IP address changes, a DDNS update
request is sent to the destination DDNS server.
Procedure
Step 1 Run:
system-view
Issue 04 (2014-01-16)
133
4 DNS Configuration
NOTE
When the device functions as the DDNS client and communicates with Siemens DDNS server, the device
needs to encrypt packets using SSL. The DDNS policy needs to be bound to the SSL policy only when the
device functions as the DDNS client and communicates with Siemens DDNS server.
To configure an SSL policy, see "SSL Configuration" in the Huawei AR150&200&1200&2200&3200
Series Enterprise Routers Configuration Guide - Security.
Procedure
Step 1 Run:
system-view
Issue 04 (2014-01-16)
134
4 DNS Configuration
When the DDNS server is www.3322.org or www.dyndns.com, you must configure the fully qualified domain
name (FQDN), that is, the fqdn parameter is mandatory.
----End
Run the display ddns policy policy-name command to view DDNS policy information.
Run the display ddns interface interface-type interface-number command to view DDNS
policy information on an interface.
----End
NOTICE
Dynamic DNS entries cannot be restored after being deleted. Exercise caution when you run the
command.
Procedure
l
Run the reset dns dynamic-host command to delete dynamic DNS entries.
----End
Issue 04 (2014-01-16)
135
4 DNS Configuration
NOTICE
DNS entries of the DNS proxy or relay cannot be restored after being deleted. Exercise caution
when you run the command.
Procedure
l
Run the reset dns forward table [ source-ip ip-address ] command to delete DNS entries
of the DNS proxy or relay.
----End
NOTICE
Statistics on sent and received DNS packets cannot be restored after being cleared. Exercise
caution when you run the command.
Procedure
l
Run the reset dns statistics command to clear statistics on sent and received DNS packets.
----End
Run:
reset ddns policy policy-name [ interface interface-type interface-num ]
Mappings between all the IP addresses and host names in the DDNS policy are updated.
----End
Issue 04 (2014-01-16)
136
4 DNS Configuration
Procedure
l
Run the display dns forward table [ source-ip ip-address ] command to check the DNS
forwarding table.
Run the display dns dynamic-host command to display dynamic DNS entries.
----End
HostC
Loopback0
4.1.1.2/32
Loopback0
4.1.1.1/32
RouterB
GE1/0/0
GE1/0/0
1.1.1.2/16 1.1.1.1/16
DNS Client
RouterA
RouterC
GE1/0/0
3.1.1.1/16
GE2/0/0
2.1.1.1/16
GE2/0/0
2.1.1.2/16
DNS Server
3.1.1.2/16
huawei.com
2.1.1.3/16
Issue 04 (2014-01-16)
137
4 DNS Configuration
Configuration Roadmap
The configuration roadmap is as follows:
1.
2.
Configure the dynamic DNS resolution on RouterA to access the DNS server.
3.
Configure the domain name suffix on RouterA to support a domain name suffix list.
4.
Procedure
Step 1 Configure RouterA.
# Configure an IP address for GE1/0/0.
<Huawei> system-view
[Huawei] sysname RouterA
[RouterA] interface gigabitethernet 1/0/0
[RouterA-GigabitEthernet1/0/0] ip address 1.1.1.2 255.255.0.0
[RouterA-GigabitEthernet1/0/0] quit
# Configure OSPF.
[RouterA] ospf
[RouterA-ospf-1] area 0
[RouterA-ospf-1-area-0.0.0.0] network 1.1.0.0 0.0.255.255
[RouterA-ospf-1-area-0.0.0.0] quit
[RouterA-ospf-1] quit
You need to configure OSPF on RouterB and RouterC to ensure reachable routes between them. For details
about OSPF configurations on RouterB and RouterC, see the configuration files.
Issue 04 (2014-01-16)
138
4 DNS Configuration
# Run the ping huawei.com command on RouterA. You can see that the ping operation succeeds
and the destination IP address is 2.1.1.3.
<RouterA> ping huawei.com
Trying DNS server (3.1.1.2)
PING huawei.com (2.1.1.3): 56
Reply from 2.1.1.3: bytes=56
Reply from 2.1.1.3: bytes=56
Reply from 2.1.1.3: bytes=56
Reply from 2.1.1.3: bytes=56
Reply from 2.1.1.3: bytes=56
# Run the ping huawei command on RouterA. You can see that the ping operation succeeds,
the domain name changes to huawei.com, and the destination IP address is 2.1.1.3.
<RouterA> ping huawei
Trying DNS server (3.1.1.2)
PING huawei.com (2.1.1.3): 56
Reply from 2.1.1.3: bytes=56
Reply from 2.1.1.3: bytes=56
Reply from 2.1.1.3: bytes=56
Reply from 2.1.1.3: bytes=56
Reply from 2.1.1.3: bytes=56
Run the display ip host command on RouterA. You can view mappings between host names
and IP addresses in static DNS entries.
<RouterA> display ip host
Host
Age
hostB
0
hostC
0
Flags Address
static 4.1.1.1
static 4.1.1.2
# Run the display dns dynamic-host command on RouterA. You can view information about
dynamic DNS entries saved in the cache.
<RouterA> display dns dynamic-host
Host
huawei.com
2.1.1.3
TTL
114
Type
IP
Address(es)
NOTE
The TTL field in the command output indicates the time left before a DNS entry ages out, in seconds.
----End
Issue 04 (2014-01-16)
139
4 DNS Configuration
Configuration File
Configuration file of RouterA
#
sysname RouterA
#
ip host hostB 4.1.1.1
ip host hostC 4.1.1.2
#
dns resolve
dns server 3.1.1.2
dns domain net
dns domain com
#
interface GigabitEthernet 1/0/0
ip address 1.1.1.2 255.255.0.0
#
ospf 1
area 0.0.0.0
network 1.1.0.0 0.0.255.255
#
return
Issue 04 (2014-01-16)
140
4 DNS Configuration
GE1/0/0
1.1.1.2/16
GE1/0/0
1.1.1.1/16
Enterprise
headquarters
HostA
FTP Server
huawei.com
2.1.1.3/16
Configuration Roadmap
The configuration roadmap is as follows:
1.
Configure DNS Proxy on the AC to implement domain name resolution for clients.
NOTE
After DNS Proxy is enabled, the RouterA can be regarded as the DNS server of HostA. You need to
configure the RouterA's IP address as the IP address of the DNS server on HostA, and configure the IP
address (2.1.1.1) of the DNS server on the headquarters network on the RouterA. In this way, when the
DNS server address changes, you only need to modify the configurations on the RouterA, which is not
detected by the users.
Procedure
Step 1 Configure an IP address for GE1/0/0.
<Huawei> system-view
[Huawei] sysname RouterA
[RouterA] interface gigabitethernet 1/0/0
[RouterA-GigabitEthernet1/0/0] ip address 1.1.1.1 255.255.0.0
[RouterA-GigabitEthernet1/0/0] quit
Issue 04 (2014-01-16)
141
4 DNS Configuration
Step 3 Configure the default route from the DNS proxy to the DNS server.
Assume that the IP address of the next hop from the DNS proxy to the DNS server is 1.1.1.2/16.
[RouterA] ip route-static 0.0.0.0 0.0.0.0 1.1.1.2
# Run the ping huawei.com command on LAN HostA. You can see that the ping operation
succeeds
C:\Documents and Settings\HostA>ping huawei.com
PING huawei.com [2.1.1.3] with 32 bytes of data:
Reply from 2.1.1.3: bytes=32 time=16ms TTL=255
Reply from 2.1.1.3: bytes=32 time<1ms TTL=255
Reply from 2.1.1.3: bytes=32 time<1ms TTL=255
Reply from 2.1.1.3: bytes=32 time<1ms TTL=255
Ping statistics for 2.1.1.3:
Packets: Sent = 4, Received = 4, Lost = 0(0% loss),
Approximate round trip times in milli-seconds:
Minimum = 0ms, Maximum = 16ms, Average = 4ms
----End
Configuration File
Configuration file of RouterA
#
sysname RouterA
#
interface GigabitEthernet1/0/0
ip address 1.1.1.1 255.255.0.0
#
dns resolve
dns server 2.1.1.1
dns proxy enable
#
ip route-static 0.0.0.0 0.0.0.0 1.1.1.2
#
return
Issue 04 (2014-01-16)
142
4 DNS Configuration
Loopback0
4.1.1.2/32
RouterC
GE1/0/0
DDNS Client
GE1/0/0
1.1.1.1/16
GE2/0/0
2.1.1.1/16
GE1/0/0
3.1.1.1/16
GE2/0/0
2.1.1.2/16 DNS Server
3.1.1.2/16
DDNS Server
2.1.1.3/16
Configuration Roadmap
The configuration roadmap is as follows:
1.
Create a DDNS policy on RouterA and bind the DDNS policy to an interface. When the
IP address of the interface changes, RouterA sends a request for updating DNS entries to
the DDNS server.
2.
Configure the URL of the DDNS server on RouterA so that RouterA sends a request for
updating DNS entries to the correct DDNS server.
Procedure
Step 1 Configure RouterA.
# Create a DDNS policy.
<Huawei> system-view
[Huawei] sysname RouterA
[RouterA] ddns policy mypolicy
Issue 04 (2014-01-16)
143
4 DNS Configuration
If the IP address of GE1/0/0 changes, Router A notifies the DDNS server of the change, and then the DDNS
server instructs the DNS server to reconfigure the mapping between the domain name www.abc.com and the IP
address to ensure that the IP address can be resolved correctly.
# Configure OSPF.
[RouterA] ospf
[RouterA-ospf-1] area 0
[RouterA-ospf-1-area-0.0.0.0] network 1.1.0.0 0.0.255.255
[RouterA-ospf-1-area-0.0.0.0] quit
[RouterA-ospf-1] quit
NOTE
To implement communication among the DDNS client, DDNS server, and the DNS server, configure OSPF
on RouterB and RouterC. For details about OSPF configurations on RouterB and RouterC, see the
configuration files.
policy mypolicy
mypolicy
3600
oray://steven:nevets@phddnsdev.oray.net
1
# Run the display ddns interface gigabitethernet 1/0/0 command on RouterA, and information
about the DDNS policy on GE1/0/0 is displayed.
<RouterA> display ddns interface gigabitethernet 1/0/0
===== Policy mypolicy =======
URL: oray://steven:nevets@phddnsdev.oray.net
Statuses:
ESTABLISH
Refresh: enable
----End
Issue 04 (2014-01-16)
144
4 DNS Configuration
Configuration File
Configuration file of RouterA
#
sysname RouterA
#
dns resolve
dns server 3.1.1.2
ddns policy mypolicy
url oray://steven:nevets@phddnsdev.oray.net
#
interface GigabitEthernet1/0/0
ip address 1.1.1.2 255.255.0.0
ddns apply policy mypolicy
#
ospf 1
area 0.0.0.0
network 1.1.0.0 0.0.255.255
#
return
Issue 04 (2014-01-16)
145
4 DNS Configuration
Loopback0
4.1.1.2/32
RouterC
GE1/0/0
DDNS Client
GE1/0/0
1.1.1.1/16
GE2/0/0
2.1.1.1/16
GE1/0/0
3.1.1.1/16
GE2/0/0
2.1.1.2/16 DNS Server
3.1.1.2/16
DDNS Server
2.1.1.3/16
Configuration Roadmap
The configuration roadmap is as follows:
1.
2.
3.
4.
5.
6.
Procedure
Step 1 Configure RouterA.
# Create a DDNS policy.
<Huawei> system-view
[Huawei] sysname RouterA
[RouterA] ddns policy mypolicy
Issue 04 (2014-01-16)
146
4 DNS Configuration
# Configure a client SSL policy. For details about how to configure a client SSL policy, see
Example for Configuring a Client SSL Policy.
# Bind the SSL policy to the DDNS policy.
[RouterA] ddns policy mypolicy
[RouterA-ddns-policy-mypolicy] ssl-policy siemens
When the IP address of GigabitEthernet1/0/0 changes, RouterA notifies the DNS server to
establish the mapping between the domain name www.abc.com and the new IP address through
the DDNS server so that users on the Internet can resolve the latest IP address mapping
www.abc.com.
# Configure OSPF.
[RouterA] ospf
[RouterA-ospf-1] area 0
[RouterA-ospf-1-area-0.0.0.0] network 1.1.0.0 0.0.255.255
[RouterA-ospf-1-area-0.0.0.0] quit
[RouterA-ospf-1] quit
NOTE
To implement communication between the DDNS client, DDNS server, and the DNS server, configure
OSPF on RouterB and RouterC. For details about OSPF configurations on RouterB and RouterC, see the
configuration files.
Issue 04 (2014-01-16)
147
:
:
:
:
4 DNS Configuration
ESTABLISH(2)
2012-06-13 13:06:46
Success
2012-06-13 23:06:46
# Run the display ddns interface gigabitethernet 1/0/0 command on RouterA. You can view
information about the DDNS policy on GigabitEthernet1/0/0.
<RouterA> display ddns interface gigabitethernet 1/0/0
===== Policy mypolicy =======
URL: https://2.1.1.3/nic/update?
group=med&user=huawei_test&password=12345&myip=<a>
Statuses:
ESTABLISH
Refresh: enable
----End
Configuration Files
Configuration file of RouterA
#
sysname RouterA
#
ddns policy mypolicy
url https://2.1.1.3/nic/update?group=med&user=huawei_test&password=12345&myip=<a>
interval 36000
ssl-policy siemens
#
dns resolve
dns server 3.1.1.2
#
interface GigabitEthernet1/0/0
ip address 1.1.1.2 255.255.0.0
ddns apply policy mypolicy
#
ospf 1
area 0.0.0.0
network 1.1.0.0 0.0.255.255
#
return
Issue 04 (2014-01-16)
148
4 DNS Configuration
Procedure
Step 1 Run the display dns dynamic-host command check whether the specified domain name exists
in the dynamic domain name cache.
l If not, check whether the DNS client communicates with the DNS server properly, the DNS
server runs properly, and dynamic domain name resolution is enabled.
l If so, but the IP address is incorrect, go to step 2.
Step 2 Run the display dns server command to verify that the IP address of the DNS server is correct
on the DNS client.
If the DNS server IP address is incorrect, run the undo dns server ip-address command to delete
the configured DNS server IP address, and run the dns server ip-address command to
reconfigure a correct IP address for the DNS server.
----End
Issue 04 (2014-01-16)
149
4 DNS Configuration
4.8 FAQ
4.8.1 How Do I View the DNS Configuration of Devices?
Run the display current-configuration | include dns command.
4.8.3 Are Dynamic DNS Entries Aged at Intervals of the Aging Time
or Using the Command?
Yes. Run the reset dns dynamic-host command to clear dynamic domain name service (DNS)
entries.
150
4 DNS Configuration
4.9 References
The following table lists the references of this document:
Issue 04 (2014-01-16)
Document
Description
Remarks
RFC1034
RFC1035
151
5 NAT Configuration
NAT Configuration
Issue 04 (2014-01-16)
152
5 NAT Configuration
Purpose
The rapid development of the Internet brings an increasing number of network applications.
Exhaustion of IPv4 addresses has become a bottleneck for the network development. IPv6 can
solve the problem of IPv4 address shortage, but numerous network devices and applications are
based on IPv4. Major transitional technologies such as classless inter-domain routing (CIDR)
and private network addresses are used before the wide use of IPv6 addresses. NAT enables
users on private networks to access public networks. When a host on a private network accesses
a public network, NAT translates the host's private IP address to a public IP address. Multiple
hosts on a private network can share one public IP address. This implements network
communication while saving public IP addresses. For the classification of private IP addresses,
see 1.2.2 IPv4 Address.
Benefits
As a transitional plan, NAT enables address reuse to meet the demand for IP addresses, therefore
alleviating the IPv4 address shortage. In addition to solving the problem of IP address shortage,
NAT provides the following advantages:
l
Protects private networks against external attacks, greatly improving network security.
This function controls not only access to external networks from internal hosts, but also
access to the internal network from external users.
5.2 Principles
5.2.1 Overview
NAT translates the IP address in an IP datagram header to another IP address, allowing users on
private networks to access public networks. Basic NAT implements one-to-one translation
between one private IP address and one public IP address, whereas Network Address and Port
Translation (NAPT) implements one-to-many translation between one public IP address and
multiple private IP addresses.
Basic NAT
Basic NAT implements one-to-one IP address translation. In this mode, only the IP address is
translated, whereas the TCP/UDP port number remains unchanged. Basic NAT cannot translate
multiple private IP addresses to the same public IP address.
Issue 04 (2014-01-16)
153
5 NAT Configuration
10.1.1.100/8
Destination address
10.1.1.100
Router
Destination address
162.105.178.65
Source address
10.1.1.100
Source address
162.105.178.65
Server
211.100.7.34/24
NAT table
Internal host sends a request
External host responds to the request
Way
Outbound
Inbound
Before Router
10.1.1.100
162.105.178.65
After Router
162.105.178.65
10.1.1.100
The Router receives a request packet sent from the host on the private network for accessing
the server on the public network. The source IP address of the packet is 10.1.1.100.
2.
The Router selects an idle public IP address (162.105.178.65) from the IP address pool,
and sets up forward and reverse NAT entries that specify the mapping between the source
IP address of the packet and the public IP address. The Router translates the packet's source
IP address to the public IP address based on the forward NAT entry, and sends the packet
to the server on the public network. After the translation, the packet's source IP address is
162.105.178.65, and its destination IP address is 211.100.7.34.
3.
After receiving a response packet from the server on the public network, the Router queries
the reverse NAT entry based on the packet's destination IP address. The Router translates
the packet's destination IP address to the private IP address of the host on the private network
based on the reverse NAT entry, and sends the packet to the host. After the translation, the
packet's source IP address is 162.105.178.65, and its destination IP address is 10.1.1.100.
NOTE
Basic NAT cannot solve the problem of public IP address shortage because it cannot implement address
reuse. Therefore, basic NAT is seldom used in practice.
The number of public IP addresses owned by the NAT device is far less than the number of hosts on private
networks because not all the hosts on private networks access public networks at the same time. The number
of public IP addresses needs to be determined based on the number of hosts on private networks that access
public networks during peak hours.
NAPT
In addition to one-to-one address translation, NAPT allows multiple private IP addresses to be
mapped to the same public IP address. It is also called many-to-one address translation or address
reuse.
NAPT translates the IP address and port number of a packet so that multiple users on a private
network can use the same public IP address to access the public network.
Issue 04 (2014-01-16)
154
5 NAT Configuration
Source address
10.1.1.100:1025
10.1.1.100/8Destination address
10.1.1.100:1025
Host B
Address group
162.105.178.65
162.105.178.66
162.105.178.67
Router
Source address
162.105.178.6516384
Destination address
162.105.178.6516384
Server
Source address
162.105.178.6516400211.100.7.34/24
Source address
10.1.1.200:1028
Destination address
162.105.178.6516400
10.1.1.200/8 Destination address
10.1.1.200:1028
NAPT table
Way
Outbound
Inbound
Outbound
Inbound
Before Router
10.1.1.100:1025
After Router
162.105.178.65:16384
162.105.178.65:16384
10.1.1.200:1028
162.105.178.65:16400
10.1.1.100:1025
162.105.178.65:16400
10.1.1.200:1028
The Router receives a request packet sent from the host on the private network for accessing
the server on the public network.For example,the packet is sent from Host A to Router, its
source IP address is 10.1.1.100, and its port number is 1025.
2.
The Router selects an idle public IP address and an idle port number from the IP address
pool, and sets up forward and reverse NAPT entries that specify the mapping between the
source IP address and port number of the packet and the public IP address and port number.
The Router translates the packet's source IP address and port number to the public IP address
and port number based on the forward NAPT entry, and sends the packet to the server on
the public network.For example, after the translation is performed on the packet of Host
A, the packet's source IP address is 162.105.178.65, and its port number is 16384.
3.
After receiving a response packet from the server on the public network, the Router queries
the reverse NAPT entry based on the packet's destination IP address and port number. The
Router translates the packet's destination IP address and port number to the private IP
address and port number of the host on the private network based on the reverse NAPT
entry, and sends the packet to the host.For example, after the translation is performed on
the packet sent from the server to Host A, the packet's destination IP address is 10.1.1.100,
and its destination port number is 1025.
155
5 NAT Configuration
NAT address pool and Easy IP are implemented in similar ways. This section describes only
Easy IP. For the implementation of NAT address pool, see 5.2.1 Overview.
Easy IP
Easy IP uses access control lists (ACLs) to control the private IP addresses that can be translated.
Easy IP is applied to the scenario where hosts on small-scale LANs access the Internet. Smallscale LANs are usually deployed at small and medium-sized cybercafes or small-sized offices
where only a few internal hosts are used and the outbound interface obtains a temporary public
IP address through dial-up. The temporary public IP address is used by the internal hosts to
access the Internet. Easy IP allows the hosts to access the Internet using this temporary public
address.
Figure 5-3 Networking diagram for Easy IP
Host A
Source address
10.1.1.100:1540
Source address
162.10.2.85480
Host B
Router
Destination address
162.10.2.85480
162.10.2.8/24
Source address
10.1.1.200:1586
Server
Source address
162.10.2.85481 211.100.7.34/24
Destination address
162.10.2.85481
10.1.1.200/8
Destination address
10.1.1.200:1586
Easy IP table
Way
Before Router
After Router
Outbound
10.1.1.1001540
162.10.2.85480
Inbound
162.10.2.85480
10.1.1.1001540
Outbound
10.1.1.2001586
162.10.2.85481
Inbound
162.10.2.85481
10.1.1.2001586
The Router receives a request packet sent from the host on the private network for accessing
the server on the public network. The packet's source IP address is 10.1.1.100, and its port
number is 1540.
2.
The Router sets up forward and reverse Easy IP entries that specify the mapping between
the source IP address and port number of the packet and the public IP address and port
number of the port connected to the public network. The Router translates the source IP
address and port number of the packet to the public IP address and port number based on
the forward Easy IP entry, and sends the packet to the server on the public network. After
the translation, the packet's source IP address is 162.10.2.8, and its port number is 5480.
3.
After receiving a response packet from the server on the public network, the Router queries
the reverse Easy IP entry based on the packet's destination IP address and port number. The
Issue 04 (2014-01-16)
156
5 NAT Configuration
Router translates the packet's destination IP address and port number to the private IP
address and port number of the host on the private network based on the reverse Easy IP
entry, and sends the packet to the host. After the translation, the packet's destination IP
address is 10.1.1.100, and its port number is 1540.
NAT Server
NAT can shield hosts on private networks from public network users. When a private network
needs to provide services such as WWW and FTP services for public network users, servers on
the private network must be accessible to public network users at any time.
The NAT server can address the preceding problem by translating the public IP address and port
number to the private IP address and port number based on the preset mapping.
Figure 5-4 Networking diagram for NAT server implementation
NAT Server
Global: 209.102.1.6880
Local: 192.168.1.6880
Internal server
192.168.1.68
Destination address
192.168.1.68:80
Router
External host
178.16.32.60
Destination address
209.102.1.68:80
Internet
Source address
192.168.1.68:80
Source address
209.102.1.68:80
NAT table
External host sends a request
Internal host responds to the request
Way
Before Router
After Router
Inbound
209.102.1.68:80
192.168.1.68:80
Outbound
192.168.1.68:80
209.102.1.68:80
As shown in Figure 5-4, the address translation process of the NAT server is as follows:
1.
Address translation entries of the NAT server are configured on the Router.
2.
The Router receives an access request sent from a host on the public network. The
Router queries the address translation entry based on the packet's destination IP address
and port number. The Router translates the packet's destination IP address and port number
to the private IP address and port number based on the address translation entry, and sends
the packet to the server on the private network. The destination IP address of the packet
sent by the host on the public network is 209.102.1.68, and its port number is 80. After the
translation by the Router, the destination IP address of the packet is 192.168.1.68, and its
port number remains unchanged.
3.
After receiving a response packet sent from the server on the private network, the Router
queries the address translation entry based on the packet's source IP address and port
number. The Router translates the packet's source IP address and port number to the public
IP address and port number based on the address translation entry, and sends the packet to
the host on the public network. The source of the response packet sent from the host on the
private network is 192.168.1.68, and its port number is 80. After translation by the
Router, the source IP address of the packet is 209.102.1.68, and its port number remains
unchanged.
Issue 04 (2014-01-16)
157
5 NAT Configuration
Static NAT/NAPT
Static NAT indicates that a private IP address is statically bound to a public IP address when
NAT is performed. Only this private IP address can be translated to this public IP address.
Static NAPT indicates that the combination of a private IP address, protocol number, and port
number is statically bound to the combination of a public IP address, protocol number, and port
number. Multiple private IP addresses can be translated to the same public IP address.
Static NAT/NAPT can also translate host IP addresses in the specified private address range to
host IP addresses in the specified public address range. When an internal host accesses the
external network, static NAT or NAPT translates the IP address of the internal host to a public
address if the IP address of the internal host is in the specified address range. An external host
can directly access an internal host if the private IP address translated from the IP address of the
external host is in the specified internal address range.
Field
DNS
FTP
Issue 04 (2014-01-16)
158
5 NAT Configuration
Application Protocol
Field
SIP
l Request line
l From
l To
l Contact
l Via
l O
l Connection information field (indicating an IP address) and
media description field (indicating a port) in the Message
body
Port field in a setup/reply OK packet
RTSP
10.1.1.200/8
www.test.com
DNS server
Router
211.100.7.34/24
www.test.com=162.10.2.5
Host
10.1.1.100/8
DNS Mapping:
162.10.2.5->10.1.1.200
DNS response=10.1.1.200
Issue 04 (2014-01-16)
159
5 NAT Configuration
As shown in Figure 5-5, the host on the private network needs to access the web server using
the domain name, and the Router functions as a NAT server. After receiving a DNS response
packet, the Router searches the DNS mapping table for the information about the web server
based on the domain name carried in the response packet. Then, the Router replaces the public
IP address carried in the DNS response packet with the private IP address of the web server. In
this manner, the DNS response packet received by the host carries the private IP address of the
web server. Then, the host can access the web server using the domain name.
Server
External
network
NAT rule
VPN 210.1.1.1-202.1.2.1
Host B
IP address10.1.1.1
VPN 2
NAT rule
VPN 110.1.1.1-202.1.1.1
Router
Private IP
addresses of VPN
1 and VPN 2 are
overlapped.
Host A
IP address10.1.1.1
VPN 1
160
5 NAT Configuration
1.
The IP addresses of host A in VPN 1 and host B in VPN 2 are 10.1.1.1. Host A and host B
want to access the same server on the public network.
2.
When a router functions as a NAT device, the router translates the source IP address of the
packet sent from host A to 202.1.1.1 and the source IP address of the packet sent from host
B to 202.1.2.1. In addition, the router records the VPN information about the hosts in the
NAT translation table.
3.
When the response packets sent from the server on the public network to host A and host
B pass through the router:
l The NAT module translates the destination IP address 202.1.1.1 of the packet sent to
host A to 10.1.1.1 based on the NAT translation table, and then sends the packet to host
A in VPN 1.
l The NAT module translates the destination IP address 202.1.2.1 of the packet sent to
host B to 10.1.1.1 based on the NAT translation table, and then sends the packet to host
B in VPN 2.
External
network
NAT server
LocalVPN 1 10.1.1.1
Global202.1.10.1
NAT server
LocalVPN 2 10.1.1.1
Global202.1.20.1
Router
Server A
IP address: 10.1.1.1
Server B
IP address: 10.1.1.1
VPN 2
Private IP
addresses of VPN
1 and VPN 2 are
overlapped.
VPN 1
As shown in Figure 5-7, the IP addresses of server A in VPN 1 and server B in VPN 2 are
10.1.1.1. The public address of server A is 202.1.10.1 and that of server B is 202.1.20.1. Hosts
on the public network can access server A using 202.1.10.1 and access server B using 202.1.20.1.
The NAT server associated with VPNs is implemented as follows:
Issue 04 (2014-01-16)
161
5 NAT Configuration
1.
A host on the public network sends a packet with the destination IP address as 202.1.10.1
to server A in VPN 1 and sends a packet with the destination IP address as 202.1.20.1 to
server B in VPN 2.
2.
The router functions as the NAT server. Based on the packets' destination IP addresses and
VPN information:
l The router translates the destination address 202.1.10.1 to 10.1.1.1 and sends the packet
to server A in VPN 1.
l The router translates the destination address 202.1.20.1 to 10.1.1.1 and sends the packet
to server B in VPN 2.
In addition, the router records the VPN information in the NAT translation table.
3.
When the response packets sent from server A and server B to the host on the public network
pass through the router:
l The NAT module translates the source IP address 10.1.1.1 of the packet sent from server
A to 202.1.10.1 based on the NAT translation table, and sends the packet to the host on
the public network.
l The NAT module translates the source IP address 10.1.1.1 of the packet sent from server
B to 202.1.20.1 based on the NAT translation table, and sends the packet to the host on
the public network.
Host B
Address group
3.3.3.1
3.3.3.2
1.1.1.1
www.example.com
Host A
External
network
1.1.1.1
Router
DNS server
Issue 04 (2014-01-16)
Host A with the IP address 1.1.1.1 on the private network wants to access host B with the
same IP address on the public network. Host A sends a DNS request to the DNS server on
the public network. The DNS server sends a response packet containing the IP address
1.1.1.1 of host B. When the response packet passes through the router, the router performs
DNS ALG and translates host B's IP address 1.1.1.1 in the response packet to the unique
temporary IP address 3.3.3.1. Then, the router forwards the response packet to Host A.
Huawei Proprietary and Confidential
Copyright Huawei Technologies Co., Ltd.
162
5 NAT Configuration
2.
Host A sends a request packet with the destination IP address as the temporary IP address
3.3.3.1, for accessing host B. When the request packet passes through the router, the
router detects that the destination IP address is the temporary IP address, and translates the
destination IP address to host B's real IP address 1.1.1.1. Meanwhile, the router translates
the source IP address of the request packet to an address in the outbound NAT address pool
using outbound NAT. Then, the router forwards the request packet to host B.
3.
Host B sends host A a response packet with the destination IP address as the address in the
outbound NAT address pool and the source IP address as the IP address of host B 1.1.1.1.
When the response packet passes through the router, the router detects that the source IP
address is the same as the real IP address of host A, and translates the source IP address to
the temporary IP address 3.3.3.1 using NAT. Meanwhile, the router translates the
destination IP address of the response packet to the private IP address 1.1.1.1 of host A.
Then, the router forwards the response packet to host A.
Figure 5-9 Networking diagram for twice NAT when multiple VPNs are deployed on a private
network
Host B
1.1.1.1
Address group
3.3.3.1
4.4.4.1
Host B
1.1.1.1
www.example.com
VPN B
Host A
1.1.1.1
Router
VPN A
External
network
DNS server
A private network may consist of multiple VPNs and hosts in the VPNs may have the same IP
address. When configuring DNS ALG on a router, you need to add the VPN information that is
used as the condition for mapping identical IP addresses of the hosts in the VPNs to IP addresses
in the temporary address pool. Figure 5-9 shows the networking for twice NAT when multiple
VPNs are deployed on a private network. When multiple VPNs are deployed on a private
network, the twice NAT process remains unchanged. The source IP address of host A in VPN
A is translated to the temporary address 3.3.3.1, and the source IP address of host B in VPN B
is translated to the temporary address 4.4.4.1.
NAT Filtering
A NAT device filters the traffic from external network to internal network. NAT filtering
includes the following modes:
Issue 04 (2014-01-16)
163
5 NAT Configuration
Endpoint-independent filtering
Endpoint-dependent filtering
PC 2: 202.1.10.1
Internet
PC 1
Data packet 2
Source IP202.1.20.1
Source port4444
Destination IP10.1.1.1
Destination port1111
Data packet 3
Source IP202.1.10.1
Source port3333
Destination IP10.1.1.1
Destination port1111
Data packet 4
Source IP202.1.10.1
Source port2222
Destination IP10.1.1.1
Destination port1111
PC 3: 202.1.20.1
As shown in the preceding figure, PC-1 on the private network communicates with PC-2 and
PC-3 on the public network using a NAT device. Datagram 1 is sent from PC-1 to PC-2. The
source port number of the datagram is 1111 and the destination port number is 2222. The NAT
device translates the source IP address to 202.169.10.1.
After PC-1 sends an access request to a PC on the public network, the PC on the public network
transmits traffic to PC-1, and the NAT device filters the traffic destined for PC-1. Datagram 2',
datagram 3', and datagram 4' are sent in three scenarios corresponding to the preceding three
NAT filtering modes.
l
Datagram 2' is sent from PC-3 to PC-1. The destination address of datagram 2 is different
from that of datagram 1, and the destination port number is 1111. Datagram 2 can pass
through the NAT device only when endpoint-independent filtering is used.
Datagram 3' is sent from PC-2 to PC-1. The destination address of datagram 3 is the same
as that of datagram 1, and the destination port number is 1111. The source port number of
datagram 3 is 3333, which is different from that of datagram 1. Datagram 3 can pass through
Issue 04 (2014-01-16)
164
5 NAT Configuration
Datagram 4' is sent from PC-2 to PC-1. The destination address of datagram 4 is the same
as that of datagram 1, and the destination port number is 1111. The source port number of
datagram 4 is 2222, which is the same as that of datagram 1. In this case, endpoint and portdependent filtering is used, which is the default one. Datagram 4 can pass through the NAT
device no matter whether a filtering mode is configured or no matter which filtering mode
is configured.
NAT Mapping
After NAT mapping is enabled on a public network, it seems that all flows from a private network
come from the same IP address because hosts on the private network share the same public IP
address. When a host on the private network initiates a session request to a host on the public
network, the NAT device searches the NAT translation table for the related session record. If
the NAT device finds the session record, it translates the private IP address and port number and
forwards the request. If the NAT device does not find the session record, it translates the private
IP address and port number and meanwhile adds a session record to the NAT translation table.
NAT mapping includes the following modes:
l
Endpoint-independent mapping: The NAT uses the same IP address and port mapping for
packets sent from the same private IP address and port to any public IP address and port.
Endpoint and port-dependent mapping: The NAT uses the same port mapping for packets
sent from the same private IP address and port to the same public IP address and port if the
mapping is still active.
5.3 Applications
5.3.1 Private Network Hosts Accessing Public Network
Private IP addresses are planned for hosts on private networks for communities, schools, and
enterprises because public IP addresses are limited. In this case, the NAT technology can be
used to implement access from hosts on the private networks to public networks. As shown in
Figure 5-11, Easy IP is configured on the Router to enable the hosts on the private network to
access the server on the public network.
Issue 04 (2014-01-16)
165
5 NAT Configuration
Figure 5-11 Networking diagram for private network hosts accessing public network servers
Host A
192.168.1.1/24
Host B
Server
Router
External
network
211.100.7.34/24
192.168.1.2/24
Host C
192.168.1.3/24
192.168.1.1/24
Host B
Host C
Router
External
network
192.168.1.2/24
211.138.7.94/24
Server
192.168.1.100/24
Issue 04 (2014-01-16)
166
5 NAT Configuration
192.168.1.1/24
Host B
DNS server
Router
External
network
192.168.1.2/24
Web server
210.33.5.1/24
www.test.com=211.65.3.1
192.168.1.100/24
www.test.com
Issue 04 (2014-01-16)
167
5 NAT Configuration
External
network
211.65.3.1/24
Router
Host B
Host A
VPN A
192.168.1.1/24
VPN B
192.168.1.1/24
Issue 04 (2014-01-16)
168
5 NAT Configuration
Issue 04 (2014-01-16)
Scenario
Description
Task
Internal
hosts use
private IP
addresses to
access
external
networks.
Important
internal
hosts use
fixed public
IP addresses
and
interface
numbers to
communica
te with
external
hosts.
169
5 NAT Configuration
Scenario
Description
Task
External
users access
internal
servers.
When configuring the NAT service on high-end LAN cards (8FE1GE and 24GE), run the
set workmode lan-card l3centralize command to disable the routing and forwarding
function. Then packets received on high-end LAN cards are all forwarded by the CPU of
the forwarding plane so that the NAT configuration can take effect.
When new NAT entries are added to an interface or existing NAT configuration on the
interface is modified, run the reset nat session { all | transit interface interface-type
interface-number } command to clear the session table. Then the NAT configuration takes
effect on all session entries, including the entries that are not aged out.
When interface A borrows the IP address of B1 to configure nat outbound, NAT functions
normally. However, when interface A borrows the IP address of B2, you need to configure
nat again to make the IP address take effect.
The user network route (UNR) protocol is used to advertise the corresponding routing
entries. If the number of routes on the device exceeds the upper limit, the UNR routing
entries of NAT fail to be delivered and therefore the NAT function does not take effect.
After the NAT configuration is complete, you are advised to run the display ip routingtable command to check whether the UNR routing entries of NAT exist. If the entries do
not exist, you can delete useless routing entries so that the UNR routing entries of NAT are
successfully delivered.
170
5 NAT Configuration
An ACL with the specified number is created and the ACL view is displayed.
Step 3 Configure basic or advanced ACLs as required. For details, see rule (basic ACL view) or rule
(advanced ACL view).
NOTE
Only basic ACLs (2000 to 3999) and advanced ACLs can be used to configure the NAT function.
1. When permit is used in the ACL rule, the system uses the address pool to translate addresses for the
packets of which the source IP address is specified in the ACL rule.
2. When permit is not used in the ACL rule, the NAT policy referencing the ACL does not take effect.
That is, the system searches routes for packets, but does not translate addresses.
----End
After users configure the IP address of outbound ports and other applications on the NAT
device, there are still some available public IP addresses. Users can choose outbound NAT
with an address pool.
After users configure the IP address of outbound ports on the NAT device and other
applications, there are no available public IP addresses. Users can choose Easy IP that uses
the IP address of outbound ports on the NAT device to implement dynamic NAT.
Procedure
Step 1 Run:
system-view
171
5 NAT Configuration
Run:
nat address-group group-index start-address end-address
Run:
interface interface-type interface-number
Run:
nat outbound acl-number [ address-group group-index [ no-pat ] |
interface interface-type interface-number ]
Run:
interface interface-type interface-number
Run:
nat outbound acl-number
Easy IP is configured.
----End
Procedure
Step 1 Run:
system-view
Issue 04 (2014-01-16)
172
5 NAT Configuration
Endpoint-and-port-independent filtering
Endpoint-and-port-dependent filtering
NOTE
Configure endpoint-and-port-dependent NAT mapping and filtering to enable SIP proxy to traverse NAT
devices.
Procedure
Step 1 Run:
system-view
173
5 NAT Configuration
| endpoint-independent | endpoint-and-port-
An overlapping address pool specifies which internal IP addresses can overlap with public
IP addresses. Twice NAT is performed only on the addresses in the overlapping address
pool.
A temporary address pool specifies which temporary IP addresses can replace addresses in
the overlapping address pool.
Procedure
Step 1 Run:
system-view
The mapping between the overlapping address pool and the temporary address pool is
configured.
NOTE
l A maximum of 255 addresses can be configured in the overlapping address pool and the temporary
address pool.
l When the VPN instance specified in the command is deleted, the configuration of twice NAT is also
deleted.
----End
174
5 NAT Configuration
NAT logs
Internet
NAT Device
Procedure
Step 1 Run:
system-view
Run:
info-center enable
Run:
info-center loghost ip-address [ channel { channel-number | channel-name }
| facility local-number | { language language-name | binary [ port ] } |
{ vpn-instance vpn-instance-name | public-net } ] *
The channel through which logs are output to the log host is configured.
The router supports a maximum of eight log hosts to implement backup among log
hosts.
NOTE
For details on how to configure the router to send logs to a log host, see Example for Outputting
Log Information to a Log Host in "Information Center Configuration" of the Huawei
AR150&200&1200&2200&3200 Series Enterprise Routers Configuration Guide - Device
Management.
175
5 NAT Configuration
Run the display nat address-group [ group-index ] [ verbose ] command to check the
configuration of a NAT address pool.
Run the display nat alg command to check the NAT ALG configuration.
Run the display nat overlap-address { map-index | all | inside-vpn-instance inside-vpninstance-name } command to check the configuration of twice NAT.
Run the display firewall-nat session aging-time command to check the aging time of NAT
mapping entries.
Run the display nat filter-mode command to check the current NAT filtering mode.
Run the display nat mapping-mode command to check the NAT mapping mode.
Run the display nat mapping table { all | number } or display nat mapping table insideaddress ip-address protocol protocol-name port port-number [ vpn-instance vpninstance-name ] command to check the NAT table information or the number of entries in
the NAT table.
----End
Issue 04 (2014-01-16)
176
5 NAT Configuration
Run:
system-view
Run:
interface interface-type interface-number
Run:
system-view
3.
Run:
interface interface-type interface-number
177
4.
5 NAT Configuration
Run:
nat static enable
l To specify a global VPN, you are advised to configure static NAT in the interface view. Then the device
can automatically obtain information about the VPN instance associated with the interface, and you
do not need to manually specify the VPN instance at the public network side (global). To associate
static NAT with a global VPN in the system view, you can specify a loopback interface as the outbound
interface at the public network side, and then specify a VPN instance.
l When configuring static NAT, ensure that global-address and host-address are different from IP
addresses of interfaces and IP addresses in the user address pool.
l If you run the undo nat static command, static mapping entries are not immediately deleted. To clear
static mapping entries, run the reset nat session command.
l You are advised to use the second method if multiple interfaces use the same static NAT mapping.
l When you configure static one-to-one NAT that borrows an interface IP address (no interface number
is specified and the IP address is mapped to a private network address), other services enabled on the
interface may become unavailable. Confirm your action before performing the configuration. If you
want to enable other applications on the interface, add an ACL rule after the configuration to filter out
the number of the interface on which the applications are enabled.
----End
Procedure
Step 1 Run:
system-view
178
5 NAT Configuration
Run the port-mapping protocol to configure port mapping when the application protocol that
is enabled with the NAT ALG function uses a non-well-known port number, namely a nondefault port number.
----End
Procedure
Step 1 Run:
system-view
A mapping from a domain name to a public IP address, an interface number, and a protocol type
is configured.
NOTE
After DNS mapping is configured, the nat alg dns enable command must be run to enable the ALG DNS
function. In this way, DNS response packets can traverse NAT devices. If the ALG DNS function is
disabled, internal hosts cannot access internal servers using the domain name.
----End
179
5 NAT Configuration
must be configured to allow only packets that meet the filtering and mapping conditions to pass
through.
The device supports the following NAT mapping types:
l
Endpoint-and-port-independent filtering
Endpoint-and-port-dependent filtering
NOTE
Configure endpoint-and-port-dependent NAT mapping and filtering to enable SIP proxy to traverse NAT
devices.
Procedure
Step 1 Run:
system-view
| endpoint-independent | endpoint-and-port-
180
5 NAT Configuration
An overlapping address pool specifies which internal IP addresses can overlap with public
IP addresses. Twice NAT is performed only on the addresses in the overlapping address
pool.
A temporary address pool specifies which temporary IP addresses can replace addresses in
the overlapping address pool.
Procedure
Step 1 Run:
system-view
The mapping between the overlapping address pool and the temporary address pool is
configured.
NOTE
l A maximum of 255 addresses can be configured in the overlapping address pool and the temporary
address pool.
l When the VPN instance specified in the command is deleted, the configuration of twice NAT is also
deleted.
----End
NAT logs
Internet
NAT Device
Issue 04 (2014-01-16)
181
5 NAT Configuration
Procedure
Step 1 Run:
system-view
Run:
info-center enable
Run:
info-center loghost ip-address [ channel { channel-number | channel-name }
| facility local-number | { language language-name | binary [ port ] } |
{ vpn-instance vpn-instance-name | public-net } ] *
The channel through which logs are output to the log host is configured.
The router supports a maximum of eight log hosts to implement backup among log
hosts.
NOTE
For details on how to configure the router to send logs to a log host, see Example for Outputting
Log Information to a Log Host in "Information Center Configuration" of the Huawei
AR150&200&1200&2200&3200 Series Enterprise Routers Configuration Guide - Device
Management.
182
5 NAT Configuration
Step 2 Run:
firewall-nat session { dns | ftp | ftp-data | http | icmp | tcp | tcp-proxy | udp
| sip | sip-media | rtsp | rtsp-media } aging-time time-value
Run the display nat alg command to check the NAT ALG configuration.
Run the display nat dns-map [ domain-name ] command to check the configuration of
DNS mapping.
Run the display nat overlap-address { map-index | all | inside-vpn-instance inside-vpninstance-name } command to check the configuration of twice NAT.
Run the display firewall-nat session aging-time command to check the aging time of NAT
mapping entries.
Run the display nat static [ global global-address | inside host-address [ vpn-instance
vpn-instance-name ] | interface interface-type interface-name | acl acl-number] command
to check the configuration of static NAT.
Run the display nat filter-mode command to check the the current NAT filtering mode.
Run the display nat mapping-mode command to check the NAT mapping mode.
Run the display nat mapping table { all | number } or display nat mapping table insideaddress ip-address protocol protocol-name port port-number [ vpn-instance vpninstance-name ] command to check the NAT table information or the number of entries in
the NAT table.
Run the display nat static interface enable command to check whether the static NAT
function is enabled.
----End
183
5 NAT Configuration
Step 2 Run:
interface interface-type interface-number
l When configuring an internal NAT server, ensure that global-address and host-address are different
from IP addresses of ports and IP addresses in the user address pool.
l You can use the IP address of current-interface or loopback as the internal server's IP address.
l The undo nat server command does not delete mapping entries immediately. You can run the reset
nat session command to delete mapping entries.
l Compared with static NAT, NAT Server translates only the IP address, but not the port number, when
the private network initiatively accesses the public network.
l When you configure one-to-one NAT Server that borrows an interface IP address (no interface number
is specified and the IP address is mapped to a private network address), other services enabled on the
interface may become unavailable. Confirm your action before performing the configuration. If you
want to enable other applications on the interface, add an ACL rule after the configuration to filter out
the number of the interface on which the applications are enabled.
----End
Procedure
Step 1 Run:
system-view
184
5 NAT Configuration
Step 2 Run:
nat alg { all | protocol-name } enable
Procedure
Step 1 Run:
system-view
A mapping from a domain name to a public IP address, an interface number, and a protocol type
is configured.
NOTE
After DNS mapping is configured, the nat alg dns enable command must be run to enable the ALG DNS
function. In this way, DNS response packets can traverse NAT devices. If the ALG DNS function is
disabled, internal hosts cannot access internal servers using the domain name.
----End
Issue 04 (2014-01-16)
185
5 NAT Configuration
Endpoint-and-port-independent filtering
Endpoint-and-port-dependent filtering
NOTE
Configure endpoint-and-port-dependent NAT mapping and filtering to enable SIP proxy to traverse NAT
devices.
Procedure
Step 1 Run:
system-view
| endpoint-independent | endpoint-and-port-
186
5 NAT Configuration
An overlapping address pool specifies which internal IP addresses can overlap with public
IP addresses. Twice NAT is performed only on the addresses in the overlapping address
pool.
A temporary address pool specifies which temporary IP addresses can replace addresses in
the overlapping address pool.
Procedure
Step 1 Run:
system-view
The mapping between the overlapping address pool and the temporary address pool is
configured.
NOTE
l A maximum of 255 addresses can be configured in the overlapping address pool and the temporary
address pool.
l When the VPN instance specified in the command is deleted, the configuration of twice NAT is also
deleted.
----End
Issue 04 (2014-01-16)
187
5 NAT Configuration
NAT logs
Internet
NAT Device
Procedure
Step 1 Run:
system-view
Run:
info-center enable
Run:
info-center loghost ip-address [ channel { channel-number | channel-name }
| facility local-number | { language language-name | binary [ port ] } |
{ vpn-instance vpn-instance-name | public-net } ] *
The channel through which logs are output to the log host is configured.
The router supports a maximum of eight log hosts to implement backup among log
hosts.
NOTE
For details on how to configure the router to send logs to a log host, see Example for Outputting
Log Information to a Log Host in "Information Center Configuration" of the Huawei
AR150&200&1200&2200&3200 Series Enterprise Routers Configuration Guide - Device
Management.
188
5 NAT Configuration
Run the display nat server [ global global-address | inside host-address [ vpn-instance
vpn-instance-name ] | interface interface-type interface-number | acl acl-number ]
command to check the configuration of the NAT server.
Run the display nat alg command to check the NAT ALG configuration.
Run the display nat dns-map [ domain-name ] command to check the configuration of
DNS mapping.
Run the display nat overlap-address { map-index | all | inside-vpn-instance inside-vpninstance-name } command to check the configuration of twice NAT.
Run the display firewall-nat session aging-time command to check the aging time of NAT
mapping entries.
Run the display nat filter-mode command to check the the current NAT filtering mode.
Run the display nat mapping-mode command to check the NAT mapping mode.
Run the display nat mapping table { all | number } or display nat mapping table insideaddress ip-address protocol protocol-name port port-number [ vpn-instance vpninstance-name ] command to check the NAT table information or the number of entries in
the NAT table.
----End
189
5 NAT Configuration
The cleared entries cannot be restored; therefore, confirm the action before you use the command.
Procedure
l
After you are determined to clear NAT mapping entries, run the reset nat session { all |
transit interface interface-type interface-number } command in the system view.
----End
Run the display nat session { all [ verbose ] | number } or display nat session
{ protocol { protocol-name | protocol-number } | source source-address [ source-port ] |
destination destination-address [ destination-port ] }* [ verbose ] command to display
information about entries in the NAT mapping table.
----End
Issue 04 (2014-01-16)
190
5 NAT Configuration
VLAN 100
Eth2/0/0
Router
Eth2/0/1
VLAN 200
202.169.10.2/24
GE3/0/0
202.169.10.1/24
Internet
Area B
PC 1...PC n
10.0.0.0/24
Configuration Roadmap
The configuration roadmap is as follows:
1.
Configure IP addresses for ports, default route, and outbound NAT on the WAN interface
to allow internal hosts to access external networks.
Procedure
Step 1 Configure an IP address for ports on the router.
<Huawei> system-view
[Huawei] sysname Router
[Router] vlan 100
[Router-vlan100] quit
[Router] interface vlanif 100
[Router-Vlanif100] ip address 192.168.20.1 24
[Router-Vlanif100] quit
[Router] interface ethernet 2/0/0
[Router-Ethernet2/0/0] port link-type access
[Router-Ethernet2/0/0] port default vlan 100
[Router-Ethernet2/0/0] quit
[Router] vlan 200
[Router-vlan200] quit
[Router] interface vlanif 200
[Router-Vlanif200] ip address 10.0.0.1 24
[Router-Vlanif200] quit
[Router] interface ethernet 2/0/1
[Router-Ethernet2/0/1] port link-type access
[Router-Ethernet2/0/1] port default vlan 200
[Router-Ethernet2/0/1] quit
[Router] interface gigabitethernet 3/0/0
[Router-GigabitEthernet3/0/0] ip address 202.169.10.1 24
[Router-GigabitEthernet3/0/0] quit
Step 2 Configure a default route with next hop address 202.169.10.2 on the router.
[Router] ip route-static 0.0.0.0 0.0.0.0 202.169.10.2
Issue 04 (2014-01-16)
191
5 NAT Configuration
To run the ping -a source-ip-address command that has a source IP address specified on the router to verify that
intranet users can access the Internet, you need to run the ip soft-forward enhance enable command to enable
the enhanced forwarding function for control packets generated by the device so that the private source IP
addresses can be translated into public IP addresses by the NAT function.
# Run the ping command on the router to verify that users on the internal network can access
the Internet.
<Router> ping -a 192.168.20.1 202.169.10.2
PING 202.169.10.2: 56 data bytes, press CTRL_C
Reply from 202.169.10.2: bytes=56 Sequence=1
Reply from 202.169.10.2: bytes=56 Sequence=2
Reply from 202.169.10.2: bytes=56 Sequence=3
Reply from 202.169.10.2: bytes=56 Sequence=4
Reply from 202.169.10.2: bytes=56 Sequence=5
-- 202.169.10.2 ping statistics --5 packet(s) transmitted
5 packet(s) received
0.00% packet loss
round-trip min/avg/max = 1/1/2 ms
<Router> ping -a 10.0.0.1 202.169.10.2
PING 202.169.10.2: 56 data bytes, press CTRL_C
Reply from 202.169.10.2: bytes=56 Sequence=1
Reply from 202.169.10.2: bytes=56 Sequence=2
Reply from 202.169.10.2: bytes=56 Sequence=3
Reply from 202.169.10.2: bytes=56 Sequence=4
Reply from 202.169.10.2: bytes=56 Sequence=5
-- 202.169.10.2 ping statistics --5 packet(s) transmitted
5 packet(s) received
0.00% packet loss
round-trip min/avg/max = 1/1/2 ms
to break
ttl=255 time=1
ttl=255 time=1
ttl=255 time=1
ttl=255 time=1
ttl=255 time=1
ms
ms
ms
ms
ms
to break
ttl=255 time=1
ttl=255 time=1
ttl=255 time=1
ttl=255 time=1
ttl=255 time=1
ms
ms
ms
ms
ms
----End
Issue 04 (2014-01-16)
192
5 NAT Configuration
Configuration Files
Configuration file of the router
#
sysname Router
#
ip soft-forward enhance enable
#
vlan batch 100 200
#
acl number 2000
rule 5 permit source 192.168.20.0 0.0.0.255
#
acl number 2001
rule 5 permit source 10.0.0.0 0.0.0.255
#
nat address-group 1 202.169.10.100 202.169.10.200
nat address-group 2 202.169.10.80 202.169.10.83
#
interface Vlanif100
ip address 192.168.20.1 255.255.255.0
#
interface Vlanif200
ip address 10.0.0.1 255.255.255.0
#
interface Ethernet2/0/0
port link-type access
port default vlan 100
#
interface Ethernet2/0/1
port link-type access
port default vlan 200
#
interface GigabitEthernet3/0/0
ip address 202.169.10.1
255.255.255.0
nat outbound 2000 address-group 1 no-pat
nat outbound 2001 address-group 2
#
ip route-static 0.0.0.0 0.0.0.0 202.169.10.2
#
return
Issue 04 (2014-01-16)
193
5 NAT Configuration
Internet
192.168.0.2/24
Configuration Roadmap
The configuration roadmap is as follows:
1.
Configure the IP address of ports, default route, and static NAT on the WAN interface to
implements one-to-one translation between a private IP address and a public IP address.
Procedure
Step 1 Configure an IP address for ports on the router.
<Huawei> system-view
[Huawei] sysname Router
[Router] interface gigabitethernet 2/0/0
[Router-GigabitEthernet2/0/0] ip address 202.10.1.2 24
[Router-GigabitEthernet2/0/0] quit
[Router] interface gigabitethernet 1/0/0
[Router-GigabitEthernet1/0/0] ip address 192.168.0.1 24
[Router-GigabitEthernet1/0/0] quit
Step 2 Configure a default route with next hop address 202.10.1.1 on the router.
[Router] ip route-static 0.0.0.0 0.0.0.0 202.10.1.1
Step 3 Configure one-to-one NAT mapping on uplink interface GE2/0/0 on the router.
[Router] interface gigabitethernet 2/0/0
[Router-GigabitEthernet2/0/0] nat static global 202.10.1.3 inside 192.168.0.2
[Router-GigabitEthernet2/0/0] quit
----End
Issue 04 (2014-01-16)
194
5 NAT Configuration
Configuration Files
Configuration file of the router
#
sysname Router
#
interface
GigabitEthernet1/0/0
ip address 192.168.0.1 255.255.255.0
#
interface GigabitEthernet2/0/0
ip address 202.10.1.2 255.255.255.0
nat static global 202.10.1.3 inside 192.168.0.2 netmask 255.255.255.255
#
ip route-static 0.0.0.0 0.0.0.0 202.10.1.1
#
return
Router
Eth2/0/0
GE3/0/0
Eth2/0/1
Internet
External
user
FTP server
10.0.0.3/24
Configuration Roadmap
The configuration roadmap is as follows:
Issue 04 (2014-01-16)
195
5 NAT Configuration
1.
Configure an IP address for ports on the router and configure an NAT server on
Gigabitethernet 3/0/0 to allow external users to access internal servers.
2.
3.
Enable the FTP NAT ALG function to allow external FTP packets to traverse the NAT
server.
Procedure
Step 1 Configure an IP address for the ports on the router and configure a NAT server.
<Huawei> system-view
[Huawei] sysname Router
[Router] vlan 100
[Router-vlan100] quit
[Router] interface vlanif 100
[Router-Vlanif100] ip address 192.168.20.1 24
[Router-Vlanif100] quit
[Router] interface ethernet 2/0/0
[Router-Ethernet2/0/0] port link-type access
[Router-Ethernet2/0/0] port default vlan 100
[Router-Ethernet2/0/0] quit
[Router] vlan 200
[Router-vlan200] quit
[Router] interface vlanif 200
[Router-Vlanif200] ip address 10.0.0.1 24
[Router-Vlanif200] quit
[Router] interface ethernet 2/0/1
[Router-Ethernet2/0/1] port link-type access
[Router-Ethernet2/0/1] port default vlan 200
[Router-Ethernet2/0/1] quit
[Router] interface gigabitethernet 3/0/0
[Router-GigabitEthernet3/0/0] ip address 202.169.10.1 24
[Router-GigabitEthernet3/0/0] nat server protocol tcp global 202.169.10.5 www
inside 192.168.20.2 8080
[Router-GigabitEthernet3/0/0] nat server protocol tcp global 202.169.10.33 ftp
inside 10.0.0.3 ftp
[Router-GigabitEthernet3/0/0] quit
Step 2 Configure a default route with next hop address 202.169.10.2 on the router.
[Router] ip route-static 0.0.0.0 0.0.0.0 202.169.10.2
Step 3 Enable the NAT ALG function for FTP packets on the router.
[Router] nat alg ftp enable
Issue 04 (2014-01-16)
: 202.169.10.33/21(ftp)
: 10.0.0.3/21(ftp)
: ---: ---: ----
196
Total :
5 NAT Configuration
# Run the display nat alg command on the router. The command output is as follows:
<Router> display nat alg
NAT Application Level Gateway Information:
---------------------------------Application
Status
---------------------------------dns
Disabled
ftp
Enabled
rtsp
Disabled
sip
Disabled
----------------------------------
# Verify that external users can access the WWW server and FTP server.The details are not
provided here.
----End
Configuration Files
Configuration file of the router
#
sysname Router
#
vlan batch 100 200
#
nat alg ftp enable
#
#
interface Vlanif100
ip address 192.168.20.1 255.255.255.0
#
interface Vlanif200
ip address 10.0.0.1 255.255.255.0
#
interface Ethernet2/0/0
port link-type access
port default vlan 100
#
interface Ethernet2/0/1
port link-type access
port default vlan 200
#
interface gigabitethernet 3/0/0
ip address 202.169.10.1 255.255.255.0
nat server protocol tcp global 202.169.10.5 www inside 192.168.20.2 8080
nat server protocol tcp global 202.169.10.33 ftp inside 10.0.0.3 ftp
#
ip route-static 0.0.0.0 0.0.0.0 202.169.10.2
#
return
197
5 NAT Configuration
the router is 202.11.1.1/24. IP addresses of internal hosts are not assigned properly. The IP
address of PC1 on the internal network overlaps with that of Server A on the external network.
In this case, PC2 can access this server using the domain name of Server A, but PC2 may access
PC1 on the same network segment based on the DNS resolution result. Users want packets to
be forwarded correctly.
Figure 5-21 Network diagram for configuring twice NAT
202.10.0.100/24
PC 1
202.10.0.100/24
Server A
Router
202.10.0.1/24
202.11.1.2/24
GE2/0/0
GE1/0/0
Internet
DNS server
PC 2
202.10.0.16/24
Configuration Roadmap
The configuration roadmap is as follows:
1.
2.
3.
Configure the DNS ALG function to enable DNS packets to traverse the NAT device.
4.
5.
Procedure
Step 1 Configure an IP address for ports on the router.
<Huawei> system-view
[Huawei] sysname Router
[Router] interface gigabitethernet 1/0/0
[Router-GigabitEthernet1/0/0] ip address 202.11.1.2 24
[Router-GigabitEthernet1/0/0] quit
[Router] interface gigabitethernet 2/0/0
[Router-GigabitEthernet2/0/0] ip address 202.10.0.1 24
[Router-GigabitEthernet2/0/0] quit
Step 2 Configure a default route with next hop address 202.11.1.1 on the router.
[Router] ip route-static 0.0.0.0 0.0.0.0 202.11.1.1
Issue 04 (2014-01-16)
198
5 NAT Configuration
Step 3 Configure the mapping between the overlapped address pool and the temporary address pool on
the router.
[Router] nat overlap-address 0 202.10.0.100 202.12.1.100 pool-length 254
Step 4 Configure a static route on the router from the temporary address pool to outbound interface
GE1/0/0.
[Router] ip route-static 202.12.1.100 32 gigabitethernet 1/0/0 202.11.1.1
Step 5 Configure the DNS NAT ALG function in the system view.
[Router] nat alg dns enable
Create an ACL and configure an ACL rule to permit the packets of PC1 to pass through.
[Router] acl 3180
[Router-acl-adv-3180] rule 5 permit ip source 202.10.0.0 0.0.0.255
[Router-acl-adv-3180] quit
2.
3.
# Run the display nat outbound command to display the configuration of NAT.
[Router] display nat outbound
NAT Outbound Information:
----------------------------------------------------------------Interface
Acl
Address-group/IP/Interface
Type
----------------------------------------------------------------GigabitEthernet1/0/0
3180
1
pat
----------------------------------------------------------------Total : 1
----End
Configuration Files
Configuration file of the router
#
sysname Router
#
acl number 3180
rule 5 permit ip source 202.10.0.0 0.0.0.255
#
nat alg dns enable
Issue 04 (2014-01-16)
199
5 NAT Configuration
#
nat address-group 1 202.11.1.100 202.11.1.200
#
nat overlap-address 0 202.10.0.100 202.12.1.100 pool-length 254
#
interface GigabitEthernet2/0/0
ip address 202.10.0.1 255.255.255.0
#
interface GigabitEthernet1/0/0
ip address 202.11.1.2 255.255.255.0
nat outbound 3180 address-group 1
#
ip route-static 0.0.0.0 0.0.0.0 202.11.1.1
ip route-static 202.12.1.100 255.255.255.255 GigabitEthernet1/0/0 202.11.1.1
#
return
Internet
DNS server
Internal user
192.168.0.200/24
Configuration Roadmap
The configuration roadmap is as follows:
l
Issue 04 (2014-01-16)
200
5 NAT Configuration
Configure Easy IP on the WAN interface to allow internal hosts to access external networks.
Configure a NAT server on the WAN interface to allow internal hosts to access external
networks.
Configure DNS mapping and DNS NAT ALG on the router to allow internal users to access
internal servers using the domain name of an external DNS server.
Procedure
Step 1 Configure an IP address for ports on the router.
<Huawei> system-view
[Huawei] sysname Router
[Router] interface gigabitethernet 1/0/0
[Router-GigabitEthernet1/0/0] ip address 202.10.1.2 24
[Router-GigabitEthernet1/0/0] quit
[Router] interface gigabitethernet 2/0/0
[Router-GigabitEthernet2/0/0] ip address 192.168.0.1 24
[Router-GigabitEthernet2/0/0] quit
Step 2 Configure a default route with next hop address 202.10.1.1 on the router.
[Router] ip route-static 0.0.0.0 0.0.0.0 202.10.1.1
Step 3 Configure outbound NAT in Easy IP mode on uplink interface GE1/0/0 of the router.
[Router] acl 2000
[Router-acl-basic-2000] rule 5 permit source 192.168.0.0 0.0.0.255
[Router-acl-basic-2000] quit
[Router] interface gigabitethernet 1/0/0
[Router-GigabitEthernet1/0/0] nat outbound 2000
[Router-GigabitEthernet1/0/0] quit
Step 5 Configure the DNS NAT ALG function and DNS mapping on the router.
[Router] nat alg dns enable
[Router] nat dns-map www.TestNat.com 202.10.1.3 80 tcp
[Router] quit
Run the display nat server command on the router. The command output is as follows:
<Router> display nat server
Nat Server Information:
Interface : GigabitEthernet 1/0/0
Global IP/Port
: 202.10.1.3/80(www)
Inside IP/Port
: 192.168.0.100 8080
Issue 04 (2014-01-16)
201
5 NAT Configuration
Protocol : 6(tcp)
VPN instance-name : ---Acl number
: ---Description : ---Total :
1
Run the display nat alg command on the router. The command output is as follows:
<Router> display nat alg
NAT Application Level Gateway Information:
---------------------------------Application
Status
---------------------------------dns
Enabled
ftp
Disabled
rtsp
Disabled
sip
Disabled
----------------------------------
----End
Configuration Files
Configuration file of the router
#
sysname Router
#
acl number 2000
rule 5 permit source 192.168.0.0 0.0.0.255
#
nat alg dns enable
#
nat dns-map www.testnat.com 202.10.1.3 80 tcp
#
interface
GigabitEthernet2/0/0
ip address 192.168.0.1 255.255.255.0
#
interface GigabitEthernet1/0/0
ip address 202.10.1.2 255.255.255.0
nat server protocol tcp global 202.10.1.3 www inside 192.168.0.100 8080
nat outbound 2000
#
ip route-static 0.0.0.0 0.0.0.0 202.10.1.1
#
return
Issue 04 (2014-01-16)
202
5 NAT Configuration
Figure 5-23 Networking diagram for configuring PPPoE dialup access in Easy IP mode
Host 1
Host 2
Eth2/0/1
GE1/0/0
Internet
Router
PPPoE Server
Host n
Configuration Roadmap
The configuration roadmap is as follows:
Create a dialer interface and set parameters of the dialer port, establish a PPPoE session,
configure a static route on the router, and configure Easy IP on the dialer interface to implement
external network access by configuring PPPoE dialup in Easy IP mode.
Procedure
Step 1 Configure a PPPoE server.
Configure the authentication mode, IP address allocation mode, and IP address or IP address
pool for the PPPoE client. For details about the configuration procedure, see the documentation
of the PPPoE server. If the router functions as a PPPoE server, see Example for Configuring the
PPPoE Server.
Step 2 Configure a dialer port.
<Huawei> system-view
[Huawei] sysname Router
[Router] dialer-rule
[Router-dialer-rule] dialer-rule 1 ip permit
[Router-dialer-rule] quit
[Router] interface dialer 1
[Router-Dialer1] dialer user user2
[Router-Dialer1] dialer-group 1
[Router-Dialer1] dialer bundle 1
[Router-Dialer1] dialer timer idle 300
INFO: The configuration will become effective after link reset.
[Router-Dialer1] dialer queue-length 8
[Router-Dialer1] ip address ppp-negotiate
[Router-Dialer1] quit
Issue 04 (2014-01-16)
203
5 NAT Configuration
Server-MAC
00e0fc030206
State
PPPUP
# Run the display nat outbound command on the router. The command output is as follows:
<Router> display nat outbound
NAT Outbound Information:
--------------------------------------------------------------------------Interface
Acl
Address-group/IP/Interface
Type
--------------------------------------------------------------------------Dialer1
2000
178.18.1.2
easyip
--------------------------------------------------------------------------Total : 1
----End
Configuration Files
Configuration file of the router
#
sysname Router
#
acl number 2000
rule 5 permit source 192.168.0.0 0.0.0.255
#
dialer-rule
dialer-rule 1 ip permit
#
interface Dialer1
link-protocol ppp
ip address ppp-negotiate
dialer user user2
dialer bundle 1
dialer queue-length 8
dialer timer idle 300
dialer-group 1
nat outbound 2000
#
interface GigabitEthernet1/0/0
pppoe-client dial-bundle-number 1 on-demand
#
ip route-static 0.0.0.0 0.0.0.0 Dialer1
#
return
Issue 04 (2014-01-16)
204
5 NAT Configuration
Outbound NAT is not properly configured on the outbound interface connected to the public
network.
Procedure
Step 1 Check whether packets are received on interfaces of device.
Run the display interface interface-type interface-number command on the device to display
the value of the Input field.
l If the value of the Input field is 0, the device does not receive any packets. Check the interface
configuration to ensure that the interface can receive packets.
l If the value of the Input field is not 0, go to step 2.
NOTE
The device supports GE, FE, Eth-Trunk, and sub-interfaces. If an Eth-Trunk sub-interface is used, run the
display interface eth-trunk [ trunk-id [.subnumber ] ] command to check whether the Eth-Trunk subinterface receives packets.
Step 2 Check whether the ACL rule bound to outbound NAT allows NAT service packets to pass
through.
Run the display nat outbound command on the device to check whether outbound NAT is
correctly configured.
[Huawei]display nat outbound
NAT Outbound Information:
--------------------------------------------------------------------------Interface
Acl
Address-group/IP/Interface
Type
--------------------------------------------------------------------------GigabitEthernet0/0/0
2000
1
no-pat
--------------------------------------------------------------------------Total : 1
The preceding information indicates that ACL 2000 is bound to outbound NAT on
GigabitEthernet0/0/0.
Check whether the rule of ACL 2000 is configured correctly. If the IP address, interface number,
or protocol type in the rule of ACL 2000 is configured incorrectly, packets cannot be transmitted
correctly.
Run thedisplay acl 2000 command to check the configuration of outbound NAT bound to ACL
2000.
Issue 04 (2014-01-16)
205
5 NAT Configuration
The rule of ACL 2000 matches packets with the source address 192.168.1.100.
l If the ACL rule is configured incorrectly, reconfigure the ACL rule.
l If the ACL rule is configured correctly but the fault persists, go to step 3.
Step 3 Check that the address pool configuration is correct.
Run the display nat address-group command on the device to check whether the address pool
bound to outbound NAT on the outbound interface is correct.
[Huawei] display nat address-group 1
NAT Address-Group Information:
-------------------------------------Index
Start-address
End-address
-------------------------------------1
110.0.0.100
110.0.0.110
-------------------------------------Total : 1
To check Easy IP information on the outbound port, run the display nat outbound command
on the device. For example:
[Huawei] display nat outbound
NAT Outbound Information:
-------------------------------------------------------------------------Interface
Acl
Address-group/IP/Interface
Type
-------------------------------------------------------------------------GigabitEthernet0/0/1
2000
30.30.30.1
easyip
-------------------------------------------------------------------------Total : 1
The preceding information indicates that Easy IP is configured on GigabitEthernet0/0/1 and the
address pool 30.30.30.1 bound to the interface is the address pool advertised on the interface. If
NAT is disabled, you perform the following steps:
l If the bound IP address is the interface address, ensure that the interface address is valid.
----End
The NAT server is configured on an incorrect interface such as an outbound port or other
irrelated interfaces. The NAT server must be configured on the inbound interface of an
external host that connects to the internal network.
The NAT server configuration is incorrect. For example, the corresponding public and
private IP addresses of internal servers are incorrect, and private ports and enabled ports
of internal servers are different.
Issue 04 (2014-01-16)
206
5 NAT Configuration
Procedure
Step 1 Check whether services on the internal NAT server are running properly.
When the external network cannot access the internal NAT server, check whether services such
as HTTP server and FTP server are enabled on the internal NAT server. Access the internal NAT
server from an internal host to check whether the services are running properly.
l If services on the internal NAT server are not running properly, enable the services.
l If services on the internal NAT server are running properly but the fault persists, go to step
2.
Step 2 Check that the NAT server is configured correctly.
Run the display nat server command on the device to check that the NAT server is configured
on the correct NAT interface and the correct protocol type, interface number, and IP address are
configured.
[Huawei] display nat server
Nat Server Information:
Interface : GigabitEthernet 2/0/0
Global IP/Port
: 202.10.1.3/80 (www)
Inside IP/Port
: 192.168.0.100 8080
Protocol : 6(tcp)
VPN instance-name : ---Acl number
: ---Description : ---Total :
1
Ensure that the mapped internal address and interface are correct. When some services such as
FTP and TFTP transmit data packets, several interfaces (some of them are randomly generated)
are used. Therefore, to configure the NAT server providing such services, cancel the limitation
on the ports so that the internal server can provide services normally.
l If the NAT server is configured incorrectly, reconfigure the NAT server.
l If the NAT server is configured correctly but the fault persists, go to step 3.
Step 3 Check the connection between the external host and NAT server and the configurations of the
connected ports.
Check that the IP address of the outbound interface on the NAT server is correct and the external
IP address of the NAT server is correct. The IP addresses cannot conflict with the addresses on
other network segments. Ping the external interface of the NAT server on an external host. Ensure
that the external host can ping the NAT server successfully.
l If the external host cannot connect to the NAT server, check the connection.
l If the external host and NAT server are connected correctly but the fault persists, go to step
4.
Step 4 Check that the internal NAT server is configured with the correct gateway address or route.
The internal NAT server must be configured with the correct route or gateway address so that
packets destined for the external host can be sent to the gateway.
l If the gateway address or route on the internal NAT server is configured incorrectly,
reconfigure it.
Issue 04 (2014-01-16)
207
5 NAT Configuration
l If the gateway address or route on the internal NAT server is configured correctly but the
fault persists, contact Huawei technical support personnel.
----End
The DNS mapping entry is configured incorrectly. For example, the corresponding public
address is different from the IP address of an external server.
The route between the temporary address pool and the outbound interface is not configured.
Procedure
Step 1 Check that outbound NAT is configured correctly.
Run the display nat outbound command on the device to check whether outbound NAT is
configured correctly.
[Huawei]display nat outbound
NAT Outbound Information:
--------------------------------------------------------------------------Interface
Acl
Address-group/IP/Interface
Type
--------------------------------------------------------------------------GigabitEthernet0/0/1
3180
1
pat
--------------------------------------------------------------------------Total : 1
The preceding information indicates that ACL 3180 is bound to outbound NAT and the address
pool index is 1. Check that outbound NAT references a correct address pool. When configuring
an address pool, ensure that the destination address on the external network is different from
any address in the address pool. Run the display nat address-group command to check the
configuration of the address pool.
[Huawei]display nat address-group 1
NAT Address-Group Information:
-------------------------------------Index
Start-address
End-address
-------------------------------------1
202.10.10.10
202.10.10.100
-------------------------------------Total : 1
Check that ACL rules bound to outbound NAT are correct. Generally, incorrect addresses,
protocol types, or interface numbers are defined in ACL rules. When an ACL problem occurs,
packets on the internal network cannot be sent out or packets on the external network cannot be
sent to the internal network.
Run the display acl 3180 command to check the ACL bound to outbound NAT.
[Huawei]display acl 3180
Advanced ACL 3180, 1 rule
Acl's step is 5
rule 5 permit tcp source 1.1.1.1 0
Issue 04 (2014-01-16)
208
5 NAT Configuration
NOTE
An ACL strictly controls the permitted address segments, protocols, and ports based on the networking
requirements. If certain protocol packets are rejected by the NAT gateway, check whether the packets of
this protocol are permitted by the ACL.
l If the DNS mapping entry is configured incorrectly, run the nat dns-map command in the
system view to configure a DNS mapping entry correctly.
l If the DNS mapping entry is configured correctly but the fault persists, go to step 3.
Step 3 Check that NAT ALG is enabled for the DNS protocol.
Run the display nat alg command on the device to check whether NAT ALG is enabled for the
DNS protocol.
[Huawei]display nat alg
NAT Application Level Gateway Information:
---------------------------------Application
Status
---------------------------------dns
Disabled
ftp
Disabled
rtsp
Enabled
sip
Disabled
----------------------------------
l If NAT ALG is disabled for the DNS protocol, run the nat alg command to enable it.
l If NAT ALG is enabled for the DNS protocol but the fault persists, go to step 4.
Step 4 Check that the mappings between overlapped address pools and temporary address pools are
correct.
Run the display nat overlap-address command on the device to check whether all the mappings
between overlapped address pools and temporary address pools are correct.
[Huawei]display nat overlap-address all
Nat Overlap Address Pool To Temp Address Pool Map Information:
---------------------------------------------------------------------Id Overlap-Address Temp-Address Pool-Length Inside-VPN-Instance-Name
---------------------------------------------------------------------1
1.1.1.1
20.20.20.20
34
----------------------------------------------------------------------Total : 1
Issue 04 (2014-01-16)
209
5 NAT Configuration
NOTE
The temporary address pool contains available IP addresses on the device. The IP addresses in the address
pool cannot conflict with any interface address, VRRP address, or NAT address. In the preceding
information, Inside-VPN-Instance-Name specifies the VPN instance to which the internal interface
connected to the host belongs.
Proto
Pre
10.0.0.0/8
Static
10.10.10.10/32 Direct
60
64
Cost
Flags NextHop
0
0
D
D
Interface
10.164.50.1
127.0.0.1
Ethernet1/0/0
Vlanif3
NOTE
If the name of the VPN instance where the internal interface is located has been configured, run the display
ip routing-table vpn-instance vpn-name command to check the routes.
5.10 FAQ
5.10.1 Does NAT Support VPN Multi-Instance?
Yes. Network address translation (NAT) supports virtual private network (VPN) multi-instance.
210
5 NAT Configuration
5.10.5 How Can I Enable NAT Log and Set a Log Interval?
NAT logs are generated when the device performs address translation.
Configuration Example
Configure the device to generate NAT logs at an interval of 200 seconds.
<Huawei>
[Huawei]
[Huawei]
[Huawei]
system-view
firewall log all enable
info-center enable
firewall log defend log-interval 200
5.10.6 How Can I Set the Aging Time of the Traffic Forwarding
Table?
You can use the firewall-nat session aging-time command to set the aging time of the session
entries.
Configuration Example
# Set the aging time of FTP session entries to 60 seconds.
<Huawei> system-view
[Huawei] firewall-nat session ftp aging-time 60
When the DNS Request packet sent by the user device contains the host name, that is, the
user device uses the domain name www.hbjs.gov.cn to access the internal server, run the
nat dns-map www.hbjs.gov.cn global-address global-port { tcp | udp } command.
When the DNS Request packet sent by the user device does not contain the host name, that
is, the user device uses the domain name hbjs.gov.cn to access the internal server, run the
nat dns-map hbjs.gov.cn global-address global-port { tcp | udp } command.
NOTE
If you are not sure whether the DNS Request packet sent by the device contains the host name or not, it is
recommended that you configure both the preceding commands.
5.10.8 Private Network User and Server Are in the Same VLAN.
After NAT Server Is Configured on the VLANIF Interface, Why
Cannot the User Access the Server Using Public Address?
The private network user and server are connected to the same VLANIF interface and the same
subcard. After the nat server command is executed in the VLANIF interface view to map the
server IP address to a public network address, the response packet sent by the server to the user
cannot be sent to the CPU, so the packet address cannot be translated. As a result, the user cannot
connect to the server. To solve this problem, run the nat outbound command on the VLANIF
Issue 04 (2014-01-16)
211
5 NAT Configuration
interface so that the server's response packet can be sent to the router and the packet address can
be translated. The router then forwards the packet to the user. The user can connect to the server.
5.10.9 What Is the Difference Between NAT Server and NAT Static?
When internal users access the external network, NAT server translates only internal IP
addresses to external IP addresses, whereas NAT static translates both internal IP addresses and
ports to external IP addresses and ports.
The enterprise requires that its internal users can access the external server and external users
can access its internal server, as shown in Figure 5-24. If you configure both NAT server and
Easy IP on the router, it translates only internal IP addresses to external IP addresses when
internal users access the external network. This may result in a failure to set up stream tables.
In this case, you are advised to configure NAT static but not NAT server on the router.
Figure 5-24 Networking diagram of NAT server and Easy IP
192.168.0.100/24
Internal server
External user
Router
202.10.1.2/24
Internet
External server
Internal user
192.168.0.200/24
Issue 04 (2014-01-16)
212
5 NAT Configuration
Source address
10.1.1.100:1540
Source address
162.10.2.85480
Host B
Router
Server
Destination address
162.10.2.85480
162.10.2.8/24
Source address
10.1.1.200:1586
Source address
162.10.2.85481 211.100.7.34/24
Destination address
162.10.2.85481
10.1.1.200/8
Destination address
10.1.1.200:1586
Easy IP table
Way
Before Router
After Router
Outbound
10.1.1.1001540
162.10.2.85480
Inbound
162.10.2.85480
10.1.1.1001540
Outbound
10.1.1.2001586
162.10.2.85481
Inbound
162.10.2.85481
10.1.1.2001586
When the address pool mode is used, you need to configure a public address pool from which
public addresses mapping private addresses are selected, as shown in Figure 5-26.
Figure 5-26 Networking of an address pool
Address group
162.105.178.65
162.105.178.66
162.105.178.67
Host
10.1.1.100/8
Destination address
10.1.1.100
Router
Destination address
162.105.178.65
Source address
10.1.1.100
Source address
162.105.178.65
Server
211.100.7.34/24
NAT table
Internal host sends a request
External host responds to the request
Way
Outbound
Inbound
Before Router
10.1.1.100
162.105.178.65
After Router
162.105.178.65
10.1.1.100
213
5 NAT Configuration
If there are idle public IP addresses after IP addresses of outbound interfaces on NAT
devices and other applications are configured, use the address pool mode.
If there are no idle public IP addresses after IP addresses of outbound interfaces on NAT
devices and other applications are configured, use Easy IP.
Physical interfaces
Layer 3 Ethernet interface, Layer 3 GE interface, G.SHDSL interface, VDSL interface,
PON interface, serial interface, POS interface, asynchronous interface, ATM interface, BRI
interface, and cellular interface
Logical interfaces
Dialer interface, tunnel interface, Layer 3 Eth-Trunk interface, VE interface, VT interface,
MP-group interface, MFR interface, and IMA-Group interface
Sub-interfaces
Ethernet sub-interface, Eth-Trunk sub-interface, ATM sub-interface, serial sub-interface,
MFR sub-interface, IMA-Group sub-interface, and POS sub-interface
5.11 References
The following table lists the references of this document.
Issue 04 (2014-01-16)
Document
Description
RFC 1631
RFC 2663
RFC 2709
RFC 2993
RFC 3022
RFC 3235
214
Issue 04 (2014-01-16)
5 NAT Configuration
Document
Description
RFC 3519
RFC 3715
RFC 3947
RFC 4008
RFC 4787
215
Issue 04 (2014-01-16)
216
Router
UDP Unicast
NetBIOS-NS
HostB
217
UDP packets with other destination ports. In addition to the 6 default ports, another 10 destination
ports can be specified.
Table 6-1 lists the default UDP ports.
Table 6-1 Default UDP ports supported by UDP helper
Protocol
69
Domain Name
System (DNS)
53
Time Service
37
NetBIOS Name
Service (NetBIOSNS)
137
NetBIOS Datagram
Service (NetBIOSDS)
138
Terminal Access
Controller Access
Control System
(TACACS)
49
NOTE
UDP helper does not relay DHCP packets. That is, the destination port number cannot be 67 or 68. To relay
DHCP packets, enable the DHCP relay function on the router. For details about DHCP relay, see
Configuring DHCP Relay Agent.
Pre-configuration Tasks
Before configuring UDP helper, complete the following task:
l
Procedure
Step 1 Run:
system-view
218
Step 2 Run:
udp-helper enable
The UDP destination port to which UDP broadcast packets are relayed is specified.
NOTE
After UDP helper is enabled, the router relays the UDP packets with the following destination ports by
default: Time (37), TACACS (49), DNS (53), TFTP (69), NetBIOS-NS (137), and NetBIOS-DS (138). If
the UDP destination port you want to specify is among the six ports, skip this step.
Step 4 Run:
interface interface-type interface-number
Run the display udp-helper port command to check the UDP port numbers of the packets
that need to be relayed.
Run the display udp-helper server command to display the packet relay interface,
destination server address, and number of forwarded packets.
----End
219
Context
NOTICE
UDP helper statistics cannot be restored after being cleared. Exercise caution when you run the
reset udp-helper packet command.
Procedure
l
Run the reset udp-helper packet command in the user view to clear UDP helper statistics.
----End
GE2/0/0
202.2.1.2/16
Router
GE1/0/0
10.110.1.1/16
PC1
Issue 04 (2014-01-16)
PC2
220
Configuration Roadmap
1.
Because the PCs on the LAN need to access each other using host names, the host names
must be resolved into IP addresses. However, the NetBIOS-NS and PCs are in different
broadcast domains. The NetBIOS-NS Register packets cannot reach the NetBIOS-NS
server. The Router must be enabled with UDP helper to forward the UDP packets with
destination port 137 (NetBIOS-NS port) to the NetBIOS-NS server.
2.
After UDP helper is enabled, specify the IP address of destination NetBIOS-NS server on
GE1/0/0 of Router.
NOTE
After UDP helper is enabled on the Router, the Router relays the broadcast packets with UDP destination port
137 by default. The UDP port number, therefore, does not need to be configured in this example.
Procedure
Step 1 Assign an IP address to GE1/0/0 on Router.
<Huawei> system-view
[Huawei] sysname Router
[Router] interface gigabitethernet 1/0/0
[Router-GigabitEthernet1/0/0] ip address 10.110.1.1 16
[Router-GigabitEthernet1/0/0] quit
# Run the display udp-helper port command to check the configured destination port number
of UDP packets to be forwarded using the UDP Helper.
<Router> display udp-helper port
Udp-Port-Number
Description
------------------------------------------------------------37
Time
49
TAC Access Control System
53
Domain Name Server
69
Trivial File Transfer Protocol
137
NETBIOS Name Service
138
NETBIOS Datagram Service
----End
Issue 04 (2014-01-16)
221
Configuration Files
Configuration file of the Router
#
sysname Router
#
udp-helper enable
#
interface GigabitEthernet1/0/0
ip address 10.110.1.1 255.255.0.0
udp-helper server 202.2.1.1
#
interface GigabitEthernet2/0/0
ip address 202.2.1.2 255.255.0.0
#
return
Issue 04 (2014-01-16)
222
7 IP Performance Configuration
IP Performance Configuration
Issue 04 (2014-01-16)
223
7 IP Performance Configuration
Default Configuration
Disabled
Disabled
Enabled
Disabled
Disabled
Disabled
Enabled
Enabled
Disabled
75s
675s
8k bytes
224
7 IP Performance Configuration
Prerequisite
Before optimizing IP performance, complete the following task:
l
Procedure
Step 1 Run:
system-view
Step 3 Run:
ip verify source-address
Procedure
Step 1 Run:
system-view
225
7 IP Performance Configuration
NOTE
The function that clears the DF field is valid for outgoing packets; therefore, this function must be
configured on the outbound interface.
Step 3 Run:
clear ip df
Procedure
Step 1 Run:
system-view
226
7 IP Performance Configuration
Perform this step if you need to adjust the bandwidth of equal-cost links so that the equal-cost
links load balance traffic based on the configured bandwidth.
Step 4 Run:
load-balance unequal-cost enable
Equal-cost links load balance proportional traffic based on the configured bandwidth only when UCMP is
enabled on the outbound interfaces of all equal-cost links and the shutdown and undo shutdown
commands are executed on the outbound interfaces in sequence to trigger FIB entry update. If UCMP is
not enabled on any outbound interface, the equal-cost links evenly load balance traffic even though FIB
entry update is triggered.
----End
Procedure
Step 1 Run:
system-view
227
7 IP Performance Configuration
Procedure
Step 1 Configure the basic or advanced ACL. For details, see Configuring a Basic ACL or Configuring
an Advanced ACL.
Step 2 Run:
system-view
228
7 IP Performance Configuration
by Telnet applications. The enhanced forwarding function can meet the requirement. You can
configure this function to apply QoS policies to the control packets generated by the device.
Currently, the enhanced forwarding function is valid only for the control packets generated by
the device.
Procedure
Step 1 Run:
system-view
Run:
set priority dot1p priority-value
Run:
set priority protocol-type protocol-type dscp dscp-value
Follow-up Procedures
After the enhanced forwarding function is configured for control packets, you can only make
QoS policies take effect for the control packets. To implement differentiated services for control
packets, configure QoS policies. For details, see Huawei AR150&200&1200&2200&3200
Series Enterprise Routers Configuration Guide - QoS.
229
7 IP Performance Configuration
NOTE
Procedure
Step 1 Run:
system-view
The routing and forwarding function is disabled on high-end LAN cards (8FE1GE and 24GE
cards).
NOTICE
l After this command is used, an interface can only be manually added to a voice VLAN.
l After this command is used, protocol packets with source or destination MAC addresses as
blackhole MAC addresses will not be discarded.
l After this command is used, the device CPU usage increases.
----End
NOTICE
If an interface is not enabled to send ICMP redirection packets, the
AR150&200&1200&2200&3200 does not send ICMP redirection packets.
Procedure
Step 1 Run:
system-view
230
7 IP Performance Configuration
Step 3 Run:
icmp ttl-exceeded drop
The device is configured to discard the ICMP packets whose TTL values are 1.
By default, the function of discarding ICMP packets with TTL values 1 is disabled.
Step 4 Run:
icmp with-options drop
The device is configured to discard the ICMP packets that carry options.
By default, the function of discarding ICMP packets that carry options is disabled.
Step 5 Run:
icmp unreachable drop
231
7 IP Performance Configuration
SYN-Wait timer: When SYN packets are sent, the SYN-Wait timer is started. If no response
packet is received after the SYN-Wait timer expires, the TCP connection is closed.
FIN-Wait timer: When the TCP connection status changes from FIN_WAIT_1 to
FIN_WAIT_2, the FIN-Wait timer is started. If no response packet is received after the
FIN-Wait timer expires, the TCP connection is closed.
If you configure TCP properties in the system view for multiple times, only the last configuration
takes effect.
Procedure
Step 1 Run:
system-view
Issue 04 (2014-01-16)
232
7 IP Performance Configuration
Run the display tcp status [ [ task-id task-id ] [ socket-id socket-id ] | [ local-ip ipaddress ] [ local-port local-port-number ] [ remote-ip ip-address ] [ remote-port remoteport-number ] ] command to check the TCP connection status.
Run the display tcp statistics command to view the TCP traffic statistics.
Run the display udp statistics command to view the UDP traffic statistics.
Run the display ip socket [ monitor ] [ task-id task-id socket-id socket-id | socket-type
socket-type ] command to view information about the created IPv4 socket.
Run the display icmp statistics command to view the ICMP traffic statistics.
----End
Issue 04 (2014-01-16)
233
7 IP Performance Configuration
NOTICE
The IP/TCP/UDP traffic statistics cannot be restored after being cleared. Therefore, confirm
your operation before clearing the IP performance statistics.
Procedure
l
Run the reset ip socket monitor [ task-id task-id socket-id socket-id ] command in the
user view to clear information in a socket monitor.
Run the reset rawip statistics command in the user view to clear statistics about RawIP
packets.
Run the reset tcp statistics command in the user view to clear TCP statistics.
Run the reset udp statistics command in the user view to clear UDP statistics.
----End
7.5 FAQ
7.5.1 Why Do I Need to Consider the Interface MTU When Setting
the MSS of TCP Packets?
The maximum segment size (MSS) is negotiated during TCP connection setup. The MSS
determines the maximum length of a TCP packet. Some upper-layer applications such as HTTP
reset the Don't fragment (DF) field of IP packets to prevent TCP packets from being fragmented.
If the DF field is reset and the interface MTU is smaller than the MSS, the router discards TCP
packets because TCP packets cannot be fragmented.
A TCP packet has the TCP header and IP header; therefore, the MSS value plus all the header
lengths cannot exceed the MTU. The MTUs supported by Ethernet and PPPoE are 1500 bytes
and 1492 bytes respectively. You are advised to set the MSS to 1200 bytes. If the interface MTU
is changed or encapsulation packets of some special applications cannot be fragmented in
PPPoE, L3VPN, and IPSec scenarios, note the MSS setting.
Issue 04 (2014-01-16)
234
7 IP Performance Configuration
Issue 04 (2014-01-16)
235
Issue 04 (2014-01-16)
236
Purpose
IPv4 is the widely used Internet protocol. During initial development of the Internet, IPv4 rapidly
developed because of its simplicity, ease of implementation, and good interoperability.
However, as the Internet rapidly develops, deficiency in IPv4 design becomes obvious. To
overcome the deficiency, IPv6 emerges. IPv6 has the following advantages over IPv4.
Table 8-1 Comparisons between IPv6 and IPv4
Item
Deficiency in IPv4
Advantage of IPv6
Address
space
Issue 04 (2014-01-16)
237
Issue 04 (2014-01-16)
Item
Deficiency in IPv4
Advantage of IPv6
Packet
format
Autoconfig
uration and
readdressin
g
Route
summarizat
ion
End-to-end
security
support
Quality of
Service
(QoS)
support
238
Item
Deficiency in IPv4
Advantage of IPv6
Mobility
8.2 Principles
8.2.1 IPv6 Addresses
IPv6 Address Formats
An IPv6 address is 128 bits long. It is written as eight groups of four hexadecimal digits (0 to
9, A to F), where each group is separated by a colon (:). For example, 2031:0000:130F:
0000:0000:09C0:876A:130B is a valid IPv6 address. This IPv6 address format is the preferred
format.
For convenience, IPv6 provides the compressed format. The following uses IPv6 address
2031:0000:130F:0000:0000:09C0:876A:130B as an example to describe the compressed
format:
l
Any zeros at the beginning of a group can be omitted. Then the given example becomes
2031:0:130F:0:0:9C0:876A:130B.
A double colon (::) can be used in an IPv6 address when two or more consecutive groups
contain all zeros. Then the given example can be written as 2031:0:130F::9C0:876A:130B.
NOTE
An IPv6 address can contain only one double colon (::). Otherwise, a computer cannot determine the number
of zeros in a group when restoring the compressed address to the original 128-bit address.
239
If the first 3 bits of an IPv6 unicast address are not 000, the interface ID must be of 64 bits. If the first 3
bits are 000, there is no such limitation.
The interface ID can be manually configured, generated through the system software, or
generated in IEEE 64-bit Extended Unique Identifier (EUI-64) format. It is most common to
generate the interface ID in EUI-64 format.
IEEE EUI-64 standards convert an interface MAC address into an IPv6 interface ID. As shown
in Figure 8-1, if a 48-bit MAC address is used as an interface ID, the first 24 bits (expressed by
c) is a vendor identifier, and the last 24 bits (expressed by m) is an extension identifier. If the
higher seventh bit is 0, the MAC address is locally unique. During conversion, EUI-64 inserts
FFFE between the vendor identifier and extension identifier of the MAC address, and then the
higher seventh bit 0 is changed to 1 to indicate that the interface ID is globally unique.
Figure 8-1 EUI-64 format
MAC address cccccc 0 ccccccccccccccccc mmmmmmmmmmmmmmmmmmmmmmmm
1111111111111110
Insert FFFE
Change the
seventh high
cccccc 1ccccccccccccccccc 1111111111111110mmm m... mmmm
bit to 1
240
Unspecified address
An IPv6 unspecified address is 0:0:0:0:0:0:0:0/128 or ::/128, indicating that an interface or
a node does not have an IP address. It can be used as the source IP address of some packets,
such as Neighbor Solicitation (NS) message in duplicate address detection. Devices do not
forward the packets with the source IP address as an unspecified address.
Loopback address
An IPv6 loopback address is 0:0:0:0:0:0:0:1/128 or ::1/128. Similar to IPv4 loopback
address 127.0.0.1, IPv6 loopback address is used when a node needs to send IPv6 packets
to itself. This IPv6 loopback address is usually used as the IP address of a virtual interface
(a loopback interface for example). The loopback address cannot be used as the source or
destination IP address of packets that need to be forwarded.
Site
Host
m bit
n bit
128-m-n bit
Subnet ID
Interface ID
001
Link-local address
Link-local addresses are used only in communication between nodes on the same local link.
A link-local address uses a link-local prefix FE80::/10 as the first 10 bits (1111111010 in
binary) and an interface ID as the last 64 bits.
When IPv6 runs on a node, each interface of the node is automatically assigned a link-local
address that consists of a fixed prefix and an interface ID in EUI-64 format. This mechanism
enables two IPv6 nodes on the same link to communicate without any configuration.
Therefore, link-local addresses are widely used in neighbor discovery and stateless address
configuration.
Devices do not forward IPv6 packets with the link-local address as a source or destination
address to devices on different links.
Issue 04 (2014-01-16)
241
64 bit
Interface ID
1111 1110 10
FE80::/10
10 bit
1 bit
40 bit
16 bit
64 bit
Prefix
Global ID
Subnet ID
Interface ID
1111 110
FC00::/7
242
Has a well-known prefix (FC00::/7) that allows for easy route filtering at site boundaries.
Does not conflict with any other addresses if it is leaked outside of the site through
routing.
Functions as a global unicast address to applications.
Is independent of the Internet Service Provider (ISP).
IPv6 Multicast Address
Like an IPv4 multicast address, an IPv6 multicast address identifies a group of interfaces, which
usually belong to different nodes. A node may belong to any number of multicast groups. Packets
sent to an IPv6 multicast address are delivered to all the interfaces identified by the multicast
address. For example, the multicast address FF02::1 indicates all nodes within the link-local
scope and FF02::2 indicates all routers within the link-local scope.
An IPv6 multicast address is composed of a prefix, flag, scope, and group ID (global ID):
l
Flag: is 4 bits long. The high-order 3 bits are reserved and must be set to 0s. The last bit 0
indicates a permanently-assigned (well-known) multicast address allocated by the Internet
Assigned Numbers Authority (IANA). The last bit 1 indicates a non-permanently-assigned
(transient) multicast address.
Scope: is 4 bits long. It limits the scope where multicast data flows are sent on the network.
Figure 8-5 shows the field values and meanings.
Group ID (global ID): is 112 bits long. It identifies a multicast group. RFC 2373 does not
define all the 112 bits as a group ID but recommends using the low-order 32 bits as the
group ID and setting all the remaining 80 bits to 0s. In this case, each multicast group ID
maps to a unique Ethernet multicast MAC address (for details, see RFC 2464).
32 bit
Group ID
l
Issue 04 (2014-01-16)
value
1
Flag
0
1
2
4
Scope
5
8
E
field
1111 1111
FF
Flag
Scope
8 bit
4 bit
4 bit
description
temporary multicast address
permanent multicast address
node
link
management
site
organization
global
the rest unsigned or reserved
243
IPv6 anycast addresses can be assigned only to devices but not hosts. Anycast addresses cannot be used as
the source IP addresses of IPv6 packets.
Issue 04 (2014-01-16)
128-n bit
0
244
Traffic Class
Flow Label
Payload Length
Next Header
Hop Limit
Source
Address
40 octets
Basic Header
Destination
Address
Next Header
Variable length
Extension Header
Traffic Class: is 8 bits long. It indicates the class or priority of an IPv6 packet. The Traffic
Class field is similar to the TOS field in an IPv4 packet and is mainly used in QoS control.
Flow Label: is 20 bits long. This field is added in IPv6 to differentiate traffic. A flow label
and source IP address identify a data flow. Intermediate network devices can effectively
differentiate data flows based on this field.
Payload Length: is 16 bits long, which indicates the length of the IPv6 payload. The payload
is the rest of the IPv6 packet following this basic header, including the extension header
and upper-layer PDU. This field indicates only the payload with the maximum length of
Issue 04 (2014-01-16)
245
65535 bytes. If the payload length exceeds 65535 bytes, the field is set to 0. The payload
length is expressed by the Jumbo Payload option in the Hop-by-Hop Options header.
l
Next Header: is 8 bits long. This field identifies the type of the first extension header that
follows the IPv6 basic header or the protocol type in the upper-layer PDU.
Hop Limit: is 8 bits long. This field is similar to the Time to Live field in an IPv4 packet,
defining the maximum number of hops that an IP packet can pass through. The field value
is decremented by 1 by each device that forwards the IP packet. When the field value
becomes 0, the packet is discarded.
Source Address: is 128 bits long, which indicates the address of the packet originator.
Destination Address: is 128 bits long, which indicates the address of the packet recipient.
Compared with the IPv4 packet header, the IPv6 packet header does not carry IHL, identifier,
flag, fragment offset, header checksum, option, and paddiing fields but carries the flow label
field. This facilitates IPv6 packet processing and improves processing efficiency. To support
various options without changing the existing packet format, the Extension Header information
field is added to the IPv6 packet header. This improves IPv6 flexibility. The following describes
IPv6 extension headers.
Issue 04 (2014-01-16)
246
Traffic Class
Payload Length
Flow Label
Hop Limit
Next Header
Source
Address
40 octets
Basic
Header
Destination
Address
Next Header Extension Header Len
Extension Head Data
Next Header Extension Header Len
Extension Head Data
Variable
Length
...
Extension
Header
...
Data
Next Header: is 8 bits long. It is similar to the Next Header field in the IPv6 basic header,
indicating the type of the next extension header (if existing) or the upper-layer protocol
type.
Extension Header Len: is 8 bits long, which indicates the extension header length excluding
the Next Header field.
Extension Head Data: is of variable length. It includes a series of options and the padding
field.
RFC 2460 defines six IPv6 extension headers: Hop-by-Hop Options header, Destination Options
header, Routing header, Fragment header, Authentication header, and Encapsulating Security
Payload header.
Issue 04 (2014-01-16)
247
Next
Head
er
Field
Value
Description
HopbyHop
Option
s
header
Destin
ation
Option
s
header
60
Routin
g
header
43
Similar to the Loose Source and Record Route option in IPv4, this header
is used by an IPv6 source node to specify the intermediate nodes that a
packet must pass through on the way to the destination of the packet.
Fragm
ent
header
44
Like IPv4 packets, IPv6 packets to be forwarded cannot exceed the MTU.
When the packet length exceeds the MTU, the packet needs to be
fragmented. In IPv6, the Fragment header is used by an IPv6 source node
to send a packet larger than the MTU.
Authen
tication
header
51
Encaps
ulating
Securit
y
Payloa
d
header
50
Issue 04 (2014-01-16)
248
Routing header
Fragment header
Authentication header
Upper-layer header
Intermediate devices determine whether to process extension headers according to the Next
Header field value in the IPv6 basic header. Not all extension headers need to be examined and
processed by intermediate devices.
Each extension header can only occur once in an IPv6 packet, except for the Destination Options
header. The Destination Options header may occur at most twice (once before a Routing header
and once before the upper-layer header).
8.2.3 ICMPv6
The Internet Control Message Protocol version 6 (ICMPv6) is one of the basic IPv6 protocols.
In IPv4, ICMP reports IP packet forwarding information and errors to the source node. ICMP
defines certain messages such as Destination Unreachable, Packet Too Big, Time Exceeded, and
Echo Request or Echo Reply to facilitate fault diagnosis and information management. In
addition to the common functions provided by ICMPv4, ICMPv6 provides mechanisms such as
Neighbor Discovery (ID), stateless address configuration including duplicate address detection,
and Path Maximum Transmission Unit (PMTU) discovery.
The protocol number of ICMPv6, namely, the value of the Next Header field in an IPv6 packet
is 58. Figure 8-9 shows the ICMPv6 packet format.
Figure 8-9 Format of an ICMPv6 packet
IPv6 basic
header
Next header = 58
ICMPv6 packet
ICMPv6 packet
Type
Code
Checksum
ICMPv6 Data
Issue 04 (2014-01-16)
249
Type: specifies the message type. Values 0 to 127 indicate the error message type, and
values 128 to 255 indicate the informational message type.
Issue 04 (2014-01-16)
250
Echo Request messages: Echo Request messages are sent to destination nodes. After
receiving an Echo Request message, the destination node responds with an Echo Reply
message. In an Echo Request message, the value of the Type field is 128 and the value of
the Code field is 0.
Echo Reply messages: After receiving an Echo Request message, the destination node
responds with an Echo Reply message. In an Echo Reply message, the value of the Type
field is 129 and the value of the Code field is 0.
Address Resolution
In IPv4, a host needs to obtain the link-layer address of the destination host through the ARP
protocol for communication. Similar to IPv4, the IPv6 NDP protocol parses the IP address to
obtain the link-layer address.
ARP packets are encapsulated in Ethernet packets. The Ethernet type value is 0x0806. ARP is
defined as a protocol that runs between Layer 2 and Layer 3. ND is implemented through
ICMPv6 packets. The Ethernet type value is 0x86dd. The Next Header value in the IPv6 header
is 58, indicating that the packets are ICMPv6 packets. NDP packets are encapsulated in ICMPv6
packets. Therefore, NDP is taken as a Layer 3 protocol. Layer 3 address resolution brings the
following advantages:
l
Layer 3 address resolution enables Layer 2 devices to use the same address resolution
protocol.
Layer 3 security mechanisms such as IPSec are used to prevent address resolution attacks.
Request packets are sent in multicast mode, reducing performance requirements on Layer
2 networks.
Neighbor Solicitation (NS) packets and Neighbor Advertisement (NA) packets are used during
address resolution.
l
Issue 04 (2014-01-16)
In an NS packet, the value of the Type field is 135 and the value of the Code field is 0. An
NS packet is similar to the ARP Request packet in IPv4.
Huawei Proprietary and Confidential
Copyright Huawei Technologies Co., Ltd.
251
In an NA packet, the value of the Type field is 136 and the value of the Code field is 0. An
NA packet is similar to the ARP Reply packet in IPv4.
Host B
NS
Host A needs to parse the link-layer address of Host B before sending packets to Host B.
Therefore, Host A sends an NS message on the network. In the NS message, the source IP address
is the IPv6 address of Host A, and the destination IP address is the solicited-node multicast
address of Host B. The destination IP address to be parsed is the IPv6 address of Host B. This
indicates that Host A wants to know the link-layer address of Host B. The Options field in the
NS message carries the link-layer address of Host A.
After receiving the NS message, Host B replies with an NA Reply message. In the NA reply
message, the source address is the IPv6 address of Host B, and the destination address is the
IPv6 address of Host A (the NS message is sent to Host A in unicast mode using the link-layer
address of Host A). The Options field carries the link-layer address of Host B. This is the whole
address resolution process.
Neighbor Tracking
Communication with neighboring devices will be interrupted because of various reasons such
as hardware fault and hot swapping of interface cards. If the destination address of a neighboring
device becomes invalid, communication cannot be restored. If the path fails, communication
can be restored. Therefore, nodes need to maintain the neighbor table to monitor the status of
each neighboring device. A neighbor state can transit from one to another.
Five neighbor states are defined in RFC2461: Incomplete, Reachable, Stale, Delay, and Probe.
Figure 8-11 shows the transition of neighbor states. The Empty state indicates that the neighbor
table is empty.
Issue 04 (2014-01-16)
252
Empty
Incomplete
Reachable
Probe
Delay
Stale
The following example describes the neighbor state changes of node A during the first
communication with node B.
1.
Node A sends an NS message and generates a cache entry. The neighbor state of node A
is Incomplete.
2.
If node B replies with an NA message, the neighbor state of node A changes from
Incomplete to Reachable; otherwise, the neighbor state changes from Incomplete to Empty
after a certain period of time. Node A deletes this entry.
3.
After the neighbor reachable time times out, the neighbor state changes from Reachable to
Stale, indicating that whether the neighbor is reachable is unknown.
4.
If node A in the Reachable state receives a non-NA Request message from node B, and the
link-layer address of node B carried in the message is different from that learned by node
A, the neighbor state of node A immediately goes to Stale.
5.
If node A in the Stale state sends data to node B, the state of node A changes from Stale to
Delay. Node A sends an NS Request message.
6.
After a certain period of time, the neighbor state changes from Delay to Probe. During this
time, if node A receives an NA Reply message, the neighbor state of node A changes to
Reachable.
7.
Node A in the Probe state sends unicast NS messages at the configured interval for several
times. If node A receives a Reply message, the neighbor state of node A changes from
Probe to Reachable; otherwise, the state changes to Empty. Node A deletes this entry.
253
Host B
2000::1
NS
NA
An IPv6 address 2000::1 is assigned to Host A as a tentative IPv6 address. To check the validity
of 2000::1, Host A sends an NS message to the Solicited-node multicast group to which 2000::1
belongs. The NS message contains the requested address 2000::1. Since 2000::1 is not specified,
the source address of the NS message is an unspecified address. After receiving the NS message,
Host B processes the message in the following ways:
l
If 2000::1 is one tentative address of Host B, Host B will not use this address as an interface
address and not send the NA message.
Router Discovery
Router discovery is used to locate a neighboring device and learn the address prefix and
configuration parameters for address autoconfiguration.
IPv6 supports stateless address autoconfiguration. Hosts obtain IPv6 prefixes and automatically
generate interface IDs. Router Discovery is the basics for IPv6 address autoconfiguration and
is implemented through the following two packets:
l
Router Solicitation (RS) message: After being connected to the network, a host immediately
sends an RS message to obtain network prefixes. Devices on the network reply with an RA
message. An RS message has a value of 133 in the Type field.
254
RA
RS
RA
Address Autoconfiguration
IPv4 uses DHCP to automatically configure IP addresses and default gateways. This simplifies
network management. The length of an IPv6 address is increased to 128 bits. Multiple terminal
nodes require the function of automatic configuration. IPv6 allows both stateful and stateless
address autoconfiguration. Stateless autoconfiguration enables hosts to automatically generate
link-local addresses. Based on the prefixes in the RA message, hosts automatically configure
global unicast addresses and obtain other information.
The process of IPv6 stateless autoconfiguration is as follows:
1.
A host automatically configures the link-local address based on the interface ID.
2.
3.
If address conflict occurs, the host stops address autoconfiguration. Then addresses need
to be configured manually.
4.
If addresses do not conflict, the link-local address takes effect. The host is connected to the
network and can communicate with the local node.
5.
6.
The host obtains the IPv6 address based on the prefixes carried in the RA message and the
interface ID.
255
with the highest priority to forward packets. If the selected router does not work, hosts select
the device in descending order of priorities.
Redirection
To choose an optimal gateway device, the gateway device sends a Redirection message to notify
the sender that packets can be sent from another gateway device. A Redirection message is
contained in an ICMPv6 message. A Redirection message has the value of 137 in the Type field
and carries a better next hop address and destination address of packets that need to be redirected.
Figure 8-14 shows the process of redirecting packets.
Figure 8-14 Packet redirection example
Host B
Router B
Host A
Router A
IPv6 packet
Neighbor redirect packet definitions:
ICMPv6 Type = 137
Src = link-local address of Router A
Dst = link-local address of Host
Data = target address (link-local
address of Router B), options
(header of redirected packet)
Note: If the target is a host, the target
address is equal to the destination
address of the redirect packet and
the options include the link-layer
address of the target host (if known).
Subsequent IPv6 packets
Host A needs to communicate with Host B. By default, packets sent from Host A to Host B are
sent through Router A. After receiving packets from Host A, Router A finds that sending packets
to Router B is much better. Router A sends a Redirection message to Host A to notify Host A
that Router B is a better next hop address. The destination address of Host B is carried in the
Redirection message. After receiving the Redirection message, Host A adds a host route to the
default routing table. Packets sent to Host B will be directly sent to Router B.
A device sends a Redirection message in the following situations:
l
Issue 04 (2014-01-16)
256
After route calculation, the outbound interface of the next hop is the interface that receives
the packets.
The device finds that a better next hop IP address of the packet is on the same network
segment as the source IP address of the packet.
After checking the source address of the packet, the device finds a neighboring device in
the neighbor entries that uses this address as the global unicast address or the link-local
unicast address.
MTU=1500
MTU=1500
MTU=1400
MTU=1300
257
Packets are transmitted through four links. The MTU values of the four links are 1500, 1500,
1400, and 1300 bytes respectively. Before sending a packet, the source node fragments the packet
based on PMTU 1500. When the packet is sent to the outbound interface with MTU 1400, the
device returns a Packet Too Big message that carries MTU 1400. After receiving the message,
the source node fragments the packet based on MTU 1400 and sends the fragmented packet
again. When the packet is sent to the outbound interface with MTU 1300, the device returns
another Packet Too Big message that carries MTU 1300. The source node receives the message
and fragments the packet based on MTU 1300. In this way, the source node sends the packet to
the destination address and discovers the PMTU of the transmission path.
NOTE
IPv6 allows a minimum MTU of 1280 bytes. Therefore, the PMTU must be greater than 1280 bytes. PMTU
of 1500 bytes is recommended.
Default Configuration
Parameter
Default Configuration
Disabled
30000 ms
Pre-configuration Tasks
Before configuring IPv6 addresses for interfaces, complete the following task:
l
Configuring link layer protocol parameters for interfaces to ensure that the link layer
protocol status on the interfaces is Up
258
Generated in the EUI-64 format: An IPv6 global unicast address in the EUI-64 format
contains a manually configured prefix and an automatically generated interface identifier.
l An interface can be configured with multiple global unicast addresses with different network prefixes.
l Manually configured global unicast addresses have higher priority than automatically generated ones.
Manually configured addresses can overwrite automatically generated ones with the same prefix. The
overwritten automatically generated addresses do not take effect even if manually configured addresses
are deleted. A device needs to generate a new global unicast address based on the IP prefix carried in
the received RA packet.
Procedure
Step 1 Run:
system-view
Issue 04 (2014-01-16)
Run the display ipv6 interface [ interface-type interface-number | brief ] command in any
view to check IPv6 information on an interface.
Huawei Proprietary and Confidential
Copyright Huawei Technologies Co., Ltd.
259
Run the display this ipv6 interface command in the interface view to check IPv6
information on the interface.
Manually configured: You can manually configure an IPv6 link-local address for an
interface.
NOTE
l Each interface can be configured with only one link-local address. To prevent link-local address
conflict, automatically generated link-local addresses are recommended. After an interface is
configured with an IPv6 global unicast address, it automatically generates a link-local address.
l Manually configured link-local addresses have higher priority than automatically generated ones.
Manually configured addresses can overwrite automatically generated ones, but automatically
generated addresses cannot overwrite manually configured ones. If manually configured addresses are
deleted, the overwritten automatically generated ones take effect.
Procedure
Step 1 Run:
system-view
260
l Run:
ipv6 address auto link-local
Run the display ipv6 interface [ interface-type interface-number | brief ] command in any
view to check IPv6 information on an interface.
Run the display this ipv6 interface command in the interface view to check IPv6
information on the interface.
Packets addressed to an anycast address are delivered to the nearest interface that is
identified by the anycast address, depending on the routing protocols.
Procedure
Step 1 Run:
system-view
Issue 04 (2014-01-16)
261
Run the display ipv6 interface [ interface-type interface-number | brief ] command in any
view to check IPv6 information on an interface.
Run the display this ipv6 interface command in the interface view to check IPv6
information on the interface.
Context
If a large number of ICMPv6 error packets are sent on the network in a short period, network
congestion may occur. To prevent network congestion, you can limit the maximum number of
ICMPv6 error packets sent in a specified period using the token bucket algorithm.
You can set the bucket size and interval for placing tokens into the bucket. The bucket size
indicates the maximum number of tokens that a bucket can hold. One token represents an
ICMPv6 error packet. When an ICMPv6 error packet is sent, one token is taken out of the token
bucket. When there is no token, ICMPv6 error packets cannot be sent until new tokens are placed
into the token bucket after the interval.
If transmission of too many ICMPv6 error packets causes network congestion or the network is
attacked by forged ICMPv6 error packets, you can disable the system from ICMPv6 error
packets, Host Unreachable packets, and Port Unreachable packets.
Pre-configuration Tasks
Before setting rate limit for sending ICMPv6 error packets, complete the following task:
l
Procedure
1.
Run:
system-view
Run:
ipv6
Run:
ipv6 icmp-error { bucket bucket-size | ratelimit interval }
262
By default, a token bucket can hold a maximum of 10 tokens and the interval for
placing tokens into the bucket is 100 ms.
4.
Run:
ipv6 icmp too-big-rate-limit
Run:
undo ipv6 icmp { icmpv6-type icmpv6-code | icmpv6-name | all } receive
Run:
undo ipv6 icmp { icmpv6-type icmpv6-code | icmpv6-name | all } send
Run:
undo ipv6 icmp redirect send
Run:
system-view
Run:
interface interface-type interface-number
Run:
ipv6 enable
Run:
undo ipv6 icmp port-unreachable send
Run:
undo ipv6 icmp hop-limit-exceeded send
263
Pre-configuration Tasks
Before configuring IPv6 ND, complete the following task:
l
Procedure
Step 1 Run:
system-view
264
After the IPv6 function is enabled on the router, the router automatically implements address resolution,
DAD, and redirection. Neighbor unreachability detection, router/prefix discovery, and address
autoconfiguration need to be manually configured. You can also configure the router to send RA packets
to enable router/prefix discovery and address autoconfiguration, and enable the automatic detection of ND
entries to check whether neighbors are reachable.
After the automatic detection of ND entries is enabled on the router, the router can send NS
packets to check whether neighbors are reachable before aging ND entries. If neighbors are
reachable, the router updates ND entries; otherwise, the router ages ND entries.
You can enable the router to send RA packets. After receiving the RA packets, network nodes
perform address autoconfiguration and router/prefix discovery based on the prefix and other
configuration information in the RA packets.
After the preceding configurations are complete, NDP functions work properly. You can also
adjust ND parameters based on service requirements.
Procedure
Step 1 You can run the following commands to enable NDP functions to work properly.
1.
Run:
system-view
Run:
interface interface-type interface-number
Run:
undo ipv6 nd ra halt
265
The managed address configuration flag (M flag) for stateful autoconfiguration in RA packets
is set.
By default, the M flag in an RA packet is not set.
l Run:
ipv6 nd autoconfig other-flag
The other configuration flag (O flag) for stateful autoconfiguration in RA packets is set.
By default, the O flag in an RA packet is not set.
NOTE
l Run:
ipv6 nd nud reachable-time value
266
l Run:
ipv6 nd ra router-lifetime ra-lifetime
The number of times NS packets are sent when the system performs Duplicate Address
Detection is set.
By default, the number of times NS packets are sent when the system performs DAD is 1.
----End
Run the display ipv6 neighbors [ ipv6-address | [ vid vid ] interface-type interfacenumber | vpn-instance vpn-instance-name ] command to check information about neighbor
entries.
Pre-configuration Tasks
Before configuring PMTU, complete the following tasks:
l
267
sized packets, you can manually configure the PMTU to a specified destination node to control
the maximum length of packets forwarded from the device to the destination node.
NOTE
When the PMTU from the device to a specified destination node is set, the IPv6 MTU values for interfaces on
all intermediate devices cannot be smaller than the configured PMTU value. Otherwise, packets are discarded.
Procedure
Step 1 Run:
system-view
Run:
interface interface-type interface-number
Run:
ipv6 mtu mtu
After the MTU value is changed, run the shutdown and undo shutdown or restart (interface view)
commands to restart the interface to make the changed MTU take effect.
3.
Run:
quit
268
NOTE
When both static PMTU and dynamic PMTU are configured, only static PMTU takes effect. Static PMTU
entries never age.
The interface MTU, IPv6 interface MTU, and PMTU are valid only for the packets generated on the device
but not for the packets forwarded by the host.
Procedure
Step 1 Run:
system-view
Run:
interface interface-type interface-number
Run:
ipv6 mtu mtu
After the MTU value is changed, run the shutdown and undo shutdown or restart (interface view)
commands to restart the interface to make the changed MTU take effect.
3.
Run:
quit
Issue 04 (2014-01-16)
269
The device is enabled to add a fragmentation header to a Packet Too Big message based on the
fragment flag in a PMTU entry.
By default, a device is disabled from adding a fragmentation header to a Packet Too Big message
based on the fragment flag in a PMTU entry.
----End
Pre-configuration Tasks
Before configuring TCP6, complete the following task:
l
Configuring link layer protocol parameters for interfaces to ensure that the link layer
protocol status on the interfaces is Up
SYN-Wait timer: When SYN packets are sent, the SYN-Wait timer is started. If no response
packet is received after the SYN-Wait timer expires, the TCP6 connection is terminated.
FIN-Wait timer: When the TCP connection status changes from FIN_WAIT_1 to
FIN_WAIT_2, the FIN-Wait timer is started. If no response packet is received after the
FIN-Wait timer expires, the TCP6 connection is terminated.
Procedure
Step 1 Run:
system-view
270
Step 3 Run:
tcp ipv6 timer fin-timeout interval
Procedure
Step 1 Run:
system-view
The receive and send buffer sizes of a TCP6 socket are set.
The receive or send buffer size of a TCP6 socket ranges from 1 KB to 32 KB. By default, the
receive or send buffer size of a TCP6 socket is 8 KB.
----End
Run the display tcp ipv6 status [ [ task-id task-id ] [ socket-id socket-id ] | [ local-ip ipv6address ] [ local-port local-port-number ] [ remote-ip ipv6-address ] [ remote-port
remote-port-number ] ] command to check the TCP6 connection status.
Run the display tcp ipv6 statistics command to check TCP6 traffic statistics.
Run the display ipv6 socket [ socketype socket-type | task-id task-id socket-id socketid ] command to check information about a specified socket.
----End
271
NOTICE
IPv6 statistics cannot be restored after being cleared. Therefore, exercise caution before clearing
IPv6 statistics.
Procedure
l
Run the reset ipv6 statistics command in the user view to clear IPv6 traffic statistics.
Run the reset tcp ipv6 statistics command in the user view to clear TCP6 statistics.
Run the reset udp ipv6 statistics command in the user view to clear UDP6 statistics.
Run the reset ipv6 neighbors { all | dynamic | static | vid vlan-id [ interface-type interfacenumber] | interface-type interface-number [ dynamic | static ] } command in the user view
to clear IPv6 neighbor entries.
----End
Procedure
l
Run the display tcp ipv6 statistics command to check TCP6 statistics.
Run the display ipv6 neighbors [ ipv6-address | [ vid vid ] interface-type interfacenumber | vpn-instance vpn-instance-name ] command to check neighbor entries.
----End
Issue 04 (2014-01-16)
272
GE1/0/0
RouterB
Configuration Roadmap
The configuration roadmap is as follows:
1.
Enable the IPv6 forwarding function on RouterA and configure an IPv6 address for
RouterA so that RouterA can forward IPv6 packets.
2.
Procedure
Step 1 Configure RouterA.
# Configure an IPv6 address for GE1/0/0 of RouterA.
<Huawei> system-view
[Huawei] sysname RouterA
[RouterA] ipv6
[RouterA] interface gigabitethernet 1/0/0
[RouterA-GigabitEthernet1/0/0] ipv6 enable
[RouterA-GigabitEthernet1/0/0] ipv6 address 3001::1/64
[RouterA-GigabitEthernet1/0/0] quit
273
1/0/0
enable
address auto link-local
address auto global
Issue 04 (2014-01-16)
274
Interface
: GigabitEthernet1/0/0
Age
: 7
VLAN
: CEVLAN: VPN name
:
Is Router
: TRUE
Secure FLAG : UN-SECURE
--------------------------------------------------------Total: 1
Dynamic: 1
Static: 0
----End
Configuration File
l
8.7 FAQ
8.7.1 What Is the Application Scope of an IPv6 Link-Local Address?
An IPv6 link-local address can be used for communication between nodes on the same link.
Packets with IPv6 link-local addresses can be forwarded only through a local link.
8.8 References
The following table lists the references of this document.
Issue 04 (2014-01-16)
Document
Description
Remarks
RFC1887
RFC1970
275
Issue 04 (2014-01-16)
Document
Description
Remarks
RFC1981
RFC2375
RFC2147
RFC2460
RFC2461
RFC2462
RFC2463
RFC2464
RFC2473
RFC2529
RFC2711
RFC2893
RFC3056
RFC3068
RFC3484
RFC3493
RFC3513
RFC3542
RFC3587
RFC3879
RFC4007
276
Issue 04 (2014-01-16)
Document
Description
Remarks
RFC4193
RFC4213
RFC4291
RFC4443
RFC4861
RFC4862
RFC5095
277
9 DHCPv6 Configuration
DHCPv6 Configuration
Issue 04 (2014-01-16)
278
9 DHCPv6 Configuration
Purpose
The IPv6 protocol provides huge address space formed by 128-bit IPv6 addresses that require
proper and efficient assignment and management policies. IPv6 stateless address
autoconfiguration defined in RFC2462 is widely used. Hosts configured with the stateless
address autoconfiguration function automatically configure IPv6 addresses based on prefixes
carried in Route Advertisement (RA) packets sent from a neighboring device.
When stateless address autoconfiguration is used, devices do not record IPv6 addresses of hosts.
Therefore, stateless address autoconfiguration has poor manageability. In addition, hosts
configured with stateless address autoconfiguration cannot obtain other configuration
parameters such as the DNS server address. Internet service providers (ISPs) do not provide
instructions for automatic allocation of IPv6 prefixes for devices. Therefore, users need to
manually configure IPv6 addresses for devices during IPv6 network deployment.
DHCPv6 solves this problem. DHCPv6 is a stateful protocol for configuring IPv6 addresses
automatically.
Compared with manual address configuration and IPv6 stateless address autoconfiguration that
uses network prefixes in RA packets, DHCPv6 has the following advantages:
l
Controls IPv6 address assignment better. A DHCPv6 device can record addresses assigned
to hosts and assign requested addresses. This function facilitates network management.
Assigns IPv6 address prefixes to network devices. This function facilitates automatic
configuration and hierarchical network management.
Provides other network configuration parameters such as the DNS server address.
9.2 Principles
9.2.1 DHCPv6 Overview
DHCPv6 runs between a client and a server. Similar to DHCP for IPv4, DHCPv6 clients and
DHCPv6 servers exchange DHCPv6 packets using the User Datagram Protocol (UDP). In IPv6,
packets cannot be broadcast; therefore, DHCPv6 uses multicast packets. In this case, DHCPv6
clients do not need to be configured with IPv6 addresses of DHCPv6 servers.
279
9 DHCPv6 Configuration
Manual configuration: You can manually configure IPv6 addresses, prefixes, and other
network configuration parameter, such as addresses of the Domain Name System (DNS),
Network Information Service (NIS), and Simple Network Time Protocol (SNTP) servers.
DHCPv6 Architecture
Figure 9-1 shows the DHCPv6 architecture.
Figure 9-1 DHCPv6 architecture
DHCPv6 Clients
IPv6
Network
DHCPv6 Relay
DHCPv6 Clients
DHCPv6 Server
DHCPv6 client
A DHCPv6 client applies to a DHCPv6 server for IPv6 addresses, prefixes, and network
configuration parameters to complete its address configuration.
DHCPv6 relay
A DHCPv6 relay agent relays DHCPv6 packets between a DHCPv6 client and a DHCPv6
server to help the DHCPv6 client complete its address configuration. Generally, a DHCPv6
client communicates with a DHCPv6 server through the link-local multicast address to
obtain IPv6 addresses, prefixes, and other network configuration parameters. If a DHCPv6
server and a DHCPv6 client are on different links, a DHCPv6 relay agent is required to
Issue 04 (2014-01-16)
280
9 DHCPv6 Configuration
forward DHCPv6 packets. In this case, you do not need to deploy a DHCPv6 server on
each link, which saves costs and facilitates centralized management.
A DHCPv6 relay agent is optional. If a DHCPv6 client and a DHCPv6 server are on the
same link or a DHCPv6 client communicates with a DHCPv6 server in unicast mode to
complete address allocation or information configuration, you do not need to deploy a
DHCPv6 relay agent. A DHCPv6 relay agent is required only when a DHCPv6 client and
a DHCPv6 server are located on different links or a DHCPv6 client cannot communicate
with a DHCPv6 server in unicast mode.
l
DHCPv6 server
A DHCPv6 server processes requests of address allocation, address lease extension, and
address release from a DHCPv6 client or a DHCPv6 relay agent, and assigns IPv6 addresses
and other network configuration parameters to the DHCPv6 client.
Multicast address
l In DHCPv6, a DHCPv6 client does not need to be configured with the IPv6 address of
a DHCPv6 server. Instead, the DHCPv6 client locates DHCPv6 servers by sending
Solicit packets with multicast addresses as destination addresses.
l In DHCPv4, a DHCP client locates DHCP servers by broadcasting DHCP packets. To
prevent broadcast storms, IPv6 does not use broadcast packets. Instead, IPv6 uses
multicast packets. DHCPv6 uses the following two multicast addresses:
FF02::1:2 (All DHCP Relay Agents and Servers): indicates the multicast address of
all the DHCPv6 servers and DHCPv6 relay agents. The address is a link-local
multicast address and is used for communication between a DHCPv6 client and its
neighboring servers or between a DHCPv6 client and DHCPv6 relay agents. All
DHCPv6 servers and relay agents are members of this multicast group.
FF05::1:3 (All DHCP Servers): indicates the multicast address of all the DHCPv6
servers. The address is a site-local address and is used for communication between
DHCPv6 relay agents and DHCPv6 servers within a site. All DHCPv6 servers within
a site are members of this multicast group.
2.
3.
4.
Issue 04 (2014-01-16)
281
9 DHCPv6 Configuration
l An IA enables a DHCPv6 server and a DHCPv6 client to identify, group, and manage
IPv6 addresses. Each IA consists of an identity association identifier (IAID) and
associated configuration information.
l A DHCPv6 client must associate at least one IA with each of its network interfaces for
which the DHCPv6 client requests IPv6 addresses from a DHCP server. The DHCPv6
client uses IAs associated with network interfaces to obtain configuration information
from a DHCPv6 server. Each IA must be associated with at least one interface.
l The IAID identifies an IA, and IAIDs on the same DHCPv6 client must be unique. The
IAID is not lost or changed because of factors such as DHCPv6 client reboot.
l The configuration information in an IA consists of one or more IPv6 addresses along
with the lifetimes T1 and T2. Each address in an IA has a preferred lifetime and a valid
lifetime.
l An interface must be associated with at least one IA; an IA can contain information
about one or more addresses.
31
7
msg-type
transaction-ID
options (variable)
Length
Description
msg-type
1 byte
Indicates the packet type. The value ranges from 1 to 13. For details,
see the DHCPv6 Packet Type.
transactionID
3 bytes
Options
Issue 04 (2014-01-16)
Variabl
e
282
9 DHCPv6 Configuration
Issue 04 (2014-01-16)
DHC
P
Pack
et
Type
DHCPv6
Packet
DHCPv4
Packet
Description
SOLICIT
DHCP
DISCOVE
R
ADVERTI
SE
DHCP
OFFER
REQUES
T
DHCP
REQUES
T
CONFIR
M
RENEW
DHCP
REQUES
T
REBIND
DHCP
REQUES
T
283
9 DHCPv6 Configuration
DHC
P
Pack
et
Type
DHCPv6
Packet
DHCPv4
Packet
Description
REPLY
DHCP
ACK/
NAK
RELEASE
DHCP
RELEASE
DECLINE
DHCP
DECLINE
10
RECONFI
GURE
11
INFORM
ATIONREQUES
T
DHCP
INFORM
12
RELAYFORW
13
RELAYREPL
284
9 DHCPv6 Configuration
DHCPv6 stateless autoconfiguration: IPv6 addresses are generated based on the Route
Advertisement (RA) packets. A DHCPv6 server provides other configuration parameters
such as addresses of the DNS, NIS, and SNTP servers except for IPv6 addresses.
DHCPv6
Client
(1)Solicit
(2)Advertise
(3)Request
(4)Reply
285
9 DHCPv6 Configuration
1.
A DHCPv6 client sends a Solicit packet to request a DHCPv6 server to allocate IPv6
addresses and network configuration parameters.
2.
If the DHCPv6 server does not support fast address allocation, the DHCPv6 server returns
an Advertise packet containing the allocated addresses and network configuration
parameters regardless of whether the Solicit packet contains the Rapid Commit option.
3.
If receiving Advertise packets from multiple DHCPv6 servers, the DHCPv6 client selects
the DHCPv6 server with the highest priority and sends Request multicast packets to all
DHCPv6 servers. The Request multicast packets carry the DUID of the selected DHCPv6
server.
4.
The DHCPv6 server responds with a Reply packet that contains the addresses and network
configuration parameters allocated to the client.
l If a DHCPv6 server is configured with two-message exchange and the Solicit packet from a DHCPv6
client contains the Rapid Commit option, the DHCPv6 server allocates IPv6 addresses and
configuration parameters in two-message exchange mode.
l If a DHCPv6 server does not support fast address allocation, the DHCPv6 server allocates IPv6
addresses and other network configuration parameters to clients using four-message exchange.
Figure 9-4 shows the process of address allocation using two-message exchange.
Figure 9-4 Process of address allocation using two-message exchange
DHCPv6
Client
DHCPv6
Server
286
9 DHCPv6 Configuration
1.
A DHCPv6 client sends a Solicit packet carrying the Rapid Commit option, indicating that
the DHCPv6 client requires fast address allocation and network configuration parameters
from a DHCPv6 server.
2.
DHCPv6
Server
Information-request:
includes an Option Request option
Reply:
includes the requested options
A DHCPv6 client multicasts an Information-Request packet with the Option Request option
to DHCPv6 servers. The Option Request option specifies the configuration parameters that
the DHCPv6 client needs to obtain from a DHCPv6 server.
2.
After receiving the Information-Request packet, the DHCPv6 server sends a Reply packet
to the client in unicast mode. The Reply packet carries the allocated network configuration
parameters. The DHCPv6 client performs stateless autoconfiguration based on parameters
carried in the Reply packet.
287
9 DHCPv6 Configuration
The DHCPv6 PD mechanism allows a downstream device to request IPv6 prefixes from the
upstream device and an upstream device to assign appropriate prefixes for the downstream
device. In this way, you do not need to configure IPv6 prefixes for user-side links on the
downstream device. The downstream device divides the obtained prefix (the length of the
obtained prefix is smaller than 64 bits) into 64-bit prefix of subnet segments and sends a Route
Advertisement (RA) packet on the link that IPv6 hosts directly connect to. This enables hosts
to automatically configure addresses, completing IPv6 network deployment.
Figure 9-6 shows the working process of DHCPv6 PD.
Figure 9-6 Working principle of DHCPv6 PD
IPv6 HostC
Router B
Router A
DHCPv6 PD Client
IPv6 HostA
DHCPv6 PD Server
IPv6 HostB
A DHCPv6 PD client sends a Solicit packet, requesting an IPv6 address prefix from a
DHCPv6 PD server.
2.
If the DHCPv6 PD server does not support fast address allocation, the DHCPv6 PD server
returns an Advertise packet containing the allocated address prefixes regardless of whether
the Solicit packet contains the Rapid Commit option.
3.
If receiving Advertise packets from multiple DHCPv6 PD servers, the DHCPv6 PD client
selects the DHCPv6 PD server with the highest priority and sends a Request packet to this
DHCPv6 PD server to request address prefixes.
4.
The DHCPv6 PD server responds with a Reply packet to assign an IPv6 address prefix to
the DHCPv6 PD client.
DHCPv6 PD also supports two-message exchange using packets carrying the Rapid Commit
option. For details, see DHCPv6 Two-Message Exchange
288
9 DHCPv6 Configuration
DHCPv6 Relay
DHCPv6 Server
(3)Relay-reply
(4)DHCPv6 message to client
A DHCPv6 client sends DHCPv6 Request packets with the destination multicast address
FF02::1:2 to all DHCPv6 servers and DHCPv6 relay agents.
2.
3.
The DHCPv6 server parses the request of the DHCPv6 client in the Relay-Forward packet
and selects IPv6 addresses and other network configuration parameters to construct a reply
packet. Then the DHCPv6 server encapsulates the reply packet in the Relay Message option
in a Relay-Reply packet and sends the Relay-reply packet to the DHCPv6 relay agent.
4.
The DHCPv6 relay agent parses the reply packet of the DHCPv6 server in the Relay-Reply
packet and forwards the reply packet to the DHCPv6 client. If the DHCPv6 client receives
reply packets from multiple DHCPv6 servers, the DHCPv6 client selects the DHCPv6
server with the highest priority, and obtains the IPv6 address and other network
configuration parameters from the DHCPv6 server.
Issue 04 (2014-01-16)
289
9 DHCPv6 Configuration
2.
If IPv6 addresses or prefixes have been specified in the address pool, these addresses
and prefixes matching the client DUIDs are preferentially assigned to clients.
b.
If the IA option in the packet sent from the client carries valid addresses or prefixes,
these addresses or prefixes are preferentially assigned to clients from the address pool.
If these addresses or prefixes are unavailable in the address pool, other idle addresses
or prefixes are assigned to clients. If the IPv6 prefix length exceeds the assigned length,
the IPv6 prefix of the assigned length is assigned.
c.
Idle addresses and prefixes are assigned to clients from the address pool. Reserved
addresses (For example, anycast addresses defined in RFC 2526), conflicted
addresses, and used addresses cannot be assigned to clients.
d.
Issue 04 (2014-01-16)
290
9 DHCPv6 Configuration
DHCPv6
Server
(1)Renew
T1
(2)Reply
A DHCPv6 client sends a Renew packet to request to update the address lease at T1 (the
recommended value of T1 is half the preferred lifetime).
2.
Figure 9-9 shows the process of updating the address lease at T2.
Figure 9-9 Process of updating the address lease at T2
DHCPv6
Client
T1
T2
DHCPv6
Server
(1)Renew
(2)Rebind
(3)Reply
291
9 DHCPv6 Configuration
1.
A DHCPv6 client sends a Renew packet to request to update the address lease at T1, but
does not receive a response packet from a DHCPv6 server.
2.
The DHCPv6 client multicasts a Rebind packet to all the DHCPv6 servers to request them
to update the address lease at T2 (the recommended value of T2 is 0.8 times the preferred
lifetime).
3.
If the DHCPv6 client does not receive a response packet from the DHCPv6 server, the DHCPv6
client stops using this address after the valid lifetime is reached.
IP Address Reservation
The DHCPv6 server supports reserved IPv6 addresses that cannot be dynamically allocated. For
example, an IPv6 address can be reserved for a DNS server.
9.3 Application
9.3.1 Typical Networking of the DHCPv6 Server
Figure 9-10 shows a typical networking of the DHCPv6 server.
Figure 9-10 Networking of the DHCPv6 server
DHCPv6 Client
DHCPv6 Server
The device functions as the DHCPv6 server to assign IPv6 addresses to clients. The DHCPv6
client applies to the DHCPv6 server for configurations including an IPv6 address and DNS server
address. The DHCPv6 server replies with related configurations according to policies.
The DHCPv6 server assigns a complete IPv6 address to a host and provides other configuration
parameters such as the DNS server address. The DHCPv6 server also provides stateless DHCPv6
services. That is, the DHCPv6 server does not assign IPv6 addresses but provides hosts with
Issue 04 (2014-01-16)
292
9 DHCPv6 Configuration
configuration parameters such as the DNS server address and domain name. Hosts automatically
configure IPv6 addresses based on RA messages. This overcomes the limitations of IPv6
stateless address autoconfiguration.
RouterB
DHCPv6 PD Client
IPv6 HostA
RouterA
DHCPv6 PD Server
IPv6 HostB
The device functions as the DHCPv6 PD server to assign IPv6 address prefixes to DHCPv6 PD
clients.
The DHCPv6 PD mechanism allows RouterB to function as a DHCPv6 PD client to request
IPv6 prefixes from the DHCPv6 PD server and allows the DHCPv6 PD server to assign prefixes
to RouterB. In this way, RouterB does not need to assign IPv6 prefixes for user-side links.
RouterB divides the obtained prefix (the length of the obtained prefix is smaller than 64 bits)
into 64-bit prefix of subnet segments and sends an RA message on the link that hosts directly
connect to. The RA message contains 64-bit prefix of subnet segments. This enables hosts to
automatically configure addresses.
Internet
DHCPv6 Relay
DHCPv6 Server
DHCPv6 Client
Issue 04 (2014-01-16)
293
9 DHCPv6 Configuration
The device functions as a DHCPv6 relay agent, the client can communicate with a DHCPv6
server on another network segment through the DHCPv6 relay agent, and obtain an IPv6 address
and other configuration parameters from the global address pool on the DHCP server. In this
manner, DHCPv6 clients on multiple network segments can share one DHCPv6 server. This
reduces costs and facilitates centralized management.
RouterA
DHCPv6 Client
RouterC
DHCPv6 Server
RouterB
DHCPv6 Client
When the DHCPv6 client function is configured on the Layer 3 interface of the device, the device
dynamically obtains IPv6 addresses and other network configuration parameters from the
DHCPv6 server. This operation facilitates user configurations and centralized management.
Router A
Router B
GE0/0/1
DHCPv6 PD Client
IPv6 HostA
Issue 04 (2014-01-16)
GE0/0/1
DHCPv6 PD Server
IPv6 HostB
Huawei Proprietary and Confidential
Copyright Huawei Technologies Co., Ltd.
294
9 DHCPv6 Configuration
The DHCPv6 PD client function is configured on the Layer 3 interface of the device, the device
dynamically obtains IPv6 addresses and other network configuration parameters from the
DHCPv6 PD server. This operation facilitates user configurations and centralized management.
The device divides the obtained IPv6 prefix (the length of the obtained prefix is smaller than 64
bits) into 64-bit prefix of subnet segments and sends an RA message on the link that hosts directly
connect to. The RA message contains 64-bit prefix of subnet segments. This enables hosts to
automatically configure addresses.
Default Value
DHCPv6 Function
disabled
DHCPv6 DUID
Pre-configuration Tasks
Before configuring the DHCPv6 server, complete the following tasks:
l
Ensuring that the link between the DHCPv6 client and the router works properly and the
DHCPv6 client can communicate with the router
(Optional) In the scenario where the DHCPv6 relay exists, configuring the route between
the router and DHCPv6 relay agent or client
Configuration Process
The configuration tasks are performed in sequence.
295
9 DHCPv6 Configuration
Context
The DUID identifies a DHCPv6 device. Each DHCPv6 server or client has a unique DUID.
DHCPv6 servers use DUIDs to identify DHCPv6 clients and DHCPv6 clients use DUIDs to
identify DHCPv6 servers.
Procedure
Step 1 Run:
system-view
Procedure
Step 1 Run:
system-view
An IPv6 address pool is created and the address pool view is displayed.
By default, no IPv6 address pool is created on the device.
Step 3 Run:
address prefix ipv6-prefix/ipv6-prefix-length [ life-time { valid-lifetime |
infinite } { preferred-lifetime |
infinite } ]
Issue 04 (2014-01-16)
296
9 DHCPv6 Configuration
start-ipv6-address [ to end-ipv6-address ]
The range of the IPv6 addresses that cannot be automatically assigned is specified in the IPv6
address pool. If only one IPv6 address is not automatically assigned, you can specify only the
value of start-ipv6-address.
By default, all IPv6 addresses in the address pool can be automatically assigned to clients.
Step 6 (Optional) Run:
information-refresh time
The time is configured for updating configuration parameters assigned to clients through
stateless DHCPv6 address autoconfiguration.
By default, the time for updating IPv6 address pool configuration is 86400s (24 hours).
----End
9.5.1.3 (Optional) Configuring Network Server Addresses for the IPv6 Address
Pool
Context
To successfully connect DHCPv6 clients to the Internet, the DHCPv6 server needs to specify
network service configurations such as the DNS server address and SIP server address when
assigning IPv6 addresses to the clients. The DHCPv6 server dynamically allocates carrierassigned configurations such as the DNS server address and SIP server address to DHCPv6
clients.
Procedure
Step 1 Run:
system-view
An IPv6 address pool is created and the address pool view is displayed.
By default, no IPv6 address pool is created on the device.
Step 3 In the IPv6 address pool view, you can run one or multiple following commands to configure
network server addresses.
Issue 04 (2014-01-16)
297
1.
9 DHCPv6 Configuration
Run:
dns-server ipv6-address
The DNS server address is configured for the DHCPv6 address pool.
2.
Run:
dns-domain-name dns-domain-name
The DNS domain name suffix allocated by the DHCPv6 server to the client is configured.
3.
Run:
sip-server ipv6-address
The SIP server IPv6 address is configured for the DHCPv6 address pool.
4.
Run:
sip-domain-name sip-domain-name
The SIP domain name suffix allocated by the DHCPv6 server to the client is configured.
5.
Run:
nis-server ipv6-address
The NIS server IPv6 address is configured for the DHCPv6 address pool.
6.
Run:
nis-domain-name nis-domain-name
The NIS domain name suffix allocated by the DHCPv6 server to the client is configured.
7.
Run:
nisp-server ipv6-address
The NISP server IPv6 address is configured for the DHCPv6 address pool.
8.
Run:
nisp-domain-name nisp-domain-name
The NISP domain name suffix allocated by the DHCPv6 server to the client is configured.
9.
Run:
sntp-server ipv6-address
The SNTP server IPv6 address is configured for the DHCPv6 address pool.
NOTE
By default, DNS, SIP, NIS, NISP, and SNTP server addresses are not configured for the IPv6 address
pool.
----End
298
9 DHCPv6 Configuration
Procedure
Step 1 Run:
system-view
An IPv6 address pool is created and the address pool view is displayed.
By default, no IPv6 address pool is created on the device.
Step 3 Run:
vendor-specific vendor-id
Vendor-defined options are configured for the IPv6 address pool and the vendor-defined mode
view is displayed.
By default, no vendor-defined option is configured. A maximum of eight vendor-defined options
can be configured for one IPv6 address pool.
vendor-id indicates the vendor identifier ID, which is assigned by the IANA. The identifier ID
of Huawei is 2011.
Step 4 Run:
suboption suboption-code
hex hex-string }
Procedure
Step 1 Run:
system-view
Issue 04 (2014-01-16)
299
9 DHCPv6 Configuration
Procedure
Step 1 Run:
system-view
DHCP is enabled.
Step 3 Run:
ipv6
Issue 04 (2014-01-16)
| preference
preference-value
| rapid-
300
9 DHCPv6 Configuration
Run the display dhcpv6 duid command to check the DUID of the DHCPv6 device on the
network.
Run the display dhcpv6 pool pool-name [ allocated { address | prefix } | binding
[ duid ] | conflict address | ipv6-address | ipv6-prefix/prefix-length ] command to check
IPv6 address pool configurations.
----End
Pre-configuration Tasks
Before configuring the DHCPv6 PD server, complete the following tasks:
l
Ensuring that the link between the DHCPv6 client and the router works properly and the
DHCPv6 client can communicate with the router
(Optional) In the scenario where the DHCPv6 relay exists, configuring the route between
the router and DHCPv6 relay agent or client
Configuration Logic
The configuration tasks are performed in sequence.
Procedure
Step 1 Run:
system-view
301
9 DHCPv6 Configuration
Step 2 Run:
dhcpv6 duid { ll | llt }
Procedure
Step 1 Run:
system-view
An IPv6 PD address pool is created and the address pool view is displayed.
By default, no IPv6 PD address pool is created on the device.
Step 3 Run:
prefix-delegation ipv6-prefix/ipv6-prefix-length assign-prefix-length [ life-time
{ valid-lifetime | infinite } { preferred-lifetime | infinite }]
An IPv6 address prefix agent is statically bound to the DHCPv6 PD client in the address pool
view.
By default, no IPv6 address prefix agent is bound to the DHCPv6 PD client.
To statically assign specified IPv6 address prefixes to some specific clients, specify the mapping
between IPv6 address prefixes and client DUIDs. When such a client requests an IPv6 address
from the DHCPv6 PD server, the device functioning as the DHCPv6 PD server assigns the
specified IPv6 address to the client.
Configure the specified IPv6 address prefixes to be assigned only to the clients with specified
DUIDs.
----End
Issue 04 (2014-01-16)
302
9 DHCPv6 Configuration
9.5.2.3 (Optional) Configuring Network Server Addresses for the IPv6 Address
Pool
Context
To successfully connect DHCPv6 clients to the Internet, the DHCPv6 server needs to specify
network service configurations such as the DNS server address and SIP server address when
assigning IPv6 addresses to the clients. The DHCPv6 server dynamically allocates carrierassigned configurations such as the DNS server address and SIP server address to DHCPv6
clients.
Procedure
Step 1 Run:
system-view
An IPv6 address pool is created and the address pool view is displayed.
By default, no IPv6 address pool is created on the device.
Step 3 In the IPv6 address pool view, you can run one or multiple following commands to configure
network server addresses.
1.
Run:
dns-server ipv6-address
The DNS server address is configured for the DHCPv6 address pool.
2.
Run:
dns-domain-name dns-domain-name
The DNS domain name suffix allocated by the DHCPv6 server to the client is configured.
3.
Run:
sip-server ipv6-address
The SIP server IPv6 address is configured for the DHCPv6 address pool.
4.
Run:
sip-domain-name sip-domain-name
The SIP domain name suffix allocated by the DHCPv6 server to the client is configured.
5.
Run:
nis-server ipv6-address
The NIS server IPv6 address is configured for the DHCPv6 address pool.
6.
Run:
nis-domain-name nis-domain-name
The NIS domain name suffix allocated by the DHCPv6 server to the client is configured.
7.
Run:
nisp-server ipv6-address
Issue 04 (2014-01-16)
303
9 DHCPv6 Configuration
The NISP server IPv6 address is configured for the DHCPv6 address pool.
8.
Run:
nisp-domain-name nisp-domain-name
The NISP domain name suffix allocated by the DHCPv6 server to the client is configured.
9.
Run:
sntp-server ipv6-address
The SNTP server IPv6 address is configured for the DHCPv6 address pool.
NOTE
By default, DNS, SIP, NIS, NISP, and SNTP server addresses are not configured for the IPv6 address
pool.
----End
Procedure
Step 1 Run:
system-view
An IPv6 address pool is created and the address pool view is displayed.
By default, no IPv6 address pool is created on the device.
Step 3 Run:
vendor-specific vendor-id
Vendor-defined options are configured for the IPv6 address pool and the vendor-defined mode
view is displayed.
By default, no vendor-defined option is configured. A maximum of eight vendor-defined options
can be configured for one IPv6 address pool.
vendor-id indicates the vendor identifier ID, which is assigned by the IANA. The identifier ID
of Huawei is 2011.
Step 4 Run:
suboption suboption-code
hex hex-string }
304
9 DHCPv6 Configuration
Procedure
Step 1 Run:
system-view
Procedure
Step 1 Run:
system-view
DHCP is enabled.
Issue 04 (2014-01-16)
305
9 DHCPv6 Configuration
Step 3 Run:
ipv6
| preference
preference-value
| rapid-
Run the display dhcpv6 duid command to check the DUID of the DHCPv6 device on the
network.
Run the display dhcpv6 pool pool-name [ allocated { address | prefix } | binding
[ duid ] | conflict address | ipv6-address | ipv6-prefix/prefix-length ] command to check
IPv6 address pool configurations.
----End
Pre-configuration Tasks
Before configuring the DHCPv6 relay agent, complete the following tasks:
Issue 04 (2014-01-16)
306
9 DHCPv6 Configuration
If the router functions as a DHCPv6 server, see 9.5.1 Configuring a DHCPv6 Server for detailed
configurations.
Procedure
Step 1 Run:
system-view
Procedure
Step 1 Run:
system-view
Issue 04 (2014-01-16)
307
9 DHCPv6 Configuration
DHCP is enabled.
Step 3 Run:
ipv6
The DHCPv6 relay function is enabled on the interface and the IPv6 address of the DHCPv6
server or next-hop relay agent is configured.
By default, the DHCPv6 relay function is disabled on an interface.
The configured IPv6 address must be a global unicast IPv6 address or a unique local IPv6
address. The DHCPv6 relay sends relay packets to the configured IPv6 address by searching for
a route.
If the peer of the DHCPv6 relay is connected to multiple DHCPv6 servers or next-hop relays,
you must repeat this step. The device supports a maximum of eight DHCPv6 servers or nexthop relays.
----End
Follow-up Procedure
For clients (such as PCs) that automatically obtain IPv6 addresses based on IPv6 RA packets by
default, flags in RA messages need to be configured on the client gateways so that the clients
can obtain IPv6 addresses using DHCPv6. When the device functions as the client gateway,
perform the following steps:
1.
Run:
system-view
Run:
interface interface-type interface-number
Issue 04 (2014-01-16)
308
9 DHCPv6 Configuration
Run:
undo ipv6 nd ra halt
Run:
ipv6 nd autoconfig managed-address-flag
Run:
ipv6 nd autoconfig other-flag
When the Huawei AR150&200&1200&2200&3200 Series functions as the DHCPv6 client, flags in RA
messages do not need to be configured on gateways. You can run the ipv6 address auto dhcp command
to configure the clients to automatically obtain IPv6 addresses and other network configuration parameters
using DHCPv6.
When receiving a message from a DHCPv6 client, the router adds the Remote-ID option
in the Relay-forward message.
If the Relay-Reply message received by the router from the DHCPv6 server contains the
remote ID, the router removes the remote ID from the Relay-Reply message before
forwarding it to DHCPv6 clients or other relay agents.
Procedure
Step 1 Run:
system-view
309
9 DHCPv6 Configuration
Step 2 Run:
dhcpv6 remote-id format { default | user-defined text }
Procedure
Step 1 Run:
system-view
DHCP is enabled.
Step 3 Run:
dhcpv6 packet-rate packet-rate
Rate limit of DHCPv6 packets is enabled and the rate threshold is configured.
By default, rate limit of DHCPv6 messages is disabled on the router.
Step 4 Run:
dhcpv6 packet-rate drop-alarm enable
310
9 DHCPv6 Configuration
After the function of generating logs is enabled, if the number of DHCPv6 messages that pass
through the router every second exceeds the rate limit, they are discarded. By default, the device
generates a log when the number of discarded DHCPv6 messages exceeds 100.
Step 5 Run:
dhcpv6 packet-rate drop-alarm threshold threshold
A log threshold for the number of discarded DHCPv6 messages when the DHCPv6 message
rate exceeds the rate threshold is set.
----End
----End
Pre-configuration Tasks
Before configuring the DHCPv6 client function, complete the following tasks:
l
Configuring the route between the router and DHCPv6 relay agent or server
Procedure
1.
Run:
system-view
Run:
ipv6
Run:
interface interface-type interface-number
311
4.
9 DHCPv6 Configuration
Run:
ipv6 enable
Run:
ipv6 address auto link-local
Run:
ipv6 address auto global default
Run:
system-view
Run:
dhcpv6 duid { ll | llt }
Run:
dhcp enable
Run:
interface interface-type interface-number
Run:
ipv6 address auto dhcp [ rapid-commit ]
The DHCPv6 client is enabled and stateful DHCPv6 address autoconfiguration is used
to assign an IPv6 address and other configuration parameters (IPv6 addresses of the
DNS server and SNTP server) to the client.
Or run:
dhcpv6 client
information-request
312
9 DHCPv6 Configuration
NOTE
To modify the DHCPv6 address autoconfiguration mode, you must disable the original mode. For
example, the DHCPv6 client is enabled to use the stateful DHCPv6 address autoconfiguration mode
to obtain an IPv6 address and other network configuration parameters including the IPv6 addresses
of the DNS and SNTP servers. To enable the DHCPv6 client to use the stateless DHCPv6 address
autoconfiguration mode to obtain network configuration parameters (excluding IPv6 addresses), run
the undo ipv6 address auto dhcp command to disable stateful DHCPv6 address autoconfiguration
and then run the dhcpv6 client information-request command to enable stateless DHCPv6 address
autoconfiguration.
----End
Pre-configuration Tasks
Before configuring the DHCPv6 PD client function, complete the following tasks:
l
Configuring the route between the router and DHCPv6 relay agent or DHCPv6 PD server
Procedure
1.
Run:
system-view
Run:
ipv6
Run:
interface interface-type interface-number
Run:
ipv6 enable
Issue 04 (2014-01-16)
313
9 DHCPv6 Configuration
Run:
ipv6 address auto link-local
Run:
ipv6 address auto global default
Run:
system-view
Run:
dhcpv6 duid { ll | llt }
Run:
dhcp enable
Run:
interface interface-type interface-number
Run:
dhcpv6 client pd
Issue 04 (2014-01-16)
Run the display dhcpv6 client prefix [ name prefix-name ] command to check IPv6
prefixes on the device that functions as the DHCPv6 client.
Huawei Proprietary and Confidential
Copyright Huawei Technologies Co., Ltd.
314
9 DHCPv6 Configuration
----End
NOTICE
DHCPv6 message statistics cannot be restored after being cleared. Confirm your operation
before clearing them.
Procedure
l
----End
Issue 04 (2014-01-16)
315
9 DHCPv6 Configuration
Context
NOTICE
DHCPv6 message statistics cannot be restored after being cleared. Confirm your operation
before clearing them.
Procedure
l
----End
----End
----End
----End
316
9 DHCPv6 Configuration
address pool. In this way, the IPv6 addresses in the address pool return to the idle state and the
clients can re-apply for these IPv6 addresses.
Procedure
l
Run the reset dhcpv6 pool pool-name [ allocated { address | prefix } | binding [ duid ]
| conflict address | ipv6-address [ to ipv6-address ] | ipv6-prefix/prefix-length ] command
to clear IPv6 address pool configurations.
----End
Router B
3000::1/64
GE0/0/1
GE0/0/1
DHCPv6 Client
DHCPv6 Server
Configuration Roadmap
The configuration roadmap is as follows:
1.
Enable IPv6 functions on the interface so that devices can communicate using IPv6.
2.
Enable the DHCPv6 Server function so that devices can assign IPv6 addresses using
DHCPv6.
Procedure
Step 1 Enable the DHCP service.
<Huawei> system-view
[Huawei] sysname Router A
[Router A] dhcp enable
Issue 04 (2014-01-16)
317
9 DHCPv6 Configuration
A] ipv6
A] interface gigabitethernet 0/0/1
A-GigabitEthernet0/0/1] ipv6 enable
A-GigabitEthernet0/0/1] ipv6 address 3000::1/64
Run the display dhcpv6 server command on the router to check information about the DHCPv6
server.
<Router A> display dhcpv6
Interface
GigabitEthernet0/0/1
server
DHCPv6 pool
pool1
----End
Configuration File
Configuration file of Router A
#
sysname Router A
#
ipv6
#
dhcp enable
#
dhcpv6 pool pool1
address prefix 3000::/64
excluded-address 3000::1
dns-server 4000::1
#
interface GigabitEthernet0/0/1
ipv6 enable
ipv6 address 3000::1/64
dhcpv6 server pool1
#
return
Issue 04 (2014-01-16)
318
9 DHCPv6 Configuration
Router B
GE0/0/1
DHCPv6 PD Client
Router A
3000::1/64
GE0/0/1
DHCPv6 PD Server
IPv6 HostA
IPv6 HostB
Configuration Roadmap
The configuration roadmap is as follows:
1.
Enable IPv6 functions on the interface so that devices can communicate using IPv6.
2.
Enable the DHCPv6 PD server function so that DHCPv6 PD server can assign IPv6 address
using DHCPv6.
Procedure
Step 1 Enable the DHCP service.
<Huawei> system-view
[Huawei] sysname Router A
[Router A] dhcp enable
Issue 04 (2014-01-16)
319
9 DHCPv6 Configuration
# Run the display dhcpv6 server command on the router to check information about the
DHCPv6 server.
<Router A> display dhcpv6
Interface
GigabitEthernet0/0/1
server
DHCPv6 pool
pool1
----End
Configuration File
Configuration file of Router A
#
sysname Router A
#
ipv6
#
dhcp enable
#
dhcpv6 pool pool1
prefix-delegation 3000::/60 63
dns-server 4000::1
#
interface GigabitEthernet0/0/1
ipv6 enable
ipv6 address 3000::1/64
dhcpv6 server pool1
#
return
Issue 04 (2014-01-16)
320
9 DHCPv6 Configuration
DHCPv6 client
DHCPv6 client
DHCPv6 Relay
RouterB
3000::3/64
DHCPv6 server
DHCPv6 client
DHCPv6 client
Configuration Roadmap
The configuration roadmap is as follows:
1.
Enable IPv6 functions on the interface so that devices can implement IPv6 communication.
2.
Enable the DHCPv6 relay function so that the DHCPv6 server and client on different links
can transmit packets.
Procedure
Step 1 Enable the DHCP service.
<Huawei> system-view
[Huawei] sysname Router A
[Router A] dhcp enable
Issue 04 (2014-01-16)
321
9 DHCPv6 Configuration
A-GigabitEthernet1/0/0]
A-GigabitEthernet1/0/0]
A-GigabitEthernet1/0/0]
A-GigabitEthernet1/0/0]
Run the display dhcpv6 relay statistics on RouterA to check DHCP message statistics on the
DHCPv6 relay agent.
[Router A] display dhcpv6 relay statistics
MessageType
Receive
Send
Solicit
0
0
Advertise
0
0
Request
0
0
Confirm
0
0
Renew
0
0
Rebind
0
0
Reply
0
0
Release
0
0
Decline
0
0
Reconfigure
0
0
Information-request
0
0
Relay-forward
0
0
Relay-reply
0
0
UnknownType
0
0
Error
0
0
0
0
0
0
0
0
0
0
0
0
0
0
----End
Configuration File
Configuration file of RouterA
#
sysname Router A
#
ipv6
#
dhcp enable
#
Issue 04 (2014-01-16)
322
9 DHCPv6 Configuration
interface GigabitEthernet1/0/0
ipv6 enable
ipv6 address 2000::1/64
dhcpv6 relay destination 3000::3
undo ipv6 nd ra halt
ipv6 nd autoconfig managed-address-flag
ipv6 nd autoconfig other-flag
#
interface GigabitEthernet2/0/0
ipv6 enable
ipv6 address 3000::1/64
#
return
Router A
GE0/0/2
GE0/0/1
Router B
3000::1/64
GE0/0/1
DHCPv6 PD Client
IPv6 hostA
DHCPv6 PD Server
IPv6 hostB
Configuration Roadmap
The configuration roadmap is as follows:
1.
Enable IPv6 functions on the interface so that devices can communicate using IPv6.
2.
Enable the DHCPv6 PD client function so that devices can obtain IPv6 address prefixes
using DHCPv6.
Procedure
Step 1 Enable the DHCP service.
Issue 04 (2014-01-16)
323
9 DHCPv6 Configuration
<Huawei> system-view
[Huawei] sysname Router A
[Router A] dhcp enable
A] ipv6
A] interface gigabitethernet 0/0/1
A-GigabitEthernet0/0/1] ipv6 enable
A-GigabitEthernet0/0/1] ipv6 address auto link-local
A] interface gigabitethernet
A-GigabitEthernet0/0/2] ipv6
A-GigabitEthernet0/0/2] ipv6
A-GigabitEthernet0/0/2] undo
A-GigabitEthernet0/0/2] ipv6
A-GigabitEthernet0/0/2] ipv6
A-GigabitEthernet0/0/2] quit
0/0/2
enable
address auto link-local
ipv6 nd ra halt
nd autoconfig other-flag
address myprefix ::1:0:0:0:1/64
Run the display dhcpv6 client statistics on the Router A to check DHCPv6 message statistics
on the DHCPv6 client.
<Router A> display dhcpv6 client statistics
Message statistics of interface GigabitEthernet0/0/1:
Message
Received
Advertise
1
Reply
1
Reconfigure
0
Invalid
0
Message
Solicit
Request
Confirm
Renew
Issue 04 (2014-01-16)
Sent
1
1
0
0
324
9 DHCPv6 Configuration
0
0
0
0
----End
Configuration File
Configuration file of Router A
#
sysname Router A
#
ipv6
#
dhcp enable
#
interface GigabitEthernet0/0/1
ipv6 enable
ipv6 address auto link-local
dhcpv6 client pd
myprefix
#
interface GigabitEthernet0/0/2
ipv6 enable
ipv6 address auto link-local
undo ipv6 nd ra halt
ipv6 nd autoconfig other-flag
ipv6 address myprefix ::
1:0:0:0:1/64
#
return
Router A
3000::1/64
GE0/0/1
GE0/0/1
DHCPv6 Client
DHCPv6 Server
Configuration Roadmap
The configuration roadmap is as follows:
1.
Issue 04 (2014-01-16)
Enable IPv6 functions on the interface so that devices can communicate using IPv6.
Huawei Proprietary and Confidential
Copyright Huawei Technologies Co., Ltd.
325
2.
9 DHCPv6 Configuration
Enable the DHCPv6 client function so that devices can obtain IPv6 addresses using
DHCPv6.
Procedure
Step 1 Enable the DHCP service.
<Huawei> system-view
[Huawei] sysname Router A
[Router A] dhcp enable
A] ipv6
A] interface gigabitethernet
A-GigabitEthernet0/0/1] ipv6
A-GigabitEthernet0/0/1] ipv6
A-GigabitEthernet0/0/1] ipv6
0/0/1
enable
address auto link-local
address auto global default
Run the display dhcpv6 client statistics command on the Router A to check message statistics
on the DHCPv6 client.
<Router A> display dhcpv6 client statistics
Message statistics of interface GigabitEthernet0/0/1:
Message
Received
Advertise
1
Reply
1
Reconfigure
0
Invalid
0
Message
Solicit
Request
Confirm
Renew
Rebind
Release
Decline
Information-request
Sent
1
1
0
0
0
0
0
0
----End
Issue 04 (2014-01-16)
326
9 DHCPv6 Configuration
Configuration File
Configuration file of Router A
#
sysname Router A
#
ipv6
#
dhcp enable
#
interface GigabitEthernet0/0/1
ipv6 enable
ipv6 address auto link-local
ipv6 address auto global default
ipv6 address auto
dhcp
#
return
9.8 References
Table 1 RFCs related to DHCPv6 features
Issue 04 (2014-01-16)
Document
Description
Remarks
RFC2460
RFC3315
RFC3319
RFC3633
RFC3646
RFC3736
RFC3898
RFC2462
RFC4075
RFC4242
RFC4649
327
10
Issue 04 (2014-01-16)
328
RouterA
IPv6 DNS Client
IPv6 DNS Server
RouterB
IPv6 DNS Client
As shown in Figure 10-1, the router functions as an IPv6 DNS client and supports static and
dynamic domain name resolution.
l
Static domain name resolution: Mappings between domain names and IPv6 addresses are
configured manually. To obtain the IPv6 address by resolving a domain name, the client
searches the static domain name resolution table for the specified domain name.
Dynamic DNS resolution: Dynamic DNS resolution is implemented by a DNS server. The
DNS server receives domain name resolution requests from DNS clients. The DNS server
searches for the corresponding IPv6 address of the domain name in its DNS database. If
no matching entry is found, it sends a query message to a higher-level DNS server. This
process continues until the DNS server finds the corresponding IPv6 address or detects that
the corresponding IPv6 address of the domain name does not exist. Then the DNS server
returns a result to the DNS client.
The router IPv6 domain name resolution system must support the following DNS query
modes:
AAAA query
A6 query
IPv6 PTR query
Issue 04 (2014-01-16)
329
As shown in Figure 10-2, an IPv6 DNS client on the LAN can connect to an external IPv6 DNS
server through the router enabled with IPv6 DNS proxy or relay. After the external DNS server
translates the domain name of the IPv6 DNS client to an IP address, the IPv6 DNS client can
access the Internet.
IPv6 DNS relay is similar to IPv6 DNS proxy. The difference is that the IPv6 DNS proxy searches
for DNS entries saved in the domain name cache after receiving DNS query messages from DNS
clients. The IPv6 DNS relay, however, directly forwards DNS query messages to the DNS server,
reducing the cache usage.
330
Procedure
Step 1 Run:
system-view
NOTICE
If multiple DNS servers are configured, query messages are sent to the DNS servers according
to the order in which they are configured till correct reply packets are received.
Procedure
Step 1 Run:
system-view
331
Step 2 Run:
dns resolve
Run the display dns configuration command to display the global DNS configurations.
Run the display ipv6 host command to view the static IPv6 DNS table.
Run the display dns server command to check the DNS server configuration.
Run the display dns domain command to check the domain name suffix configuration.
----End
Pre-configuration Tasks
Before configuring IPv6 DNS proxy or relay, complete the following tasks:
l
Issue 04 (2014-01-16)
Connecting interfaces and setting physical parameters for the interfaces to ensure that the
physical status of the interfaces is Up
Huawei Proprietary and Confidential
Copyright Huawei Technologies Co., Ltd.
332
Configuring link layer protocol parameters for interfaces to ensure that the link layer
protocol status on the interfaces is Up
Configuring routes between the local routing device and the DNS server and between the
local routing device and the IPv6 DNS client
Procedure
Step 1 Run:
system-view
The DNS server that the IPv6 DNS proxy or relay connects to is configured.
----End
Procedure
Step 1 Run:
system-view
Issue 04 (2014-01-16)
333
No source IPv6 address is available for the outbound interface connected to the DNS server.
If one of the preceding requirements is met, when receiving an AAAA or A6 query, the IPv6
DNS proxy or relay return spoofing reply messages using the configured IPv6 address.
Procedure
Step 1 Run:
system-view
IPv6 DNS spoofing is enabled and the IPv6 address in response packets is specified.
By default, IPv6 DNS spoofing is disabled.
----End
Run the display dns configuration command to display the global DNS configurations.
Run the display ipv6 host command to view the static IPv6 DNS table.
Issue 04 (2014-01-16)
334
Run the display dns server command to check the DNS server configuration.
----End
NOTICE
IPv6 DNS entries cannot be restored after being cleared. Exercise caution when you run the
command.
Procedure
l
Run the reset dns ipv6 dynamic-host to clear IPv6 DNS entries in the domain name cache.
----End
NOTICE
IPv6 DNS forwarding entries cannot be restored after being cleared. Exercise caution when you
run the command.
Procedure
l
Run the reset dns ipv6 forward table [ source-ip ipv6-address ]command in the user
view to clear IPv6 DNS forwarding entries.
----End
335
Context
NOTICE
Statistics on sent and received IPv6 DNS packets cannot be restored after being cleared. Exercise
caution when you run the command.
Procedure
l
Run the reset dns statistics command to clear statistics on sent and received IPv6 DNS
packets.
----End
Procedure
l
Run the display dns ipv6 dynamic-host [ domain-name | a6 ] command to check IPv6
dynamic DNS entries saved in the cache.
----End
Issue 04 (2014-01-16)
336
RouterC
RouterB
GE1/0/0
2001::1/64
GE1/0/0
2003::1/64
GE1/0/0
2001::2/64
GE2/0/0
2002::2/64
GE2/0/0
2002::3/64
DNS server
2003::2/64
huawei.com
2002::1/64
Configuration Roadmap
The configuration roadmap is as follows:
1.
2.
Configure the dynamic DNS resolution on RouterA to access the DNS server.
Procedure
Step 1 Configure RouterA.
# Configure IPv6 function.
<Huawei> system-view
[Huawei] sysname RouterA
[RouterA] ipv6
[RouterA] interface gigabitethernet 1/0/0
[RouterA-GigabitEthernet1/0/0] ipv6 enable
[RouterA-GigabitEthernet1/0/0] ipv6 address 2001::1/64
[RouterA-GigabitEthernet1/0/0] quit
Issue 04 (2014-01-16)
337
NOTE
To resolve the domain name, you need to configure the route from RouterA to the IPv6 DNS server. For
details on how to configure the route, see Configure static route example in the Configuration GuideIP Routing.
# Run the display ipv6 host command on RouterA. You can view mappings between host names
and IPv6 addresses in static DNS entries.
<RouterA> display ipv6 host
Host
Age
RouterB
0
RouterC
0
Flags
static
static
IPv6Address (es)
2001::2
2002::3
Run the display dns ipv6 dynamic-host command on RouterA. You can view information about
dynamic IPv6 DNS entries saved in the cache.
<RouterA> display dns ipv6 dynamic-host
Host
TTL
Type
Address(es)
huawei.com
3579
IPv6
2002::1
NOTE
The TTL field in the command output indicates the lifetime of a DNS entry, in seconds.
----End
Configuration File
l
Issue 04 (2014-01-16)
338
Issue 04 (2014-01-16)
339
RouterA
DNS Proxy
NetworkA
GE1/0/0
2001::2/64
GE1/0/0
2001::1/64
GE2/0/0
2002::1/64
RouterB
DNS Server
2002::2/64
Configuration Roadmap
The configuration roadmap is as follows:
1.
Configure the IPv6 address for the DNS server on RouterA to forward DNS packets.
2.
Procedure
Step 1 Configure an IPv6 address for GE1/0/0.
<Huawei> system-view
[Huawei] sysname RouterA
[RouterA] ipv6
[RouterA] interface gigabitethernet 1/0/0
[RouterA-GigabitEthernet1/0/0] ipv6 enable
[RouterA-GigabitEthernet1/0/0] ipv6 address 2001::1 64
[RouterA-GigabitEthernet1/0/0] quit
# Configure a DNS server that the DNS proxy or relay connects to.
[RouterA] dns server ipv6 2002::2
Step 3 Configure DNS spoofing and specify the IPv6 address in response messages as 2003::3.
[RouterA] dns spoofing ipv6 2003::3
You need to configure a static IPv6 route on the DNS server so that DNS packets can be sent and received
properly.
340
# Run the display current-configuration command to view the DNS proxy configuration on
RouterA.
<RouterA> display current-configuration | include dns
dns resolve
dns server ipv6 2002::2
dns Proxy enable
dns Spoofing ipv6
2003::3
----End
Configuration File
Configuration file of RouterA
#
sysname RouterA
#
ipv6
#
interface GigabitEthernet1/0/0
ipv6 enable
ipv6 address 2001::1/64
#
dns resolve
dns server ipv6 2002::2
dns proxy enable
dns spoofing ipv6 2003::3
#
ipv6 route-static 2002:: 64 2001::2
#
return
Issue 04 (2014-01-16)
341
11
Issue 04 (2014-01-16)
342
11.2 Principles
11.2.1 Dual Protocol Stack
Dual protocol stack is a technology used for the transition from the IPv4 to IPv6 network. Nodes
on a dual stack network support both IPv4 and IPv6 protocol stacks. A source node and a
destination node use the same protocol stack. Network devices use protocol stacks to process
and forward packets based on the protocol type of packets. You can implement a dual protocol
stack on a unique device or a dual stack backbone network. On the dual stack backbone network,
all devices must support both IPv4 and IPv6 protocol stacks. Interfaces connecting to the dual
stack network must be configured with both IPv4 and IPv6 addresses. Figure 11-1 shows the
structures of a single protocol stack and a dual protocol stack.
Figure 11-1 Dual protocol stack
IPv4 Application
UDP
TCP
IPv4/IPv6 Application
TCP
UDP
IPv4
IPv4
Protocol ID:
0x0800
Ethernet
IPv4 Stack
IPv6
Protocol ID: Protocol ID:
0x86DD
0x0800
Ethernet
Dual Stack
Issue 04 (2014-01-16)
343
Figure 11-2 shows a typical application of the dual IPv4/IPv6 protocol stack.
Figure 11-2 Networking diagram for applying a dual protocol stack
www.example.com=?
IPv4
10.1.1.1
DNS
Server
Network
10.1.1.1 or
3ffe:yyyy::1
Router
IPv6
3ffe:yyyy::1
As shown in Figure 11-2, an application that supports dual protocol stack requests an IP address
corresponding to the domain name www.example.com from the DNS server. As shown in the
figure, a host sends a DNS request packet to the DNS server, requesting the IP address
corresponding to the domain name www.example.com. The DNS server responds with the
requested IP address. The IP address can be 10.1.1.1 or 3ffe:yyyy::1. If the host sends a class A
query packet, it requests the IPv4 address from the DNS server. If the host sends a class AAAA
query packet, it requests the IPv6 address from the DNS server.
Router in the figure supports the dual protocol stack. Router uses the IPv4 protocol stack to
connect the host to the network server with the IPv4 address 10.1.1.1. Router uses the IPv6
protocol stack to connect the host to the network server with the IPv6 address 3ffe:yyyy::1.
344
whereas IPv6 networks are isolated sites over the world. You can create tunnels on the IPv4
networks to connect to IPv6 isolated sites. These tunnels are called IPv6 over IPv4 tunnels.
Figure 11-3 shows how to apply the IPv6 over IPv4 tunnel.
Figure 11-3 Networking diagram for applying the IPv6 over IPv4 tunnel
Dual Stack
Router
IPv6
IPv4
Dual Stack
Router
IPv6 over
IPv4 Tunnel
Tunnel
IPv6
IPv6 host
IPv6 Header
IPv6 host
IPv6 Data
IPv4 Header
IPv6 Header
IPv6 Header
IPv6 Data
IPv6 Data
1.
On the border device, the dual IPv4/IPv6 protocol stack is enabled, and an IPv6 over IPv4
tunnel is configured.
2.
After the border device receives a packet from the IPv6 network, the device appends an
IPv4 header to the IPv6 packet to encapsulate the IPv6 packet as an IPv4 packet if the
destination address of the IPv6 packet is not the device and the outbound interface of the
next hop is the tunnel interface.
3.
On the IPv4 network, the encapsulated packet is transmitted to the remote border device.
4.
The remote border device decapsulates the packet, removes the IPv4 header, and sends the
decapsulated IPv6 packet to the IPv6 network.
A tunnel is established when its start and end points are determined. You must manually
configure an IPv4 address at the start point of an IPv6 over IPv4 tunnel. The IPv4 address at the
end point of the tunnel can be determined manually or automatically. Based on the mode in
which the end point IPv4 address is obtained, IPv6 over IPv4 tunnels are classified into manual
tunnels and automatic tunnels.
l
Manual tunnel: If a tunnel is created manually, a border router cannot automatically obtain
an IPv4 address at the end point. You must manually configure an end point IPv4 address
before packets can be transmitted to the remote border router.
Manual Tunnel
Based on encapsulation modes of IPv6 packets, manual tunnels are classified into IPv6 over
IPv4 manual tunnels and IPv6 over IPv4 Generic Routing Encapsulation (GRE) tunnels.
IPv6 over IPv4 Manual Tunnel
The border router uses the received IPv6 packet as the payload and encapsulates the IPv6 packet
as an IPv4 packet. You must manually specify the source and destination addresses of a manual
Issue 04 (2014-01-16)
345
tunnel. A manual tunnel is a P2P connection. It can be created between two border routers to
connect IPv4 isolated IPv6 sites, or created between a border router and a host to enable the host
to access an IPv6 network. Hosts and border routers on both ends of a manual tunnel must support
the IPv4/IPv6 dual protocol stack. Other devices only need to support a single protocol stack. If
you create multiple IPv6 over IPv4 manual tunnels between one border router and multiple hosts,
the configuration workload is heavy. Therefore, an IPv6 over IPv4 manual tunnel is commonly
created between two border routers to connect IPv6 networks.
Figure 11-4 shows the encapsulation format of an IPv6 over IPv4 packet.
Figure 11-4 Encapsulation format of an IPv6 over IPv4 packet
IPv4 Header
IPv6 Header
IPv6 Data
The forwarding mechanism of an IPv6 over IPv4 manual tunnel is as follows: After a border
router receives an packet from the IPv6 network, it searches the destination address of the IPv6
packet in the routing and forwarding table. If the packet is forwarded from this virtual tunnel
interface, the router encapsulates the packet based on the source and destination IPv4 addresses
configured on the interface. The IPv6 packet is encapsulated as an IPv4 packet and processed
by the IPv4 protocol stack. The encapsulated packet is forwarded through the IPv4 network to
the remote end of the tunnel. After the border router on the remote end of the tunnel receives
the encapsulated packet, it decapsulates the packet and processes the packet using the IPv6
protocol stack.
IPv6 over IPv4 GRE Tunnel
An IPv6 over IPv4 GRE tunnel uses the standard GRE tunnel technology to provide P2P
connections. You must manually specify addresses for both ends of the tunnel. Any types of
protocol packets that GRE supports can be encapsulated and transmitted through a GRE tunnel.
The protocols may include IPv4, IPv6, Open Systems Interconnection (OSI), and Multiprotocol
Label Switching (MPLS).
Figure 11-5 shows the encapsulation and transmission process on an IPv6 over IPv4 GRE tunnel.
Figure 11-5 IPv6 over IPv4 GRE tunnel
IPv6 Header
Data
IPv4
IPv6
GRE Tunnel
Issue 04 (2014-01-16)
IPv6
Data
346
The forwarding mechanism of an IPv6 over IPv4 GRE tunnel is the same as that of an IPv6 over
IPv4 manual tunnel. For details, see the Configuration Guide - VPN.
Automatic Tunnel
You only need to configure the start point of an automatic tunnel, and the device automatically
obtains the end point of the tunnel. The tunnel interface uses a special form of IPv6 address with
an IPv4 address embedded. The device obtains the IPv4 address from the destination IPv6
address and uses the IPv4 address as the end point address of the tunnel.
Based on the encapsulation modes of IPv6 packets, automatic tunnels are classified into IPv4compatible IPv6 automatic tunnels, IPv6-to-IPv4 tunnels, and Intra-Site Automatic Tunnel
Addressing Protocol (ISATAP) tunnels.
IPv4-compatible IPv6 Automatic Tunnel
For an IPv4-compatible IPv6 automatic tunnel, the destination address contained in an IPv6
packet is an IPv4-compatible IPv6 address. The first 96 bits of an IPv4-compatible IPv6 address
are all 0s and the last 32 bits are the IPv4 address. Figure 11-6 shows the format of an IPv4compatible IPv6 address.
Figure 11-6 IPv4-compatible IPv6 address
0
IPv4 address
96 bit
32 bit
Figure 11-7 shows the forwarding mechanism of an IPv4-compatible IPv6 automatic tunnel.
Figure 11-7 Forwarding mechanism of an IPv4-compatible IPv6 automatic tunnel
IPv4
1.1.1.1/24
2.1.1.1/24
IPv4-Compatible IPv6 Tunnel
::1.1.1.1/96
Router A
::2.1.1.1/96
Router B
After receiving an IPv6 packet, Router A searches the routing table for the destination address ::
2.1.1.1 and finds that the next hop address is a virtual tunnel interface address. Router A then
encapsulates the IPv6 packet as an IPv4 address because the tunnel configured on Router A is
an IPv4-compatible IPv6 automatic tunnel. The source address of the encapsulated IPv4 address
is the start point address of the tunnel 1.1.1.1, and the destination address is 2.1.1.1, which is the
last 32 bits of the IPv4-compatible IPv6 address. Router A sends the packet through the tunnel
interface and forwards it on an IPv4 network to the destination address 2.1.1.1 (Router B). Router
Issue 04 (2014-01-16)
347
B receives the packet, obtains the IPv6 packet, and processes the IPv6 packet using the IPv6
protocol stack. Router B returns packets to Router A in the same way.
NOTE
If the IPv4 address contained in an IPv4-compatible IPv6 address is a broadcast address, multicast address,
network broadcast address, subnet broadcast address of an outbound interface, address of all 0s, or loopback
address, the IPv6 packet will be discarded.
To deploy an IPv4-compatible IPv6 tunnel, each host must have a valid IP address, and hosts
that communicate with each other must support dual protocol stacks and IPv4-compatible IPv6
tunnels. Therefore, it is unsuitable for large-scale networks. Currently, the IPv4-compatible IPv6
tunnel has been replaced by the IPv6-to-IPv4 tunnel.
IPv6-to-IPv4 Tunnel
An IPv6-to-IPv4 tunnel also uses an IPv4 address that is embedded in an IPv6 address. Unlike
IPv4-compatible IPv6 tunnels, you can create IPv6-to-IPv4 tunnels between two routers, a router
and a host, and two hosts. An IPv6-to-IPv4 address uses the IPv4 address as the network ID.
Figure 11-8 shows the format of an IPv6-to-IPv4 address.
Figure 11-8 Format of an IPv6-to-IPv4 address
FP
001
TLA
0x0002
IPv4 address
SLA ID
Interface ID
3 bit
13 bit
32 bit
16 bit
64 bit
Issue 04 (2014-01-16)
348
IPv4-Addr 1
IPv6 Header
IPv4-Addr 2
Data
IPv6 Header
Data
IPv4
6to4 tunnel
6to4
6to4 Router
2002:IPv4-Addr1::/48
6to4
6to4 Router
2002:IPv4-Addr2::/48
Data
One IPv4 address can be used as the source address of only one IPv6-to-IPv4 tunnel. When a
border device is connected to multiple IPv6-to-IPv4 networks that use the same IPv4 address as
the source address of the tunnel, the IPv6-to-IPv4 networks share a tunnel and are identified by
SLA ID in the IPv6-to-IPv4 address. Figure 11-10 shows the case.
Figure 11-10 Example of an IPv6-to-IPv4 tunnel (2)
2002:IPv4-Addr1:1::/64
IPv4-Addr 1
IPv4-Addr 2
6to4
IPv4
6to4
6to4 tunnel
6to4 Router
6to4 Router
2002:IPv4-Addr2::/48
6to4
Data
2002:IPv4-Addr1:2::/64
Backed by the advance of IPv6 networks, IPv6 hosts need to communicate with IPv4 hosts
through IPv6-to-IPv4 networks. It can be implemented by deploying IPv6-to-IPv4 relays. When
the destination address of an IPv6 packet forwarded through an IPv6-to-IPv4 tunnel is not an
IPv6-to-IPv4 address, but the next hop address is an IPv6-to-IPv4 address, the next hop router
is an IPv6-to-IPv4 relay. The device obtains the destination IPv4 address from the next hop IPv6to-IPv4 address. Figure 11-11 shows an IPv6-to-IPv4 relay.
Issue 04 (2014-01-16)
349
IPv4-Addr 2
IPv6 Network
IPv4
6to4 Net-2
6to4 tunnel
6to4 Relay
6to4 Router
2002:IPv4-Addr2::/48
6to4 Net-1
IPv4 Header IPv6 Header
Data
2002:IPv4-Addr1::/48
When hosts on IPv6-to-IPv4 network 2 want to communicate with hosts on the IPv6 network,
configure the next hop address as the IPv6-to-IPv4 address of the IPv6-to-IPv4 relay on the
border router. The IPv6-to-IPv4 address matches the source address of the IPv6-to-IPv4 tunnel.
Packets sent from IPv6-to-IPv4 network 2 to the IPv6 network are sent to the IPv6-to-IPv4 relay
router according to the routing table. The IPv6-to-IPv4 relay router then forwards packets to the
pure IPv6 network. When hosts on the IPv6 network send packets to IPv6-to-IPv4 network 2,
the IPv6-to-IPv4 relay router appends IPv4 headers to the packets and forwards the packets to
the destination addresses (IPv6-to-IPv4 addresses).
ISATAP Tunnel
ISATAP is another automatic tunnel technology. The ISATAP tunnel uses a special format of
IPv6 address with an IPv4 address embedded. Different from the IPv6-to-IPv4 address that uses
the IPv4 address as the network prefix, the ISATAP address uses the IPv4 address as the interface
ID. Figure 11-12 shows the format of the interface ID of an ISATAP address.
Figure 11-12 Format of the interface ID of an ISATAP address
000000ug00000000 0101111011111110
16 bit
16 bit
IPv4 address
32 bit
The "u" bit in the IPv4 address that is globally unique is set to 1. Otherwise, the "u" bit is set to
0. "g" is the individual/group bit. An ISATAP address contains an interface ID and it can be a
global unicast address, link-local address, ULA address, or multicast address. The device obtains
the first 64 bits of an ISATAP address by sending Request packets to the ISATAP router. Devices
on both ends of the ISATAP tunnel run the Neighbor Discovery (ND) protocol. The ISATAP
tunnel considers the IPv4 network as a non-broadcast multiple access (NBMA) network.
ISATAP allows IPv6 networks to be deployed within existing IPv4 networks. The deployment
is simple and networks can be easily expanded. Therefore, ISATAP is suitable for transition of
Issue 04 (2014-01-16)
350
local sites. ISATAP supports local routing within IPv6 sites, global IPv6 routing domains, and
automatic IPv6 tunnels. ISATAP can be used together with NAT to allow the use of an IPv4
address that is not globally unique within the site. Typically, an ISATAP tunnel is used within
the site, and does not require a globally unique IPv4 address embedded.
Figure 11-13 shows a typical application of the ISATAP tunnel.
Figure 11-13 Typical application of the ISATAP tunnel
Host B
10.1.2.5
FE80::5EFE:0A01:0205
1::5EFE:0A01:0205
T
I SA
AP
el
nn
u
T
IPv4
IPv6
ISATAP Tunnel
Host A
3::8
GE1/0/0
10.1.2.1
ISATAP Router
Tunnel 1
FE80::5EFE:0A01:0201
1::5EFE:0A01:0201
Host C
10.1.2.6
FE80::5EFE:0A01:0206
1::5EFE:0A01:0206
As shown in Figure 11-13, Host B and Host C are located on an IPv4 network. They both support
dual protocol stacks and have private IPv4 addresses. Perform the following operations to enable
the ISATAP function on Host B and Host C:
1.
2.
Encapsulate a link-local IPv6 address based on the interface ID. When a host obtains the
link-local IPv6 address, it can access the IPv6 network on the local link.
3.
The host automatically obtains a global unicast IPv6 address and ULA address.
4.
The host obtains an IPv4 address from the next hop IPv6 address as the destination address,
and forwards packets through the tunnel interface to communicate with another IPv6 host.
When the destination host is located on the same site as the source host, the next hop address
is the address of the source host. When the destination host is not located on the local site,
the next hop address is the address of the ISATAP device.
Issue 04 (2014-01-16)
351
Pre-configuration Tasks
Before configuring an IPv4/IPv6 dual stack, complete the following tasks:
l
Configuring link layer protocol parameters for interfaces to ensure that the link layer
protocol status on the interfaces is Up
Procedure
Step 1 Run:
system-view
352
Procedure
Step 1 Run:
system-view
} eui-64
353
Procedure
l
----End
Prerequisites
Source and destination devices of an IPv6 over IPv4 tunnel have forwarding routes.
Pre-configuration Tasks
Before configuring an IPv6 over IPv4 tunnel, complete the following task:
l
Configuration Process
You can perform the following configuration tasks in any sequence according to usage scenarios
shown in Table 11-1.
Table 11-1 Usage scenarios of IPv6 over IPv4 tunnels
Issue 04 (2014-01-16)
Category
Subcategory
Tunnel Source/
Destination IP
Address
Tunnel
Interface IP
Address
Usage Scenario
Manual
tunnel
Source and
destination IP
addresses use
manually
configured IPv4
addresses.
IPv6 address
Applies to simple
IPv6 networks or
point-to-point
connections.
Only IPv6
packets can be
transmitted over
the manual IPv6
over IPv4 tunnel.
354
Category
Automati
c tunnel
Subcategory
Tunnel Source/
Destination IP
Address
Tunnel
Interface IP
Address
Usage Scenario
Source and
destination IP
addresses use
manually
configured IPv4
addresses.
IPv6 address
Applies to simple
IPv6 networks or
point-to-point
connections. The
IPv6 over IPv4
GRE tunnel
supports multiple
upper-layer
protocols
including IPv6.
Automatic IPv6
over IPv4 tunnel
The source IP
address uses a
manually
configured IPv4
address, and the
destination
address is
automatically
generated.
Applies to pointto-multipoint
connections of
IPv6 hosts.
6to4 tunnel
The source IP
address uses a
manually
configured IPv4
address, and the
destination
address is
automatically
generated.
6to4 address in
the format of
2002:IPv4source-address::/
48
Applies to pointto-multipoint
connections on
IPv6 networks.
ISATAP tunnel
The source IP
address uses a
manually
configured IPv4
address, and the
destination
address is
automatically
generated.
ISATAP address
in the format of
Prefix:0
Applies to
connections of
IPv6 nodes on an
IPv4 network.
355
When the specified tunnel source interface is a physical interface, you are advised to set
the tunnel number to be the same as the tunnel source interface number.
The following configurations must be performed on devices at both ends of the tunnel.
To support a dynamic routing protocol, configure a network address for the tunnel interface.
Procedure
Step 1 Run:
system-view
You can specify a physical interface or a loopback interface as the source interface of a tunnel. Similarly,
you can specify the IP address of a physical interface or loopback interface as the source address of the
tunnel.
Step 5 Run:
destination dest-ip-address
The destination address of a tunnel can be the IP address of a physical interface or loopback interface.
Step 6 Run:
ipv6 enable
Issue 04 (2014-01-16)
356
You are advised to set the tunnel number to be the same as the number of the source physical
interface of the tunnel when the source interface of the tunnel is specified as a physical
interface.
You only need to specify the source address of the tunnel when an automatic tunnel is
configured. The destination address of the tunnel is obtained from the destination address
of the original IPv6 packet. In addition, the source addresses of an automatic tunnel must
be unique.
Ensure that the IPv6 address configured for the tunnel interface is compatible with an IPv4
address. In the IPv6 address, the high-order 96 bits are all 0s, and last 32 bits are the IPv4
address configured for the IPv4 network-side interface.
Procedure
Step 1 Run:
system-view
Issue 04 (2014-01-16)
357
You are advised to set the tunnel number to be the same as the number of the source physical
interface of the tunnel.
You only need to specify the source address of the tunnel when a 6to4 tunnel is configured.
The destination address of the tunnel is obtained from the destination address of the original
IPv6 packet. In addition, the source address of a 6to4 tunnel must be unique.
You need to configure a 6to4 address for the interface that connects a border device to the
6to4 network, and an IPv4 address for the interface that connects a border device to the
IPv4 network. You also need to configure a network address for the tunnel interface to
support a dynamic routing protocol.
Procedure
Step 1 Run:
system-view
The IPv6 address prefix of the specified tunnel interface must be the same as the address prefix of the 6to4
network that the device belongs to.
----End
Issue 04 (2014-01-16)
358
Follow-up Procedure
Connect to an IPv6 network through a 6to4 relay agent. The procedure for connecting to an IPv6
network through a 6to4 relay agent is similar to the procedure for configuring a 6to4 tunnel. For
details, see Example for Configuring 6to4 Relay.
You are advised to set the tunnel number to be the same as the number of the source physical
interface of the tunnel.
The source interface of a tunnel is the physical interface that forwards tunnel packets. You
can specify an IP address or interface name for the source interface.
You need to configure an ISATAP address with a 64-bit prefix-length as the IPv6 address
of a tunnel interface.
Procedure
Step 1 Run:
system-view
Issue 04 (2014-01-16)
359
Procedure
l
Run the display ipv6 interface tunnel interface-number command to check IPv6 attributes
of a tunnel interface.
----End
11.4.1 Monitoring the Running Status of the IPv6 over IPv4 Tunnel
Context
In routine maintenance, you can run the following command in any view to monitor the running
status of the IPv6 over IPv4 tunnel.
Procedure
l
Run the display ipv6 interface tunnel interface-number command in any view to view
the running status of the tunnel interface.
----End
Issue 04 (2014-01-16)
360
Figure 11-14 Networking diagram for configuring a manual IPv6 over IPv4 tunnel
IPv4
network
GE1/0/0
192.168.50.1/24
GE2/0/0
192.168.51.1/24
Router B
GE1/0/0
192.168.50.2/24
IPv6
GE1/0/0
192.168.51.2/24
Dual
Stack
RouterA
Dual
Stack
RouterC
IPv6
Configuration Roadmap
The configuration roadmap is as follows:
1.
Configure IP addresses for physical interfaces so that devices can communicate on the IPv4
backbone network.
2.
Configure IPv6 addresses, source interfaces, and destination addresses for tunnel interfaces
so that devices can communicate with hosts on the two IPv6 networks.
3.
Set the tunnel protocol to IPv6-IPv4 so that hosts on the two IPv6 networks can
communicate through the IPv4 backbone network.
Procedure
Step 1 Configure RouterA.
# Configure an IP address for an interface.
<Huawei>system-view
[Huawei] sysname RouterA
[RouterA] ipv6
[RouterA] interface gigabitethernet 1/0/0
[RouterA-GigabitEthernet1/0/0] ip address 192.168.50.2 255.255.255.0
[RouterA-GigabitEthernet1/0/0] quit
# Configure an IPv6 address, a source interface, and a destination address for the tunnel interface.
[RouterA-Tunnel0/0/1]
[RouterA-Tunnel0/0/1]
[RouterA-Tunnel0/0/1]
[RouterA-Tunnel0/0/1]
[RouterA-Tunnel0/0/1]
ipv6 enable
ipv6 address 3001::1/64
source gigabitethernet 1/0/0
destination 192.168.51.2
quit
361
# Configure an IPv6 address, a source interface, and a destination address for the tunnel interface.
[RouterC-Tunnel0/0/1]
[RouterC-Tunnel0/0/1]
[RouterC-Tunnel0/0/1]
[RouterC-Tunnel0/0/1]
[RouterC-Tunnel0/0/1]
ipv6 enable
ipv6 address 3001::2/64
source gigabitethernet 1/0/0
destination 192.168.50.2
quit
# Ping the IPv6 address of Tunnel0/0/1 on RouterA from RouterC. RouterC can receive a Reply
packet from RouterA.
[RouterC] ping ipv6 3001::1
PING 3001::1 : 56 data bytes, press CTRL_C to break
Reply from 3001::1
Issue 04 (2014-01-16)
362
----End
Configuration Files
l
Issue 04 (2014-01-16)
363
#
ip route-static 192.168.50.0 255.255.255.0 192.168.51.1
#
return
RouterB
GE1/0/0
20.1.1.2/24
RouterA
GE2/0/0
30.1.1.1/24
GE1/0/0
GE1/0/0
30.1.1.2/24
20.1.1.1/24
GRE Tunnel
GE2/0/0 Tunnel0/0/1
10.1.1.2/24 40.1.1.1/24
PC1
10.1.1.1/24
RouterC
Tunnel0/0/1 GE2/0/0
40.1.1.2/24 10.2.1.2/24
PC2
10.2.1.1/24
Configuration Roadmap
The configuration roadmap is as follows:
1.
Configure IP addresses for physical interfaces so that devices can communicate on the IPv4
network.
2.
Create tunnel interfaces on RouterA and RouterC, set up a GRE tunnel between them, and
specify the source and destination addresses of the tunnel interfaces, so that encapsulated
packets can be forwarded using OSPF routes. The source address is the IP address of the
interface sending packets, and the destination address is the IP address of the interface
receiving packets.
3.
Configure static routes on RouterA and RouterC, so that traffic between PC1 and PC2 can
be forwarded through the GRE tunnel. Set the destination address to the network segment
connected to the peer PC and the outbound interface to the tunnel interface on the local
device.
Issue 04 (2014-01-16)
364
Procedure
Step 1 Configure an IP address for each physical interface.
# Configure RouterA.
<Huawei> system-view
[Huawei] sysname RouterA
[RouterA] interface gigabitethernet 1/0/0
[RouterA-GigabitEthernet1/0/0] ip address 20.1.1.1 255.255.255.0
[RouterA-GigabitEthernet1/0/0] quit
[RouterA] ipv6
[RouterA] interface gigabitethernet 2/0/0
[RouterA-GigabitEthernet2/0/0] ipv6 enable
[RouterA-GigabitEthernet2/0/0] ipv6 address 2001::1 64
[RouterA-GigabitEthernet2/0/0] quit
# Configure RouterB.
<Huawei> system-view
[Huawei] sysname RouterB
[RouterB] interface gigabitethernet 1/0/0
[RouterB-GigabitEthernet1/0/0] ip address 20.1.1.2 255.255.255.0
[RouterB-GigabitEthernet1/0/0] quit
[RouterB] interface gigabitethernet 2/0/0
[RouterB-GigabitEthernet2/0/0] ip address 30.1.1.1 255.255.255.0
[RouterB-GigabitEthernet2/0/0] quit
# Configure RouterC.
<Huawei> system-view
[Huawei] sysname RouterC
[RouterC] interface gigabitethernet 1/0/0
[RouterC-GigabitEthernet1/0/0] ip address 30.1.1.2 255.255.255.0
[RouterC-GigabitEthernet1/0/0] quit
[RouterC] ipv6
[RouterC] interface gigabitethernet 2/0/0
[RouterC-GigabitEthernet2/0/0] ipv6 enable
[RouterC-GigabitEthernet2/0/0] ipv6 address 4001::1 64
[RouterC-GigabitEthernet2/0/0] quit
# Configure RouterC.
[RouterC] ip route-static 20.1.1.1 255.255.255.0 30.1.1.1
# Configure RouterC.
[RouterC] interface tunnel 0/0/1
[RouterC-Tunnel0/0/1] tunnel-protocol gre
Issue 04 (2014-01-16)
365
ipv6 enable
ipv6 address 3001::2 64
source 30.1.1.2
destination 20.1.1.1
quit
# Configure RouterC.
[RouterC] ipv6 route-static 2001::1 64 tunnel 0/0/1
# Ping the IPv6 address of RouterA from RouterC. RouterC can receive a Reply packet from
RouterA.
[RouterC] ping ipv6 2001::1
PING 2001::1 : 56 data bytes, press CTRL_C to break
Reply from 2001::1
bytes=56 Sequence=1 hop limit=64 time = 28 ms
Reply from 2001::1
bytes=56 Sequence=2 hop limit=64 time = 27 ms
Reply from 2001::1
bytes=56 Sequence=3 hop limit=64 time = 26 ms
Reply from 2001::1
bytes=56 Sequence=4 hop limit=64 time = 27 ms
Reply from 2001::1
bytes=56 Sequence=5 hop limit=64 time = 26 ms
--- 2001::1 ping statistics --5 packet(s) transmitted
5 packet(s) received
0.00% packet loss
round-trip min/avg/max = 26/26/28 ms
----End
Configuration Files
l
Issue 04 (2014-01-16)
366
Issue 04 (2014-01-16)
367
IPv4
RouterA
Dual
Stack
GE1/0/0
2.1.1.1/8
Tunnel0/0/1
::2.1.1.1/96
IPv6
GE1/0/0
2.1.1.2/8
Tunnel0/0/1
::2.1.1.2/96
Dual
Stack
RouterB
IPv6
Configuration Roadmap
The configuration roadmap is as follows:
1.
Configure IP addresses for physical interfaces so that devices can communicate on the IPv4
backbone network.
2.
Configure IPv6 addresses and source interfaces for tunnel interfaces so that devices can
communicate with hosts on the two IPv6 networks.
3.
Set the tunnel protocol to automatic so that hosts on the two IPv6 networks can
communicate through the IPv4 network.
Procedure
Step 1 Configure RouterA.
# Configure an IPv4/IPv6 dual stack.
<Huawei> system-view
[Huawei] sysname RouterA
[RouterA] ipv6
[RouterA] interface gigabitethernet 1/0/0
[RouterA-GigabitEthernet1/0/0] ip address 2.1.1.1 255.0.0.0
[RouterA-GigabitEthernet1/0/0] quit
Issue 04 (2014-01-16)
368
ipv6 enable
ipv6 address ::2.1.1.1/96
source gigabitethernet 1/0/0
quit
# Ping the IPv6 address of the peer device that is compatible with the IPv4 address from RouterA.
The IPv6 address is pinged successfully.
[RouterA] ping ipv6 ::2.1.1.2
PING ::2.1.1.2 : 56 data bytes, press CTRL_C to break
Reply from ::2.1.1.2
bytes=56 Sequence=1 hop limit=64 time = 30 ms
Reply from ::2.1.1.2
bytes=56 Sequence=2 hop limit=64 time = 40 ms
Reply from ::2.1.1.2
bytes=56 Sequence=3 hop limit=64 time = 50 ms
Reply from ::2.1.1.2
bytes=56 Sequence=4 hop limit=64 time = 1 ms
Reply from ::2.1.1.2
bytes=56 Sequence=5 hop limit=64 time = 50 ms
--- ::2.1.1.2 ping statistics --5 packet(s) transmitted
5 packet(s) received
0.00% packet loss
round-trip min/avg/max = 1/34/50 ms
----End
Issue 04 (2014-01-16)
369
Configuration Files
l
Issue 04 (2014-01-16)
370
IPv4
GE1/0/0
2.1.1.1
RouterA
GE1/0/0
2.1.1.2
RouterB
GE2/0/0
2002:201:101:1::1/64
Tunnel 0/0/1
2002:201:101::1/64
2002:201:101:1::2
PC1
IPv6
GE2/0/0
2001::1/64
Tunnel0/0/1
2002:201:102::1/64
2002:201:102:1::2
PC2
IPv6
Configuration Roadmap
The configuration roadmap is as follows:
1.
Configure an IPv4/IPv6 dual stack on routers so that they can access the IPv4 network and
the IPv6 network.
2.
Configure a 6to4 tunnel on routers to connect IPv6 networks through the IPv4 backbone
network.
3.
Configure a static route between RouterA and RouterB so that they can communicate
through the IPv4 backbone network.
Procedure
Step 1 Configure RouterA.
# Configure an IPv4/IPv6 dual stack.
<Huawei> system-view
[Huawei] sysname RouterA
[RouterA] ipv6
[RouterA] interface gigabitethernet 1/0/0
[RouterA-GigabitEthernet1/0/0] ip address 2.1.1.1 255.0.0.0
[RouterA-GigabitEthernet1/0/0] quit
[RouterA] interface gigabitethernet 2/0/0
[RouterA-GigabitEthernet2/0/0] ipv6 enable
[RouterA-GigabitEthernet2/0/0] ipv6 address 2002:0201:0101:1::1/64
[RouterA-GigabitEthernet2/0/0] quit
Issue 04 (2014-01-16)
371
----End
Configuration Files
l
Issue 04 (2014-01-16)
372
#
ipv6
#
interface GigabitEthernet1/0/0
ip address 2.1.1.1 255.0.0.0
#
interface GigabitEthernet2/0/0
ipv6 enable
ipv6 address 2002:201:101:1::1/64
#
interface Tunnel 0/0/1
ipv6 enable
ipv6 address 2002:201:101::1/64
tunnel-protocol ipv6-ipv4 6to4
source pos1/0/0
#
ipv6 route-static :: 0 2002:201:102::1
#
ipv6 route-static 2002:: 16 Tunnel 0/0/1
#
return
Issue 04 (2014-01-16)
373
IPv6
network
IPv6 Host
3001::2
ISATAP
Router
IPv4
network
GE1/0/0 GE2/0/0
3001::1/64 2.1.1.1/8
ISATAP Host
FE80::5EFE:0201:0102
2.1.1.2
2001::5EFE:0201:0102
Configuration Roadmap
The configuration roadmap is as follows:
1.
Configure an IPv4/IPv6 dual stack on the router so that the router can communicate with
devices on the IPv4 network and the IPv6 network.
2.
Configure an ISATAP tunnel on the router so that IPv6 hosts on the IPv4 network can
communicate with IPv6 hosts on the IPv6 network.
3.
Procedure
Step 1 Configure the ISATAP router.
# Enable the IPv4/IPv6 dual stack and configure an IP address for each interface.
<Huawei> system-view
[Huawei] sysname Router
[Router] ipv6
[Router] interface gigabitethernet 1/0/0
[Router-GigabitEthernet1/0/0] ipv6 enable
[Router-GigabitEthernet1/0/0] ipv6 address 3001::1/64
[Router-GigabitEthernet1/0/0] quit
[Router] interface gigabitethernet 2/0/0
[Router-GigabitEthernet2/0/0] ip address 2.1.1.1 255.0.0.0
[Router-GigabitEthernet2/0/0] quit
374
# Run the following command to add a static route to the border router. The number of the
pseudo interface on the host is 2. You can run the ipv6 if command to check the interface
corresponding to Automatic Tunneling Pseudo-Interface.
C:\> netsh interface ipv6 isatap set router 2.1.1.1
The preceding information shows that the host obtains the prefix 2001::/64 and generates the
address 2001::5efe:2.1.1.2, router discovery has been enabled, and the ISATAP tunnel has
been set up successfully.
l When the ISATAP host runs Windows 7 operating system, perform the following operations:
# Run the following command to add a static route to the border router. IPv6 has been installed
by default in Windows 7 operating system.
C:\> netsh interface ipv6 isatap set router 2.1.1.1
C:\> netsh interface ipv6 isatap set router 2.1.1.1 enabled
The preceding information shows that the host obtains the prefix 2001::/64 and generates the
address 2001::200:5efe:2.1.1.2, and the ISATAP tunnel has been set up successfully.
Step 3 Configure the IPv6 host.
# Configure a static route to the border router tunnel on the IPv6 host so that PCs on two different
networks can communicate through the ISATAP tunnel.
C:\> netsh interface ipv6 set route 2001::/64 3001::1
375
# View the IPv6 status of Tunnel0/0/2 on the ISATAP router. You can see that the tunnel status
is Up.
[Router] display ipv6 interface Tunnel 0/0/2
Tunnel0/0/2 current state : UP
IPv6 protocol current state : UP
IPv6 is enabled, link-local address is FE80::5EFE:201:101
Global unicast address(es):
2001::5EFE:201:101, subnet is 2001::/64
Joined group address(es):
FF02::1:FF01:101
FF02::2
FF02::1
MTU is 1500 bytes
ND reachable time is 30000 milliseconds
ND retransmit interval is 1000 milliseconds
ND advertised reachable time is 0 milliseconds
ND advertised retransmit interval is 0 milliseconds
ND router advertisement max interval 600 seconds, min interval 200 seconds
ND router advertisements live for 1800 seconds
Hosts use stateless autoconfig for addresses
# Ping the global unicast address of the tunnel interface on the ISATAP host running Windows
XP operating system from the ISATAP router.
[Router] ping ipv6 2001::5efe:2.1.1.2
PING 2001::5efe:2.1.1.2 : 56 data bytes, press CTRL_C to break
Reply from 2001::5EFE:201:102
bytes=56 Sequence=1 hop limit=64 time = 4 ms
Reply from 2001::5EFE:201:102
bytes=56 Sequence=2 hop limit=64 time = 3 ms
Reply from 2001::5EFE:201:102
bytes=56 Sequence=3 hop limit=64 time = 2 ms
Reply from 2001::5EFE:201:102
bytes=56 Sequence=4 hop limit=64 time = 2 ms
Reply from 2001::5EFE:201:102
bytes=56 Sequence=5 hop limit=64 time = 2 ms
--- 2001::5efe:2.1.1.2 ping statistics --5 packet(s) transmitted
5 packet(s) received
0.00% packet loss
round-trip min/avg/max = 2/2/4 ms
# Ping the global unicast address of the ISATAP router from the ISATAP host running Windows
XP operating system.
C:\> ping6 2001::5efe:2.1.1.1
Pinging 2001::5efe:2.1.1.1
from 2001::5efe:2.1.1.2 with 32 bytes of data:
Reply from 2001::5efe:2.1.1.1: bytes=32 time=1ms
Reply from 2001::5efe:2.1.1.1: bytes=32 time=1ms
Reply from 2001::5efe:2.1.1.1: bytes=32 time=1ms
Reply from 2001::5efe:2.1.1.1: bytes=32 time=1ms
Ping statistics for 2001::5efe:2.1.1.1:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 1ms, Maximum = 1ms, Average = 1ms
# Ping the IPv6 host from the ISATAP host running Windows XP operating system. They can
ping each other.
C:\> ping6 3001::2
Pinging 3001::2 with 32 bytes of data:
Reply from 3001::2: time<1ms
Reply from 3001::2: time<1ms
Reply from 3001::2: time<1ms
Issue 04 (2014-01-16)
376
----End
Configuration Files
Configuration file of the ISATAP router
#
sysname ISATAP
#
ipv6
#
interface GigabitEthernet1/0/0
ipv6 enable
ipv6 address 3001::1/64
#
interface GigabitEthernet2/0/0
ip address 2.1.1.1 255.0.0.0
#
interface Tunnel0/0/2
ipv6 enable
ipv6 address 2001::/64 eui-64
undo ipv6 nd ra halt
tunnel-protocol ipv6-ipv4 isatap
source GigabitEthernet2/0/0
#
return
Issue 04 (2014-01-16)
377
12
Issue 04 (2014-01-16)
378
Dual Stack
Router
IPv4
network
IPv6
network
Dual Stack
Router
IPv4
network
IPv4
Host
IPv4
Host
IPv4 Header IPv4 Payload
IPv6 Header
IPv4 Header
IPv4 Payload
1.
On the border device, the IPv4/IPv6 dual protocol stack is enabled and the IPv4 over IPv6
tunnel is configured.
2.
After the border device receives a packet not destined for the device from the IPv4 network,
the device appends an IPv6 header to the IPv4 packet and encapsulates the IPv4 packet as
an IPv6 packet.
3.
On the IPv6 network, the encapsulated packet is transmitted to the remote border device.
4.
The remote border device decapsulates the packet, removes the IPv6 header, and sends the
decapsulated IPv4 packet to the IPv4 network.
Pre-configuration Tasks
Before configuring an IPv4 over IPv6 tunnel, complete the following task:
Issue 04 (2014-01-16)
379
The device does not support fragmentation of packets that are transmitted over the IPv4 over IPv6 tunnel.
Therefore, the IPv4 MTU of the tunnel interface must meet the following conditions:
IPv4 MTU of the tunnel interface < ( IPv6 MTU of the physical interface - Header length of IPv6 packets
on the IPv4 over IPv6 tunnel )
Procedure
Step 1 Run:
system-view
380
Procedure
Step 1 Run:
system-view
Procedure
Step 1 Run:
system-view
381
Procedure
l
Run the display interface tunnel [ interface-number ] command to check the running status
of the tunnel interface.
----End
12.3.1 Monitoring the Running Status of the IPv4 over IPv6 Tunnel
Context
In routine maintenance, you can run the following commands in any view to monitor the running
status of the IPv4 over IPv6 tunnel.
Issue 04 (2014-01-16)
382
Procedure
l
Run the display interface tunnel [ interface-number ] command in any view to view the
running status of the tunnel interface.
Run the display interface tunnel interface-number command in any view to view IPv4
attributes of the tunnel interface.
----End
IPv4
network
IPv6
network
GE1/0/0
10.1.2.1/30
GE1/0/0
RT1 10.1.2.2/30
RT2
GE1/0/0
GE1/0/0
2001::2/64 RT3 2002::2/64
GE2/0/0
2001::1/64
GE2/0/0
2002::1/64
RT4
GE2/0/0
10.1.3.1/30
GE1/0/0
10.1.3.2/30
RT5
IPv4
network
Configuration Roadmap
The configuration roadmap is as follows:
1.
Issue 04 (2014-01-16)
Configure an IPv4 over IPv6 tunnel on the border devices at both ends of the IPv6 network.
Huawei Proprietary and Confidential
Copyright Huawei Technologies Co., Ltd.
383
2.
Use a dynamic routing protocol to configure a route for the tunnel interface to forward
packets.
Configuration Procedures
1.
Configure an IPv6 address for the physical interface and enable IPv6 capability for IS-IS
on the IPv6 network to implement IP connectivity of the IPv6 network.
# Configure RT2.
<Huawei> system-view
[Huawei] sysname RT2
[RT2] ipv6
[RT2] interface gigabitethernet 2/0/0
[RT2-GigabitEthernet2/0/0] ipv6 enable
[RT2-GigabitEthernet2/0/0] ipv6 address 2001::1 64
[RT2-GigabitEthernet2/0/0] quit
[RT2] isis 1
[RT2-isis-1] network-entity 10.0000.0000.0001.00
[RT2-isis-1] ipv6 enable topology standard
[RT2-isis-1] quit
[RT2] interface gigabitethernet 2/0/0
[RT2-GigabitEthernet2/0/0] isis ipv6 enable 1
[RT2-GigabitEthernet2/0/0] quit
# Configure RT3.
<Huawei> system-view
[Huawei] sysname RT3
[RT3] ipv6
[RT3] interface gigabitethernet 1/0/0
[RT3-GigabitEthernet1/0/0] ipv6 enable
[RT3-GigabitEthernet1/0/0] ipv6 address 2001::2 64
[RT3-GigabitEthernet1/0/0] quit
[RT3] interface gigabitethernet 2/0/0
[RT3-GigabitEthernet2/0/0] ipv6 enable
[RT3-GigabitEthernet2/0/0] ipv6 address 2002::1 64
[RT3-GigabitEthernet2/0/0] quit
[RT3] isis 1
[RT3-isis-1] network-entity 10.0000.0000.0002.00
[RT3-isis-1] ipv6 enable topology standard
[RT3-isis-1] quit
[RT3] interface gigabitethernet 1/0/0
[RT3-GigabitEthernet1/0/0] isis ipv6 enable 1
[RT3-GigabitEthernet1/0/0] quit
[RT3] interface gigabitethernet 2/0/0
[RT3-GigabitEthernet2/0/0] isis ipv6 enable 1
[RT3-GigabitEthernet2/0/0] quit
# Configure RT4.
<Huawei> system-view
[Huawei] sysname RT4
[RT4] ipv6
[RT4] interface gigabitethernet 1/0/0
[RT4-GigabitEthernet1/0/0] ipv6 enable
[RT4-GigabitEthernet1/0/0] ipv6 address 2002::2 64
[RT4-GigabitEthernet1/0/0] quit
[RT4] isis 1
[RT4-isis-1] network-entity 10.0000.0000.0003.00
[RT4-isis-1] ipv6 enable topology standard
[RT4-isis-1] quit
[RT4] interface gigabitethernet 1/0/0
[RT4-GigabitEthernet1/0/0] isis ipv6 enable 1
[RT4-GigabitEthernet1/0/0] quit
2.
Issue 04 (2014-01-16)
Configure an IPv4 address for the physical interface and configure OSPF on the IPv4
network to implement IP connectivity of the IPv4 network.
Huawei Proprietary and Confidential
Copyright Huawei Technologies Co., Ltd.
384
# Configure RT1.
<Huawei> system-view
[Huawei] sysname RT1
[RT1] interface gigabitethernet 1/0/0
[RT1-GigabitEthernet1/0/0] ip address 10.1.2.2 30
[RT1-GigabitEthernet1/0/0] quit
[RT1] ospf 1
[RT1-ospf-1] area 0
[RT1-ospf-1-area-0.0.0.0] network 10.1.2.0 0.0.0.3
# Configure RT2.
[RT2] interface gigabitethernet 1/0/0
[RT2-GigabitEthernet1/0/0] ip address 10.1.2.1 30
[RT2-GigabitEthernet1/0/0] quit
[RT2] ospf 1
[RT2-ospf-1] area 0
[RT2-ospf-1-area-0.0.0.0] network 10.1.2.0 0.0.0.3
# Configure RT4.
[RT4] interface gigabitethernet 1/0/0
[RT4-GigabitEthernet1/0/0] ip address 10.1.3.1 30
[RT4-GigabitEthernet1/0/0] quit
[RT4] ospf 1
[RT4-ospf-1] area 0
[RT4-ospf-1-area-0.0.0.0] network 10.1.3.0 0.0.0.3
# Configure RT5.
<Huawei> system-view
[Huawei] sysname RT5
[RT5] interface gigabitethernet 1/0/0
[RT5-GigabitEthernet1/0/0] ip address 10.1.3.2 30
[RT5-GigabitEthernet1/0/0] quit
[RT5] ospf 1
[RT5-ospf-1] area 0
[RT5-ospf-1-area-0.0.0.0] network 10.1.3.0 0.0.0.3
3.
# Configure RT4.
[RT4] interface tunnel 0/0/1
[RT4-Tunnel0/0/1] tunnel-protocol ipv4-ipv6
[RT4-Tunnel0/0/1] ip address 10.1.1.2 30
[RT4-Tunnel0/0/1] source gigabitethernet 1/0/0
[ET4-Tunnel0/0/1] destination 2001::1
4.
Use a dynamic routing protocol to configure a route for the tunnel interface to forward
packets.
# Configure RT2.
[RT2] ospf 1
[RT2-ospf-1] area 0
[RT2-ospf-1-area-0.0.0.0] network 10.1.1.0 0.0.0.3
[RT2-ospf-1-area-0.0.0.0] quit
[RT2-ospf-1] quit
# Configure RT4.
[RT4] ospf 1
Issue 04 (2014-01-16)
385
[RT4-ospf-1] area 0
[RT4-ospf-1-area-0.0.0.0] network 10.1.1.0 0.0.0.3
5.
Check the IPv4 routing table on RT2 and RT4. You can see that the outbound interface of
the route to the remote IPv4 network is a tunnel interface.
[RT2] display ip routing-table
Routing Tables: Public
Destinations : 9
Destination/Mask
Proto Pre
1.1.1.1/32 Direct 0
10.1.1.0/30 Direct 0
10.1.1.1/32 Direct 0
10.1.2.0/30 Direct 0
10.1.2.1/32 Direct 0
10.1.2.2/32 Direct 0
10.1.3.0/24 OSPF
10
127.0.0.0/8
Direct 0
127.0.0.1/32 Direct 0
Routes : 9
Cost
NextHop
0
127.0.0.1
0
10.1.1.1
0
127.0.0.1
0
10.1.2.1
0
127.0.0.1
0
10.1.2.2
2
10.1.1.2
0
127.0.0.1
0
127.0.0.1
Interface
InLoopBack0
Tunnel0/0/2
Tunnel2/0/0
GigabitEthernet1/0/0
GigabitEthernet1/0/0
GigabitEthernet1/0/0
Tunnel0/0/2
InLoopBack0
InLoopBack0
Configuration Files
l
Issue 04 (2014-01-16)
386
sysname RT1
#
interface GigabitEthernet1/0/0
ip address 10.1.2.2 255.255.255.252
#
ospf 1
area 0.0.0.0
network 10.1.2.0 0.0.0.3
#
return
Issue 04 (2014-01-16)
387
Issue 04 (2014-01-16)
388