H3C SR6600 SPE-FWM User manual

H3C SR6600 Routers
OAA Configuration Guide
Hangzhou H3C Technologies Co., Ltd.
http://www.h3c.com
Document Version: 20100930-C-1.08
Product Version: SR6600-CMW520-R2420

Copyright © 2007-2010, Hangzhou H3C Technologies Co., Ltd. and its licensors
All Rights Reserved
No part of this manual may be reproduced or transmitted in any form or by any means without prior
written consent of Hangzhou H3C Technologies Co., Ltd.
Trademarks
H3C, , Aolynk, , H3Care, , TOP G, , IRF, NetPilot, Neocean, NeoVTL,
SecPro, SecPoint, SecEngine, SecPath, Comware, Secware, Storware, NQA, VVG, V2G, VnG, PSPT,
XGbus, N-Bus, TiGem, InnoVision and HUASAN are trademarks of Hangzhou H3C Technologies Co.,
Ltd.
All other trademarks that may be mentioned in this manual are the property of their respective owners.
Notice
The information in this document is subject to change without notice. Every effort has been made in the
preparation of this document to ensure accuracy of the contents, but all statements, information, and
recommendations in this document do not constitute the warranty of any kind, express or implied.

Preface
The H3C SR6600 documentation set includes 13 configuration guides, which describe the software
features for the H3C SR6600 Routers and guide you through the software configuration procedures.
These configuration guides also provide configuration examples to help you apply software features to
different network scenarios.
The OAA Configuration Guide describes the Open Application Architecture (OAA) supported protocols
(such as ACFP and ACSEI), their configurations, and the configuration of the H3C open application
platform (OAP) card.
This preface includes:
zAudience
zConventions
zAbout the H3C SR6600 Documentation Set
zObtaining Documentation
zDocumentation Feedback
Audience
This documentation is intended for:
zNetwork planners
zField technical support and servicing engineers
zNetwork administrators working with the SR6600
Conventions
This section describes the conventions used in this documentation set.
Command conventions
Convention Description
Boldface Bold text represents commands and keywords that you enter literally as shown.
italic Italic text represents arguments that you replace with actual values.
[ ] Square brackets enclose syntax choices (keywords or arguments) that are
optional.
{ x | y | ... }
Braces enclose a set of required syntax choices separated by vertical bars,
from which you select one.
[ x | y | ... ]
Square brackets enclose a set of optional syntax choices separated by vertical
bars, from which you select one or none.
{ x | y | ... } *
Asterisk marked braces enclose a set of required syntax choices separated by
vertical bars, from which you select at least one.
[ x | y | ... ] *
Asterisk marked square brackets enclose optional syntax choices separated by
vertical bars, from which you may select multiple choices or none.
&<1-n> The argument or keyword and argument combination before the ampersand (&)
sign can be entered 1 to n times.
# A line that starts with a pound (#) sign is comments.

GUI conventions
Convention Description
Boldface Window names, button names, field names, and menu items are in Boldface.
For example, the New User window appears; click OK.
> Multi-level menus are separated by angle brackets. For example, File > Create
> Folder.
Symbols
Convention Description
Means reader be extremely careful. Improper operation may cause bodily
injury.
Means reader be careful. Improper operation may cause data loss or damage to
equipment.
Means an action or information that needs special attention to ensure
successful configuration or good performance.
Means a complementary description.
Means techniques helpful for you to make configuration with ease.
Network topology icons
Convention Description
Represents a generic network device, such as a router, switch, or firewall.
Represents a routing-capable device, such as a router or Layer 3 switch.
Represents a generic switch, such as a Layer 2 or Layer 3 switch, or a router
that supports Layer 2 forwarding and other Layer 2 features.
About the H3C SR6600 Documentation Set
The H3C SR6600 documentation set includes:
Category Documents Purposes
Marketing brochures Describe product specifications and benefits.
Technology white papers Provide an in-depth description of software features
and technologies.
Product description and
specifications
Card datasheets Describe card specifications, features, and standards.
Compliance and safety
manual Provides regulatory information and the safety instructions that must be followed during installation.
Installation guide Provides a complete guide to hardware installation
and hardware specifications.
Hardware specifications
and installation
Card manuals Provide the hardware specifications of cards.

Category Documents Purposes
H3C N68 Cabinet
Installation and Remodel
Introduction
Guides you through installing and remodeling H3C
N68 cabinets.
Configuration guides Describe software features and configuration
procedures.
Software configuration Command references Provide a quick reference to all available commands.
H3C SR6608 Release
notes
Operations and
maintenance H3C SR6602 Release
notes
Provide information about the product release,
including the version history, hardware and software
compatibility matrix, version upgrade information,
technical support information, and software upgrading.
Obtaining Documentation
You can access the most up-to-date H3C product documentation on the World Wide Web at
http://www.h3c.com.
Click the links on the top navigation bar to obtain different categories of product documentation:
[Technical Support & Documents > Technical Documents] – Provides hardware installation, software
upgrading, and software feature configuration and maintenance documentation.
[Products & Solutions] – Provides information about products and technologies, as well as solutions.
[Technical Support & Documents > Software Download] – Provides the documentation released with
the software version.
Technical Support
[e-mail]
http://www.h3c.com
Documentation Feedback
You can e-mail your comments about product documentation to [email protected].
We appreciate your comments.

i
Table of Contents
1 OAP Card Configuration···························································································································1-1
OAP Card Overview································································································································1-1
Logging In to the Operating System of an OAP Card·············································································1-1
Logging In Through the Console Port of an OAP Card···································································1-1
Logging In Through the Management Ethernet Port of an OAP Card by Using SSH·····················1-1
Logging In Through the Internal Fast Ethernet Interface of an OAP Card by Using SSH··············1-2
Redirecting to an OAP Card from the Router··················································································1-2
Resetting the System of an OAP Card ···································································································1-3
2 ACFP Configuration ··································································································································2-4
Introduction to ACFP·······························································································································2-4
ACFP Architecture···························································································································2-5
ACFP Collaboration·························································································································2-5
ACFP Management·························································································································2-5
ACFP Information Overview············································································································2-6
Using ACFP·····································································································································2-9
ACFP Configuration Task List·················································································································2-9
Enabling the ACFP Server······················································································································2-9
Configuring ACFP Client·······················································································································2-10
Enabling the ACFP Trap Function········································································································2-10
Displaying and Maintaining ACFP ········································································································2-11
ACFP Configuration Example···············································································································2-11
Network Requirements··················································································································2-11
Configuration Procedure················································································································2-12
3 ACSEI Configuration·······························································································································3-14
Introduction to ACSEI····························································································································3-14
Functions of ACSEI·······················································································································3-14
ACSEI Timers································································································································3-15
ACSEI Startup and Running··········································································································3-15
ACSEI Server Configuration·················································································································3-15
Enabling ACSEI Server·················································································································3-15
Configuring the Clock Synchronization Timer···············································································3-16
Configuring the Monitoring Timer··································································································3-16
Closing an ACSEI Client················································································································3-16
Restarting an ACSEI Client···········································································································3-16
Displaying and Maintaining ACSEI Server····················································································3-17
4 Index ·························································································································································4-18

1-1
1 OAP Card Configuration
This chapter includes these sections:
zOAP Card Overview
zLogging In to the Operating System of an OAP
zResetting the System of an OAP
OAP Card Overview
As an open software and hardware system, the OpenApplication Architecture (OAA) of Hangzhou H3C
Technologies Co., Ltd. (referred to as H3C hereinafter) provides a set of standard software and
hardware interfaces based on H3C devices. The third party vendors can develop products with special
functions. These products can be compatible with H3C devices as long as they conform to the OAA
interface standards. Therefore, the functions of single network products can be expanded andthe users
can get more benefits. The OpenApplication Platform (OAP) is developed based on the OAA. It can be
an independent network device, or a card used as an extended part of a device or integrated into a
network device. This kind of OAP is called an OAP card. An OAP card runs an independent operating
system. You can load software such as security and voice in the operating system as needed.
Meanwhile, after an OAP card is inserted into the expansion card slot of the device, it interacts with the
device on data, status information and control information through its internal service interfaces.
Logging In to the Operating System of an OAP Card
Logging In Through the Console Port of an OAP Card
You can log in to the operating system on an OAP card directly through the console port on the OAP
card. In this example, a PC acts as a terminal.
1) Connect one end of the configuration cable to the serial port of the PC, and the other end to the
console port of the OAP card.
2) Start the PC and run the terminal emulation program such as the HyperTerminal. Select the
connection mode COM and set the terminal parameters. Parameter requirements: set the bits per
second to 9600, data bits to 8, parity to none, stop bits to 1, and flow control to none.
After the configuration, you can log in to the operating system of the OAP card through the terminal
emulation program on the PC.
Logging In Through the Management Ethernet Port of an OAP Card by Using SSH
You can log in to the operating system of an OAP card through its management Ethernet port. To
configure the OAP card as the SSH server, follow these steps:
1) Log in to the OAP card through the console port, and then enable the SSH server function on the
OAP card.
2) Connect the management Ethernet port of the OAP card to the network with a network cable.

1-2
3) Assign an IP address to the management Ethernet port of the OAP card, and make sure that the
SSH client (the H3C device or a PC with the SSH client software installed) and the management
Ethernet port can reach each other.
4) Establish an SSH connection, enter the IP address of the management Ethernet port and use it as
the IP address of the SSH server. You can log in to the operating system of the OAP card after the
SSH connection is established successfully.
By default, the SSH server function is disabled on the OAP card. First log in the OAP card and perform
SSH server related configurations, and then log in the operating system of the card using SSH. For
more information about the SSH server, see SSH2.0 in the Security Configuration Guide.
Logging In Through the Internal Fast Ethernet Interface of an OAP Card by Using
SSH
When an OAP card is installed into the expansion card slot of a router, the OAP card exchanges
information with the router through its two internal service interfaces. One of them is a serial interface,
and the other is a fast Ethernet interface. The fast Ethernet interface is used in this login mode.
You can log in to the operating system of an OAP card through its internal Ethernet interface. To
configure the OAP card as the SSH server, follow these steps:
1) Log in to the OAP card through the console port, and then enable the SSH server function on the
OAP card.
2) Assign an IP address to the fast Ethernet interface on the OAP card.
3) Connect one end of the cable to the PC, and the other end to the Ethernet port of the router.
4) Make sure that the PC and the fast Ethernet interface can reach each other.
5) Input the IP address of either of the internal service interfaces as the SSH server address. You can
log in to the operating system of the OAP card after the connection is established.
By default, the SSH server function is disabled on the OAP card. First log in to the OAP card and
perform SSH server relatedconfigurations, and then log in to the operating system of the card with SSH.
For more information about the SSH server, see SSH2.0 in the Security Configuration Guide.
Redirecting to an OAP Card from the Router
You can redirect to the operating system of an OAPcard from the router through the following operation.
In this way, the terminal display interface will be switched from the command line interface on the router
to the operating interface of the operating system of the OAPcard, and you can manage the system and

1-3
application software on the OAP card. After the switch, you can press Ctrl+K to return to the command
line interface on the router.
Follow the step to redirect from the router to the OAP card:
To do… Use the command… Remarks
Redirect from the router to the OAP
card oap connect slot slot-number Required
Available in user view
Redirecting from the router to the OAP cardwith the oap connect command is equal to loggingin to the
OAP card from the AUX port. Therefore, to ensure a successful login, you need to first set the
authentication mode for users at login and the user privilege level under AUX user interface view of the
OAP card. For more information, see Logging In to the Router in the Fundamentals Configuration
Guide.
Resetting the System of an OAP Card
If the operating system works abnormally or is under other anomalies, you can reset the system of an
OAP card with the following command, which is equal to resetting the OAP card by pressing the reset
button on the OAP card.
An OAP card has its independent CPU; therefore, the router can still recognize and control the OAP
card after you reset the OAP system.
Follow the step to reset the system of an OAP card:
To do… Use the command… Remarks
Reset the system of an OAP card
(on any SR6600 router but the
SR6602) oap reboot slot slot-number Required
Available in user view
Reset of the OAP card may cause data loss and service interruption. Therefore, before resetting the
OAP card, you need to save the configurations of the OAP card operating system and shut down the
OAP card operating system to avoid service interruption and hardware data loss.

2-4
2 ACFP Configuration
This chapter includes these sections:
zIntroduction to ACFP
zEnabling the ACFP Server
zConfiguring ACFP Client
zEnabling the ACFP Trap Function
zDisplaying and Maintaining ACFP
zACFP Configuration Example
Introduction to ACFP
Basic data communication networks comprise of routers and switches, which forward data packets. As
data networks develop, more and more services run on them. It has become inappropriate to use
legacy devices for handling some new services. Therefore, some security products such as firewalls,
Intrusion Detection System (IDS), and Intrusion Prevention System (IPS), and voice and wireless
products are designed to handle specific services.
For better support of new services, manufacturers of legacy networking devices (routers and switches
in this document) have developed various dedicated service boards (service cards) to specifically
handle these services. Some manufacturers of legacy networking devices provide a set of
software/hardware interfaces to allow the boards (cards) or devices of other manufacturers to be
plugged or connected to these legacy networking devices for cooperating to handle these services.
This gives full play to the advantages of respective manufacturers for better support of new services
while reducing user investments.
The open application architecture (OAA) is an open service architecture developed with this concept. It
integrates devices and software produced by different manufacturers, making them function as one
device, and thus providing integrated resolutions for the customers.
The Application Control Forwarding Protocol (ACFP) is developed based on the OAAarchitecture. For
example, collaborating IPS/IDS cards or IPS/IDS devices acting as ACFP clients run software
packages developed by other manufacturers to support the IPS/IDS services. Arouter or switch mirrors
or redirects the received packets to an ACFP client after matching the ACFP collaboration rules. The
software running on the ACFP client monitors and detects the packets. Based on the monitoring and
detection results, the ACFP client sends back responses to the router or switch through collaboration
Management Information Bases (MIBs) to instruct the router or switch to process the results, such as
filtering out the specified packets.

2-5
ACFP Architecture
Figure 2-1 Diagram for ACFP architecture
Independent service
component Routing/Switching
component
Interface-connecting
component
ACFP client ACFP server
As shown in Figure 2-1, the ACFP architecture consists of:
zRouting/switching component: As the main part of a routers and a switch, it performs complete
router/switch functions and is also the core of user management control. This part is called the
ACFP server.
zIndependent service component: It is the main part open for development by a third party and is
mainly used to provide various unique service functions. This part is called the ACFP client.
zInterface-connecting component: It connects the interface of the routing/switching component to
that of the independent service component, allowing the devices of two manufacturers to be
interconnected.
ACFP Collaboration
ACFP collaboration means that the independent service component can send instructions to the
routing/switching component to change its functions. ACFP collaboration is mainly implemented
through the Simple Network Management Protocol (SNMP).Acting as a network management system,
the independent service component sends various SNMP commands to the routing/switching
component, which can then execute the instructions received because it supports SNMP agent. In this
process, the cooperating MIB is the key to associating the two components with each other.
ACFP Management
ACFP collaboration provides a mechanism that enables the ACFP client to control the traffic on the
ACFP server by implementing the following functions:
zMirroring and redirecting the traffic on the ACFP server to the ACFP client
zPermitting/denying the traffic from the ACFP server
zRestricting the rate of the traffic on the ACFP server
zCarrying the context ID in a packet to enable the ACFP server and ACFP client to communicate
the packet context with each other. The detailed procedure is as follows:
The ACFP server maintains a context table that can be queried with context ID. Each context ID
corresponds with an ACFP collaboration policy that contains information including inbound interface
and outbound interface of the packet, and collaboration rules. When the packet received by the ACFP
server is redirected or mirrored to the ACFP client after matching a collaboration rule, the packet carries
the context ID of the collaboration policy to which the collaboration rule belongs. When the redirected
packet is returned from theACFP client, the packet also carries the context ID. With the context ID, the
ACFP server knows that the packet is returned after being redirected and then forwards the packet
normally.

2-6
For the ACFP client to better control traffic, the two-level structure of collaboration policy and
collaboration rules is set in the collaboration to manage the traffic matching the collaboration rule based
on the collaboration policy, implementing flexible traffic management.
To better support the Client/Server collaboration mode and granularly and flexibly set different rules,
the collaboration content is divided into four parts: ACFP server information, ACFP client information,
ACFP collaboration policy and ACFP collaboration rules. These four parts of information are saved in
the ACFP server.
An ACFP server supports multiple ACFP clients. Therefore, ACFP client information, ACFP
collaboration policy, andACFP collaboration rules are organized in the form of tables.
ACFP server information is generated by the ACFP server itself. ACFP client information, ACFP
collaboration policy, and ACFP collaboration rules are generated on the ACFP client and sent to the
ACFP server through the collaboration MIB or collaboration protocol.
The SR6600 routers do not support rate restriction of the traffic on the ACFP server.
ACFP Information Overview
ACFP server information
ACFP server information contains the following:
zSupported working modes: host, pass-through, mirroring, and redirect. An ACFP server can
support multiple working modes among these four at the same time. The ACFP server and client(s)
can collaborate with each other only when the ACFP server supports the working mode of the
ACFP client.
zMaximum expiration time of the supported collaboration policy: This indicates for how long the
collaboration policy of the ACFP server will remain valid.
zWhether the ACFP server can permanently save the collaboration policy: It mainly refers to
whether the ACFP server can keep the original collaboration policy after reboot.
zCurrently supported context ID type: The location of the context ID in the packet may vary with
ACFP servers. There are five types of context IDs: no-context (no context ID is carried),
HG-context (carrying the preamble HG as the context ID), HGPlus-context (carrying the preamble
HGPlus as the context ID), FlowID-context (carrying the preamble Flow ID as the context ID),
VLANID-context (carrying VLAN ID as the context ID).
The above-mentioned information indicates the collaboration capabilities of an ACFP server. ACFP
clients can access this information through a collaboration protocol or collaboration MIB.
The SR6600 routers support only one type of context ID, namely, the VLANID-context (carrying VLAN
ID as the context ID).

2-7
ACFP client information
ACFP client information contains the following:
zACFP client identifier. It can be assigned by the ACFP server through a collaboration protocol or
specified by the network administrator to ensure that each ACFP client has a unique client ID on
the ACFP server.
zDescription: ACFP client description information.
zHw-Info: ACFP client hardware type, version number, and so on.
zOS-Info: System name and version number of the ACFP client.
zApp-Info: Application software type and version number of the ACFP client.
zClient IP: ACFP client IP address.
zClient Mode: Working mode currently supported by the ACFP client, namely, the combination of
the host, pass-through, mirroring, and redirect modes.
ACFP collaboration policy
ACFP collaboration policy refers to the collaboration policy that the ACFP client sends to the ACFP
server for application. The policy information is as follows:
zClient ID: ACFP client identifier.
zPolicy-Index
zIn-interface: Interface through which the packet is sent to the ACFP server.
zOut-interface: Interface through which the packet is forwarded normally.
zDest-interface: ACFP server interface connected with ACFP client.
zContext ID: It is used when the packet is mirrored or redirected to an ACFP client. After the
interface connected to the ACFP client is specified in the policy sent, the ACFP server assigns it a
global serial number, that is, the Context ID, with each Context ID corresponding to an ACFP
collaboration policy.
zAdmin-Status: It indicates whether to enable the policy.
zEffect-Status: It indicates the expiration time of the policy and is used to control the expiration time
of all the rules under the policy.
zStart-Time: It indicates starting from what time (second/minute/hour) the policy takes effect and is
used to control starting from what time all the rules under the policy take effect.
zEnd-time: It indicates starting from what time (second/minute/hour) the policy turns invalid and is
used to control starting from what time all the rules under the policy turn invalid.
zDestIfFailAction: If the policy dest-interface is down, the actions to all rules under the policy will be
as follows: for forwarding first devices, select the delete action to keep the redirected and mirrored
packets being forwarded; for security first devices, select the reserve action to discard the
redirected and mirrored packets.
zPriority: It indicates the priority of a policy, number notation, in the range of 1 to 8. The bigger the
number, the higher the priority.
ACFP collaboration rules
ACFP collaboration rules refer to the collaboration rules that the ACFPclient sends to the ACFP server
for application. There are three types of collaboration rules:

2-8
zMonitoring rules: that is, to monitor, analyze, and process the packets to be sent to the ACFP client.
The action types corresponding to monitoring rules are redirect and mirror.
zFiltering rules: that is, to determine which packets to deny and which packets to permit. The action
types corresponding to filtering rules are deny and permit.
zRestricting rules: that is, to determine the rate of which packets is to be restricted. The action type
corresponding to restricting rules is rate.
Rule information is described as follows:
zClientID: ACFP client identifier.
zPolicy index
zRule index: rule identifier
zStatus: It indicates whether the rule is applied successfully.
zAction: It can be mirror, redirect, deny, permit, or rate.
zMatch all packets: It indicates whether to match all the packets. If yes, the following matching
needs not be performed.
zSource MAC address
zDestination MAC address
zStarting VLAN ID
zEnding VLAN ID
zProtocol number in IP
zSource IP address
zWildcard mask of source IP address
zSource port operator: Its type can be equal to, not equal to, greater than, less than, greater
than and less than. The following ending source port number takes effect only when the type is
greater than and less than. The source port number of the packets matched by the identifier
must be greater than thestarting source port number and less than the endingsource port number.
zStarting source port number
zEnding source port number
zDestination IP address
zWildcard mask of destination IP address
zDestination port number operator: Its type can be equal to, not equal to, greater than, less than,
greater than and less than. The following ending destination port number is meaning only when
the type is greater than and less than. The destination port number of the packets matched by
the identifier must be greater than the starting destination port number and less than the ending
destination port number.
zStarting destination port number
zEnding destination port number
zPro: Protocol type, which can be GRE, ICMP, IGMP, OSPF, TCP, UDP, and IP.
zIP precedence: Packet precedence, a number in the range of 0 to 7.
zIP ToS: Type of Service (ToS) of IP
zIP DSCP: Differentiated Services Code Point (DSCP) of IP
zTCP flag: It indicates that some bits in the six flag bits (URG, ACK, PSH, RST, SYN, FIN) are
concerned.

2-9
zIP fragment: It indicates whether the packet is an IP packet fragment.
zRate limit
zRow state
You can use the collaboration policy to manage the collaboration rules that belong to it.
Using ACFP
zFor VLANID-context devices, after ACFP is enabled, some VLAN IDs must not be used by any
other modules; otherwise, some data packets may be forwarded incorrectly.
zIn a GRE tunneling environment, an ACFP policy can be configured on a tunnel interface only.
zACFP does not support policy routing services or NetStream services.
zThe handling of the packets redirected by ACFP and the part of the QoS processing (FR-DE
matching, ATM-CLP matching, inbound interface matching, QoS local-id, local precedence, and
so on) are mutually exclusive. No QoS processing is performed on the packets returned after they
are redirected to the ACFP client.
zOn the destination interface, the packets redirected or mirrored by ACFP only support Layer 2QoS
processing, including queuing, WRED (Weighted Random Early Detection), andso on; but not any
other service processing, such as non-Layer 2 QoS processing and non-QoS service processing.
zWith ACFP, a stream cannot be mirrored or redirected to multiple ACFP clients.
zACFP cannot process outbound packets.
zFor multi-core and software forwarding devices, ACFP does not support the handling of the
following types of packets: broadcasts, multicasts, MPLS packets, inbound packets, and IPv6
packets.
zFor multi-core and software forwarding devices, ACFP redirects and mirrors any IP datagram not
greater than 1,500 bytes (length of Layer 3 packet, excluding link layer header) but discards any IP
datagram greater than 1,500 bytes.
zFor software forwarding devices, if the contents of the rules matched by the packet on the inbound
interface or outbound interface exceed the quintuple information, the packet does not create fast
forwarding cache when being forwarded and therefore will not be fast forwarded.
ACFP Configuration Task List
Complete the following tasks to configure ACFP:
Task Remarks
Enabling the ACFP Server Required
Configuring ACFP Client Required
Enabling the ACFP Trap Function Optional
Enabling the ACFP Server
Follow these steps to configure to enable the ACFP server:
To do… Use the command… Remarks
Enter system view system-view —

2-10
To do… Use the command… Remarks
Enable the ACFP server acfp server enable Required
Disabled by default
Configuring ACFP Client
You need to configure the ACFP collaboration policy and ACFP collaboration rules on the ACFP client
through MIB. The specific configuration depends on the service software used on the ACFP client.
Enabling the ACFP Trap Function
To make ACFP work normally, you must enable the router to send traps of the ACFP module.
After the trap function on the ACFP module is enabled, the ACFP module will generate traps to report
important events of the module. The levels of the ACFP traps are described in Table 2-1.
Table 2-1 ACFP trap message level
Trap message Level
Context ID type changed notifications
ACFP client registration notifications
ACFP client deregistration notifications
ACSEI detects that ACFP client had no response warnings
ACFP server does not support the working mode of the ACFP client errors
Expiration period of ACFP collaboration policy changed notifications
ACFP collaboration rules are created informational
ACFP collaboration rules are removed informational
ACFP collaboration rules failed errors
Expiration period of ACFP collaboration policy timed out notifications
The generated traps will be sent to the information center of the router. With the parameters for the
information center set, the output rules for traps (that is, whether the traps are allowed to be output and
the output destinations) are decided. For more information about the parameters for the information
center, see Information Center in the Network Management and Monitoring Configuration Guide.
Follow these steps to enable the ACFP function:
To do… Use the command… Remarks
Enter system view system-view —
Enable the trap function of the
ACFP module snmp-agent trap enable acfp [ client
| policy | rule | server ] Optional
Enabled by default

2-11
For more information about the snmp-agent trap enable command, see SNMP in the Network
Management and Monitoring Command Reference.
Displaying and Maintaining ACFP
To do… Use the command… Remarks
Display the configuration
information of the ACFP server display acfp server-info
Display the configuration
information of an ACFP client display acfp client-info [ client-id ]
Display the configuration
information of an ACFP policy
display acfp policy-info [ client client-id
[ policy-index ] | dest-interface
interface-type interface-number |
in-interface interface-type
interface-number | out-interface
interface-type interface-number ] [ active |
inactive ]
Display ACFP rule configuration
information
display acfp rule-info { in-interface
[ interface-type interface-number ] |
out-interface [ interface-type
interface-number ] | policy [ client-id
policy-index ] }
Display ACFP rule cache
configuration information
display acfp rule-cache [ in-interface
interface-type interface-number |
out-interface interface-type
interface-number ] *
Display the configuration
information of ACFP Trap display snmp-agent trap-list
Available in any view
ACFP Configuration Example
Network Requirements
zAs shown in Figure 2-2, different departments are interconnected on the intranet through Router
(ACFP server).
zACFP client is connected to Router to control traffic on Router and analyzes traffic on the inbound
interface GigabitEthernet 1/2. After the traffic analysis by the ACFP client, all packets with the
inbound interface being GigabitEthernet 3/0//2 and source IP address being 192.168.1.1/24 are
permitted and all packets with the inbound interface being GigabitEthernet 3/0//2 and source IP
address being 192.168.1.2/24 are denied.

2-12
Figure 2-2 Network diagram for ACFP configuration
GE3/0/3
GE3/0/2 GE3/0/1
Router
ACFP client
ACFP server
Host A
192.168.1.1/24 Host B 192.168.1.2/24 Host C 192.168.2.1/24 Host D 192.168.2.2/24
Configuration Procedure
Configuring Router
# Enable the ACFP server.
<Router> system-view
[Router] acfp server enable
Configuring the collaboration policy and monitoring rules for the ACFP client through MIB
# Configure the ACFP client.
Configure the ACFPclient through MIB browser to send information to Router, where the client index is
1, four working modes are supported, namely, host, pass-through, redirect, and mirror (by setting the
node h3cAcfpClientMode), and the other parameters adopt the default values.
# Configure the ACFP policy.
Configure the ACFP policy through MIB browser to send information to Router, where the client index
and policy index is 1, the policy inbound interface is GigabitEthernet 3/0/2 (by setting the node
h3cacfpPolicyInIfIndex), the policy destination interface is GigabitEthernet 3/0/3 (by setting the node
h3cAcfpPolicyDestIfIndex) and the other parameters adopt the default values.
# Configure the ACFP rule.
Configure the ACFP rule through MIB browser to send information to Router, where both the client
index and policy index is 1, the action is redirect (by setting the node h3cAcfpRuleAction), and the
other parameters adopt the default values.
Configuring the collaboration policy and filtering rules for the ACFP client through MIB
# Configure the ACFP policy.
Configure the ACFPpolicy through MIB browser to send information to Router, where the client index is
1, policy index is 2, the policy inbound interface is GigabitEthernet 3/0/2 (by setting the node
h3cAcfpPolicyInIfIndex), and the other parameters adopt the default values.
# Configure the ACFP rule.
Apply the ACFP rule through MIB Browser to send information to Router, where the client index is 1,
policy index is 2, the action is permit (by setting the node h3cAcfpRuleAction), the packets whose
source IPaddress is 192.168.1.1 are matched (by setting the node h3cAcfpRuleSrcMAC), the wildcard

2-13
mask of the source IPaddress is 0.0.0.255 (by setting the node h3cAcfpRuleSrcIPMask), and the other
parameters adopt the default values.
Configure the ACFPrule through MIB browser to send information to Router, where the client index is 1,
policy index is 2, the action is deny (by setting the node h3cAcfpRuleAction), thepackets whose source
IP address is 192.168.1.2 are matched (by setting the node h3cAcfpRuleSrcMAC), the wildcard mask
of the source IPaddress mask is 0.0.0.255 (by setting the node h3cAcfpRuleSrcIPMask), and the other
parameters adopt the default values.
Verifying the configuration
Use the ping command to verify the connectivity between Host Aand Host C, Host B and Host C. The
test results show that Host C can be pinged on HostA and Host C cannot be pinged on Host B.

3-14
3 ACSEI Configuration
This chapter includes these sections:
zIntroduction to ACSEI
zACSEI Server Configuration
Introduction to ACSEI
As a private protocol, ACSEI provides a method for exchanging information between ACFPclients and
ACFP server. It well supports Application Control Forwarding Protocol (ACFP) collaboration, ensuring
valid information interaction between the ACFP clients and the ACFP server, so that the ACFP server
and clients can cooperate to run a service.
As a supporting protocol ofACFP, ACSEI also has two entities: server and client.
zACSEI server is integrated into the software system (Comware) of the device and is supported by
the device.
zACSEI client is implemented in two ways. One way is to integrate it into the system software
(Comware) of the device. In this way it is a function supported by the device. The other way is to
integrate it into the software system of the OAP module. In this way it is a function supported by the
OAP module. Hardware and configurations needed in the two implementations are different. This
chapter will introduce them respectively.
zACFP is designed based on the Open Application Architecture (OAA). The collaborating IDS
(Intrusion Detection System) cards or IDS devices serve as the ACFP clients which run
applications of other vendors and support the IPS (Intrusion Prevention System)/IDS services. For
more information about the ACFP, see ACFP in the OAA Configuration Guide.
zThe open application platform (OAP) is designed for new services. On OAP module runs the
operating system. You can load various service software, such as security, voice, and so on as
needed. For more information about the OAP module, see OAP Module in the OAA Configuration
Guide.
Functions of ACSEI
ACSEI mainly provides the following functions:
zRegistration and deregistration of an ACSEI client to the ACSEI server.
zID assignment. The ACSEI server assigns IDs to ACSEI clients to distinguish between them.
zMutual monitoring and awareness between an ACSEI client and the ACSEI server.