HP 2520-8 User manual

HP Switch Software
HP 2520-8-PoE Switch
HP 2520-24-PoE Switch
Software version S.15.09
August 2012
IPv6 Configuration Guide

HP Networking
2520 Switches
IPv6 Configuration Guide
August 2012
S.15.09

Hewlett-Packard Company
8000 Foothills Boulevard, m/s 5551
Roseville, California 95747-5551
http://www.www.hp.com/networking
© Copyright 2012 Hewlett-Packard Development Company,L.P.
The information contained herein is subject to change without
notice. All Rights Reserved.
This document contains proprietary information, which is
protected by copyright. No part of this document may be
photocopied, reproduced, or translated into another
language without the prior written consent of Hewlett-
Packard.
Publication Number
5998-3621
August 2012
Applicable Products
HP 2520-8-PoE Switch (J9137A)
HP 2520-24-PoE Switch (J9138A)
Trademark Credits
Microsoft, Windows, and Microsoft Windows NT are US
registered trademarks of Microsoft Corporation. Java™ is a
US trademark of Sun Microsystems, Inc.
Disclaimer
The information contained in this document is subject to
change without notice.
HEWLETT-PACKARD COMPANY MAKES NO WARRANTY
OF ANY KIND WITH REGARD TO THIS MATERIAL,
INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
WARRANTIES OF MERCHANTABILITY AND FITNESS
FOR A PARTICULAR PURPOSE. Hewlett-Packard shall not
be liable for errors contained herein or for incidental or
consequential damages in connection with the furnishing,
performance, or use of this material.
The only warranties for HP products and services are set
forth in the express warranty statements accompanying
such products and services. Nothing herein should be
construed as constituting an additional warranty. HP shall
not be liable for technical or editorial errors or omissions
contained herein.
Hewlett-Packard assumes no responsibility for the use or
reliability of its software on equipment that is not furnished
by Hewlett-Packard.
Software End User License Agreement and Hardware
Limited Warranty
For the software end user license agreement and the
hardware limited warranty information for HP Networking
products, visit www.hp.com/networking/support.

1
IPv6 Addressing Configuration
Introduction ................................................................................. 1-1
General Configuration Steps ..................................................... 1-2
Configuring IPv6 Addressing .................................................... 1-3
Enabling IPv6 with an Automatically
Configured Link-Local Address ................................................ 1-3
Enabling Autoconfiguration of a
Global Unicast Address and a Default
Router Identity on a VLAN ....................................................... 1-4
Enabling DHCPv6 ....................................................................... 1-6
Configuring a Static IPv6 Address on a VLAN ....................... 1-9
Statically Configuring a Link-Local Unicast Address ..... 1-9
Statically Configuring A Global Unicast Address .......... 1-10
Duplicate Address Detection (DAD) for Statically
Configured Addresses ..................................................... 1-12
Disabling IPv6 on a VLAN ....................................................... 1-12
Neighbor Discovery (ND) ......................................................... 1-12
Duplicate Address Detection (DAD) ........................................ 1-14
DAD Operation ............................................................... 1-14
Configuring DAD ........................................................... 1-15
View the Current IPv6 Addressing Configuration ................ 1-17
Router Access and Default Router Selection .......................... 1-23
Router Advertisements .................................................... 1-23
Router Solicitations ......................................................... 1-24
Default IPv6 Router ........................................................ 1-24
Router Redirection .......................................................... 1-25
View IPv6 Gateway, Route, and Router Neighbors .............. 1-25
Viewing Gateway and IPv6 Route Information .............. 1-25
Viewing IPv6 Router Information .................................. 1-26
Address Lifetimes ...................................................................... 1-28
Preferred Lifetime ........................................................... 1-28
Valid Lifetime ................................................................. 1-28
Sources of IPv6 Address Lifetimes ................................. 1-28
2
IPv6 Management Features
Introduction ................................................................................. 2-1
Viewing and Clearing the IPv6 Neighbors Cache .................... 2-1
Viewing the Neighbor Cache ............................................ 2-1
Clearing the Neighbor Cache ............................................ 2-3
IPv6 Telnet Operation ................................................................ 2-4

Outbound Telnet to Another Device ................................. 2-4
Viewing the Current Telnet Activity on a Switch ........................... 2-6
Enabling or Disabling Inbound Telnet Access ................. 2-7
Viewing the Current Inbound Telnet Configuration ......... 2-7
SNTP and Timep ......................................................................... 2-8
Configuring (Enabling or Disabling) the SNTP Mode ..... 2-8
Configuring an IPv6 Address for an SNTP Server ........... 2-9
Configuring (Enabling or Disabling) the Timep Mode .. 2-11
TFTP File Transfers Over IPv6 ............................................... 2-14
TFTP File Transfers over IPv6 ....................................... 2-14
Enabling TFTP for IPv6 .................................................. 2-15
Using Auto-TFTP for IPv6 ............................................. 2-19
SNMP Management for IPv6 ................................................... 2-21
SNMP Features Supported .............................................. 2-21
SNMP Configuration Commands Supported ................. 2-21
IP Preserve for IPv6 .................................................................. 2-24
3
IPv6 Management Security Features
Authorized IP Managers for IPv6 ............................................. 3-1
Usage Notes ...................................................................... 3-1
Configuring Authorized IP Managers for Switch Access . 3-3
Using a Mask to Configure Authorized Management
Stations ............................................................................. 3-3
Displaying an Authorized IP Managers Configuration .. 3-10
Additional Examples of Authorized IPv6 Managers
Configuration .................................................................. 3-10
Secure Shell (SSH) for IPv6 ..................................................... 3-12
Configuring SSH for IPv6 .............................................. 3-13
Displaying an SSH Configuration .................................. 3-17
Secure Copy and Secure FTP for IPv6 ................................... 3-17
4
IPv6 Diagnostic and Troubleshooting
Introduction ................................................................................. 4-1
ICMP Rate-Limiting ................................................................... 4-1
Ping for IPv6 (Ping6) .................................................................. 4-3
Traceroute for IPv6 .................................................................... 4-5
DNS Resolver for IPv6 ................................................................ 4-8
DNS Configuration ........................................................... 4-8
Viewing the Current Configuration ................................ 4-10
Operating Notes .............................................................. 4-10
Debug/Syslog for IPv6 .............................................................. 4-10

Configuring Debug and Event Log Messaging .............. 4-11
Debug Command ............................................................ 4-11
Configuring Debug Destinations .................................... 4-12
Configuring an IPv6 Syslog Server ................................ 4-12
For more information, see “Configuring Debug and
Event Log Messaging” on page 4-11. ............................. 4-13
Logging Command ......................................................... 4-13
Displaying a Debug/Syslog for Configuration ............... 4-14
A
IPv6 Terminology

5
Product Documentation
About Your Switch Manual Set
Note For the latest version of all HP switch documentation, including Release Notes
covering recently added features, please visit the HP Networking web site at
www.hp.com/Networking/support.
Electronic Publications
The latest version of each of the publications listed below is available in PDF
format on the HP Networking web site, as described in the Note at the top of
this page.
■Installation and Getting Started Guide—Explains how to prepare for
and perform the physical installation and connect the switch to your
network.
■Basic Operation Guide—Describes how to use the switch interfaces and
introduces basic operations.
■Management and Configuration Guide—Describes how to configure,
manage, and monitor basic switch operation.
■Advanced Traffic Management Guide—Explains how to configure traffic
management features such as VLANs, MSTP, QoS, and Meshing.
■Access Security Guide—Explains how to configure access security fea-
tures and user authentication on the switch.
■IPv6 Configuration Guide—Describes the IPv6 protocol operations that
are supported on the switch.
■Command Line Interface Reference Guide—Provides a comprehensive
description of CLI commands, syntax, and operations.
■Event Log Message Reference Guide—Provides a comprehensive descrip-
tion of event log messages.
■Release Notes—Describe new features, fixes, and enhancements that
become available between revisions of the main product guide.

6
Software Feature Index
For the software manual set supporting your series 2520 switch models, this
feature index indicates which manual to consult for information on a given
software feature.
Feature Management and
Configuration
AdvancedTraffic
Management
Access Security
Guide
Basic Operation
Guide
802.1Q VLAN Tagging - X--
802.1p Priority X---
802.1X Authentication - - X-
AAA Authentication X-
Authorized IP Managers - - X-
Auto MDIX Configuration X- - -
BOOTP X---
Config File -- - X
Console Access ---X
Copy Command X---
Debug X---
DHCP Configuration - X- -
DHCP/Bootp Operation X---
Diagnostic Tools X---
Downloading Software X---
Eavesdrop Protection X -
Event Log X---
Factory Default Settings - - - X
File Management X---

7
File Transfers X---
Friendly Port Names X ---
GVRP - X- -
IGMP - X--
Interface Access (Telnet,
Console/Serial, Web)
- - - X
IP Addressing - - - X
LACP X---
LLDP X---
LLDP-MED X
Loop Protection X
MAC Address Management X---
MAC Lockdown - - X-
MAC Lockout - - X-
MAC-based Authentication - - X-
Monitoring and Analysis X---
Multicast Filtering - X--
Network Management
Applications (LLDP, SNMP)
X---
Passwords - - X-
Ping X---
Port Configuration X---
Port Security - - X-
Port Status X---
Port Trunking (LACP) X---
Port-Based Access Control
(802.1X)
--X-
Feature Management and
Configuration
AdvancedTraffic
Management
Access Security
Guide
Basic Operation
Guide

8
Port-Based Priority (802.1Q) X---
Power over Ethernet (PoE)
Quality of Service (QoS) - X- -
RADIUS Authentication and
Accounting
--X-
Secure Copy X---
SFTP X---
SNMP X---
Software Downloads (SCP/SFTP,
TFTP, Xmodem)
X---
Spanning Tree (MSTP) -X- -
SSH (Secure Shell) Encryption - - X-
SSL (Secure Socket Layer) - - X-
Stack Management (Stacking) - X--
Syslog ----
System Information - - - X
TACACS+ Authentication - - X-
Telnet Access X---
TFTP X---
Time Protocols (TimeP, SNTP) X---
Troubleshooting X---
VLANs - X--
Web-based Authentication - - X-
Web UI - X
Feature Management and
Configuration
AdvancedTraffic
Management
Access Security
Guide
Basic Operation
Guide

1-1
1
IPv6 Addressing Configuration
Introduction
In the default configuration, IPv6 operation is disabled on the switch. This
section describes the general steps and individual commands for enabling
IPv6 operation.
This chapter provides the following:
■general steps for IPv6 configuration
■IPv6 command syntax descriptions, including show commands
Most IPv6 configuration commands are applied per-VLAN. The exceptions are
ICMP, ND (neighbor discovery), and the (optional) authorized-managers
feature, which are configured at the global configuration level. (ICMP and ND
for IPv6 are enabled with default values when IPv6 is first enabled, and can
either be left in their default settings or reconfigured, as needed.) For more
information on ICMP, refer to “View the Current IPv6 Addressing Configura-
tion” on page 1-17. For more on ND, refer to “Neighbor Discovery (ND)” on
page 1-12.
Note The switch is capable of operating in dual-stack mode, where IPv4 and IPv6
run concurrently on a given VLAN.
Feature Default CLI
Enable IPv6 with a Link-Local
Address
disabled 1-3
Configure Global Unicast
Autoconfig
disabled 1-4
Configure DHCPv6 Addressing disabled 1-6
Configure a Static Link-Local
Address
None 1-9
Configure a Static Global Unicast
Address
None 1-10
Change DAD Attempts 3 1-14
View Current IPv6 Addressing n/a 1-17

1-2
IPv6 Addressing Configuration
General Configuration Steps
General Configuration Steps
The IPv6 configuration includes global and per-VLAN settings. This section
provides an overview of the general configuration steps for enabling IPv6 on
a given VLAN and can be enabled by any one of several commands. The
following steps provide a suggested progression for getting started.
Note The ICMP and Neighbor Discovery (ND) parameters are set to default values
at the global configuration level are satisfactory for many applications and
generally do not need adjustment when you are first configuring IPv6 on the
switch.
In the default configuration, IPv6 is disabled on all VLANs.
1. If IPv6 DHCP service is available, enable IPv6 DHCP on the VLAN. If IPv6
is not already enabled on the VLAN, enabling DHCPv6 also enables IPv6
and automatically configures a link-local address using the EUI-64 format.
Note If IPv6 is not already enabled on the VLAN, enabling DHCPv6 causes the
switch to automatically generate a link-local address. DHCPv6 does not assign
a link-local address.
A DHCPv6 server can provide other services, such as the addresses of
time servers. For this reason you may want to enable DHCP even if you
are using another method to configure IPv6 addressing on the VLAN.
2. If IPv6 DHCP service is not enabled on the VLAN, then either:
• Enable IPv6 on the VLAN. This automatically configures a link-local
address with an EUI- 64 interface identifier.
• Statically configure a unicast IPv6 address on the VLAN. This enables
IPv6 on the VLAN and, if you configure anything other than a link-
local address, the link-local address will be automatically configured
as well, with an EUI-64 interface identifier.
3. If an IPv6 router is connected on the VLAN, then enable IPv6 address
autoconfiguration to automatically configure global unicast addresses
with prefixes included in advertisements received from the router. The
device identifier used in addresses configured by this method will be the
same as the device identifier in the current link-local address.
4. If needed, statically configure IPv6 unicast addressing on the VLAN
interface as needed. This can include any of the following:
• statically replacing the automatically generated link-local address
• statically adding global unicast, and/or unique local unicast addresses

1-3
IPv6 Addressing Configuration
Configuring IPv6 Addressing
Configuring IPv6 Addressing
In the default configuration on a VLAN, any one of the following commands
enables IPv6 and creates a link-local address. Thus, while any one of these
methods is configured on a VLAN, IPv6 remains enabled and a link-local
address is present:
ipv6 enable (page 1-3)
ipv6 address autoconfig (page 1-4)
ipv6 address dhcp full [rapid-commit] (page 1-6)
ipv6 address fe80:0:0:0:< device-identifier > link-local (page 1-9)
ipv6 address <prefix:device-identifier > (page 1-10)
Note Addresses created by any of these methods remain tentative until verified as
unique by Duplicate Address Detection. (Refer to “Duplicate Address Detec-
tion (DAD)” on page 1-14.)
Enabling IPv6 with an Automatically
Configured Link-Local Address
This command enables automatic configuration of a link-local address.
Syntax: [no] ipv6 enable
If IPv6 has not already been enabled on a VLAN by another
IPv6 command option described in this chapter, this command
enables IPv6 on the VLAN and automatically configures the
VLAN's link-local unicast address with a 64-bit EUI-64 inter-
face identifier generated from the VLAN MAC address. (Refer
to “Disabling IPv6 on a VLAN” on page 1-12.).
Note: Only one link-local IPv6 address is allowed on the
VLAN interface. Subsequent static or DHCP configuration
of another link-local address overwrites the existing link-
local address.

1-4
IPv6 Addressing Configuration
Enabling Autoconfiguration of a Global Unicast Address and a Default Router Identity on a VLAN
To view the current IPv6 Enable setting and any statically configured IPv6
addresses per-VLAN, use show run.
To view all currently configured IPv6 unicast addresses, use the following:
■show ipv6 (Lists IPv6 addresses for all VLANs configured on the switch.)
■show ipv6 vlan < vid > (Lists IPv6 addresses configured on the VLAN.)
For more information, refer to “View the Current IPv6 Addressing Configura-
tion” on page 1-17.
Enabling Autoconfiguration of a
Global Unicast Address and a Default
Router Identity on a VLAN
Enabling autoconfig or rebooting the switch with autoconfig enabled on a
VLAN causes the switch to configure IPv6 addressing on the VLAN using
router advertisements and an EUI-64 interface identifier (page 1-12).
A link-local address always uses the prefix fe80:0:0:0.
With IPv6 enabled, the VLAN uses received router advertise-
ments to designate the default IPv6 router. (Refer to “Default
IPv6 Router” on page 1-24.)
After verification of uniqueness by DAD, a link-local IPv6
address assigned automatically is set to the preferred status,
with a “permanent” lifetime. (Refer to “View the Current IPv6
Addressing Configuration” on page 1-17.)
Default: Disabled
The no form of the command disables IPv6 on the VLAN if no
other IPv6-enabling command is configured on the VLAN.
(Refer to “Disabling IPv6 on a VLAN” on page 1-12.)
Syntax: [no] ipv6 address autoconfig

1-5
IPv6 Addressing Configuration
Enabling Autoconfiguration of a Global Unicast Address and a Default Router Identity on a VLAN
To view the current IPv6 autoconfiguration settings per-VLAN, use show run.
Implements unicast address autoconfiguration as follows:
■If IPv6 is not already enabled on the VLAN, this command
enables IPv6 and generates a link-local (EUI- 64) address.
■Generates router solicitations (RS) on the VLAN.
■If a router advertisement (RA) is received on the VLAN,
the switch uses the route prefix in the RA to configure a
global unicast address. The device identifier for this
address will be the same as the device identifier used in
the current link-local address at the time the RA is
received. (This can be either a statically configured or the
(automatic) EUI-64 device identifier, depending on how
the link-local address was configured.) For information
on EUI- 64, refer to “Disabling IPv6 on a VLAN” on page 1-
12.) If an RA is not received on the VLAN after autoconfig
is enabled, a link-local address will be present, but no
global unicast addresses will be autoconfigured.
Notes: If a link-local address is already configured on the
VLAN, a later, autoconfigured global unicast address uses
the same device identifier as the link-local address.
Autoconfigured and DHCPv6-assigned global unicast
addresses with the same prefix are mutually exclusive on
a VLAN. On a given switch, if both options are configured
on the same VLAN, then only the first to acquire a global
unicast address will be used.
After verification of uniqueness by DAD, an IPv6 address
assigned to a VLAN by autoconfiguration is set to the preferred
and valid lifetimes specified by the RA used to generate the
address, and is configured as a preferred address. (Refer to
“View the Current IPv6 Addressing Configuration” on page 1-
17.)
Default: Disabled.
The no form of the command produces different results,
depending on how IPv6 is configured on the VLAN:
If IPv6 was enabled only by the autoconfig command, then
deleting this command disables IPv6 on the VLAN. (Refer to
“Disabling IPv6 on a VLAN” on page 1-12.)

1-6
IPv6 Addressing Configuration
Enabling DHCPv6
To view all currently configured IPv6 unicast addresses, use the following:
■show ipv6 (Lists IPv6 addresses for all VLANs configured on the switch.)
■show ipv6 vlan < vid > (Lists IPv6 addresses configured on the VLAN.)
For more information, refer to “View the Current IPv6 Addressing Configura-
tion” on page 1-17.
Operating Notes
With IPv6 enabled, the VLAN uses received router advertisements to designate
the default IPv6 router. (Refer to “Router Access and Default Router Selection”
on page 1-23.)
Enabling DHCPv6
Enabling the DHCPv6 option on a VLAN allows the switch to obtain a global
unicast address and an NTP (network time protocol) server assignment for a
Timep server. (If a DHCPv6 server is not needed to provide a global unicast
address to a switch interface, the server can still be configured to provide the
NTP server assignment. This is sometimes referred to as “stateless DHCPv6”.)
Syntax: [no] ipv6 address dhcp full [rapid-commit]

1-7
IPv6 Addressing Configuration
Enabling DHCPv6
To view the current IPv6 DHCPv6 settings per-VLAN, use show run.
This option configures DHCPv6 on a VLAN, which initiates
transmission of DHCPv6 requests for service. If IPv6 is not
already enabled on the VLAN by the ipv6 enable command, this
option also enables IPv6 and causes the switch to autocon-
figure a link-local unicast address with an EUI-64 interface
identifier.
Notes: A DHCPv6 server does not assign link-local
addresses, and enabling DHCPv6 on a VLAN does not
affect a pre-existing link-local address configured on the
VLAN.
A DHCPv6-assigned address can be configured on a VLAN
when the following is true:
• The assigned address is not on the same subnet as a
previously configured autoconfig address.
• The maximum IPv6 address limit on the VLAN or the
switch has not been reached.
If a DHCPv6 server responds with an IPv6 address assign-
ment, this address is assigned to the VLAN. (The DHCPv6-
assigned address will be dropped if it has the same subnet as
another address already assigned to the VLAN by an earlier
autoconfig command.)
After verification of uniqueness by DAD, an IPv6 address
assigned to the VLAN by an DHCPv6 server is set to the
preferred and valid lifetimes specified in a router advertise-
ment received on the VLAN for the prefix used in the assigned
address, and is configured as a preferred address. (Refer to
the section titled “Address Lifetimes” on page 1-28.)
[rapid-commit]: Expedites DHCP configuration by using a two-
message exchange with the server (solicit-reply) instead of the
default four-message exchange (solicit-advertise- request-
reply).
Default: Disabled
The no form of the command removes the DHCPv6 option from
the configuration and, if no other IPv6-enabling command is
configured on the VLAN, disables IPv6 on the VLAN. (Refer to
“Disabling IPv6 on a VLAN” on page 1-12.)

1-8
IPv6 Addressing Configuration
Enabling DHCPv6
To view all currently configured IPv6 unicast addresses, use the following:
■show ipv6 (Lists IPv6 addresses for all VLANs configured on the switch.)
■show ipv6 vlan < vid > (Lists IPv6 addresses configured on the VLAN.)
For more information, refer to “View the Current IPv6 Addressing Configura-
tion” on page 1-17.
Operating Notes
■If multiple DHCPv6 servers are available, the switch selects a server based
on the preference value sent in DHCPv6 messages from the servers.
■The switch supports both DHCPv4 and DHCPv6 client operation on the
same VLAN.
■DHCPv6 authentication and stateless DHCPv6 are not supported.
■With IPv6 enabled, the switch determines the default IPv6 router for the
VLAN from the router advertisements it receives. (Refer to “Default IPv6
Router” on page 1-24.)
■DHCPv6 and statically configured global unicast addresses are mutually
exclusive on a given VLAN. That is, configuring DHCPv6 on a VLAN erases
any static global unicast addresses previously configured on that VLAN,
and the reverse. (A statically configured link-local address will not be
affected by configuring DHCPv6 on the VLAN.)
■For the same subnet on the switch, a DHCPv6 global unicast address
assignment takes precedence over an autoconfigured address assign-
ment, regardless of which address type was the first to be configured. If
DHCPv6 is subsequently removed from the configuration, then an auto-
configured address assignment will replace it after the next router adver-
tisement is received on the VLAN. DHCPv6 and autoconfigured addresses
co-exist on the same VLAN if they belong to different subnets.
For related information refer to:
■RFC 3315: “Dynamic Host Configuration Protocol for IPv6 (DHCPv6)”
■RFC 3633: “IPv6 Prefix Options for Dynamic Host Configuration Protocol
(DHCP) version 6”
■RFC 3736: “Stateless Dynamic Host Configuration Protocol (DHCP)
Service for IPv6”