Hcna(hcda) Huawei Certified Network Associate Training.pdf 2y6v6v

[email protected]

.

c r u

: s e

h

o s Re

For example #Enter the system view from the view. system-view Enter system view, return view with Ctrl+Z #Enter the interface view from the system view. [Huawei]interface Serial 0/0/0 [Huawei-Serial0/0/0] #Return to the system view from the interface view. [Huawei-Serial0/0/0]quit [Huawei] #Return to the view from the system view. [Huawei]return

g n i

n r a

M

e r o

Le

Page179

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

In this example, through using the “?” command, it is possible to obtain a brief of all the commands at a given level. All levels will the use of this command to display possible completions. Another use of this command will allow for completion based on matches to a partial entry. If only the first letter of a command can be recalled, the ? command can be inserted as shown in the example above, in order to obtain all the commands with the same matching parameters, in this case, the same first letter.

c r u

g n i

n r a

e r o

Le

M

Page180

o s Re

: s e

h

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

The command line interface automatically stores commands input by s which so that s can recall used commands at any time and repetitively. By default,

: s e

h

the command line interface can keep records of up to 10 commands for a .

c r u

display history-command:

o s Reor : Up-arrow key gthe earlier record if there is one; otherwise the alarm Display n i off. goes n ardown-arrow key or : To display the commands that a has input.

M

e r o

Le

Display the next record if there is one; otherwise, the command is cleared up and the alarm goes off. When you use the command record function, please note the following: (1) The format of command records kept by VRP complies with the format of commands input by s. If the format of commands input by s is not intact, then the format of commands kept by VRP is not intact either. Page181

(2) If a command is run by a for many times, VRP only keeps the first running of this command as record. If a command is run in different formats several times, it is treated as different commands. For example, if you run the display ip routing-table command several times, VRP will keep it as only one record. If you run disp ip routing and display ip routing-table, VRP will keep them as two records.

m o c . i

n e /

e w ua

h . ng

i n ar

e l //

c r u

g n i

n r a

e r o

Le

M

Page182

o s Re

: s e

h

: p tt

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

Do as following to change the name of a router: system-view

: s e

h

Enter system view, return view with Ctrl+Z. [Huawei]

c r u

[Huawei]sysname Router1 [Router1]

g n i

o s Re

n r a

e r o

Le

M

Page183

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

Some services require that there be synchronization of time with other devices, often as a security measure and therefore the system time should be set correctly.

: s e

h

VRP s the setting of the time zone and daylight savings time features. #Set the time.

c r u

o s e R g display clock n i n 2006-12-12 10:19:50 r a Tuesday

clock datetime 10:19:30 2006/12/12

Mo

re

Le

Time Zone(Default Zone Name) : UTC+00:00

Page184

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

You can display the VRP version information by running the display version command. display version Huawei Versatile Routing Platform Software VRP (R) software, Version 5.90 (AR2200 V200R001C01SPC300) Copyright (C) 2011 HUAWEI TECH CO., LTD …… The version is 5.90 (AR2200 V200R001C01SPC300)。 You can view the information about terminal s by running the display s command. display s -Intf Delay Type Network Address AuthenStatus + 0 CON 0 00:00:00 name : Unspecified You can view the configurations in the current view by running the display this command. For example, you can view the configurations of the interface after you enter the interface view: [Hauwei]interface Ethernet 0 [Hauwei-Ethernet0]display this #

c r u

g n i

: s e

h

o s Re

n r a

M

e r o

Le

Page185

interface Ethernet0 ip address 13.13.13.2 255.255.255.252 isis enable 1 # return You can obtain the diagnostic information by running the display diagnostic-information command.

m o c . i

n e /

e w ua

h . ng

i n ar

e l //

c r u

g n i

n r a

e r o

Le

M

Page186

o s Re

: s e

h

: p tt

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

VRP manages software and configuration files through the file system. The file system is used for managing the files and directories in the storage device, which includes creating the system file, changing names of files and directories, creating, deleting, modifying files and directories and display files. The two main functions of the file system are storage device management and files management. The storage device is the hardware device that keeps information. At present, flash memory, hard disks and CF cards can be used by routers as storage devices. Different products use different devices to store information. File system is a mechanism for information storage and management. File directories are mechanisms for organizing files and they are the logical vessels for keeping files.

c r u

g n i

: s e

h

o s Re

n r a

Mo

re

Le

Delete a file. delete flash:/test/test.txt Delete flash:/test/test.txt?[Y/N] Restore the file that was deleted. undelete sample.bak Undelete flash:/test/sample.bak ?[Y/N]:y Page187

% Undeleted file flash:/test/sample.bak Delete files in the recycle bin. reset recycle-bin Display a file. more test.txt AppWizard has created this test application for you. This file contains a summary of what you will find in each of the files that make up your test application. Test.dsp

e w ua

Copy a file.

h . ng

copy hda1:/sample.txt flash:/ Copy hda1:/sample.txt to flash:/sample.txt ?[Y/N]:Y

i n ar

100% complete.

e l //

c r u

g n i

n r a

e r o

Le

M

Page188

o s Re

: s e

h

: p tt

m o c . i

n e /

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

Create a directory mkdir dd

: s e

h

Info: Create directory sd1:/dd......Done Delete a directory

c r u

rmdir test

o s %Removing Redirectory sd1:/test ...Done! Displaygthe current directory n pwd i n r flash:/test a Rmdir test?[Y/N]:y

e r o

Le

M

Page189

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

Format storage device format flash:

: s e

h

All data(include configuration and system startup file) on flash: will be lost , proceed with format? (y/n)[n]:Y

c r u

%Format flash: completed.

o s e flash: fixdisk R Fixdiskgflash: will take long time if needed. n flash: completed. Fixdisk i n r Be careful with the format command. It deletes all the files in the a Fix storage device whose file system is abnormal

e r o

Le

storage device once you run it.

M

Page190

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

When the router is powered on, it reads the configuration file from the default storage path to initialize itself. The configuration in the configuration file is called the initial configuration. If there are no configuration files in the default storage path, the router will initialize itself with the default parameters. The configuration used when the router is running is called the current configuration.

c r u

: s e

h

o s Re

s can change the current configurations of the router through the command line interface. To make the current configuration to be the initial configuration for the router when the router is powered on next time, you need to save the current configuration in the default storage path with the save command. You can view the saved configuration of the router by running the display saved configuration command.

g n i

n r a

M

e r o

Le

You can view the current configuration of the router by running the display current-configuration command. You can save the current configuration by running the save command. The detailed procedure is as follows: save

Page191

The current configuration will be written to the device. Are you sure to continue? (y/n)[n]:y It will take several minutes to save configuration file, please wait..... Configuration file had been saved successfully Note: The configuration file will take effect after being activated You can erase the configuration file in the storage device by running the reset saved-configuration command. The detailed procedure is as follows: reset saved-configuration

e w ua

This will delete the configuration in the flash memory.

h . ng

The device configurations will be erased to reconfigure.

i n ar

Are you sure? (y/n)[n]:y

Clear the configuration in the device successfully.

e l //

You can run the compare configuration command to make comparisons between the current configuration and the configuration in the configuration file stored. The following shows that the message displayed indicates that the current configuration is not the same as the stored configuration.

: s e

: p tt

h

compare configuration Warning:The current configuration is NOT the same as the saved configuration!

c r u

o s Re

====== Current configuration line 31 ====== ospf 1

g n i

……

====== Saved configuration line 31 ======

n r …… a

e r o

Le

M

Page192

m o c . i

n e /

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

VRP can backup its software and configuration files through FTP, TFTP. Here we will introduce the basic operations for routers or switches to obtain version files through the two modes, which is the general knowledge about version update. For details about version update methods and procedures, please refer to the update guidelines we provide for a product or a specific version of a product.

c r u

: s e

h

o s Re

FTP, TFTP are all file transport protocols for transporting files between s and devices.

g n i

File Transfer Protocol (FTP) is based on T and takes the mode of Server/Client. VRP can act both as the FTP server and the FTP client. When it acts as the FTP server, s can to the router to visit files on the router by running the FTP client program. When VRP acts as the FTP client, s can run FTP commands to connect with the remote FTP server and then visit files on the remote host after they built connections with the router through the terminal emulation program or Telnet.

n r a

M

e r o

Le

Trivial File Transfer Protocol (TFTP), different from FTP, does not require any authentication mechanisms, which is fit for an environment that does not involve much interaction between clients and servers. Page193

TFTP is based on UDP and takes the mode of Server/Client. TFTP transfer is initiated by the client. When there are files to , the client sends requests to the TFTP server for reading the files and receives packets from the server and at last, it sends confirmation to the server. When there are files to , the client sends requests to the TFTP server for writing the files and sends packets to the server and at last, it sends confirmation to the server. TFTP files have two modes, one is the binary mode that is used for program files and the other is the ASCII mode that is for text files. VRP can only act as the TFTP client and can transfer files only in the binary mode.

e w ua

m o c . i

h . ng

i n ar

e l //

c r u

g n i

n r a

e r o

Le

M

Page194

o s Re

: s e

h

: p tt

n e /

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

As the above figure illustrates, the PC and Router A are connected through serial ports and Router A and the FTP server are connected to the LAN. Router A obtains version files from the FTP server as the FTP client. Set the name and to huawei and huawei respectively on the FTP server. to Router A from the PC by the super terminal and make the following operations to obtain version files. # to the FTP server from Router A. ftp 172.16.104.110 Trying 172.16.104.110 ... Connected to 172.16.104.110. (172.16.104.110:(none)):huawei 331 Give me your , please : 230 Logged in successfully #Obtain the version file vrp.cc from the FTP server by running the get command. [RouterA] get vrp.cc 150 "D:\system\vrp.cc" file ready to send (5805100 bytes) in IMAGE / Binary mode 226 Transfer finished successfully. FTP: 5805100 byte(s) received in 19.898 second(s) 291.74Kbyte(s)/sec.

c r u

g n i

: s e

h

o s Re

n r a

M

e r o

Le

Page195

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

c r u

g n i

n r a

M

e r o

Le

: p tt

As the above figure illustrates, the PC and Router A are connected through serial ports and Router A and the FTP client are connected to LAN. Router A is configured as the FTP server to obtain version files from the FTP client. Run the following commands to configure Router A as the FTP server. #Enable the FTP server on the router. [RouterA]ftp server enable #Enter the AAA view and configure the authentication and authorization of the FTP server. Only s that the authentication and are authorized successfully can enjoy the services offered by the FTP server. [RouterA]aaa #Create a local named huawei. [RouterA-aaa] local- huawei #Set the service type to FTP. [RouterA-aaa] local- huawei service-type ftp #Configure the to huawei. [RouterA-aaa] local- huawei simple huawei #Configure the authorization directory of FTP s on the FTP server. [RouterA-aaa] local- huawei ftp-directory flash:/ftp/huawei

Page196

o s Re

: s e

h

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

As the above figure illustrates, the PC with the IP address of 10.111.16.160 runs the TFTP software to act as the TFTP server and Router A obtains version software from the TFTP server. Run the following command on Router A to obtain version software. #Run the tftp command to obtain the vrp.cc file and save it under cfcard:/. tftp 10.111.16.160 get vrp.cc cfcard:/vrp.cc Run the dir command to check if the version file is obtained and save in the defined directory. dir Directory of cfcard:/ 0 -rw- 86211956 Jun 08 2006 15:20:14 v300r001b02ssp02.cc 1-rw- 2718 Jun 21 2006 17:46:46 1.cfg 2 -rw- 6247 May 19 2006 15:00:10 license.txt 3 -rw- 80975644 Jun 08 2006 14:50:20 v300r001b02msp06.cc 4 -rw- 86235884 Feb 05 2001 10:23:46 vrp.cc 508752 KB total (261112 KB free)

c r u

g n i

: s e

h

o s Re

n r a

M

e r o

Le

Page197

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

c r u

g n i

n r a

e r o

Le

M

Page198

o s Re

: s e

h

: p tt

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

Simple Network Management Protocol (SNMP) is a widely used network management protocol. SNMP is a protocol that works at the application layer and the transport layer protocol is UDP. It takes up the 161 and 162 ports.

h

: s e and Agent. NMS stands for Network SNMP consists of NMS c r which sends requests to Agent. Agent is a Management Station u process or tasko that resides on the device that is managed. sanalysis and obtains information after it receives Agent makes e R NMS and then it generates responding packets to requests from g to NMS. SNMP is the application protocol that defines sendn back howito deliver management information between NMS and Agent. n defines two operations, namely GET and SET. The GET r SNMP a

M

e r o

Le

operation is for obtaining management information from the device that is under management.

The SET operation is for setting variable values to configure the management device. Trap is generated by Agent and it reports abnormalities of the managed device to NMS. Once NMS receives the trap, it takes measures such as polling detection to diagnose problems and take methods to solve problems and make changes to the data of network management. Page199

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p t v3 //Configure the SNMP [RouterAsnmp-agent sys-info version t h version information. : s [RouterA]snmp-agent community read public //Configure the e name of the SNMP read c community. r u community write private //Configure the [RouterA]snmp-agent o s write community. name of the SNMP e Note: The R configurations of Agent should agree with that on the NMS. g n i [RouterA]snmp-agent trap enable //Enable the router to send n r Trap. a [RouterA]snmp-agent //Enable the SNMP Agent service

M

e r o

Le

[RouterA]snmp-agent target-host udp-domain udp-port 5000 params securityname public

10.111.16.160

Configure the destination address of Trap, the UDP port number and community attributes.

Page200

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

1. How is a console connection established?

h

Connect the PC serial port with the Console port of the router by the normal line and run the terminal emulation software such as the windows terminal emulation software. Configure the parameters correctly and then to the router to configure.

: s e

c r u command levels and command views? 2. What are the o VRP s levels include the visit level, the monitor The VRP command e R level and the manage level. The command views level, the config gthe view, the system involve n i the interface view, and the routing protocol view, and so on. view, n ar3. How to create a Telnet ?

Mo

re

Le

Enter the vty view and configure the authentication mode and the for authentication and configure permissions. 4. What protocols can be used to upgrade VRP file? FTP, TFTP .

Page201

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

c r u

g n i

n r a

e r o

Le

M

Page202

o s Re

: s e

h

: p tt

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

Routing protocol basics is a basic course with great significance for understanding the different routing protocols. Based on previous sections, this section focuses on how the packet is forwarded between routers and the structure of the routing table.

c r u

g n i

: s e

h

o s Re

n r a

e r o

Le

M

Page203

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

c r u

g n i

n r a

e r o

Le

M

Page204

o s Re

: s e

h

: p tt

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

A router provides mechanisms for interconnecting networks of different structures which makes the transfer of packets among networks a reality. Routes are decisions made regarding the path over which the forwarding of packets will occur for a given destination. In the internet, routes are decided by routers. A router chooses an appropriate route according to the destination address in the header of the packet and sends the packet to the next router. The last router on the route is responsible for delivering the packet to the destination host. The whole process is very similar to a relay race. Each router focuses only on finding an optimal route and forward packets to the next station along that route. In this way, packets are delivered from one router to the next until they reach their destinations. However, packets do not always travel along the best route if some routing policies cause interference. In the example above, RTA is going to send a packet to a destination in network N. By searching the routing table, RTA finds the egress to network N is E0/0 and the next hop router is RTB. Then RTA sends out the packet through E0/0 to RTB and RTB forwards the packet to RTC in the same way and so on until the last router RTC sends the packet to network N. The packet is sent following the route RTA-RTB-RTC-network N.

c r u

g n i

: s e

h

o s Re

n r a

M

e r o

Le

Page205

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

Here we take the previous example to explain the process of IP routing. As the above figure shows: RTA connects with network 10.3.1.0 on the left and RTC connects with network 10.4.1.0 on the right. Here is a datagram to be sent from network 10.3.1.0 to network 10.4.1.0. The process of IP routing is as follows:

c r u

: s e

h

The packet is sent to E1 port of RTA that directly connects with network 10.1.1.0.After receiving the packet, RTA looks up the routing table and finds that the next hop to the destination is 10.1.2.2 and the egress is E0. Then the packet is sent out from E0 to 10.1.2.2.

g n i

o s Re

When the packet reaches E0 port of network 10.1.2.2, RTB n r a looks up its routing table to find the route to the destination of the

M

e r o

Le

packet. The routing table tells that the next hop to the destination is 10.2.1.2 and the egress is E1. Then the packet is sent out from E1 to head for its next hop, network 10.2.1.2. When the packet reaches E0 port of network 10.2.1.2, RTC looks up its routing table and finds that the destination of the packet is in its own segment and the next hop for the packet is 10.4.1.1 and the egress is E1. Then the packet is sent out from E1 to its destination.

Page206

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

The analysis of the process of IP routing shows us that data forwarding is totally dependent on the information in the routing table. To function effectively and efficiently, a router should:

: s e

h

1. Check the destination of a packet: Does the router have information about the destination of the packet?

c r u

2. Find the source of the information: Where is the information about the route to the destination from? Is it defined by the statically? Or is it obtained from other routers?

g n i

o s Re

3. Search for possible routes to the destination: What are the possible routes to the destination?

4.nSelect the best route: which is the best route to the destination? r a Should the router use the loading balance mechanism to send

M

e r o

Le

the packet by multiple routes?

5. and maintain routing information: Is a route valid? Is it the latest? Routers have to and maintain routing information to ensure that the information is correct.

Page207

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

c r u

g n i

n r a

e r o

Le

: p tt

Routers check the destination of the packets they receive and if the destination of the packets is not the interface of local routers, they will look up their routing tables to find out to which port the packets should be forwarded. 1. If the destination network connects with the router directly, the router knows to which port the packet should be forwarded. 2. If the destination network does not directly connects with the router, the router should find out of the possible routes to send the packet and then select one of them to forward the packet. Routes in the routing table can be sorted to three categories according to their sources: 1. Routes found by data-link layer protocols (interface routes or direct routes) 2. Static routes manually configured by network s. 3. Routes found by dynamic routing protocols.

M

Page208

o s Re

: s e

h

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

The protocol field in the routing table indicates the source of the routes. Routes come from three sources. The first source is those routes discovered by the data-link layer. When data-link layer protocols are up, routes of this sort are generated and their protocol field value in the routing table is shown as “direct”. Routes discovered by the data-link layer do not need maintenance, which reduces the workload. However, data-link layer can only find routes to segments directly connected with its interfaces and can not discover routes that cross segments. Routes that cross segments can only be discovered by other methods.

c r u

g n i

: s e

h

o s Re

n r a

e r o

Le

M

Page209

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

The second source is the statically configured routes. Static routes are configured by s manually and they can also help to build connectivity between networks. Static routes however cannot make adjustments automatically when networks fail. They must be managed by s.

c r u

g n i

n r a

e r o

Le

M

Page210

o s Re

: s e

h

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

The last group of routes are discovered by dynamic routing protocols. Configuring routes statically for a network with a complicated topology is a demanding task and may result in errors easily. So it is better to use dynamic routing protocols to find and change routes, which does not need manual maintenance. However, the cost of dynamic routing protocols is. As the figure above shows, routes whose Proto field values are RIP and OSPF are routes discovered by RIP dynamic routing protocol or OSPF routing protocol. Details about dynamic routing protocols will be given later.

c r u

g n i

: s e

h

o s Re

n r a

e r o

Le

M

Page211

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

As we mentioned just now, routes come from three sources. Here, we make a comparison between static routes and dynamic routes.

: s e

h

1. Static routes must be defined by s. When the network topology changes, s have to change the configurations of static routes

c r u

o s Re

manually. Static routes are more suitable for simple and small networks. If the network is complicated, s may struggle to the complexity and work needed to manage numerous static routes.

g n i

2.nRouting protocols collect network information for dynamic r a routes. When the network topology changes, routers update their

e r o

Le

information automatically without the help of s.

M

Page212

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

Routing protocol is a language that works for the communication between routers. With the routing protocol, routers can share information about routes and network status. Only routers that use the same language can communicate with each other. Routers that do not speak the same language may obtain information from each other with other approaches, but it will not be discussed here. Routing protocols set down a set of rules for the communication between routers.

c r u

: s e

h

o s Remaintain their routing tables and offer the And routers g through routing protocols. best routes n i n ar

e r o

Le

M

Page213

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

An AS is a set of networks under unified management. According to their working area, routing protocols can be divided into:

h

1. Interior Gateway Protocol (IGP): a protocol for exchanging routing information between gateways within an autonomous network. The protocols we introduce here like RIP and OSPF are IGP protocols. Other IGP protocols that are not mentioned here include ISIS, IGRP and EIGRP.

c r u

: s e

o s e Protocol (EGP): a protocol for exchanging 2. Exterior R Gateway routing information between two autonomous systems. The gGateway Protocol (BGP) is a kind of EGP. Border n i n ar

e r o

Le

M

Page214

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

According to the algorithms used, routing protocols can be divided into the following categories:

h

Distance-Vector routing protocol: RIP and BGP. BGP is also called the Path -Vector Protocol.

: s e

c r u the algorithms used by the DistanceThe differences between o Vector routings protocols and the Link-State protocols lie in the e way they find and R calculate routes. Distance-Vector routing protocols concern is to the number of the hops to the destination, g n while Link-State protocols care more about the network topology ibandwidth n and resources used to reach a given destination. r a Link-State Protocol: OSPF and IS-IS.

e r o

Le

M

Page215

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

Routing protocols can be divided into unicast routing protocols and multicast routing protocols according to their applications. Unicast is one of the data transmission modes. In this mode, the destination of a datagram is unique, which can be a host or a device. Multicast is another data transmission mode. In this mode, the destination address is a multicast address, which means a group of hosts or devices can receive a datagram at the same time. Here, we only focus on unicast routing protocols. For details about multicast routing protocols, see references for multicast modules.

c r u

g n i

n r a

e r o

Le

M

Page216

o s Re

: s e

h

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

Routing tables play a key role in packet forwarding. Each router holds a routing table and every entry in the routing table tells a packet should be sent through which physical port of a router to reach a subnet or a host before the packet arrives at the next hop router or its destination.

c r u

: s e

h

A routing table contains the following items:

o s Re

Destination: indicates the destination or the destination network of an IP packet.

g n i

Mask: We have already learned the structure and functions of mask in our T/IP course. Similarly, network masks are important information in a routing table. If we let an IP address and a network mask go through a logical AND operation, we can get information about the network segment. As the example here, the destination address is 8.0.0.0 and the mask is 255.0.0.0. After they go through the logical AND, we may know that the segment is 8.0.0.0/8 which is a Class A address.

n r a

M

e r o

Le

Another function of network masks is that when there are multiple route entries to the same destination in a routing table, the router can choose the route with the longest mask.

Page217

Interface: indicates which interface an IP packet should be forwarded from. Nexthop: indicates the IP address of the next interface that an IP packet will go through. Other fields in the routing table will be discussed later.

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

c r u

g n i

n r a

e r o

Le

M

Page218

o s Re

: s e

h

: p tt

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

Routes to the same destination may come from different sources. So the next hop of those routes may be the same or different. In this case, how routers make their choice about those routes? Route preference is here for this problem.

h

: s e are two routes to the segment 10.0.0.0: In the figure above, there c r R0 and R1. R0 is discovered by RIP protocol and R1 is u discovered by OSPF o protocol. By default, OSPF has a higher s route preference level than that of RIP . So routers use the route e R discovered by OSPF on this occasion and add it to the global gtable for packet forwarding. routing n i n ar

e r o

Le

M

Page219

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

The default route preference on VRP platform is shown in the above table. Preference 0 is for direct routes and 255 is for untrustworthy routes. Except direct routes, the preference of all dynamic routing protocols can be configured manually according to the requirements of our customers. And you should note that usually a preference is for all routes of the protocol with that preference. For example, routes discovered by IS-IS have the same preference 15. The static route is an exception because each static route may have its own preference.

c r u

g n i

n r a

e r o

Le

M

Page220

o s Re

: s e

h

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

The route metric reflects the cost of a route to its destination. Route metrics are often decided by factors including the delay, bandwidth, line occupation rate, line reliability, hops and the maximum transmission unit. Different dynamic routing protocols choose different factors to calculate a route cost. For example, RIP uses hops to calculate the route metric. Route metrics make sense only for routes discovered by the same routing protocol. It is meaningless to compare route metrics calculated by different protocols and there is no formula to make conversions between route metrics come from different routing protocols. The route metric of the static route is 0.

c r u

g n i

: s e

h

o s Re

n Router A learns routes to Router D from Router B and Router E r a

M

e r o

Le

with the same protocol. As the figure above illustrates, the route metric of the route that Router A gets from Router B is 9. While the route metric of the route that Router A gets from Router E is 12. Obviously, the route that Router A gets from Router B is better than the route Router A learns from Router E. So Router A adds the first route to its routing table. Router B is the next hop for that route.

Page221

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

If there are multiple routes to the same destination and their route metrics and route preference are the same, all these routes will be added to the routing table. IP packets are sent on these routes alternatively, which helps to realize the load balancing.

h

: s e that load balancing are RIP, At present, routing protocols c r The static route also s load OSPF, BGP and IS-IS. u balancing. o s Re g n i n ar

e r o

Le

M

Page222

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

In the routing table above, there are three routes to the network 10.1.1.1/32. The three routes have the same preference and the preference is the highest preference. So all the three routes are added to the routing table to balance the load.

c r u

g n i

: s e

h

o s Re

n r a

e r o

Le

M

Page223

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

Data packets are forwarded according to the IP addresses of their destinations. When a packet reaches a router, the router first gets to know the IP address of the destination of the packet and then looks up its routing table to make the logical AND operation for the IP address and the mask in the table. If the result of the logical AND operation agrees with the destination IP address of the entry in the table, it means the entry is the route to the destination of the IP packet; Otherwise, it is not. When all the entries that meet the requirement are found, the router will choose the one with the longest mask among them.

c r u

g n i

n r a

e r o

Le

M

Page224

o s Re

: s e

h

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

Imagine that a packet whose destination IP address is 9.1.2.1 reaches the router. The router looks up its routing table and finds three matching routes there. They are:

: s e

h

0.0.0.0/0 whose matching length is 0 bit.

c r 9.1.0.0/16 whose u matching length is 16 bits. o shas the longest mask length. So the router will The last route e choose thisRone to forward the packet through serial 0/0. g n i n ar 9.0.0.0/8 whose matching length is 8 bits.

e r o

Le

M

Page225

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

Routing loop is a network problem in which packets are sent from one router and return back to the router after travelling in the network for a while. When the routing loop problem occurs, packets travel around several routers until they are discarded when TTL is 0, which wastes the network resource quite a lot. Steps should taken to keep routing loops at bay.

c r u

: s e

h

o s Re

As the figure above shows, RTA has a packet heading for network N. The packet is forwarded to RTC and the value of TTL is decremented by one. When RTC receives the packet, it forwards it to RTB which leads to a routing loop occurrence, at which point the TTL value again decrements by one. RTC receives the packet and forwards it to RTA and then RTA sends the packet again to RTC. This process continues until the packet is discarded once the TTL value is reduced to 0. The routing loop is very harmful to the network and care should taken to avoid it’s occurrence.

g n i

n r a

M

e r o

Le

The possible causes for a routing loop may be: 1. A temporary loop occurs when the network converges. 2. Algorithm defect.

Page226

3. Information that can prevent routing loops is lost when routes are imported to different routing domains. 4. Configuration mistakes.

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

c r u

g n i

: s e

: p tt

h

o s Re

n r a

e r o

Le

M

Page227

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

c r u

g n i

n r a

M

e r o

Le

: p tt

1. What are the sources of routes, and what are their characteristics? Routes come from three sources: direct routes discovered by the Data-Link layer; manually configured static routes; routes discovered by dynamic routing protocols. Routes found by the Data-Link layer do not need maintenance and they are discovered automatically when protocols at Data-Link layer are up. The disadvantage of this source is that it can only find routes to the directly connected segments and routes to other segments cannot be discovered. Manually configured static routes need maintenance and they cannot be modified automatically when the network topology changes. Dynamic routing protocols can discover and modify routes automatically without human interference but the cost of these protocols is huge and the configuration process is rather complicated. 2. What are the classifications for dynamic routing protocols? Dynamic routing protocols can be grouped into the IGP and EGP protocols according to their working areas and Distance-Vector and Link-State protocols according to their algorithms and unicast routing protocols and multicast routing protocols according to their applications.

Page228

o s Re

: s e

h

3. What are the values that can be found in a routing table? The routing table includes factors like destination, mask, protocol, preference, metric, nexthop and interface. The equal cost multipath refers to routes that head for the same destination with the same metric. When these routes have the same preference, they are all added to the routing table and IP packets are sent on them alternatively. 4. What does equal cost multi-path mean? Equal cost multi-path refers to two or more routes to a single destination from a single source, that are capable of ing load balancing due to the fact that both routes a metric that is considered equal to the routing protocol being used. Should the protocol be RIP, the number of hops to a given destination should be equal. Alternatively if the protocol happened to be OSPF, the distance between the source and the destination over the two routes must reflect an equal cost, based on the link type e.g Serial/Ethernet and ed bandwidth of the such links in accordance with OSPF cost values.

e w ua

m o c . i

h . ng

i n ar

e l //

c r u

g n i

: s e

: p tt

h

o s Re

n r a

e r o

Le

M

Page229

n e /

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

c r u

g n i

n r a

e r o

Le

M

Page230

o s Re

: s e

h

: p tt

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

c r u

g n i

: s e

: p tt

h

o s Re

n r a

e r o

Le

M

Page231

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

c r u

g n i

n r a

e r o

Le

M

Page232

o s Re

: s e

h

: p tt

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

A static route is a special route that is configured by a network manually. The disadvantage of static routes is that they cannot adapt to the change in a network automatically, so network changes require manual reconfiguration. Static routes are fit for networks with comparatively simple structures. It is not advisable to configure and maintain static routes for a network with a complex structure.

c r u

g n i

: s e

h

o s Re

n r a

e r o

Le

M

Page233

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

c r u

g n i

n r a

M

e r o

Le

: p tt

The command for configuring the static route is: [Huawei]ip route-static [ <mask> | <masklen> ] | [ preference <preference_value> ] [ reject | blackhole ] The meaning of the parameters in the command are as follows: (1) [<mask>|<masklen>]:the IP address and mask of the Destination The IP address should take the form of dotted decimal notation; the mask can be in the form of a dotted decimal or be represented by the mask length (the number of the bits set as “1” in the mask). (2) | : the name of the sending interface or the address of the next hop When configuring static routes, you can define an interface name or the address of the next hop. To define the interface name or the next hop address should be decided by the real situation. Actually, for every route entry, there must be a next hop address. When sending the packets, the routers looks up the routing table for a route that matches with the address of the destination of the packet. Only when the next hop address is specified, the datalink layer can find the corresponding data-link address to forward the packet.

Page234

o s Re

: s e

h

(3) <preference_value>: preference value A flexible management technique on routes can be realized by configuring the preference value differently. If you assign multiple routes to the same destination with the same preference value, load balancing can be achieved; otherwise, route backup is made. You can input preference values more than once in a command but only the last one is valid. (4) Others The attributes “reject” and “blackhole” refer to an inaccessible route and a blackhole route respectively. If one static route is labeled with the “reject” attribute, all the packets sent to the destination of the route will be discarded and an ICMP packet will be sent to notify the source that the destination is unreachable. When a static route is assigned the attribute “blackhole”, any packet heading for the destination of the static route will be abandoned and in this case, no ICMP packet will be sent to notify the source. In the example above, the two routers to the loopback segment of RTA on RTB. The command for configuring the route can be in one of the three forms below:are connected by serial ports and we can configure a static route destined [RTB] ip route-static 10.1.1.1 255.255.255.255 1.1.1.1 [RTB] ip route-static 10.1.1.1 32 1.1.1.1 [RTB] ip route-static 10.1.1.1 32 Serial 0 In the first form, the mask is represented by a dotted decimal number. In the second form, the mask is shown by its length. In the last form, gateway address is taken place by the interface name.

e w ua

m o c . i

h . ng

i n ar

e l //

c r u

g n i

: s e

: p tt

h

o s Re

n r a

e r o

Le

M

Page235

n e /

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

You can query the routing table by running display ip routingtable command after the static route is configured. The static route is displayed in the routing table as highlighted in red here.

c r u

g n i

n r a

e r o

Le

M

Page236

o s Re

: s e

h

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

Load balancing: Packets are sent through several links alternately when there are multiple paths to the destination of those packets with the same cost. Static routes load balancing.

h

: s e three routes are configured to the As shown in the figurecabove, r 10.1.1.1/32, on RTB. The three static same destination, network u routes have the o same preference value with the default value 60 s and there are no routes heading for this network with higher e R preference value than these three routes. In this case, these g are equal routes which can share the load, and threenroutes i will be sent through the three routes alternately. packets n ar

e r o

Le

M

Page237

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

Looking up the routing table, you can see there are three routes destined to the network 10.1.1.1/32 which will share the load over each ECMP ed link.

c r u

g n i

n r a

e r o

Le

M

Page238

o s Re

: s e

h

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

Route backup: Multiple routes heading for the same destination are configured, amongst which there is one with a higher preference value that acts as the main route. Other equal cost routes with lower preference values become backup routes.

h

: s e two static routes are configured, As the above figure shows, c r 10.1.1.1/32 on RTB. One of the routes destined for the network u has the preference of the default value 60 while the other so value with static route iseconfigured a less preferred preference value R of 100. g n i n ar

e r o

Le

M

Page239

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

By looking up the routing table, you may find that there is only one route heading for the network 10.1.1.1/32 which acts as the main route. The route with the preference value of 100 has not been added to the routing table. It will be added to the routing table only after the route with the preference value of 60 becomes invalid.

c r u

g n i

n r a

e r o

Le

M

Page240

o s Re

: s e

h

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

After running the display ip routing-table protocol static command, you can see the route whose preference value is 60 is active, which means it is the main route to forward packets to the network 10.1.1.1/32.

h

: s e value is 100 is inactive and acts as The route whose preference c the backup route. It r will not be added to the routing table or used u for forwarding packets o until the route with a preference of 60 is s no longer available, or the preference of this route is changed to e R a value lower than the currently preferred route. g Note:nThe routing table here is a global routing table. idisplay ip routing-table can only list the active routes n arat present.

M

e r o

Le

display ip routing-table protocol static can list all the static routes, including the active routes and the inactive routes.

Page241

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

A look up of the routing table after disabling a port for the active route with the shutdown command will result in the backup route becoming the active route, and being added to the routing table to forward packets in place of the lost route.

c r u

g n i

n r a

e r o

Le

M

Page242

o s Re

: s e

h

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

The default route is one kind of special route. Usually, default routes are configured by s manually but they can also be generated by routing protocols such as OSPF and IS-IS. When a router receives a packet whose destination is not listed in the routing table, the router will forward the packet to the next hop defined by the default route. You can run the display ip routing-table command to see if a default route is configured. A packet will be forwarded to the default route if its destination does not match any destinations of the routes in the routing table. If there is no default route either, then the packet will be discarded and an ICMP message notifying the source that the destination or the network is inaccessible will be sent.

c r u

g n i

: s e

h

o s Re

n r a

e r o

Le

M

Page243

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

A default route is configured by setting the destination address and the mask to be 0s (0.0.0.0 0.0.0.0) when you run the ip route-static command to configure a static route.

c r u

g n i

n r a

e r o

Le

M

Page244

o s Re

: s e

h

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

In the routing table, you may see the destination address of the default route is set to be 0.0.0.0 and the mask length is 0.

c r u

g n i

: s e

h

o s Re

n r a

e r o

Le

M

Page245

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

The default route s both the load balancing and route backup mechanisms. If multiple default routes are configured with the same preference value, they will share the load together. If they have different preference values, the one with the highest route acts as the main route and others are backup routes.

c r u

: s e

h

As the above table shows, the two static routes highlighted in red share the load for each other after they are configured with the same preference value of the default value of 60.

g n i

n r a

e r o

Le

M

Page246

o s Re

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

What are the differences between load balancing and route backup for static routes?

h

Load balancing: Packets are sent through several links alternately when there are multiple paths to the destination of those packets with the same metric.

c r u

: s e

Route backup: If there are multiple routes heading for the same destination, one of them which having the highest preference value will act as the main route, and the others with lower preference value will act as the backup routes. The backup routes will be in use only after the main route becomes invalid.

g n i

o s Re

n is a default route? What r a The default route is a kind of the special route used for last resort

M

e r o

Le

forwarding. Usually, default routes are configured by s manually but they can also be generated by routing protocols such as OSPF and IS-IS. A default route is the route whose network address and mask are both 0s in the routing table.

Page247

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

c r u

g n i

n r a

e r o

Le

M

Page248

o s Re

: s e

h

: p tt

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

c r u

g n i

: s e

: p tt

h

o s Re

n r a

e r o

Le

M

Page249

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

c r u

g n i

n r a

e r o

Le

M

Page250

o s Re

: s e

h

: p tt

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

Routing protocols are like languages that build bridges between routers for information exchange. Information like the network status and its accessibility range is shared among routers with the help of those routing protocols.

h

: s e are not only responsible for selecting Dynamic routing protocols c routes, they are alsorcapable of finding another best route to the u destination whenothe original one is not available. This feature of s is especially noteworthy when a network dynamic routing e R which makes it the advantage of dynamic topology changes gprotocol over static routing protocol. routing n icommon routing protocols in use at present are RIP, OSPF, The n arISIS and BGP. RIP is famous for its simplicity of configuration

M

e r o

Le

and deployment and it is designed for exchanging routing information within a small to medium-size network as it converges slowly.

Developed by IETF, OSPF is a complicated but widely used protocol. ISIS is a routing protocol based on a simple design with good extendibility and is extensively applied to large scale SP networks. BGP is used for communicating route information between AS’. Page251

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

At present, the common dynamic routing protocols include RIP, OSPF, ISIS, BGP routing protocols. RIP routing protocol configuration is simple, but the convergence rate is slow, and RIP is commonly used in small and medium-sized networks. OSPF protocol developed by the IETF, the protocol principle of OSPF is more complex, and it is widely used; the ISIS design idea is simple, and it has good scalability, presenting in large SP network configuration.

c r u

: s e

h

o s e The BGP isRused to exchange routing information between AS’. g n i n ar

e r o

Le

M

Page252

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

A traditional definition for autonomous system (AS) is a collection of IP networks and routers under the control of one entity that presents a common routing policy to the Internet. Now, the definition of AS has developed into a collection of networks and routers that are managed by multiple entities and adhere to several routing policies.

c r u

: s e

h

o s Re

AS numbers are assigned by the IANA and each AS is allocated with a unique number to differentiate from another. AS number ranges from 1 to 65535 and are divided into two ranges. The first are public AS numbers, which may be used on the Internet and range from 1 to 64511. AS number in the second range, from 64512 to 65534, are known as private numbers, and can only be used internally within an organization.

g n i

n r a

e r o

Le

M

Page253

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

Routing protocols can be divided into IGP and EGP according to their working area.

h

IGP（Interior gateway protocols）

: s e

A set of routing protocols that are used within an autonomous system, such as RIP and IS-IS. IGP is mainly used to search and calculate routes within an autonomous

c r u

o s Re gateway protocols）is used to connect EGP（Exterior g autonomous systems. An EGP, such as BGP, controls different n communication of route information between i n arautonomous systems with routing policies and route filtering system.

e r o

Le

mechanisms.

M

Page254

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

Routing protocols can be divided into Distance-vector protocols and Link-state protocols. RIP and BGP are examples of Distance-vector protocols and OSPF and IS-IS fall in the group of Link-state protocols. BGP is also called Path-vector protocol.

h

: s e Protocol Distance-vector Routing c r algorithm to calculate paths. In They use the Bellman-Ford u orouting protocols, each router sends complete Distance-vector s eto their neighboring routers at fixed intervals. It is routing tables R the metric which means the distance between the router and the g network and the vector which indicates the interface destination n i which data is forwarded that routers in a Distance-vector from n arrouting protocol network really care about .

M

e r o

Le

Advantages of Distance-vector protocol:

They are easy to configure and take up comparatively few resources of memory and U. Disadvantages of Distance-vector protocol: Poor extendibility, for example, the maximum hops of RIP is limited to 16.

Page255

Link-state Routing Protocol They are based on the Dijkstra algorithm which is sometimes called the Shortest Path First (SPF) algorithm. This algorithm pays attention to the state of links or interfaces in the network, including whether they are up or down, their IP addresses and masks. Routers information about link states they know to other routers in the area through which each router in the area builds up a complete link state database for the area. Then every router draws its own topology map based on the information it collected in the form of a graph showing which nodes are connected to which other nodes.

e w The primary advantage of link-state routing is that it reacts more a quickly, and in a bounded amount of time, to connectivity hu changes. Routers send update information only when the . link g state changes which saves the bandwidth of the links between n i routers. Some of the update information only covers the n r information about the changes of link state instead a of the whole e routing table. l / / : p t ht : s e c r u o s Re g n i n ar

m o c . i

e r o

Le

M

Page256

n e /

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

In some occasions, route information should be shared among different routing protocols. For example, route information obtained from RIP may possibly needs to be imported to OSPF. The process of exchanging route information between protocols is called route importation. This process could be a one-way street as we see in the example of import information from RIP to OSPF. And it could also be a two-way process as RIP and OSPF can learn route information from each other.

c r u

: s e

h

o s e The cost ofReach protocol can not be compared and there are no gto convert the cost of one protocol to another's. So we formula n i set the Metric again ( some protocols can use the default must n arvalue set by the system) when we import route information from

e r o

Le

one protocol to another. Improper importation may impose burdens on routers or lead to loops, so we must be careful with it.

M

Page257

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p t should be able to find the t (1) Correctness: The routing protocol h optimal route without self-loop correctly. :routing protocol can respond to a new s (2) Fast convergence: The e network topology quickly. c r (3) Low cost: The u cost (memory, U, network bandwidth) of the oitself is minimum. s routing protocol Re The routing protocol is resistent to attack and (4) High security: provideghigh security. n adaptability: The routing protocol can be easily applied i (5) High nnetworks of different topologies and scales. r to a What makes a good dynamic routing protocol?

e r o

Le

M

Page258

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p t t They are RIP, OSPF, ISIS and BGP. h Dynamic routing protocols : can be divided into which domain s classifications? e cbe grouped into two distinct classifications, Routing protocols can r u or inter AS based, better known as of either intra-AS based o s Protocol (IGP) and Exterior Gateway Protocol Interior Gateway e (EGP). R g What classifications of dynamic routing protocols are there? n i OSPF, ISIS fall in the first group and BGP belongs to RIPv1/v2, n arthe second. According to the algorithm, routing protocols can be What are the common dynamic routing protocols used?

M

e r o

Le

categorized into Distance vector routing protocols and Link-state routing protocols. RIPv1/RIPv2 and BGP are all Distance-vector protocols and OSPF and ISIS are Link-state routing protocols.

Page259

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

c r u

g n i

n r a

e r o

Le

M

Page260

o s Re

: s e

h

: p tt

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

c r u

g n i

: s e

: p tt

h

o s Re

n r a

e r o

Le

M

Page261

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

c r u

g n i

n r a

e r o

Le

M

Page262

o s Re

: s e

h

: p tt

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

The distance-vector (D-V) routing protocol is based on the Bellman-ford algorithm. A router using the D-V algorithm sends the entire routing table to adjacent routers.

: s e

h

The adjacent routers compare the received routing table with their own routing tables. If the received route is new, it will be added to the routing tables directly. If the received route had the same destination as the existing route, the router will compare the metric of these routes, and will add the one whose metric is smaller to the routing table. The adjacent routers then broadcast their routing tables (with the new routes) to their adjacent routers. The distance-vector routing protocol s routing information in the format of (Distance, Direction). Distance indicates the metric, and Direction indicates the next hop. The advantage of the distance-vector routing protocol: The configuration is simple, so less memory is used and shorter U processing time is needed.

c r u

g n i

o s Re

n r a

M

e r o

Le

Disadvantage: The expandability is poor. For example, the maximum hop count in RIP cannot exceed 16.

Page263

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

When a router starts (on t0), it generates an entry for each directly-connected network segment. The router is directly connected to the network segment, so the hop count is 0 and the next hop router is represented as "– –" in the entry. The router then broadcasts the routing information to all links.

c r u

g n i

n r a

e r o

Le

M

Page264

o s Re

: s e

h

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

On t1, routers receive and process the first update message. RTA receives the update message from RTB and finds that RTB has a route to 10.1.3.0 with 0 hops. This route is not contained in the routing table of RTA, so RTA adds this route to its routing table and increases the hop count by 1. Thus RTA learns the route to 10.1.3.0 from the update message sent by RTB. Similarly, RTB learns the route to 10.1.1.0 from the update message sent by RTA and learns the route to 10.1.4.0 from the update message sent by RTC. RTC learns the route to 10.1.2.0 from the update message sent by RTB.

c r u

g n i

: s e

h

o s Re

n r a

e r o

Le

M

Page265

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

On t2, the update period begins and new update packets are broadcasted. RTA learns the route to 10.1.4.0 from RTB. RTC learns the route to 10.1.1.0 from RTB. Through the periodical update mechanism, each router obtains routes to all network segments. Finally, the network converges.

c r u

g n i

n r a

e r o

Le

M

Page266

o s Re

: s e

h

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

The D-V algorithm requires that each router sends it’s routing table to adjacent routers. When receiving the route update message, the router compares the new routing information with the original routing information in its routing table. The router then modifies the local routing table according to the comparison to keep pace with the change of network.

c r u

: s e

h

The principles of updating the routing table are: 1. Adding new routes.

o s Re

As shown in the figure, RTB receives the route update message from RTA. If a route entry of RTA, for example, the route to 10.1.1.0 does not exist in the routing table of RTB, RTB will adds this entry to its own routing table. In the routing table of RTB, the destination network of this route is 10.1.1.0; the metric (hop count) is the metric of this entry for RTA plus 1; the next hop address is the IP address of RTA's interface connected to RTB, namely, 10.1.2.1.

g n i

n r a

e r o

Le

M

Page267

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tfrom RTA and finds that the RTB receives the update message t h metric to a network in the routing table of RTA is less than the : minus 1. For example, to the same metric in its own routing table s e in routing table of RTB needs 5 hops, network 10.0.1.0, the c route r table of RTA needs 2 hop. 5-1>2, which while the route in routing u indicates that the ometric is less if the packet es through RTA. s Therefore, RTB changes the route entry in its routing table. The e R next hop is changed to the IP address of the interface on RTA. g packets will be forwarded to the destination network Subsequent n i The route metric is the route metric of RTA plus 1. by RTA. n ar 2. Changing the next hop address and metric.

e r o

Le

M

Page268

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p t As shown in the figure, the next t hop to network segment for RTB h is RTA. The update message from RTA shows that the metric to : has changed. At this time, the the destination network segment s ein the routing table of RTB changes to metric of this route entry c r plus 1. That is, the original metric 2 the new metric of RTA u changes to 4+1=5. o s Re g n i n ar 3. Changing the metric (hop count) only .

e r o

Le

M

Page269

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p t to the destination network is In RTB's routing table, the next hop t h RTA, but routing table of RTA does not contain the route to this : deletes this route entry from the network any more. Then s RTB e entry in the figure as example. In routing table. Take thec10.0.3.0 r the next hop is RTA. However, the the routing table of RTB, u update messageosent by RTA does not contain this entry. It s cannot reach 10.0.3.0 through RTA, so indicates thatepackets RTB needsRto delete this entry from its routing table. g n i n ar 4. Deleting unreachable routes.

e r o

Le

M

Page270

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

When a network fault occurs, network convergence may slow down because the routes in the routing table may be inconsistent with routes in the actual network topology. In this case, routing loop may be generated. This figure provides a simple network structure to show how a route loop is generated. Before a fault occurs to network 11.4.0.0, all routers have correct and consistent routing tables and the network is converged. In this example, route metric is represented by hop count, so the metric of each link is 1. Router C is directly connected to network 11.4.0.0, so the hop count is 0. Router B is connected to network 11.4.0.0 through Router C, so the hop count is 1. Router A is connected to network 11.4.0.0 through Router B and Router C, so the hop count is 2. When a fault occurs to network 11.4.0.0, route loop may be generated. The process is as follows:

c r u

g n i

: s e

h

o s Re

n r a

M

e r o

Le

1.When a fault occurs to network 11.4.0.0, Router C receives the information about the fault first. Router C then regards 11.4.0.0 as unreachable, and waits till the update period begins to the route change to the adjacent router. If the update period of Router B begins earlier than the update period of Router C, Router C will learn a new route to 11.4.0.0 from Router B. Actually, the learnt route is incorrect. Page271

Thus, the routing table of Router C records an incorrect route. (The next hop is Router B; the destination is 11.4.0.0; the hop count is increases to 2.) 2. After leaning a wrong route, Router C s this route to Router B. Route B also records a wrong route to 11.4.0.0, of which the next hop is Router C and the hop count is increases to 3. Router B considers that network 11.4.0.0 is reachable through Router C, and Router C considers that network 11.4.0.0 is reachable through Router B. Thus, a loop is generated.

e w ua

m o c . i

h . ng

i n ar

e l //

c r u

g n i

n r a

e r o

Le

M

Page272

o s Re

: s e

h

: p tt

n e /

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

When a route loop occurs, the count of hops to network 11.4.0.0 keeps increasing, and the network cannot converge. To avoid this problem, the RIP protocol limits the maximum hop count to 16. In the figure, when the hop count reaches 16, network 11.4.0.0 is considered unreachable. The router marks this route unreachable in the routing table and does not update the route to 11.4.0.0 any more. By defining the maximum hop count, the distance-vector routing protocol prevents the route metric from increasing infinitely when route loop occurs. In addition, incorrect route information is corrected. However, routing loop still exists before the hop count reaches the maximum value. That is to say, this solution is only a remedial measure but it cannot avoid route loops. This solution can only mitigate the damage caused by route loop. Therefore, designers of routing protocols provide other solutions to reduce the probability generating the route loops, for example, split horizon and triggered update.

c r u

g n i

: s e

h

o s Re

n r a

M

e r o

Le

Page273

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

c r u

g n i

n r a

M

e r o

Le

: p tt

Split horizon is a common solution among distance-vector routing protocols to avoid routing loops. One cause of routing loops is due to a router learning the route from its neighbor, and then advertising this route to the same neighbor who d this route to it. With split horizon, a router does not send the routing information to the neighbor from whom the routing information is sent. As shown in the figure: 1.Router C s the route to network 11.4.0.0 to Router B. Router B then s this routing information to Router A. At the same time, Router B also sends this routing information to Router C. If network 11.4.0.0 works normally, Router C does not accept the route to 11.4.0.0 d by Router B, because Router C has a route with smaller metric to 11.4.0.0. 2. If route from Router C to 11.4.0.0 becomes unreachable, Router C accepts the route to 11.4.0.0 d by Router B, although it is an incorrect route now. (Since the route from Router C to 11.4.0.0 is unreachable, the route learned by Router B from Router C is incorrect.) However, Router C does not know that the route is incorrect. Router B considers that 11.4.0.0 is reachable through Router C, and Router C considers that 11.4.0.0 is reachable through Router B. Thus, the routing loop generates.

Page274

o s Re

: s e

h

3. Split horizon solves this problem. Split horizon forbids a router to return the routing information to the interface from which the routing information arrived. In the figure, Router B learns the route to 11.4.0.0 from Router C. Split horizon forbids Router B to this route to Router C again. This avoids routing loops to some extent.

m o c . i

n e /

e w ua

h . ng

i n ar

e l //

c r u

g n i

: s e

: p tt

h

o s Re

n r a

e r o

Le

M

Page275

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

Route poisoning is a supplement to split horizon. Route poisoning can prevent routing loops to some extent and can suppress network flapping caused by interface resetting. When a fault occurs in the network or an interface is reset, route poisoning suppresses the related route and starts a hold-down timer. Within the hold-down time, the router does not update the routing table. In this way, the routing loop is avoided and network flapping is suppressed.

c r u

: s e

h

o s Rethe figure: As shown in g Whenna fault occurs in network 11.4.0.0, Router C sets the metric i route to this network to 16 (unreachable) in its routing table, ofnthe arand thus this route is suppressed. Router C does not accept the

M

e r o

Le

update message of the route to 11.4.0.0 from the adjacent router. After Router B receives the ment from Router C, indicating that the route metric to 11.4.0.0 is infinite, Router B sends a poison reverse update message to Router C. The update message indicates that 11.4.0.0 is unreachable. The update message violates the principle of split horizon, but it is used to confirm that all routers on this network segment know that the route is suppressed.

Page276

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

Route poisoning can avoid routing loops to some extent and can suppress network flapping caused by interface resetting. When a fault occurs in the network or an interface is reset, route poisoning suppresses the related route and starts a hold-down timer. Within the hold-down time, the router does not update the routing table. In this way, the routing loop is avoided and network flapping is suppressed.

c r u

: s e

h

o s Re

As shown in the figure:

g n i

1. When a fault occurs in network 11.4.0.0, Router C suppresses the related route entry in the routing table, that is, it sets the metric of the route to this network to 16 or unreachable. At the same time, Router C starts a hold-down timer. Within the holddown time, if Router C receives a route reachable message from the same neighbor (or the same direction), it marks the network as reachable and stops the hold-down timer.

n r a

M

e r o

Le

2. If Router C receives an update message from other neighbors, advertising the route with higher weight, Router C updates the routing table by selecting the new route. At the same time, Router C stops the hold-down timer.

Page277

3. Within the hold-down time, if Router C receives a route reachable update message, but the weight of the new route is lower, Router C will not accept the new route. After the holddown timer expires, if Router C receives this update message again, it will update the routing table.

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

c r u

g n i

n r a

e r o

Le

M

Page278

o s Re

: s e

h

: p tt

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

As shown in the figure, when network 11.4.0.0 becomes unreachable, Router C obtains this information first. Generally, route update messages are sent to adjacent routers periodically. For example, RIP specifies that a router sends route update messages every 30 seconds. However, if the update message sent by Router B reaches Router C before the update period of Router C begins, Router C will learns the wrong route to 11.4.0.0. Thus the routing loop generates. If Router C sends the update message immediately, instead of waiting for the update period, this problem will be avoided. This mechanism is call triggered update. Triggered update means that a router sends a triggered update message to adjacent routers immediately after the routing information changes. When a router detects that the network topology changes, it immediately sends the triggered update message to adjacent router. All other routers also send the triggered update messages immediately, and thus the triggered update messages spread in the entire network. In the figure, Router C immediately sends an update message to that network 11.4.0.0 is unreachable. After Router B receives this message, it sends the network unreachable message from interface S0. Router A then s this message from interface E0.

c r u

g n i

: s e

h

o s Re

n r a

M

e r o

Le

Page279

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

Triggered update avoids the route loop to some extent, but it still cannot avoid the following problems:

h

1. The packet containing the update message may be discarded or damaged.

c r u

: s e

2. If a router receives the periodically sent update message from the adjacent router before receiving the triggered update messages, the router will learn the wrong routing information.

o s e The aboveRproblems can be solved when triggered update is combined with the hold-down timers. Within the hold-down timers, g n thei router does not update the route to the destination network n which becomes unreachable. Therefore, combining triggered r a updates with the hold-down timers ensures that the triggered

M

e r o

Le

update message has enough time to be transmitted in the network. As shown in the figure, when Route C detects that network 11.4.0.0 is disconnected, it deletes the route to this network immediately. Then Router C sends a triggered update message to Router B. Router C sets the route metric to 11.4.0.0 to infinite (16) to suppress this route. After receiving the triggered update message,

Page280

Router B starts the hold-down timer and marks the network as "may be disconnected." At the same time, Router B sends a reverse update message to Router C, then sends a triggered update message to Router A to that network 11.4.0.0 is unreachable. Router A then suppresses the route to 11.4.0.0 and sends a reverse update message to Router B.

m o c . i

n e /

e w ua

h . ng

i n ar

e l //

c r u

g n i

: s e

: p tt

h

o s Re

n r a

e r o

Le

M

Page281

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tis an algorithm based on A distance-vector routing protocol t h distance and vector. The distance-vector routing protocol is also : or Ford-Fulkerson algorithm. called Bellman-ford algorithm s ea route is d in the format of Based on this protocol, c r count) and vector (direction, outgoing distance (metric, hop u interface). Everyorouter periodically sends its routing table to s routers. directly connected e R What are the methods used to prevent routing loop? ng for avoiding routing loops are: split horizon, route Theimethods n poisoning, hold-down timers, and triggered updates. r a What is distance-vector routing protocol?

e r o

Le

M

Page282

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

c r u

g n i

: s e

: p tt

h

o s Re

n r a

e r o

Le

M

Page283

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

c r u

g n i

n r a

e r o

Le

M

Page284

o s Re

: s e

h

: p tt

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

c r u

g n i

: s e

: p tt

h

o s Re

n r a

e r o

Le

M

Page285

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

c r u

g n i

n r a

M

e r o

Le

: p tt

The Routing Information Protocol (RIP) is a relatively simple dynamic routing protocol, but it is widely used. RIP is a routing protocol based on the distance vector (D-V) algorithm. RIP exchanges routing information through UDP. Based on RIP, a router sends update messages every 30 seconds. If a router does not receive the update message from the peer router within 180 seconds, the router marks all routes learned from the peer router as unreachable. If the router still does not receive the update message from the peer router in the subsequent 120 seconds, it deletes these routes from the routing table. RIP represents the distance to the destination network by the hop count. In RIP, the hop count between a router and the directly connected network is 0. If the network can be reached through another router, the hop count increases by 1. The hop count increases with the number of routers between the source router and the destination network. In RIP, the metric is an integer ranging from 0 to 15. The hop count equal to or larger than 16 is defined as infinite, that is, the destination network or host is unreachable. RIP is on the upper layer of UDP. Routing information for RIP is encapsulated in the datagram of UDP. RIP uses port 520 to exchange routing information. When a router receives the route update message from the remote router, the router notifies other routers of the changed route. In this way, routes are synchronized on all routers in the network. To improve the routing performance and avoid route loop, RIP s split horizon, poison reverse, and triggered updates. In addition, RIP can import routes learned through other routing protocols.

Page286

o s Re

: s e

h

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

When RIP is enabled, the initial routing table contains only direct routes. After RIP is enabled on a router, the router broadcast Request packets to all directly connected interfaces. When the adjacent router receives the Request packet from an interface, it broadcast Response packet to the network connected to this interface according to its routing table. When the router receives the Response packet from the adjacent router, it generates the routing table according to the Response packet. Based on the characteristics of the D-V algorithm, the devices involved in RIP are classified into active devices and ive devices. The active device actively broadcasts route update packets, and the ive device receives route update packets ively. Generally, a host is a ive device, and a router is both an active device and a ive device. That is, a router not only broadcasts route update packets, but also receives the D-V packets from other active devices and updates the routing table.

c r u

g n i

: s e

h

o s Re

n r a

M

e r o

Le

Page287

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

c r u

g n i

n r a

M

e r o

Le

: p tt

Based on RIP, a router broadcasts its routing table through the Response packets every 30 seconds. After receiving the Response packet from the neighbor, the router calculates the route metric in the packet through RIP. Then the router compares the calculated metric with the metric of the route in the routing table and updates the routing table. The route metric is calculated by the following formula: metric = Min (metric + cost, 16). Here, "metric" is the metric in the packet. Cost is the metric from the neighbor to the network where the packet is received. The default value of cost is 1 (one hop). 16 means that the destination network is unreachable. When the local router receives a route update packet, it updates the routing table based on the following principles: For an existing route entry in the routing table, if the next hop is the adjacent router, the local router updates the entry (keeps the original metric and only resets the aging timer), regardless of whether the metric in the route up date packet is larger or smaller. If the next hop is not the adjacent router, the local router updates the route entry only when the metric in the router update packet is smaller than the previous metric. For a route entry that does not exist in the routing table, the router adds it to the routing table if the metric is less than 16 (unreachable). Each entry in the routing table has an aging timer. If a route entry is not updated within 180 seconds, the aging timer times out and the metric of this route changes to 16 (unreachable).

Page288

o s Re

: s e

h

After the metric of a route changes to 16 and the route is d through the Response packet for four times (120 seconds), this route will be deleted from the routing table.

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

c r u

g n i

: s e

: p tt

h

o s Re

n r a

e r o

Le

M

Page289

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

RIP has two versions: RIPv1 and RIPv2. RIPv1 does not Variable Length Subnet Masks (VLSM). RIPv2 s VLSM, route aggregation, and Classless Inter-Domain Routing (CIDR). In addition, RIPv2 s plain text authentication and MD5 authentication. In RIPv1, packets are transmitted in broadcast mode. RIPv2 s two transmission modes: broadcast and multicast. Multicast is adopted by RIPv2 by default. The multicast address for RIPv2 is 224.0.0.9. An advantage of multicast transmission is that the networks that do not RIP will not receive the RIP packets. Also with multicast, network segments that run RIPv1 will not receive or process the RIPv2 routes.

c r u

g n i

n r a

e r o

Le

M

Page290

o s Re

: s e

h

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

This figure shows the format of the RIPv1 packet. A RIPv1 packet contains a command field, a version field, and multiple route entries (up to 25 entries). Each route entry consists of the Address Family Identifier, reachable IP address, and hop count (Metric). If a router needs to send more than 25 route entries, the entries must be sent in multiple RIP packets. From this figure, you can see that the RIP packet header takes four bytes, and each route entry takes 20 bytes. Therefore, the length of a RIP packet is 4 + 25 x 20 = 504 bytes. Counting the 8-byte UDP header, the maximum length of the RIP packet (excluding the IP header) is 512 bytes.

c r u

g n i

: s e

h

o s Re

n The values and functions of the fields in the RIP packet are as r a

Mo

re

Le

follows:

Command: The value can be only 1 or 2. 1 represents the Request packet; 2 represents the Response packet. A router or host sends the Request packet to require routing information from the peer router. The peer router responds by the Response packet. But in most cases, a router periodically sends Response packets without waiting for the Request packet. Version: For RIPv1, the value is 1. Page291

Address Family Identifier (AFI): For the IP protocol, the value is 2. IP address: indicates the destination address of the route. The value can be a network address or the address of a host. Metric: indicates the hop count. The value ranges from 1 to 16.

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

c r u

g n i

n r a

e r o

Le

M

Page292

o s Re

: s e

h

: p tt

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

Compared with the RIPv1 packet, the RIPv2 packet has the following new fields:

h

Route tag: 16 bits, used to mark the external route or the route redistributed to RIPv2 protocol.

c r u

: s e

Subnet mask: 32-bit mask, used to identify the network address and subnet address in the IP address.

o s Re

Next hop: 32-bit next-hop IP address.

g n i

n r a

e r o

Le

M

Page293

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p t RIP version is 1. Unless In the VRP series routers, the default t h otherwise specified, the RIP version is RIPv2.0 in this course. : RIP protocol version will be The method of changing s the e RIP configuration includes the described later. The basic c r following: u Enable RIP. so [Huawei] RIP Re g RIP is not enabled. By default, n i the network segment for RIP. Specify n ar[Huawei-rip] network network-address All command lines base on VRP 5.9.

M

e r o

Le

RIP runs only on the interfaces in the specified network segment. For an interface out of the specified network segment, RIP does not send or receive routes on the interface. RIP does not forward routes on this interface to other interfaces either. Therefore, you must specify a network segment after RIP is enabled. The network-address specifies the address of the network where RIP is enabled. It can be the network address of the interface. When this parameter is specified, RIP is enabled on all interfaces in this network segment. Page294

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

The display rip command is used to display the running status and configuration of RIP. Part of the display information is described in the following. Pay attention to the contents marked in red.

h

: s e that the RIP process number is 1. RIP process: 1— indicates c r— indicates the public network VPN. Public VPN-Instance u o — indicates that the RIP version is 2. s RIP version: RIP-2 Re100 — indicates that the precedence of the RIP Preference: gis 100. protocol n i number of balanced paths: 8 — indicates that the Maximum n armaximum number of equal-cost routes is 8.

M

e r o

Le

Update time: 30 sec — indicates that the route update interval is 30 seconds. Age time: 180 sec — indicates that the aging time of the RIP route is 180 seconds. Networks: 192.168.1.0 172.16.0.0 — indicates the network where RIP is enabled.

Page295

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

The display rip route command is used to display all active and inactive routes, and the timer of each route.

h

Destination (Dest) destination IP address next hop of the route

Cost

weight of the route

Tag route Sec

ng

i n r

e r o

: s e

Nexthop

a e L

M

Page296

c r u

o s Re

flag used to identify the internal route and external period in which a route entry keeps in certain status

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

All command lines base on VRP 5.3. You can configure any of the following RIP versions: 1. Global RIP version version { 1 | 2 }: configure the RIP version globally. This command is ed by vrp5.x only. 2. Interface RIP version rip version { 1| { 2 [ broadcast | multicast ] } }: configures the RIP version on an interface. This command is configured in the interface view. By default, the RIP version on an interface is RIPv1. RIPv2 s two packet transmission modes: broadcast and multicast. Multicast is adopted by default. The multicast address for RIPv2 is 224.0.0.9. An advantage of using multicast is that the networks not running RIP will not process the RIP packets. With multicast, network segments that run RIPv1 will not receive or process the RIPv2 routes. If the interface with the RIP version RIPv1, the interface process only RIPv1 and RIPv2 broadcast packets and does not process RIPv2 multicast packets. If RIPv2 broadcast mode is adopted on the interface, the interface receives only RIPv1 and RIPv2 broadcast packets and does not receive RIPv2 multicast packets. If RIPv2 multicast mode is adopted on the interface, the interface receives only RIPv2 multicast packets and does not receive RIPv1 and RIPv2 broadcast packets.

c r u

g n i

: s e

h

o s Re

n r a

M

e r o

Le

Page297

Note: If the global RIP version is configured, you need not configure the RIP version in the interface view vrp5.x s this function.

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

c r u

g n i

n r a

e r o

Le

M

Page298

o s Re

: s e

h

: p tt

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

c r u

g n i

: s e

: p tt

h

o s Re

n r a

e r o

Le

M

Page299

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

c r u

g n i

n r a

M

e r o

Le

: p tt

On Router A, the summary command is used to configure route aggregation. Thus, routes 172.16.1.1/32, 172.16.1.2/32, and 172.16.1.3/32 are aggregated to one route: 172.16.0.0/16. The aggregated route uses the natural mask. 172 indicates that the address is a Class-B address, so the mask length of the aggregated route is 16. RIPv2 s route aggregation. By default, route aggregation is enabled. That is, when the RIP version is configured to RIPv2, route aggregation takes effect automatically, unless you use the undo summary command to disable route aggregation. Route aggregation in RIP-2 improves the extendibility and efficiency of large scale networks. After route aggregation, the RIP routing table does not contain sub route entries, namely, the route entry containing a single IP address. In this way, the routing table is condensed, thus the router can process more routes. When the classful aggregation is enabled, the router aggregates the subnet addresses to the natural network segment when it s routes to the destination out of the network segment. However, when split horizon or poison reverse is configured, classful aggregation becomes invalid. Therefore, to configure the router to aggregated routes to the destination out of the natural network segment, you must disable the split horizon and poison reverse functions in the corresponding view by using the following commands: [RTA-Serial0/0/0]undo rip split-horizon [RTA-Serial0/0/0]undo rip poison-reverse// ed by VRP5.X

Page300

o s Re

: s e

h

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

Using the undo summary command, you can disable classful route aggregation to allow routing between subnets. In this case, routing information of the subnet is d. Route aggregation reduces the routing information in the routing table. By default, route aggregation is enabled in RIPv2. In this example, three IP addresses are configured for three loopback interfaces on Router A. RIP is enabled on these IP addresses. Route aggregation is disabled by the undo summary command. These IP addresses are d to other routers. Viewing the routing table of Router B, you can find three host routes with these IP addresses.

c r u

g n i

: s e

h

o s Re

n r a

e r o

Le

M

Page301

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

Using the rip summary-address ip-address mask command, you can configure a RIP router to an aggregated local IP address. This command is ed by VRP5.9.

: s e

h

ip-address: network address to be aggregated

c r u summary-address ip-address mask Using the undo rip o command youscan cancel the configuration. If both auto route aggregation Reand manual route aggregation are enabled, the manually aggregated routes are integrated into the automatically g n aggregated routes. Namely, auto route aggregation take effect. If imask length n the of aggregated route is smaller than natural mask r a length, use manual route aggregation to perform it and do not mask: subnet mask

e r o

Le

use auto route aggregation together.

M

Page302

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

Each routing protocol has a preference. The preference influences the routing policy in selecting the route learned through a certain protocol as the best route. The larger the value, the lower is the preference. You can set the preference of the RIP protocol manually.

c r u

: s e

h

Set the preference of RIP protocol.

o s Restore the Repreference of the RIP protocol to the default value. g undo preference [Huawei-rip] n idefault, the preference of RIP protocol is 100. By n ar [Huawei-rip] preference value

e r o

Le

M

Page303

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

RIP allows RIP to import the routing information of other routing protocol into the RIP routing table. You can set the default cost of the imported route. Routes that can be imported to the RIP routing table are: direct routes, static routes, OSPF routes, BGP routes, and IS-IS routes. Enable RIP to import routes of other routing protocols.

c r u

: s e

h

o s Re

[Huawei-rip] import-route protocol [ allow-ibgp ] [ cost value ] [ route-policy

g n i

route-policy-name ] Disable RIP to import routes of other routing protocols by default.

n r a [Huawei-rip] undo import-route protocolBy default, RIP does

M

e r o

Le

not import routes of other routing protocols. When protocol is specified as BGP, the allow-ibgp keyword is optional. The import-route bgp command configures RIP to import only EBGP routes. The import-route bgp allow-ibgp command configures RIP to import both EBGP routes and IBGP routes. This configuration may cause route disorder, so use this command with caution then takes default-cost as route cost. If route cost is not set for the imported routes.

Page304

The default-cost value is 0. In this example, the route cost is set to 10. Therefore, the cost of imported routes is calculated by route-cost plus 1,so the cost of routes received by RTB is 11.

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

c r u

g n i

: s e

: p tt

h

o s Re

n r a

e r o

Le

M

Page305

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

Using the rip metricin value command, you can set the metric increment for the RIP route received on an interface.

h

value: specifies the metric increment for the RIP route received on an interface.

: s e

c r When receiving a u route, the router adds the RIP increment of the o s to the route, and then adds the route to the receiving interface e routing table. Thus, the metric in the routing table is changed. R Therefore, when the RIP metric of an interface increases, the g n metric i value of the RIP routes received on the interface also n increases. arwhen RTA receiving route 10.1.1.1/32 by rip update message, it The value ranges from 0 to 15. By default, the value is 0.

M

e r o

Le

will calculate cost 10.1.1.1/32. The metric-in value of RTA's receiving interface is changed to 5, the

cost of 10.1.1.1/32 in rip message is 1. So the cost of 10.1.1.1/32 in RTA's the routing-table is 6 (5+1=6).

Page306

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

Using the rip metricout value command, you can set the increment of metric for the RIP route sent from an interface. value: specify the metric increment for the RIP route sent from an interface. The value ranges from 1 to 15. By default, the value is 1. Before a route is d, the metric increment is added to this route. Therefore, when the RIP metric of an interface increases, the metric value of the RIP routes sent from the interface also increases. However, the metric in the routing table is not changed. When RTB receives routes 172.16.1.X by rip update messages, the metric of 172.16.1.X in the update is 4, which is set by "rip metricout 4" on RTA's serial interface. The default metric in of RTB's serial interface is 0, so RTB calculates 4+0=4, 4 being the cost of 172.16.1.X in RTB's routing table.

c r u

g n i

: s e

h

o s Re

n r a

e r o

Le

M

Page307

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

c r u

g n i

n r a

M

e r o

Le

: p tt

RIPv1 does not packets authentication. In RIPv2, two authentication modes are used: plain text authentication and MD5 authentication. MD5 authentication packets have two formats. One is described in RFC 2453, and the other is described in RFC 2082. The router s both formats and you can select the format as required. You can configure the RIP authentication mode by using the following command: rip authentication-mode { { simple } | { md5 { rfc2082 key-string key-id | huawei key-string } } }. simple: adopt simple text authentication. : specify the for plain text authentication. The value is a character string. For the plain text , the string can contain 1 to 16 characters. For the cipher text , the string must contain 24 characters. md5: adopt MD5 authentication. rfc2082: indicate that the MD5 authentication packet adopts the non-standard format (described in RFC 2082) huawei: indicate that the MD5 authentication packet adopts the standard format (described in RFC 2453).

Page308

o s Re

: s e

h

key-string: specify the for MD5 authentication. For the plain text , the string can contain 1 to 16 characters, for example, 1234567. For the cipher text , the string must contain 24 characters, and the format must be cipher text, for example, _(TT8F]Y\5SQ=^Q`MAF4<1!!. key-id: specify the ID of the key used in MD5 authentication. The value ranges from 1 to 255. Using the rip authentication-mode command, you can configure the authentication mode and authentication parameters for RIPv2. Using the undo rip authentication-mode command, you can disable RIPv2 authentication. The rip input command is used to allow an interface to receive RIP packets. The rip output command is used to allow an interface to send RIP packets. By default, an interface can receive and send RIP update packets at the same time.

e w ua

m o c . i

h . ng

i n ar

e l //

c r u

g n i

: s e

: p tt

h

o s Re

n r a

e r o

Le

M

Page309

n e /

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p t The Routing Information Protocolt(RIP) is a distance-vector h routing protocol. It is an IGP protocol. The RIP protocol is : applicable to medium andssmall-sized networks. It has two e versions: RIPv1 and RIPv2. The RIP protocol exchanges routing c information throughr UDP, using port number 520. RIP s u the route loop avoidance mechanisms, such as split horizon, o s route poisoning, and triggered update. e R What are the differences between RIPv1 and RIPv2? g a classful routing protocol and does not VLSM n RIPv1 is iCIDR. RIPv1 sends packets in broadcast mode and does n and arnot authentication. RIPv2 is a classless routing protocol What are the characteristics of the RIP protocol?

M

e r o

Le

and s route aggregation and CIDR. RIPv2 sends packets in broadcast or multicast mode (using multicast address 240.0.0.9). RIPv2 s plain text authentication and MD5 authentication.

Page310

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

c r u

g n i

: s e

: p tt

h

o s Re

n r a

e r o

Le

M

Page311

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

c r u

g n i

n r a

e r o

Le

M

Page312

o s Re

: s e

h

: p tt

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

c r u

g n i

: s e

: p tt

h

o s Re

n r a

e r o

Le

M

Page313

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

c r u

g n i

n r a

e r o

Le

M

Page314

o s Re

: s e

h

: p tt

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

The Routing Information Protocol (RIP) is a relatively simple dynamic routing protocol. RIP is a routing protocol based on the distance-vector (D-V) algorithm.

: s e

h

RIP exchanges routing information through UDP. Based on RIP, a router sends update messages every 30 seconds. If a router does not receive the update message from the peer router within 180 seconds, the router marks all routes learned from the peer router as unreachable. If the router still does not receive the update message from the peer router in the subsequent 120 seconds, it deletes these routes from the routing table.

c r u

g n i

o s Re

RIP represents the distance to the destination network by the n r a hop count. In RIP, the hop count between a router and the

M

e r o

Le

directly connected network is 0. If the network is reachable reached through another router, the hop count is 1. The hop count increases with the number of routers between the source router and the destination network. In RIP, the metric is an integer ranging from 0 to 15. The hop count equal to or larger than 16 is defined as infinite, that is, the destination network or host is unreachable.

Page315

RIP is on the upper layer of UDP. Routing information for RIP is encapsulated in the datagram of UDP. RIP uses port 520 to exchange routing information. When a router receives the route update message from the remote router, the router notifies other routers of the changed route. In this way, routes are synchronized on all routers in the network. To improve the routing performance and avoid route loop, RIP s split horizon, poisoned reverse, and triggered update. In addition, RIP can import routes learned through other routing protocols.

e w ua

m o c . i

h . ng

i n ar

e l //

c r u

g n i

n r a

e r o

Le

M

Page316

o s Re

: s e

h

: p tt

n e /

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

RIP has two versions: RIPv1 and RIPv2. RIPv1 does not Variable Length Subnet Masks (VLSM). RIPv2 s VLSM, route aggregation, and Classless Inter-Domain Routing (CIDR). In addition, RIPv2 s plain text authentication and MD5 authentication. In RIPv1, packets are transmitted in broadcast mode. RIPv2 s two transmission modes: broadcast and multicast. Multicast is adopted by RIPv2 by default. The multicast address for RIPv2 is 224.0.0.9. An advantage of multicast transmission is that the networks that do not RIP will not receive the RIP packets. Also with multicast, network segments that run RIPv1 will not receive or process the RIPv2 routes.

c r u

g n i

: s e

h

o s Re

n r a

e r o

Le

M

Page317

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

c r u

g n i

n r a

e r o

Le

M

Page318

o s Re

: s e

h

: p tt

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tserial interface. RTA and RTB t RTA is connected to RTB through h are configured with two loopback interfaces each. IP addresses : in the figure. of these interfaces are shown s e Fault description: c r the routes learned through RIP are not u After the configuration, o table. s found in the routing Re g n i n ar Network description:

e r o

Le

M

Page319

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

The flowchart provides the main procedure for troubleshooting. When a router fails to receive part of or all the routes, follow the following steps to locate the fault:

: s e

h

1. Check whether RIP is enabled on the incoming interface.

c r u

Use the network command to specify the network segment where RIP is enabled. An interface can receive and send RIP routes only if the RIP protocol is enabled on this interface. You can use the display current-configuration configuration rip command to view the information about the RIP-enabled network segment and check whether the incoming interface is included in this network segment. The specified network segment must be a natural network segment.

g n i

o s Re

n r a

M

e r o

Le

2. Check whether the incoming interface works normally.

Use the display interface command to view the status of the incoming interface. If the physical status of the interface is Down or istratively Down, or the protocol status is Down, RIP cannot function normally on the interface. Therefore, you must ensure that the status of the incoming interface is normal.

Page320

3. Check whether the version of the RIP packets sent from the peer is the same as the RIP version configured on the local interface. If the version of the received RIP packets is different from the RIP version configured on the incoming interface, the RIP routes may not be accepted correctly. 4. Check whether the undo rip input command is configured on incoming interface. The rip input command is used to allow the specified interface to receive RIP packets. The undo rip input command is used to prohibit the specified interface to receive RIP packets. If the undo rip input is configured on the incoming interface, RIP packets received on this interface cannot be processed, so RIP routes cannot be received.

e w ua

h . g n The filter-policy import command is used to filter the received i n RIP routing information. If the ACL is used, use the display r a current-configuration ewhether the RIP l configuration acl-basic command to check /IP address prefix is / routes from the neighbor are filtered. If the : to check the p used, use the display ip ip-prefix command t are filtered by the routing configured routing policy. If RIP routes t h correct touting policy. policy, you need to configure the : metric set by the rip metricin 6. Check whether the additional s e of the received route exceed 15. The command makes the c metric r is used to set the metric increment for the rip metricin command u o RIP packets. If the metric of the received route in the received s e 15, the router considers the route as unreachable route exceeds R and does not add this route to the routing table. g whether the metric of the received RIP route exceeds n 7. Check iSimilarly, if the metric of the received route exceeds 15, the n 15. arrouter considers the route as unreachable and dose not add this 5. Check whether a routing policy is configured to filter RIP routes.

M

e r o

Le

m o c . i

route to the routing table.

8. Check whether the routing table contains the same route learned through another protocol. Use the display rip 1 route command to check whether the local router receives the RIP route. It is possible that the RIP routes are accepted correctly, but the routing table contains the same routes learned through another routing protocol,

Page321

n e /

for example, OSPF or IS-IS. Generally, the priority of OSPF or IS-IS is higher than the priority of RIP, so the routing management module selects the routes learned through OSPF or IS-IS. Using the display ip routing-table protocol rip verbose command, you can see that these routes are inactive. If the fault still exists after these steps, technical engineers of Huawei or visit http://.huawei.com.

m o c . i

n e /

e w ua

h . ng

i n ar

e l //

c r u

g n i

n r a

e r o

Le

M

Page322

o s Re

: s e

h

: p tt

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

c r u

g n i

: s e

: p tt

h

o s Re

n r a

e r o

Le

M

Page323

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

c r u

g n i

n r a

e r o

Le

M

Page324

o s Re

: s e

h

: p tt

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tserial interface. RTA and RTB RTA is connected to RTB through t h are configured with two loopback interface each. IP addresses of :in the figure. these interfaces are shown s e Fault description: c r the router does not send all or some of u After the configuration, o the routes. s Re g n i n ar Networking description:

e r o

Le

M

Page325

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

The flowchart provides the main procedure for troubleshooting. When a router fails to send part of or all routes, follow the following steps to locate the fault:

: s e

h

1. Check whether RIP is enabled on the outgoing interface.

c r u

Use the network command to enable the network segment of the interface .

o s Re

An interface can receive and send RIP routes only if the RIP protocol is enabled on this interface. You can use the display current-configuration configuration rip command to view the information about the RIP-enabled network segment and check whether the outgoing interface is included in this network segment. The specified network segment must be a natural network segment.

g n i

n r a

M

e r o

Le

2. Check whether the outgoing interface works normally. Use the display interface command to view the status of the outgoing interface. If the physical status of the interface is Down or istratively Down, or theprotocol status is Down, RIP cannot function normally on the interface. Therefore,you must ensure that the status of the incoming interface is normal.

Page326

3. Check whether the silent-interface command is configured on the outgoing interface. The silent-interface command is used to suppress the interface from sending the RIP packet. The display current-configuration configuration rip command is used to check whether the interface is suppressed from sending the RIP packet. Enable the interface if it is disabled. 4. Check whether the undo rip output command is configured on outgoing interface. The rip output command is used to allow the specified interface to send RIP packets. The undo rip output command is used to prohibit the specified interface

e w ua

m o c . i

to send RIP packets. If the undo rip output is configured on the outgoing interface, RIP packets cannot be sent from this interface.

h . ng

5. Checking whether the rip split-horizon command is configured on the outgoing interface. Run the display currentconfiguration command on the outgoing interface to

i n ar

e l //

view whether the rip split-horizon command is configured. If the command is configured, the split-horizon is enabled on the outgoing interface. By default, the split-horizon is enabled on all outgoing interfaces, and it is used to could the route loop,so please be careful if you want to cancel split-horizon .

: s e

: p tt

h

6. Check whether a routing policy is configured to filter RIP routes. The filter-policy export command is used to filter the RIP routes. Only the route that es the filtering policy can be added to the d routing table of RIP.

c r u

o s Re

7. Check the status of the interface when the route contains the address of the local interface. Run the display interface command to check the status of the interface. If the physical state of the interface is Down or istratively Down, or the current status of the protocol on the interface is Down, the IP address of the interface cannot be added to the d routing table of RIP. Therefore, the routing information will not be sent to the neighbor.

g n i

n r a

M

e r o

Le

8. Check whether there are other problems. If the outgoing interface does not the multicast or broadcast mode and a packet needs to be sent to the multicast or broadcast address, the fault occurs.

Page327

n e /

You can configure the peer command in the RIP mode to make routers send packets with unicast address. If the fault still exists after these steps, technical engineers of Huawei or visit http://.huawei.com.

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

c r u

g n i

n r a

e r o

Le

M

Page328

o s Re

: s e

h

: p tt

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

c r u

g n i

: s e

: p tt

h

o s Re

n r a

e r o

Le

M

Page329

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

c r u

g n i

n r a

e r o

Le

M

Page330

o s Re

: s e

h

: p tt

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

Fault description: RTA and RTB use different authentication keys, so they cannot receive routes from each other.

h

Analysis: If a router cannot receive any route from the peer, check the following:

: s e

c r ubetween the routers is normal. 2. Whether the link o srouting protocol is configured properly. 3. Whether the e R Using related commands, you can see that RIP is enabled on the g and the link between the routers is normal, but the interfaces n i configuration of RTA is different from that of RTB. Comparing n r their configurations, you can see that authentication is a 1. Whether RIP is enabled on the interfaces connecting the peer.

M

e r o

Le

configured for RTA and RTB. Following the preceding sections, you already know that RIPv2 s the authentication of update packets to improve security. The authentication modes and authentication keys must be the same on the two routers. If the authentication modes or authentication keys on two routers are different, the routers cannot exchange routing information and they ignore the update packets.

Page331

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

After the authentication mode and key are configured correctly, the routers can learn routing information of each other from the update packets.

c r u

g n i

n r a

e r o

Le

M

Page332

o s Re

: s e

h

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

Fault description: The metric of the route exceeds the hop count limit in RIP, so the router cannot accept route.

h

Analysis: RIP limits the hop count to 15. If the hop count in a network exceeds 15, RIP is not applicable to this network.

c r u

: s e

Additional metric is the increment (hop count) added to the original metric. The rip metricin command is used to set the increment added to the received route when the route is added to the routing table. The metric of this route is also changed in the routing table. The rip metricout command is used to set the increment added to a route to be d. But the metric of this route is not changed in the local routing table. For example, after you configure rip metricin 15 on RTB, the hop count of the route to 172.16.3.0 is 16 when the route is received by RTA. RTA does not add the route to the routing table.

g n i

o s Re

n r a

M

e r o

Le

Command lines used here are based on VRP3.4.

Page333

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

Viewing the routing tables of RTA and RTB, you can find that the route to 172.16.2.0 is added to the routing table of RTB, while route to 172.16.3.0 is not added to the routing table of RTA.

c r u

g n i

n r a

e r o

Le

M

Page334

o s Re

: s e

h

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

Change the additional metric to 15, and RTA will add the route to 172.16.3.0 to its routing table.

c r u

g n i

: s e

h

o s Re

n r a

e r o

Le

M

Page335

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

Fault description: The subnets are not continuous, and thus the routing information cannot be added to the routing table.

h

Analysis: Network 162.16.0.0 segment is divided by network segment. RTA and RTB uses RIPv1, which is a classful routing protocol. Therefore, the routers send update packets with a Class-B network segment address 162.16.0.0 but not the accurate network addresses 162.16.2.0 and 162.16.3.0.

c r u

g n i

n r a

e r o

Le

M

Page336

o s Re

: s e

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

When RTA receives the update packet for the route to 162.16.0.0, RTA does not add the route to the routing table, because it has a directly connected network segment 162.16.2.0.

c r u

g n i

: s e

h

o s Re

n r a

e r o

Le

M

Page337

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

To solve this problem, you can enable RIPv2 on the routers, because RIPv2 is a classless routing protocol. Use the undo summary command to enable the CIDR function.

c r u

g n i

n r a

e r o

Le

M

Page338

o s Re

: s e

h

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

After you modify the configuration, RTB s the route with the accurate address 162.16.3.0, and RTA adds the route to the routing table.

c r u

g n i

: s e

h

o s Re

n r a

e r o

Le

M

Page339

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p t 1. Check whether RIP is enabledton the incoming interface. hinterface works normally. 2. Check whether the incoming : s 3. Check whether the version of the received RIP packet is the e c same as the RIP version r configured on the incoming interface. u 4. Check whether o the undo rip input command is configured on s the incomingeinterface. R 5. Check whether the routing policy is configured to filter the g RIP routes. received n i 6.nCheck whether the additional metric set by the rip metricin arcommand makes the metric of the received route exceed 15.

What are the steps for troubleshooting received RIP routes?

M

e r o

Le

7. Check whether the metric of the received route exceeds 15. 8. Check whether the routing table contains the same route learned through another routing protocol. What are the steps for troubleshooting sent RIP routes? 1. Check whether RIP is enabled on the outgoing interface. 2. Check whether the outgoing interface works normally.

Page340

3. Check whether the silent-interface command is configured on the outgoing interface. 4. Check whether the undo rip output command is configured on the outgoing interface. 5. Check whether split horizon is configured on the outgoing interface.

n e /

6. Check whether the routing policy is configured to filter the routes imported to RIP. 7. Check status of the local interface if the route to be d contains the address of the local interface.

e w ua

8. Check whether other problems exist.

h . ng

i n ar

e l //

c r u

g n i

: s e

: p tt

h

o s Re

n r a

e r o

m o c . i

Le

M

Page341

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

c r u

g n i

n r a

e r o

Le

M

Page342

o s Re

: s e

h

: p tt

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

c r u

g n i

: s e

: p tt

h

o s Re

n r a

e r o

Le

M

Page343

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

c r u

g n i

n r a

e r o

Le

M

Page344

o s Re

: s e

h

: p tt

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

Open Shortest Path First (OSPF) is an IGP protocol based on the link state algorithm. OSPF is brought forward by the Internet Engineering Task Force (IETF). OSPF has three versions. OSPFv1 is defined in RFC 1131. This version was in the experimental stage and has never been released for public use. OSPFv2 is used for IPv4 and was initially defined in RFC 1247. RFC2328 is the latest standard document for OSPFv2. OSPFv3 is used for IPv6. Unless otherwise specified, OSPF refers to OSPFv2 in this course.

c r u

g n i

: s e

h

o s Re

OSPF is borne by the IP protocol and uses IP protocol number 89. An OSPF packet consists of the header and the packet body. The format of the OSPF packet is described in the HCDP course and is not explained here.

n r a

e r o

Le

M

Page345

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

c r u

g n i

n r a

M

e r o

Le

: p tt

The following features of OSPF enable extensive use of OSPF: s CIDR. Early routing protocols, such as RIPv1, do not CIDR. OSPF s CIDR and allows the d routing information to contain the subnet mask so that routing information is not limited to the classful network. s area division. OSPF allows dividing an autonomous system (AS) into areas so that the s can be managed more flexibly. Avoids route loops. The design of OSPF avoids route loops. OSPF allows dividing an AS into areas. Routers in an area use the SPF algorithm to avoid route loops. Route loop between areas is avoided through the area connection rule specified by OSPF. The routes converge very quickly when the network topology is changed. OSPF adopts the triggered update mode. When the network topology changes, the new link state is flooded immediately. OSPF is sensitive to the change of network topology, so the routes converge quickly. Forwards protocol data through IP multicast. An OSPF router sends and receives protocol data through multicast or unicast, which uses low network traffic.

Page346

o s Re

: s e

h

s equal-cost routes. OSPF s equal-cost routes. When multiple routes to the same destination have the same cost, the traffic is shared by these routes evenly. Through load balancing, the link bandwidth is used more efficiently. s authentication of protocol packets. In a network that requires higher security, OSPF routers can provide the authentication function. Packets can be exchanged between OSPF routers only after they the authentication. The authentication improves security of the network.

e w ua

m o c . i

h . ng

i n ar

e l //

c r u

g n i

: s e

: p tt

h

o s Re

n r a

e r o

Le

M

Page347

n e /

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

OSPF is an open standard routing protocol and is extensively used by various network carriers. OSPF can be applied to both the enterprise network and the carrier-class IP network. This slide lists the differences between OSPF, RIPv2 and RIPv1.

c r u

g n i

n r a

e r o

Le

M

Page348

o s Re

: s e

h

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

Compared with RIP, OSPF is a more advanced interior gateway protocol. OSPF and RIP are totally different, although they are both IGPs. OSPF is based on the link state algorithm, while RIP is based on the distance-vector algorithm. As described in the course of the RIP protocol, distance-vector protocols select routes based on the hop count and do not consider network resources such as the link bandwidth. Under this condition, a path with high bandwidth may not be selected.

c r u

: s e

h

o s Re routes according to the link state. OSPF enables OSPF selects g fast convergence of routes and do not limit the hop count. OSPF n i the link information, instead of periodically routers n arsending route update packets. Therefore, OSPF is more

M

e r o

Le

applicable to large-scale networks. (A link can be regarded as an interface on a router. The link state is the description of the interface and the relation between the local router and the adjacent router.) The calculation process of OSPF will be described later.

Page349

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

Unlike early routing protocols that use the distance-vector algorithm, OSPF uses the link state algorithm. The following describes the route calculation process of the link state algorithm.

: s e

h

An OSPF router floods the link state ment (LSA) to notify other routers of the status of the local link, for example, available interface, reachable neighbor, and the information about the adjacent network segment. Flooding is a process of sending and synchronizing the link state between routers.

c r u

g n i

o s Re

Each router generates a link state database (LSDB) according to the LSAs d by other routers and its local LSAs. The LSDB describes the detailed network topology in the routing area. In the same area, all routers have the same LSDB.

n r a

M

e r o

Le

Based on the LSDB, each router calculates a shortest path tree with the SPF algorithm. The local router is the root of the tree, and other nodes in the network are leaves. The shortest path tree calculated through the SPF algorithm does not have route loops. The shortest path tree of each router provides the routing table listing the routes to other nodes in the network. Thus, each OSPF router knows the routes to other routers.

Page350

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

OSPF s five types of packets, which contain the same OSPF header. An OSPF router uses the following packets to discover neighbors and maintain the neighbor relation, synchronize the LSDB, and exchange routing information:

h

: s e packet used to discover neighbors Hello packet: It is a common c r relation. The Hello packet is also used and maintain the neighbor u to elect the designated so router (DR) and backup designated router (BDR) in theebroadcast network and NBMA network. R DD packet: Routers use DD packets to describe their LSDBs g whennthey synchronize the LSDBs. A DD packet consists of an iand an LSA header. The header uniquely identifies an LSA. LSA n arThe LSA header makes a small part of the packet, and thus the

M

e r o

Le

traffic of protocol packets transmitted between routers can be reduced. The peer router checks whether an LSA already exists according to the LSA header.

LSR packet: After two routers exchange the DD packets, each router knows the LSAs that exist in the LSDB of the peer but do not exist in the local LSDB. Then the router sends an LSR packet to request for these LSAs. The LSR packet contains the summary of the required LSAs. Page351

LSU packet: This packet is used to send the required LSAs to the peer router. An LSU packet contains the combination of multiple LSAs. LSAck packet: This packet is used to acknowledge the received LSU packet.

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

c r u

g n i

n r a

e r o

Le

M

Page352

o s Re

: s e

h

: p tt

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

To exchange the link status and routing information, two OSPF routers need to establish the neighbor relation. Neighbor

: s e

h

After an OSPF router is started, it sends Hello packets through the OSPF interface to discover neighbors. The OSPF router that receives the Hello packet checks the parameters in the Hello packet. If the parameters are consistent on the two routers, the two routers establish the neighbor relation.

c r u

o s Re

g n Notiall neighboring routers can establish the adjacency. n Adjacency establishment depends on the network type. The real r a adjacency is established only if the routers exchange DD packets Adjacency

Mo

re

Le

successfully and can exchange LSAs. To send LSAs, a router must discover the neighbor and establish the adjacency with the neighbor.

In this example, RTA is connected to three routers through Ethernet. RTA has three neighbors, but you cannot say that RTA establishes three adjacencies.

Page353

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

Not all neighbors can establish the adjacency to exchange link status and routing information. Adjacency establishment depends on the network type, namely, the layer-2 link type of the OSPF network.

h

: s eprotocol, OSPF networks are classified Based on the link-layer c r network, broadcast network, NBMA into the point-to-point u network, and point-to-multipoint network. A point-to-point network so is a network e that directly connects two routers. R Link layer protocols for the point-to-point network are PPP, LAPB, g In a point-to-point network, neighboring routers can and HDLC. n i the adjacency directly. Broadcast network: If the linkestablish n arlayer protocol is Ethernet or FDDI, the network is considered as

M

e r o

Le

a broadcast network by default. The network shown in the right of the figure is a broadcast network.

Ethernet is a common link layer protocol for a broadcast network. In the broadcast network, NBMA network, and point-to-multipoint network, routers establish adjacency selectively.

Page354

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

A non-broadcast network can connect more than two routers, but it does not broadcast.

h

In non-broadcast networks, OSPF has two operation modes: non broadcast multi-access (NBMA) and point-to-multipoint.

: s e

c r u routers must establish a full connection. An In an NBMA network, o s ATM network adopting full connection is an NBMA network. e R network, OSPF simulates the operations on In an NBMA g networks, however neighbors of each router must be broadcast n configured i manually. n arCommon link layer protocols for the NBMA network are Frame NBMA

e r o

Le

Relay and ATM.

M

Page355

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tfull connection needs to A network that cannot establish the t h adopt the point-to-multipoint mode. A Frame Relay network is : the entire non-broadcast network such a network. In this mode, s eof point-to-point networks. A router is regarded as a group c r by using a lower layer protocol, for discovers its neighbors u example, inverse oARP. The point-to-multipoint network type is not s a default type in Re OSPF. g n i n ar Point-to-multipoint

e r o

Le

M

Page356

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

In broadcast and NBMA networks, if any two routers need to establish the adjacency, route convergence is very slow. Use of the designated router (DR) and backup designated router (BDR) solves this problem.

h

: s eNBMA network containing at least two A broadcast network or c routers has one DRrand a BDR. u and BDR: o Functions of the DR s e The DR and BDR R reduce adjacencies, thus reduce exchanges of link state information and routing information. Use of the DR and g n BDR bandwidth consumption and lowers the burden of i reduces n routers. A router that is neither the DR nor the BDR is called a arDRother. A DRother establishes the adjacencies and exchanges

M

e r o

Le

the link state information and routing information only with the DR and BDR. This mode greatly reduces adjacencies and raises route convergence speed in large-scale broadcast and NBMA networks. In the figure, RTA has three neighbors, but it establishes adjacencies only with the DR and BDR. RTA does not establish the adjacency with the other router and does not exchange routing information with this router.

Page357

To sum up, establishment of the adjacency depends on the network type. In a point-to-point network, two routers can establish the adjacency. A point-tomultipoint network can be regarded as a group of point-to-point networks. An adjacency is established between each two directly connected routers. In a broadcast or NBMA network, a DR and a BDR are selected. Drothers establishes adjacencies only with the DR and the BDR.

m o c . i

n e /

e w ua

h . ng

i n ar

e l //

c r u

g n i

n r a

e r o

Le

M

Page358

o s Re

: s e

h

: p tt

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p t of routers that use the An autonomous system is a combination t h same routing policy and are managed by the same technical :In the course of OSPF, an management organization. s e to a group of routers that exchange autonomous system refers c r using the same routing protocol. In this routing information by u course, autonomous is referred to as AS for short. As an so onsystem IGP protocolebased the link state algorithm, OSPF takes effect only R within the AS. g Arean iarea is a combination of routers and the networks connected n An arto these routers. As shown in the figure, three routers and the Autonomous system

M

e r o

Le

networks connected to the routers forms an area. Single area means that all routers running OSPF belong to the same area. OSPF requires that all routers in the same area have the same LSDBs. Router ID:

To run OSPF, a router must have a router ID. The LSDB records the topology of the network, including routers in the network.

Page359

Each router must have a unique identifier to identify itself in the LSDB. A router ID is a 32-bit integer used to uniquely identifies a router in an AS. Each OSPF router has a router ID. Router ID uses the format of an IP address. The IP address of Loopback interface of a router is recommended as the router ID.

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

c r u

g n i

n r a

e r o

Le

M

Page360

o s Re

: s e

h

: p tt

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

In this example, the topology for OSPF single area configuration is as follows:

h

RTA and RTB are located in the network. Each router uses the IP address of Loopback0 as the router ID. RTA and RTB belong to Area 0. Here, configuration of interfaces and IP addresses is not mentioned. For the configuration, refer to related basic courses.

c r u

: s e

o s Run the router Re id router-id command to specify the router ID. If the router ID is not specified, OSPF uses the largest loopback IP g n address router ID. If no loopback interface is configured, ilargestasIPtheaddress n the of physical interfaces is used as the router r a ID. The procedure for basic OSPF configuration is as follows:

M

e r o

Le

Run the ospf [ process-id] command to enable OSPF. OSPF s multiple processes. If the process ID is not specified, process 1 is used by default. Run the area area-id command to enter the area view. Run the network ip-address wildcard command to specify the network segment included in the area. When specifying the network, use the wildcard mask of the network segment.

Page361

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

After the configuration, you can use related commands to check the configuration. For example, you can use the display ospf routing command to display information about the OSPF routing table.

h

: s e [RTA] display ospf routing c rcommand displays the OSPF routing table In this example, this u o shows that the OSPF routing table of RTA of RTA. The display s e route entries and they are all in Area 0. Each route contains three R entry shows network segment, next hop, router that s g and the area the route belongs to. From the display this route, n i information, you can see that the OSPF configuration is correct n r a and RTA and RTB can exchange routing information.

e r o

Le

M

Page362

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

As the network size keeps increasing it increases the number of devices that are part of the same converged domain and in turn their routing tables. If all routers in a large-scale network run OSPF, an increasing amount of storage space becomes occupied, The reason is that the LSDB becomes very large when a large number of routers are added to the network. A huge LSDB makes calculation of SPF algorithm very complicated and burdens the U. When the network size is enlarged, the probability of topology changes also increases and the network often flaps. Under such a condition, a large amount of OSPF packets are transmitted in the network, which lowers the bandwidth utility. To make it worse, each time the network topology changes, all routers in the network need to recalculate routes. To avoid this problem, OSPF divides an AS into areas. Areas logically classify routers into different groups. An area is identified by the area ID. An area is a combination of network segments. OSPF allows network segment to form an area. Dividing an AS into areas reduces the LSDB size and reduces network traffic. The detailed topology within an area is not sent to other areas. Areas exchanges only abstract routing information but not the link state information. Areas maintain different LSDBs.

c r u

g n i

: s e

h

o s Re

n r a

M

e r o

Le

Page363

Each router maintains a independent LSDB that records each area connected to it. Since the link state information is not d to other areas, the size of LSDB is much more smaller. Area 0 is the backbone area that s the inter-area routing information (not detailed link state information) summarized by edge routers to non-backbone areas. To avoid routing loop, nonbackbone areas cannot inter-area routing information. Each edge router, therefore, must have at least one interface in Area 0. That is, all non-backbone networks must be connected to the backbone area.

e w ua

m o c . i

h . ng

i n ar

e l //

c r u

g n i

n r a

e r o

Le

M

Page364

o s Re

: s e

h

: p tt

n e /

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

OSPF defines the following types of router: Internal Router (IR)

: s e

h

An IR is the whole interfaces of a router connected to network segments in the same area. IRs in the same area maintain the same LSDBs.

c r u (ABR) Area border router o s connected to multiple areas. An ABR An ABR is a e router R LSBD for each area connected to it. ABRs maintains an g inter-area routing information. exchange n i router (BR) Backbone n arA BR is a router that has at least one interface (or virtual

M

e r o

Le

connection) in the backbone area. All ABRs and routers that have all interfaces in the backbone area are BRs. Non-backbone areas must be directly connected to the backbone area, and so BRs usually process routing information of multiple areas. AS boundary router (ASBR) An ASBR is a router used to exchange routing information with routers in other AS’.

Page365

The ASBR s routing information of other AS’ to all routers in the same AS. Routers in an AS communicate with routers in other AS’ through the ASBR. An IR or ABR can act as the ASBR. An ASBR can be in the backbone area or a nonbackbone area.

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

c r u

g n i

n r a

e r o

Le

M

Page366

o s Re

: s e

h

: p tt

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

Only one area (Area 1) is configured on RTA, and so network segments are specified only for Area 1.

c r u

g n i

: s e

h

o s Re

n r a

e r o

Le

M

Page367

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

As shown in the figure, the area is divided into Area 0, Area 1, and Area 2. OSPF requires non-backbone areas to be directly connected to the backbone network, and so Area 1 and Area 2 are connected to Area 0. On RTA, Area 1 must be configured. On RTB, Area 0 and Area 1 must be configured. On RTC, Area 0 and Area 2 must be configured. On RTD, Area 2 must be configured. RTA and RTB exchanges LSAs to generate LSDBs. LSDBs of RTA and RTB are the same. Since RTB also belongs to Area 0, RTB maintains another LSDB for Area 0. This LSDB is the same as the LSDB on RTC. Similarly, RTD and RTC maintain same LSDBs for Area 2.

c r u

g n i

: s e

h

o s Re

n The configuration is similar to configuration of a single area, and r a

M

e r o

Le

the commands are omitted here. When configuring multiple areas, network segments must be specified for area separately. For example, network segment 2.2.2.2 is specified Area 1, and so this network segment cannot be specified in Area 0. Note that a network segment cannot belong to multiple areas. The configuration of RTA is similar that of RTD. please take note of the configuration of RTD later.

Page368

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

This page shows the configuration of RTC. Two areas are configured on RTC:

h

Area 0 and Area 2. Their network segments are specified separately.

c r u

g n i

: s e

o s Re

n r a

e r o

Le

M

Page369

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

Only one area (Area 2) is configured on RTD, and so network segments are specified only for Area 2.

c r u

g n i

n r a

e r o

Le

M

Page370

o s Re

: s e

h

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

Using the display ospf routing command, you can the configuration. You can also use the following command to view information about neighbors of an OSPF router. display ospf peer

: s e

h

c r Area indicates theuarea a neighbor belongs to. o s Interface indicates e the interface connected to this neighbor. R Router Id indicates the router ID of the neighbor. g indicates the address of the neighboring interface. n Address ihas two neighbors: RTA in Area 1 and RTC in Area 0. n RTB ar In the output information:

M

e r o

Le

First line of the output information: OSPF Process 1 with Router ID 2.2.2.2 indicates that the router ID of RTB is 2.2.2.2. The following lines: Area 0.0.0.0 interface 10.1.2.1(Ethernet0/1)'s neighbors Router ID: 3.3.3.3 Address: 10.1.2.2 These lines indicate that the neighbor belongs to backbone area Area 0; the IP address of the interface connected to the neighbor is 10.1.2.1; the router ID of the neighbor is 3.3.3.3; Page371

the IP address of the neighboring interface is 10.1.2.2. Information about the neighbor in Area 2 is similar to the above information.

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

c r u

g n i

n r a

e r o

Le

M

Page372

o s Re

: s e

h

: p tt

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

In this example, you can use the display ip routing-table protocol ospf command to view the global routing table. The output information shows that five route entries are learned through OSPF.

c r u

g n i

: s e

h

o s Re

n r a

e r o

Le

M

Page373

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p t the local link state Each router in the network s t h information to other routers and collects the link state information :In this way, each router generates an d by other routers. s enetwork topology. Based on the LSDB, LSDB that describes the c r path tree by using the SPF algorithm. routers calculate a shortest u The shortest path o tree provides routes to all nodes in the network. s e area? What is anROSPF An OSPF g area is a combination of network segments. n What i is the procedure for basic OSPF configuration? n arEnable the OSPF process. Create OSPF areas. Specify network What is the calculation process of the link state algorithm?

e r o

Le

segments for each area.

M

Page374

n e /

m o c . i

e w ua

h . ng

Module 3 rni a e Switching /l

c r u

g n i

n r a

M

e r o

Le

o s Re

: s e

h

/ : p t t

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

c r u

g n i

n r a

M

e r o

Le

o s Re

: s e

h

: p tt

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

c r u

g n i

: s e

: p tt

h

o s Re

n r a

e r o

Le

M

Page377

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

LAN technology includes Ethernet, token ring and token bus. In these technologies, Ethernet technology gradually occupy a dominant position with its efficient and low prices.

c r u

g n i

n r a

e r o

Le

M

Page378

o s Re

: s e

h

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

c r u

g n i

: s e

: p tt

h

o s Re

n r a

e r o

Le

M

Page379

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p t in Palo Alto, California. Dr 1973, Ethernet was invented at Xerox t Robert Metcalfe is regardedhas the father of Ethernet. Early Ethernet standards, the:prototype of today’s Ethernet ran at a s speed of 2.94 Mbps.e c Corporation, Intel and Xerox promoted r 1980, Digital Equipment u Ethernet as aostandard, the so called Ethernet DIX80 or s 1 standard which standardized 10Mbps Ethernet e version R Ethernet. g 1982,nA second revision of Ethernet, known as Ethernet DIX82 or iEthernet version II. The Ethernet II remains the Ethernet n ar standard used in today’s networks. The history of Ethernet:

M

e r o

Le

1995, IEEE issued the standard for Fast Ethernet, namely, the 802.3u standard. 1998, IEEE issued the standard for gigabit Ethernet.

1999, IEEE 802.3ab or 1000 BASE-T standard was published. July 18th, 2002, IEEE published the 802.3ae or 10G Ethernet standard which involves three physical interface standards, namely, 10GBASE-R, 10GBASE-W and 10GBASE-LX4. March, 2004, IEEE issued the 802.3ak standard or 10GBASE-CX4 for 10G Ethernet over copper twin-axial cable. Page380

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

In the early days, Ethernet was a shared network medium. It often ran using the following transmission media:

: s e

h

10Base5: thick coaxial cable commonly known as thicknet. The 5 refers to a maximum transmission distance of 500 meters.

c r u

10Base2: thin coaxial cable commonly known as thinnet. The 2 refers to a maximum transmission distance of close to 200 meters, the true distance is 185 meters.

o s Before shared Re Ethernet came into being, coaxial cable was connected with a device called a pigtail which is was inserted by g n cutting a small hole in the coaxial cable. Extreme care had to be i when n taken inserting a pigtail into the coaxial cable due to the r a potential for the central core to short out on with the

e r o

Le

metallic shield, which could cause the failure of an entire segment.

M

Page381

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

At the end of 1980s, unshielded twisted pair (UTP) came into being and was soon widely used. UTP is cheap and easily made and with UTP data can be sent and received over different wires, which makes full duplex easily applied.

h

: s e in two types: shielded twisted pair Twisted pair cable comes c r twisted pair (UTP). STP is very effective at (STP) and unshielded u protecting cables ofrom external electromagnetic interference. s Twisted cables are categorized by the length of a single twist for e R each wire pair, and they come in the following types: g twisted-pair cable ——The cable defined by ANSI Category-3 n iEIA/TIA568. Its transmission frequency is 16MHz and is and n armainly for transmitting voice or transmitting data with data rates

M

e r o

Le

of up to 10Mbps. It is often used for 10base-T networks.

Category-4 twisted-pair cable — Mainly used for transmitting voice or transmitting data with a typical data rate of 16Mbps. It is commonly used in token ring LANs and 10base-T/100base-T networks.

Page382

Category-5 twisted-pair cable — Mainly for transmitting voice or data at the rates of up to 100Mbps. It is often used for 100base-T and 10base-T networks. It one of the most widely used Ethernet cables, however has generally been superseded by an enhanced version known as Cat5e. The Cat5e standards are much more stringent and give a the use of 4 wire pairs as opposed to 2 wire pairs used by Cat5, allowing Cat5e to Gigabit Ethernet transmissions.

e w ua

m o c . i

h . ng

i n ar

e l //

c r u

g n i

: s e

: p tt

h

o s Re

n r a

e r o

Le

M

Page383

n e /

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

Ethernet interfaces on networking devices come into two types: Medium Dependent Interface (MDI) and Medium Dependent Interface Crossover (MDI_X). Ethernet interfaces of routers and interfaces of Network Interface Cards (NIC) are often MDIs. The Interfaces of hubs are considered MDI_X interfaces.

c r u

Twisted-pair cables can be divided into straight cable and crossover cable types. Straight cables are used for connecting MDI and MDI_X type devices; crossover cables are mainly for connecting MDI and MDI or MDI_X and MDI_X device types. It should be noted that the pair sequence in a crossover cable results in a crossover at each end of the cable between pins 1 & 3 and 2 & 6.

g n i

n r a

e r o

Le

: s e

h

M

Page384

o s Re

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

c r u

g n i

: s e

: p tt

h

o s Re

n r a

e r o

Le

M

Page385

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

Usually 10 Mbit/s Ethernet is only located at the access layer of the network. The new generation multimedia products, video and database products may easily chew up the bandwidth of 10Mbit/s Ethernet.

c r u

g n i

n r a

e r o

Le

M

Page386

o s Re

: s e

h

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

Besides coaxial cable and twisted pair cable, the IEEE802.3 cable also use fiber 10BASE-F. 10BASE-F was once used at the early age of Ethernet and its transmission distance can reach 2 Km.

c r u

g n i

: s e

h

o s Re

n r a

e r o

Le

M

Page387

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

The standard (10Mbps) Ethernet transmission rate is too low to meet the demands of today’s networks. To meet these higher demands, IEEE issued the IEEE802.3u standard for fast Ethernet, ing data transmission rates of 100Mbps.

c r u

g n i

n r a

e r o

Le

M

Page388

o s Re

: s e

h

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

Full-duplex fast Ethernet is capable of sending and receiving data at 100 Mbps/s rate simultaneously. Data sending and receiving are independent due to the use of separate wire pairs for transmitted and received data, which avoids collisions and interference and improves the network efficiency.

c r u

: s e

h

The standards body EIA/TIA stands for Electronic Industries Alliance/Telecommunication Industry Association.

g n i

o s Re

n r a

e r o

Le

M

Page389

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

Gigabit Ethernet is an extension of the Ethernet defined by IEEE802.3, for which transmission speeds of 1Gbps are achieved.

: s e

h

There are two standards that have been defined for gigabit Ethernet, they are IEEE802.3z (for fiber and copper) and IEEE802.3ab (for twisted-pair).

c r u

g n i

n r a

e r o

Le

M

Page390

o s Re

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

IEEE802.3ab specifies the standard for 1000BaseT. 1000BaseT is a kind of 10G Ethernet technologies using Type5 UTP to transmit data and its effective transmission distance reaches 100 meters as that of 100BASETX does. s can upgrade their 100Mbps Ethernet to 1000Mbps Ethernet smoothly in their original fast Ethernet system with this technology. IEEE802.3z sets standards for three kinds of cables: 1000BaseCX is based on a kind of copper shielded twisted-pair cables with high quality. The transmission distance of this cable is 25 meters and is connected by 9um D type connectors. 1000BaseSX is a kind of technology using shortwave laser as the signal source. The wavelength of the laser is set to be within the scope of 770-860nm (usually 800nm). It s only multimode fiber and cannot operate on the single mode fiber. 1000BaseLX is another optical gigabit Ethernet standard, using a long wavelength laser (1270-1355, usually is 1300nm),It can drive not only multi-mode fiber but also single-mode fiber.

c r u

g n i

: s e

h

o s Re

n r a

M

e r o

Le

Page391

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

10G Ethernet is the cutting-edge technology in the Ethernet world. Its transmission speed is 10 times that of a gigabit Ethernet and its working area is much wider. 10G Ethernet can be applied not only to the traditional LANs, but also WANs and MANs which were once closed to Ethernet due to its limited capabilities. 10G Ethernet can be compatible with DWDM seamlessly which stretches Ethernet to a global geographical scope without being limited by distance.

c r u

: s e

h

o s Re IEEE and 10 Gigabit Ethernet Alliance Two organizations, g played an important role in the standardization of 10G (10GEA), n i IEEE is in charge of setting standards for 10G Ethernet Ethernet. n arand it has issued IEEE802.3ae as of June 2006. IEEE802.3ae

M

e r o

Le

specifies the standard of 10G Ethernet that runs on fiber, a standard not so suitable for enterprise LANs that commonly transmit data through copper cabling. To meet the requirements from the 10G Ethernet that runs on copper cables, IEEE issued the 802.3ak standard in March 2004 and the IEEE 802.3an standard for 10G Ethernet over twisted-pair cabling.

Page392

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

The standard for 10G Ethernet over fiber is IEEE802.3ae, which consists of 10G BASE-X, 10GBASE-R and 10GBASE-W.

h

10GBASE-X uses a tightly packed package which involves a rather simple WDM device, four receivers and four lasers that work at the wavelength of about 1300nm at an interval of around 25nm. Each sender and receiver pair works at a speed of 3.125 Gbps with a data rate of 2.5 Gbps.

c r u

: s e

o s eis a form of serial interface based on a 64B/66B 10GBASE-R R coding scheme instead of the 8B/10B scheme applied to the gEthernet. Its data rate is 10.000 Gbps/s which leads to a gigabit n i rate of 10.3 Gbps. clock n ar10GBASE-W refers to the WAN interface, which is compatible

M

e r o

Le

with SONET OC-192. The clock rate and data rate of 10 GBASEW are 9.953 Gbps and 9.585 Gbps respectively. The 10G Ethernet standard for fiber is IEEE802.3ae. IEEE802.3ak is the standard for 10G Ethernet over coaxial cables. 10GBASE-CX4 allows 10G Ethernet to transmit over coaxial copper lines up to a distance of 15 meters.

Page393

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tformed? 1. How was the Ethernet standard t h Xerox first presented the : original Ethernet technology whose speed was only 3Mbps ins1973. Later, Digital Equipment e Corporation, Intel andcXerox tly proposed the 10Mbps DIX r This was then developed into early forms standard for Ethernet. u ostandard in 1980. of the IEEE802.3 s 2. Which media Re types are ed by Ethernet? g has defined standards for of Ethernet over Ethernet n coaxial, i twisted-pair and fiber optic media types. n ar3. What are the speed rates of Ethernet? This chapter involves the following contents:

e r o

Le

10M, 100M, 1000M and 10G. Early category 4 cabling also s speeds of 16Mbps for token ring.

M

Page394

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

c r u

g n i

: s e

: p tt

h

o s Re

n r a

e r o

Le

M

Page395

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

c r u

g n i

n r a

e r o

Le

M

Page396

o s Re

: s e

h

: p tt

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

c r u

g n i

: s e

: p tt

h

o s Re

n r a

e r o

Le

M

Page397

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

c r u

g n i

n r a

e r o

Le

M

Page398

o s Re

: s e

h

: p tt

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

Carrier Sense Multiple Access with Collision Detection (CSMA/CD) is a set of rules determining how network devices respond when two devices attempt to use a data channel simultaneously. The basic working theories of CSMA/CD are as follows:

c r u

: s e

h

(1) If the transmission media is not occupied at that time, a particular station can transmit, otherwise move on to the next step.

g n i

o s Re

(2) The station waits for a while until the data channel is not occupied and then it begins to send data.

n If the station detects a collision which is known as the voltage (3) r a level is as twice as usual, it stops transmitting that frame and

M

e r o

Le

transmits a jam signal in order let all the participating stations know the collision. (4) After a random time interval, the station that collided attempts to transmit again, which goes back to step 1 again and the process cycles.

Page399

5

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

Limited by the algorithm of CSMA/CD, the length of a frame sent over Ethernet using 10M half duplex should be at least 64 bytes.

c r u

g n i

: s e

h

o s Re

n r a

e r o

Le

M

Page400

6

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

Two network devices appeared during the period when the Ethernet developed from a shared to a switched network, one is the Hub, the other is the Repeater.

: s e

h

When the network is extended, signals degrade as they travel long distances, which may often lead to corrupted data. The repeater is an electronic device that helps to recover or amplify signals.

c r u

o s The hub and Rerepeater both work at the physical layer. g n i n ar

e r o

Le

M

Page401

7

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

The hub is an Ethernet device which works based on the mechanism of CSMA/CD. The working principles of the hub are quite simple. The hub forwards the data frame received by one of its ports to all other ports directly no matter whether the frame is unicast or broadcast.

c r u

: s e

h

We may say that the hub and repeater changes only the physical topology of the Ethernet, the logical topology of the Ethernet is still remains a bus topology.

g n i

o s Re

The hub does not have a MAC address and only forwards data without filtering.

n r a

e r o

Le

M

Page402

8

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

The network connected by hubs or repeaters is considered to be shared Ethernet, so it is no wonder that this kind of network has all the weaknesses of a shared Ethernet, weaknesses that include:

c r u

•Collisions

: s e

h

•Broadcast flooding

o s Re

•No Guarantee of Security

g n i

n r a

e r o

Le

M

Page403

9

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

c r u

g n i

: s e

: p tt

h

o s Re

n r a

e r o

Le

M

Page404

10

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

The Ethernet switch operates at the data-link layer and has two basic functions: Learning MAC addresses;

: s e

h

Switching or filtering data.

c r u

g n i

o s Re

n r a

e r o

Le

M

Page405

11

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

In the figure above, DMAC indicates the MAC address of the destination and SMAC is the MAC address of the source. The meaning of the Length/Type field various with its values. When its (hexadecimal) value exceeds 1500, it indicates the field is a type field; when the value is less than or equal to 1500, the field indicates it is a frame length field. The value of the DATA/PAD field represents the length of the data filled to make the frame length to be 64 bytes or above. FCS refers to the extra checksum characters added to a frame for error detection and correction.

c r u

: s e

h

o s Re

g n i the value of the Length/Type field exceeds 1500, the MAC When n arsub-layer can submit the frame to a protocol at the upper layer

M

e r o

Le

immediately without going through the LLC sub-layer. This structure is the Ethernet_II structure which is very popular and used by most protocols. In this structure, the data-link layer only involves the MAC sub-layer and does not implement the LLC layer.

When the value of the Length/Type is less than or equals to 1500, it indicates the Ethernet_SNAP structure which is set by the 802.3 committee but is not widely used. Page406

12

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

An Ethernet frame whose type is 0800 is an Ethernet_II frame, as 0x0800 when converted from Hexadecimal to Decimal is bigger than 1500 and must be an IP datagram, since 0800 represents the IP datagram header.

h

: s e to determine that a 0806 frame is In a similar way, it is c possible r for ARP request/response and a 8035 frame is for RARP u request/response. o s e question remains how we can identify the ‘type’ of However, the R a the next frame header defined in 802.3 since the 802.3 frame g only the frame ‘length’ instead of the frame ‘type'? indicates n i n ar

e r o

Le

M

Page407

13

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

In an 802.3 frame, there is a three-byte 802.2 LLC and a fivebyte 802.2 SNAP header. The values of Destination Service Access Point (DSAP) and Source Service Access Point (SSAP) are both set to 0xAA. The Ctrl field is set to 3 and the 3-byte org code field that comes after it is set to 0. The following ‘TYPE’ field functions the same as that of the Ethernet_II frame.

c r u

g n i

: s e

h

o s Re

n r a

e r o

Le

M

Page408

14

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

A MAC address is a 48 bit address and is often represented by a 12-bit hexadecimal digit. A MAC address is globally unique and IEEE is responsible for the management and allocation of MAC addresses. A MAC address is made up of two parts which are the manufacturer assigned and the sequence number. The first 24 bits identify the organization that issued the identifier and is managed and allocated by IEEE. The following 24 bits are assigned by that organization in nearly any manner they please, subject to the constraint of uniqueness.

c r u

g n i

: s e

h

o s Re

Special MAC addresses:

1.nIf a MAC address whose 48 bits are all 1s, it is a broadcast r a address.

M

e r o

Le

2. If a MAC address whose eighth bit is 1, it is a multicast address. The eighth bit of the destination address indicates whether the frame is sent to a single station or a group of stations. The eighth bit of a source address must be 0 since a frame cannot be sent by a group of stations.

Page409

15

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p t on its MAC address table t The bridge forwards frames based h which is built using the source MAC addresses of received : table of a layer-2 switch maps frames. A common MACsaddress e and switch ports. between MAC addresses c We should bear inur mind that a switch learns the source address o of data frames meaning that every port of a switch s it receives, e listens independently for the source address of data frames they R receive. gthe MAC address table is empty, but once a switch n Initially, i a frame via port 1, the switch will check the frame’s n receives ardestination and search for the MAC address in its cache however Source MAC Learning

M

e r o

Le

no entry will currently exist. The switch as a result will flood the frame out of all ports except the port on which the frame was received and then use the source address of the frame to build it’s MAC address table, mapping port 1 to the MAC address of station A. Similarly, each station will map the port on which the frame is received to the source MAC address of that frame, forming a MAC address table for each switch device.

Page410

16

If a port connects to a hub, then the switch port will recognize multiple MAC addresses for a single interface. Every port of a switch corresponds to a collision domain. Note: For multicasting, address entries are not obtained by learning. They are obtained by IGMP or protocols such as CGMP.

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

c r u

g n i

: s e

: p tt

h

o s Re

n r a

e r o

Le

M

Page411

17

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p t to its MAC address table. t The switch forwards frames according h If the destination address of the frame is not in the table, the : The switch maintains its MAC switch will flood the frame. s e an automatic learning and aging address table through c mechanism. Framerstructures are not modified in most cases. u to the frame structure by putting a TAG in (VLAN makes changes o s the frame.) e R g n i n ar Forwarding Frames Based on the Destination MAC

e r o

Le

M

Page412

18

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

The switch receives a data frame from the local segment via one of it’s port interfaces.

h

The switch builds its MAC address table by learning the source MAC of the frames and maintains its MAC address table with the aging mechanism. The switch looks for the destination MAC in its MAC address table and if the destination MAC is in the table, then the switch sends the frame to the corresponding port (the source port is not included); if the switch cannot find the destination MAC in its table, then it sends the frame to all the ports except the source port.

c r u

g n i

: s e

o s Re

n r a

e r o

Le

M

Page413

19

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

There are three switching modes: Cut-Through, Store-andForward and

h

Fragment-free. Their characteristics are as follows: Cut-Through

c r u

: s e

The switch starts forwarding a frame before the whole frame has been received, normally as soon as the destination address is processed.

o s Re Low latency g forwards frames without detecting errors. The switch n i n Store-and-Forward arThe switch starts forwarding a frame after the whole frame has

M

e r o

Le

been received.

High latency, and the latency is decided by the frame length. The switch checks for errors and once it finds an error, the frame is discarded immediately.

Page414

20

Fragment-free The switch starts forwarding a frame after the first 64 bits (the shortest possible length) of the frame has been received. This mode inherits the advantages of the Cut-Through mode and the Store-and-Forward mode. With this mode, the switch can start forwarding without the whole frame having being received which is the same as it does with the Cut-Through mode; and at the same time, the switch can check errors as it does with the Storeand-Forward mode and should it find there are errors in the first 64 bits of the frame, it will drop the frame.

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

c r u

g n i

: s e

: p tt

h

o s Re

n r a

e r o

Le

M

Page415

21

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

L2 switches help to avoid collisions in a shared Ethernet but broadcast flooding is still widespread. How can this problem be resolved?

c r u

g n i

: s e

h

o s Re

n r a

e r o

Le

M

Page416

22

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

c r u

g n i

: s e

: p tt

h

o s Re

n r a

e r o

Le

M

Page417

23

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

L3 switches tend to take the form of a switch. Compared with routers, L3 switches are endowed with all the functions that L2 switches possess, including MAC-address based frame forwarding, STP and VLAN. However, L3 switches also have the L3 functions that L2 switches are not given, which enables them to realize the L3 internetworking for VLANs.

c r u

: s e

h

o s Re

Most of the lower or middle-end L3 switches realize L3 forwarding through L3 exact match, which means to search the cache according to the destination IP address of data frames directly. While, traditional routers use the longest matching method, that is to search the routing table for the destination IP address and forward data with the longest matching address in the table. Different manufacturers use different approaches to forward data. Exact search is more suitable for a network that has stable routes and whose topology does not often change.

g n i

n r a

M

e r o

Le

High-end L3 switches are often applied to complex networks. So if they use the exact search approach to find routes, the odds to hit the cache is not optimistic. Furthermore, most high-end switches use hardware to realize longest matching search which may be as efficient as the exact search approach. So for highend switches, exact search is not a must choice. Page418

24

Finally, L3 switches have evolved from L2 switches and they are always thought to be designed for LANs. So L3 switches do not many interface types except the interfaces relevant to VLANs such as Ethernet interface, ATM VLAN virtual interface, which avoids problems that have bothered routers with multi-type interfaces. Since every interface of a L3 switch is an Ethernet interface, collisions are avoided and the odds of segmentation is lowered. But for the efficiency of up-link, many L3 switches are equipped with high-speed POS interfaces.

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

c r u

g n i

: s e

: p tt

h

o s Re

n r a

e r o

Le

M

Page419

25

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p t 1. Communication with the sametsegment. h the destination host, it judges When a host communicates with :in the same segment with its own IP s whether the destination is e If they are in the same segment, the address and subnet mask. c r MAC address of the destination through host searches foruthe oMAC address in the frame header. ARP and fill the s 2. Communications Re across segments. g finds that the destination is not in the same segment If the host n withiitself, then it searches for the MAC address of the gateway n instead of the MAC address of the destination and fills the MAC r a address of the gateway in the frame header. Layer-3 switches IP Network Rules:

Mo

re

Le

make decisions on whether to make layer-2 forwarding or layer-3 forwarding according to the above rules. The layer-3 switch performs layer-3 forwarding if it is given the MAC address of an interface defined by a VLAN; otherwise the switch performs layer-2 forwarding within the VLAN.

Page420

26

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p t Ethernet? 1. How to communicate over shared t h realize multi-point CSMA/CD is an effective way to : medium. The station listens to the s communications over a shared e so to avoid collisions. The frame sent link before it sends frames, c rreceived by multiple stations. The station by a station can be u owhile it sends frames and it stops sending monitors the link s e as it detects a collision and waits for a random frames as R soon time interval before trying to g frame again. n send the i n 2. What is the principle operation of a L2 switch ar This chapter involves the following contents:

M

e r o

Le

The L2 switch works at the data-link layer and has two basic functions: learning based on the source MAC address and forwarding based on the destination MAC address. 3. What is the difference between a L3 switch and a router?

L3 switch is small but is powerful in some specific areas; however, the router is large and has comprehensive abilities.

Page421

27

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

c r u

g n i

n r a

e r o

Le

M

Page422

o s Re

: s e

h

: p tt

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

c r u

g n i

: s e

: p tt

h

o s Re

n r a

e r o

Le

M

Page423

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

c r u

g n i

n r a

e r o

Le

M

Page424

o s Re

: s e

h

: p tt

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

c r u

g n i

: s e

: p tt

h

o s Re

n r a

e r o

Le

M

Page425

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

Auto-negotiation was developed to help devices ing 10Mbps Ethernet be compatible with the 100Mbps Fast Ethernet. The auto-negotiation technology takes the operational modes of the local device, and receives the operational modes from the link partner and determines the highest common shared operational mode that can be ed.

c r u

Auto-negotiation works on the revised 10Base-T standard and is achieved depending on the design of physical layer chips. It does not use any specific datagram or cost any upper layer protocols. The basic mechanism of auto-negotiation is to encapsulate negotiation information into a series of revised link conformity test pulses of the 10BASET linking test wave (Fast Link Pulse). Each device should be able to send a series of pulse when the device is powered on, or receives management demands, or is interfered with by s. FLP involves a series of clock/digital sequence formed by linking conformity testing pulse. Once those data are drawn out, we may know the operational mode the link partner s and get information concerning the negotiation hand-shake mechanisms.

g n i

n r a

M

e r o

Le

o s Re

: s e

h

Page426

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

When both the negotiation parties more than one operational mode, there should be a precedence order to decide the final operational model. The table above lists the precedence of operational modes from high to low defined by IEEE 802.3. The basic principle is the 100Mbps mode has a higher precedence than the 10Mbps and full duplex is better than half duplex. 1000BASE-T4 is listed before 100BASE-TX because 100BASE-T4 s more cable types. Ethernet over fiber does not auto-negotiation. You need to configure the operation mode for the two link parties manually, which includes the rate, duplex mode and traffic control. If the two parties are configured differently, they cannot communicate with each other.

c r u

g n i

: s e

h

o s Re

n r a

M

e r o

Le

Note: 100BASE-T4 can be realized through Type3, Type4 and Type5 UTP and all the four pairs are used. 100BASE-TX can only run over Type5 UTP or STP and two pairs of the four pairs are used.

Page427

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p t To set the duplex mode to full duplex: t hfull [Quidway-Ethernet0/1] duplex : s Restore the duplex mode to e its default value: c [Quidway-Ethernet0/1] r undo duplex u o s Re g n i n ar Configuration Example

e r o

Le

M

Page428

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

You can configure the speed of Ethernet port with the following commands. If the port speed is configured to be decided by the auto-configuration mechanism, the two parties will negotiate to decide the port speed together. You can also configure the port speed manually by running the speed command.

c r u

: s e

h

By default, the port speed is in the auto state (decided by autonegotiation).

o s Configuration ReExample Set thegport speed of Ethernet to 100Mbps: n [Quidway-Ethernet0/1] speed 100 i n ar

e r o

Le

M

Page429

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

c r u

g n i

n r a

e r o

Le

M

Page430

o s Re

: s e

h

: p tt

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

Network congestion occurs when data are transmitted between two ports with different speed rates (for example, when a 100Mbps port sends data to a 10Mbps port.) or a link or node is carrying so much data that its quality of service deteriorates. Typical effects include queuing delay, packet loss or more retransmissions which wastes network resources dramatically.

c r u

: s e

h

o s Re

In real networks, especially for LANs, network congestion seldom occurs. So no switch manufacturers produce switches with flow control functions. High-capability switches should backpressure in the half duplex mode and flow control in the full duplex mode defined by IEEE802.3x.

g n i

n r a

e r o

Le

M

Page431

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

Bridged or half-duplex Ethernet uses a method called backpressure to manage transmission between stations with different speeds. For example, when a 100Mbps server sends data to a 10Mbps client PC through the switch, the switch will try its best to cache frames until its cache is nearly full, at which time it must ask the server to stop sending more data.

c r u

To achieve this the switch can generate a collision event with the server to make the server retreat, or alternatively the switch can apply a carrier test to keep the server port busy. The two approaches can both cause the server to stop sending data for a while which gives time for the switch to process the data in its cache.

g n i

n r a

e r o

Le

o s Re

: s e

h

M

Page432

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

In the full duplex environment, the link between the server and the switch is a collision-free channel and the backpressure technology cannot be applied to it. So the server continues to send packets to the switch until the frame cache of the switch overflows. To solve the problem, IEEE made a compound full duplex flow control standard, namely, IEEE 802.3x.

c r u

: s e

h

o s Re

IEEE 802.3x defines the format of a 64-byte MAC control frame named PAUSE. When congestion occurs at the port, the switch sends PAUSE to the source to tell it to stop sending information for a while.

g n i

n r a

e r o

Le

M

Page433

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

PAUSE is applied to prevent frames from being dropped when an instantaneous influx of traffic causes an overflow to the cache. The PAUSE frame can help the device prevent loss of frames when the traffic sures the cache limit. The device sends a PAUSE frame to its peer to prevent its cache overflow by requesting the peer device stop sending data after it receives the PAUSE frame. In this way, the device wins time to relieve the congestion/buildup in its cache.

c r u

g n i

n r a

e r o

Le

M

Page434

o s Re

: s e

h

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tport Enable the flow control of Ethernet t h [Quidway-Ethernet0/1]flow-control : s Shut down the flow control e of Ethernet port: c [Quidway-Ethernet0/1]undo flow-control r u othe flow control of Ethernet port is disabled. Note: By default, s Re g n i n ar Configuration Example

e r o

Le

M

Page435

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

c r u

g n i

n r a

e r o

Le

M

Page436

o s Re

: s e

h

: p tt

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

c r u

g n i

: s e

: p tt

h

o s Re

n r a

e r o

Le

M

Page437

n e /

m o c . i

e w ua

h . ng

i n ar

: p tt

Advantages of Port Aggregation 1. Increase bandwidth

: s e

e l //

h

Port aggregation can bind multiple transmission ports together to make one logical link to increase transmission bandwidth and speed. The bandwidth after aggregation is the total sum of the bandwidth of each aggregated port. With a switch that s this function, you can increase the network bandwidth easily when too much traffic on one port impairs network capability. For example, you can bind two to four 100Mbps ports together to make a 200-400Mbps link to increase the bandwidth and speed. Port aggregation can be applied to 10Mbps, 100Mbps and 1000Mbps Ethernet.

c r u

g n i

o s Re

n r a

M

e r o

Le

2. Improve reliability Backbone networks run at a very fast speed and once the link fails, large amount of data will be lost. The connection of highspeed server and backbone network should be absolutely guaranteed. With port aggregation function, you can prevent such a disaster. For example, if a cable is pulled out by mistake, the link will not be affected. So for an aggregated port consists of multiple ports, the failure of one port will not affect the whole

Page438

connection. Data will be loaded on other working connections automatically. You only need to change the visiting address and the whole process is completed in no time. This function makes network to run continuously.

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

c r u

g n i

: s e

: p tt

h

o s Re

n r a

e r o

Le

M

Page439

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

The parameters of the two peers of aggregation ports must be the same. Parameters here include physical parameters and logical parameters.

: s e

h

Physical parameters include: Number of the aggregation ports, Speed of the aggregation ports, Duplex mode of the aggregation ports.

c r u

o s Re

Logical parameters include: Spanning Tree Protocol (STP), Quality of Service (QoS), VLAN, Port.

g n i

STP configuration includes: enable/disable the STP function at the port, port link type (point-to-point or not point-to-point), STP preference level, route cost, speed limit for sending packets, loop protection, root protection and edge port.

n r a

Mo

re

Le

QoS configuration includes: flow speed control, preference mark, the default preference level of 802.1p, bandwidth guarantee, congestion prevention, flow redirection and flow statistics. VLAN configuration includes: VLANs that are allowed to the port and default VLAN ID. Port configuration includes port link types such as Trunk, Hybrid and Access. Page440

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p t t （1）Configure the IP address of the interface h Create the layer-3 addresses 10.1.1.1/30 and 10.1.1.2/30 of : s VLAN1 on SW1 and e SW2 respectively. rc u attributes of the aggregated ports （2）Configure o s port aggregation, you should make sure that e Before configuring R all the aggregated ports of Sw1 and Sw2 work in the full duplex g at the same speed rate instead of the auto-negotiation modenand i mode. n ar（3）Configure port aggregation Configuration Procedure:

M

e r o

Le

Result Testing: <Sw1>display link-aggregation Master port: Ethernet0/1 Other sub-ports: Ethernet0/2 Mode: both Page441

The configuration commands may be different for some switches, please refer to product operation manuals for relevant information.

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

c r u

g n i

n r a

e r o

Le

M

Page442

o s Re

: s e

h

: p tt

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

c r u

g n i

: s e

: p tt

h

o s Re

n r a

e r o

Le

M

Page443

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

Port mirroring is applied to traffic observation and fault location by making a copy of service data and sending them to the monitor device to be analyzed. Port mirroring has two types: port-based mirroring and flow-based mirroring.

c r u

g n i

n r a

e r o

Le

M

Page444

o s Re

: s e

h

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

c r u

g n i

: s e

: p tt

h

o s Re

n r a

e r o

Le

M

Page445

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

Flow-based mirroring is only applied to flows that meets certain defined classifications, which may include the same destination address, the same port number and so on. The classifications can be set as required.

c r u

g n i

n r a

e r o

Le

M

Page446

o s Re

: s e

h

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

Case:PC1 connects to interface E0/1 of SW, though this interface you can analyse the data which enters into interface E0/24. Configuration:

: s e

h

c r [SW]observe-portu 1 interface Ethernet 0/1 o s E0/24 of SW as mirroring port, and 2.Configure e interface transferringRdata to observe-port. g [SW-Ethernet0/24] port-mirroring to observe-port 1 inbound n i n r a 1.Configure interface E0/1 of SW as observe-port

e r o

Le

M

Page447

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

This chapter involves the following contents: 1. What is auto-negotiation?

: s e

h

Auto-negotiation aims to resolve rate inconsistencies between Ethernet devices. This includes negotiation of the port speed and duplex mode.

c r u 2. What are the differences between half-duplex and full-duplex o traffic control?s e Half-duplexRtraffic control uses the backpressure method. When gcongestion occurs, the switch will apply the carrier network n detect i mechanism or emulate a collision. In the full-duplex mode, n IEEE defines the format of a 64-byte MAC control frame arnamed802.3x PAUSE. When congestion occurs at the port, the switch

M

e r o

Le

sends PAUSE to the source to tell it to stop sending information for a while.

3. What are the functions of port aggregation and port mirroring? Port aggregation can increase link bandwidth, realize load balancing and improve network reliability. Port mirroring is applied to traffic observation and fault location by making a copy of service data and sending this data to the monitor device port to be analyzed. Page448

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

c r u

g n i

: s e

: p tt

h

o s Re

n r a

e r o

Le

M

Page449

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

c r u

g n i

n r a

e r o

Le

M

Page450

o s Re

: s e

h

: p tt

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

c r u

g n i

: s e

: p tt

h

o s Re

n r a

e r o

Le

M

Page451

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

c r u

g n i

n r a

e r o

Le

M

Page452

o s Re

: s e

h

: p tt

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

The traditional Ethernet switch adopts source address learning mode when it forwards data. It can automatically learn the MAC address of host connecting to each port to, form the forwarding table, and then forward Ethernet frames according to the table. The whole forwarding process is completed automatically, all the ports can communicate with each other, and maintenance personnel can not control the forwarding between any two ports. For example, they can not implement prevention to restrict host B from reaching host A. The following disadvantages exist in this kind of network:

c r u

: s e

h

o s Re

g n i Security is bad. All the ports can communicate with • Network n reach other, which increases the possibility that s will attack

Mo

re

a the network. e L

• Network efficiency is low. s may receive abundant unnecessary frames, which is a waste of bandwidth and host U resources, e.g. unnecessary broadcast packets. • Service expanded capability is bad. The network cannot implement differentiated services, for example, it can not forward an Ethernet frame used for network management with higher priority. Page453

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

VLAN technology divides s into multiple logical networks (groups). Communication is allowed within a group, but it is prohibited among groups. Layer-2 unicast packet, layer-2 multicast packet and layer-2 broadcast packets can only be forwarded within a group. It is easy to add and delete group using VLAN technology.

c r u

o s Re

: s e

h

VLAN technology provides a management method to control the intercommunication among terminals regardless of physical location in the LAN. In the figure above, PCs in group 1 and group 2 can not communicate with each other.

g n i

n r a

e r o

Le

M

Page454

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

In order to control forwarding, the switch will add a VLAN tag to an Ethernet frame before forwarding it, then use this tag to manage the frame, which may include discarding the frame, forwarding the frame, and adding & removing tags. Before forwarding the frame, the switch will check the VLAN tag of the packet and decide whether the tag is allowed to be forwarded from the port. In the figure above, if the switch adds tag 5 to all the frames sent from A, and then look up the layer-2 forwarding table, and according to the destination MAC address, forward them to the port connected to B. However this port is configured to only allow VLAN 1 to , so the frames sent by A will be discarded.

c r u

g n i

: s e

h

o s Re

n r a

M

e r o

Le

The switch ing VLAN will hence forward Ethernet frames not only according to the destination MAC address but also the VLAN configuration of the port, so as to implement layer-2 forwarding control.

Page455

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

c r u

g n i

n r a

M

e r o

Le

: p tt

4-byte VLAN tag is added to the Ethernet frame header directly. Document IEEE802.1Q describes VLAN tagging. •TPID：Tag Protocol Identifier，2 bytes，fixed value，0x8100， new type defined by IEEE, it indicates that it is a frame with 802.1Q tag. •TCI：Tag Control Information，2 bytes. • Priority：3 bits, defines the priority of an Ethernet frame. It has 8 priority levels, 0－7, is used to provide differentiated forwarding service. • CFI：Canonical Format Indicator，1 bit. Used to indicate bit order of address information in token ring or source route FDDI media access, namely, whether the low bit is transmitted before high bit. • VLAN Identifier：VLAN ID，12 bits, from 0 to 4095. Combined with VLAN configuration of port, it can control the forwarding of an Ethernet frame. Ethernet frame has two formats: the frame without tag is called an untagged frame; the frame with tagging is called a tagged frame. This course will only discuss the VLAN ID of VLAN tag.

Page456

o s Re

: s e

h

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

All the Ethernet frames exist in the switch in the form of tagged frames. Certain ports may receive untagged frames from peer devices, but the frame from the port of the local switch must be a tagged frame. If the frame received is tagged, it will be forwarded; if it is untagged, a tag will be added to it. The device can implement a VLAN in the following way.

c r u

: s e

h

o s Re

• Port based: Network manager configures a PVID for every port of a switch, known as the Port VLAN ID or port default VLAN. If an untagged frame is received, the VLAN ID will be the PVID.

g n i

• MAC based: Network manger configures the mapping relation for each MAC address to a VLAN ID, if an untagged frame is received, the VLAN ID will be added according to the mapping relationship table.

n r a

M

e r o

Le

• Protocol based: Network manager configures a mapped relationship between the protocol field of the Ethernet frame and a VLAN ID; if an untagged frame is received, the VLAN ID will be added according to the mapping relationship table. • Subnet based: Adding of a VLAN ID according to the IP address information in a packet. • Policy based: Provides strict control capability, based on MAC address and IP address, MAC address, or IP address and port. Page457

If implementation of the VLAN is successful, it can forbid s from changing the MAC address or the IP address. If the device can multiple methods at one time, the general priority order from high to low is : Policy based—MAC based—Subnet based—Protocol based—Port based. Presently, port based VLAN tagging is the most common method.

m o c . i

n e /

e w ua

h . ng

i n ar

e l //

c r u

g n i

n r a

e r o

Le

M

Page458

o s Re

: s e

h

: p tt

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

c r u

g n i

: s e

: p tt

h

o s Re

n r a

e r o

Le

M

Page459

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

The tag in Ethernet frames combined with VLAN configuration of the port can control packet forwarding. A received Ethernet frame on port A will check whether the destination MAC is attached to port B. After the introduction of VLAN tagging, two key points will decide whether the frame should be forwarded from port B:

c r u

: s e

h

• Whether the VLAN ID in the frame is created by switch. There are two methods to create VLANs: Manual configuration or automatically created using GVRP.

g n i

o s Re

• Whether the destination port will allow the VLAN frames to . VLAN lists determine whether to allow frames to through a port and can be created by the or automatically created by GVRP (GARP VLAN Registration Protocol).

n r a

M

e r o

Le

In the forwarding process, there are two types of tag operation: • Add tag：For untagged frames add the PVID, it is completed after receiving the frame from the peer device. • Remove tag：delete the VLAN tagging information in the frame then send it to peer device in the form of an untagged frame. In normal cases, the switch will not change the VLAN ID in a tagged frame, while some devices ing special services may provide the function for changing the VLAN ID.

Page460

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

After introducing VLAN functionality, switch ports may be one of three types: Access port, Trunk port and Hybrid port.

h

An access port is used to connect host and has features as follows:

c r u

: s e

• Only permit allowed VLAN IDs to through the port, or the VLAN ID is the same with PVID of the port.

o s Re

• If the frame received from peer device is untagged, the switch will add a PVID to the frame automatically.

g n i default port type of many types of switch is access，PVID •n The ris 1 by default，VLAN 1 is created by the system and cannot be

• The frame sent by an access port is always an untagged frame.

e r o

a deleted. e L

M

Page461

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

The following command can be used to set ports as access ports and implement the PVID of the access port after creating the VLAN: [SWA]vlan 3

c r u

: s e

h

[SWA-vlan3]port ethernet 0/1

o s Re

[SWA]vlan 5

[SWA-vlan5]port ethernet 0/2

g n i

The port mode should be specified as either access or trunk when making any change to the PVID.

n r a

e r o

Le

M

Page462

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

Trunk port: used to connect switches and transmit tagged frames among switches. It can be set to permit multiple VLAN IDs, even those VLAN ID’s that may differ from its own.

: s e

h

A trunk port will send tagged frames to other devices, using the following rule base:

c r u

If the VLAN ID of the tagged frame does not exist in the VLAN permitted list, it will be discarded;

o s • If the VLAN ReID of the tagged frame is the same as the PVID ,also exist in the VLAN permitted list, the frame will be g n forwarded after removing the tag. The PVID of each port is i however n unique, in this case, the frame will be untagged when r a sent by the trunk port.

M

e r o

Le

• If the VLAN ID of the tagged frame is different from PVID, the frame will be forwarded to the peer device without modification. VLAN forwarding will generally query the tagging information of the VLAN frame for forwarding, and compare the frame to the VLAN permit list to look for a match. If a VLAN which is ed by GVRP however, it must also on the port, otherwise the VLAN ID will not exist in the VLAN permit list, and the corresponding VLAN frame cannot be forwarded from the port. Page463

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

c r u

g n i

n r a

e r o

Le

M

Page464

o s Re

: s e

h

: p tt

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

As an access port, a packet is sent to another device in the form of an untagged frame, as a trunk port it can send out untagged frame only in when the trunk VLAN ID is the same as the frame VLANID. In other cases, it sends frames as tagged. Hybrid VLANs can be used to effectively control the VLAN tagging process. For example, a device connected to the switch cannot VLANs, but the ports still can be used to isolated the devices.

c r u

: s e

h

o s Recan flexibly control the VLAN tag. In this example, if Hybrid ports g ID of frame is 3, then forward it according to the the VLAN n i mode of trunk port. If it is 4, remove tag 4 and then forwarding n arforward it.

e r o

Le

M

Page465

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

If a Hybrid port is only configured to allow untagged VLAN forwarding, the port will take on the same role as an access port.

h

If a port is configured to only tagged VLANs, it will have the same function as a trunk port.

c r u

If a switch port is configured with a PVID that is both tagged and s untagged VLANS for example VLAN2 on Ethernet0/1, it is capable of communicating with other hybrid ports that the same untagged VLANS, as opposed to ports such as 0/3, which only s VLAN3. The configuration above thus shows how it is possible to implement isolation between port 0/1 and port 0/3, but still allow both to communicate with the host connected to port 0/24.

g n i

n r a

e r o

Le

: s e

M

Page466

o s Re

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

To configure access and trunk ports on SWA and SWB, it is necessary to create VLAN 2 on SWB, and allow VLAN 2 to traverse the two ports of SWB, to allow PC1 and PC2 to communicate with each other. SWB will not connect to any s, it is a transitional switch; in large-scale networks, there may be many transitional switches for which the configuration and management is difficult. The manager only cares about the intercommunication control, for example, after new s the network, the manager should configure the access port which connects the new and make the port as part of a certain VLAN group.

c r u

g n i

: s e

h

o s Re

n If the transition switch can automatically implement r a

M

e r o

Le

intercommunication among logical group , it will save cost for network maintenance. GVRP can implement this function. After all the switches are enabled with GVRP functionality, VLAN configuration on the edge switches can transmit to the whole network though GVRP, and automatically implement configuration of VLANs on each port.

Page467

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

The command “gvrp” is used to enable GVRP on a switch. The command “undo gvrp” can be used to disable it. The GVRP protocol is disabled by default. In the system view, the command “GVRP” is used to enable or disable GVRP for all ports, whereas the command “GVRP” will enable or disable GVRP on a particular port when used at the interface as shown in the example.

c r u

Note:

g n i

M

e r o

o s Re

• Before enabling port based GVRP, GVRP must be enabled at the system view first. If GVRP is in disabled status at the system level, GVRP will also disabled on all ports, and the will not able to change the status of the port based GVRP.

n r a

Le

: s e

h

• GVRP should be enabled and disabled on the trunk port. After Enabling GVRP on Trunk port, switch is not allowed to change trunk port to any other port type.

Page468

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p t three port types, they are Answer: A Huawei switch can t h access, trunk and hybrid port types. :when sent from a trunk port to peer s 2. Must a frame be tagged e devices? c ra frame is tagged, but if the VLAN ID is the u Answer: In general, o of the trunk, the tag will be removed and s same as the PVID e forwarded R in the form of an untagged frame. g n i n ar 1. How many port types does a Huawei switch ?

e r o

Le

M

Page469

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

c r u

g n i

: s e

: p tt

h

o s Re

n r a

e r o

Le

M

Page470

1

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

c r u

g n i

: s e

: p tt

h

o s Re

n r a

e r o

Le

M

Page471

2

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

c r u

g n i

: s e

: p tt

h

o s Re

n r a

e r o

Le

M

Page472

3

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

c r u

g n i

: s e

: p tt

h

o s Re

n r a

e r o

Le

M

Page473

4

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

VLANs create and isolate layer-2 broadcasts domains, therefore isolating the traffic of different VLANs. This results in s being unable to sustain communication when associated with different VLANs.

c r u

g n i

: s e

h

o s Re

n r a

e r o

Le

M

Page474

5

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

Flows between different VLANs cannot directly cross VLAN boundaries, and so the ability to route traffic is needed to allow the forwarding of packets from one VLAN to another.

: s e

h

Hosts of different VLANS are assigned as entities of different networks. When a default gateway been configured on a host local for a given VLAN, any communication destined for hosts that are not associated with the same VLAN will automatically forward traffic to the default gateway which shall in turn route traffic between VLANS.

c r u

g n i

o s Re

n r a

e r o

Le

M

Page475

6

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

One of the methods to solve VLAN intercommunication is to assign a separate physical interface for each VLAN. The traffic from different VLANs can be forwarded between these physical interfaces and routed. This method will enable intercommunication between VLANs, however as the number of VLANs increase, so does the number of router interfaces needed. Such solutions would result in higher costs and a poor network design. Some VLANs do not have a need to forward traffic to other VLANs frequently which leads to further waste, therefore this method is not generally suited to solving the problem of VLAN intercommunication.

c r u

g n i

: s e

h

o s Re

n r a

e r o

Le

M

Page476

7

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

To resolve the physical interface limitation problem, a method of trunking is implemented using only a single physical interface on the router and a single port on the switch. One single Ethernet interface on the router can all VLAN gateways and bear all VLAN traffic through the creation of sub-interfaces.

c r u

: s e

h

As shown above, only a single physical router Ethernet interface is being used, but is ing three sub-interfaces as default gateways for each of the three VLANs. Each frame will contain a VLAN tag used to identify which VLAN it belongs to. When s in VLAN100 need to communicate with s in another VLAN, the only needs to forward the frame to the default gateway, the default gateway will modify the VLAN tag of the data frame and then route it to the VLAN on which the destination host .

g n i

o s Re

n r a

e r o

Le

M

Page477

8

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

The third option for VLAN routing is through the use of a layer-3 switch. A layer-3 switch effectively integrates the functionality of a layer-2 switch and a layer-3 routing, therefore combines the advantages of advantages of both. The limitation lies mainly in the cost of such devices due to its extended functionality.

c r u

g n i

: s e

h

o s Re

n r a

e r o

Le

M

Page478

9

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

Huawei s layer-3 switching through the means of switch and route processing units, or SRU, and may multiple SRU boards for redundancy. All the routable packets are sent by the forwarding engine to the SRU board for processing. The SRU board also broadcasts and filters packets and executes routing policies. The SRU will VLAN switching, default VLANs as well as other more advanced VLAN technologies including Q-inQ and dynamic VLAN allocation based on MAC addressing. The example above reflects how a layer-3 switch can be used associate VLAN gateways directly with VLAN interfaces within a single device.

c r u

g n i

: s e

h

o s Re

n r a

e r o

Le

M

Page479

10

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

c r u

g n i

: s e

: p tt

h

o s Re

n r a

e r o

Le

M

Page480

11

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

In this example two VLANs are present, VLAN100 and VLAN200. A host in VLAN100 wishes to forward traffic to a host in VLAN200. Each VLAN is part of a separate broadcast domain and therefore as different network. Each host has been assigned a network host address respective to the VLAN it belongs to, and the gateway address for the network. The forwarding of traffic requires VLAN trunking to multiple VLANs over a single physical link and sub interface configuration for the layer 3 router. How is this achieved?

c r u

g n i

: s e

h

o s Re

n r a

e r o

Le

M

Page481

12

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

//create VLAN100 [SWA]vlan 100

: s e

h

//configure ethernet 0/1 belonging to VLAN100 [SWA-vlan100]port ethernet 0/1

c r u

//create VLAN200

o s e 0/2 belonging to VLAN200 //configureRethernet [SWA-vlan200]port ethernet 0/2 g n i into interface view //enter n ar[SWA]interface ethernet 0/24 [SWA]vlan 200

M

e r o

Le

//configure port type as Trunk [SWA-Ethernet0/24]port link-type trunk //permit all VLAN to [SWA-Ethernet0/24]port trunk allow- vlan all

Page482

13

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

Using the control-vid command, you can specify the mappings between the control VLAN and the Ethernet sub-interface to differentiate termination sub-interfaces of the same main interface. Using the undo control-vid command, you can remove the mappings between the control VLAN and Ethernet sub-interfaces. By default, no mapping between a control VLAN and an Ethernet sub-interface is specified. The dot1qtermination indicates that the encapsulation mode of a subinterface is dot1q. This mode applies to single-tagged packets (as opposed to dual tagged packets used in Q-in-Q configuration).

c r u

g n i

: s e

h

o s Re

n Using the arp broadcast enable command, you can enable the r a

M

e r o

Le

ARP broadcast function on a sub-interface for VLAN tag termination. Using the undo arp broadcast enable command, you can disable the ARP broadcast function on a sub-interface for VLAN tag termination. By default, the ARP broadcast function is disabled on sub-interfaces for VLAN tag termination.

Page483

14

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

Connectivity between the hosts of different VLANs can be verified through means such as the ping command. If the host 192.168.10.10 in VLAN100 can ping host 192.168.20.20 in VLAN 200, it indicates that the configuration is correct.

c r u

g n i

: s e

h

o s Re

n r a

e r o

Le

M

Page484

15

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

On the layer-3 switch (SWA) port 1 and port 2 represent a local network that has been logically segmented through the implementation of VLANs. The hosts via port 1 have been assigned to VLAN 100 and hosts via port 2 to VLAN 200. The hosts of VLAN 100 and VLAN 200 are able to the forwarding of traffic between VLANs 100 & 200 through SWA. The example demonstrates how a single host from each VLAN would be configured to this forwarding of traffic.

c r u

g n i

: s e

h

o s Re

n r a

e r o

Le

M

Page485

16

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

When a layer-3 switch needs to communicate with devices at the network layer, a logical interface can be created, namely, a VLANIF interface. A VLANIF interface is a network layer interface and can be configured with an IP address. The layer-3 switch then uses the VLANIF interface to communicate with devices at the network layer. The IP address that is assigned to each VLANIF is recognised as the gateway address by the respective VLAN hosts. The command “interface vlanif ” specifies the ID of the VLAN that a VLANIF interface belongs to. The value of the vlan-id is an integer that ranges from 1 to 4094.

c r u

g n i

: s e

h

o s Re

n r a

e r o

Le

M

Page486

17

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

In the same way that is was possible to VLAN routing using a layer-3 router, it is also possible to connectivity between hosts of different VLANs ed by a layer-3 switch. If host 192.168.10.10 in VLAN100 is able to successfully ping host 192.168.20.20 in VLAN 200, it indicates that the configuration is correct.

c r u

g n i

: s e

h

o s Re

n r a

e r o

Le

M

Page487

18

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p t Answer: The main advantage of t VLANs is to isolate broadcast h domains, but it is often the case that traffic must flow between : routing is used to resolve this these broadcast domains.sVLAN e problem by facilitatingccommunication between broadcast r domains. u ocan be used to implement VLAN routing? 2.What methods s Answer: Ordinary Re layer-2 switches are only able to communication within a single VLAN (broadcast) domain. The g n flowiof VLAN traffic between broadcast domains is achievable n the configuration of VLAN routing on reachable layer-3 through r a device. It is therefore possible to achieve VLAN routing through 1.What is the purpose of VLAN routing?

M

e r o

Le

the following methods. Communication through a router connected to the network can achieve VLAN routing, using either a single physical interface for each VLAN, or more suitably through the implementation of multiple sub-interfaces on a single physical interface. A layer-3 switch can also be used to implement VLAN routing, through the configuration of a layer-3 VLAN interface for each VLAN.

Page488

19

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

c r u

g n i

: s e

: p tt

h

o s Re

n r a

e r o

Le

M

Page489

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

c r u

g n i

n r a

e r o

Le

M

Page490

o s Re

: s e

h

: p tt

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

c r u

g n i

: s e

: p tt

h

o s Re

n r a

e r o

Le

M

Page491

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

c r u

g n i

n r a

e r o

Le

M

Page492

o s Re

: s e

h

: p tt

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

A switch forwards data frames based on the MAC address table. The MAC address table specifies the mapping between destination MAC addresses and destination ports.

: s e

h

1: Assume that PCA sends a data frame to PCB. The destination MAC address of this data frame is set to the MAC address of PCB, namely, 00-0D-56-BF-88-20.

c r u

o s Re

When SWA receives this frame, it searches the MAC address table. According to the entries in the MAC address table, SWA forwards the data frame through port E0/3.

g n i

The switch does not make any modification to the data frame before forwarding it. If the switch receives a broadcast frame or a frame whose MAC address wasn't included in the MAC address table, it forwards the frame to all ports.

n r a

M

e r o

Le

2: When SWB searches the MAC address table, it will use the information stored to make forwarding decisions. In the example, SWB forwards a frame through port E0/6. No modification is made to the data frame. 3: When PCB receives the frame, it will search through the MAC address table to find that the destination MAC address is it’s own MAC address. PCB will then process this data frame and send the de-encapsulated data to the upper layer protocol. Page493

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

If a switch receives a broadcast data frame from a port, the switch forwards the data frame to all other ports. In addition, does not make any modification to the data frame before forwarding it. Therefore, if a loop exists in the network, the broadcast frames are forwarded in the network infinitely, thus causing the broadcast storm.

c r u

g n i

n r a

e r o

Le

M

Page494

o s Re

: s e

h

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

A switch forwards data frames based on the MAC address table, but the MAC address table is empty when the switch is started. Therefore, the switch needs to learn the MAC address table.

: s e

h

A switch learns the MAC address table based on the mapping between the source address of the received data frame and the receiving port.

c r u

o s Re

1: Assume that PCA sends a data frame to PCB. The destination address of the frame is the MAC address of PCB, namely, 000D-56-BF-88-20. The source address is the MAC address of PCA, namely 00-0D-56-BF-88-10. When SWA receives the data frame, it checks the source address of the frame and adds mapping between the source address and receiving port to the MAC address table. Thus, the mapping between the destination address and

g n i

n r a

M

e r o

Le

destination port is recorded in the table. 2: When SWB receives this frame, it also adds the mapping between the source address and receiving port to the MAC address table as a MAC address entry. 3: When PCB receives the frame, it processes this frame.

Page495

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

A switch generates a MAC address entry according to the source address and receiving port of the received data frame.

h

PCA sends a data frame. Assume that the destination MAC address of the data frame does not exist in any MAC address table of the switches in the network. When SWA receives this data frame, it generates a MAC address entry, in which the MAC address 00-0D-56-BF-88-10 maps port E0/2.

c r u

: s e

o s eMAC address table of SWA does not contain any Because the R entry with this destination MAC address, SWA forwards the data g framento E0/3 and E0/4. iMAC address table of SWB also does not contain any entry n The arwith this destination MAC address. So, after SWB receives the

M

e r o

Le

data frame on E0/5, it forwards the frame to SWA through E0/6.

After SWA receives this data frame on E0/4, it deletes the previous entry with this address and generates a new entry. In the new entry, MAC address 00-0D-56-BF-88-10 maps port E0/4. In this case, the MAC address table is unstable and wrong entries are generated.

Page496

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

c r u

g n i

: s e

: p tt

h

o s Re

n r a

e r o

Le

M

Page497

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

The main function of STP (Spanning Tree Protocol) is to avoid switching loops where redundant links are present in the network.

h

As the figure of this slide shows, a ring is composed of SWA, SWB and SWC, which may cause problems such as broadcast storms. After the spanning tree protocol is enabled, calculations cause the network to converge resulting in the interfaces performing various operational roles including the blocking of one or more ports in order to remove the possibility of any loop occurred. In this example, it is assumed that port E0/2 of SWB is blocked to remove the loop.

c r u

g n i

n r a

e r o

Le

M

Page498

o s Re

: s e

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

After the port E0/2 of SWB is blocked, there is no loop in the network.

c r u

g n i

: s e

h

o s Re

n r a

e r o

Le

M

Page499

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tactive path, the blocked If some problems occur along the t h interface could be made active, so as to resume the connectivity :redundant link. Thus the loop between of the network through the s efor redundancy. STP remove the logical switches is usually used c loop in the network r through blocking of port(s), but the physical u links are not changed. In the previous example, it is mentioned so of SWB that the port e E0/20 is blocked to remove the loop. If R another port is down ( for example, the port E0/20 of SWC), STP g the blocked port through convergence, to make it couldnrecover i forward packets again. possible n ar Another feature of STP is link backup:

e r o

Le

M

Page500

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

The basic idea of STP is quite simple. If the network could develop like a tree, the loop will be prevented. Thus, STP defines some concepts, including Root Bridge, Root Port, Designated Port, Path Cost, etc. The purpose is to cut out redundant loop through constructing a tree, and implementing link backup and path optimization at the same time. The algorithm used to construct the tree is the spanning tree algorithm.

c r u

: s e

h

o s Re

In order to calculate the spanning tree, relative information and parameters need to be exchanged between switches. These information and parameters are encapsulated in the BPDU (Bridge Protocol Data Unit), and transmitted between switches.

g n i

n following tasks are done through the exchange of BPDU r The a

M

e r o

Le

between bridges:

1. Select a bridge as the root bridge among all bridges; 2. Calculate the shortest path from the current bridge to the root bridge; 3. For every shared network segment, select the bridge nearest to the root bridge as the designated bridge, responsible for the data forwarding of this network segment; 4. For every bridge, select a root port. 5. Select the designated port besides the root port.

Page501

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

To calculate the spanning tree, switches need to exchange information and parameters. The information and parameters are encapsulated in the

: s e

h

Configuration Bridge Protocol Data Unit (BPDU) and transmitted between switches.

c r u

In a broad sense, a BPDU refers to a data unit used to exchange information between switches. The configuration BPDU is one type of the BPDU.

g n i

o s Re

Calculation of the spanning tree starts from election of the root bridge. The root bridge is elected based on the bridge identifier.

An bridge identifier consists of a 2-byte bridge priority and a 6-byte r a MAC address. The bridge priority is configurable. The value

M

e r o

Le

ranges from 0 to 65535 and the default value is 32768.

In the network, the switch with the smallest identifier becomes the root bridge. The system first compares the priority. If the switches have the same priority, the system compares their MAC addresses. The switch with the smallest MAC address is elected first. In this example, the three switches have the same priority. SWA has the smallest MAC address, so SWA is elected as the root bridge.

Page502

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

STP elects a root port for each non-root bridge. Each port of a switch has a port cost parameter. The port cost refers the cost for sending the data from this port, namely the cost of the outgoing port. STP considers that no cost is needed for receiving the data on a port. The port cost depends on the bandwidth of the port. The higher the bandwidth is, the smaller the port cost will be. On the VRP, the cost of a 100M port with half duplex is 200, the cost of a 100M port with full duplex is 199.

c r u

: s e

h

o s Re may exist between a non-root bridge and a root Multiple paths gThe cost of a path is the total cost of all outgoing ports on bridge. n thisipath. nroot port is a local port on the path with the least cost from a r A a

M

e r o

Le

non-root bridge to the root bridge. The cost of this path is referred to as the root path cost. If multiple root ports exist, the system compares the identifiers of the upstream switches.

The port whose upstream switch has the smallest identifier is elected. If the upstream switches have the same bri dge identifier, the system compares the identifier of the upstream ports. The port whose upstream port has the smallest identifier is elected. The port identifier consists of a 1-byte port priority and a 1-byte port number. Page503

The port priority is configurable. The default value is 128. In this example, we assume that all ports are 100 M ports and their cost values are all 200.

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

c r u

g n i

n r a

e r o

Le

M

Page504

o s Re

: s e

h

: p tt

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

STP elects the designated port for each network segment. The designated port forwards the data transmitted between the root bridge and this network segment. The switch where the designated port is located is called the designated switch.

h

: s e port and designated bridge for a When electing the designated c r compares the root path cost of the switch network segment, STP u on which the port o is connected to this network segment. If the s switches have the same root path cost, STP compares their e R bridge identifiers. The port on the switch with the smallest g has the highest priority. If their identifiers are also the identifier n i STP compares the identifiers of the ports connected to the same, n arnetwork segment. The port with the smallest identifier has the

Mo

re

Le

highest priority.

On the root bridge, all ports are the designated ports of the connected network segments. Therefore, the designated ports of LANA and LANB are both on SWA. LAND and LANE are both connected to the port of only one switch, and the connected ports are designated port for LAND and LANE respectively. LANC is connected to the ports of two switches and the two switches have the same root path cost. Therefore, the identifiers Page505

of the switches are compared. SWB has a smaller identifier (because its MAC address is smaller), so the designated port for LANC is on SWB. The port that is neither the root port nor the designated port is called the alternate port. The alternate port does not forward data and is in Blocking state.

m o c . i

n e /

e w ua

h . ng

i n ar

e l //

c r u

g n i

n r a

e r o

Le

M

Page506

o s Re

: s e

h

: p tt

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

STP defines three roles for the STP-enabled port that works normally on the physical layer and data link layer. The root port and designated port are in Forwarding state. The port that is not enabled is called the Disabled port.

c r u

g n i

: s e

h

o s Re

n r a

e r o

Le

M

Page507

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

After enabled, a port switches to Listening state and begins to calculate the spanning tree. After the calculation, if the port is set to the alternate port, the port state changes to Blocking. If the port is set to the root port or designated port, the port state switches from Listening to Learning after a period of forward delay. After another period of forward delay, the port state switches from Learning to Forwarding, and the port can forward data frames.

c r u

g n i

n r a

e r o

Le

M

Page508

o s Re

: s e

h

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

After enabled, a port switches to Listening state and begins to calculate the spanning tree. After the calculation, if the port is set to the alternate port, the port state changes

: s e

h

to Blocking. If the port is set to the root port or designated port, the port state switches from Listening to Learning after a period of forward delay. After another period of forward delay, the port state switches from Learning to Forwarding, and the port can forward data frames.

c r u

g n i

o s Re

1:The port is elected as the designated port or root port. 2: The port is elected as the alternate port.

n 3: The port waits a period of the forward delay. By default, the r a forward delay is 15 seconds.

Mo

re

Le

When a port is disabled, it switches to Disabled state. Before switching from non-Forwarding state to Forwarding sate, a port needs to wait two times as along as the forward delay . Thus, the potential risk of temporary loop is avoided.

Page509

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

c r u

g n i

n r a

e r o

Le

M

Page510

o s Re

: s e

h

: p tt

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

This figure shows the physical topology. The priority of SWA is 4096; the priority of SWB is 8192; the priority of SWC is 32678. Therefore, SWA becomes the root bridge and SWB becomes the designated switch of LANC.

c r u

g n i

: s e

h

o s Re

n r a

e r o

Le

M

Page511

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p t or disable STP on a switch t The stp command is used to enable h or on a port. By default, STP is enabled on the switch. :} s stp mode { stp | rstp | mstp e is used to set the STP working mode c The stp mode command r the working mode of the switch is MSTP. u on a switch. By default, o will be described in later courses. This course s RTSP and MSTP only describe ReSTP. g priority stp priority n i specifies the priority of a switch. The value ranges from 0 priority: n arto 61440, with the step of 4096. That is, 16 priority values are stp { enable | disable }

M

e r o

Le

available for a switch, for example, 0, 4096, 8192, and so on. The stp priority command is used to set the bridge priority. By default, the bridge priority is 32768.

Page512

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

In the global information, the root bridge identifier is different from the identifier of this switch. It indicates that this switch is a non-root switch.

c r u

g n i

: s e

h

o s Re

n r a

e r o

Le

M

Page513

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

The STP port information output indicates that: The port state is Forwarding.

: s e

The port is the root port.

h

The default port priority is 128.

c r u

The identifier of the designated port of the network segment connected to this port is 0.4c1f-cc45-aacc, which identifies SWA.

g n i

n r a

e r o

Le

M

Page514

o s Re

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

c r u

g n i

: s e

: p tt

h

o s Re

n r a

e r o

Le

M

Page515

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

c r u

g n i

n r a

M

e r o

Le

: p tt

When the port role and state changes, temporary loops may be formed. In this example, SWA is the root bridge initially. Among all switches, only SWD has an alternate port E0/2 and the port is in a non-Forwarding state. Assume that the priority of SWC is changed so that SWC becomes the new root switch. In this case, E0/2 of SWD will become the new root port and switch to a Forwarding state. E0/1 of SWD will become the new designated port and switch to a Forwarding state. E0/2 of SWB should become the new alternate port and switch to a non-forwarding state. If E0/2 of SWD switches from a non-Forwarding state to a Forwarding state before E0/2 of SWB switches from a Forwarding state to a non-Forwarding state, a temporary loop is formed in the network. To avoid temporary loops, a port (for example, E0/1 of SWC) must wait enough time before switching from anon-Forwarding state to a Forwarding state. Therefore, the ports that need to switch to a non-Forwarding state have enough time to calculate the spanning tree and switch to a nonForwarding state.

Page516

o s Re

: s e

h

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

In STP, for a port, the transition from a blocking state to a forwarding state will take the period at least two times the Forward Delay, which is not suitable for many applications. RSTP (Rapid Spanning Tree Protocol) resolves this problem through the following mechanism:

c r u

: s e

h

1. Allocating two port roles, an Alternate Port and a Backup Port for root port and designated root, for fast state transition. When the root port is invalid, the Alternate Port will become the new root port and switch to a forwarding state without delay; when the designated port is invalid, the Backup Port will become the new designated port and switch to a forwarding state without delay.

g n i

o s Re

nIn the point to point link only connecting two switch ports, r 2. a

M

e r o

Le

following a one way handshake to the downstream bridge, the designated port could change to a forwarding state without time delay. If more than three bridges are connected by the shared link, the downstream bridge will not respond to the handshake request sent from upstream designated port; only after two times Forward Delay would it change to a forwarding state. 3. The port is defined as an Edge Port if it is connected with a terminal directly instead of other bridges, the Edge Port could enter a forwarding state without any time delay. However, it Page517

should be configured manually since the bridge cannot identify whether the port is directly connected with the terminal or not.

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

c r u

g n i

n r a

e r o

Le

M

Page518

o s Re

: s e

h

: p tt

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

In STP all VLANs in a LAN will generally share the same spanning tree, therefore load balancing cannot be implemented between VLANs. It is possible that packets of some VLANs cannot be forwarded. As this slide shows, both of SWB and SWC connect with s of VLAN10 and VLAN20. The link between SWB and SWA and that between SWA and SWC allow VLAN10 and VLAN20 to . Other links only allow VLAN10 to . If the port E0/20 is blocked, the VLAN20 s of SWB can only use the link between SWB and SWC to communicate with SWC. However, this link only allows VLAN10 to , thus a failure in communication occurs.

c r u

g n i

: s e

h

o s Re

n r a

e r o

Le

M

Page519

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

In order to solve the second problem, MSTP (Multiple Spanning Tree Protocol) is put forward. MSTP is a newer protocol defined by IEEE under 802.1Q-2005 which introduces the concept of “Instances”. Simply speaking, STP/RSTP is port based, while MSTP based on instances. An instance is a collection of multiple VLANs under a single converged spanning tree. Through binding multiple VLANs into a single instance, the communication cost and network resources could be saved. In MSTP, the topology calculation of every instance is independent. Load balancing could be implemented in these instances. In use, multiple VLANs with the same topology could be mapped to the same instance.

c r u

g n i

n r a

e r o

Le

M

Page520

o s Re

: s e

h

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

How does STP converge to prevent switching loops in the network?

h

STP elects a root bridge, and then elects a root port for each non-root switch and elects a designated port for each network segment. The ports that are neither the root port nor the designated port are set to be in Blocking state.

c r u

: s e

o s Before switching Re from a non-Forwarding state to a Forwarding state, agport needs to wait twice the forward delay period. This n that other switches have enough time to calculate the ensures i n tree. spanning r a How does STP resolve the problem of temporary loops?

e r o

Le

M

Page521

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

c r u

g n i

n r a

e r o

Le

M

Page522

o s Re

: s e

h

: p tt

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

c r u

g n i

: s e

: p tt

h

o s Re

n r a

e r o

Le

M

Page523

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

c r u

g n i

n r a

e r o

Le

M

Page524

o s Re

: s e

h

: p tt

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tLAN, which is used as the t There is only one router RTA in the h gateway by all the PCs, therefore there is no redundancy : provided. s enetwork will be unable to reach external If RTA fail, all PCs in the c r there is a single point failure within this networks. In otheruwords, oresulting in a high chance of isolation from kind of network, s external networks. Re g n i n ar In this example:

e r o

Le

M

Page525

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

VRRP is designed to provide a virtual router on a LAN. In this case:

c r u

g n i

n r a

e r o

Le

: s e

h

There are two routers (RTA and RTB) on this LAN, RTA has physical IP address 10.1.1.251/24; RTB has physical IP address 10.1.1.252/24. RTA and RTB are configured to be associated with the same Virtual Router. This Virtual Router has a virtual IP address 10.1.1.254. All the PCs on this LAN can use the virtual IP address 10.1.1.254 as the default gateway, regardless of the physical IP addresses of the two routers. VRRP elects one router from the VRRP routers as the Master, and the Master processes all the packets sent to the virtual IP address. If the Master is fails, VRRP elects a new Master from other VRRP routers.

M

Page526

o s Re

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

A Virtual Router is identified by both Virtual Router ID and associated Virtual IP Address. Multiple Virtual Routers could be configured on the same interface. A Virtual Router ID (VRID) is the identifier of a Virtual Router. Configurable item in the range 1255 (decimal). The Virtual Router IDs configured on all the VRRP routers of the same virtual group must be the same. A Virtual Router can be associated with more than one Virtual IP Addresses. However, the Virtual IP Addresses configured for the VRRP routers of the same Virtual Router should be the same. If VRRP routers with the same VRIDs but different virtual IP addresses; or reversely, with same IP address but different VRIDs, in VRRP, they are regarded as different Virtual Routers.

c r u

g n i

: s e

h

o s Re

n r a

e r o

Le

M

Page527

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

Master: The VRRP router that is assuming the responsibility of forwarding packets sent to the IP address(es) associated with the virtual router, and answering ARP requests for these IP addresses.

h

: s e routers available to assume forwarding Backup: The set of VRRP c r router if the current Master fails. responsibility for a virtual u o is based on the value of Priority. For the The election ofsMaster e different Priority values could be assigned to same interface, R different associated virtual routers. g n i n ar

e r o

Le

M

Page528

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p t the protocol is running; t Run Priority: The Priority used when h usually it is the same as Config Priority. :of 0-255. The value 255 is reserved s The Priority is in the range e and the VRRP packet with Priority 0 is for the IP address owner, c r used to trigger theuimmediate changeover from Backup to Master. o In this case: he espriority of RTA is 100, which is lower than the priority 200Rof RTB, RTB will be the Master while RTA is the Backup. g n i n ar Config Priority: The configured Priority, the default value is 100.

e r o

Le

M

Page529

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p t There is a VRRP router that hastthe virtual router's IP address(es) h as real interface address(es). Such a router is called the IP : Address Owner. s e c r u o s Re g n i n ar In this case:

e r o

Le

M

Page530

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

No matter what the Config Priority is, the Run Priority of IP address owner is always 255. The IP address owner is always the Master. Although the configured priority value of RTB is higher than that of RTA, the RTB is still the Backup, since its Run Priority is lower than that of RTA. Hence, when it comes to the election of the Master, the contributing factor is the value of Run Priority instead of Config Priority.

c r u

g n i

: s e

h

o s Re

n r a

e r o

Le

M

Page531

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tRTA and RTB. A single Virtual There are two routers in this LAN, t h Router is to be configured, with VRID 1 and Virtual IP Address : is to be configured as 200, and 10.1.1.254. The Priority ofsRTB e to make RTB the Master. that of RTA as 100, socas r u o s Re g n i n ar In this case:

e r o

Le

M

Page532

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p t virtual-address vrrp vrid virtual-router-ID virtual-ip t h virtual-ip [ virtual-address ] undo vrrp vrid virtual-router-ID : s virtual-router-ID：The identifier of Virtual Router, in the range of e c 1-255. r u virtual-address：Virtual o IP address. s By default, ifethe Priority of the virtual router is not designated, R the default value is 100. g n i n ar The VRRP is configured under the interface view.

e r o

Le

M

Page533

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

The VRID and Virtual IP Address should be the same as is configured on RTA.

h

vrrp vrid virtual-router-ID priority priority-value

: s e

undo vrrp vrid virtual-router-ID priority

c r u

virtual-router-ID：The identifier of Virtual Router, in the range of 1-255.

o s Re

priority-value：The value of Priority, with configured range from 1 to 254.

g n i

When configuring the priority, the VRID should be specified. Different virtual routers can be configured with different priority values.

n r a

e r o

Le

M

Page534

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

In this case: There are two routers in the LAN. Two Virtual Routers are to be configured. One of them is with VRID 1 and Virtual IP Address 10.1.1.100; the other with VRID 2 and Virtual IP Address 10.1.1.200. Configuring the Priority of Virtual Router 1 as 200 on RTA while 100 on RTB, so that in Virtual router 1, RTA is the Master. Configuring the Priority of Virtual Router 2 as 200 on RTB while 100 on RTA, so that in Virtual router 2, RTB is the Master. Hence, RTA is the Master of Virtual Router 1 and the Backup of Virtual Router 2; RTB is the Master of Virtual Router 2 and the Backup of Virtual Router 1. In the LAN, PCs can use different Virtual IP addresses as the default gateway, so as to implement traffic sharing.

c r u

g n i

: s e

h

o s Re

n r a

e r o

Le

M

Page535

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p t10.1.1.100, Priority as 200; Virtual Router 1: Virtual IP address t h 10.1.1.200, Priority as 100 Virtual Router 2: Virtual IP address : s (default). e c r u o s Re g n i n ar On RTA, configuring two Virtual Routers as followings:

e r o

Le

M

Page536

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p t10.1.1.100, Priority as 100 t Virtual Router 1: Virtual IP address h (default); : s Virtual Router 2: Virtual IP address 10.1.1.200, Priority as 200. e c r u o s Re g n i n ar On RTB, configuring two Virtual Routers as followings:

e r o

Le

M

Page537

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p t RTB is the Master Router. If the t interface Ethernet 1/0 (WAN h interface) of RTB is down, we hope RTA to be the new Master :such function by configuring RTB to immediately. VRP s s e tracking interface Ethernet 1/0. If the enable the Virtual Router c r is down, the Priority of the Virtual Router interface Ethernet 1/0 u would be reduced o by a configured value to be a new value lower s than that of RTA. Hence, RTA will be the new Master Router e R automatically. If the interface E1/0 of RTB recovers and works g the priority of RTB will come back to the original value, properly, n andiRTB will be the Master again. n r a VRRP can track upstream interfaces. In this case:

e r o

Le

M

Page538

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

The configuration of RTA is the same as the configuration of single Virtual Router.

By default, the Priority is 100.

c r u

g n i

: s e

h

o s Re

n r a

e r o

Le

M

Page539

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

By configuring the Priority as 200, RTB is the Master. Configuring tracking interface Ethernet 1/0 on RTB. If interface Ethernet 1/0 is down, the Priority is reduced by 150, and the new Priority is 50. Hence, RTA will be the new Master.

c r u

g n i

n r a

e r o

Le

M

Page540

o s Re

: s e

h

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

This is the VRRP States if the tracked interface is down. On RTB, although the Configured Priority is 200, the Running Priority is reduced to 50. Hence, RTA will become the Master.

c r u

g n i

: s e

h

o s Re

n r a

e r o

Le

M

Page541

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

This chapter covers the following points: 1. Why is VRRP needed?

: s e

h

Because the single gateway cannot provide any redundancy, it is of very poor availability.

c r u

2. What is VRRP？

o s Re

The result of running VRRP is to provide a virtual router in the LAN.

g n i

3. How can a virtual router be identified? It can be identified by the VRID and the Virtual IP address(es) associated.

n r a 4. How is the Master elected?

Mo

re

Le

The election of Master is based on the Priority of the Virtual Router. 5. What are the priority values? The value of Priority is 255 indicating the current router is the Virtual IP address owner. The value of Priority is 0 indicating the device stop taking part of the backup group. Page542

6. How is a Single Virtual Router configured? Configuring a Virtual Router, Virtual IP address and the value of Priority. 7. How are Multiple Virtual Routers configured? Configuring multiple Virtual Routers. For different Virtual Routers, different routers are made as the Master through proper configuration of the value of Priority. 8. How does the tracking of an up-link interface VRRP operation?

e w ua

m o c . i

Through configuring the VRRP router so as to make the priority value change along with the state of a tracked interface should it fail.

h . ng

i n ar

e l //

c r u

g n i

: s e

: p tt

h

o s Re

n r a

e r o

Le

M

Page543

n e /

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: s ce

r u so

g n i

n r a

M

e r o

Le

Re

h

: p tt

n e /

m o c . i

e w ua

h . ng

Module 4 rni a e WAN /l

c r u

g n i

n r a

M

e r o

Le

o s Re

: s e

h

/ : p t t

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

c r u

g n i

n r a

M

e r o

Le

o s Re

: s e

h

: p tt

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

c r u

g n i

: s e

: p tt

h

o s Re

n r a

e r o

Le

M

Page547

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

c r u

g n i

n r a

e r o

Le

M

Page548

o s Re

: s e

h

: p tt

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

c r u

g n i

: s e

: p tt

h

o s Re

n r a

e r o

Le

M

Page549

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

c r u

g n i

n r a

e r o

Le

M

Page550

o s Re

: s e

h

: p tt

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

The HDLC drafted by the ISO is a bit-based communication protocol. The basic unit transmitted by HDLC is the frame. The most outstanding feature is that the data may not be the specified set of character . Any bit flows can be transmitted transparently.

c r u

: s e

h

In the 1970s, IBM put forward the bit-oriented synchronous data link control (SDLC). Then, ANSI and ISO adopted and developed the SDLC, and also put forward their own standards: Advanced Data Communication Control Procedure (ADC) of ANSI and HDLC of ISO.

g n i

o s Re

As na bit-based protocol, the HDLC protocol has the following r a features:

M

e r o

Le

1. The protocol is independent of any set of characters .

2. Packets can be transmitted transparently. The “0-bit insert method” for transparent transmission can be implemented based on hardware. 3. The full-duplex communication can be implemented. Data can be transmitted continuously without waiting. The data transmission on the link is highly efficient. 4. All the frames adopt CRC check. The frames are numbered. Page551

Thus no frame is lost or received repeatedly. The transmission reliability is high. 5. The transmission control is separated from processing, which makes HDLC flexible and controllable. All of the protocols in the standard HDLC protocol suite run on the synchronous serial lines.

m o c . i

n e /

e w ua

h . ng

i n ar

e l //

c r u

g n i

n r a

e r o

Le

M

Page552

o s Re

: s e

h

: p tt

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

An HDLC frame consists of the flag field (F), the address field (A), the control field (C), the information field (I), and the sequence number field (FCS). Flag field (F) The flag field is in the 01111110 format. The two flag fields indicate the start and the end of a frame. The flag field can also be used as the filling character between frames. Address field (A) The address field carries the address information. Control field (C) The control field forms the commands and the responses to monitor and control the link. The main node or the combination node of the sender uses the control field to request the slave node or the combination node to perform the specified operation. The slave node uses this field to respond to the commands and report the completed operations or the change of status. Information field (I) The information field can be any binary bit string. The length of the string is not limited. The upper limit of the string length depends on the FCS field or the cache capacity of the communication node. The commonly used length is 1000-2000 bytes. The lower limit can be 0, namely, no information field. The

c r u

g n i

: s e

h

o s Re

n r a

M

e r o

Le

Page553

supervisory frame, however, cannot have the information field. Sequence number field (FCS) The FCS field contains 16 bits. It is used to the entire frame between the two flag fields.

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

c r u

g n i

n r a

e r o

Le

M

Page554

o s Re

: s e

h

: p tt

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

The HDLC frame is classified into the information frame (I frame), the supervisory frame (S frame), and the unnumbered frame (U frame).

: s e

h

Information frame (I frame)

c r u Supervisory (Soframe) s errors and traffic. If the first two bits of the The S frameecontrols Rin a frame are “10”, it is an S frame. The S frame control field g contain the information bit. It contains only 6 bytes, doesn not i 48 bits. namely, n arUnnumbered frame (U frame) The I frame transmits the valid information or data.

e r o

Le

The U frame is used to establish, delete, and control the link.

M

Page555

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

c r u

g n i

n r a

e r o

Le

M

Page556

o s Re

: s e

h

: p tt

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

The HDLC configuration on the serial link is simple. The only needs to configure HDLC in the interface view, and then configure the IP address. The link-protocol hdlc command configures the link-layer protocol for the encapsulation on the interface to be HDLC.

c r u

: s e

h

NOTE: The encapsulation modes on the two interfaces of the communication nodes must be the same. The default encapsulation protocol on the serial interface of the

g n i

o s Re

VRP based routers is PPP. When the VRP-based routers are interconnected with the devices of other vendors, make sure that the encapsulation modes are the same.

n r a

e r o

Le

M

Page557

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

After configuration is complete, the can use ping to check whether the configuration is correct. If the two nodes can send and receive ping packets, the configuration is deemed successful; otherwise, check whether the configuration on the corresponding interfaces is accurate.

c r u

g n i

n r a

e r o

Le

M

Page558

o s Re

: s e

h

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

As is shown in the figure above, RouterA and RouterB are connected through the serial interface. HDLC runs on the interfaces. Interface S0/0/1 on Router A borrows the IP address of the local loopback interface. The IP address of the loopback interface adopts the 32-bit mask. The ip address unnumbered interface LoopBack 0 command configures interface S0/0/1 to borrow the IP address of interface loopback 0. The ip routestatic 10.1.1.0 24 Serial 0/0/1 command configures the static route. The egress of the static route to network 10.1.1.0 is Serial0/0/1. For the configuration of the static route, refer to the routing module.

c r u

g n i

: s e

h

o s Re

n r a

e r o

Le

M

Page559

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

The display ip interface brief command displays the IP addresses of the interfaces. In this example, you can see that Serail0/0/1 and Loopback0 use the same IP address. If the interface does not borrow the IP address of another interface, a message is displayed to remind you of the IP addresses conflict. In this example, however, Serial0/0/1 borrows the IP address of Loopback0, so the IP addresses are not in conflict.

c r u

g n i

n r a

e r o

Le

M

Page560

o s Re

: s e

h

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

We can use PING to test the connectivity between the two routers. If the test succeeds, it verifies that the router configuration is correct, otherwise it will be necessary to check whether the corresponding interface configuration match.

c r u

g n i

: s e

h

o s Re

n r a

e r o

Le

M

Page561

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p t is a bit-based link-layer High-level Data Link Control, HDLC, t h protocol. The protocols of the HDLC protocol suite run on synchronous serial links. s: e is comprised of which fields? 2. The HDLC frame structure c r of the flag field (F), address field (A), u An HDLC frame consists oinformation field (I), and a sequence number s control field (C), e field (FCS).R g n i n ar 1. What is HDLC?

e r o

Le

M

Page562

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

c r u

g n i

: s e

: p tt

h

o s Re

n r a

e r o

Le

M

Page563

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

c r u

g n i

n r a

e r o

Le

M

Page564

o s Re

: s e

h

: p tt

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

c r u

g n i

: s e

: p tt

h

o s Re

n r a

e r o

Le

M

Page565

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

c r u

g n i

n r a

e r o

Le

M

Page566

o s Re

: s e

h

: p tt

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

PPP is placed in the data link layer of the T/IP stack. It is the most popular point-to-point link layer protocol. PPP is used to encapsulate and transmit IP packets on the serial link, ATM link, and SDH link.

c r u

g n i

: s e

h

o s Re

n r a

e r o

Le

M

Page567

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

PPP consists of three components, namely, data encapsulation method, Link Control Protocol (L) , and Network Control Protocol (N) . The datagram encapsulation method defines how to encapsulate multi-protocol packets.

h

: s e link types, PPP defines L. L can To be adapted to various c r (for example, whether a loop is test the link environment u generated) and o negotiate link parameters (for example, the s maximum length of the packet and the type of the authentication e R protocol) . Compared with other link layer protocols, PPP can gauthentication. The two ends of the link can negotiate the provide n i authentication protocol to be used and implement the n r a authentication. The session can be established only after the

M

e r o

Le

authentication succeeds. With this feature, PPP can be used by ISP to receive the access of dispersive subscribers.

PPP defines a group of N protocols. Each protocol matches a network layer protocol. The N protocol is used to negotiate the parameters like IP addresses. For example, IP negotiates IP control parameters, and IPX negotiates IPX control parameters.

Page568

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

The encapsulation method of PPP data frame is used for differentiating the packets of each upper layer protocol. The encapsulation format of PPP contains only three fields.

: s e

h

Protocol: This field contains two bytes. It identifies the type of protocol encapsulated in the PPP frame, for example, IP, L, and N. The common values are shown in the above figure.

c r u

o s Re

Information: This field contains the data encapsulated in PPP, for example, L data, N data, and network-layer packets. The length of this field is variable.

g n i

Padding: This field is used for filling in the information field.

n The total length of the Padding and Information fields is the r a

M

e r o

Le

maximum receive unit (MRU) of PPP. The default value of MRU is 1500 bytes. If the Information field is shorter than MRU, PPP fills in the Padding field to reach the length of MRU to make the transmission convenient. But the padding is not mandatory. That is to say, the Padding field is optional.

Page569

n e /

m o c . i

e w ua

h . ng

i n ar

e l /on the link. Additional / PPP frames cannot be transmitted directly : p encapsulation modes and control mechanisms must be used t depending on the types of the links. The PPP frames transmitted ht HDLC. on the serial link must comply with :or the end bit of the frame. The value s Flag: indicates the start bit e is “01111110”. c rthe IP address. It is all “1”s. Because PPP is u Address: indicates o a point-to-pointsprotocol, it does not need the addressing mechanism. ReThe address of all “1s” represents the receiver end. g indicates the control field. HDLC can use this field to Control: n transmit i data and control packets orderly. In PPP, the value of n this field is 0x03, which indicates that the data is transmitted in arcountless mode. This is a simple working mechanism.

e r o

Le

M

Page570

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

The basic configuration of PPP on the serial link is simple. Configure PPP encapsulation interface view, and then configure the IP address. The link-protocol ppp command is used to configure the link layer protocol of the interface as PPP.

c r u

g n i

: s e

h

o s Re

n r a

e r o

Le

M

Page571

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

c r u

g n i

n r a

e r o

Le

M

Page572

o s Re

: s e

h

: p tt

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

This table lists four types of L packets used to negotiate linklayer parameters.

h

Configure-Request：The first packet during the link-layer negotiation process, indicating the beginning of link-layer parameter negotiation of the two ends.

c r u

: s e

Configure-Ack：After receiving the Configure-Request packet sent by the peer, if the values of negotiated parameters are acceptable, this packet is used for acknowledgement.

g n i

o s Re

Configure-Nak：After receiving the Configure-Request packet sent by the peer, if the values of the negotiated parameters are not acceptable, this packet is used for reply, carrying the locally acceptable parameters.

n r a

Mo

re

Le

Configure-Reject：After receiving the Configure-Request packet sent by the peer, if the values of the negotiated parameters cannot be identified, this packet is used for reply carrying the parameters not identified.

Page573

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

As is shown in the figure above, RTA and RTB are connected through the serial link and they run PPP. When the physical layer link is up, RTA and RTB negotiate the link parameters through L. In this example, RTA sends an L packet. RTA sends a Configure-Request packet to RTB. The packet contains the link layer parameters configured on RTA. After RTB receives the Configure-Request packet, it returns a Configure-Ack packet to RTA if RTB can identify the parameters in the packet and the parameter values are acceptable.

c r u

g n i

: s e

h

o s Re

If RTA does not receive the Configure-Ack packet, it will re-sends the Configure-Request packet every three seconds. If RTA still dose not receive the Configure -Ack packet after it sends 10 Configure-Request packets, RTA considers RTB failed and stops sending the Configure-Request packet.

n r a

M

e r o

Le

NOTE: If the above process has finished it only indicates that RTB considers the link parameters on RTA acceptable. RTB still needs to send the Configure-Request packet to RTA to let RTA check whether the parameters on RTB are acceptable.

Page574

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

After RTB receives the Configure-Request packet sent by RTA, RTB checks the parameters contained in the packet. If RTB can identify the link layer parameters but finds that some or any of the parameter values cannot be accepted, RTB returns a Configure-Nak packet to RTA. This Configure-Nak packet contains only the unacceptable parameters. The values (or value ranges) of these parameters are changed into the values that can be accepted by RTB. After receiving the Configure-Nak packet, RTA modifies the parameter values locally according to the parameter values in the packet, and then re-sends a Configure-Request packet. After five negotiations, if the values still cannot be accepted, the parameters are forbidden without further negotiation.

c r u

g n i

: s e

h

o s Re

n r a

e r o

Le

M

Page575

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

After RTB receives the Configure-Request packet sent by RTA, RTB checks the parameters contained in the packet. If RTB cannot identify some or any of the link layer parameters in the packet, RTB returns a Configure-Reject packet to RTA. The Configure-Reject packet contains only the unidentified parameters.

c r u

o s Re

: s e

h

After receiving the Configure-Reject packet, RTA re-sends a Configure-Request packet to RTB. This packet does not contain the unidentified parameters.

g n i

n r a

e r o

Le

M

Page576

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

On the VRP platform, MRU is represented by MTU configured on the interface. The PPP authentication protocols widely used are PAP and CHAP (will be described in the following chapters). The two ends of a PPP link can authenticate each other using different authentication protocols. The authenticated party, however, must the authentication protocol used by the peer and the authentication information such as name and should be configured correctly.

c r u

: s e

h

o s Re number to detect abnormal cases such as loop. L uses magic gnumber is generated randomly. The random mechanism A magic n hasito guarantee that the two ends generate the magic numbers. n one end receives the Configure-Request packet, it r After a

M

e r o

Le

compares the magic number contained in the packet with the local magic number. If the two numbers are different, it indicates that no loop occurs on the link, and the receiver end sends a Configure-Ack packet (other parameters are also agreed), indicating the magic number is agreed. If the packets sent later contain the magic numbers, the magic numbers are set to the negotiated one, and L does not generate new magic numbers any more.

If the magic number in the Configure-Request packet is the same Page577

as the local magic number, the receiver end sends a ConfigureNak packet, which contains a new magic number. Then, L sends a new Configure-Request packet with a mew magic number whether the received Configure-Nak packet contains the same magic number or not . If loop occurs on the link, this process is repeated continuously. If there is no loop, the packet interaction is restored.

m o c . i

n e /

e w ua

h . ng

i n ar

e l //

c r u

g n i

n r a

e r o

Le

M

Page578

o s Re

: s e

h

: p tt

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

If the authentication fails or the closes the connection manually, L will stop the connection.

h

L stop connections by using the Terminate-Request and Terminate-Ack packets. The Terminate-Request packet is used for the peer to request stop the connection. If one end receives a Terminate-Request packet, L must return a Terminate-Ack packet to confirm the closure of connection.

c r u

: s e

o s edoes not receive the Terminate-Ack packet, it will If the sender R re-sends the Terminate-Request packet every three seconds. If g still fails to receive the Terminate-Ack packet after it the sender n i two request packets, it considers the peer failed and will sends n arclose the connection.

e r o

Le

M

Page579

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

After establishing a connection, L detects the status of the link by using the Echo-Request and Echo-Reply packets. After receiving an Echo-Request packet, it returns an Echo-Reply packet to tell that the link status is normal. On the VRP platform, an Echo-Request packet is sent every 10 seconds.

c r u

g n i

n r a

e r o

Le

M

Page580

o s Re

: s e

h

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

c r u

g n i

: s e

: p tt

h

o s Re

n r a

e r o

Le

M

Page581

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

PAP is the Authentication Protocol. It is used for s authentication.

h

The configuration of PAP contains two steps:

: s e

1. Enable PAP authentication on the authenticator; create a PPP .

c r u name and for PAP authentication 2. Configure the o s party. on the authenticated e local-Rhuawei simple hello g is used for the creation of a local , of which This command n i name is huawei and the is hello. Key word the n arsimple indicates that the is plain text in the

M

e r o

Le

configuration file. If the key word is cipher, it indicates that the is cipher text in the configuration file. local- huawei service-type ppp

This command is used for configuring huawei as a PPP . ppp authentication-mode pap This command is used for enabling PAP authentication on the authenticator. That is, request the peer to use PAP authentication. Page582

ppp pap local- huawei simple hello This command is used for configuring the name and for PAP authentication on the authenticated party.

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

c r u

g n i

: s e

: p tt

h

o s Re

n r a

e r o

Le

M

Page583

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

The working process of PAP authentication is simple. After L negotiation, the authenticator requests the peer to use PAP authentication. The peer sends the name and in plain text through the Authenticate-Request packet to the authenticator. In this example, the name is huawei and the is hello.

: s e

h

c r u name and , the authenticator After receiving the o s the information is correct in the local database. If checks whether e the information R is correct, it returns an Authenticate-Ack packet; otherwise, it returns an Authenticate-Nak packet, indicating g n failure i of the authentication. n ar

e r o

Le

M

Page584

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

CHAP is the Challenge Handshake Authentication Protocol. It is an authentication method that sends information in cipher text. Compared with PAP, CHAP is more secure.

: s e

h

c r This command is u used for creating a local , of which the o s and the is hello. Key word cipher name is huawei e indicates that the R information is displayed in cipher text in the configuration file. g n local- i huawei service-type ppp n arThis command is used for configuring huawei as a PPP local- huawei cipher hello

M

e r o

Le

.

ppp authentication-mode chap This command is used for enabling CHAP authentication on the authenticator. That is, request the peer to use CHAP authentication. ppp chap huawei This command is used for configuring the name for CHAP authentication to be huawei on the peer. Page585

ppp chap simple hello This command is used for configuring the for CHAP authentication to be hello on the peer.

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

c r u

g n i

n r a

e r o

Le

M

Page586

o s Re

: s e

h

: p tt

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

The CHAP authentication contains three interaction phases. To match the request packet and response packet, the packet carries the Identifier field. All the packets in one authentication process use the same identifier.

: s e

h

After the L negotiation, the authenticator sends a Challenge packet to the peer. The packet contains the Identifier field and the Challenge character string which is generated randomly. This Identifier will be used by the consequent packet of the same authentication process.

c r u

g n i

o s Re

After the peer receives the Challenge packet, it encrypts the packet. The encryption formula is MD5{ Identifier + + Challenge }. The character string consisting of Identifier, , and Challenge undergoes the MD5 calculation. Then, a 16-byte digest is generated. The digest and the CHAP name configured on the port are encapsulated in the Response packet and sent back to the authenticator. In this example, after the encryption, the digest information and name huawei are sent to the authenticator.

n r a

M

e r o

Le

After the authenticator receives the Response packet sent by the peer, it searches the local database for the challenge message matching the name. Page587

Then, the authenticator encrypts the . The encryption calculation is the same as that used by the peer. Then, the authenticator compares the digest information with that encapsulated in the Response packet. If they are the same, the authentication succeeds; otherwise, the authentication fails. As this shown in the previous process, CHAP sends the in cipher text instead of plain text, hence the security is enhanced greatly.

e w ua

m o c . i

h . ng

i n ar

e l //

c r u

g n i

n r a

e r o

Le

M

Page588

o s Re

: s e

h

: p tt

n e /

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

c r u

g n i

: s e

: p tt

h

o s Re

n r a

e r o

Le

M

Page589

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

PPP defines a group of N protocols. Each protocol matches a network layer protocol. The N protocol negotiates the network layer parameters. For example, IP is used for negotiating and controlling IP parameters, and MPLS is used for negotiating and MPLS parameters. This course discusses only IP.

c r u

g n i

n r a

e r o

Le

M

Page590

o s Re

: s e

h

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

IP uses the same negotiation mechanism and packet type as L, but IP does not invoke L. This is the same as L in of working procedure, packet and so on. There are two types of IP address negotiation methods: static configuration and dynamic configuration.

c r u

: s e

h

As it is shown in the figure, the IP addresses on the two ends are 10.1.1.1/30 and 10.1.1.2/30. The two IP addresses are in network segment 10.1.1.0/30.

g n i

o s Re

The negotiation process for the static configuration of IP addresses is as follows:

1.nThe two ends send the Configure-Request packets, which r a contain the local IP address.

M

e r o

Le

2. After receiving the Configure-Request packet, the two ends check the IP address contained in the packet. If the IP address is a valid unicast IP address and it is different from that configured locally (no confliction), it indicates that the peer can use this IP address and the local end returns a Configure-Ack packet.

Page591

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

As it is shown in the routing table, the IP address of the peer on the PPP link is a 32-bit host address. The reason is that by sending information through IP, the two ends of the PPP link can know the IP address of the peer.

c r u

g n i

n r a

e r o

Le

M

Page592

o s Re

: s e

h

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

As is shown in the figure above, RTA asks the peer to allocate an IP address, and RTB uses static IP address 10.1.1.2/30. RTB enables the function to allocate IP address for the peer, allocating IP address 10.1.1.1 for RTA.

: s e

h

The process of the dynamic negotiation of dynamic IP address is as follows:

c r u

o s Re

RTA sends a Configure-Request packet to RTB. The packet contains IP address 0.0.0.0, which indicates a request for an IP address allocating . After RTB receives the Configure-Request packet, it considers IP address 0.0.0.0 invalid and returns a Configure-Nak packet containing IP address 10.1.1.1; After RTA receives the Configure-Nak packet, it updates the local IP address and re-sends a Configure-Request packet, which contains IP address 10.1.1.1; When RTB receives the ConfigureRequest packet, it considers the IP address contained in the packet valid and returns a Configure-Ack packet.

g n i

n r a

M

e r o

Le

At the same time, RTB sends a Configure-Request packet to RTA, which means that RTB requests to use IP address 10.1.1.2. If RTA considers the IP address valid, it will return a ConfigureAck packet. Page593

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

The VRP platform s IP address negotiation in PPP. ip address ppp-negotiate

: s e

h

This command is used for enabling the function of requesting the peer to allocate IP addresses.

c r u

remote address 10.1.1.1

o s Re

This command is used for enabling the function of allocating IP addresses to the peer. In this example, IP address 10.1.1.1 is allocated to the peer.

g n i

Note: The IP address obtained through negotiation is a 32-bit host address. The route of the corresponding network segment will not be generated in the routing table.

n r a

e r o

Le

M

Page594

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p t data encapsulation method, t PPP has three components, namely, h L and N. :for negotiating link parameters in s Which packets can be used e c L? r first packet during the link-layer u Configure-Request：The o indicating the beginning of link-layer s negotiation process, e parameterR negotiation of the two ends. g Configure-Ack：After receiving the Configure-Request packet n iby the peer, if the values of negotiated parameters are sent n aracceptable, this packet is used for responsing. What are the components in PPP?

M

e r o

Le

Configure-Nak：After receiving the Configure-Request packet sent by the peer, if the values of negotiated parameters are not acceptable, this packet is used for responsing, carrying the locally acceptable parameters.

Configure-Reject：After receiving the Configure-Request packet sent by the peer, if the values of negotiated parameters cannot be identified, this packet is used for responsing, carrying the parameters not identified. How many packet exchanges are necessary for CHAP? Page595

Three. Sending of name and in cipher text. What do the main IP parameters negotiate? IP address.

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

c r u

g n i

n r a

e r o

Le

M

Page596

o s Re

: s e

h

: p tt

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

c r u

g n i

: s e

: p tt

h

o s Re

n r a

e r o

Le

M

Page597

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

c r u

g n i

n r a

e r o

Le

M

Page598

o s Re

: s e

h

: p tt

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

c r u

g n i

: s e

: p tt

h

o s Re

n r a

e r o

Le

M

Page599

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

c r u

g n i

n r a

e r o

Le

M

Page600

o s Re

: s e

h

: p tt

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

The FR technology is a fast packet switching technology that transmits and switches data units in a simplified manner when compared to X.25. The FR adopts a virtual circuit based behavior, transmitting data through logical links, rather than physical links. Multiple logical links can be multiplexed on one physical link. The bandwidth can therefore be multiplexed and dynamically allocated. This facilitates the transmission of data for multiple s and multiple rates. The network resource is fully used. As shown in the figure above, the virtual circuit is used so that the network resource is fully utilized. Frame Relay has the features of high throughput and low delay. It is applicable to the service that has burst traffic. FR simplifies the layer-3 function of X.25, however does not retransmission when an error occurs.

c r u

g n i

: s e

h

o s Re

n r a

e r o

Le

M

Page601

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

Frame Relay is found at the second layer of the OSI model. It is a simplified way to transmit and switch data units at the data link layer. FR realizes the functions of the physical layer and the link layer. The functions such as traffic control and error checking are realized by the intelligent terminal. Hence the protocol between nodes is simplified. FR can transmit various routing protocols. The packets of the routing protocols are encapsulated in the FR data frame, as shown in the figure above.

c r u

g n i

n r a

e r o

Le

M

Page602

o s Re

: s e

h

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p t The FR technology is used for transmitting data service. Data is t transmitted as frames. FR is ahfast packet switching technology, which is connection-oriented. : FR transmits data over the logical s links, rather than physical e links. Multiple logical links can be c multiplexed on onerphysical link. Bandwidth can be multiplexed u and dynamicallyoallocated. sX.25 protocol realizes statistics multiplexing, frame The simplified e transparentR transmission, and error detection on the data link layer,ng but does not retransmission. The FR protocol i the layer-3 function of X.25. It simplifies the processing simplifies n aron network nodes and improves the information processing FR has the following features:

M

e r o

Le

efficiency. The 2-layer structure consisting of physical layer and data link layer is adopted. Only the core subset of the data link layer is kept. The mechanisms like frame numbering, traffic control, response, and monitor are not required. The cost of switches is reduced, and the network throughput is improved, and the delay in communication is reduced. The access rate of FR s is between 64 Kbit/s and 2 Mbit/s. A mechanism is provided to manage bandwidth and prevent congestion. The can fully use the reserved bandwidth,

Page603

namely, the committed information rate (CIR). The burst data of the can occupy the unreserved bandwidth. Thus the network resource is fully used.

Similar to packet switching, FR adopts the connection-oriented switching technology. It can provide the SVC and PVC services. In the current FR network, only the PVC service is used. Switching unit-The length of the frame is longer than the length of the packet. The maximum length of the frame is at least 1600 bytes. It is used for encapsulating the data of LAN.

e w ua

m o c . i

h . ng

i n ar

e l //

c r u

g n i

n r a

e r o

Le

M

Page604

o s Re

: s e

h

: p tt

n e /

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

The above figure shows the FR network model. The model consists of the DTE and the FR switching fabric.

h

The FR switching fabric consists of a group of DCE. The LANs on the two ends are interconnected through the FR network. The data of the LAN is transmitted through the PVC.

c r u

: s e

The related to the FR network are as follows:

o s Re Data Circuit-terminating Equipment (DCE): refers to the g equipment on the network, like FR switch. The DTE switching n andithe DCE are directly connected. The DCE is connected to a n on the switch. Multiple connections are set up between port r a multiple switches. The links between the DTE are established, as Data Terminal Equipment (DTE): refers to the -side device.

M

e r o

Le

shown in the figure above.

Data Link Connection Identifier (DLCI): identifies the link interface. Every link on the FR network uses a DLCI. The FR is a connection-oriented technology. Before communication starts, a link must be established between the devices. The link between the DTE is called virtual circuit. The virtual circuit of the FR is classified into PVC and SVC. The PVC is widely used in FR.

Page605

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

A Frame Relay (FR) network provides data communication between devices (such as routers and hosts).

: s e

h

According to different functions, FR devices and interfaces can be divided into the following three types:

c r u

•The device is called Data Terminal Equipment (DTE). The interfaces on the DTE are called DTE interfaces.

g n i

n r a

M

e r o

Le

o s Re

•The device that provides access for DTE is called Data Circuitterminating Equipment (DCE). The interfaces on the DCE devices are called DCE interfaces or Network-to-Network Interfaces (NNIs) interfaces. The interfaces that connect the DTE and the DCE are -to-Network Interfaces (UNIs). •The interface between the FR switches are NNIs. In practice, the DTE interface can be connected only with the DCE interface; the NNI interface can be connected only with the NNI interface.

Page606

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

The FR is a connection-oriented technology. Before communication starts, a link must be established between the devices. The link between the DTE is called virtual circuit.

: s e

h

The virtual circuit of FR is classified into PVC and SVC. The PVC is widely used in FR.

c r u

Permanent Virtual Circuit (PVC): refers to the fixed virtual circuit provided for s. Once the link is established, it will always be valid; unless the deletes it manually. The PVC transmits frequent and stable data between two ends frequently and stably.

g n i

o s Re

n Switched Virtual Circuit (SVC): refers to the virtual circuit r a automatically allocated by protocol. After communication

M

e r o

Le

completes, the virtual circuit can be deleted by the local equipment or switch. The burst data is often transmitted through the SVC.

Page607

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

FR is a statistical multiplexing protocol. One physical link can provide multiple virtual links. Each virtual link is identified by the DLCI. The address field in the FR frame can identify the virtual link that FR frame belongs to.

h

: s e local interface and the peer interface The DLCI is applied tocthe r to the local interface. It is not used that is directly connected u globally. That is,oin the FR network, a DLCI on different physical sidentify multiple virtual links. The interface interfaces may e R s up to 1024 virtual circuits. The value of on a FR network g that can be used by s ranges from 16 to 1007. The the DLCI n i circuit is connection-oriented, so different local DLCIs are virtual n arconnected to different peer devices. The local DLCI can be

M

e r o

Le

considered as the “FR address ” of the peer device. The FR network is public facility. It is often provided by the telecom service provider. s can also establish a FR network by using private switches. No matter which method is used, the provider of the FR network allocates the DLCI to the PVCs that are used by the s‟ routers. Some DLCI numbers represent special functions. For example, DLCI 0 and DLCI 1023 are used by only the LMI protocol. Address mapping of FR is to associate the protocol address of

Page608

the peer device with the FR address (local DLCI) of the peer device so that the upper layer protocol can find the peer device through the protocol address of the peer device. FR is mainly used to carry the IP protocol. Before the device sends the IP packet, the DLCI matching the next hop address must be known . The device can find the DLCI by searching the mapping table. Address mapping can be configured manually or dynamically maintained by the protocol.

e w ua

m o c . i

h . ng

i n ar

e l //

c r u

g n i

: s e

: p tt

h

o s Re

n r a

e r o

Le

M

Page609

n e /

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

Local Management Interface (LMI): monitors the status of the PVC. The system s three kinds of LMI protocol: Q.933 Annex A of ITU-T, T1.617 Annex D of ANSI, and the nonstandard compatible protocol. The nonstandard compatible protocol is used for interconnecting a device with the devices of other vendors.

c r u

: s e

h

o s Re

The working method of LMI is : DTE sends ak Status Enquiry packet at a interval to query the status of the virtual circuit. When the DCE receives the packet, it sends a Status packet to notify DTE of the status of all the virtual circuits on the current interface.

g n i

n r The a PVC status of the DTE-side devices depends on the DCE-

M

e r o

Le

side devices. The PVC status of the DCE-side devices depends on the network. If two network devices are directly connected, the PVC status of the DCE-side devices is set by the .

Page610

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

The FR network can connect the disparate networks. The network architecture may be full-meshed, partial-meshed, or star. In of cost, the star structure is the best as it limits the number of PVCs required. A central node is connected to the distributed nodes by using multiple PVCs on one interface. This architecture is applicable to the company where the headquarters needs to be connected to multiple branches. The disadvantage of this architecture is that the disparate nodes can communicate only through the central node.

c r u

g n i

: s e

h

o s Re

In the full-meshed structure, all the nodes are interconnected through PVCs. Any two nodes can communicate directly without ing other nodes. The reliability of such a architecture is high. If one PVC fails, the data can be transmitted through another. The disadvantage of such architecture is that a great number of PVCs are required. If one node is added to the network, many new PVCs need to be added.

n r a

M

e r o

Le

In the partial-meshed structure, some nodes are connected directly. The default FR network architecture is non-broadcast multi-access (NBMA). That is to say, although the nodes in the FR network can communicate with each other, the FR network does not broadcasts. If a node receives routing Page611

information, it recreates the packet and then sends the duplicated packet carrying the routing information to other nodes.

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

c r u

g n i

n r a

e r o

Le

M

Page612

o s Re

: s e

h

: p tt

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

Address mapping of FR associates the protocol address of the peering device with the local DLCI, so that frame relay can identify the PVC that should be used in order to reach a given destination.

h

: s e mapping table is based on a logical It should be noted that the c r interface has its own mapping table. The interface. The logical u key in the mapping o table is the relationship between the peer s protocol address Re and the local DLCI. g n i n ar

e r o

Le

M

Page613

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

The inverse ARP protocol is used for resolving the network address of a peer over a virtual circuit, with for both IP and IPX addressing. If the protocol address of the peer is known, the inverse ARP protocol can locally generate a mapping relationship between the peer network address and the DLCI (MAP). The address mapping therefore need not be configured manually.

c r u

: s e

h

o s Re

The process is as follows:

g n i

When a new virtual circuit is found (the local interface is already configured with the protocol address), the inverse ARP protocol sends an Inverse ARP request packet to the peer. The packet contains the local protocol address. When the peer receives the request, it obtains the local protocol address, and generates a mapping relationship. At the same time, the inverse ARP protocol sends a response packet and generates the mapping locally.

n r a

M

e r o

Le

It should be noted that: 1. If the static mapping relationship is configured manually, the Inverse ARP protocol does not send the request packet to the peer, no matter whether the peer's address is in the static mapping is correct or not. Page614

2. After receiving the inverse ARP request packet, the dynamic mapping cannot be generated if the receiver discovers that the peer protocol address is the same as the network address in the local mapping table. 3. The multiprotocol host responds only to the protocol address that is the same as the protocol address in the request packet. 4. The multiprotocol host applies addresses for all the protocol addresses on each interface.

e w ua

m o c . i

h . ng

i n ar

e l //

c r u

g n i

: s e

: p tt

h

o s Re

n r a

e r o

Le

M

Page615

n e /

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

c r u

g n i

n r a

M

e r o

Le

: p tt

As is shown in the figure above, Router A is connected to three routers, Router B, Router C, and Router D, through interface S0. If three DLCIs are mapped to three routers over S0, then the route update information on S0 is not sent out through S0. The distance vector routing protocol implements split horizon. The router cannot forward the route update information out through the interface on which the information was received. As shown, Router B advertizes the routing information to Router A. The split horizon mechanism results in Router A being unable to forward to Router C and Router D through interface S0. There are two ways to resolve this problem, one is to connect multiple neighboring nodes through multiple physical interfaces. This method requires that the router have multiple physical interfaces, which results in increased cost to the additional physical node interfaces. Another method is to implement sub-interfaces. In this manner, a single physical interface is configured with multiple logical interfaces. Each sub-interface has its own network address, and operated like an independent physical interface. It is also possible to disable the split horizon feature, but doing so will increase the possibility of routing loops being generated.

Page616

o s Re

: s e

h

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

The split horizon problem can be solved by configuration of subinterfaces. One physical interface can multiple logical sub-interfaces. Each sub-interface can be connected to the peer router through one or many DLCIs over a FR network.

h

: s e are defined on the serial link. The subThe logical sub-interfaces c r to the peer router through one or more interfaces are connected u DLCIs. After a DLCI o is configured on the sub-interface, the s mapping between the addressing of the destination end and the e R DLCI should be generated. g As isn shown in the figure above, the physical serial interface S0 i A, the DLCI of S0.1 is mapped to Router B, the DLCI on Router n arof S0.2 is mapped to Router C, and the DLCI of S0.3 is mapped

M

e r o

Le

to Router D.

The sub-interfaces in FR are classified into two types: Point-to-point sub-interface: connects to a single remote node. Each sub-interface is configured with one PVC. The peer can be found without the static address mapping. Therefore, the peer address is determined when the sub-interface is configured on the PVC. Point-to-multipoint sub-interface: connects multiple remote nodes. Page617

One sub-interface is configured with multiple PVCs. Each PVC is mapped to the connected remote protocol address. Thus, the PVC can be connected to the corresponding remote end. The address mapping must be configured manually or set up through the inverse ARP protocol. Before creating the FR sub-interface, the should configure the interface to use FR as the link-layer protocol. The default sub-interface type is p2mp.

e w ua

m o c . i

h . ng

i n ar

e l //

c r u

g n i

n r a

e r o

Le

M

Page618

o s Re

: s e

h

: p tt

n e /

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

c r u

g n i

: s e

: p tt

h

o s Re

n r a

e r o

Le

M

Page619

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

RTA and RTB are connected by a serial link. The IP address planning is as shown in the above figure. The link-layer protocol is FR. The configuration of FR in this example is similar to the configuration in the preceding example. The difference is that the mapping between the interface network address and the FR address is generated by the inverse ARP protocol.

c r u

o s Re

: s e

h

The fr inarp [ ip [ dlci-number ] ] command enables the dynamic address mapping. In VRP, the dynamic address mapping is enabled on the FR interface by default. So this step is optional.

g n i

n r a

e r o

Le

M

Page620

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

The display fr interface command displays the information about the FR interfaces, the operation mode of the FR interfaces, and the physical status and protocol status of the FR interfaces.

: s e

h

The display interface Serial 0 command displays the information about the interfaces, including the physical status and protocol status of the interfaces, the IP address, the linklayer encapsulation mode, and the LMI type.

c r u

g n i

o s Re

n r a

e r o

Le

M

Page621

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

RTA and RTB are connected by a serial link. The IP address planning is as shown in the above figure. The link-layer protocol is FR.

: s e

h

The link-protocol fr command encapsulates the link-layer protocol into FR. By default, the link-layer protocol is encapsulated into PPP. When the FR protocol is encapsulated, the encapsulation format is IETF by default.

c r u

o s ethe standard IETF encapsulation, which complies ietf: indicates R with the RFC 1490. It is the default encapsulation format. g indicates the encapsulation format of the n nonstandard: i n nonstandard compatible protocol. r a The fr interface-type command sets the FR interface type.

Mo

re

Le

dte, dce, and nni: indicates the three types of the FR interfaces. In FR, the two parties of the communication are at the side and the network side respectively. The -side party is called DTE. The network-side party is called DCE. In the FR network, the interfaces between the FR switches are NNI interfaces. The corresponding interfaces adopt the NNI mode. If the devices are used for FR switching, the interfaces should work in NNI mode or DCE mode. Page622

The fr dlci command configures the virtual circuit for the FR interface. The IP address 10.1.1.1 30 command configures the IP address for the interface.

The fr map ip command adds a mapping relationship between the FR address and the DLCI static address. ip-address: indicates the IP address of the peer. ip-mask: indicates the subnet mask. The format of the subnet mask is X.X.X.X. X is an integer ranging from 0 to 255. dlcinumber: indicates the number of the local virtual circuit. The value ranges from 16 to 1007.

e w ua

m o c . i

h . ng

i n ar

e l //

c r u

g n i

: s e

: p tt

h

o s Re

n r a

e r o

Le

M

Page623

n e /

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

The display fr map-info command displays the mapping

h

between the protocol address and the FR address.

: s e

In this example, RTA displays the information showing that the

c r and FR address ofuRTB. The local interface S0 on RTA works in o DCE mode. es R g n i n ar address mapped to DLCI 200 is 10.1.1.2, the network address

e r o

Le

M

Page624

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

Using ping to check FR configuration and interface‟s reachability.

c r u

g n i

: s e

h

o s Re

n r a

e r o

Le

M

Page625

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

In this example, the router functions as the FR switch. The PVC is configured manually.

c r u

g n i

n r a

e r o

Le

M

Page626

o s Re

: s e

h

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

Configuration of RTD is similar to those of RTA. It needs to Configure data link protocol, interface type and IP address.

c r u

g n i

: s e

h

o s Re

n r a

e r o

Le

M

Page627

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

Using the display fr map-info command, you can view the FR address mapping table.

[RTA]dis fr map-info

: s e

h

Map Statistics for interface Serial0 (DTE)

c r u

DLCI = 100, IP INARP 10.1.1.2, Serial0

o s e = ietf, vlink = 20, broadcast encapsulation R It is possible g to the PVC is operational from the „active‟ state.n i 10.1.1.2 n ping ar create time = 2007/06/04 17:34:59, status = ACTIVE

Mo

re

Le

PING 10.1.1.2: 56 data bytes, press CTRL_C to break

Reply from 10.1.1.2: bytes=56 Sequence=1 ttl=255 time=31 ms Reply from 10.1.1.2: bytes=56 Sequence=2 ttl=255 time=31 ms Reply from 10.1.1.2: bytes=56 Sequence=3 ttl=255 time=31 ms Reply from 10.1.1.2: bytes=56 Sequence=4 ttl=255 time=31 ms Reply from 10.1.1.2: bytes=56 Sequence=5 ttl=255 time=31 ms

Page628

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tthe -side is called DTE t Three, DTE, DCE, and NNI. In FR, h and the network-side party is called DCE. In the FR network, the :switches are NNI interfaces. The interfaces between the FR s e adopt the NNI mode. If the devices are corresponding interfaces c r the interfaces should work in NNI mode or used for FR switching, u o DCE mode. s 2. What‟s the Remeaning of FR DLCI? The DLCI identifies the data links. All the virtual circuits are g n identified by the DLCIs. The DLCI is applied to the local interface ithe peer n and interface that is directly connected to the local r a interface. It is not used globally. That is, in the FR network, a 1. How many modes does the FR interface have?

M

e r o

Le

DLCI on different physical interfaces may identify multiple virtual links. 3. How to establish a virtual circuit?

In the FR network, the DTE are interconnected with through virtual circuits. The virtual circuit can be set up in PVC or SVC mode. PVC mode is commonly adopted.

Page629

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: s ce

r u so

g n i

n r a

M

e r o

Le

Re

h

: p tt

n e /

m o c . i

e w ua

h . ng

Module 5 rni a e Network Security /l

c r u

g n i

n r a

M

e r o

Le

o s Re

: s e

h

/ : p t t

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

c r u

g n i

n r a

M

e r o

Le

o s Re

: s e

h

: p tt

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: s ce

: p tt

h

r u so

g n i

Re

n r a

e r o

Le

M

Page633

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: s ce

r u so

g n i

n r a

e r o

Le

M

Page634

Re

h

: p tt

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: s ce

: p tt

h

r u so

g n i

Re

n r a

e r o

Le

M

Page635

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: s ce

r u so

g n i

n r a

e r o

Le

M

Page636

Re

h

: p tt

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

In a practical sense, a firewall acts as a separator, and also an analyzer, to supervise any activity between an internal and external network, and assist in assuring the security of the internal network is maintained. The firewall can be in the form of a series of hardware devices or ed software within a given device. The firewall can be divided into several parts, some parts implement other function besides the function of a firewall. Firewall is the accumulation of hardware, software and control policies, where the control policy can be divided into two kinds: 1. Strict policy— highly secure but may disrupt many services due to non-reviewed policy restrictions. 2. Loose policy—provides much freedom to s however may leave many security holes in the network if good policy management has not been applied. Commonly firewalls will take on a more secure policy and assess policy for additional permissions on a case by case basis should additional policy restrictions need to be relinquished. However this can take some effort due to a series of security review processes that are often necessary to ensure the permission for release of restrictions does not threaten the integrity of the internal network to external threats.

: s ce

h

r u so

g n i

Re

n r a

M

e r o

Le

Page637

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

With the development of firewall technology, the function of firewall is more and more diverse, seen from the technology development aspect, variations have formed and can be classified into three kinds: packet filtering, proxy and state detection. At present, the more popular type is the state detection firewall.

: s ce

r u so

g n i

n r a

e r o

Le

M

Page638

Re

h

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tspecial rules predefined to t Packet filtering technology utilizes h source IP address, destination filter packets. The firewall obtains : port, destination T/UDP port s IP address, source T/UDP e and protocol number c of data packet, compare partial or overall r the rule to filter the data packet through information aboveuwith odefined rule application is done according to the the firewall. The s e IP packet, the elements mentioned above can be features of the R used to define the condition that allows the packet to gthe firewall. through n i n arThe feature of packet filtering firewall is that it is simple, but lacks Packet filtering firewall:

M

e r o

Le

flexibility, additionally packet filtering firewall will implement policy detection on every data packet, which affects the performance of a firewall.

Page639

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p t Proxy firewall regards itself as h at intermediary node of service access; for a client node, it:represents a server; for a server, it s firewall provides high security, but represents the client. A proxy e the cost is also high. It is c hard to develop a corresponding proxy r service for every application, so a proxy firewall can not u o an abundancesof services, it can only provide proxy service for some applications Re such as HTTP services, Proxy etc. g n i n ar Proxy firewall:

e r o

Le

M

Page640

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p t t State detection technology is an advanced h is used communication filtering technology. State detection to detect protocol : s layer and supervise the protocol information of the application e state of connection-oriented c application layer. Through detecting r the state of T/UDP based connection, a firewall can u o dynamically determine whether the packet can through the sThe firewall e firewall or not. will maintain a session item that takes R five-element group (source/destination IP address, g source/destination port number, protocol number) as Key values; n i for the received data packet, the firewall can match the session n r a item to determine which is legal and which is illegal. State detection firewall:

M

e r o

Le

As shown in the figure above, for Telnet access, when T completes the three-way handshake, the firewall will create a session item based on this five-element group. When a telnet response packet of A es through firewall, only the packet that matches the session item can be permitted to through the firewall, the Telnet response packet of other s will be blocked by firewall. Session item can be changed if the T protocol state changes,

Page641

before completion of three-handshake, illegal packet can not through the firewall. After telnet session finishing, the session item will be deleted immediately, the spurious illegal telnet packet remains unable to through the firewall. Session identifies a “complete connection”, a complete connection is composed of five elements (source address, destination address, source port, destination port, protocol number). When a three-way handshake of T is completed, the firewall will create a complete session item, the session item can be used to supervise the state transition of a session.

e w ua

m o c . i

h . ng

i n ar

e l //

: s ce

r u so

g n i

n r a

e r o

Le

M

Page642

Re

h

: p tt

n e /

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

As shown in the figure above, in the security system, firewall is analogous to a door, it can prevent people from entering, but it can not prevent malicious attacks from people that have permission to enter the network or are located internally. An access control system can prevent people with low priority from doing work which exceeds their authority, but it can not prevent people with high priority from malicious actions. It also cannot prevent people with low priority from obtaining high priority through illegal behavior. Intrusion detection system (IDS) is a unique device to identify whether the system is safe or not according to the data and behavior mode, it is the second security door following the firewall. There is a classical comparison: firewall corresponds a security system of a community, it will audit all the people who go through the gateway. But it cannot audit the people inside the community or with legal identity. IDS can supervise the internal community.

: s ce

h

r u so

g n i

Re

n r a

M

e r o

Le

IDS is analogous to a security camera of a network, it can capture and record all the data; at the same time ,it is also an intelligent camera, it can analyze and abstract doubtful and abnormal network data with the intelligence to Page643

Penetrate disguised data and identify the actual content. The advanced IDS can beat back, terminate connection and close path automatically to regulate illegal behavior. There are other technologies in security system besides those mentioned, for example, identity authentication technology, ACL packet filtering, special system access, protection to special source linked servers through reinforced and installed immunity systems, discovery of system holes and patching through scanning software; transmission of encrypted data or use of VPN technology to transmit, so as to guarantee the security (often end to end). Supervisory system operation through a security management center, and operational event logging and threat detection using alarms and threat response processes.

e w ua

m o c . i

h . ng

i n ar

e l //

: s ce

r u so

g n i

n r a

e r o

Le

M

Page644

Re

h

: p tt

n e /

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

Firewall strictly manages access from external networks into the internal network. The access from the internal network to external network is relatively loose in comparison. Firewall can not renew operation software periodically as other virus software, so the defense provided to new generated safety menace is sometimes not enough.

: s ce

h

r u o function is configured, the firewall will detect If depth detection s e of a data packet, which will also increase the the partial content R forwarding delay time and affect forwarding performance. gcannot provide detection to encrypted packets or other n Firewall i transmitted in VPN tunnels that es through the n packets arfirewall.

e r o

Le

M

Page645

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: s ce

r u so

g n i

n r a

e r o

Le

M

Page646

Re

h

: p tt

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

With the rapid development of the Internet, a growing number of enterprises have begun to speed up development by taking advantages of network services. It has become a concern of enterprises to protect their intranet in an open network environment. Huawei delivers the self-developed USG series unified security gateway products for large- and medium-sized enterprises. With 150 Mbit/s to 8 Gbit/s processing capabilities, these products provide cost-effective security solutions for largeand medium-sized networks.

: s ce

h

r u so

g n i

Re

USG unified security gateways are based on a high-performance hardware platform and advanced software architecture. They are equipped with high-performance or multi-core Us to provide line-rate packet processing, data forwarding, and anti-attack functions.

n r a

M

e r o

Le

USG unified security gateways provide rich interface functions, including fixed ports such as GE/FE and console ports, and general expansion slots for mini interface cards (MICs), and expansion slots for flexible interface modules (FICs). The expansion slots GE/FE, ADSL2+, WiFi, 3G, and E1/CE1 interface cards, Page647

for flexible selection according to the network environments of customers. In addition, the strong software scalability allows for cost-effective network upgrade and capacity expansion.

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: s ce

r u so

g n i

n r a

e r o

Le

M

Page648

Re

h

: p tt

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: s ce

: p tt

h

r u so

g n i

Re

n r a

e r o

Le

M

Page649

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: s ce

r u so

g n i

n r a

e r o

Le

M

Page650

Re

h

: p tt

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: s ce

: p tt

h

r u so

g n i

Re

n r a

e r o

Le

M

Page651

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: s ce

r u so

g n i

n r a

e r o

Le

M

Page652

Re

h

: p tt

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

The USG devices are used on the enterprise headquarters network, egress gateways of various branches, and security gateways of regional offices and remote sites.

h

: s ce to ensure communication security. Providing rich VPN r functions uWiFi functions for easy networking. Providing 3G and o s e R g n i n ar

Providing firewall and UTM functions to ensure intranet security.

e r o

Le

M

Page653

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

Q: How many variations of firewall are there, and what features do they ?

: s ce

h

A: Firewalls represent three variations: packet filtering, proxy and state detection. Packet filtering firewall utilizes special rule defined before (source/destination IP address, source/destination T/IP port and protocol number) to filter packets. Proxy firewalls are regarded as middle node of service access; for a client node, it represents a server and for a server, it represents the client. State detection is used to detect protocol information of the application layer and supervise the protocol state of connection-oriented application layer. Through detecting the state of T/UDP based connection, a firewall can dynamically determine whether the packet can through the firewall or not.

r u so

g n i

Re

n r a

M

e r o

Le

Q: Which models make up the USG firewall series? A: it includes: 2100, 2200 and 5120.

Page654

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: s ce

: p tt

h

r u so

g n i

Re

n r a

e r o

Le

M

Page655

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: s ce

r u so

g n i

n r a

e r o

Le

M

Page656

Re

h

: p tt

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: s ce

: p tt

h

r u so

g n i

Re

n r a

e r o

Le

M

Page657

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: s ce

r u so

g n i

n r a

e r o

Le

M

Page658

Re

h

: p tt

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

A zone is an important firewall security concept. Firewalls is are generally located at the boundary of a network, and so allows different networks to be represented part of alternative zones. The firewall adds interfaces into zones and enables security detection between zones (called a security policy). It can be used to filter the data flowing through different zones. The common methods used for security detection includes ACL based detection and application state detection. USG firewall has four reserved security Zones: Untrusted zone: A low-level security zone, the security priority assigned is 5. DMZ: A mid-level security zone, the security priority assigned is 50. Trust Zone: A high-level security zone, the security priority assigned is 85. Local Zone: The highest-level security zone, the security priority assigned is 100. If necessary, s can configure new security zones and define the security priority. With exception to the Local zone, before using any other zones, the security zone should be associated with the firewall interfaces, achieved by adding the interface of firewall into a security zone. The interface can only be added into only one zone. The interface can be a physical or logical interface. Adding an interface to a zone means that the network connected to the interface belongs to the zone, the interface

: s ce

h

r u so

g n i

Re

n r a

M

e r o

Le

Page659

itself belongs to the local zone.Association of security zones and networks should obey the following rules: internal networks should belong to Zone with a higher priority; external networks should belong to zones with a lower priority; some network that can provide conditioned services for external s should belong to the DMZ. The purpose of defining security priority is to distinguish the direction of data flow amongst security zones, whether inbound or outbound.

e w ua

m o c . i

h . ng

i n ar

e l //

: s ce

r u so

g n i

n r a

e r o

Le

M

Page660

Re

h

: p tt

n e /

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

When the data flow is forwarded between security zones, the firewall security detection mechanisms will spring into action, in particular the security policy of the firewall implemented between zones to manage traffic flow for example between the untrusted zone and trusted zone. Different security policies can be implemented between different zones for example, packet filtering policy, state filtering policy and so on.

: s ce

h

r u so

Re

g n Inbound: i In which the data flow is transmitted from a zone with a n low ar priority to a zone with a high priority. There are two directions of data flow between zones:

M

e r o

Le

Outbound: In which the data flow is transmitted from a zone with a high priority to a zone with a low priority.

Any two security zones cannot operate the same priority; the interfaces in the same Zone can forward packets directly without filtering, thus nullifying the zone defenses. An interface is unable to forward packets before it is added into a zone.

Page661

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

This example introduces how a security zone is created and how to configure the priority and apply an interface to the created zone.

: s ce

h

[USG2100] firewall zone name zone

r u so

// creates a security zone named zone, the system can up to 16 zones in total, including the default 4 zones.

e R //configures with a range from 1 to 100, any two gcan nottheusepriority, n zones the same priority, the priority of default 4 i cannot be modified. n zones ar[USG2100-zone-zone] add interface Ethernet 0/0/1 [USG2100-zone-zone] set priority 60

Mo

re

Le

//adds an interface to a zone, one zone can 1024 interfaces at most. Command “[USG2100]display zone zone” can be used to display related information for a given security zone.

Page662

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

This example introduces how to configure security policy between zones. When data flows between security zones, the security detection mechanism will initialize. Generally, data from an untrusted zone can not enter a trusted zone, unless permitted explicitly. After applying the configuration displayed, data from an untrusted zone can forward to a trusted Zone.

: s ce

h

r u so

g n i

Re

n r a

e r o

Le

M

Page663

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: s ce

r u so

g n i

n r a

e r o

Le

M

Page664

Re

h

: p tt

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

USG firewall can work in three modes: route mode, transparent mode and composite mode.

: s ce

h

If the USG firewall connects to the external network at layer 3 (meaning an IP address has been configured on the external interface), it is regarded that the firewall is operating in route mode. As shown in the figure above, when the USG firewall is located between an internal network and an external network, the three interfaces on the firewall that connect to internal network, external network and the DMZ area should be configured with IP addresses as part of different network segments. The topology would recognize the firewall as corresponding to the operation of a router. When adopting route mode, it can complete ACL packet filtering, ASPF (status based packet filtering) dynamic filtering and NAT functionality. However, when using route mode the network topology should be modified (the s on the internal network should change the gateway of the end system, the router should change the route configuration and so on).

r u so

g n i

Re

n r a

M

e r o

Le

Page665

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: s ce

r u so

g n i

n r a

e r o

Le

: p tt

If the USG firewall connects externally at layer 2 (an IP address is not configured on the interface), the firewall is considered to be operating in transparent mode. If the USG firewall adopts the transparent mode, the firewall only needs to be inserted into the network as bridge, the greatest advantage is that it is not necessary to modify any configuration; the firewall functions as a switch, and the internal network and external network must remain in the same subnet. At present, the USG firewall can not STP, so the usage of firewall should be done with care so as to avoid layer 2 loops in the network. In this mode, the firewall will not only forward packets like a switch, but also analyze the packet.

M

Page666

Re

h

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

If USG firewall has not only interface which is working in route mode (interface has IP address ) but also s an interface which is working in transparent mode (interface has no IP address), then the firewall is considered to be working in composite mode. This kind of mode is the mix of transparent mode and route mode, at present, it is only used in special applications of transparent mode to provide dual device hot backup.

: s ce

h

r u so

g n i

Re

The IP address should be configured for the interface which has VRRP (Virtual Router Redundancy Protocol) function enabled. The other interfaces do not require an IP address, furthermore the internal network and external network must be in the same subnet.

n r a

e r o

Le

M

Page667

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: s ce

r u so

g n i

n r a

e r o

Le

M

Page668

Re

h

: p tt

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

A firewall must provide the ability to control the network data flow, so as to guarantee security, QoS requirement and constituting policy. ACL (Access Control Lists) are one of the methods that can be used to control data flow. An ACL is a series of ordered rules composed of permit or deny statements. These rules describe data packet through parameters such as the source address, destination address, port number and protocol. An ACL can be applied in the following situations:

: s ce

h

r u so

e R 1, Packet filtering as part of the network security protection g Packet filtering is used between two networks with n mechanism. i priorities to control the data flow of a network (inbound different n arand outbound). When a firewall forwards the data packet, it will

M

e r o

Le

first detect packet header (i.e: source address/destination address, source port/destination port and upper-layer protocol), and then compare with configured rules. According to the result of the comparison, it can determine whether to forward the packet or to discard the packet. To implement packet filtering, a series of filtering rules are needed. It is possible to adopt an ACL to define filtering rule, and then apply the ACL to filter between the firewall zones, so as to implement packet filtering. Page669

2, NAT (Network Address Translation) is the process used to translate the IP address in a data packet header to another IP address. It mainly implements this function so that the internal network (using a private IP addressing) can forward traffic to the external network (using public IP addressing). In the actual application, it is hoped that some internal hosts (ing private IP addresses) can access the external network or Internet, while other internal hosts can not. It is implemented through association of the ACL and NAT address pool, meaning only data packets that satisfy the ACL rule can translate addresses, so as to control the range of address translation.

e w An ACL can also be applied to other scenarios involving IPSec,a u h QoS and routing policies. . g n i n r a e l / / : p t ht : s e c r u o s Re g n i n ar

m o c . i

e r o

Le

M

Page670

n e /

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

The firewall defines an ACL based on a numeral value. On USG 300/500/1000, an ACL can be divided into three kinds: basic ACL (2000～2999), advanced ACL (3000～3999), and firewall ACL (5000～5499). s can choose ACL according to the requirement in order to define different data flows. The data flow defined by the three kinds of ACL is different: basic ACL only uses source address to define data flow; advanced ACL uses source address, destination address, source port number, destination port number and protocol number to define data flow. The firewall ACL uses source address, destination address and destination port number to define data flow.

: s ce

h

r u so

g n i

Re

n r a

e r o

Le

M

Page671

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

One ACL can be composed of multiple ACL rules that include key word permit or deny.

: s ce

h

Use command “acl [ number ] acl-number [ vpn-instance vpninstance-name ]” in system view to create an ACL.

r u so

[ number ] acl-number can define one ACL. For basic ACL, the range is 2000～2999; for advanced ACL, the range is 3000～ 3999; for a firewall ACL, the range is 5000～5499.

e R vpn-instance refers to the creation of a firewall ACL rule. g Aftern enter basic ACL view, the command “rule [ rule-id ] i {n permit | deny } ar[ source { source-address source-wildcard | any } ] [ time-range

M

e r o

Le

time-name ]” can be used to create basic ACL rule:

rule-id is the number for each ACL rule, it is an optional parameter. When defining the ACL rule, if the ACL defines a number that already exists, the newly defined rule overwrite the old one. If it does not exist, it will create a new rule. If an ACL number is not appointed, and an ACL rule is defined, the system will automatically assign a number to the ACL rule.

Page672

Permit and deny means the applied action when a match occurs. “permit” will implement NAT or security policy detection on the data packet and allow accordingly. “deny” is opposite, it will not implement corresponding detection on a packet that is not in accordance with the conditions set in the ACL. “source { source-address source-wildcard | any }” indicates source address of an ACL rule “time-range time-name” indicates the time at which an ACL will take effect.

e w ua

m o c . i

After enter advanced ACL view, the command “rule [ rule-id ] { permit |deny } protocol [ source { source-address sourcewildcard | any } ] [ destination{ dest-address dest-mask | any } ] [ source-port operator port1 [ port2 ] ][ destination-port operator port1 [ port2 ] ] [ icmp-type { icmp-type icmp-code | icmp-message } ] [ precedence precedence ] [ tos tos ] [ timerange timename ]” can be used to create an advanced ACL rule: the usage of the key word and parameter is the same with those in basic ACL rules.

h . ng

i n ar

e l //

: p tt

“protocol” uses name or number to indicate protocol type of IP carrier.

h

An advanced ACL can filter multiple protocols, for example: T . UDP、ICMP、IP and so on. The IP packet is used to transmit T and UDP, if we choose to filter IP protocols in protocol field, it means to permit or refuse all the IP transmission based protocol, like ICMP message, T messages or UDP messages; if we only plan to discard packets of specific protocols and permit other packets to , then we must appoint those specific protocols.

: s ce

r u so

Re

g n i “destination { dest-address dest-wildcard | any }” indicates the n arlayer three destination of an ACL rule.

M

e r o

Le

“icmp-type” indicates message type and code information of an ICMP packet, it can take effect only when the ICMP protocol packet type parameter is defined. If it is not configured, it means any ICMP packet can match.

Page673

n e /

“source-port” is used to indicate the layer four source port, it can take effect only when the source port is defined. If it is not indicated, it means any packet from any source port can match. “destination-port” is used to indicate the layer four destination port, it can take effect only when the destination port it defined. If it is not indicated, it means a packet for any destination port can match. Precedence: An optional parameter, in which a data packet can be filtered according to priority, the range is 0～7 number or name.

e w ua

m o c . i

tos: An optional parameter, that allows a data packet to be filtered according to the service type. The range is 0～15 number or name.

h . g One firewall can include multiple ACL groups. Wheni anpacket n when matches an ACL rule, it should obey the following rule: r matching an ACL rule, the firewall ACL has priority a over an e advanced ACL, an advanced ACL has priority over a basic ACL. l / In firewall ACL, advanced ACL and basic types, the ACL /ACLfirst. : with the smaller acl-number will be matched In the same p t has priority over others. ACL rule group, rule with smaller rule-id t Once the data flow has matched an h ACL successfully, it will not continue to look for further : matches. A firewall will implement s other operations on data e flow according to the ACL rule. c r u o s Re g n i n ar

e r o

Le

M

Page674

n e /

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: s ce

: p tt

h

r u so

g n i

Re

n r a

e r o

Le

M

Page675

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

NAT is the process to transitioning individual IP addresses in IP data packet headers to an alternative IP address. In the actual application, NAT mainly implements the function to allow end systems in a private network to forward traffic over the external network.

: s ce

r u so

Public IP address space is limited, and as the world’s networks continue to grow, available public IP address ranges have been completely absorbed. It is impossible to use the IPv4 address scheme for to apply individual public IP addresses for all end system devices. The solution has been until now to use private IP addresses in internal enterprise networks and use public IP addressing as an external interface to an internal network. The private IP address cannot be used within the WAN domain, so if s with private IP addresses need to access the public network, addresses must be translated using NAT. It is possible to use a small number of public address to represent such a large number of private addresses (internal s). Attacks to government and enterprise networks over public networks has become increasingly frequent and complex. NAT can effectively hide private IP addresses, implement security precautions on the NAT egress routers which can reduce the difficulty associated with effective security.

g n i

n r a

M

e r o

Le

h

Page676

Re

In some cases, two enterprise networks may need to combine into a single network, however private address overlapping commonly occurs. IP addressing schemes should be redesigned, but it is hard to implement effectively in a short time without causing downtime to s. Here, we can configure NAT on the egress routers for the two internal networks. The egress routers can act as a public interface between the two private networks. Hosts of one internal network can translate private addresses a public IP address in order to reach the external interface of the other network. The NAT router of the receiving network can the source and translate accordingly.

e w ua

m o c . i

h . ng

i n ar

e l //

: s ce

: p tt

h

r u so

g n i

Re

n r a

e r o

Le

M

Page677

n e /

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

Internet address distribution regulates that the following three network address ranges are reserved as private address ranges.

h

: s e 172.16.0.0 -172.31.255.255 c r 192.168.0.0-192.168.255.255 u o addresses will not be distributed on Internet, The three network s ebe used as part of an internal enterprise (LAN). The but they can R enterprise proper network address range according to g chooses n foreseeable host quantity required. Different enterprises can i the same internal network addressing. If a company does n have arnot choose the network address above as an internal network 10.0.0.0 - 10.255.255.255

M

e r o

Le

address, the routing table may endure some confusion. So when constructing an internal LAN, it is recommended that one of the network address schemes above should be used for internal network addressing. Public addressing is legal and IP addresses can be obtained from Internet address distribution organization, most this means application of public addressing from ISP as part of a typical subscription package.

Page678

As referred before, when private IP address s wish to access public address domains such as the Internet, they must translate private addresses to public addresses through NAT.

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: s ce

: p tt

h

r u so

g n i

Re

n r a

e r o

Le

M

Page679

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

When the Trust Zone establishes a connection to the Untrust Zone and DMZ on the USG firewall, it will detect whether corresponding data needs to implement NAT translation. If it is needed, it will be completed at the egress of IP forwarding interface, the source address of the packet (a private address) is translated to a public address. At the ingress of the IP layer, the reply packet destination address (public address) will be translated to a private address.

: s ce

h

r u so

e R As shown in the figure above, the USG firewall is located at a g network boundary. When an internal PC A n private/public i (192.168.1.3) sends data packet1 to external server B n r a (202.120.10.2), the data packet will go through the firewall. The

M

e r o

Le

NAT process will check the content of the packet header, it will find that the packet is destined for an external network, and translate private address 192.168.1.3 in the source address field of packet 1 into public address 202.169.10.1. The packet can then be sent with the translated address to external server B and record the private to public address mapping in the NAT table. External server B will send a reply packet (packet 2) to internal PC A (the initial destination address is 202.169.10.1),

Page680

when the packet gets to the firewall, NAT will check the packet and lookup record in the NAT table. The destination address will be replaced by a private address 192.168.1.3 of the internal PC. The NAT process referred above is transparent to end system devices (for example, the PC A-D and server). For the external server, it regards IP address of internal PC as 202.169.10.1, it is totally unaware of the address 192.168.1.3. Therefore in this manner, NAT is able to “hide” the private network of an enterprise.

e w ua

m o c . i

h . ng

i n ar

e l //

: s ce

: p tt

h

r u so

g n i

Re

n r a

e r o

Le

M

Page681

n e /

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

On USG firewall, there are two modes of address transition: NO_PAT and NAPT.

h

: s e addresses correspond to individual NO_PAT: Individual private c public addresses, itr does not need to associate ports with u addresses in order to translate, and is straight forward to o s implement. The is that by corresponding a single Re todisadvantage private address a single public address, it does not solve the g problem associated with public addressing. It does help shortage n to map i internal devices such as servers to allow direct mapping n which the ability for external devices to reach such ardevicessimplifies internally without knowing the associated internal

M

e r o

Le

address, or having any means to by the firewall.

NAPT: It permits multiple private addresses to map to a single public address. NAPT will map IP addresses and port numbers. The data packet from different internal addresses can be mapped to the same external address, but the port number in each case or session will be different so as to distinguish between the different internal hosts. As shown in the figure above,

Page682

when four data packets with internal addresses reach the NAT server, packet 1 and 2 are shown to be from the same internal address but since the destination is different for the two packets, there will be a different port number associated with each packet. Packet 3 and 4 are from different internal addresses but have same port number. Through NAT transition, the four packets are transited to the same external address, but each packet has different source port number, so the differentiation between the four packets is maintained. When the reply packet gets to the NAT server, the NAT server will also identify the packet according to the destination address, and the port number of the reply packet helps to forward packet to the right internal host. USG adopts this mode by default. USG series of firewall s overlapping of IP addresses for outgoing interfaces and address pools. USG s regarding IP address of outbound interface as translated source addresses (called Easy IP), USG300/500/1000 however does not this function.

e w ua

m o c . i

h . ng

i n ar

e l //

: s ce

: p tt

h

r u so

g n i

Re

n r a

e r o

Le

M

Page683

n e /

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

NAT hides the structure of the internal network, and has the capability to “shield” internal hosts, while at the same time it makes it capable for external devices to access internal hosts, for example, WWW server or FTP server. NAT can internal servers, for example, address 202.168.0.11 which can be used as an external address for the Web server, or address 202.168.0.12 which can be used as the external address of internally located FTP server.

: s ce

h

r u so

Re

g n NAT iprovides internal server function that external network can n access. shown in the figure above, when of external arnetwork Asaccess internal server, NAT will translate public

M

e r o

Le

destination IP addresses of packets into private destination IP addresses of internal servers. For the reply packet of each internal server, NAT can translate the source of reply packets to public addresses. NAT and NAPT can only translate header addresses of IP packets and also the port information of T/UDP headers. For some special protocol,

Page684

like ICMP and FTP, the data part of a packet may include an IP address or port information, this content can not be translated by NAT effectively, which will lead to problems. For example, one FTP server that uses an internal IP address needs to send its IP address to a peer when it establishes a session with an external host. The address information is carried in the data part of the packet, it can not be translated by NAT. When external network host receives the private address and uses it, FTP server will regard it as unreachable. The solution to solve this NAT problem is through a special protocol ALG (Application Level Gateway) in NAT implementation. ALG is a translation proxy of a special application protocol, it alternates with NAT and uses NAT state information to change special data that is encapsulated in data part of an IP packet, it also completes other necessary work to make the application protocol run in different ranges.

e w ua

m o c . i

h . ng

i n ar

e l //

USG firewalls functions as a perfect address translation application level gateway mechanism, it can all kinds of special application protocol, it is unnecessary to modify NAT platform and has good extension.

: s ce

: p tt

h

At present, it has implemented ALG function of application protocol for: DNS, FTP, H.323, HWCC, ICMP, ILS, MG (Media Gateway Control Protocol), MSN , NetBIOS, PPTP , QQ, RAS and SNP.

r u so

g n i

Re

n r a

e r o

Le

M

Page685

n e /

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

NAT combines NO-PAT mode and NAPT effectively on USG firewall. If NAPT function is configured, in the process of address transition, NAT will first translate private IP addresses into one public IP address, and then choose another public IP address to complete address translation. Address pool is the aggregation of public IP addresses used for transition. s should configure a proper address pool according to the legal IP address quantity, host quantity within internal network and actual applications.

: s ce

h

r u so

Re

g n USG i firewall utilizes ACL to limit address translation. Only the n data that satisfy ACL can implement address translation, arwhichpackets can control the range of address translations effectively

e r o

Le

and allow the special host access to the external network.

M

Page686

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

This example introduces how NAT is configured on USG. As shown in the figure above, firewall divides network into the internal network Trust Zone, external Untrust Zone and DMZ. The host with the private address in Trust Zone needs to access the external network (Internet). The host with public address in Untrust Zone needs to access the three servers of the DMZ.

: s ce

h

r u so

g n i

Re

n r a

e r o

Le

M

Page687

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

[USG2100] nat address-group 1 202.168.0.10 202.168.0.20

h

//configure NAT address pool with series number 1, it includes public address for NAT transition.

: s e trust untrust outbound [USG2100]nat-policy c interzone rbetween two areas //defining nat policy u o [USG2100-nat-policy-interzone-trust-untrust-outbound]policy 1 s e R [USG2100-nat-policy-interzone-trust-untrust-outbound-1]policy sourceg192.168.0.0 mask 24 n the range of source IP addresses to be enabled NAT i //Defining n r [USG2100-nat-policy-interzone-trust-untrust-outbounda

M

e r o

Le

1]address-group 1 no-pat //Binding address pool.

[USG2100-nat-policy-interzone-trust-untrust-outbound-1]action source-nat //Enable nat

Page688

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

[USG2100] nat server global 202.168.0.10 inside 192.168.1.100

h

[USG2100] nat server protocol t global 202.168.0.11 80 inside 192.168.1.101 8080

: s e t global 202.168.0.12 1021 [USG2100] nat serverrotocol r ftp inside 192.168.1.102 u oserver” is used to define the mapping table of //command “nat s e The three commands above define separately the internal server. R that each can access the internal server 192.168.1.100 gpublic address 202.168.0.10 is able to access the through n i server, 192.168.1.101:8080 through public address internal n ar202.168.0.11:80, is able to access the internal Web server, and

M

e r o

Le

192.168.1.102 through public address 202.168.0.12:1021. is able to access the internal FTP server. [USG2100]policy interzone dmz untrust inbound //defining filtering policy between two areas [USG2100-policy-interzone-dmz-untrust-inbound]policy 1 [USG2100-policy-interzone-dmz-untrust-inbound-1]policy destination 192.168.1.0 mask 24

Page689

//Defining the range of destination IP addresses matched with filtering policies [USG2100-policy-interzone-dmz-untrust-inbound-1]policy service service-set ftp //Defining the service-type matched with filtering policies [USG2100-policy-interzone-dmz-untrust-inbound-1]action deny

m o c . i

e w ua

h . ng

i n ar

e l //

: s ce

r u so

g n i

n r a

e r o

Le

M

Page690

Re

h

: p tt

n e /

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: s ce

: p tt

h

r u so

g n i

Re

n r a

e r o

Le

M

Page691

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: s ce

r u so

g n i

n r a

e r o

Le

M

Page692

Re

h

: p tt

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

Q: Which operational modes does USG ?

h

A: Route mode, transparent mode and composite mode.

: s eUSG security zones? Q: What are the default c r Zone, DMZ and Local. u A: Trust Zone, Untrust o s e Q: What isRthe difference between a basic ACL and an advanced ACL?ng i A:nA basic ACL only uses the source address to define data flow, arwhereas an advanced ACL uses source/destination address,

M

e r o

Le

source/destination port and upper-layer protocol to define data flow. Q: Which forms of NAT does USG ? A: NO-PAT, NAPT.

Page693

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: s ce

r u so

g n i

n r a

M

e r o

Le

Re

h

: p tt

n e /

m o c . i

e w ua

h . ng

Module 6 rni a e l Product / /

c r u

g n i

n r a

M

e r o

Le

o s Re

: s e

h

: p tt

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: p tt

To calculate the spanning tree, switches need to exchange information and parameters. The information and parameters are encapsulated in the

: s e

h

Configuration Bridge Protocol Data Unit (BPDU) and transmitted between switches.

c r u

In a broad sense, a BPDU refers to a data unit used to exchange information between switches. The configuration BPDU is one type of the BPDU.

g n i

o s Re

Calculation of the spanning tree starts from election of the root bridge. The root bridge is elected based on the bridge identifier.

An bridge identifier consists of a 2-byte bridge priority and a 6-byte r a MAC address. The bridge priority is configurable. The value

M

e r o

Le

ranges from 0 to 65535 and the default value is 32768.

In the network, the switch with the smallest identifier becomes the root bridge. The system first compares the priority. If the switches have the same priority, the system compares their MAC addresses. The switch with the smallest MAC address is elected first. In this example, the three switches have the same priority. SWA has the smallest MAC address, so SWA is elected as the root bridge.

Page502

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: s ce

: p tt

h

r u so

g n i

Re

n r a

e r o

Le

M

Page697

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: s ce

r u so

g n i

n r a

e r o

Le

M

Page698

Re

h

: p tt

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: s ce

: p tt

h

r u so

g n i

Re

n r a

e r o

Le

M

Page699

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: s ce

r u so

g n i

n r a

e r o

Le

M

Page700

Re

h

: p tt

n e /

m o c . i

e w ua

h . ng

i n ar Router Huawei HUAWEI NetEngine40E UniversaleService (hereinafter referred to as the NE40E) / isla high-end router / core and backbone with 10-Gbit/s interfaces designed : for p as the edge or networks. The NE40E is positioned t t convergence router on the IPh backbone network. : s e c r u o s Re g n ni

z

e r o

r a e

L

M

Page701

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: s ce

r u so

g n i

n r a

e r o

Le

M

Page702

Re

h

: p tt

n e /

m o c . i

e w ua

h . ng

z

i n rAll LPUs can a This is the introduction of NE40E product family. lemain difference be applied to NE40E-X16, X8 or X3. / The / between LPUs is forwarding capability. : p t ht : s e c r u o s Re g n i

n r a

e r o

Le

M

Page703

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: s ce

r u so

g n i

n r a

e r o

Le

M

Page704

Re

h

: p tt

n e /

m o c . i

e w ua

h . ng

z

i n ras shown in a The NE40E-X adopts a system architecture e Figure above. In this architecture,/l the data plane, /monitoring plane are management and control plane, and : p system reliability and separated. This design helps to improve t t plane. facilitates separate upgrade of heach : s e c r u o s Re g n i

n r a

e r o

Le

M

Page705

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: s ce

r u so

g n i

n r a

e r o

Le

M

Page706

Re

h

: p tt

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: s ce

: p tt

h

r u so

g n i

Re

n r a

e r o

Le

M

Page707

n e /

m o c . i

e w ua

h . ng

z

i n r a The control plane of the NE40E-X16 adopts MPU. e l The following USB interface attributes are/ed by MPU: / : s the biggest USB fat32 p format, and s the t memory available in the market. ht For security reasons : not allowed to write USB storage s device . e c r Updates automatically, insert the USB memory without u o any operating. s e R g n i

z

‡

‡

‡

n r a

e r o

Le

M

Page708

n e /

m o c . i

e w ua

h . ng

z

i n r the data a The control plane of the NE40E is separated from e l plane and the monitoring plane. The SRU is / adopted on the / NE40E-X8. The SRU integrates an : SFU used for data p switching. t t h are ed by SRU: The following USB interface attributes :USB fat32 format, and s the s s the biggest e in the market. c memory available r u For security o reasons not allowed to write USB storage s device Re . gUpdates automatically, insert the USB memory without n i any operating.

z

‡

‡

‡

n r a

e r o

Le

M

Page709

n e /

m o c . i

e w ua

h . ng

z

i n r the system a The MPU of the NE40E-X3 controls and manages e l and switches data. The MPUs work in 1+1 backup mode. The / / MPU consists of the main control unit, : switching unit, system p clock unit, synchronous clock unit, t and system maintenance t unit. The functions of the hMPU are described from the following aspects. : s e c r u o s Re g n i

n r a

e r o

Le

M

Page710

n e /

m o c . i

e w ua

h . ng

z

i n r and is a A switching network is a key component of the NE40E e l responsible for switching data between LPUs. / / : p t t h : s e c r u o s Re g n i

n r a

e r o

Le

M

Page711

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: s ce

r u so

g n i

n r a

e r o

Le

M

Page712

Re

h

: p tt

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: s ce

: p tt

h

r u so

g n i

Re

n r a

e r o

Le

M

Page713

n e /

m o c . i

e w ua

h . ng

z

z

i n r (PFE) a As shown in the figure, the Packet Forwarding Engine le Specific adopts a Network Processor (NP) or an/Application / high-speed packet Integrated Circuit (ASIC) to implement : p Static Random Access routing. External memory types include t Memory (SRAM), Dynamic Random ht Access Memory (DRAM), and Net Search Engine (NSE). : The SRAM stores forwarding s entries; the DRAM stores e packets; the NSE performs nonc linear searching. r u o Data forwarding s processes can be divided into upstream and e downstream R processes based on the direction of the data flow. g n iUpstream process: The Physical Interface Card (PIC)

n encapsulates packets to frames and then sends them to the r a z

M

e r o

Le

PFE. On the PFE of the inbound interface, the system

decapsulates the frames and identifies the packet types. It then classifies traffic according to the QoS configurations on the inbound interface. After traffic classification

Page714

, the system searches the Forwarding Information Base (FIB)

z

for the outbound interfaces and next hops of packets to be forwarded. To forward an IPv4 unicast packet, for instance, the system searches the FIB for the outbound interface and next hop according to the destination IP address of the packet. Finally, the system sends the packets containing information about outbound interfaces and next hops to the traffic management (TM) module.

n e /

have been identified in the upstream process and about the outbound interfaces is encapsulated through the link layer protocol and the packets are stored in corresponding queues for transmission. If an IPv4 packet whose outbound interface is an Ethernet interface, the system needs to obtain the MAC address of the next hop. Outgoing traffic is then classified according to the QoS configurations on the outbound interfaces. Finally, the system encapsulates the packets with new Layer 2 headers on the outbound interfaces and sends them to the PIC.

e w ua

h . ng

i n ar

e l //

: s ce

: p tt

h

r u so

g n i

Re

n r a

e r o

m o c . i

Downstream process: Information about packet types that

z

Le

M

Page715

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: s ce

r u so

g n i

n r a

e r o

Le

M

Page716

Re

h

: p tt

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: s ce

: p tt

h

r u so

g n i

Re

n r a

e r o

Le

M

Page717

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: s ce

r u so

g n i

n r a

e r o

Le

M

Page718

Re

h

: p tt

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: s ce

: p tt

h

r u so

g n i

Re

n r a

e r o

Le

M

Page719

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: s ce

r u so

g n i

n r a

e r o

Le

M

Page720

Re

h

: p tt

n e /

m o c . i

e w ua

h . ng

z

i n r is the a The NE40E s entire HQoS solutions, HUAWE e l only vendor that s HQoS, DS-TE and / MPLS HQoS, / the other vendors one or two. : Thus, HUAWEI can p provide a entire HQoS solution to t meet kinds of scenarios of t carrier-class services. h : s e c r u o s Re g n i

n r a

e r o

Le

M

Page721

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: s ce

r u so

g n i

n r a

e r o

Le

M

Page722

Re

h

: p tt

n e /

m o c . i

e w ua

h . ng

z

i n r and IDC a The main scenario of NE40E Router: Campus e l interconnection, Large branch access, Key nodes / of WAN. / : p t t h : s e c r u o s Re g n i

n r a

e r o

Le

M

Page723

n e /

m o c . i

e w ua

h . ng

z

i n r of NE40EWhat is the difference between the control planes a e X8 and NE40E-X16? l The control plane of the NE40E-X8 / is separated from the / data plane and the monitoring plane. The SRU is :SRU integrates adopted on the NE40E-X8. The an SFU p t used for data switching. tNE40-X16 is MPU, on which h The control plane of the doesn’t integrate SFU. : the SFUs of NE40E-X8 and s What is the difference between e NE40E-X16? c r The SFU u on the NE40E-X8 switches data for the entire system o at wire speed of 480 Gbit/s (240 Gbit/s for the s upstream and 240 Gbit/s for the downstream e Thistraffic traffic). ensures a non-blocking switching network. R The NE40E-X8 has three SFUs working in 2+1 load g balancing mode. The entire system provides a switching in capacity at wire speed of 1.44 Tbit/s. The three SFUs ‡

‡

z

‡

n r a

e r o

Le

M

Page724

load balance services at the same time. When one SFU is faulty or replaced, the other two SFUs automatically take over its tasks to ensure normal running of services. ‡ The SFU on the NE40E-X16 switches data for the entire system at wire speed of 640 Gbit/s (320 Gbit/s for the upstream traffic and 320 Gbit/s for the downstream traffic). This ensures a non-blocking switching network. The NE40E-X16 has four SFUs working in 3+1 load balancing mode. .The entire system provides a switching capacity at wire speed of 2.56 Tbit/s. The four SFUs load balance services at the same time. When one

SFU is faulty or replaced, the other three SFUs automatically take over its tasks to ensure normal running of services.

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: s ce

: p tt

h

r u so

g n i

Re

n r a

e r o

Le

M

Page725

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: s ce

r u so

g n i

n r a

e r o

Le

M

Page726

Re

h

: p tt

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: s ce

: p tt

h

r u so

g n i

Re

n r a

e r o

Le

M

Page727

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: s ce

r u so

g n i

n r a

e r o

Le

M

Page728

Re

h

: p tt

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: s ce

: p tt

h

r u so

g n i

Re

n r a

e r o

Le

M

Page729

n e /

m o c . i

e w ua

h . ng

z

i n r The first a Huawei routers have evolved for three generations. e l generation routers use integrated single-core / design, the / second generation routers integrated : multi-core design, and p the third-generation routers distributed t multi-core design. t h (AR G3 routers for short) Huawei AR G3 series routers :access modes, including Ethernet, multiple network s e PON, and 3G. c r are the next-generation routing and u The AR G3 routers o that provide routing, switching, wireless, s gateway devices Re security services. The AR G3 routers include the voice, and g AR2200, and AR3200 series routers. AR1200, n i

z

z

n r a

e r o

Le

M

Page730

n e /

m o c . i

e w ua

h . ng

z

i n r in the a The AR G3 routers provide the highest port density e industry and flexible service interface/lcard (SIC) slots, / to a LAN, WAN, or allowing enterprise customers to connect : wireless network. The AR G3tp routers provide the most t economical enterprise network h solutions. : flexible slot combinations. Two The AR G3 routers provide s e into one WSIC slot, two WSIC SIC slots can be combined c r slot, and two XSIC slots into one EXSIC slots into one XSIC u o slot. s Re hardware design, the AR G3 routers allow With extensible g to choose SICs flexibly and to expand networks customers n ieconomically.

z

z

n r a

e r o

Le

M

Page731

n e /

m o c . i

e w ua

h . ng

z

i n r of routers, a The AR G3 routers integrate various services e l switches, and wireless devices, including voice, / firewall, and / VPN. : p t t h : s e c r u o s Re g n i

n r a

e r o

Le

M

Page732

n e /

m o c . i

e w ua

h . ng

z

i n rcan access a Depending on telecom carriers' networks, s e l these networks by using CE1/CT1, FE/GE, ADSL, G.SHDSL, / / or Synchronization Agent (SA). The:AR G3 routers provide p These routers provide dual-uplink to ensure service reliability. t the following services for access hts: : routing, switching, VPN, and Provide the security, s e to ensure secure, fast, and reliable wireless services c rforwarding. data packet u oa variety of value-added services, including s Provide Re network address translation (NAT), domain name DH, gsystem (DNS), and billing services. n i ‡

‡

n r a

M

e r o

Le

‡

Provide

security

control

mechanisms,

including

controlling access to internal networks and rights, to ensure the access security on the enterprise intranet and isolate the departments of an enterprise. ‡

Provide the attack defense function to protect traffic against attacks from the external and internal networks. .Guarantee -specific QoS and service-specific QoS and flexibly allocate bandwidth for services as needed. Page733

The headquarters and branches use the AR G3 routers to connect each other on the Internet. The enterprise establishes

z

a VPN and uses GRE/IPSec VPN tunnels to secure the data. The employees on a business trip use IPSec VPN tunnels to communicate with the headquarters. The AR G3 routers, located between the enterprise intranet

z

and the Internet, ensure information security on the entire intranet and intranet LANs. Additionally, the AR G3 routers provide network access control (NAC) to restrict the access permissions of internal s. This ensures that only authorized s can access the intranet.

z

e w a An enterprise can build a voice communication system over u h . the IP network, saving fees on internal communication. Within gcan n the voice communication system, an AR G3 router ni In the function as an IP PBX or SIP access gatewayr(AG). as (analog downlink direction, the router connects to POTS e l (UE) s phones or fax machines) and SIP equipment / / FXS or Ethernet (IP phones or PC software terminals):through pthe router connects to the interfaces. In the uplink direction, t t or to the IP network PSTN through E1 or FXS h interfaces through Ethernet interfaces. : s e c r u o s Re g n i

n r a

e r o

m o c . i

Le

M

Page734

n e /

n e /

m o c . i

e w ua

h . ng

z

z

z

i n roffices. They a The AR200 series routers apply to small-scale e l integrate switching and routing functions. / These routers / provide wireline LAN access and wireless : AP access to s. p With them, s can access the t Internet through Ethernet, t 3G, or PPPoE. h : feature powerful routing functions. The AR1200 series routers s e access modes, such as wireline LAN They provide multiple c rAdditionally, these routers provide flexible and wireless AP. u o s to install subcards to extend interfaces slots that allow s and enrich Refunctions. gAR2200 series routers feature powerful routing functions The n iand multiple access modes. They a variety of

n subcards to apply to different usage scenarios. Their slots can r a

M

e r o

Le

be combined to achieve a higher port density. Among them, the AR2240 is equipped with two main control boards and two power supplies for redundancy backup. This redundancy backup design improves the router usability and reliability.

Page735

The AR3200 series routers have a large capacity. They

z

provide many flexible slots that allow s to install different cards in different usage scenarios. Additionally, their slots can be combined to provide a higher port density. To improve system reliability, these routers are configured with two main control boards and two power supplies for redundancy backup.

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: s ce

r u so

g n i

n r a

e r o

Le

M

Page736

Re

h

: p tt

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: s ce

: p tt

h

r u so

g n i

Re

n r a

e r o

Le

M

Page737

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: s ce

r u so

g n i

n r a

e r o

Le

M

Page738

Re

h

: p tt

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: s ce

: p tt

h

r u so

g n i

Re

n r a

e r o

Le

M

Page739

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: s ce

r u so

g n i

n r a

e r o

Le

M

Page740

Re

h

: p tt

n e /

m o c . i

e w ua

h . ng

z

z

z

i n r families in a Huawei has the most extensive enterprise switch e l the industry, ranging from low-end, medium-range, to high/ / end. : p tS5700 switches are used at The S1700, S2700, S3700, and t the access layer of a campushnetwork. The S1700 and S2700 : The S3700 s Layer 3 FE provide Layer 2 FE access. s e for Layer 3 GE access and has a access. The S5700callows r Additionally, the S5700 s cluster high port density. u oand features high fault tolerance through the use management s of stacking Re technology. gS5700, S7700, and S9300 are used at the convergence The n ilayer of a campus network. These switches provide powerful

n switching functions and have a high port density. They also r a

M

e r o

Le

a variety of cards to apply to different usage scenarios where varying interfaces are required.

z

The S5700, S6700, S9300, and S12700 are high-end switches. These switches are used at the core layer of a

Page741

campus network. They also apply to the access and core

z

switching layers of a large-scale data center. With a high port density and a variety of cards, these switches provide various ports to meet different requirements.

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: s ce

r u so

g n i

n r a

e r o

Le

M

Page742

Re

h

: p tt

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: s ce

: p tt

h

r u so

g n i

Re

n r a

e r o

Le

M

Page743

n e /

m o c . i

e w ua

h . ng

z

i n r enterprise a The SX7 series switches are intended for the e l market. They provide Layer 2 and Layer 3 / access and FE, / GE, and 10GE ports. Among these : series switches, the STp level core switch7700 uses a t distributed architecture and t provides up to 12 slots thath allow s to install different cards in various usage scenarios. : s e c r u o s Re g n i

n r a

e r o

Le

M

Page744

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: s ce

: p tt

h

r u so

g n i

Re

n r a

e r o

Le

M

Page745

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: s ce

r u so

g n i

n r a

e r o

Le

M

Page746

Re

h

: p tt

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: s ce

: p tt

h

r u so

g n i

Re

n r a

e r o

Le

M

Page747

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: s ce

r u so

g n i

n r a

e r o

Le

M

Page748

Re

h

: p tt

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: s ce

: p tt

h

r u so

g n i

Re

n r a

e r o

Le

M

Page749

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: s ce

r u so

g n i

n r a

e r o

Le

M

Page750

Re

h

: p tt

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: s ce

: p tt

h

r u so

g n i

Re

n r a

e r o

Le

M

Page751

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: s ce

r u so

g n i

n r a

e r o

Le

M

Page752

Re

h

: p tt

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: s ce

: p tt

h

r u so

g n i

Re

n r a

e r o

Le

M

Page753

n e /

m o c . i

e w ua

h . ng

e l S2700/3700/5700/6700 is integrated /with internal HTTP / server, and can access the device : in the switch three-layer pbrowse. t interface through a variety of WEB ht : s e c r u o s Re g n i

z z

Principleᷛ

n r a

e r o

i n ar

Le

M

Page754

n e /

m o c . i

e w ua

h . ng

i n r implement a The following requirements must be met to e l stacking: / / All the member switches belong to : the same series. The EI p ta stack. series and SI series cannot form t h All the member switches are connected by using stack cables : s and stack modules. ce The stack rear rcard cannot be used together with the u E4GF/E4GFAoor E4XY front card. s e R g n ni

z

z

z

z

e r o

r a e

L

M

Page755

n e /

m o c . i

e w ua

h . ng

z

z z z

z

i n rprerequisites, a If all the member switches meet the stack setup e l the stack system is automatically created / when these / switches are powered on. : p tfollows: The master switch is selected as t h The device that starts first becomes the master switch. s: If all the devices starteat the same time, the one of the highest c priority becomes r the master switch. u o If all the devices s have the same priority and start at the same e time, the R one with the smallest MAC address becomes the master g switch. n iThe slave switch is selected as follows:

n r a The device that starts first among all the other devices z

M

e r o

Le

z

excluding the master switch becomes the slave switch. z

If all the other switches excluding the master switch start at

Page756

the same time, the master switch preferentially selects the

z

switch connected to its stack interface 1 as the standby switch. If all the other switches excluding the master switch start at the same time and no switch is connected to stack interface 1

z

on the master switch, the master switch selects the switch connected to its stack interface 0 as the standby switch.

n e /

e w ua

m o c . i

h . ng

i n ar

e l //

: s ce

: p tt

h

r u so

g n i

Re

n r a

e r o

Le

M

Page757

n e /

m o c . i

e w ua

h . ng

z

i n r It provides a The S7700 is a next generation switch of Huawei. e l large capacity, line-speed forwarding, and high / density ports. / The S7700 is an important product for : establishing the MANs p in the future. The S7700 can t be used as an aggregation t switch or a core switch for h enterprise networks, campus networks, and data centers. : s e into the S7703, S7706, and S7712. The S7700s are classified c r The S7700 is auhigh-end network product that provides wireo speed FE, s GE, and 10GE interfaces. The S7700 can function Reswitch for enterprise networks, campus networks, as a core gdata centers. and n i

z z

n r a

e r o

Le

M

Page758

n e /

m o c . i

e w ua

h . ng

z

i n rand S7712. a The S7700s are classified into the S7703, S7706, e l The S7700 uses a fully distributed/architecture and the / technology. The : latest hardware forwarding engine tpthe interfaces can be services ed by tall h These services include IPv4, forwarded at wire speed. MPLS, and Layers 2: forwarding services. The S7700 can e also use ACLscto forward packets at wire speed. rs wire-speed forwarding of multicast u The S7700 o The hardware implements 2-level multicast s packets. Re replication: gThe SFU replicates multicast packets to the LPU. n i ‡

‡

n r a

M

e r o

Le

‡

‡

‡

Then the forwarding engine of the LPU replicates the multicast packets to the interfaces on the LPU. The S7700 s 2 Tbit/s switching capacity and various high-density cards to meet the requirements for

Page759

‡

the large capacity and high-density interfaces of core

and convergence layer devices. The S7700 can meet the increasing bandwidth requirements and maximally reduce investments. S7703's switching capacity:

z

Adopting the full mesh architecture, the S7703 provides 16 Gbit/s bandwidth in each HIG group, that is, 4 x 5 Gbit/s x

z

8/10 (8B/10B code). The channel between each slot and the backplane s eight HIG groups; therefore, the total

e w There is no switching network unit in the full mesh a u architecture. The switching capability is 720 Gbit/s, that is, h . 120 Gbit/s x 2 x 3 (3 LPUs). g n i S7706/S7712's switching capacity: n r athe S7706 or Adopting the switching network architecture, e l HIG group, that S7712 provides 16 Gbit/s bandwidth in each / /The channel between is, 4 x 5 Gbit/s x 8/10 (8B/10B code). : p four HIG groups (an each slot and the backplane s t active SRU and a standby ht SRU); therefore, the total bandwidth for each slot is:64 Gbit/s. Each 12x10GE LPU slot s therefore, the total bandwidth is s eight HIG groups; e c 128 Gbit/s. (Onlyrtwo 12x10GE LPUs of the S7712 u wire-speed forwarding.) o s switching capability of the S7706 or S7712 is e The maximum R that is, 16 Gbit/s x 16 (ports) x 1 (switching 2048 Gbit/s, g n network i unit) x 2 (bidirectional) x 4 SRUAs. bandwidth for each slot is 128 Gbit/s.

z

z z

z

n r a

e r o

m o c . i

Le

M

Page760

n e /

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: s ce

: p tt

h

r u so

g n i

Re

n r a

e r o

Le

M

Page761

n e /

m o c . i

e w ua

h . ng

: s ce

r u so

g n i

n r a

e r o

e l //

ISSU=In-service software upgrade.

z

Le

M

Page762

Re

: p tt

h

i n ar

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: s ce

: p tt

h

r u so

g n i

Re

n r a

e r o

Le

M

Page763

n e /

m o c . i

e w ua

h . ng

z

i n r campus a The figure on this slide shows a typical enterprise e network. Within this network, you can/l clearly see where Huawei switches, routers, firewalls,:/ servers and other IT p products are located. Actually, Huawei t can provide a full range t of IT products and the most comprehensive network solutions h in the industry. : s e c r u o s Re g n i

n r a

e r o

Le

M

Page764

n e /

m o c . i

e w ua

h . ng

i n ar

e l Deployment Position ᷛBetween an internal / network and a / public network . : p Integrated access ᷛ Data:tt FE/GE/EPON/GPON/three 3G h IP-PBX ᷜ Switching: FE/GE modes ᷜ Voice: FXS and : switching cards/MSTP/VLAN/Static port aggregationᷜMPLS s e VPN . c r Security ᷛEnterprise-class firewall ᷜIntegrated VPN access: u o IPSec/GRE/MPLS. s e 2.What R are the Characteristics of Huawei Switches for Enterprises ᷠ g n Seamless upgrading of port switching capacity. i n

z

1. What is the positioning of AR G3 ᷠ ‡

‡

‡

z

ar

Mo

re

Le

‡

‡

Highly compatible software platform.

‡

Universal platform and energy-efficient chips.

Page765

n e /

m o c . i

e w ua

h . ng

i n ar

e l //

: s ce

r u so

g n i

n r a

M

e r o

Le

Re

h

: p tt

The privilege of HCNA/HCNP/HCIE: With any Huawei Career Certification, you have the privilege on http://learning.huawei.com/en to enjoy: 

n e /

1、Comprehensive E-Learning Courses

m o c



Content：All Huawei Career Certification E-Learning courses



Methods to get the E-learning privilege : submit Huawei and email being used for Huawei

w a u

registration to [email protected] . 

h . Content: Huawei product training material and Huawei career certification g training material n iTraining/Classroom Training ,then you can Method：Logon http://learning.huawei.com/en and enter HuaWei n ar training material in the specific training introductionepage. l 3、 Priority to participate in Huawei Online Open Class(LVC) / / : Content：The Huawei career certification training covering p all ICT technical domains like R&S, UC&C, Security, t Storage and so on, which are conducted by Huawei ht professional instructors : refer to LVC Open Courses Schedule Method：The plan and participate method please s e 4、Learning Tool: eNSP c ur is a graphical network simulation tool which is developed by eNSP (Enterprise Network SimulationoPlatform) smainly simulates enterprise routers, switches as close to the real hardware as e Huawei and free of charge. eNSP R it possible, which makes theglab practice available and easy without any real device. nup Huawei Technical Forum which allows candidates to discuss technical issues with i In addition, Huawei has built n r Huawei experts , share a exam experiences with others or be acquainted with Huawei Products( e L http://.huawei.com/ecommunity/） e r Mo 2、 Training Material 















. i e

HUAWEI TECHNOLOGIES CO., LTD.

Huawei Confidential

1

Hcna(hcda) Huawei Certified Network Associate Training.pdf 2y6v6v

Overview 6h3y3j

More details h6z72

Related Documents 543cg

Hcna(hcda) Huawei Certified Network Associate Training.pdf 2y6v6v

Abap_sap Certified Development Associate 6o5535

Aws Certified Developer Associate Guide 472j6s

Aws Certified Solution Architect Associate 6h237

Training Report On Ccna(cisco Certified Network Associate) 50n6u

Mtcna Pdf 360 Paginas Espanol Mikrotik Certified Network Associate w425l

More Documents from "Caco Pradas" 1i6q2d

Hcna(hcda) Huawei Certified Network Associate Training.pdf 2y6v6v

Chapter 1 Marketing 2r5855

Iron Maiden - Wasting Love.mp3 6j2z4d

Sni 03-0090-1999 Bronjong 326h2k

Ondas+solucoes 551d5k

Off The Job Safety 4p362a