H3C H3C S5600 Series User manual

H3C S5600 Series Ethernet Switches
Operation Manual
Hangzhou H3C Technologies Co., Ltd.
http://www.h3c.com
Manual Version: 20090703-C-1.02
Product Version: Release 1602

Copyright © 2007-2009, Hangzhou H3C Technologies Co., Ltd. and its licensors
All Rights Reserved
No part of this manual may be reproduced or transmitted in any form or by any means without prior
written consent of Hangzhou H3C Technologies Co., Ltd.
Trademarks
H3C, , Aolynk, , H3Care, , TOP G, , IRF, NetPilot, Neocean, NeoVTL,
SecPro, SecPoint, SecEngine, SecPath, Comware, Secware, Storware, NQA, VVG, V2G, VnG, PSPT,
XGbus, N-Bus, TiGem, InnoVision and HUASAN are trademarks of Hangzhou H3C Technologies Co.,
Ltd.
All other trademarks that may be mentioned in this manual are the property of their respective owners.
Notice
The information in this document is subject to change without notice. Every effort has been made in the
preparation of this document to ensure accuracy of the contents, but all statements, information, and
recommendations in this document do not constitute the warranty of any kind, express or implied.
Technical Support
[e-mail]
http://www.h3c.com

About This Manual
Organization
H3C S5600 Series Ethernet Switches Operation Manual-Release 1602 is organized as follows:
Chapter Contents
00-2Product Overview Introduces the characteristics and implementations of the
Ethernet switch.
01-CLI Introduces the command hierarchy, command view and CLI
features of the Ethernet switch.
02-Login Introduces the ways to log into an Ethernet switch.
03-Configuration File
Management Introduces the ways to manage configuration files.
04-VLAN Introduces VLAN fundamental and the related configuration.
05-IP Address and
Performance Introduces IP address and IP performance fundamental and the related configuration.
06-Voice VLAN Introduces voice VLAN fundamental and the related configuration.
07-GVRP Introduces GVRP and the related configuration.
08-Port Basic Configuration Introduces basic port configuration.
09-Link Aggregation Introduces link aggregation and the related configuration.
10-Port Isolation Introduces port isolation and the related configuration.
11-Port Security-Port Binding Introduces port security, port binding, and the related
configuration.
12-DLDP Introduces DLDP and the related configuration.
13-MAC Address Table
Management Introduces MAC address forwarding table management and the related configuration.
14-Auto Detect Introduces auto detect and the related configuration.
15-MSTP Introduces STP and the related configuration.
16-Routing Protocol
Introduces the routing protocol-related configurations, including
static route configuration, RIP configuration, OSPF configuration,
BGP configuration, IP routing policy configuration and Route
Capacity Configuration.
17-Multicast Introduces the configuration of IGMP Snooping, IGMP, PIM-DM,
PIM-SM, and MSDP.
18-802.1x and System Guard Introduces 802.1x, System-Guard, Quick EAD deployment, HABP
and the related configuration.
19-AAA Introduces AAA, RADIUS, HWTACACS, EAD, and the related
configurations.
20-Web Authentication Introduces Web Authentication and the related configuration.
21-MAC Address
Authentication Introduces MAC address authentication and the related configuration.
22-VRRP Introduces VRRP and the related configuration.
23-ARP Introduces ARP and the related configuration.

Chapter Contents
24-DHCP Introduces DHCP server, DHCP relay, DHCP-Snooping, and the
related configurations.
25-ACL Introduces ACL and the related configuration.
26-QoS-QoS Profile Introduces QoS, QoS profile and the related configuration.
27-Mirroring Introduces port mirroring and the related configuration.
28 IRF Fabric Introduces IRF fabric-related configuration.
29-Cluster Introduces the configuration to form clusters using HGMP V2.
30-PoE-PoE Profile Introduces PoE, PoE profile and the related configuration.
31-UDP Helper Introduces UDP Helper and the related configuration.
32-SNMP-RMON Introduces the configuration to manage network devices through
SNMP and RMON.
33-NTP Introduces NTP and the related configuration.
34-SSH Introduces SSH and the related configuration.
35-File System Management Introduces basic configuration for file system management.
36-FTP-SFTP-TFTP Introduces basic configuration for FTP , SFTP and TFTP, and the
applications.
37-Information Center Introduces the configuration to analyze and diagnose networks
using the information center.
38-System Maintenance and
Debugging Introduces daily system maintenance and debugging.
39-VLAN-VPN Introduces VLAN-VPN and the related configuration.
40-HWPing Introduces HWPing and the related configuration.
41-IPv6 Management Introduces IPv6 Management and the related configuration.
42-DNS Introduces DNS and the related configuration.
43 Smart Link-Monitor Link Introduces Smart Link, Monitor Link and the related configuration.
44-Access Management Introduces Access Management and the related configuration.
45-Appendix Lists the acronyms used in this manual.
Conventions
The manual uses the following conventions:
Command conventions
Convention Description
Boldface The keywords of a command line are in Boldface.
italic Command arguments are in italic.
[ ] Items (keywords or arguments) in square brackets [ ] are optional.
{ x | y | ... }
Alternative items are grouped in braces and separated by vertical bars.
One is selected.

Convention Description
[ x | y | ... ]
Optional alternative items are grouped in square brackets and
separated by vertical bars. One or none is selected.
{ x | y | ... } *
Alternative items are grouped in braces and separated by vertical bars.
A minimum of one or a maximum of all can be selected.
[ x | y | ... ] *
Optional alternative items are grouped in square brackets and
separated by vertical bars. Many or none can be selected.
&<1-n> The argument(s) before the ampersand (&) sign can be entered 1 to n
times.
# A line starting with the # sign is comments.
GUI conventions
Convention Description
< > Button names are inside angle brackets. For example, click <OK>.
[ ] Window names, menu items, data table and field names are inside
square brackets. For example, pop up the [New User] window.
/ Multi-level menus are separated by forward slashes. For example,
[File/Create/Folder].
Symbols
Convention Description
Means reader be extremely careful. Improper operation may cause
bodily injury.
Means reader be careful. Improper operation may cause data loss or
damage to equipment.
Means a complementary description.
Related Documentation
In addition to this manual, each H3C S5600 Series Ethernet Switches documentation set includes the
following:
Manual Description
H3C S5600 Series Ethernet Switches
Command Manual-Release 1602 It is used for assisting the users in using various commands.
H3C S5600 Series Ethernet Switches
Installation Manual It provides information for the system installation.

Obtaining Documentation
You can access the most up-to-date H3C product documentation on the World Wide Web at this URL:
http://www.h3c.com.
The following are the columns from which you can obtain different categories of product documentation:
[Products & Solutions]: Provides information about products and technologies, as well as solutions.
[Technical Support & Document > Technical Documents]: Provides several categories of product
documentation, such as installation, configuration, and maintenance.
[Technical Support & Document > Software Download]: Provides the documentation released with the
software version.
Documentation Feedback
You can e-mail your comments about product documentation to [email protected].
We appreciate your comments.

i
Table of Contents
1 Obtaining the Documentation··················································································································1-1
CD-ROM ·················································································································································1-1
H3C Website···········································································································································1-1
Software Release Notes ·························································································································1-1
2 Correspondence Between Documentation and Software·····································································2-1
Software Version·····································································································································2-1
Manual List··············································································································································2-4
3 Product Overview······································································································································3-1
Preface····················································································································································3-1
Switch Models·········································································································································3-1
Software Features···································································································································3-2
4 Networking Applications ··························································································································4-1
Application in Small/Middle-Scaled Enterprise Networks·······································································4-1
Application in Large-Scaled/Campus Networks······················································································4-1

1-1
1 Obtaining the Documentation
Hangzhou H3C Technologies Co., Ltd. (hereafter referred to as H3C) provides various ways for you to
obtain product documents and new feature releases in a convenient and timely manner. The
documentations are available with:
zCD-ROMs shipped with the devices
zH3C website
zSoftware release notes
CD-ROM
H3C delivers a CD-ROM together with each device. The CD-ROM contains a complete set of electronic
documents of the product, including operation manuals and command manuals. After installing the
reader program provided by the CD-ROM, you can search for the desired contents in a convenient way
through the reader interface.
The contents in the manual are subject to update on an irregular basis due to product version upgrade
or some other reasons. Therefore, the contents in the CD-ROM may not be the latest version. This
manual serves the purpose of user guide only. Unless otherwise noted, all the information in the
document set does not claim or imply any warranty. For the latest software documentation, go to the
H3C website.
H3C Website
Perform the following steps to query and download the product documentation from the H3C website.
Table 1-1 Acquire product documentation from the H3C website
How to apply for an
account
Access the homepage of H3C at http://www.h3c.com and click
Registration at the top right. In the displayed page, provide your
information and click Submit to register.
How to get
documentation
In the homepage, select Technical Support & Document > Technical
Documents from the navigation bar at the top.
Select a product for its documents.
Software Release Notes
With software upgrade, new software features may be added. You can acquire the information about
the newly added software features through software release notes.

2-1
2 Correspondence Between Documentation and
Software
Software Version
H3C S5600 Series Ethernet Switches Operation Manual-Release 1602 and H3C S5600 Series
Ethernet Switches Command Manual-Release 1602 are for the software version of Release1602 of the
S5600 series products.
zCompared with Release 1510, many new features are added in Release 1602. For details, refer to
Table 2-1.
zCompared with Release 1510, a feature is removed from Release 1602. For details, refer to Table
2-2.
zCompared with Release 1510, three features are modified in Release 1602. For details, refer to
Table 2-3.
Table 2-1 Added features in Release 1602
Added feature in Release 1602 Manual
Specifying the authentication mode for user level switching
Adopting HWTACACS authentication for user level switching 01-CLI
Copyright information is displayed when a Telnet user logs in
Banner information is displayed when a user logs in through Web 02-Login
Auto-negotiation rate configuration for the current port
The port up/down log output function is removed
Packet traffic threshold configuration for ports
Display of the statistics of discarded packets on ports
Configuration of the delay time of sending state-change traps for
the current port
Configuring Combo port state change
08-Port Basic Configuration
Inter-device port isolation 10-Port Isolation
New port security modes: macAddressAndUserLoginSecure
and macAddressAndUserLoginSecureExt 11-Port Security-Port Binding
Destination MAC address update
Configuring the MAC address of an Ethernet port 13-MAC Address Table
Management
STP maintainability
802.1d-compliant traps 15-MSTP
Configuration of the Type-7 LSAs converter features in an NSSA
zone
Support of unicasting protocol messages in a P2MP network 16-Routing Protocol

2-2
Added feature in Release 1602 Manual
Multicast data packet cache mechanism
Support of multicast source lifetime configuration
Support of IGMPv3 Snooping
Support of IGMPv3 Snooping simulated joining
Support of suppressing flooding of unknown multicast traffic in the
VLAN
Support of static member port configuration
Support of static router port configuration
Support of VLAN tag configuration for query messages
17-Multicast Protocol
Online user handshake
Support of 802.1x re-authentication configuration
Support of 802.1x re-authentication timeout configuration
Quick deployment of EAD
18-802.1x and System-Guard
Support of domain delimiter configuration
Support of HWTACACS scheme configuration for ISP domain
user level switching
Setting of MAC address format of the Calling-Station-Id (Type 31)
field in RADIUS packets
19-AAA
Web authentication 20-Web Authentication
Support of fixed password configuration when a MAC address is
used as a user name
Enhanced MAC authentication functions
21-MAC Address
Authentication
Display of detailed backup group information 22-VRRP
ARP attack detection
ARP packet rate limiting
Support of sending gratuitous ARP packets periodically
Proxy ARP
23-ARP
Configuration of the TFTP server address and bootfile name for
DHCP clients that support auto-configuration
Support of option 82 in DHCP snooping
IP filtering
DHCP packet rate limiting
24-DHCP
Applying ACLs to VLANs
Configuration of inner VLAN information for Layer 2 ACLs 25-ACL
VLAN mapping
Configuration of burst traffic for port rate limiting and traffic
policing
Configuration of priority remarking in VLANs
26-QoS-QoS Profile

2-3
Added feature in Release 1602 Manual
Redirecting traffic to an aggregation port group and removing the
outer VLAN tag after the traffic is redirected to the uplink port or
the aggregation port group
Burst function
Configuration of IRF automatic fabric 28-IRF Fabric
Online upgrade of PSE processing software 30-PoE-PoE Profile
Creating a MIB view with the mask of a MIB subtree
Encrypting a plain-text password
Adding interface description and interface type in linkUp/linkDown
Trap message
32-SNMP-RMON
Support of the DSA asymmetric key algorithm 34-SSH
Banner information of the FTP server 36-FTP-SFTP-TFTP
Displaying timestamp with the UTC time zone 37-Information Center
Configuration of real-time monitoring of system running status
Hot patching
Viewing and diagnosing hot-pluggable transceivers
38-System Maintenance and
Debugging
Selective QinQ
Support of multiple types of protocol packets for BPDU Tunneling
Customizing tunnel packet MAC addresses
39-VLAN-VPN
Eight test types are added in HWPing, including DHCP test, FTP
test, HTTP test, DNS test, SNMP test, Jitter test, TCP test, and
UDP test
Maximum number of history records that can be saved
40-HWping
IPv6 management 41-IPv6 Management
Smart Link
Monitor Link 43-Smart Link-Monitor Link
Table 2-2 Deleted feature from Release 1602
Deleted feature Manual
CLI language mode setting 38-System Maintenance and Debugging
Table 2-3 Modified features in Release 1602
Modified feature Manual
Support of up to 128 characters in a domain
name, compared with the original 24 characters 19-AAA
Sequence of selecting Web files 35-File System Management
Keywords of five commands 22-VRRP

2-4
Manual List
Manual name
H3C S5600 Series Ethernet Switches Installation Manual
H3C S5600 Series Ethernet Switches Operation Manual-Release 1602
H3C S5600 Series Ethernet Switches Command Manual-Release 1602

3-1
3 Product Overview
Preface
H3C S5600 Series Ethernet Switches (hereinafter referred to as the S5600 series) provide multi-layer
switching capabilities, and support rich Layer 3 features and enhanced extended functions. They are
intelligent network-manageable switches designed for network environments that require high
performance, high port density and easy-to-install characteristics.
Switch Models
Table 3-1 lists the S5600 series Ethernet Switches models.
Table 3-1 Models in the S5600 series
Model Power
supply
Available
ports on
front panel
Ports on
front panel Combo ports Console port
H3C
S5600-26C
AC and DC
dual input
power supply
(PSL130-AD)
24
24 x
10/100/1000B
ase-T
electrical ports
4 x 1000 Mbps
SFP Combo
ports 1
H3C
S5600-26C-P
WR
AC/DC input
external PoE
power supply
(PSL480-AD2
4P)
24
24 x
10/100/1000B
ase-T
electrical ports
4 x 1000 Mbps
SFP Combo
ports 1
H3C
S5600-26F
AC and DC
dual input
power supply
(PSL130-AD)
24 24 x 1000 Mbps SFP
optical ports
4 x 1000 Mbps
RJ45 Combo
ports 1
H3C
S5600-50C
AC and DC
dual input
power supply
(PSL180-AD)
48
48 x
10/100/1000B
ase-T
electrical ports
4 x 1000 Mbps
SFP Combo
ports 1
H3C
S5600-50C-P
WR
AC/DC input
external PoE
power supply
(PSL480-AD4
8P)
48
48 x
10/100/1000B
ase-T
electrical ports
4 x 1000 Mbps
SFP Combo
ports 1
An S5600 series switch provides one 2-port fabric port and one expansion module slot on its rear panel.
The available expansion modules you can select include: 8-port 1000 Mbps SFP module, 1-port 10G
XENPAK module, and 2-port 10G XFP module.

3-2
Software Features
S5600 Series Ethernet Switches have abundant software features and can meet the requirements of
different applications. Table 3-2 summarizes the features provided by each module.
Table 3-2 Service features of the S5600 series
Part Features
1 CLI
zCLI
zHierarchically grouped commands
zCLI online help
2 Login
zLogging into a switch through the Console port
zLogging into a switch through an Ethernet port by
using Telnet or SSH
zLogging into a switch through the Console port by
using modem
zLogging into a switch through Web or NMS
zControlling user login using ACL
3 Configuration File Management zSaving, restoring, and deleting the configuration file
4 VLAN
zIEEE 802.1Q-compliant VLAN
zPort-based VLAN
zProtocol-based VLAN
5 IP Address and Performance
Configuration
zConfiguring an IP address for a switch
zConfiguring the TCP attributes for a switch
zEnabling/disabling the switch to receive directed
broadcasts
zEnabling/disabling the switch to send ICMP error
messages
6 Voice VLAN zVoice VLAN
7 GVRP zGARP VLAN Registration Protocol (GVRP)
8 Port Basic Configuration
zConfiguring port auto-negotiation rate
zLimiting traffic on a port
zSetting broadcast storm suppression globally
zLoopback detection supported
zCable test
9 Link Aggregation zLink Aggregation Control Protocol (LACP)
10 Port Isolation zPort isolation group
11 Port Security-Port Binding zMultiple security modes
zMAC address-to-IP address-to-port binding
12 DLDP zDevice Link Detection Protocol (DLDP)
13 MAC Address Table
zManually configuring dynamic, static, and black
hole MAC addresses
zConfiguring the aging time for MAC addresses
zMAC address learning limit
14 Auto Detect
zAuto detect
zAuto detect applications in static routing, VRRP,
and VLAN interface backup

3-3
Part Features
15 MSTP
zSTP/RSTP/MSTP
zThe following guard functions are available on an
MSTP-enabled switch: BPDU guard, root guard,
loop guard, TC-BPDUattack guard, and BPDU drop
zDigest snooping
zRapid transition
zVLAN-VPN TUNNEL
zH3C-proprietary MSTP path cost standard
16 Routing Protocols.
zStatic route
zRouting Information Protocol (RIP) v1/v2
zOpen Shortest Path First (OSPF)
zBorder Gateway Protocol (BGP)
zRouting policy
zRoute capacity limiting
17 Multicast
zInternet Group Management Protocol Snooping
(IGMP Snooping)
zInternet Group Management Protocol (IGMP)
zProtocol Independent Multicast-dense mode
(PIM-DM)
zProtocol Independent Multicast-sparse mode
(PIM-SM)
zMSDP
18 802.1x and System Guard
z802.1X authentication
zGuest VLAN
zQuick deployment of EAD
zHuawei Authentication Bypass Protocol (HABP)
zSystem guard
19 AAA
zAuthentication, Authorization, and Accounting
(AAA)
zRemote Authentication Dial-In User Service
(RADIUS)
zHuawei Terminal Access Controller Access Control
System (HWTACACS)
zEndpoint Admission Defense (EAD)
20 Web Authentication zWeb authentication
21 MAC Address Authentication zMAC address authentication
zEnhanced MAC address authentication
22 VRRP zVirtual Router Redundancy Protocol (VRRP)
23 ARP
zGratuitous ARP
zSending gratuitous ARP packets periodically
zManually configuring ARP entries
zARP attack detection
zARP packet rate limiting
zProxy ARP
zResilient ARP

3-4
Part Features
24 DHCP
zDHCP client/BOOTP client
zDHCP server
zDHCP relay
zDHCP Snooping
zDHCP accounting
zUsing Option184 in DHCP server
zUsing Option82 in DHCP relay andDHCP Snooping
zDHCP packet rate limitation
25 ACL
zBasic ACLs
zAdvanced ACLs
zLayer 2 ACLs
zUser-defined ACLs
zApplying ACLs on ports
zApplying ACLs to VLANs
26 QoS-QoS Profile zQuality of Service (QoS)
zQoS profile
27 Mirroring
zTraffic mirroring
zLocal port mirroring
zRemote port mirroring
28 IRF Fabric zIRF Fabric
zPeer end detection for stack ports
29 Cluster
zHuawei Group Management Protocol (HGMP) v2
zNeighbor Discovery Protocol (NDP)
zNeighbor Topology Discovery Protocol (NTDP)
30 PoE-PoE Profile zPower over Ethernet (PoE)
zPoE profile
31 UDP Helper zForwarding UDP broadcast packets by using UDP
Helper
32 SNMP-RMON
zSimple Network Management Protocol (SNMP) v3,
compatible with SNMP v1/v2
zSupport of Trap parameters configuration
zRemote monitoring (RMON)
33 NTP zNetwork Time Protocol (NTP)
34 SSH Terminal Service Secure shell (SSH) v2.0, compatible with SSHv1.5
35 File System Management
zFile system configuration
zFile attribute configuration
zConfiguration file backup and restoration
36 FTP-SFTP-TFTP
zOperating as an FTP server/FTP client
zOperating as an SFTP server/SFTP client
zOperating as a TFTP client
37 Information Center
zSystem logs
zHierarchical alarms
zDebugging information output
38 System Maintenance and Debugging
zLoading Boot ROM and software in multiple ways
zBasic system configuration and debugging
zNetwork connectivity test
zDevice management

3-5
Part Features
39 VLAN-VPN
zVLAN VPN (QinQ)
zSelective QinQ
zBPDU Tunnel
zConfiguring VLAN VPN interior-layer priority
replication
40 HWPing
zOperating as a HWPing server/HWPing client
zNine test types, including ICMP test, DHCP test,
FTP test, HTTP test, DNS test, SNMP test, jitter
test, TCP test, and UDP test
41 IPv6 Management
zIPv6 management
zIPv6 static route
zIPv6 DNS
42 DNS IPv4 Domain Name System (DNS)
43-Smart Link-Monitor Link zSmart Link
zMonitor Link
44 Access Management Configuring the access IP address pool based on the
physical port

4-1
4 Networking Applications
The S5600 series support flexible networking. They can be used as broadband access devices, as well
as networking devices in enterprise networks. The following describes several typical networking
methods for the S5600 series.
Application in Small/Middle-Scaled Enterprise Networks
The S5600 series can be used as backbone switches in the branches of small/middle-scaled
enterprises, where they can be connected (by routers) to the networks of other branches or the
headquarters. When the branches or enterprises grow in scale, the S5600 series also provide seamless
growth through IRF.
Figure 4-1 Application in small/middle-scaled enterprise branches
S5600
S3600
Access
Core/Distribution
Application in Large-Scaled/Campus Networks
The S5600 series can also be used as distribution devices in large-scaled enterprise networks and
campus networks, where each of them can be connected with multiple Layer 2/3 downstream Ethernet
switches (for example, S3600 series switches), and connected to Layer 3 core upstream switches

4-2
through the GE expansion module slot. In this way, the S5600 series can provide a full solution for
building enterprise networks in various size (from Gigabit backbone network, 100 Mbps network to
desktop network).
Figure 4-2 Application in large-scaled/campus networks
S5600
S3600
Access
Core
Distribution
S7500
S5600
S3600

i
Table of Contents
1 CLI Configuration ······································································································································1-1
Introduction to the CLI·····························································································································1-1
Command Hierarchy·······························································································································1-2
Command Level and User Privilege Level······················································································1-2
Modifying the Command Level········································································································1-2
Switching User Level·······················································································································1-3
CLI Views················································································································································1-6
CLI Features ·········································································································································1-11
Online Help····································································································································1-11
Terminal Display····························································································································1-12
Command History··························································································································1-12
Error Prompts································································································································1-13
Command Edit·······························································································································1-13