H3C H3C S5600 Series User manual

H3C S5600 Series Ethernet Switches
Operation Manual
Hangzhou H3C Technologies Co., Ltd.
http://www.h3c.com
Manual Version: 20100630-C-1.00
Product Version: Release 1702

Copyright © 2007-2010, Hangzhou H3C Technologies Co., Ltd. and its licensors
All Rights Reserved
No part of this manual may be reproduced or transmitted in any form or by any means without prior
written consent of Hangzhou H3C Technologies Co., Ltd.
Trademarks
H3C, , Aolynk, , H3Care, , TOP G, , IRF, NetPilot, Neocean, NeoVTL,
SecPro, SecPoint, SecEngine, SecPath, Comware, Secware, Storware, NQA, VVG, V2G, VnG, PSPT,
XGbus, N-Bus, TiGem, InnoVision and HUASAN are trademarks of Hangzhou H3C Technologies Co.,
Ltd.
All other trademarks that may be mentioned in this manual are the property of their respective owners.
Notice
The information in this document is subject to change without notice. Every effort has been made in the
preparation of this document to ensure accuracy of the contents, but all statements, information, and
recommendations in this document do not constitute the warranty of any kind, express or implied.
Technical Support
[e-mail]
http://www.h3c.com

1
Table of Contents
1 About This Document ·······························································································································1-1
Audience·················································································································································1-1
Part Organization····································································································································1-1
New Features··········································································································································1-4
Conventions············································································································································1-6
Command conventions····················································································································1-6
GUI conventions······························································································································1-6
Symbols···········································································································································1-7
2 H3C S5600 Series Documentation Guide································································································2-1
Obtaining the Documentation ·················································································································2-1
CD-ROM··········································································································································2-1
H3C Website ···································································································································2-1
Software Release Notes··················································································································2-1
Related Documentation ··························································································································2-1
Finding Documents at the H3C Website·································································································2-2
Documentation Feedback·······················································································································2-2
3 Product Overview······································································································································3-1
Product Overview····································································································································3-1
Network Scenarios··································································································································3-1
Application in Small/Middle-Scaled Enterprise Networks································································3-1
Application in Large-Scaled/Campus Networks··············································································3-2

1-1
1 About This Document
The H3C S5600 Series Ethernet Switches Operation Manual, Release 1702 describes the software
features available in the S5600 series software release 1702, and guides you through the software
feature configuration procedures.
Audience
This document is for administrators who are configuring and maintaining the S5600 series switches.
Part Organization
Table 1-1 presents the part organization of this document:
Table 1-1 Part organization
Part Contents
01-CLI zIntroduction to CLI
zCLI Configuration
02-Login
zLogging In Through the Console Port
zLogging In Through Telnet or SSH
zLogging In Using a Modem
zLogging In Through Web or NMS
zConfiguring Source IP Address for Telnet Service Packets
zControlling Login Users by Using ACL
zSwitching User Level
03-Configuration File
Management
zIntroduction to Configuration File
zSaving the Current Configuration
zErasing the Startup Configuration File
zSpecifying a Configuration File for Next Startup
04-VLAN
zBasic VLAN Configuration
zConfiguring Port-Based VLAN
zConfiguring Protocol-Based VLAN
05-IP Address and
Performance
zConfiguring an IP address for a Switch
zConfiguring the TCP Attributes for a Switch
zEnabling Reception and Forwarding of Directed Broadcasts to a Directly
Connected Network
zDisabling the Switch from Sending ICMP Error Messages
zCanceling the System-Defined ACLs for ICMP Attack Guard
06-Voice VLAN zVoice VLAN Overview
zVoice VLAN Configuration
07-GVRP zIntroduction to GVRP
zGVRP Configuration
08-Port Basic
Configuration
zConfiguring Speed Options for Auto Negotiation on a Port
zConfiguring Flow Control on a Port
zDuplicating the Configuration of a Port to Other Ports
zEnabling Loopback Test
zEnabling Giant-Frame Statistics Function
zLimiting Traffic on a Port
zSetting Broadcast Storm Suppression Globally
zConfiguring Loopback Detection on a Port
zEnabling Cable Test on a Port

1-2
Part Contents
09-Link Aggregation
zConfiguring a Manual Aggregation Group
zConfiguring a Static LACP Aggregation Group
zConfiguring a Dynamic LACP Aggregation Group
10-Port Isolation Configuring Port Isolation Group
11-Port Security-Port
Binding
zSetting the Maximum Number of Secure MAC Addresses Allowed on a Port
zSetting the Port Security Mode
zConfiguring Port Security Features
zConfiguring Guest VLAN for a Port in macAddressOrUserLoginSecure mode
zIgnoring the Authorization Information from the RADIUS Server
zConfiguring Secure MAC Addresses
zConfiguring Port Binding
12-DLDP Device link detection protocol (DLDP)
13-MAC Address Table
Management
zIntroduction to MAC Address Table
zConfiguring a MAC Address Entry
zSetting the MAC Address Aging Timer
zSetting the Maximum Number of MAC Addresses a Port Can Learn
zEnabling Destination MAC Address Triggered Update
zAssigning MAC Addresses for Ethernet Ports
14-Auto Detect
zAuto Detect Basic Configuration
zAuto Detect Implementation in Static Routing
zAuto Detect Implementation in VRRP
zAuto Detect Implementation in VLAN Interface Backup
15-MSTP
zSTP/RSTP/MSTP Overview and Basic Configuration
zPerforming mCheck Operation
zGuard Functions: BPDU Guard, Root Guard, Loop Guard, TC-BPDU Attack
Guard, and BPDU Drop
zDigest Snooping
zRapid Transition
zVLAN-VPN Tunnel
zMSTP Maintenance Configuration
zSending Trap Messages Conforming to 802.1d Standard
16-Routing Protocol
zStatic Route
zRouting Information Protocol (RIP) v1/v2
zOpen Shortest Path First (OSPF)
zBorder Gateway Protocol (BGP)
zRouting Policy
zRoute Capacity Limiting
17-Multicast
zMulticast Overview
zConfiguring the Common Multicast Functions
zInternet Group Management Protocol (IGMP)
zProtocol Independent Multicast (PIM)
zMulticast Source Discovery Protocol (MSDP)
zInternet Group Management Protocol Snooping (IGMP Snooping)
18-802.1X and System
Guard
z802.1X Authentication
zGuest VLAN
zQuick EAD Deployment
zHuawei Authentication Bypass Protocol (HABP)
zSystem Guard
19-AAA
zAuthentication, Authorization, and Accounting (AAA)
zRemote Authentication Dial-In User Service (RADIUS)
zHuawei Terminal Access Controller Access Control System (HWTACACS)
zEndpoint Admission Defense (EAD)
20-Web Authentication
zWeb Authentication Configuration
zConfiguring HTTPS Access for Web Authentication
zCustomizing Web Authentication Pages

1-3
Part Contents
21-MAC Address
Authentication
zBasic MAC Address Authentication
zEnhanced MAC Address Authentication
22-VRRP zVirtual Router Redundancy Protocol (VRRP) Basic Configuration
zVRRP Tracking
23-ARP
zARP
zGratuitous ARP
zARP Attack Detection
zProxy ARP
zResilient ARP
zMFF
24-DHCP
zDHCP Server
zDHCP Relay Agent
zDHCP Snooping
zDHCP Packet Rate Limit
zDHCP/BOOTP Client
25-ACL
zBasic ACLs
zAdvanced ACLs
zLayer 2 ACLs
zUser-Defined ACLs
zIPv6 ACLs
zApplying ACLs to Ports
zApplying ACLs to VLANs
26-QoS-QoS Profile zQuality of Service (QoS)
zQoS Profile
27-Mirroring
zTraffic Mirroring
zLocal Port Mirroring
zRemote Port Mirroring (available only on the S3600-EI series)
28-IRF Fabric
zIRF Fabric
zSpecifying the Fabric Port of a Switch
zIRF Fabric Detection
zIRF Automatic Fabric
29-Cluster
zHuawei Group Management Protocol (HGMP) v2
zNeighbor Discovery Protocol (NDP)
zNeighbor Topology Discovery Protocol (NTDP)
zEnhanced Cluster Features
zCluster Synchronization Functions
30-PoE-PoE Profile zPoE Configuration
zPoE Profile Configuration
31-UDP Helper zIntroduction to UDP Helper
zConfiguring UDP Helper
32-SNMP-RMON
zSimple Network Management Protocol (SNMP) v1, v2, v3
zConfiguring Trap-Related Functions
zRemote Monitoring (RMON)
33-NTP
zIntroduction to NTP
zConfiguring NTP Implementation Modes
zConfiguring Access Control Right
zConfiguring NTP Authentication
zConfiguring Optional NTP Parameters
34-SSH
zSSH Overview
zConfiguring the SSH Server
zConfiguring the SSH Client
35-File System
Management
zFile System Configuration
zFile Attribute Configuration
zConfiguration File Backup and Restoration

1-4
Part Contents
36-FTP-SFTP-TFTP zFTP and SFTP Configuration
zTFTP Configuration
37-Information Center zInformation Center Overview
zInformation Center Configuration
38-System Maintenance
and Debugging
zBoot ROM and Host Software Loading
zBasic System Configuration and Debugging
zNetwork Connectivity Test
zDevice Management
zScheduled Task Configuration
39-VLAN-VPN
zVLAN VPN (QinQ)
zEnabling Transparent IGMP Message Transmission on a VLAN-VPN Port
zConfiguring the Inner-to-Outer Tag Priority Replication
zSelective QinQ
zBPDU Tunnel
40-HWPing
zHWPing Server/HWPing Client Configuration
zNine test types, including ICMP test, DHCP test, FTP test, HTTP test, DNS test,
SNMP test, jitter test, TCP test, and UDP test
41-IPv6 Management
zIPv6 Management
zStatic IPv6 Route
zIPv6 DNS
zIPv6 Application Configuration
42-DNS IPv4 Domain Name System (DNS)
43-Smart Link-Monitor
Link
zSmart Link
zMonitor Link
44-Access Management zAccess Management Overview
zConfiguring Access Management
45-LLDP
zBasic Link Layer Discovery Protocol (LLDP) configuration
zCDP Compatibility
zLLDP Trapping
46-PKI
zSubmitting a PKI Certificate Request in Auto Mode or in Manual Mode
zVerifying, Retrieving, and Deleting a PKI Certificate
zConfiguring an Access Control Policy
47-SSL zConfiguring an SSL Server Policy
zConfiguring an SSL Client Policy
48-HTTPS
zHTTPS Service
zAssociating the HTTPS Service with an SSL Server Policy
zAssociating the HTTPS Service with a Certificate Attribute Access Control Policy
zAssociating the HTTPS Service with an ACL
New Features
H3C S5600 Series Ethernet Switches Operation Manual-Release 1702 and H3C S5600 Series
Ethernet Switches Command Manual-Release 1702 are for software release 1702.
See Table 1-2 for new features introduced in release 1702.
Table 1-2 New features in release 1702
New features Reference
Command alias configuration 01-CLI

1-5
Canceling the system-defined ACLs for ICMP attack guard 05-IP Address and
Performance
Configuring QoS priority settings for voice traffic on an interface 06-Voice VLAN
Configuring loopback port auto-shutdown and loopback detection on Ethernet
ports in bulk
Configuring storm suppression thresholds in kbps
Various types of characters in port descriptions
08-Port Basic Configuration
Extended LACP function 09-Link Aggregation
Configuring Guest VLAN for port security
Configuring the aging time for learned secure MAC address entries 11-Port Security-Port Binding
Configuring PIM prune delay (available only on the S3600-EI series)
Configuring the source address to be carried in IGMP group-specific queries
Disabling a port from becoming a router port
17-Multicast
802.1x mandatory authentication domain function
802.1x unicast trigger function
CPU protection
system-guard transparent function
18-802.1X and System Guard
Ignoring assigned RADIUS authorization attributes
Auto VLAN
Per user type AAA
RADIUS server backup function
19-AAA
Setting the maximum online time for Web authentication users
Configuring HTTPS access for Web authentication
Customizing Web authentication pages
20-Web Authentication
Configuring MAC authentication offline detect timer on a port 21-MAC Address
Authentication
ARP attack defense
Local proxy ARP
MFF
23-ARP
IP filtering based on authenticated 802.1X clients
Removing DHCP snooping entries
Configuring the DHCP relay agent to process DHCP-INFORM messages in an
IRF system
24-DHCP
IPv6 ACLs 25-ACL
Port mirroring–STP collaboration 27-Mirroring
Cluster synchronization 29-Cluster

1-6
Enabling the UDP Helper TTL-keep function 31-UDP Helper
Enabling auto power down on an electrical Ethernet port
Scheduled task configuration
38-System Maintenance and
Debugging
Enabling transparent IGMP message transmission on a VLAN-VPN port 39-VLAN-VPN
New HWPing commands, including: adv-factor, datafill, description, display
hwping statistics, filesize, history keep-time, history-record enable,
hwping-agent clear, hwping-agent max-requests, sendpacket passroute,
statistics, statistics keep-time, test-time begin, and ttl.
40-HWPing
LLDP 45-LLDP
PKI 46-PKI
SSL 47-SSL
HTTPS 48-HTTPS
Conventions
Command conventions
Convention Description
Boldface The keywords of a command line are in Boldface.
italic Command arguments are in italic.
[ ] Items (keywords or arguments) in square brackets [ ] are optional.
{ x | y | ... }
Alternative items are grouped in braces and separated by vertical bars. One is
selected.
[ x | y | ... ]
Optional alternative items are grouped in square brackets and separated by
vertical bars. One or none is selected.
{ x | y | ... } *
Alternative items are grouped in braces and separated by vertical bars. A
minimum of one or a maximum of all can be selected.
[ x | y | ... ] *
Optional alternative items are grouped in square brackets and separated by
vertical bars. Many or none can be selected.
&<1-n> The argument(s) before the ampersand (&) sign can be entered 1 to n times.
# A line starting with the # sign contains comments.
Command line interface (CLI) commands of H3C products are case insensitive.
GUI conventions
Convention Description
Boldface Window names, button names, field names, and menu items are in Boldface.
For example, the New User window appears; click OK.

1-7
Convention Description
> Multi-level menus are separated by angle brackets. For example, File > Create
> Folder.
Symbols
Convention Description
Means reader be extremely careful. Improper operation may cause bodily
injury.
Means reader be careful. Improper operation may cause data loss or damage to
equipment.
Means a complementary description.
Means techniques helpful for you to make configuration with ease.

2-1
2 H3C S5600 Series Documentation Guide
Obtaining the Documentation
You can obtain the H3C S5600 series documentation in these ways:
zCD-ROMs shipped with the devices
zH3C website
zSoftware release notes
CD-ROM
H3C delivers a CD-ROM together with each device. The CD-ROM contains a complete set of electronic
documents of the product, including operation manuals and command manuals. After installing the
reader program provided by the CD-ROM, you can search for the desired contents in a convenient way
through the reader interface.
The contents in the manual are subject to update on an irregular basis due to product version upgrade
or some other reasons. Therefore, the contents in the CD-ROM may not be the latest version. This
manual serves the purpose of user guide only. Unless otherwise noted, all the information in the
document set does not claim or imply any warranty. For the latest software documentation, go to the
H3C website.
H3C Website
To obtain up-to-date documentation and technical support, go to http://www.h3c.com.
Go to the following columns for different categories of product documentation:
[Products & Solutions]: Provides information about products and technologies, as well as solutions.
[Technical Support & Document > Technical Documents]: Provides several categories of product
documentation, such as installation, configuration, and maintenance.
[Technical Support & Document > Software Download]: Provides the documentation released with the
software version.
Software Release Notes
With software upgrade, new software features may be added. You can acquire the information about
the newly added software features through software release notes.
Related Documentation
Use the documents listed in Table 2-1 together with H3C S5600 Series Ethernet Switches Operation
Manual to make full use of the benefits delivered by the S5600 series.
Table 2-1 Related documentation
Document title Description
H3C S5600 Series Ethernet Switches Command
Manual-Release 1702
Describes the commands for the S5600 Series
Ethernet Switches. A master index of all commands
covered by the whole manual is provided for the ease
of retrieval.

2-2
Document title Description
H3C S5600 Series Ethernet Switches Installation
Manual
Describes the physical views and hardware
specifications of the H3C S5600 series switches, and
guides you through the installation, power-on and
startup, troubleshooting and maintenance procedures.
H3C S5600 Series Ethernet Switches Compliance
and Safety Manual
Provides the safety and regulatory compliance
statements, and describes the protection actions that
you must take when installing and maintaining the
H3C S5600 series switches.
H3C Low-End Ethernet Switches Configuration Guide Describes the typical application scenarios, and provides configuration examples and configuration
guidelines.
Finding Documents at the H3C Website
All these documents are available at the H3C website:
zFor software feature descriptions and configuration procedures, see H3C S5600 Series Ethernet
Switches Operation Manual.
zFor command reference, see H3C S5600 Series Ethernet Switches Command Manual.
zFor hardware specifications, installation, and troubleshooting, see H3C S5600 Series Ethernet
Switches Installation Manual.
zFor typical application scenarios, configuration examples, and configuration guidelines, see H3C
Low-End Ethernet Switches Configuration Guides.
Documentation Feedback
You can e-mail your comments about product documentation to [e-mail].
We appreciate your comments.

3-1
3 Product Overview
Product Overview
H3C S5600 Series Ethernet Switches (hereinafter referred to as the S5600 series) provide multi-layer
switching capabilities, and support rich Layer 3 features and enhanced extended functions. They are
intelligent network-manageable switches designed for network environments that require high
performance, high port density and easy-to-install characteristics.
Table 3-1 H3C S5600 switch hardware summary
Model Power supply Available
ports on
front panel Ports on front panel Combo ports Console
port
S5600-26C AC and DC dual
input power supply
(PSL130-AD) 24 24 x
10/100/1000Base-T
electrical ports
4 x 1000 Mbps
SFP Combo
ports 1
S5600-26C-PWR
AC/DC input
external PoE
power supply
(PSL480-AD24P)
24 24 x 10/100/1000Base-T
electrical ports
4 x 1000 Mbps
SFP Combo
ports 1
S5600-26F AC and DC dual
input power supply
(PSL130-AD) 24 24 x 1000 Mbps SFP
optical ports
4 x 1000 Mbps
RJ45 Combo
ports 1
S5600-50C AC and DC dual
input power supply
(PSL180-AD) 48 48 x
10/100/1000Base-T
electrical ports
4 x 1000 Mbps
SFP Combo
ports 1
S5600-50C-PWR
AC/DC input
external PoE
power supply
(PSL480-AD48P)
48 48 x 10/100/1000Base-T
electrical ports
4 x 1000 Mbps
SFP Combo
ports 1
An S5600 series switch provides one 2-port fabric port and one expansion module slot on its rear panel.
The available expansion modules you can select include: 8-port 1000 Mbps SFP module, 1-port 10G
XENPAK module, and 2-port 10G XFP module.
Network Scenarios
You can deploy the S5600 series on many types of networks, such as enterprise and broadband access
networks. This section describes several typical application scenarios for the S5600 series.
Application in Small/Middle-Scaled Enterprise Networks
The S5600 series can be used as backbone switches in the branches of small/middle-scaled
enterprises, where they can be connected (by routers) to the networks of other branches or the
headquarters. When the branches or enterprises grow in scale, the S5600 series also provide
seamless growth through IRF.

3-2
Figure 3-1 Application in small/middle-scaled enterprise branches
S5600
S3600
Access
Core/Distribution
Application in Large-Scaled/Campus Networks
The S5600 series can also be used as distribution devices in large-scaled enterprise networks and
campus networks, where each of them can be connected with multiple Layer 2/3 downstream Ethernet
switches (for example, S3600 series switches), and connected to Layer 3 core upstream switches
through the GE expansion module slot. In this way, the S5600 series can provide a full solution for
building enterprise networks in various size (from Gigabit backbone network, 100 Mbps network to
desktop network).

3-3
Figure 3-2 Application in large-scaled/campus networks
S5600
S3600
Access
Core
Distribution
S7500
S5600
S3600

1
Table of Contents
1 CLI Configuration ······································································································································1-1
What Is CLI? ···········································································································································1-1
Entering the CLI······································································································································1-1
Entering CLI Through the Console Port··························································································1-2
Entering CLI Through Telnet···········································································································1-6
H3C Products CLI Descriptions··············································································································1-7
Command Conventions···················································································································1-7
CLI View Description·······················································································································1-8
Tips on Using the CLI····························································································································1-12
Using the CLI Online Help·············································································································1-12
Command Line Error Information··································································································1-13
Typing and Editing Commands·····································································································1-14
Displaying and Executing History Commands ··············································································1-14
Undo Form of a Command············································································································1-15
Controlling CLI Display··················································································································1-15
CLI Configurations ································································································································1-16
Configuring Command Aliases······································································································1-16
Synchronous Information Output···································································································1-17
Configuring Command Levels·······································································································1-17
Saving Configurations ···················································································································1-19

1-1
1 CLI Configuration
This chapter includes these sections:
zWhat Is CLI?
zEntering the CLI
zH3C Products CLI Descriptions
zTips on Using the CLI
zCLI Configurations
What Is CLI?
The command line interface (CLI) is an interface where you can interact with your device by typing text
commands. At the CLI, you can instruct your device to perform a given task by typing a text command
and then pressing Enter to submit it to your device. At the CLI, you can enter commands to configure
your switch, and verify the configuration based on the output. Thus, the CLI facilitates your switch
configuration and management. The CLI of H3C switches is as shown in Figure 1-1.
Figure 1-1 Schematic diagram for the CLI
Entering the CLI
The H3C S5600 Series Ethernet switches provide multiple methods of entering the CLI, as follows:
zThrough the console port. For more information, see Entering CLI Through the Console Port.
zThrough Telnet. For more information, see Entering CLI Through Telnet.
zThrough SSH with encryption. For more information, see SSH Configuration.

1-2
Entering CLI Through the Console Port
When you use the CLI of an H3C switch for the first time, you can log in to the switch and enter the CLI
through the console port only. Follow these steps to log in to your H3C switchand enter the CLI through
the console port:
1) Use the console cable shipped with your switch to connect your PC to your switch. Plug the DB-9
(female) connector of the console cable into the 9-pin serial port of your PC. Then plug the RJ-45
connector of the console cable into the console port of your switch.
Figure 1-2 Use the console cable to connect your PC to your switch
Identify the interface to avoid connection errors.
Because the serial port of a PC is not hot swappable, do not plug or unplug the console cable when your
switch is powered on. When connecting the PC to your switch, first plug the DB-9 connector of the
console cable into the PC, and then plug the RJ-45 connector of the console cable into your switch.
When disconnecting the PC from your switch, first unplug the RJ-45 connector and then the DB-9
connector.
2) Launch a terminal emulation utility on your PC. In this chapter, the HyperTerminal in Windows XP
is used as an example. Click Start > All Programs > Accessories > Communications >
HyperTerminal to enter the HyperTerminal window. The Connection Description window as
shown in Figure 1-3 appears. Type a connection name (Switch, for example) in the Name input
box, and click OK.

1-3
Figure 1-3 Connection description
3) Then, the Connect To window as shown in Figure 1-4 appears. Select the serial port you want to
use from the Connect using drop-down list, and then click OK.
Figure 1-4 Specify the serial port used to establish the connection
4) The COM1 Properties window as shown in Figure 1-5 appears. On the window, set Bits per
second to 9600, Data bits to 8, Parity to None, Stop bits to 1, and Flow control to None. Click
OK.

1-4
Figure 1-5 Set the properties of the serial port
5) The HyperTerminal window as shown in Figure 1-6 appears.
Figure 1-6 The HyperTerminal window