H3C SecPath F5020 User manual

H3C Firewall Devices
Interface Configuration Guide (Comware V7)
Hangzhou H3C Technologies Co., Ltd.
http://www.h3c.com
Software version:
F5020/F5040 firewalls ESS9304
M9006/M9010/M9014 security
g
ateways ESS9114
VFW1000 virtual firewalls ESS9204
Document version: 5W100-20150116

Copyright © 2015, Hangzhou H3C Technologies Co., Ltd. and its licensors
All rights reserved
No part of this manual may be reproduced or transmitted in any form or by any means without prior
written consent of Hangzhou H3C Technologies Co., Ltd.
Trademarks
H3C, , H3CS, H3CIE, H3CNE, Aolynk, , H3Care, , IRF, NetPilot, Netflow,
SecEngine, SecPath, SecCenter, SecBlade, Comware, ITCMM and HUASAN are trademarks of
Hangzhou H3C Technologies Co., Ltd.
All other trademarks that may be mentioned in this manual are the property of their respective owners.
Notice
The information in this document is subject to change without notice. Every effort has been made in the
preparation of this document to ensure accuracy of the contents, but all statements, information, and
recommendations in this document do not constitute the warranty of any kind, express or implied.

Preface
The H3C firewall devices configuration guides (Comware V7) describe the software features and
configuration procedures for the Comware V7-based firewall devices in "Applicable devices." These
guides also provide configuration examples to help you apply software features to different network
scenarios.
The Interface Configuration Guide describes interface configuration. It covers the configuration for bulk
interfaces, Ethernet interfaces, loopback interfaces, null interfaces, inloopback interfaces, and Blade
interfaces.
This preface includes:
•Applicable devices
•Audience
•Conventions
•About the H3C firewall documentation set
•Obtaining documentation
•Technical support
•Documentation feedback
Applicable devices
This document applies to the following firewall devices:
Product series Model Device t
yp
e
H3C SecPath F5000 firewalls F5020/F5040 Centralized IRF devices. These
devices support IRF.
H3C SecPath M9000 multiservice
security gateways M9006/M9010/M9014
Distributed devices. These devices
support IRF. They can operate in
one of the following modes:
•Standalone mode—The device
cannot form an IRF fabric with
other devices.
•IRF mode—The device can form
an IRF fabric with other devices.
H3C SecPath virtual multiservice
security gateways VFW1000 Centralized devices. These devices do not support IRF.
Audience
This document is intended for:
•Network planners.
•Field technical support and servicing engineers.

•Network administrators working with the firewall devices.
Conventions
This section describes the conventions used in this document.
Command conventions
Convention Descri
p
tion
Boldface Bold text represents commands and keywords that you enter literally as shown.
Italic Italic text represents arguments that you replace with actual values.
[ ] Square brackets enclose syntax choices (keywords or arguments) that are optional.
{ x | y | ... }
Braces enclose a set of required syntax choices separated by vertical bars, from which
you select one.
[ x | y | ... ]
Square brackets enclose a set of optional syntax choices separated by vertical bars, from
which you select one or none.
{ x | y | ... } *
Asterisk marked braces enclose a set of required syntax choices separated by vertical
bars, from which you select at least one.
[ x | y | ... ] *
Asterisk marked square brackets enclose optional syntax choices separated by vertical
bars, from which you select one choice, multiple choices, or none.
&<1-n> The argument or keyword and argument combination before the ampersand (&) sign can
be entered 1 to n times.
# A line that starts with a pound (#) sign is comments.
GUI conventions
Convention Descri
p
tion
Boldface Window names, button names, field names, and menu items are in Boldface. For
example, the New User window appears; click OK.
> Multi-level menus are separated by angle brackets. For example, File > Create > Folder.
Symbols
Convention Descri
p
tion
WARNING An alert that calls attention to important information that if not understood or followed can
result in personal injury.
CAUTION An alert that calls attention to important information that if not understood or followed can
result in data loss, data corruption, or damage to hardware or software.
IMPORTANT An alert that calls attention to essential information.
NOTE An alert that contains additional or supplementary information.
TIP An alert that provides helpful information.

Network topology icons
Represents a generic network device, such as a router, switch, or firewall.
Represents a routing-capable device, such as a router or Layer 3 switch.
Represents a generic switch, such as a Layer 2 or Layer 3 switch, or a router that supports
Layer 2 forwarding and other Layer 2 features.
Represents a security product, such as a firewall, UTM, multiservice security gateway, or
load-balancing device.
Represents a security card, such as a firewall, load balancing, NetStream, SSL VPN, IPS,
or ACG card.
Port numbering in examples
The port numbers in this document are for illustration only and might be unavailable on your device.
About the H3C firewall documentation set
The H3C firewall documentation set includes:
Cate
g
or
y
Documents Pur
p
oses
Product description and
specifications Marketing brochures Describe product specifications and benefits.
Hardware specifications
and installation
Compliance and safety
manual
Provides regulatory information and the safety
instructions that must be followed during installation.
Quick start
Guides you through initial installation and setup
procedures to help you quickly set up and use your
device with the minimum configuration.
Installation guide Provides a complete guide to hardware installation
and hardware specifications.
Card manuals Provide the hardware specifications of cards.
H3C transceiver modules
user guide
Guides you through installing
SFP/SFP+/XFP/QSFP+/CFP/CXP transceiver
modules and CX4 cables.
Software configuration
Configuration guides Describe software features and configuration
procedures.
Command references Provide a quick reference to all available
commands.


Obtaining documentation
Access the most up-to-date H3C product documentation on the World Wide Web
at http://www.h3c.com.
Click the following links to obtain different categories of product documentation:
[Technical Documents]—Provides hardware installation, software upgrading, and software feature
configuration and maintenance documentation.
[Products & Solutions]—Provides information about products and technologies, as well as solutions.
[Software Download]—Provides the documentation released with the software version.
Technical support
servic[email protected]
http://www.h3c.com
Documentation feedback
You can e-mail your comments about product documentation to [e-mail].
We appreciate your comments.

i
Contents
Bulk configuring interfaces ·········································································································································· 1
Configuration restrictions and guidelines·······················································································································1
Configuration procedure··················································································································································2
Displaying and maintaining bulk interface configuration·····························································································2
Configuring Ethernet interfaces··································································································································· 3
Configuring common Ethernet interface settings ···········································································································3
Configuring a combo interface (single combo interface) ····················································································3
Configuring basic settings of an Ethernet interface or subinterface ···································································4
Configuring the link mode of an Ethernet interface······························································································5
Configuring jumbo frame support ··························································································································6
Configuring physical state change suppression on an Ethernet interface··························································7
Configuring dampening on an Ethernet interface ································································································8
Performing a loopback test on an Ethernet interface····························································································9
Configuring generic flow control on an Ethernet interface··············································································· 10
Setting the statistics polling interval····················································································································· 11
Enabling subinterface rate statistics collection on an Ethernet interface ························································· 12
Forcibly bringing up a fiber port ························································································································· 13
Configuring a Layer 2 Ethernet interface ···················································································································· 15
Setting speed options for autonegotiation on an Ethernet interface ································································ 15
Configuring storm suppression ···························································································································· 16
Configuring storm control on an Ethernet interface··························································································· 17
Setting the MDIX mode of an Ethernet interface ································································································ 18
Testing the cable connection of an Ethernet interface······················································································· 19
Configuring a Layer 3 Ethernet interface or subinterface·························································································· 19
Setting the MTU for an Ethernet interface or subinterface ················································································ 19
Configuring the MAC address of an Ethernet interface or subinterface ························································· 20
Displaying and maintaining an Ethernet interface or subinterface··········································································· 21
Configuring loopback, null, and inloopback interfaces··························································································22
Configuring a loopback interface ································································································································ 22
Configuring a null interface ·········································································································································· 23
Configuring an inloopback interface··························································································································· 23
Displaying and maintaining loopback, null, and inloopback interfaces ································································· 23
Configuring Blade interfaces·····································································································································24
Overview········································································································································································· 24
Feature and hardware compatibility···························································································································· 24
Displaying and maintaining a Blade interface ··········································································································· 24
Index ···········································································································································································25

1
Bulk configuring interfaces
You can enter interface range view to bulk configure multiple interfaces with the same feature instead of
configuring them one by one. For example, you can execute the shutdown command in interface range
view to shut down a range of interfaces.
Configuration restrictions and guidelines
When you bulk configure interfaces in interface range view, follow these restrictions and guidelines:
•In interface range view, only the commands supported by the first interface are available. The first
interface is specified with the interface range command.
•You cannot enter the view of some interfaces by using the interface interface-type
{ interface-number | interface-number.subnumber } command, for example, BRI 1/1/1:1. Do not
configure any of these interfaces as the first interface in the interface range.
•Do not assign both an aggregate interface and any of its member interfaces to an interface range.
Some commands, after being executed on both an aggregate interface and its member interfaces,
can break up the aggregation.
•No limit is set on the maximum number of interfaces in an interface range. The more interfaces in
an interface range, the longer the command execution time.
•The maximum number of interface range names is limited only by the system resources. To
guarantee bulk interface configuration performance, H3C recommends that you configure fewer
than 1000 interface range names.
•After a command is executed in interface range view, one of the following situations might occur:
{The system displays an error message and stays in interface range view. It means that the
execution fails on member interfaces in the interface range.
−If the execution fails on the first member interface in the interface range, the command is not
executed on any member interfaces.
−If the execution fails on non-first member interfaces, the command takes effect on the other
member interfaces.
{The system returns to system view. It means that:
−The command is supported in both system view and interface view.
−The execution fails on a member interface in interface range view and succeeds in system
view.
−The command is not executed on the subsequent member interfaces.
You can use the display this command to verify the configuration in interface view of each
member interface. In addition, if the configuration in system view is unnecessary, use the undo
form of the command to remove the configuration.

2
Configuration procedure
Ste
p
Command Remarks
1. Enter system view. system-view N/A
2. Enter interface range
view.
•interface range { interface-type
interface-number [ to
interface-type
interface-number ] } &<1-5>
•interface range name name
[ interface { interface-type
interface-number [ to
interface-type
interface-number ] } &<1-5> ]
By using the interface range name
command, you assign a name to an
interface range and can specify this
name rather than the interface range to
enter the interface range view.
3. (Optional.) Display
commands available for
the first interface in the
interface range.
Enter a question mark (?) at the
interface range prompt. N/A
4. Use available
commands to configure
the interfaces.
Available commands depend on the
interface. N/A
5. (Optional.) Verify the
configuration. display this N/A
Displaying and maintaining bulk interface
configuration
Execute the display command in any view.
Task Command
Display information about the interface ranges
created by using the interface range name command.
display interface range [name name ]

3
Configuring Ethernet interfaces
Your device supports the following types of Ethernet interfaces:
•Layer 2 Ethernet interfaces—Physical Ethernet interfaces operating at the data link layer (Layer 2)
to switch packets.
•Layer 3 Ethernet interfaces—Physical Ethernet interfaces operating at the network layer (Layer 3) to
route packets. You can assign an IP address to a Layer 3 Ethernet interface.
•Layer-configurable Ethernet interfaces—Physical Ethernet interfaces that can be configured to
operate in bridge mode as Layer 2 Ethernet interfaces or in route mode as Layer 3 Ethernet
interfaces.
•Layer 3 Ethernet subinterfaces—Logical interfaces operating at the network layer. You can assign
an IP address to a Layer 3 Ethernet subinterface. To enable a Layer 3 Ethernet interface to transport
packets for multiple VLANs, you must create Layer 3 subinterfaces on the Layer 3 Ethernet interface.
For information about how a Layer 3 Ethernet subinterface sends and receives VLAN-tagged
packets, see Layer 2—LAN Switching Configuration Guide.
Configuring common Ethernet interface settings
This section describes the settings common to Layer 3 Ethernet interfaces, and Layer 3 Ethernet
subinterfaces. For more information about the settings specific to Layer 2 Ethernet interfaces, see
"Configuring a Layer 2 Ethernet interface." For more information about the settings specific to Layer 3
Ethernet interfaces or subinterfaces, see "Configuring a Layer 3 Ethernet interface or subinterface."
Configuring a combo interface (single combo interface)
A combo interface is a logical interface that physically comprises one fiber combo port and one copper
combo port. The two ports share one forwarding channel and one interface view. As a result, they cannot
work simultaneously. When you activate one port, the other port is automatically disabled. In the
interface view, you can activate the fiber or copper combo port, and configure other port attributes such
as the interface rate and duplex mode.
Configuration prerequisites
Before you configure combo interfaces, complete the following tasks:
•Determine the combo interfaces on your device. Identify the two physical interfaces that belong to
each combo interface according to the marks on the device panel.
•Use the display interface command to determine which port (fiber or copper) of each combo
interface is active:
{If the copper port is active, the output includes "Media type is twisted pair, Port hardware type
is 1000_BASE_T."
{If the fiber port is active, the output does not include this information.
Also, you can use the display this command in the view of each combo interface to display the
combo interface configuration:
{If the fiber port is active, the combo enable fiber command exists in the output.

4
{If the copper port is active, the combo enable fiber command does not exist in the output.
Changing the active port of a combo interface
Ste
p
Command Remarks
1. Enter system view. system-view N/A
2. Enter Ethernet interface view. interface interface-type
interface-number N/A
3. Activate the copper combo
port or fiber combo port. combo enable {copper |fiber }By default, the copper combo port
is active.
Configuring basic settings of an Ethernet interface or
subinterface
You can configure an Ethernet interface to operate in one of the following duplex modes:
•Full-duplex mode—The interface can send and receive packets simultaneously.
•Half-duplex mode—The interface can only send or receive packets at a given time.
•Autonegotiation mode—The interface negotiates a duplex mode with its peer.
You can set the speed of an Ethernet interface or enable it to automatically negotiate a speed with its
peer. For a 100-Mbps or 1000-Mbps Layer 2 Ethernet interface, you can also set speed options for
autonegotiation. The two ends can select a speed only from the available options. For more information,
see "Setting speed options for autonegotiation on an Ethernet interface."
Configuring an Ethernet interface
Ste
p
Command Remarks
1. Enter system view. system-view N/A
2. Enter Ethernet interface
view.
interface interface-type
interface-number N/A
3. Set the description for
the Ethernet interface. description text
The default setting is interface-name
Interface. For example,
GigabitEthernet1/0/1 Interface.
4. Set the duplex mode for
the Ethernet interface. duplex { auto | full | half }
By default:
•The duplex mode is full for 10-GE and
40-GE interfaces.
•The duplex mode is auto for other
Ethernet interfaces.
Fiber ports do not support the half
keyword.
5. Set the speed for the
Ethernet interface.
speed { 10 | 100 |1000 |
10000 |40000 |100000 |
auto }
By default, an Ethernet interface
autonegotiates its speed.
6. Set the expected
bandwidth for the
Ethernet interface.
bandwidth bandwidth-value
By default, the expected bandwidth (in
kbps) is the interface baud rate divided by
1000.

5
Ste
p
Command Remarks
7. Restore the default
settings for the Ethernet
interface.
default N/A
8. Bring up the Ethernet
interface. undo shutdown By default, the Ethernet interface is up.
Configuring an Ethernet subinterface
When you configure an Ethernet subinterface, follow these restrictions and guidelines:
•To transmit and receive packets through an Ethernet subinterface, you must associate it with a VLAN.
For more information, see Layer 2—LAN Switching Configuration Guide.
•To transmit packets between a local Ethernet subinterface and a remote Ethernet subinterface,
configure them with the same subinterface number and VLAN ID.
To configure an Ethernet subinterface:
Ste
p
Command Remarks
1. Enter system view. system-view N/A
2. Create an Ethernet
subinterface.
interface interface-type
interface-number.subnumber N/A
3. Set the description for the
Ethernet subinterface. description text
The default setting is
interface-name Interface. For
example, GigabitEthernet1/0/1.1
Interface.
4. Restore the default settings for
the Ethernet subinterface. default N/A
5. Set the expected bandwidth
for the Ethernet subinterface. bandwidth bandwidth-value
By default, the expected
bandwidth (in kbps) is the interface
baud rate divided by 1000.
6. Bring up the Ethernet
subinterface. undo shutdown By default, the Ethernet
subinterface is up.
Configuring the link mode of an Ethernet interface
CAUTION:
A
fter you chan
g
e the link mode of an Ethernet interface, all commands (except the shutdown and combo
enable commands) on the Ethernet interface are restored to their defaults in the new link mode.
The following matrix shows the feature and hardware compatibility:
Hardware Link mode confi
g
uration com
p
atibilit
y
F5020/F5040 Yes
M9006/M9010/M9014 Yes
VFW1000 No

6
Ethernet interfaces operate differently depending on the hardware structure of interface cards:
•Some Ethernet interfaces can operate only as Layer 2 Ethernet interfaces (in bridge mode).
•Some Ethernet interfaces can operate only as Layer 3 Ethernet interfaces (in route mode).
•Some Ethernet interfaces can operate either as Layer 2 or Layer 3 Ethernet interfaces. You can set
the link mode to bridge or route for these Ethernet interfaces.
To configure the link mode of an Ethernet interface:
Ste
p
Command Remarks
1. Enter system view. system-view N/A
2. Enter Ethernet interface view. interface interface-type
interface-number N/A
3. Configure the link mode of the
Ethernet interface. port link-mode { bridge | route } By default, an Ethernet interface
operates as a Layer 3 interface.
Configuring jumbo frame support
The following matrix shows the feature and hardware compatibility:
Hardware Jumbo frame su
pp
ort com
p
atibilit
y
F5020/F5040 No
M9006/M9010/M9014 Yes
VFW1000 No
An Ethernet interface might receive frames larger than the standard Ethernet frame size during
high-throughput data exchanges, such as file transfers. These frames are called jumbo frames.
The Ethernet interface processes jumbo frames in the following ways:
•When the Ethernet interface is configured to deny jumbo frames, the Ethernet interface discards
jumbo frames.
•When the Ethernet interface is configured with jumbo frame support, the Ethernet interface
performs the following tasks:
{Processes jumbo frames within the specified length.
{Discards jumbo frames that exceed the specified length.
To configure jumbo frame support in interface view:
Ste
p
Command Remarks
1. Enter system view. system-view N/A
2. Enter Ethernet interface
view.
interface interface-type
interface-number N/A

7
Ste
p
Command Remarks
3. Configure jumbo frame
support. jumboframe enable [ value ]
By default, an Ethernet interface allows
jumbo frames within 9216 bytes to
pass through.
Configuring physical state change suppression on an Ethernet
interface
IMPORTANT:
Do not enable this feature on an interface with MSTP enabled.
The following matrix shows the feature and hardware compatibility:
Hardware Ph
y
sical state chan
g
e su
pp
ression com
p
atibilit
y
F5020/F5040 No
M9006/M9010/M9014 Yes
VFW1000 No
The physical link state of an Ethernet interface is either up or down. Each time the physical link of an
interface comes up or goes down, the interface immediately reports the change to the CPU. The CPU
then performs the following tasks:
•Notifies the upper-layer protocol modules (such as routing and forwarding modules) of the change
for guiding packet forwarding.
•Automatically generates traps and logs to inform users to take the correct actions.
To prevent frequent physical link flapping from affecting system performance, configure physical state
change suppression. You can configure this feature to suppress only link-down events, only link-up events,
or both. If an event of the specified type still exists when the suppression interval expires, the system
reports the event.
When you configure this feature, follow these guidelines:
•To suppress only link-down events, configure the link-delay [ msec ] delay-time command.
•To suppress only link-up events, configure the link-delay [ msec ] delay-time mode up command.
•To suppress both link-down and link-up events, configure the link-delay [ msec ] delay-time mode
updown command.
To configure physical state change suppression on an Ethernet interface:
Ste
p
Command Remarks
1. Enter system view. system-view N/A
2. Enter Ethernet
interface view.
interface interface-type
interface-number N/A

8
Ste
p
Command Remarks
3. Configure physical
state change
suppression.
link-delay [ msec ]
delay-time [ mode { up |
updown }]
By default, physical state change suppression is
disabled on an Ethernet interface.
You can configure different suppression intervals
for link-up and link-down events.
If you configure this command multiple times for
link-up or link-down events on an Ethernet
interface, the most recent configuration takes
effect.
Configuring dampening on an Ethernet interface
The interface dampening feature uses an exponential decay mechanism to prevent excessive interface
flapping events from adversely affecting routing protocols and routing tables in the network. Suppressing
interface state change events protects the system resources.
If an interface is not dampened, its state changes are reported. For each state change, the system also
generates an SNMP trap and log message.
After a flapping interface is dampened, it does not report its state changes to the CPU. For state change
events, the interface only generates SNMP trap and log messages.
Parameters
•Penalty—The interface has an initial penalty of 0. When the interface flaps, the penalty increases
by 1000 for each down event. It does not increase for up events.
•Ceiling—The penalty stops increasing when it reaches the ceiling.
•Suppress-limit—The accumulated penalty that triggers the device to dampen the interface. In
dampened state, the interface does not report its state changes to the CPU. For state change events,
the interface only generates SNMP traps and log messages
•Reuse-limit—When the accumulated penalty decreases to this reuse threshold, the interface is not
dampened. Interface state changes are reported to the upper layers. For each state change, the
system also generates an SNMP trap and log message.
•Decay—The amount of time (in seconds) after which a penalty is decreased.
•Max-suppress-time—The maximum amount of time the interface can be dampened. If the penalty
is still higher than the reuse threshold when this timer expires, the penalty stops increasing for down
events.
The ceiling is equal to 2(Max-suppress-time/Decay) × reuse-limit. It is not user configurable.
Figure 1 shows the change rule of the penalty value. The lines t0and t2indicate the start time and end
time of the suppression, respectively. The period from t0to t2indicates the suppression period, t0to t1
indicates the max-suppress-time, and t1to t2indicates the complete decay period.

9
Figure 1 Change rule of the penalty value
Configuration restrictions and guidelines
When you configure dampening on an Ethernet interface, follow these restrictions and guidelines:
•The dampening command and the link-delay command cannot be configured together on an
interface.
•The dampening command does not take effect on the administratively down events. When you
execute the shutdown command, the penalty restores to 0, and the interface reports the down event
to the upper-layer protocols.
•Do not enable the dampening function on an interface with MSTP enabled.
Configuration procedure
To configure dampening on an Ethernet interface:
Ste
p
Command Remarks
1. Enter system view. system-view N/A
2. Enter Ethernet interface
view.
interface interface-type
interface-number N/A
3. Enable dampening on
the interface.
dampening [half-life reuse
suppress max-suppress-time ]
By default, interface dampening is
disabled on Ethernet interfaces.
Performing a loopback test on an Ethernet interface
The following matrix shows the feature and hardware compatibility:
Not suppressed Not suppressedSuppressed
Penalty
Time
Reuse limit
Suppress limit
Ceiling
t0t1t2

10
Hardware Loo
p
back test com
p
atibilit
y
F5020/F5040 Yes
M9006/M9010/M9014 Yes
VFW1000 No
If an Ethernet interface does not work correctly, you can perform a loopback test on it to identify the
problem. An Ethernet interface in a loopback test does not forward data traffic.
Loopback tests include the following types:
•Internal loopback test—Tests all on-chip functions associated with the Ethernet interface.
•External loopback test—Tests the hardware of the Ethernet interface. To perform an external
loopback test on the Ethernet interface, connect a loopback plug to the Ethernet interface. The
device sends test packets out of the Ethernet interface, which are expected to loop over the plug and
back to the Ethernet interface. If the Ethernet interface fails to receive any test packets, the hardware
of the Ethernet interface is faulty.
Configuration restrictions and guidelines
When you perform loopback tests, follow these restrictions and guidelines:
•On an administratively shut down Ethernet interface (displayed as in ADM or Administratively
DOWN state), you cannot perform an internal or external loopback test.
•During a loopback test on an Ethernet interface, the speed, duplex, mdix-mode, and shutdown
commands are not available on the Ethernet interface.
•During a loopback test on an Ethernet interface, the Ethernet interface operates in full duplex mode.
When the loopback test is complete, the Ethernet interface restores to its duplex setting.
Configuration procedure
To perform a loopback test on an Ethernet interface:
Ste
p
Command Remarks
1. Enter system view. system-view N/A
2. Enter Ethernet interface view. interface interface-type
interface-number N/A
3. Perform a loopback test. loopback { external | internal }
By default, no loopback test is
performed on the Ethernet
interface.
Configuring generic flow control on an Ethernet interface
The following matrix shows the feature and hardware compatibility:
Hardware Generic flow control com
p
atibilit
y
F5020/F5040 Yes
M9006/M9010/M9014 Yes
VFW1000 No

11
To avoid dropping packets on a link, you can enable generic flow control at both ends of the link. When
traffic congestion occurs at the receiving end, the receiving end sends a flow control (Pause) frame to ask
the sending end to suspend sending packets. Generic flow control includes the following types:
•TxRx-mode generic flow control—Enabled by using the flow-control command. With TxRx-mode
generic flow control enabled, an interface can both send and receive flow control frames:
{When congestion occurs, the interface sends a flow control frame to its peer.
{When the interface receives a flow control frame from its peer, it suspends sending packets to
its peer.
•Rx-mode generic flow control—Enabled by using the flow-control receive enable command. With
Rx-mode generic flow control enabled, an interface can receive flow control frames, but it cannot
send flow control frames:
{When congestion occurs, the interface cannot send flow control frames to its peer.
{When the interface receives a flow control frame from its peer, it suspends sending packets to
its peer.
To handle unidirectional traffic congestion on a link, configure the flow-control receive enable command
at one end and the flow-control command at the other end. To enable both ends of a link to handle traffic
congestion, configure the flow-control command at both ends.
To enable generic flow control on an Ethernet interface:
Ste
p
Command Remarks
1. Enter system view. system-view N/A
2. Enter Ethernet interface
view.
interface interface-type
interface-number N/A
3. Enable generic flow control.
•Enable TxRx-mode generic
flow control:
flow-control
•Enable Rx-mode generic flow
control:
flow-control receive enable
By default, generic flow control is
disabled on an Ethernet interface.
Setting the statistics polling interval
The following matrix shows the supported views of firewall devices for the feature:
Hardware Su
pp
orted views
F5020/F5040 Ethernet interface view
M9006/M9010/M9014 Ethernet interface view
VFW1000 System view
To set the statistics polling interval in system view:
Ste
p
Command Remarks
1. Enter system view. system-view N/A

12
Ste
p
Command Remarks
2. Set the statistics polling
interval. flow-interval interval By default, the statistics polling interval
is 300 seconds.
To set the statistics polling interval in Ethernet interface view:
Ste
p
Command Remarks
1. Enter system view. system-view N/A
2. Enter Ethernet interface
view.
interface interface-type
interface-number N/A
3. Set the statistics polling
interval for the Ethernet
interface.
flow-interval interval By default, the statistics polling interval
is 300 seconds.
To display the interface statistics collected in the last statistics polling interval, use the display interface
command.
Enabling subinterface rate statistics collection on an Ethernet
interface
CAUTION:
Use this feature with caution, because it might consume a large amount of system resources.
The following matrix shows the feature and hardware compatibility:
Hardware Subinterface rate statistics collection
com
p
atibilit
y
F5020/F5040 Yes
M9006/M9010/M9014 No
VFW1000 No
The following matrix shows the feature and hardware compatibility:
Hardware Subinterface rate statistics collection
com
p
atibilit
y
L5000-S/L5000-C Yes
VLB1000 No
After you enable subinterface rate statistics collection on an Ethernet interface, the device periodically
refreshes the rate statistics on the subinterfaces of this Ethernet interface. You can use the display
interface command to display the subinterface rate statistics.
To enable subinterface rate statistics collection on an Ethernet interface:

13
Ste
p
Command Remarks
1. Enter system view. system-view N/A
2. Enter Ethernet interface view. interface interface-type
interface-number N/A
3. Enable subinterface rate
statistics collection on the
Ethernet interface.
sub-interface rate-statistic
By default, subinterface rate statistics
collection is disabled on an Ethernet
interface.
Forcibly bringing up a fiber port
The following matrix shows the feature and hardware compatibility:
Hardware Forcibl
y
brin
g
in
g
u
p
fiber
p
orts com
p
atibilit
y
F5020/F5040 No
M9006/M9010/M9014 Yes
VFW1000 No
As shown in Figure 2, a fiber port uses separate fibers for transmitting and receiving packets. The
physical state of the fiber port is up only when both transmit and receive fibers are physically connected.
If one of the fibers is disconnected, the fiber port does not work.
To enable a fiber port to forward traffic over a single link, you can use the port up-mode command. This
command forcibly brings up a fiber port, even when no fiber links or transceiver modules are present for
the fiber port. When one fiber link is present and up, the fiber port can forward packets over the link
unidirectionally.