HP FlexNetwork MSR2003 User manual

HPE FlexNetwork MSR Router Series
Comware 7 Layer 3—IP Services Configuration Guide
Part number: 5998-8832
Software version: CMW710-R0305
Document version: 6PW106-20160308

i
© Copyright 2016 Hewlett Packard Enterprise Development LP
The information contained herein is subject to change without notice. The only warranties for Hewlett Packard
Enterprise products and services are set forth in the express warranty statements accompanying such
products and services. Nothing herein should be construed as constituting an additional warranty. Hewlett
Packard Enterprise shall not be liable for technical or editorial errors or omissions contained herein.
Confidential computer software. Valid license from Hewlett Packard Enterprise required for possession, use, or
copying. Consistent with FAR 12.211 and 12.212, Commercial Computer Software, Computer Software
Documentation, and Technical Data for Commercial Items are licensed to the U.S. Government under vendor’s
standard commercial license.
Links to third-party websites take you outside the Hewlett Packard Enterprise website. Hewlett Packard
Enterprise has no control over and is not responsible for information outside the Hewlett Packard Enterprise
website.
Acknowledgments
Intel®, Itanium®, Pentium®, Intel Inside®, and the Intel Inside logo are trademarks of Intel Corporation in the
United States and other countries.
Microsoft® and Windows® are trademarks of the Microsoft group of companies.
Adobe® andAcrobat® are trademarks ofAdobe Systems Incorporated.
Java and Oracle are registered trademarks of Oracle and/or its affiliates.
UNIX® is a registered trademark of The Open Group.

i
Contents
Configuring ARP·····························································································1
Overview····························································································································································1
ARP message format·································································································································1
ARP operating mechanism ························································································································1
ARP table···················································································································································2
Configuring a static ARP entry···························································································································3
Setting the maximum number of dynamic ARP entries for a device··································································4
Setting the maximum number of dynamic ARP entries for an interface ····························································4
Setting the aging timer for dynamic ARP entries ·······························································································5
Enabling dynamic ARP entry check···················································································································5
Enabling ARP logging········································································································································5
Displaying and maintaining ARP························································································································6
Configuration examples ·····································································································································7
Long static ARP entry configuration example····························································································7
Short static ARP entry configuration example····························································································8
Configuring gratuitous ARP ············································································9
Overview····························································································································································9
Gratuitous ARP packet learning·················································································································9
Periodic sending of gratuitous ARP packets······························································································9
Configuration procedure ··································································································································10
Enabling IP conflict notification ························································································································10
Configuring proxy ARP ·················································································12
Enabling common proxy ARP··························································································································12
Enabling local proxy ARP ································································································································12
Displaying proxy ARP ······································································································································13
Common proxy ARP configuration example····································································································13
Network requirements······························································································································13
Configuration procedure···························································································································13
Verifying the configuration························································································································14
Configuring ARP fast-reply ···········································································15
Overview··························································································································································15
Configuration procedure ··································································································································15
ARP fast-reply configuration example··············································································································15
Network requirements······························································································································15
Configuration procedure···························································································································16
Configuring ARP PnP ···················································································17
Overview··························································································································································17
Configuration prerequisites······························································································································17
Configuration procedure ··································································································································17
Displaying and maintaining ARP PnP··············································································································18
ARP PnP configuration example······················································································································18
Network requirements······························································································································18
Configuration procedure···························································································································18
Verifying the configuration························································································································19
Configuring ARP suppression·······································································20
Overview··························································································································································20
Configuration procedure ··································································································································20
Displaying and maintaining ARP suppression ·································································································21
ARP suppression configuration example·········································································································21
Network requirements······························································································································21
Configuration procedure···························································································································22
Verifying the configuration························································································································22

ii
Configuring ARP direct route advertisement·················································23
Overview··························································································································································23
Configuration procedure ··································································································································23
Configuring IP addressing·············································································24
Overview··························································································································································24
IP address classes···································································································································24
Special IP addresses ·······························································································································25
Subnetting and masking···························································································································25
Assigning an IP address to an interface ··········································································································25
Configuration guidelines···························································································································26
Configuration procedure···························································································································26
Configuring IP unnumbered·····························································································································26
Configuration guidelines···························································································································26
Configuration prerequisites······················································································································27
Configuration procedure···························································································································27
Displaying and maintaining IP addressing·······································································································27
Configuration examples ···································································································································27
IP address configuration example············································································································27
IP unnumbered configuration example ····································································································29
DHCP overview·····························································································31
DHCP address allocation·································································································································31
Allocation mechanisms ····························································································································31
IP address allocation process··················································································································32
IP address lease extension······················································································································32
DHCP message format····································································································································33
DHCP options ··················································································································································34
Common DHCP options···························································································································34
Custom DHCP options·····························································································································34
Protocols and standards ··································································································································36
Configuring the DHCP server ·······································································37
Overview··························································································································································37
DHCP address pool ·································································································································37
IP address allocation sequence···············································································································39
DHCP server configuration task list ·················································································································39
Configuring an address pool on the DHCP server···························································································40
Configuration task list·······························································································································40
Creating a DHCP address pool················································································································40
Specifying IP address ranges for a DHCP address pool ·········································································40
Specifying gateways for DHCP clients·····································································································43
Specifying a domain name suffix for DHCP clients··················································································44
Specifying DNS servers for DHCP clients································································································44
Specifying WINS servers and NetBIOS node type for DHCP clients·······················································44
Specifying BIMS server for DHCP clients································································································45
Specifying the configuration file for DHCP client auto-configuration························································45
Specifying a server for DHCP clients·······································································································46
Configuring Option 184 parameters for DHCP clients ·············································································46
Customizing DHCP options······················································································································47
Configuring the DHCP user class whitelist·······························································································48
Enabling DHCP················································································································································49
Enabling the DHCP server on an interface······································································································49
Applying an address pool on an interface········································································································49
Configuring IP address conflict detection·········································································································50
Enabling handling of Option 82························································································································50
Configuring DHCP server compatibility············································································································51
Configuring the DHCP server to broadcast all responses········································································51
Configure the DHCP server to ignore BOOTP requests··········································································51
Configuring the DHCP server to send BOOTP responses in RFC 1048 format······································52
Setting the DSCP value for DHCP packets sent by the DHCP server·····························································52

iii
Configuring DHCP binding auto backup ··········································································································52
Configuring address pool usage alarming ·······································································································53
Binding gateways to a common MAC address································································································53
Advertising subnets assigned to clients···········································································································54
Applying a DHCP address pool to a VPN instance··························································································55
Enabling client offline detection on the DHCP server ······················································································55
Configuring DHCP logging on the DHCP server······························································································56
Displaying and maintaining the DHCP server··································································································56
DHCP server configuration examples··············································································································57
Static IP address assignment configuration example ··············································································57
Dynamic IP address assignment configuration example ·········································································58
DHCP user class configuration example··································································································60
DHCP user class whitelist configuration example····················································································61
Primary and secondary subnets configuration example ··········································································62
DHCP option customization configuration example·················································································63
Troubleshooting DHCP server configuration ···································································································65
Symptom··················································································································································65
Analysis····················································································································································65
Solution····················································································································································65
Configuring the DHCP relay agent································································66
Overview··························································································································································66
Operation ·················································································································································66
DHCP relay agent support for Option 82 ·································································································67
DHCP relay agent configuration task list ·········································································································67
Enabling DHCP················································································································································68
Enabling the DHCP relay agent on an interface ······························································································68
Specifying DHCP servers on a relay agent······································································································68
Configuring the DHCP relay agent security functions······················································································69
Enabling the DHCP relay agent to record relay entries ···········································································69
Enabling periodic refresh of dynamic relay entries ··················································································69
Enabling DHCP starvation attack protection····························································································70
Configuring the DHCP relay agent to release an IP address···········································································71
Configuring Option 82······································································································································71
Setting the DSCP value for DHCP packets sent by the DHCP relay agent·····················································72
Enabling DHCP server proxy on a DHCP relay agent·····················································································72
Configuring a DHCP relay address pool··········································································································73
Specifying a gateway address for DHCP clients······························································································74
Enabling client offline detection on the DHCP relay agent ··············································································74
Specifying the source address and gateway address in DHCP requests························································74
Displaying and maintaining the DHCP relay agent··························································································75
DHCP relay agent configuration examples······································································································75
DHCP relay agent configuration example································································································75
Option 82 configuration example ·············································································································76
Troubleshooting DHCP relay agent configuration····························································································77
Symptom··················································································································································77
Analysis····················································································································································77
Solution····················································································································································77
Configuring the DHCP client·········································································78
Enabling the DHCP client on an interface········································································································78
Configuring a DHCP client ID for an interface ·································································································78
Enabling duplicated address detection ············································································································79
Setting the DSCP value for DHCP packets sent by the DHCP client ······························································79
Displaying and maintaining the DHCP client ···································································································79
DHCP client configuration example ·················································································································80
Network requirements······························································································································80
Configuration procedure···························································································································80
Verifying the configuration························································································································81
Configuring DHCP snooping·········································································83
Overview··························································································································································83

iv
Application of trusted and untrusted ports································································································84
DHCP snooping support for Option 82·····································································································85
Command and hardware compatibility·············································································································85
DHCP snooping configuration task list·············································································································85
Configuring basic DHCP snooping ··················································································································86
Configuring Option 82······································································································································86
Configuring DHCP snooping entry auto backup ······························································································87
Enabling DHCP starvation attack protection····································································································88
Enabling DHCP-REQUEST attack protection··································································································89
Setting the maximum number of DHCP snooping entries ···············································································89
Displaying and maintaining DHCP snooping ···································································································90
DHCP snooping configuration examples ·········································································································90
Basic DHCP snooping configuration example ·························································································90
Option 82 configuration example ·············································································································91
Configuring the BOOTP client·······································································93
BOOTP application ··········································································································································93
Obtaining an IP address dynamically···············································································································93
Protocols and standards ··································································································································93
Configuring an interface to use BOOTP for IP address acquisition·································································93
Displaying and maintaining BOOTP client·······································································································94
BOOTP client configuration example···············································································································94
Network requirements······························································································································94
Configuration procedure···························································································································94
Verifying the configuration························································································································94
Configuring DNS···························································································95
Overview··························································································································································95
Static domain name resolution·················································································································95
Dynamic domain name resolution············································································································95
DNS proxy················································································································································96
DNS spoofing···········································································································································97
DNS configuration task list·······························································································································98
Configuring the IPv4 DNS client ······················································································································98
Configuring static domain name resolution······························································································98
Configuring dynamic domain name resolution·························································································99
Configuring the IPv6 DNS client ······················································································································99
Configuring static domain name resolution······························································································99
Configuring dynamic domain name resolution·······················································································100
Configuring the DNS proxy ····························································································································101
Configuring DNS spoofing ·····························································································································101
Configuring network mode tracking for an output interface ···········································································102
Specifying the source interface for DNS packets···························································································102
Configuring the DNS trusted interface ···········································································································103
Setting the DSCP value for outgoing DNS packets ·······················································································103
Displaying and maintaining IPv4 DNS ···········································································································103
IPv4 DNS configuration examples ·················································································································104
Static domain name resolution configuration example···········································································104
Dynamic domain name resolution configuration example······································································105
DNS proxy configuration example··········································································································107
IPv6 DNS configuration examples ·················································································································108
Static domain name resolution configuration example···········································································108
Dynamic domain name resolution configuration example······································································109
DNS proxy configuration example··········································································································114
Troubleshooting IPv4 DNS configuration·······································································································115
Symptom················································································································································115
Solution··················································································································································115
Troubleshooting IPv6 DNS configuration·······································································································115
Symptom················································································································································115
Solution··················································································································································115

v
Configuring DDNS ······················································································116
Overview························································································································································116
DDNS application···································································································································116
DDNS client configuration task list·················································································································117
Configuring a DDNS policy ····························································································································117
Configuration prerequisites····················································································································118
Configuration procedure·························································································································118
Applying the DDNS policy to an interface······································································································119
Setting the DSCP value for outgoing DDNS packets·····················································································119
Displaying DDNS ···········································································································································120
DDNS configuration examples·······················································································································120
DDNS configuration example with www.3322.org ·················································································120
DDNS configuration example with PeanutHull server············································································121
Configuring NAT ·························································································123
Overview························································································································································123
Terminology ···········································································································································123
NAT types ··············································································································································123
NAT control············································································································································124
Command and hardware compatibility···········································································································124
NAT implementations·····································································································································124
Static NAT··············································································································································124
Dynamic NAT·········································································································································124
NAT Server ············································································································································125
DS-Lite NAT444·····································································································································126
NAT entries····················································································································································126
NAT session entry··································································································································126
EIM entry················································································································································127
NO-PAT entry·········································································································································127
Using NAT with other features·······················································································································127
VRF-aware NAT·····································································································································127
NAT with DNS mapping·························································································································128
NAT with ALG ········································································································································128
NAT configuration task list ·····························································································································129
Configuring static NAT···································································································································129
Configuration prerequisites····················································································································129
Configuring outbound one-to-one static NAT·························································································129
Configuring outbound net-to-net static NAT···························································································130
Configuring inbound one-to-one static NAT···························································································130
Configuring inbound net-to-net static NAT·····························································································131
Configuring dynamic NAT······························································································································131
Configuration restrictions and guidelines·······························································································132
Configuration prerequisites····················································································································132
Configuring outbound dynamic NAT······································································································132
Configuring inbound dynamic NAT ········································································································133
Configuring NAT Server·································································································································134
Configuring common NAT Server··········································································································134
Configuring load sharing NAT Server ····································································································135
Configuring ACL-based NAT Server······································································································136
Configuring DS-Lite NAT444 ·························································································································136
Configuring NAT with DNS mapping··············································································································137
Configuring NAT hairpin·································································································································137
Configuring NAT with ALG·····························································································································138
Configuring NAT session logging···················································································································138
Displaying and maintaining NAT····················································································································138
NAT configuration examples··························································································································140
Outbound one-to-one static NAT configuration example·······································································140
Outbound dynamic NAT configuration example (non-overlapping addresses)······································141
Outbound bidirectional NAT configuration example···············································································144
NAT Server for external-to-internal access configuration example························································147
NAT Server for external-to-internal access through domain name configuration example····················150

vi
Bidirectional NAT for external-to-internal NAT Server access through domain name configuration example
·······························································································································································153
NAT hairpin in C/S mode configuration example···················································································156
NAT hairpin in P2P mode configuration example ··················································································159
Twice NAT configuration example ·········································································································162
Load sharing NAT Server configuration example ··················································································165
NAT with DNS mapping configuration example·····················································································167
DS-Lite NAT444 configuration example·································································································170
Basic IP forwarding on the device·······························································173
FIB table·························································································································································173
Displaying FIB table entries ···························································································································174
Configuring load sharing·············································································175
Command and hardware compatibility···········································································································175
Configuring per-packet or per-flow load sharing····························································································175
Configuring load sharing based on bandwidth·······························································································176
Configuring fast forwarding·········································································177
Overview························································································································································177
Command and hardware compatibility···········································································································177
Configuring the aging time for fast forwarding entries ···················································································177
Configuring fast forwarding load sharing ·······································································································177
Displaying and maintaining fast forwarding ···································································································178
Configuring flow classification·····································································179
Feature and hardware compatibility···············································································································179
Specifying a flow classification policy ············································································································179
Displaying the adjacency table ···································································180
Overview························································································································································180
Command and hardware compatibility···········································································································181
Displaying commands····································································································································181
Configuring IRDP························································································182
Overview························································································································································182
IRDP operation·······································································································································182
Basic concepts·······································································································································182
Protocols and standards ························································································································183
Configuration procedure ································································································································183
IRDP configuration example ··························································································································184
Network requirements····························································································································184
Configuration procedure·························································································································184
Verifying the configuration······················································································································185
Optimizing IP performance ·········································································186
Command and hardware compatibility···········································································································186
Enabling an interface to receive and forward directed broadcasts destined for the directly connected network
·······································································································································································186
Configuration procedure·························································································································186
Configuration example···························································································································187
Configuring MTU for an interface···················································································································188
Configuring TCP MSS for an interface···········································································································188
Configuring TCP path MTU discovery ···········································································································188
Enabling TCP SYN Cookie ····························································································································189
Configuring the TCP buffer size·····················································································································190
Configuring TCP timers··································································································································190
Enabling sending ICMP error messages ·······································································································190
Configuring rate limit for ICMP error messages·····························································································192
Specifying the source address for ICMP packets ··························································································192
Enabling IPv4 local fragment reassembly······································································································193
Displaying and maintaining IP performance optimization ··············································································193

vii
Configuring UDP helper··············································································196
Overview························································································································································196
Feature and hardware compatibility···············································································································196
Configuration restrictions and guidelines·······································································································196
Configuring UDP helper to convert broadcast to unicast···············································································196
Configuring UDP helper to convert broadcast to multicast ············································································197
Configuring UDP helper to convert multicast to broadcast or unicast····························································198
Displaying and maintaining UDP helper ········································································································199
UDP helper configuration examples ··············································································································199
Configuring UDP helper to convert broadcast to unicast·······································································199
Configuring UDP helper to convert broadcast to multicast ····································································200
Configuring UDP helper to convert multicast to broadcast ····································································201
Configuring basic IPv6 settings···································································202
Overview························································································································································202
IPv6 features··········································································································································202
IPv6 addresses ······································································································································203
IPv6 ND protocol····································································································································205
IPv6 path MTU discovery·······················································································································207
IPv6 transition technologies···························································································································208
Dual stack ··············································································································································208
Tunneling ···············································································································································208
NAT-PT··················································································································································209
6PE ························································································································································209
Protocols and standards ································································································································209
Compatibility information································································································································210
Command and hardware compatibility···································································································210
IPv6 basics configuration task list··················································································································210
Assigning IPv6 addresses to interfaces·········································································································211
Configuring an IPv6 global unicast address···························································································211
Configuring an IPv6 link-local address···································································································213
Configuring an IPv6 anycast address ····································································································214
Configuring IPv6 ND ······································································································································214
Configuring a static neighbor entry ········································································································214
Setting the maximum number of dynamic neighbor entries···································································215
Setting the aging timer for ND entries in stale state···············································································215
Minimizing link-local ND entries·············································································································216
Setting the hop limit································································································································216
Configuring parameters for RA messages·····························································································216
Configuring the maximum number of attempts to send an NS message for DAD·································218
Enabling ND proxy·································································································································219
Configuring IPv6 ND suppression··········································································································220
Configuring IPv6 ND direct route advertisement····················································································221
Configuring path MTU discovery····················································································································222
Configuring the interface MTU···············································································································222
Configuring a static path MTU for an IPv6 address ···············································································223
Configuring the aging time for dynamic path MTUs···············································································223
Controlling sending ICMPv6 messages·········································································································223
Configuring the rate limit for ICMPv6 error messages···········································································223
Enabling replying to multicast echo requests·························································································224
Enabling sending ICMPv6 destination unreachable messages·····························································224
Enabling sending ICMPv6 time exceeded messages············································································225
Enabling sending ICMPv6 redirect messages ·······················································································225
Specifying the source address for ICMPv6 packets···············································································225
Enabling IPv6 local fragment reassembly······································································································226
Configuring IPv6 load sharing based on bandwidth·······················································································226
Displaying and maintaining IPv6 basics·········································································································227
IPv6 configuration examples··························································································································230
Basic IPv6 configuration example··········································································································230
IPv6 ND suppression configuration example·························································································234
Troubleshooting IPv6 basics configuration ····································································································235

viii
Symptom················································································································································235
Solution··················································································································································235
DHCPv6 overview·······················································································236
Feature and hardware compatibility···············································································································236
DHCPv6 address/prefix assignment··············································································································236
Rapid assignment involving two messages ···························································································236
Assignment involving four messages·····································································································236
Address/prefix lease renewal·························································································································237
Stateless DHCPv6 ·········································································································································238
Protocols and standards ································································································································238
Configuring the DHCPv6 server··································································240
Overview························································································································································240
IPv6 address assignment·······················································································································240
IPv6 prefix assignment···························································································································240
Concepts················································································································································241
DHCPv6 address pool····························································································································241
IPv6 address/prefix allocation sequence································································································242
Configuration task list·····································································································································243
Configuring IPv6 prefix assignment ···············································································································243
Configuration guidelines·························································································································243
Configuration procedure·························································································································244
Configuring IPv6 address assignment ···········································································································244
Configuration guidelines·························································································································245
Configuration procedure·························································································································245
Configuring network parameters assignment ································································································246
Configuring network parameters in a DHCPv6 address pool·································································246
Configuring network parameters in a DHCPv6 option group·································································247
Configuring the DHCPv6 server on an interface····························································································247
Configuration guidelines·························································································································247
Configuration procedure·························································································································248
Setting the DSCP value for DHCPv6 packets sent by the DHCPv6 server···················································248
Configuring DHCPv6 binding auto backup ····································································································248
Advertising subnets assigned to clients·········································································································249
Applying a DHCPv6 address pool to a VPN instance····················································································250
Configuring DHCPv6 logging on the DHCPv6 server····················································································250
Displaying and maintaining the DHCPv6 server····························································································251
DHCPv6 server configuration examples········································································································252
Dynamic IPv6 prefix assignment configuration example········································································252
Dynamic IPv6 address assignment configuration example····································································254
Configuring the DHCPv6 relay agent··························································257
Overview························································································································································257
DHCPv6 relay agent configuration task list····································································································258
Enabling the DHCPv6 relay agent on an interface ························································································258
Specifying DHCPv6 servers on the relay agent·····························································································258
Setting the DSCP value for DHCPv6 packets sent by the DHCPv6 relay agent ···········································259
Specifying a padding mode for the Interface-ID option··················································································259
Configuring a DHCPv6 relay address pool ····································································································260
Specifying a gateway address for DHCPv6 clients························································································260
Displaying and maintaining the DHCPv6 relay agent ····················································································261
DHCPv6 relay agent configuration example··································································································261
Network requirements····························································································································261
Configuration procedure·························································································································262
Verifying the configuration······················································································································262
Configuring the DHCPv6 client···································································264
Overview························································································································································264
Configuration restrictions and guidelines·······································································································264
DHCPv6 client configuration task list·············································································································264
Configuring IPv6 address acquisition·············································································································264

ix
Configuring IPv6 prefix acquisition·················································································································265
Configuring IPv6 address and prefix acquisition····························································································265
Configuring stateless DHCPv6 ······················································································································265
Setting the DSCP value for DHCPv6 packets sent by the DHCPv6 client·····················································265
Displaying and maintaining DHCPv6 client····································································································266
DHCPv6 client configuration examples··········································································································266
IPv6 address acquisition configuration example····················································································266
IPv6 prefix acquisition configuration example························································································268
IPv6 address and prefix acquisition configuration example···································································269
Stateless DHCPv6 configuration example·····························································································271
Configuring DHCPv6 snooping···································································274
Overview························································································································································274
Application of trusted and untrusted ports······························································································274
Command and hardware compatibility···········································································································275
Implementation of Option 18 and Option 37 ··································································································275
Option 18 for DHCPv6 snooping············································································································275
DHCPv6 snooping support for Option 37·······························································································276
DHCPv6 snooping configuration task list·······································································································276
Configuring basic DHCPv6 snooping·············································································································277
Configuring Option 18 and Option 37 ············································································································277
Configuring DHCPv6 snooping entry auto backup ························································································278
Setting the maximum number of DHCPv6 snooping entries··········································································279
Enabling DHCPv6-REQUEST check·············································································································279
Displaying and maintaining DHCPv6 snooping ·····························································································280
DHCPv6 snooping configuration example ·····································································································280
Network requirements····························································································································280
Configuration procedure·························································································································281
Verifying the configuration······················································································································281
Configuring IPv6 fast forwarding·································································282
Overview························································································································································282
Compatibility information································································································································282
Command and hardware compatibility···································································································282
Configuring the aging time for IPv6 fast forwarding entries ···········································································282
Configuring IPv6 fast forwarding load sharing ·······························································································283
Displaying and maintaining IPv6 fast forwarding ···························································································283
Configuring tunneling··················································································284
Overview························································································································································284
IPv6 over IPv4 tunneling························································································································284
IPv4 over IPv4 tunneling························································································································286
IPv4 over IPv6 tunneling························································································································287
IPv6 over IPv6 tunneling························································································································291
Protocols and standards ························································································································291
Compatibility information································································································································292
Feature and hardware compatibility·······································································································292
Command and hardware compatibility···································································································292
Tunneling configuration task list·····················································································································292
Configuring a tunnel interface························································································································292
Configuring an IPv6 over IPv4 manual tunnel································································································294
Configuration example···························································································································295
Configuring an automatic IPv4-compatible IPv6 tunnel ·················································································297
Configuration example···························································································································297
Configuring a 6to4 tunnel·······························································································································298
6to4 tunnel configuration example·········································································································299
6to4 relay configuration example···········································································································301
Configuring an ISATAP tunnel·······················································································································303
Configuration example···························································································································304
Configuring an IPv4 over IPv4 tunnel ············································································································306
Configuration example···························································································································307
Configuring an IPv4 over IPv6 manual tunnel································································································308

x
Configuration example···························································································································309
Configuring a DS-Lite tunnel··························································································································311
Configuration example···························································································································312
Configuring an IPv6 over IPv6 tunnel ············································································································314
Configuration example···························································································································315
Displaying and maintaining tunneling configuration·······················································································316
Troubleshooting tunneling configuration········································································································317
Symptom················································································································································317
Analysis··················································································································································317
Solution··················································································································································317
Configuring GRE·························································································318
Overview························································································································································318
GRE encapsulation format·····················································································································318
GRE tunnel operating principle··············································································································318
GRE security mechanisms·····················································································································319
GRE application scenarios·····················································································································319
Protocols and standards ························································································································321
Configuring a GRE/IPv4 tunnel······················································································································322
Configuration guidelines·························································································································322
Configuration procedure·························································································································322
Configuring a GRE/IPv6 tunnel······················································································································323
Configuration guidelines·························································································································324
Configuration procedure·························································································································324
Displaying and maintaining GRE ···················································································································325
GRE configuration examples ·························································································································326
Configuring an IPv4 over IPv4 GRE tunnel····························································································326
Configuring an IPv4 over IPv6 GRE tunnel····························································································328
Troubleshooting GRE ····································································································································330
Symptom················································································································································330
Analysis··················································································································································330
Solution··················································································································································331
Configuring ADVPN····················································································332
Overview························································································································································332
ADVPN structures··································································································································332
How ADVPN operates····························································································································334
NAT traversal·········································································································································337
ADVPN configuration task list························································································································337
Configuring AAA ············································································································································337
Configuring the VAM server···························································································································337
Creating an ADVPN domain ··················································································································338
Enabling the VAM server ·······················································································································338
Configuring a pre-shared key for the VAM server··················································································338
Configuring hub groups··························································································································339
Configuring the port number of the VAM server·····················································································340
Specifying authentication and encryption algorithms for the VAM server··············································341
Configuring an authentication method ···································································································341
Configuring keepalive parameters ·········································································································341
Configuring the retry timer······················································································································342
Configuring the VAM client ····························································································································342
Creating a VAM client ····························································································································343
Enabling VAM clients·····························································································································343
Specifying VAM servers·························································································································343
Specifying an ADVPN domain for a VAM client·····················································································343
Configuring a pre-shared key for a VAM client ······················································································344
Setting the retry timer and retry times for a VAM client··········································································344
Setting the dumb timer for a VAM client·································································································344
Configuring a username and password for a VAM client·······································································345
Configuring an ADVPN tunnel interface·········································································································345
Configuring routing·········································································································································347
Configuring IPsec for ADVPN tunnels ···········································································································347

xi
Displaying and maintaining ADVPN···············································································································347
ADVPN configuration examples·····················································································································349
IPv4 full-mesh ADVPN configuration example·······················································································349
IPv6 full-mesh ADVPN configuration example·······················································································356
IPv4 hub-spoke ADVPN configuration example·····················································································364
IPv6 hub-spoke ADVPN configuration example·····················································································372
IPv4 multi-hub-group ADVPN configuration example············································································379
IPv6 multi-hub-group ADVPN configuration example············································································393
IPv4 full-mesh NAT traversal ADVPN configuration example································································408
Configuring WAAS······················································································417
Overview························································································································································417
TFO························································································································································417
DRE························································································································································418
LZ compression······································································································································418
Command and hardware compatibility···········································································································419
Protocols and standards ································································································································419
WAAS configuration task list··························································································································419
Configuring a WAAS class·····························································································································419
Configuring a WAAS policy····························································································································420
Applying a WAAS policy to an interface·········································································································420
Configuring TFO parameters ·························································································································421
Configuring the TFO blacklist autodiscovery feature ·····················································································421
Deleting all WAAS settings ····························································································································422
Restoring predefined WAAS settings·············································································································422
Displaying and maintaining WAAS ················································································································422
WAAS configuration examples ······················································································································423
Predefined WAAS policy configuration example····················································································423
User-defined WAAS policy configuration example·················································································425
Configuring AFT··························································································429
Overview························································································································································429
Compatibility information································································································································429
Command and hardware compatibility···································································································429
AFT implementations·····································································································································429
Static AFT ··············································································································································429
Dynamic AFT ·········································································································································429
Prefix translation ····································································································································430
AFT internal server·································································································································431
AFT translation process·································································································································431
For IPv6-initiated communication···········································································································431
For IPv4-initiated communication···········································································································432
AFT with ALG·················································································································································433
AFT configuration task list······························································································································433
For IPv6-initiated communication···········································································································433
For IPv4-initiated communication···········································································································434
Enabling AFT ·················································································································································434
Configuring an IPv6-to-IPv4 destination address translation policy·······························································434
Configuring an IPv6-to-IPv4 source address translation policy ·····································································435
Configuring an IPv4-to-IPv6 destination address translation policy·······························································436
Configuring an IPv4-to-IPv6 source address translation policy ·····································································436
Configuring AFT logging ································································································································437
Setting the ToS field to 0 for translated IPv4 packets····················································································437
Setting the Traffic Class field to 0 for translated IPv6 packets·······································································437
Displaying and maintaining AFT ····················································································································437
AFT configuration examples ··························································································································439
Allowing IPv4 Internet access from an IPv6 network·············································································439
Providing FTP service from an IPv6 network to the IPv4 Internet··························································442
Allowing mutual access between IPv4 and IPv6 networks ····································································443
Allowing IPv6 Internet access from an IPv4 network·············································································445
Providing FTP service from an IPv4 network to the IPv6 Internet··························································448

xii
Document conventions and icons·······························································451
Conventions···················································································································································451
Network topology icons··································································································································452
Support and other resources ······································································453
Accessing Hewlett Packard Enterprise Support ····························································································453
Accessing updates·········································································································································453
Websites ················································································································································454
Customer self repair·······························································································································454
Remote support······································································································································454
Documentation feedback ·······················································································································454
Index···········································································································456

1
Configuring ARP
Overview
ARP resolves IP addresses into MAC addresses on Ethernet networks.
ARP message format
ARP uses two types of messages: ARP request and ARP reply. Figure 1 shows the format of ARP
request/reply messages. Numbers in the figure refer to field lengths.
Figure 1 ARP message format
•Hardware type—Hardware address type. The value 1 represents Ethernet.
•Protocol type—Type of the protocol address to be mapped. The hexadecimal value 0x0800
represents IP.
•Hardware address length and protocol address length—Length, in bytes, of a hardware
address and a protocol address. For an Ethernet address, the value of the hardware address
length field is 6. For an IPv4 address, the value of the protocol address length field is 4.
•OP—Operation code, which describes the type of ARP message. The value 1 represents an
ARP request, and the value 2 represents an ARP reply.
•Sender hardware address—Hardware address of the device sending the message.
•Sender protocol address—Protocol address of the device sending the message.
•Target hardware address—Hardware address of the device to which the message is being
sent.
•Target protocol address—Protocol address of the device to which the message is being sent.
ARP operating mechanism
As shown in Figure 2, Host Aand Host B are on the same subnet. Host Asends a packet to Host B as
follows:
1. Host A looks through the ARP table for an ARP entry for Host B. If one entry is found, Host A
uses the MAC address in the entry to encapsulate the IP packet into a data link layer frame.
Then Host A sends the frame to Host B.
2. If Host A finds no entry for Host B, Host A buffers the packet and broadcasts an ARP request.
The payload of the ARP request contains the following information:
{Sender IP address and sender MAC address—HostA's IP address and MAC address.
{Target IP address—Host B's IP address.
{Target MAC address—An all-zero MAC address.

2
All hosts on this subnet can receive the broadcast request, but only the requestedhost (Host B)
processes the request.
3. Host B compares its own IP address with the target IP address in the ARP request. If they are
the same, Host B operates as follows:
a. Adds the sender IP address and sender MAC address into its ARP table.
b. Encapsulates its MAC address into an ARP reply.
c. Unicasts the ARP reply to Host A.
4. After receiving the ARP reply, Host A operates as follows:
a. Adds the MAC address of Host B into its ARP table.
b. Encapsulates the MAC address into the packet and sends the packet to Host B.
Figure 2 ARP address resolution process
If Host A and Host B are on different subnets, Host A sends a packet to Host B as follows:
1. Host A broadcasts an ARP request where the target IP address is the IP address of the
gateway.
2. The gateway responds with its MAC address in an ARP reply to Host A.
3. Host A uses the gateway's MAC address to encapsulate the packet, and then sends the packet
to the gateway.
4. If the gateway has an ARP entry for Host B, it forwards the packet to Host B directly. If not, the
gateway broadcasts an ARP request, in which the target IP address is the IP address of Host B.
5. After the gateway gets the MAC address of Host B, it sends the packet to Host B.
ARP table
An ARP table stores dynamic, static, OpenFlow, and Rule ARP entries.
Dynamic ARP entry
ARP automatically creates and updates dynamic entries. A dynamic ARP entry is removed when its
aging timer expires or the output interface goes down. In addition, a dynamic ARP entry can be
overwritten by a static ARP entry.
Static ARP entry
A static ARP entry is manually configured and maintained. It does not age out and cannot be
overwritten by any dynamic ARP entry.
Static ARP entries protect communication between devices because attack packets cannot modify
the IP-to-MAC mapping in a staticARP entry.
The device supports the following types of staticARP entries:

3
•Long static ARP entry—It contains theIP address, MAC address,VLAN, and output interface.
It is directly used for forwarding packets.
•Short static ARP entry—It contains only the IP address and MAC address.
{If the output interface is a Layer 3 Ethernet interface, the short ARP entry can be directly
used to forward packets.
{If the output interface is a VLAN interface, the device sends an ARP request whose target IP
address is the IP address in the short entry. If the sender IP and MAC addresses in the
received ARP reply match the short static ARP entry, the device performs the following
operations:
−Adds the interface that received theARP reply to the short staticARP entry.
−Uses the resolved short staticARP entry to forward IP packets.
To communicate with a host by using a fixed IP-to-MAC mapping, configure a short staticARP entry
on the device. To communicate with a host by using a fixed IP-to-MAC mapping through an interface
in a VLAN, configure a long staticARP entry on the device.
OpenFlow ARP entry
ARP creates OpenFlow ARP entries by learning from the OpenFlow module. An OpenFlow ARP
entry does not age out, and it cannot be updated. It can be overwritten by a static ARP entry. An
OpenFlow ARP entry can be used directly to forwardpackets. For more information about OpenFlow,
see OpenFlow Configuration Guide.
Rule ARP entry
ARP creates Rule ARP entries by learning from the IPoE or portal module. A Rule ARP entry does
not age out, and it cannot be updated. It can be overwritten by a static ARP entry. ARule ARP entry
can be used directly to forward packets. For more information about IPoE, see Layer 2—WAN
Access Configuration Guide. For more information about portal, see Security Configuration Guide.
Configuring a static ARP entry
A static ARP entry is effective when the device functions correctly. If a VLAN or VLAN interface is
deleted, long static ARPentries in the VLAN are deleted, and resolved shortstatic ARP entries in the
VLAN become unresolved.
A resolved short static ARP entry becomes unresolved upon certain events. For example, it
becomes unresolved when the resolved output interface goes down.
A long static ARP entry is ineffective in either of the following situations:
•The IP address in the entry conflicts with a local IP address.
•No local interface has an IP address in the same subnet as the IP address in theARP entry.
Follow these guidelines when you configure a long staticARP entry:
•The vlan-id argument must be the ID of an existing VLAN where theARP entry resides. The
specified Ethernet interface must belong to that VLAN.
•The VLAN interface must be created. Its IP address and the IP address specified by the
ip-address argument must be on the same subnet.
To configure a static ARP entry:
Step Command Remarks
1. Enter system view. system-view N/A

4
Step Command Remarks
2. Configure a static ARP
entry.
•Configure a long static ARP entry:
arp static ip-address mac-address
vlan-id interface-type
interface-number [ vpn-instance
vpn-instance-name ]
•Configure a short static ARP entry:
arp static ip-address mac-address
[ vpn-instance vpn-instance-name ]
By default, no static ARP entry is
configured.
Setting the maximum number of dynamic ARP
entries for a device
Adevice can dynamically learn ARP entries. To prevent a device from holding too many ARPentries,
you can set the maximum number of dynamic ARP entries that the device can learn. When the
maximum number is reached, the device stops learningARP entries.
If you set a value lower than the number of existing dynamic ARP entries, the device does not
remove the existing entries unless they are aged out.
To set the maximum number of dynamic ARP entries for a device:
Step Command Remarks
1. Enter system view. system-view N/A
2. Set the maximum
number of dynamic
ARP entries for the
device.
arp max-learning-number
number
If the value for the number argument is set to
0, the device is disabled from learning
dynamic ARP entries.
Setting the maximum number of dynamic ARP
entries for an interface
An interface can dynamically learnARP entries. To prevent an interface from holding too many ARP
entries, you can set the maximum number of dynamic ARPentries that the interface can learn. When
the maximum number is reached, the interface stops learningARP entries.
You can set limits for both a Layer 2 interface and the VLAN interface for a permitted VLAN on the
Layer 2 interface. The Layer 2 interface learns anARP entry only when neither limit is reached.
To set the maximum number of dynamic ARP entries for an interface:
Step Command Remarks
1. Enter system view. system-view N/A
2. Enter interface view. interface interface-type
interface-number N/A
3. Set the maximum number
of dynamic ARP entries for
the interface. arp max-learning-num
number
If the value of the number argument is
set to 0, the interface is disabled from
learning dynamic ARP entries.

5
Setting the aging timer for dynamic ARP entries
Each dynamic ARP entry in the ARP table has a limited lifetime, called an aging timer. The aging
timer of a dynamic ARP entry is reset each time the dynamic ARP entry is updated. A dynamic ARP
entry that is not updated before its aging timer expires is deleted from the ARP table.
To set the aging timer for dynamic ARP entries:
Step Command Remarks
1. Enter system view. system-view N/A
2. Set the aging timer for
dynamic ARP entries. arp timer aging aging-time By default, the aging time for dynamic ARP
entries is 20 minutes.
Enabling dynamic ARP entry check
The dynamic ARP entry check function disables the device from supporting dynamic ARP entries
that contain multicast MAC addresses. The device cannot learn dynamic ARP entries containing
multicast MAC addresses. You cannot manually add static ARP entries containing multicast MAC
addresses.
When dynamic ARP entry check is disabled, ARP entries containing multicast MAC addresses are
supported. The device can learn dynamic ARPentries containing multicast MAC addresses obtained
from the ARP packets sourced from a unicast MAC address. You can also manually add static ARP
entries containing multicast MAC addresses.
To enable dynamic ARP entry check:
Step Command Remarks
1. Enter system view. system-view N/A
2. Enable dynamic ARP entry
check. arp check enable By default, dynamic ARP entry check is
enabled.
Enabling ARP logging
This function enables a device to log ARP events when ARP cannot resolve IP addresses correctly.
The device can log the followingARP events:
•On a proxy ARP-disabled interface, the target IP address of a received ARP packet is not one of
the following IP addresses:
{The IP address of the receiving interface.
{The virtual IP address of the VRRP group.
{The public IP address after NAT.
•The sender IPaddress of a receivedARP reply conflicts with one of the following IP addresses:
{The IP address of the receiving interface.
{The virtual IP address of the VRRP group.
{The public IP address after NAT.
The device sends ARPlog messages to the information center. You can use the info-center source
command to specify the log output rules for the information center. For more information about
information center, see Network Management and Monitoring Configuration Guide.

6
To enable the ARP logging function:
Step Command Remarks
1. Enter system view. system-view N/A
2. Enable the ARP logging
function. arp check log enable By default, ARP logging is disabled.
Displaying and maintaining ARP
IMPORTANT:
Clearing ARP entries from the ARP tablemight cause communication failures. Make sure the entries
to be cleared do not affect current communications.
Execute display commands in any view and reset commands in user view.
Task Command
Display ARP entries (centralized devices
in standalone mode). display arp [ [ all | dynamic | static ] | vlan vlan-id | interface
interface-type interface-number ] [ count | verbose ]
Display ARP entries (distributed devices
in standalone mode/centralized devices in
IRF mode).
display arp [ [ all | dynamic | static ] [ slot slot-number ] | vlan
vlan-id | interface interface-type interface-number ] [ count |
verbose ]
Display ARP entries (distributed devices
in IRF mode).
display arp [ [ all | dynamic | static ] [ chassis chassis-number
slot slot-number ] | vlan vlan-id | interface interface-type
interface-number ] [ count | verbose ]
Display the ARP entry for an IP address
(centralized devices in standalone mode). display arp ip-address [verbose ]
Display the ARP entry for an IP address
(distributed devices in standalone
mode/centralized devices in IRF mode). display arp ip-address [slot slot-number ] [ verbose ]
Display the ARP entry for an IP address
(distributed devices in IRF mode). display arp ip-address [ chassis chassis-number slot
slot-number ] [ verbose ]
Display the ARP entries for a VPN
instance. display arp vpn-instance vpn-instance-name [ count ]
Display the aging timer of dynamic ARP
entries. display arp timer aging
Clear ARP entries from the ARP table
(centralized devices in standalone mode). reset arp { all | dynamic | interface interface-type
interface-number | static }
Clear ARP entries from the ARP table
(distributed devices in standalone
mode/centralized devices in IRF mode).
reset arp { all | dynamic | interface interface-type
interface-number |slot slot-number | static }
Clear ARP entries from the ARP table
(distributed devices in IRF mode). reset arp { all | chassis chassis-number slot slot-number |
dynamic | interface interface-type interface-number | static }