HP FlexNetwork MSR2003 User manual

HPE FlexNetwork MSR Router Series
Comware 7 Layer 3—IP Services Configuration Guide
Part number: 5998-8832
Software version: CMW710-R0305
Document version: 6PW106-20160308

i
© Copyright 2016 Hewlett Packard Enterprise Development LP
The information contained herein is subject to change without notice. The only warranties for Hewlett Packard
Enterprise products and services are set forth in the express warranty statements accompanying such
products and services. Nothing herein should be construed as constituting an additional warranty. Hewlett
Packard Enterprise shall not be liable for technical or editorial errors or omissions contained herein.
Confidential computer software. Valid license from Hewlett Packard Enterprise required for possession, use, or
copying. Consistent with FAR 12.211 and 12.212, Commercial Computer Software, Computer Software
Documentation, and Technical Data for Commercial Items are licensed to the U.S. Government under vendor’s
standard commercial license.
Links to third-party websites take you outside the Hewlett Packard Enterprise website. Hewlett Packard
Enterprise has no control over and is not responsible for information outside the Hewlett Packard Enterprise
website.
Acknowledgments
Intel®, Itanium®, Pentium®, Intel Inside®, and the Intel Inside logo are trademarks of Intel Corporation in the
United States and other countries.
Microsoft® and Windows® are trademarks of the Microsoft group of companies.
Adobe® andAcrobat® are trademarks ofAdobe Systems Incorporated.
Java and Oracle are registered trademarks of Oracle and/or its affiliates.
UNIX® is a registered trademark of The Open Group.

i
Contents
Configuring ARP·····························································································1
Overview····························································································································································1
ARP message format·································································································································1
ARP operating mechanism ························································································································1
ARP table···················································································································································2
Configuring a static ARP entry···························································································································3
Setting the maximum number of dynamic ARP entries for a device··································································4
Setting the maximum number of dynamic ARP entries for an interface ····························································4
Setting the aging timer for dynamic ARP entries ·······························································································5
Enabling dynamic ARP entry check···················································································································5
Enabling ARP logging········································································································································5
Displaying and maintaining ARP························································································································6
Configuration examples ·····································································································································7
Long static ARP entry configuration example····························································································7
Short static ARP entry configuration example····························································································8
Configuring gratuitous ARP ············································································9
Overview····························································································································································9
Gratuitous ARP packet learning·················································································································9
Periodic sending of gratuitous ARP packets······························································································9
Configuration procedure ··································································································································10
Enabling IP conflict notification ························································································································10
Configuring proxy ARP ·················································································12
Enabling common proxy ARP··························································································································12
Enabling local proxy ARP ································································································································12
Displaying proxy ARP ······································································································································13
Common proxy ARP configuration example····································································································13
Network requirements······························································································································13
Configuration procedure···························································································································13
Verifying the configuration························································································································14
Configuring ARP fast-reply ···········································································15
Overview··························································································································································15
Configuration procedure ··································································································································15
ARP fast-reply configuration example··············································································································15
Network requirements······························································································································15
Configuration procedure···························································································································16
Configuring ARP PnP ···················································································17
Overview··························································································································································17
Configuration prerequisites······························································································································17
Configuration procedure ··································································································································17
Displaying and maintaining ARP PnP··············································································································18
ARP PnP configuration example······················································································································18
Network requirements······························································································································18
Configuration procedure···························································································································18
Verifying the configuration························································································································19
Configuring ARP suppression·······································································20
Overview··························································································································································20
Configuration procedure ··································································································································20
Displaying and maintaining ARP suppression ·································································································21
ARP suppression configuration example·········································································································21
Network requirements······························································································································21
Configuration procedure···························································································································22
Verifying the configuration························································································································22

ii
Configuring ARP direct route advertisement·················································23
Overview··························································································································································23
Configuration procedure ··································································································································23
Configuring IP addressing·············································································24
Overview··························································································································································24
IP address classes···································································································································24
Special IP addresses ·······························································································································25
Subnetting and masking···························································································································25
Assigning an IP address to an interface ··········································································································25
Configuration guidelines···························································································································26
Configuration procedure···························································································································26
Configuring IP unnumbered·····························································································································26
Configuration guidelines···························································································································26
Configuration prerequisites······················································································································27
Configuration procedure···························································································································27
Displaying and maintaining IP addressing·······································································································27
Configuration examples ···································································································································27
IP address configuration example············································································································27
IP unnumbered configuration example ····································································································29
DHCP overview·····························································································31
DHCP address allocation·································································································································31
Allocation mechanisms ····························································································································31
IP address allocation process··················································································································32
IP address lease extension······················································································································32
DHCP message format····································································································································33
DHCP options ··················································································································································34
Common DHCP options···························································································································34
Custom DHCP options·····························································································································34
Protocols and standards ··································································································································36
Configuring the DHCP server ·······································································37
Overview··························································································································································37
DHCP address pool ·································································································································37
IP address allocation sequence···············································································································39
DHCP server configuration task list ·················································································································39
Configuring an address pool on the DHCP server···························································································40
Configuration task list·······························································································································40
Creating a DHCP address pool················································································································40
Specifying IP address ranges for a DHCP address pool ·········································································40
Specifying gateways for DHCP clients·····································································································43
Specifying a domain name suffix for DHCP clients··················································································44
Specifying DNS servers for DHCP clients································································································44
Specifying WINS servers and NetBIOS node type for DHCP clients·······················································44
Specifying BIMS server for DHCP clients································································································45
Specifying the configuration file for DHCP client auto-configuration························································45
Specifying a server for DHCP clients·······································································································46
Configuring Option 184 parameters for DHCP clients ·············································································46
Customizing DHCP options······················································································································47
Configuring the DHCP user class whitelist·······························································································48
Enabling DHCP················································································································································49
Enabling the DHCP server on an interface······································································································49
Applying an address pool on an interface········································································································49
Configuring IP address conflict detection·········································································································50
Enabling handling of Option 82························································································································50
Configuring DHCP server compatibility············································································································51
Configuring the DHCP server to broadcast all responses········································································51
Configure the DHCP server to ignore BOOTP requests··········································································51
Configuring the DHCP server to send BOOTP responses in RFC 1048 format······································52
Setting the DSCP value for DHCP packets sent by the DHCP server·····························································52

iii
Configuring DHCP binding auto backup ··········································································································52
Configuring address pool usage alarming ·······································································································53
Binding gateways to a common MAC address································································································53
Advertising subnets assigned to clients···········································································································54
Applying a DHCP address pool to a VPN instance··························································································55
Enabling client offline detection on the DHCP server ······················································································55
Configuring DHCP logging on the DHCP server······························································································56
Displaying and maintaining the DHCP server··································································································56
DHCP server configuration examples··············································································································57
Static IP address assignment configuration example ··············································································57
Dynamic IP address assignment configuration example ·········································································58
DHCP user class configuration example··································································································60
DHCP user class whitelist configuration example····················································································61
Primary and secondary subnets configuration example ··········································································62
DHCP option customization configuration example·················································································63
Troubleshooting DHCP server configuration ···································································································65
Symptom··················································································································································65
Analysis····················································································································································65
Solution····················································································································································65
Configuring the DHCP relay agent································································66
Overview··························································································································································66
Operation ·················································································································································66
DHCP relay agent support for Option 82 ·································································································67
DHCP relay agent configuration task list ·········································································································67
Enabling DHCP················································································································································68
Enabling the DHCP relay agent on an interface ······························································································68
Specifying DHCP servers on a relay agent······································································································68
Configuring the DHCP relay agent security functions······················································································69
Enabling the DHCP relay agent to record relay entries ···········································································69
Enabling periodic refresh of dynamic relay entries ··················································································69
Enabling DHCP starvation attack protection····························································································70
Configuring the DHCP relay agent to release an IP address···········································································71
Configuring Option 82······································································································································71
Setting the DSCP value for DHCP packets sent by the DHCP relay agent·····················································72
Enabling DHCP server proxy on a DHCP relay agent·····················································································72
Configuring a DHCP relay address pool··········································································································73
Specifying a gateway address for DHCP clients······························································································74
Enabling client offline detection on the DHCP relay agent ··············································································74
Specifying the source address and gateway address in DHCP requests························································74
Displaying and maintaining the DHCP relay agent··························································································75
DHCP relay agent configuration examples······································································································75
DHCP relay agent configuration example································································································75
Option 82 configuration example ·············································································································76
Troubleshooting DHCP relay agent configuration····························································································77
Symptom··················································································································································77
Analysis····················································································································································77
Solution····················································································································································77
Configuring the DHCP client·········································································78
Enabling the DHCP client on an interface········································································································78
Configuring a DHCP client ID for an interface ·································································································78
Enabling duplicated address detection ············································································································79
Setting the DSCP value for DHCP packets sent by the DHCP client ······························································79
Displaying and maintaining the DHCP client ···································································································79
DHCP client configuration example ·················································································································80
Network requirements······························································································································80
Configuration procedure···························································································································80
Verifying the configuration························································································································81
Configuring DHCP snooping·········································································83
Overview··························································································································································83

iv
Application of trusted and untrusted ports································································································84
DHCP snooping support for Option 82·····································································································85
Command and hardware compatibility·············································································································85
DHCP snooping configuration task list·············································································································85
Configuring basic DHCP snooping ··················································································································86
Configuring Option 82······································································································································86
Configuring DHCP snooping entry auto backup ······························································································87
Enabling DHCP starvation attack protection····································································································88
Enabling DHCP-REQUEST attack protection··································································································89
Setting the maximum number of DHCP snooping entries ···············································································89
Displaying and maintaining DHCP snooping ···································································································90
DHCP snooping configuration examples ·········································································································90
Basic DHCP snooping configuration example ·························································································90
Option 82 configuration example ·············································································································91
Configuring the BOOTP client·······································································93
BOOTP application ··········································································································································93
Obtaining an IP address dynamically···············································································································93
Protocols and standards ··································································································································93
Configuring an interface to use BOOTP for IP address acquisition·································································93
Displaying and maintaining BOOTP client·······································································································94
BOOTP client configuration example···············································································································94
Network requirements······························································································································94
Configuration procedure···························································································································94
Verifying the configuration························································································································94
Configuring DNS···························································································95
Overview··························································································································································95
Static domain name resolution·················································································································95
Dynamic domain name resolution············································································································95
DNS proxy················································································································································96
DNS spoofing···········································································································································97
DNS configuration task list·······························································································································98
Configuring the IPv4 DNS client ······················································································································98
Configuring static domain name resolution······························································································98
Configuring dynamic domain name resolution·························································································99
Configuring the IPv6 DNS client ······················································································································99
Configuring static domain name resolution······························································································99
Configuring dynamic domain name resolution·······················································································100
Configuring the DNS proxy ····························································································································101
Configuring DNS spoofing ·····························································································································101
Configuring network mode tracking for an output interface ···········································································102
Specifying the source interface for DNS packets···························································································102
Configuring the DNS trusted interface ···········································································································103
Setting the DSCP value for outgoing DNS packets ·······················································································103
Displaying and maintaining IPv4 DNS ···········································································································103
IPv4 DNS configuration examples ·················································································································104
Static domain name resolution configuration example···········································································104
Dynamic domain name resolution configuration example······································································105
DNS proxy configuration example··········································································································107
IPv6 DNS configuration examples ·················································································································108
Static domain name resolution configuration example···········································································108
Dynamic domain name resolution configuration example······································································109
DNS proxy configuration example··········································································································114
Troubleshooting IPv4 DNS configuration·······································································································115
Symptom················································································································································115
Solution··················································································································································115
Troubleshooting IPv6 DNS configuration·······································································································115
Symptom················································································································································115
Solution··················································································································································115

v
Configuring DDNS ······················································································116
Overview························································································································································116
DDNS application···································································································································116
DDNS client configuration task list·················································································································117
Configuring a DDNS policy ····························································································································117
Configuration prerequisites····················································································································118
Configuration procedure·························································································································118
Applying the DDNS policy to an interface······································································································119
Setting the DSCP value for outgoing DDNS packets·····················································································119
Displaying DDNS ···········································································································································120
DDNS configuration examples·······················································································································120
DDNS configuration example with www.3322.org ·················································································120
DDNS configuration example with PeanutHull server············································································121
Configuring NAT ·························································································123
Overview························································································································································123
Terminology ···········································································································································123
NAT types ··············································································································································123
NAT control············································································································································124
Command and hardware compatibility···········································································································124
NAT implementations·····································································································································124
Static NAT··············································································································································124
Dynamic NAT·········································································································································124
NAT Server ············································································································································125
DS-Lite NAT444·····································································································································126
NAT entries····················································································································································126
NAT session entry··································································································································126
EIM entry················································································································································127
NO-PAT entry·········································································································································127
Using NAT with other features·······················································································································127
VRF-aware NAT·····································································································································127
NAT with DNS mapping·························································································································128
NAT with ALG ········································································································································128
NAT configuration task list ·····························································································································129
Configuring static NAT···································································································································129
Configuration prerequisites····················································································································129
Configuring outbound one-to-one static NAT·························································································129
Configuring outbound net-to-net static NAT···························································································130
Configuring inbound one-to-one static NAT···························································································130
Configuring inbound net-to-net static NAT·····························································································131
Configuring dynamic NAT······························································································································131
Configuration restrictions and guidelines·······························································································132
Configuration prerequisites····················································································································132
Configuring outbound dynamic NAT······································································································132
Configuring inbound dynamic NAT ········································································································133
Configuring NAT Server·································································································································134
Configuring common NAT Server··········································································································134
Configuring load sharing NAT Server ····································································································135
Configuring ACL-based NAT Server······································································································136
Configuring DS-Lite NAT444 ·························································································································136
Configuring NAT with DNS mapping··············································································································137
Configuring NAT hairpin·································································································································137
Configuring NAT with ALG·····························································································································138
Configuring NAT session logging···················································································································138
Displaying and maintaining NAT····················································································································138
NAT configuration examples··························································································································140
Outbound one-to-one static NAT configuration example·······································································140
Outbound dynamic NAT configuration example (non-overlapping addresses)······································141
Outbound bidirectional NAT configuration example···············································································144
NAT Server for external-to-internal access configuration example························································147
NAT Server for external-to-internal access through domain name configuration example····················150

vi
Bidirectional NAT for external-to-internal NAT Server access through domain name configuration example
·······························································································································································153
NAT hairpin in C/S mode configuration example···················································································156
NAT hairpin in P2P mode configuration example ··················································································159
Twice NAT configuration example ·········································································································162
Load sharing NAT Server configuration example ··················································································165
NAT with DNS mapping configuration example·····················································································167
DS-Lite NAT444 configuration example·································································································170
Basic IP forwarding on the device·······························································173
FIB table·························································································································································173
Displaying FIB table entries ···························································································································174
Configuring load sharing·············································································175
Command and hardware compatibility···········································································································175
Configuring per-packet or per-flow load sharing····························································································175
Configuring load sharing based on bandwidth·······························································································176
Configuring fast forwarding·········································································177
Overview························································································································································177
Command and hardware compatibility···········································································································177
Configuring the aging time for fast forwarding entries ···················································································177
Configuring fast forwarding load sharing ·······································································································177
Displaying and maintaining fast forwarding ···································································································178
Configuring flow classification·····································································179
Feature and hardware compatibility···············································································································179
Specifying a flow classification policy ············································································································179
Displaying the adjacency table ···································································180
Overview························································································································································180
Command and hardware compatibility···········································································································181
Displaying commands····································································································································181
Configuring IRDP························································································182
Overview························································································································································182
IRDP operation·······································································································································182
Basic concepts·······································································································································182
Protocols and standards ························································································································183
Configuration procedure ································································································································183
IRDP configuration example ··························································································································184
Network requirements····························································································································184
Configuration procedure·························································································································184
Verifying the configuration······················································································································185
Optimizing IP performance ·········································································186
Command and hardware compatibility···········································································································186
Enabling an interface to receive and forward directed broadcasts destined for the directly connected network
·······································································································································································186
Configuration procedure·························································································································186
Configuration example···························································································································187
Configuring MTU for an interface···················································································································188
Configuring TCP MSS for an interface···········································································································188
Configuring TCP path MTU discovery ···········································································································188
Enabling TCP SYN Cookie ····························································································································189
Configuring the TCP buffer size·····················································································································190
Configuring TCP timers··································································································································190
Enabling sending ICMP error messages ·······································································································190
Configuring rate limit for ICMP error messages·····························································································192
Specifying the source address for ICMP packets ··························································································192
Enabling IPv4 local fragment reassembly······································································································193
Displaying and maintaining IP performance optimization ··············································································193

vii
Configuring UDP helper··············································································196
Overview························································································································································196
Feature and hardware compatibility···············································································································196
Configuration restrictions and guidelines·······································································································196
Configuring UDP helper to convert broadcast to unicast···············································································196
Configuring UDP helper to convert broadcast to multicast ············································································197
Configuring UDP helper to convert multicast to broadcast or unicast····························································198
Displaying and maintaining UDP helper ········································································································199
UDP helper configuration examples ··············································································································199
Configuring UDP helper to convert broadcast to unicast·······································································199
Configuring UDP helper to convert broadcast to multicast ····································································200
Configuring UDP helper to convert multicast to broadcast ····································································201
Configuring basic IPv6 settings···································································202
Overview························································································································································202
IPv6 features··········································································································································202
IPv6 addresses ······································································································································203
IPv6 ND protocol····································································································································205
IPv6 path MTU discovery·······················································································································207
IPv6 transition technologies···························································································································208
Dual stack ··············································································································································208
Tunneling ···············································································································································208
NAT-PT··················································································································································209
6PE ························································································································································209
Protocols and standards ································································································································209
Compatibility information································································································································210
Command and hardware compatibility···································································································210
IPv6 basics configuration task list··················································································································210
Assigning IPv6 addresses to interfaces·········································································································211
Configuring an IPv6 global unicast address···························································································211
Configuring an IPv6 link-local address···································································································213
Configuring an IPv6 anycast address ····································································································214
Configuring IPv6 ND ······································································································································214
Configuring a static neighbor entry ········································································································214
Setting the maximum number of dynamic neighbor entries···································································215
Setting the aging timer for ND entries in stale state···············································································215
Minimizing link-local ND entries·············································································································216
Setting the hop limit································································································································216
Configuring parameters for RA messages·····························································································216
Configuring the maximum number of attempts to send an NS message for DAD·································218
Enabling ND proxy·································································································································219
Configuring IPv6 ND suppression··········································································································220
Configuring IPv6 ND direct route advertisement····················································································221
Configuring path MTU discovery····················································································································222
Configuring the interface MTU···············································································································222
Configuring a static path MTU for an IPv6 address ···············································································223
Configuring the aging time for dynamic path MTUs···············································································223
Controlling sending ICMPv6 messages·········································································································223
Configuring the rate limit for ICMPv6 error messages···········································································223
Enabling replying to multicast echo requests·························································································224
Enabling sending ICMPv6 destination unreachable messages·····························································224
Enabling sending ICMPv6 time exceeded messages············································································225
Enabling sending ICMPv6 redirect messages ·······················································································225
Specifying the source address for ICMPv6 packets···············································································225
Enabling IPv6 local fragment reassembly······································································································226
Configuring IPv6 load sharing based on bandwidth·······················································································226
Displaying and maintaining IPv6 basics·········································································································227
IPv6 configuration examples··························································································································230
Basic IPv6 configuration example··········································································································230
IPv6 ND suppression configuration example·························································································234
Troubleshooting IPv6 basics configuration ····································································································235

viii
Symptom················································································································································235
Solution··················································································································································235
DHCPv6 overview·······················································································236
Feature and hardware compatibility···············································································································236
DHCPv6 address/prefix assignment··············································································································236
Rapid assignment involving two messages ···························································································236
Assignment involving four messages·····································································································236
Address/prefix lease renewal·························································································································237
Stateless DHCPv6 ·········································································································································238
Protocols and standards ································································································································238
Configuring the DHCPv6 server··································································240
Overview························································································································································240
IPv6 address assignment·······················································································································240
IPv6 prefix assignment···························································································································240
Concepts················································································································································241
DHCPv6 address pool····························································································································241
IPv6 address/prefix allocation sequence································································································242
Configuration task list·····································································································································243
Configuring IPv6 prefix assignment ···············································································································243
Configuration guidelines·························································································································243
Configuration procedure·························································································································244
Configuring IPv6 address assignment ···········································································································244
Configuration guidelines·························································································································245
Configuration procedure·························································································································245
Configuring network parameters assignment ································································································246
Configuring network parameters in a DHCPv6 address pool·································································246
Configuring network parameters in a DHCPv6 option group·································································247
Configuring the DHCPv6 server on an interface····························································································247
Configuration guidelines·························································································································247
Configuration procedure·························································································································248
Setting the DSCP value for DHCPv6 packets sent by the DHCPv6 server···················································248
Configuring DHCPv6 binding auto backup ····································································································248
Advertising subnets assigned to clients·········································································································249
Applying a DHCPv6 address pool to a VPN instance····················································································250
Configuring DHCPv6 logging on the DHCPv6 server····················································································250
Displaying and maintaining the DHCPv6 server····························································································251
DHCPv6 server configuration examples········································································································252
Dynamic IPv6 prefix assignment configuration example········································································252
Dynamic IPv6 address assignment configuration example····································································254
Configuring the DHCPv6 relay agent··························································257
Overview························································································································································257
DHCPv6 relay agent configuration task list····································································································258
Enabling the DHCPv6 relay agent on an interface ························································································258
Specifying DHCPv6 servers on the relay agent·····························································································258
Setting the DSCP value for DHCPv6 packets sent by the DHCPv6 relay agent ···········································259
Specifying a padding mode for the Interface-ID option··················································································259
Configuring a DHCPv6 relay address pool ····································································································260
Specifying a gateway address for DHCPv6 clients························································································260
Displaying and maintaining the DHCPv6 relay agent ····················································································261
DHCPv6 relay agent configuration example··································································································261
Network requirements····························································································································261
Configuration procedure·························································································································262
Verifying the configuration······················································································································262
Configuring the DHCPv6 client···································································264
Overview························································································································································264
Configuration restrictions and guidelines·······································································································264
DHCPv6 client configuration task list·············································································································264
Configuring IPv6 address acquisition·············································································································264