H3C SR6600 SPE-FWM User manual

H3C SR6600/SR6600-X Routers
OAA Configuration Guide
Hangzhou H3C Technologies Co., Ltd.
http://www.h3c.com
Software version: SR6600X-CMW520-R3303
SR6602-CMW520-R3303
SR6602X_MCP-CMW520-R3303
SR6600-CMW520-R3303-RPE
SR6600-CMW520-R3303-RSE
Document version: 20150715-C-1.14

Copyright © 2007-2015, Hangzhou H3C Technologies Co., Ltd. and its licensors
All rights reserved
No part of this manual may be reproduced or transmitted in any form or by any means without prior
written consent of Hangzhou H3C Technologies Co., Ltd.
Trademarks
H3C, , H3CS, H3CIE, H3CNE, Aolynk, , H3Care, , IRF, NetPilot, Netflow,
SecEngine, SecPath, SecCenter, SecBlade, Comware, ITCMM and HUASAN are trademarks of
Hangzhou H3C Technologies Co., Ltd.
All other trademarks that may be mentioned in this manual are the property of their respective owners
Notice
The information in this document is subject to change without notice. Every effort has been made in the
preparation of this document to ensure accuracy of the contents, but all statements, information, and
recommendations in this document do not constitute the warranty of any kind, express or implied.

Preface
The H3C SR6600/SR6600-X documentation set includes 14 configuration guides, which describe the
software features for the H3C SR6600/SR6600-X Routers and guide you through the software
configuration procedures. These configuration guides also provide configuration examples to help you
apply software features to different network scenarios.
The OAA Configuration Guide describes the Open Application Architecture (OAA) supported protocols
(such as ACFP and ACSEI), their configurations, and the configuration of the H3C open application
platform (OAP) card.
This preface includes:
•Audience
•Conventions
•About the H3C SR6600/SR6600-X documentation set
•Obtaining documentation
•Technical support
•Documentation feedback
Audience
This documentation is intended for:
•Network planners
•Field technical support and servicing engineers
•Network administrators working with the routers
Conventions
This section describes the conventions used in this documentation set.
Command conventions
Convention Descri
p
tion
Boldface Bold text represents commands and keywords that you enter literally as shown.
Italic Italic text represents arguments that you replace with actual values.
[ ] Square brackets enclose syntax choices (keywords or arguments) that are optional.
{ x | y | ... }
Braces enclose a set of required syntax choices separated by vertical bars, from which
you select one.
[ x | y | ... ]
Square brackets enclose a set of optional syntax choices separated by vertical bars, from
which you select one or none.
{ x | y | ... } *
Asterisk marked braces enclose a set of required syntax choices separated by vertical
bars, from which you select at least one.

[ x | y | ... ] *
Asterisk marked square brackets enclose optional syntax choices separated by vertical
bars, from which you select one choice, multiple choices, or none.
&<1-n> The argument or keyword and argument combination before the ampersand (&) sign can
be entered 1 to n times.
# A line that starts with a pound (#) sign is comments.
GUI conventions
Convention Descri
p
tion
Boldface Window names, button names, field names, and menu items are in Boldface. For
example, the New User window appears; click OK.
> Multi-level menus are separated by angle brackets. For example, File > Create > Folder.
Symbols
Convention Descri
p
tion
WARNING An alert that calls attention to important information that if not understood or followed can
result in personal injury.
CAUTION An alert that calls attention to important information that if not understood or followed can
result in data loss, data corruption, or damage to hardware or software.
IMPORTANT An alert that calls attention to essential information.
NOTE An alert that contains additional or supplementary information.
TIP An alert that provides helpful information.
Network topology icons
Represents a generic network device, such as a router, switch, or firewall.
Represents a routing-capable device, such as a router or Layer 3 switch.
Represents a generic switch, such as a Layer 2 or Layer 3 switch, or a router that supports
Layer 2 forwarding and other Layer 2 features.
Represents an access controller, a unified wired-WLAN module, or the access controller
engine on a unified wired-WLAN switch.
Represents an access point.
Represents a mesh access point.
Represents omnidirectional signals.
Represents directional signals.
Represents a security product, such as a firewall, UTM, multiservice security gateway, or
load balancing device.





Represents a security card, such as a firewall, load balancing, NetStream, SSL VPN, IPS,
or ACG card.
Port numbering in examples
The port numbers in this document are for illustration only and might be unavailable on your device.
About the H3C SR6600/SR6600-X documentation
set
The H3C SR6600/SR6600-X documentation set includes:
Cate
g
or
y
Documents
Pur
p
oses
Product description and
specifications
Marketing brochures Describe product specifications and benefits.
Technology white papers
Provide an in-depth description of software features
and technologies.
Card datasheets Describe card specifications, features, and
standards.
Hardware specifications
and installation
Compliance and safety
manual
Provides regulatory information and the safety
instructions that must be followed during installation.
Installation guide Provides a complete guide to hardware installation
and hardware specifications.
Card manuals Provide the hardware specifications of cards.
H3C N68 Cabinet
Installation and Remodel
Introduction
Guides you through installing and remodeling H3C
N68 cabinets.
Software configuration
Configuration guides Describe software features and configuration
procedures.
Command references Provide a quick reference to all available
commands.
Operations and
maintenance
H3C SR6602 Release
notes
Provide information about the product release,
including the version history, hardware and software
compatibility matrix, version upgrade information,
technical support information, and software
upgrading.
H3C SR6608 Release
notes
Obtaining documentation
You can access the most up-to-date H3C product documentation on the World Wide Web
at http://www.h3c.com.
Click the links on the top navigation bar to obtain different categories of product documentation:
[Technical Support & Documents > Technical Documents] – Provides hardware installation, software
upgrading, and software feature configuration and maintenance documentation.
[Products & Solutions] – Provides information about products and technologies, as well as solutions.

[Technical Support & Documents > Software Download] – Provides the documentation released with the
software version.
Technical support
servic[email protected]
http://www.h3c.com
Documentation feedback
You can e-mail your comments about product documentation to [e-mail].
We appreciate your comments.

i
Contents
Configuring OAP modules ·········································································································································· 1
Logging in to the operating system of an OAP module································································································1
Logging in through the console port on the OAP module····················································································1
Logging in through the management Ethernet port of the OAP module by using SSH ····································2
Logging in through the internal Ethernet interface on the OAP module by using SSH·····································2
Switching to the OAP module's CLI from the device ····························································································2
Resetting OAP modules ····················································································································································3
Configuring ACFP ························································································································································ 4
Overview············································································································································································4
ACFP collaboration ··················································································································································4
ACFP traffic management········································································································································5
ACFP information ·····················································································································································5
ACFP usage guidelines············································································································································8
ACFP configuration task list ·············································································································································9
Enabling the ACFP server on the device ························································································································9
Configuring the ACFP client (the OAP module)·············································································································9
Enabling the ACFP trap function on the device ·············································································································9
Displaying and maintaining ACFP······························································································································· 10
ACFP configuration example ········································································································································ 10
Configuring ACSEI·····················································································································································13
Overview········································································································································································· 13
ACSEI functions ····················································································································································· 13
ACSEI timers ·························································································································································· 14
ACSEI startup and operation ······························································································································· 14
Configuring the ACSEI server······································································································································· 14
Displaying ACSEI client information on the server side····························································································· 15
Index ···········································································································································································16

1
Configuring OAP modules
The H3C Open Application Architecture (OAA) provides an open interface for third-party vendors to
develop value-added applications (such as firewall and IPS) and integrate the applications into H3C
products. H3C has developed some application-specific modules called "Open Application Platform
(OAP) module."
The following matrix shows the OAP feature and router compatibility:
SR6602 SR6602-X SR6604/SR6608/SR6616 SR6604-X/SR6608-X/SR6
616-
X
No. No.
Yes when RPE-X1 and RSE-X1 MPUs
are used and no when MCP MPUs
are used.
Yes.
Logging in to the operating system of an OAP
module
An OAP module has an independent operating system and CLI. You must log in to the module's CLI to
configure it.
Logging in through the console port on the OAP module
You can log in to the operating system on an OAP module directly through the console port on the OAP
module. In the following procedure, the PC acts as a terminal.
1. Connect one end of the configuration cable to the serial port of the PC and the other end to the
console port of the OAP module.
2. Start the PC and run a terminal emulation program such as the HyperTerminal. Select the COM
connection mode and set the terminal parameters as follows:
{Bits per second—9600
{Data bits—8
{Parity check mode—None
{Stop bits—1
{Flow control—None
After the configuration, you can log in to the operating system of the OAP module through the terminal
emulation program on the PC.

2
Logging in through the management Ethernet port of the OAP
module by using SSH
To log in to the operating system of an OAP module through its management Ethernet port, you must first
configure the OAP module as the SSH server. To do so, follow these steps:
1. Log in to the OAP module through the console port, and then enable the SSH server function on the
OAP module.
2. Connect the management Ethernet port of the OAP module to the network by using a network
cable.
3. Assign an IP address to the management Ethernet port of the OAP module, and make sure the SSH
client (the H3C device or a PC that has the SSH client software installed) and the management
Ethernet port can reach each other.
4. Establish an SSH connection, entering the IP address of the management Ethernet port as the SSH
server IP address.
After the SSH connection is successfully established, you are logged in to the operating system of the
OAP module.
Logging in through the internal Ethernet interface on the OAP
module by using SSH
When installed in the expansion slot of a device, an OAP module exchanges information with the device
through its two internal service interfaces. One of these is a serial interface, and the other is a fast
Ethernet interface. The fast Ethernet interface is used in this login mode.
To log in to the operating system of an OAP module through its internal Ethernet interface, you must first
configure the OAP module as the SSH server. To do so, follow these steps:
1. Log in to the OAP module through the console port, and then enable the SSH server function on the
OAP module.
2. Assign an IP address to the fast Ethernet interface on the OAP module.
3. Connect one end of the cable to the PC and the other end to the Ethernet port of the device.
4. Make sure the PC and the fast Ethernet interface can reach each other.
5. Establish an SSH connection, entering the IP address of the management Ethernet port as the SSH
server IP address.
After the SSH connection is successfully established, you are logged in to the operating system of the
OAP module.
Switching to the OAP module's CLI from the device
From the device's CLI, you can switch to the OAP module's CLI to manage and configure the OAP
module's system and software. To switch back to the device's CLI, press Ctrl+K.
To switch to the CLI of the OAP module from the device, execute the following command in user view:

3
Task Command
Switch to the CLI of the OAP module from the device.
•In standalone mode:
oap connect slot slot-number
•In IRF mode:
oap connect chassis chassis-number slot slot-number
Using the oap connect command is the same as logging in to the CLI of the OAP module through the AUX
port. To ensure successful login, you must configure login authentication parameters and assign a user
privilege level. For more information, see the chapter on logging in to the CLI in Fundamentals
Configuration Guide.
Resetting OAP modules
CAUTION:
To avoid data loss, shut down (poweroff) the operating system of the OAP module before you reset an
OAP module.
To recover an OAP module from an error condition, reboot the module at the CLI or press the reset button
on the module. The device can still identify and control the OAP module after the reset.
To reset the OAP module, execute the following command in user view:
Task Command
Reset the OAP module.
•In standalone mode:
oap reboot slot slot-number
•In IRF mode:
oap reboot chassis chassis-number slot slot-number