H3C S12500 Series User manual

H3C S12500 Series Routing Switches
OAA Configuration Guide
Hangzhou H3C Technologies Co., Ltd.
http://www.h3c.com
Software version: S12500-CMW730-R7374
Document version: 6W731-20150528

Copyright © 2014-2015, Hangzhou H3C Technologies Co., Ltd. and its licensors
All rights reserved
No part of this manual may be reproduced or transmitted in any form or by any means without prior
written consent of Hangzhou H3C Technologies Co., Ltd.
Trademarks
H3C, , H3CS, H3CIE, H3CNE, Aolynk, , H3Care, , IRF, NetPilot, Netflow,
SecEngine, SecPath, SecCenter, SecBlade, Comware, ITCMM and HUASAN are trademarks of
Hangzhou H3C Technologies Co., Ltd.
All other trademarks that may be mentioned in this manual are the property of their respective owners
Notice
The information in this document is subject to change without notice. Every effort has been made in the
preparation of this document to ensure accuracy of the contents, but all statements, information, and
recommendations in this document do not constitute the warranty of any kind, express or implied.

Preface
The H3C S12500 documentation set includes 17 configuration guides. These guides describe the
software features for the H3C S12500 Series 10G Core Routing Switches and guide you through the
software configuration procedures. These guides also provide configuration examples to help you apply
software features to different network scenarios.
The OAA Configuration Guide describes the Open Application Platform (OAP) and OAP configuration.
After you configure OAP on the switch, the switch can interact with and control OAP modules.
This preface includes:
•Audience
•Conventions
•About the H3C S12500 documentation set
•Obtaining documentation
•Technical support
•Documentation feedback
Audience
This documentation is intended for:
•Network planners
•Field technical support and servicing engineers
•Network administrators working with the S12500 series
Conventions
This section describes the conventions used in this documentation set.
Command conventions
Convention Descri
p
tion
Boldface Bold text represents commands and keywords that you enter literally as shown.
Italic Italic text represents arguments that you replace with actual values.
[ ] Square brackets enclose syntax choices (keywords or arguments) that are optional.
{ x | y | ... }
Braces enclose a set of required syntax choices separated by vertical bars, from which
you select one.
[ x | y | ... ]
Square brackets enclose a set of optional syntax choices separated by vertical bars, from
which you select one or none.
{ x | y | ... } *
Asterisk marked braces enclose a set of required syntax choices separated by vertical
bars, from which you select at least one.
[ x | y | ... ] *
Asterisk marked square brackets enclose optional syntax choices separated by vertical

Convention Descri
p
tion
bars, from which you select one choice, multiple choices, or none.
&<1-n> The argument or keyword and argument combination before the ampersand (&) sign can
be entered 1 to n times.
# A line that starts with a pound (#) sign is comments.
GUI conventions
Convention Descri
p
tion
Boldface Window names, button names, field names, and menu items are in Boldface. For
example, the New User window appears; click OK.
> Multi-level menus are separated by angle brackets. For example, File > Create > Folder.
Symbols
Convention Descri
p
tion
WARNING An alert that calls attention to important information that if not understood or followed can
result in personal injury.
CAUTION An alert that calls attention to important information that if not understood or followed can
result in data loss, data corruption, or damage to hardware or software.
IMPORTANT An alert that calls attention to essential information.
NOTE An alert that contains additional or supplementary information.
TIP An alert that provides helpful information.
Network topology icons
Represents a generic network device, such as a router, switch, or firewall.
Represents a routing-capable device, such as a router or Layer 3 switch.
Represents a generic switch, such as a Layer 2 or Layer 3 switch, or a router that supports
Layer 2 forwarding and other Layer 2 features.
Represents an access controller, a unified wired-WLAN module, or the access controller
engine on a unified wired-WLAN switch.
Represents an access point.
Represents a mesh access point.
Represents omnidirectional signals.
Represents directional signals.




Represents a security product, such as a firewall, UTM, multiservice security gateway, or
load-balancing device.
Represents a security card, such as a firewall, load-balancing, NetStream, SSL VPN, IPS,
or ACG card.
Port numbering in examples
The port numbers in this document are for illustration only and might be unavailable on your device.
About the H3C S12500 documentation set
The H3C S12500 documentation set includes:
Cate
g
or
y
Documents Pur
p
oses
Product description and
specifications
Marketing brochures Describe product specifications and benefits.
Technology white papers
Provide an in-depth description of software features
and technologies.
Card datasheets Describe card specifications, features, and
standards.
Hardware specifications
and installation
Regulatory compliance
and safety information
Provides regulatory information and the safety
instructions that must be followed during installation.
Installation guide Provides a complete guide to hardware installation
and hardware specifications.
Quick start
Guides you through initial installation and setup
procedures to help you quickly set up and use your
switch with the minimum configuration.
H3C Pluggable SFP
[SFP+][XFP] Transceiver
Modules Installation
Guide
Guides you through installing SFP/SFP+/XFP
transceiver modules.
H3C QSFP+ Transceiver
Modules[Cables]
Installation Guide
Guides you through installing QSFP+ transceiver
modules.
H3C CFP Transceiver
Modules Installation
Guide
Guides you through installing CFP transceiver
modules.
Adjustable Slider Rail
Installation Guide
Guides you through installing adjustable slider rails
to a rack.
H3C High-End Network
Products Hot-Swappable
Module Manual
Describes the hot-swappable modules available for
the H3C high-end network products, their external
views, and specifications.
Software configuration
Configuration guides Describe software features and configuration
procedures.
Command references Provide a quick reference to all available
commands.
Operations and System log messages Explains the system log messages.


Cate
g
or
y
Documents Pur
p
oses
maintenance Trap messages Explains the trap messages.
MIB Companion Describes the MIBs for the software release.
Release notes
Provide information about the product release,
including the version history, hardware and software
compatibility matrix, version upgrade information,
technical support information, and software
upgrading.
Obtaining documentation
Access the most up-to-date H3C product documentation on the World Wide Web
at http://www.h3c.com.
Click the links on the top navigation bar to obtain different categories of product documentation:
[Technical Support & Documents > Technical Documents]—Provides hardware installation, software
upgrading, and software feature configuration and maintenance documentation.
[Products & Solutions]—Provides information about products and technologies, as well as solutions.
[Technical Support & Documents > Software Download]—Provides the documentation released with the
software version.
Technical support
servic[email protected]
http://www.h3c.com
Documentation feedback
You can e-mail your comments about product documentation to [email protected].
We appreciate your comments.

i
Contents
Configuring the OAP module······································································································································ 1
Internal interfaces for OAP modules ·······························································································································1
Logging in to an OAP module·········································································································································2
Logging in through the console port on the OAP module····················································································2
Logging in through the management Ethernet port on the OAP module by using Telnet·································3
Logging in through the management Ethernet port on the OAP module by using SSH ···································3
Redirecting to the OAP module from the device···································································································4
Resetting OAP modules ····················································································································································4
Configuring OAP ························································································································································· 6
Overview············································································································································································6
OAP functions ···························································································································································6
OAP manager timers ···············································································································································6
Configuring OAP ······························································································································································7
Enabling OAP···························································································································································7
Setting the clock synchronization timer··················································································································7
Setting the client monitoring timer ··························································································································7
Managing OAP clients ·····················································································································································7
Restarting an OAP client··········································································································································7
Shutting down an OAP client··································································································································8
Displaying and maintaining OAP ···································································································································8
Index ············································································································································································· 9

1
Configuring the OAP module
H3C Open Application Architecture provides an open interface for third-party vendors to develop and
integrate value-added applications into H3C products. These applications can apply to one of the
following forms:
•A standalone network device.
•A card that can be installed in a network device (Open Application Platform module, or OAP
module).
OAP modules have their own operating systems. You can log in to the operating system of an OAP
module to install features. For example, you can install security features and voice features on the OAP
module operating system to provide security and voice services for users.
OAP modules exchange data, status information, and control information with hosting devices through
internal interfaces.
Table 1 shows the OAP modules provided by H3C.
Table 1 H3C OAP modules
OAP module Module t
yp
e Number of internal interfaces
LST1FW2A1
Firewall card
1
LST1FW3A1 2
LST1FW3C1 4
LST1IPS1A1 1000M intrusion prevention card 1
LST1IPS2A1 2
LST1NSM1A1 NetStream card 1
LST1NSM2C1 4
LST1LB1A1 Load balancing card 1
LST1ADE1A1 2
LST1ACG1A1 Application control gateway card 1
CR-IM-MAC1A Master AC card 2
Internal interfaces for OAP modules
An OAP module integrates a front card and a rear card. The front card provides value-added security
services, such as firewall, intrusion prevention, and application control. The rear card is responsible for
data exchange between the front card and the switch. The rear card communicates with the front card
through the internal interface. Table 1 shows the number of internal interfaces on each model of OAP
module.

2
Figure 1 Diagram for the internal interface
When using internal interfaces, follow these guidelines and restrictions:
•For successful traffic forwarding, the two internal interfaces on an LST1IPS2A1 module must be up
at the same time.
•You can add the two internal interfaces on an LST1IPS2A1 module to an aggregation group to
implement dynamic backup. To do so, set the minimum number of Selected ports to 2 for the
aggregation group. To set the argument, use the link-aggregation selected-port minimum
command. For more information about this command, see Layer 2—LAN Switching Command
Reference.
•If you add the internal interfaces on an LST1FW3A1 or LST1FW3C1 module to an aggregation
group, the aggregation group does not support OAP. For more information, see "Configuring
OAP."
•Only the internal interfaces on LST1NSM1A1 and LST1NSM2C1 modules support the port
connection-mode command. For more information about this command, see Interface Command
Reference.
Logging in to an OAP module
This section describes only OAP-related operations on the switch that is holding the OAP module. For
information about operations on the OAP module, see the OAP module manual.
Logging in through the console port on the OAP module
1. Connect one end of the console cable to the serial port of the configuration terminal (for example,
a PC).
2. Connect the other end of the console cable to the console port of the OAP module.
3. Start the PC and run a terminal emulation program, such as HyperTerminal.
4. Select the COM connection mode and set the terminal parameters as follows:
{Bits per second—9600.
{Data bits—8.
{Parity check mode—None.

3
{Stop bits—1.
{Flow control—None.
5. Follow the OAP module user guide to log in to the operating system of the OAP module through the
terminal emulation program.
Logging in through the management Ethernet port on the OAP
module by using Telnet
You can Telnet to the OAP module through its management Ethernet port by using either of the following
methods:
•Telnetting to the OAP module from the switch:
a. Connect the management Ethernet port of the OAP module to an Ethernet interface on the
switch by using a network cable.
b. Log in to the OAP module through the console port and enable the Telnet server function on the
OAP module.
c. Assign an IP address to the management Ethernet port of the OAP module. Make sure the
management Ethernet port and the switch can reach each other.
d. From the switch, Telnet to the IP address of the OAP module's management Ethernet port.
After the Telnet connection is successfully established, you are logged in to the operating system of
the OAP module.
•Telnetting to the OAP module from a PC:
e. Connect the Ethernet interface of a PC to the management Ethernet port of the OAP module by
using a network cable.
f. Log in to the OAP module through the console port and enable the Telnet server function on the
OAP module.
g. Assign an IP address to the management Ethernet port of the OAP module. Make sure the
management Ethernet port and the PC can reach each other.
h. From the PC, Telnet to the IP address of the OAP module's management Ethernet port.
After the Telnet connection is successfully established, you are logged in to the operating system of
the OAP module.
Logging in through the management Ethernet port on the OAP
module by using SSH
You can log in to the OAP module through its management Ethernet port by using SSH.
Use either of the following methods:
•Using SSH to log in to the OAP module from the switch:
a. Connect the management Ethernet port of the OAP module to an Ethernet interface on the
switch by using a network cable.
b. Log in to the OAP module through the console port and enable the SSH server function on the
OAP module.
c. Assign an IP address to the management Ethernet port of the OAP module. Make sure the
management Ethernet port and the switch can reach each other.

4
d. From the switch, establish an SSH connection to the IP address of the OAP module's
management Ethernet port.
After the SSH connection is successfully established, you are logged in to the operating system of
the OAP module.
•Using SSH to log in to the OAP module from a PC:
e. Connect the Ethernet interface of a PC to the management Ethernet port of the OAP module by
using a network cable.
f. Log in to the OAP module through the console port and enable the SSH server function on the
OAP module.
g. Assign an IP address to the management Ethernet port of the OAP module. Make sure the
management Ethernet port and the PC can reach each other.
h. From the PC, establish an SSH connection to the IP address of the OAP module's management
Ethernet port.
After the SSH connection is successfully established, you are logged in to the operating system of
the OAP module.
Redirecting to the OAP module from the device
From the CLI of the device, you can redirect to the CLI of the OAP module.
Before using this login method, you must log in to the OAP module through the console port and
configure AUX login on the OAP module.
Perform the following task in user view:
Task Command
Redirect to the CLI of the OAP module from the
device.
•In standalone mode:
oap connect slot slot-number
•In IRF mode:
oap connect chassis chassis-number slot slot-number
To return to the CLI of the device, press Ctrl+K.
Resetting OAP modules
CAUTION:
Resetting an OAP module might cause a service outage.
IMPORTANT:
To avoid service data loss, close the operating system of an OAP module before resetting the module.
You can reset an OAP module to restore it to normal operation in the following situations:
•The OAP module fails.
•The OAP module is not operating correctly. For example, the OAP module does not respond to your
operation.

5
Pressing the reset button of the OAP module has the same effect. The device can still identify and control
the OAP module after the module starts up again.
Perform the following task in user view:
Task Command
Reset the OAP module.
•In standalone mode:
oap reboot slot slot-number
•In IRF mode:
oap reboot chassis chassis-number slot slot-number

6
Configuring OAP
Overview
Open Application Platform (OAP) is an open application protocol for supporting emerging services. It
provides a method for information exchange and collaboration between the ACFP server and ACFP
client.
ACFP is an application control forwarding protocol based on the OAA architecture that uses the
client/server model. Examples of ACFP clients include IPS/IDS cards inserted in routers or switches and
standalone IPS/IDS devices. These IPS/IDS cards and devices provide intrusion protection/detection
services for the ACFP server.
As a support protocol of ACFP, OAP defines the following entities:
•OAP manager—Integrated in the device software (Comware) as a function.
•OAP client—Integrated in the device software (Comware) as a function, or integrated in the
operating system of the OAP module as a function.
On the operating system of an OAP module, you can install applications such as security and voice
applications to provide various services.
The device does not support ACFP.
OAP functions
OAP provides the following functions:
•OAP clients register with and deregister from the OAP manager.
•The OAP manager assigns IDs to OAP clients to uniquely identify the clients.
•The OAP manager and an OAP client exchange information to, for example, monitor each other
and synchronize the clock.
From the OAP manager, you can perform the following tasks:
•Restart OAP clients.
•Shut down OAP clients.
•Display OAP client information.
An OAP manager can manage up to 255 OAP clients.
OAP manager timers
The OAP manager uses the following timers:
•Clock synchronization timer—Regularly triggers the OAP manager to send clock and time zone
synchronization notifications to OAP clients. This mechanism keeps the clients' clocks synchronized
with the manager's clock.
•Client monitoring timer—Regularly triggers the OAP manager to send client monitoring packets to
OAP clients.

7
Configuring OAP
Enabling OAP
Ste
p
Command Remarks
1. Enter system view. system-view N/A
2. Enter interface view. interface interface-type
interface-number N/A
3. Enable OAP. oap enable By default, OAP is disabled on an
interface.
Setting the clock synchronization timer
Ste
p
Command Remarks
1. Enter system view. system-view N/A
2. Set the clock synchronization
timer. oap timer clock-sync minutes
By default, the clock
synchronization timer is set to 5
minutes.
Setting the client monitoring timer
Ste
p
Command Remarks
1. Enter system view. system-view N/A
2. Set the client monitoring timer. oap timer monitor seconds By default, the client monitoring
timer is set to 5 seconds.
Managing OAP clients
You can restart or shut down an OAP client.
Restarting an OAP client
Ste
p
Command
1. Enter system view. system-view
2. Restart an OAP client. oap client reboot client-id

8
Shutting down an OAP client
This feature applies only to OAP clients on Linux.
To shut down an OAP client:
Ste
p
Command
1. Enter system view. system-view
2. Shut down an OAP client. oap client close client-id
Displaying and maintaining OAP
Execute display commands in any view.
Task Command
Display the summary registration information
of OAP clients. display oap client summary [ client-id ]
Display OAP client information. display oap client info [ client-id ]

9
Index
A
ACFP
OAP, 6
OAP function configuration, 6
OAP manager configuration, 7
application control forwarding protocol. See ACFP
C
CLI
OAP module CLI login, 4
client
OAP client management, 7
OAP client monitoring timer, 6, 7
OAP client restart, 7
OAP client shutdown, 8
clock
OAP clock synchronization timer, 6, 7
configuring
OAP, 1, 7
OAP functions, 6
console
OAP module console login, 2
D
device
OAP configuration, 1
OAP function configuration, 6
OAP manager configuration, 7
OAP module CLI login, 4
OAP module console login, 2
OAP module internal interface, 1
OAP module login, 2
OAP module management Ethernet port
login, 3, 3
OAP module reset, 4
displaying OAP, 8
E
enabling
OAP, 7
Ethernet
OAP module CLI login, 4
OAP module management Ethernet port login, 3, 3
F
function
OAP client, 6
OAP manager, 6
I
internal interface
OAP module, 1
L
logging in
OAP module, 2
OAP module CLI login, 4
OAP module console login, 2
OAP module management Ethernet port login, 3, 3
M
managing
OAP client, 7
module
OAP configuration, 1
OAP module CLI login, 4
OAP module console login, 2
OAP module login, 2
OAP module management Ethernet port login, 3, 3
OAP reset, 4
N
network
enabling OAP, 7
OAP client management, 7
OAP client monitoring timer, 7
OAP client restart, 7
OAP client shutdown, 8
OAP clock synchronization timer, 7
OAP manager configuration, 7
OAP module CLI login, 4
OAP module console login, 2
OAP module login, 2

10
OAP module management Ethernet port
login, 3, 3
OAP module reset, 4
network management
OAP configuration, 1
OAP function configuration, 6
OAP module internal interface, 1
O
OAA
OAP configuration, 1
OAP function configuration, 6
OAP manager configuration, 7
OAP module CLI login, 4
OAP module console login, 2
OAP module internal interface, 1
OAP module login, 2
OAP module management Ethernet port
login, 3, 3
OAP module reset, 4
OAP
ACFP, 6
client, 6
client functions, 6
client management, 7
client monitoring timer, 6, 7
client restart, 7
client shutdown, 8
clock synchronization timer, 6, 7
configuration, 1
displaying OAP, 8
enable, 7
function configuration, 6
internal interface, 1
manager, 6, 6
manager configuration, 7
module CLI login, 4
module console login, 2
module login, 2
module management Ethernet port login, 3, 3
module reset, 4
Open Application
Architecture. See OAA
Platform. See OAP
P
port
OAP module CLI login, 4
OAP module management Ethernet port login, 3, 3
procedure
displaying OAP, 8
enabling OAP, 7
logging in to OAP module (CLI login), 4
logging in to OAP module (console login), 2
logging in to OAP module (management Ethernet
port login), 3, 3
managing OAP client, 7
resetting OAP module, 4
restarting OAP client, 7
setting OAP client monitoring timer, 7
setting OAP clock synchronization timer, 7
shutting down OAP client, 8
R
resetting
OAP module, 4
restarting
OAP client, 7
S
setting
OAP client monitoring timer, 7
OAP clock synchronization timer, 7
shutting down
OAP client, 8
SSH
OAP module management Ethernet port login, 3
T
Telnet
OAP module management Ethernet port login, 3
timer
OAP client monitoring, 6, 7
OAP clock synchronization, 6, 7