Hp 6125xlg User manual

HP 6125XLG Blade Switch

Network Management and Monitoring

Configuration Guide

Part number: 5998-3725

Software version: Release 2306

Document version: 6W100-20130912

Legal and notice information

No part of this documentation may be reproduced or transmitted in any form or by any means without

prior written consent of Hewlett-Packard Development Company, L.P.

The information contained herein is subject to change without notice.

HEWLETT-PACKARD COMPANY MAKES NO WARRANTY OF ANY KIND WITH REGARD TO THIS

MATERIAL, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY

AND FITNESS FOR A PARTICULAR PURPOSE. Hewlett-Packard shall not be liable for errors contained

herein or for incidental or consequential damages in connection with the furnishing, performance, or

use of this material.

The only warranties for HP products and services are set forth in the express warranty statements

accompanying such products and services. Nothing herein should be construed as constituting an

additional warranty. HP shall not be liable for technical or editorial errors or omissions contained

herein.

Contents

Using ping, tracert, and system debugging··············································································································· 1

Ping·····················································································································································································1

Using a ping command to test network connectivity ····························································································1

Ping example ····························································································································································1

Tracert ················································································································································································3

Prerequisites ······························································································································································4

Using a tracert command to identify failed or all nodes in a path·····································································4

Tracert example························································································································································4

System debugging ····························································································································································5

Debugging information control switches················································································································6

Debugging a feature module ··································································································································6

Configuring NTP ·························································································································································· 8

Overview············································································································································································8

How NTP works························································································································································8

NTP architecture ·······················································································································································9

Association modes ················································································································································ 10

NTP security ··························································································································································· 12

Protocols and standards ······································································································································· 13

Configuration restrictions and guidelines···················································································································· 13

Configuration task list ···················································································································································· 13

Enabling the NTP service ·············································································································································· 13

Configuring NTP association modes···························································································································· 13

Configuring NTP in client/server mode·············································································································· 14

Configuring NTP in symmetric active/passive mode ························································································ 14

Configuring NTP in broadcast mode ·················································································································· 15

Configuring NTP in multicast mode····················································································································· 16

Configuring access control rights································································································································· 17

Configuring NTP authentication ··································································································································· 17

Configuring NTP authentication in client/server mode····················································································· 17

Configuring NTP authentication in symmetric active/passive mode ······························································· 19

Configuring NTP authentication in broadcast mode ························································································· 21

Configuring NTP authentication in multicast mode ··························································································· 23

Configuring NTP optional parameters························································································································· 25

Specifying the source interface for NTP messages ···························································································· 25

Disabling an interface from receiving NTP messages······················································································· 26

Configuring the maximum number of dynamic associations············································································ 26

Configuring the local clock as a reference source ····································································································· 27

Displaying and maintaining NTP ································································································································· 27

NTP client/server mode configuration example ········································································································· 28

IPv6 NTP client/server mode configuration example································································································· 29

NTP symmetric active/passive mode configuration example ··················································································· 30

IPv6 NTP symmetric active/passive mode configuration example··········································································· 32

NTP broadcast mode configuration example ············································································································· 34

NTP multicast mode configuration example················································································································ 36

IPv6 NTP multicast mode configuration example ······································································································· 39

Configuration example for NTP client/server mode with authentication································································· 42

Configuration example for NTP broadcast mode with authentication····································································· 44

Configuring SNTP ······················································································································································48

Enabling the SNTP service ············································································································································ 48

Specifying an NTP server for the device ····················································································································· 48

Configuring SNTP authentication ································································································································· 49

Displaying and maintaining SNTP ······························································································································· 50

SNTP configuration example ········································································································································ 50

Configuring the information center···························································································································52

Log types ································································································································································ 52

Log levels································································································································································ 52

Log destinations ····················································································································································· 53

Default log output rules········································································································································· 53

Log format ······························································································································································ 53

Information center configuration task list····················································································································· 55

Outputting logs to the console ······································································································································ 56

Outputting logs to the monitor terminal ······················································································································· 56

Outputting logs to a log host ········································································································································ 57

Outputting logs to the log buffer ·································································································································· 57

Saving logs to the log file·············································································································································· 58

Managing security logs················································································································································· 59

Saving security logs into the security log file······································································································ 60

Managing the security log file ····························································································································· 60

Enabling synchronous information output ··················································································································· 61

Enabling duplicate log suppression ····························································································································· 61

Disabling an interface from generating link up/down logging information ··························································· 62

Displaying and maintaining information center ········································································································· 62

Configuration example for outputting logs to the console························································································· 63

Configuration example for outputting logs to a UNIX log host················································································· 63

Configuration example for outputting logs to a Linux log host ················································································· 65

Configuring SNMP·····················································································································································67

FIPS compliance ····························································································································································· 67

SNMP framework·················································································································································· 67

MIB and view-based MIB access control ············································································································ 67

SNMP operations ·················································································································································· 68

Protocol versions···················································································································································· 68

Configuring SNMP basic parameters·························································································································· 68

Configuring SNMPv1 or SNMPv2c basic parameters······················································································ 69

Configuring SNMPv3 basic parameters············································································································· 70

Configuring SNMP logging ·········································································································································· 73

Configuring SNMP notifications··································································································································· 74

Enabling SNMP notifications ······························································································································· 74

Configuring the SNMP agent to send notifications to a host ··········································································· 75

Displaying the SNMP settings······································································································································· 76

SNMPv1/SNMPv2c configuration example··············································································································· 77

SNMPv3 configuration example ·································································································································· 78

Configuring NQA ······················································································································································81

Collaboration························································································································································· 81

Threshold monitoring ············································································································································ 82

NQA client configuration task list ································································································································ 82

iii

Enabling the NQA client··············································································································································· 82

Configuring the ICMP echo operation························································································································· 83

Configuring the UDP echo operation··························································································································· 84

Configuring optional parameters for the NQA operation························································································· 85

Configuring the collaboration function ························································································································ 85

Configuring threshold monitoring································································································································· 86

Threshold types······················································································································································ 86

Triggered actions··················································································································································· 86

Reaction entry ························································································································································ 86

Configuration procedure ······································································································································ 87

Configuring the NQA statistics collection function····································································································· 87

Configuring the saving of NQA history records········································································································· 88

Scheduling the NQA operation on the NQA client··································································································· 88

Displaying and maintaining NQA······························································································································· 89

NQA configuration examples ······································································································································ 90

ICMP echo operation configuration example ···································································································· 90

UDP echo operation configuration example ······································································································ 91

NQA collaboration configuration example········································································································ 93

Configuring sFlow······················································································································································96

sFlow configuration task list ·········································································································································· 96

Configuring the sFlow agent and sFlow collector information·················································································· 97

Configuring flow sampling············································································································································ 97

Configuring counter sampling ······································································································································ 98

Displaying and maintaining sFlow······························································································································· 98

sFlow configuration example········································································································································ 99

Network requirements··········································································································································· 99

Verifying the configurations ·······························································································································100

Troubleshooting sFlow configuration ·························································································································100

The remote sFlow collector cannot receive sFlow packets ··············································································100

Monitoring and maintaining processes················································································································· 101

Displaying and maintaining processes······················································································································101

Displaying and maintaining user processes··············································································································101

Monitoring kernel threads ···········································································································································102

Configuring kernel thread deadloop detection································································································102

Configuring kernel thread starvation detection································································································102

Displaying and maintaining kernel threads······································································································103

Configuring port mirroring ····································································································································· 104

Terminology ·························································································································································104

Port mirroring classification and implementation·····························································································105

Configuring local port mirroring ································································································································106

Local port mirroring configuration task list ·······································································································106

Creating a local mirroring group ······················································································································106

Configuring source ports for the local mirroring group ··················································································107

Configuring the monitor port for the local mirroring group············································································107

Using the remote probe VLAN to enable local port mirroring to support multiple monitor ports···············108

Configuring Layer 2 remote port mirroring ···············································································································110

Layer 2 remote port mirroring configuration task list ······················································································110

Configuring a remote destination group on the destination device ······························································110

Configuring a remote source group on the source device ·············································································112

Displaying and maintaining port mirroring···············································································································114

Local port mirroring configuration example··············································································································114

Verifying the configuration·································································································································115

Local port mirroring with multiple monitor ports configuration example ·······························································116

Layer 2 remote port mirroring configuration example ·····························································································117

Configuring traffic mirroring ·································································································································· 120

Traffic mirroring configuration task list ······················································································································120

Configuring match criteria ··········································································································································120

Configuring a traffic behavior ····································································································································121

Configuring a QoS policy···········································································································································121

Applying a QoS policy ···············································································································································121

Applying a QoS policy to an interface·············································································································121

Applying a QoS policy to a VLAN····················································································································122

Applying a QoS policy globally························································································································122

Applying a QoS policy to the control plane ····································································································122

Traffic mirroring configuration example ····················································································································123

Support and other resources ·································································································································· 125

Contacting HP ······························································································································································125

Subscription service ············································································································································125

Related information······················································································································································125

Documents····························································································································································125

Websites·······························································································································································125

Conventions ··································································································································································126

Index ········································································································································································ 128

Using ping, tracert, and system debugging

This chapter covers ping, tracert, and information about debugging the system.

Ping

Use the ping utility to determine if a specific address is reachable.

Ping sends ICMP echo requests (ECHO-REQUEST) to the destination device. Upon receiving the requests,

the destination device responds with ICMP echo replies (ECHO-REPLY) to the source device. The source

device outputs statistics about the ping operation, including the number of packets sent, number of echo

replies received, and the round-trip time. You can measure the network performance by analyzing these

statistics.

Using a ping command to test network connectivity

Execute ping commands in any view.

Task Command

Determine if a specified address in an IP

network is reachable.

When you configure the ping command for a low-speed

network, set a larger value for the timeout timer (indicated by the

-t keyword in the command).

•For IPv4 networks:

ping [ ip ] [ -a source-ip | -c count | -f | -httl | -i

interface-type interface-number | -m interval | -n | -p pad |

-q | -r | -s packet-size | -t timeout | -tos tos | -v |

-vpn-instance vpn-instance-name ] * host

•For IPv6 networks:

ping ipv6 [ -a source-ipv6 | -c count | -m interval |-q|-s

packet-size | -t timeout | -v | -vpn-instance

vpn-instance-name ] * host [ -i interface-type

interface-number ]

Ping example

Network requirements

As shown in Figure 1, determine if Device A and Device C can reach each other. If they can reach each

other, get detailed information about routes from Device A to Device C.

Figure 1 Network diagram

Configuration procedure

# Use the ping command on Device A to test connectivity to Device C.

PING 1.1.2.2 (1.1.2.2): 56 data bytes, press CTRL_C to break

56 bytes from 1.1.2.2: icmp_seq=0 ttl=254 time=2.137 ms

56 bytes from 1.1.2.2: icmp_seq=1 ttl=254 time=2.051 ms

56 bytes from 1.1.2.2: icmp_seq=2 ttl=254 time=1.996 ms

56 bytes from 1.1.2.2: icmp_seq=3 ttl=254 time=1.963 ms

56 bytes from 1.1.2.2: icmp_seq=4 ttl=254 time=1.991 ms

--- 1.1.2.2 ping statistics ---

5 packet(s) transmitted, 5 packet(s) received, 0.0% packet loss

round-trip min/avg/max/std-dev = 1.963/2.028/2.137/0.062 ms

The output shows that Device A sends five ICMP packets to Device C and Device A receives five ICMP

packets, no ICMP packet is lost, and the route is reachable.

# Get detailed information about routes from Device A to Device C.

<DeviceA> ping -r 1.1.2.2

PING 1.1.2.2 (1.1.2.2): 56 data bytes, press CTRL_C to break

56 bytes from 1.1.2.2: icmp_seq=0 ttl=254 time=4.685 ms

RR: 1.1.2.1

1.1.2.2

1.1.1.2

1.1.1.1

56 bytes from 1.1.2.2: icmp_seq=1 ttl=254 time=4.834 ms (same route)

56 bytes from 1.1.2.2: icmp_seq=2 ttl=254 time=4.770 ms (same route)

56 bytes from 1.1.2.2: icmp_seq=3 ttl=254 time=4.812 ms (same route)

56 bytes from 1.1.2.2: icmp_seq=4 ttl=254 time=4.704 ms (same route)

--- 1.1.2.2 ping statistics ---

5 packet(s) transmitted, 5 packet(s) received, 0.0% packet loss

round-trip min/avg/max/std-dev = 4.685/4.761/4.834/0.058 ms

The test procedure of ping –r is as shown in Figure 1:

1. The source device (Device A) sends an ICMP echo request to the destination device (Device C)

with the RR option blank.

2. The intermediate device (Device B) adds the IP address of its outbound interface (1.1.2.1) to the RR

option of the ICMP echo request, and forwards the packet.

3. Upon receiving the request, the destination device copies the RR option in the request and adds the

IP address of its outbound interface (1.1.2.2) to the RR option. Then the destination device sends

an ICMP echo reply.

4. The intermediate device adds the IP address of its outbound interface (1.1.1.2) to the RR option in

the ICMP echo reply, and then forwards the reply.

5. Upon receiving the reply, the source device adds the IP address of its inbound interface (1.1.1.1)

to the RR option. The detailed information of routes from Device A to Device C is formatted as:

1.1.1.1 <-> {1.1.1.2; 1.1.2.1} <-> 1.1.2.2.

Tracert

Tracert (also called "Traceroute") enables retrieval of the IP addresses of Layer 3 devices in the path to a

specific destination. In the event of network failure, use tracert to test network connectivity and identify

failed nodes.

Figure 2 Tracert operation

Tracert uses received ICMP error messages to get the IP addresses of devices. Tracert works as shown

in Figure 2:

1. The source device sends a UDP packet with a TTL value of 1 to the destination device. The

destination UDP port is not used by any application on the destination device.

2. The first hop (Device B, the first Layer 3 device that receives the packet) responds by sending a

TTL-expired ICMP error message to the source, with its IP address (1.1.1.2) encapsulated. This

way, the source device can get the address of the first Layer 3 device (1.1.1.2).

3. The source device sends a packet with a TTL value of 2 to the destination device.

4. The second hop (Device C) responds with a TTL-expired ICMP error message, which gives the

source device the address of the second Layer 3 device (1.1.2.2).

5. This process continues until a packet sent by the source device reaches the ultimate destination

device. Because no application uses the destination port specified in the packet, the destination

device responds with a port-unreachable ICMP message to the source device, with its IP address

encapsulated. This way, the source device gets the IP address of the destination device (1.1.3.2).

Device A Device B Device DDevice C

1.1.1.1/24

1.1.1.2/24

Hop Lmit=1

TTL exceeded

1.1.2.1/24 1.1.3.1/24

1.1.2.2/24 1.1.3.2/24

Hop Lmit=2

TTL exceeded

UDP port unreachable

Hop Lmit=n

6. The source device thinks that the packet has reached the destination device after receiving the

port-unreachable ICMP message, and the path to the destination device is 1.1.1.2 to 1.1.2.2 to

1.1.3.2.

Prerequisites

Before you use a tracert command, perform the tasks in this section.

For an IPv4 network:

•Enable sending of ICMP timeout packets on the intermediate devices (devices between the source

and destination devices). If the intermediate devices are HP devices, execute the ip ttl-expires

enable command on the devices. For more information about this command, see Layer 3—IP

Services Command Reference.

•Enable sending of ICMP destination unreachable packets on the destination device. If the

destination device is an HP device, execute the ip unreachables enable command. For more

information about this command, see Layer 3—IP Services Command Reference.

For an IPv6 network:

•Enable sending of ICMPv6 timeout packets on the intermediate devices (devices between the

source and destination devices). If the intermediate devices are HP devices, execute the ipv6

hoplimit-expires enable command on the devices. For more information about this command, see

Layer 3—IP Services Command Reference.

•Enable sending of ICMPv6 destination unreachable packets on the destination device. If the

destination device is an HP device, execute the ipv6 unreachables enable command. For more

information about this command, see Layer 3—IP Services Command Reference.

Using a tracert command to identify failed or all nodes in a

path

Execute tracert commands in any view.

Task Command

Display the routes from source to

destination.

•For IPv4 networks:

tracert [ -a source-ip | -f first-ttl |-m max-ttl | -p port | -q packet-number

| -vpn-instance vpn-instance-name |-w timeout ] * host

•For IPv6 networks:

tracert ipv6 [ -f first-hop| -m max-hops | -p port | -q packet-number |

-vpn-instance vpn-instance-name | -w timeout ] * host

Tracert example

Network requirements

As shown in Figure 3, Device A failed to Telnet Device C.

Test the network connectivity between Device A and Device C. If they cannot reach each other, locate the

failed nodes in the network.

Figure 3 Network diagram

Configuration procedure

1. Use the ping command to test connectivity between Device A and Device C.

<DeviceA> ping 1.1.2.2

PING 1.1.2.2(1.1.2.2): 56 -data bytes, press CTRL_C to break

Request time out

--- 1.1.2.2 ping statistics ---

5 packet(s) transmitted,0 packet(s) received,100.0% packet loss

The output shows that Device A and Device C cannot reach each other.

2. Use the tracert command to identify failed nodes:

# Enable sending of ICMP timeout packets on Device B.

<DeviceB> system-view

[DeviceB] ip ttl-expires enable

# Enable sending of ICMP destination unreachable packets on Device C.

<DeviceC> system-view

[DeviceC] ip unreachables enable

# Execute the tracert command on Device A.

<DeviceA> tracert 1.1.2.2

traceroute to 1.1.2.2(1.1.2.2) 30 hops at most,40 bytes each packet, press CTRL_C to

break

1 1.1.1.2 14 ms 10 ms 20 ms

2 * * *

3 * * *

4 * * *

The output shows that Device A and Device C cannot reach each other, Device A and Device B can

reach each other, and an error has occurred on the connection between Device B and Device C.

3. Use the debugging ip icmp command on Device A and Device C to verify that they can send and

receive the specific ICMP packets, or use the display ip routing-table command to verify the

connectivity between Device A and Device C.

System debugging

The device supports debugging for the majority of protocols and features and provides debugging

information to help users diagnose errors.

Device A Device B Device C

1.1.1.1/24 1.1.1.2/24 1.1.2.1/24 1.1.2.2/24

Debugging information control switches

The following switches control the display of debugging information:

•Module debugging switch—Controls whether to generate the module-specific debugging

information.

•Screen output switch—Controls whether to display the debugging information on a certain screen.

Use terminal monitor and terminal logging level commands to turn on the screen output switch. For

more information about these two commands, see Network Management and Monitoring

Command Reference.

As shown in Figure 4, assume that the device can provide debugging for the three modules 1, 2, and 3.

The debugging information can be output on a terminal only when both the module debugging switch

and the screen output switch are turned on.

Debugging information is typically displayed on a console. You can also send debugging information to

other destinations. For more information, see "Configuring the information center."

Figure 4 Relationship between the module and screen output switch

Debugging a feature module

Output of debugging commands is memory intensive. To guarantee system performance, enable

debugging only for modules that are in an exceptional condition. When debugging is complete, use the

undo debugging all command to disable all the debugging functions.

To debug a feature module:

Ste

Command

Remarks

1. Enable debugging for a

specified module in user view.

debugging { all [ timeout time ] |

module-name [ option ] }

By default, all debugging functions

are disabled.

2. (Optional.) Display the

enabled debugging in any

view.

display debugging

[module-name ] N/A

Configuring NTP

Synchronize your device with a trusted time source by using the Network Time Protocol (NTP) or

changing the system time before you run it on a live network. Various tasks, including network

management, charging, auditing, and distributed computing depend on an accurate system time setting,

because the timestamps of system messages and logs use the system time.

Overview

NTP is typically used in large networks to dynamically synchronize time among network devices. It

guarantees higher clock accuracy than manual system clock setting. In a small network that does not

require high clock accuracy, you can keep time synchronized among devices by changing their system

clocks one by one.

NTP runs over UDP and uses UDP port 123.

How NTP works

Figure 5 shows how NTP synchronizes the system time between two devices, in this example, Device A

and Device B. Assume that:

•Prior to the time synchronization, the time of Device A is set to 10:00:00 am and that of Device B

is set to 11:00:00 am.

•Device B is used as the NTP server. Device A is to be synchronized to Device B.

•It takes 1 second for an NTP message to travel from Device A to Device B, and from Device B to

Device A.

•It takes 1 second for Device B to process the NTP message.

Figure 5 Basic work flow

The synchronization process is as follows:

1. Device A sends Device B an NTP message, which is timestamped when it leaves Device A. The

time stamp is 10:00:00 am (T1).

2. When this NTP message arrives at Device B, Device B adds a timestamp showing the time when

the message arrived at Device B. The timestamp is 11:00:01 am (T2).

3. When the NTP message leaves Device B, Device B adds a timestamp showing the time when the

message left Device B. The timestamp is 11:00:02 am (T3).

4. When Device A receives the NTP message, the local time of Device A is 10:00:03 am (T4).

Up to now, Device A can calculate the following parameters based on the timestamps:

•The roundtrip delay of the NTP message: Delay = (T4–T1) – (T3-T2) = 2 seconds.

•Time difference between Device A and Device B: Offset = ((T2-T1) + (T3-T4)) /2 = 1 hour.

Based on these parameters, Device A can be synchronized to Device B.

This is only a rough description of the work mechanism of NTP. For more information, see the related

protocols and standards.

NTP architecture

NTP uses stratums 1 to 16 to define clock accuracy, as shown in Figure 6. A lower stratum value

represents higher accuracy. Clocks at stratums 1 through 15 are in synchronized state, and clocks at

stratum 16 are not synchronized.

Figure 6 NTP architecture

Typically, a stratum 1 NTP server gets its time from an authoritative time source, such as an atomic clock,

and provides time for other devices as the primary NTP server. The accuracy of each server is the stratum,

with the topmost level (primary servers) assigned as one and each level downwards (secondary servers)

in the hierarchy assigned as one greater than the preceding level. NTP uses a stratum to describe how

many NTP hops away a device is from the primary time server. A stratum 2 time server receives its time

from a stratum 1 time server, and so on.

Primary servers

(Stratum 1)

Authoritative

clock

Server

Secondary servers

(Stratum 2)

Tertiary servers

(Stratum 3)

Quaternary servers

(Stratum 4)

Client Symmetric

peer

Symmetric

peer

Broadcast/multicast

server

Broadcast/multicast

client

To ensure time accuracy and availability, you can specify multiple NTP servers for a device. The device

selects an optimal NTP server as the clock source based on parameters such as stratum. The clock that

the device selects is called the reference source. For more information about clock selection, see the

related protocols and standards.

If the devices in a network cannot synchronize to an authoritative time source, you can select a device that

has a relatively accurate clock from the network, and use the local clock of the device as the reference

clock to synchronize other devices in the network.

Association modes

NTP supports the following association modes:

•Client/server mode

•Symmetric active/passive mode

•Broadcast mode

•Multicast mode

Table 1 NTP association modes

Mode Workin

rocess

Princi

lication scenario

Client/server

On the client, specify the IP

address of the NTP server.

A client sends a clock

synchronization message to the

NTP servers. Upon receiving the

message, the servers

automatically operate in server

mode and send a reply.

If the client can be synchronized

to multiple time servers, it selects

an optimal clock and

synchronizes its local clock to the

optimal reference source after

receiving the replies from the

servers.

A client can be

synchronized to a server,

but a server cannot be

synchronized to a client.

As Figure 6 shows, this

mode is intended for

configurations where

devices of a higher stratum

are synchronized to

devices with a lower

stratum.

Mode Workin

rocess

Princi

lication scenario

Symmetric

active/passive

On the symmetric active peer,

specify the IP address of the

symmetric passive peer.

A symmetric active peer

periodically sends clock

synchronization messages to a

symmetric passive peer. The

symmetric passive peer

automatically operates in

symmetric passive mode and

sends a reply.

If the symmetric active peer can

be synchronized to multiple time

servers, it selects an optimal clock

and synchronizes its local clock to

the optimal reference source after

receiving the replies from the

servers.

A symmetric active peer

and a symmetric passive

peer can be

synchronized to each

other. If both of them are

synchronized, the peer

with a higher stratum is

synchronized to the peer

with a lower stratum.

As Figure 6 shows, this

mode is most often used

between two or more

servers with the same

stratum to operate as a

backup for one another. If

a server fails to

communicate with all the

servers of a higher stratum,

the server can be

synchronized to the servers

of the same stratum.

Broadcast

A server periodically sends clock

synchronization messages to the

broadcast address

255.255.255.255. Clients listen

to the broadcast messages from

the servers to synchronize to the

server according to the broadcast

messages.

When a client receives the first

broadcast message, the client and

the server start to exchange

messages to calculate the network

delay between them. Then, only

the broadcast server sends clock

synchronization messages.

A broadcast client can

be synchronized to a

broadcast server, but a

broadcast server cannot

be synchronized to a

broadcast client.

A broadcast server sends

clock synchronization

messages to synchronize

clients in the same subnet.

As Figure 6 shows,

broadcast mode is

intended for configurations

involving one or a few

servers and a potentially

large client population.

The broadcast mode has a

lower time accuracy than

the client/server and

symmetric active/passive

modes because only the

broadcast servers send

clock synchronization

messages.

Multicast

A multicast server periodically

sends clock synchronization

messages to the user-configured

multicast address. Clients listen to

the multicast messages from

servers and synchronize to the

server according to the received

messages.

A multicast client can be

synchronized to a

multicast server, but a

multicast server cannot

be synchronized to a

multicast client.

A multicast server can

provide time

synchronization for clients

in the same subnet or in

different subnets.

The multicast mode has a

lower time accuracy than

the client/server and

symmetric active/passive

modes.

In this document, an "NTP server" or a "server" refers to a device that operates as an NTP server in

client/server mode. Time servers refer to all the devices that can provide time synchronization, including

NTP servers, NTP symmetric peers, broadcast servers, and multicast servers.

NTP security

To improve time synchronization security, NTP provides the access control and authentication functions.

NTP access control

You can control NTP access by using an ACL. The access rights are in the following order, from least

restrictive to most restrictive:

•Peer—Allows time requests and NTP control queries (such as alarms, authentication status, and time

server information) and allows the local device to synchronize itself to a peer device.

•Server—Allows time requests and NTP control queries, but does not allow the local device to

synchronize itself to a peer device.

•Synchronization—Allows only time requests from a system whose address passes the access list

criteria.

•Query—Allows only NTP control queries from a peer device to the local device.

The device processes an NTP request, as follows:

•If no NTP access control is configured, peer is granted to the local device and peer devices.

•If the IP address of the peer device matches a permit statement in an ACL for more than one access

right, the least restrictive access right is granted to the peer device. If a deny statement or no ACL is

matched, no access right is granted.

•If no ACL is created for a specific access right, the associated access right is not granted.

•If no ACL is created for any access right, peer is granted.

This feature provides minimal security for a system running NTP. A more secure method is NTP

authentication.

NTP authentication

Use this feature to authenticate the NTP messages for security purposes. If an NTP message passes

authentication, the device can receive it and get time synchronization information. If not, the device

discards the message. This function makes sure the device does not synchronize to an unauthorized time

server.

Figure 7 NTP authentication

As shown in Figure 7, NTP authentication works as follows:

1. The sender uses the MD5 algorithm to calculate the NTP message according to the key identified

by a key ID, and sends the calculated digest together with the NTP message and key ID to the

receiver.

2. Upon receiving the message, the receiver finds the key according to the key ID in the message,

uses the MD5 algorithm to calculate the digest, and compares the digest with the digest contained

Key value

Message

Sender

Message

Sends to the

receiver Digest

Receiver

Compare

Compute the

digest

Compute the

digest

Digest

Key ID Message

Digest

Key ID

Key value

in the NTP message. If they are the same, the receiver accepts the message. Otherwise, it discards

the message.

Protocols and standards

•RFC 1305, Network Time Protocol (Version 3) Specification, Implementation and Analysis

•RFC 5905, Network Time Protocol Version 4: Protocol and Algorithms Specification

Configuration restrictions and guidelines

•You cannot configure both NTP and SNTP on the same device.

•Do not configure NTP on an aggregate member port.

•The NTP service and SNTP service are mutually exclusive. You can only enable either NTP service

or SNTP service at a time.

Configuration task list

Tasks at a

lance

(Required.) Enabling the NTP service

(Required.) Perform at least one of the following tasks:

•Configuring NTP association modes

•Configuring the local clock as a reference source

(Optional.) Configuring access control rights

(Optional.) Configuring NTP authentication

(Optional.) Configuring NTP optional parameters

Enabling the NTP service

Ste

Command

Remarks

1. Enter system view. system-view N/A

2. Enable the NTP service. ntp-service enable By default, the NTP service is not

enabled.

Configuring NTP association modes

This section describes how to configure NTP association modes.

Configuring NTP in client/server mode

When the device operates in client/server mode, specify the IP address for the server on the client.

Follow these guidelines when you configure an NTP client:

•A server must be synchronized by other devices or use its local clock as a reference source before

synchronizing an NTP client. Otherwise, the client will not be synchronized to the NTP server.

•If the stratum level of a server is higher than or equal to a client, the client will not synchronize to that

server.

•You can configure multiple servers by repeating the ntp-service unicast-server and ntp-service ipv6

unicast-server commands.

To configure an NTP client:

Ste

Command

Remarks

1. Enter system view. system-view N/A

2. Specify an NTP server for the

device.

•Specify an NTP server for the

device:

ntp-service unicast-server

{ ip-address | server-name }

[ vpn-instance

vpn-instance-name ]

[ authentication-keyid keyid |

priority | source interface-type

interface-number | version

number ] *

•Specify an IPv6 NTP server for

the device:

ntp-service ipv6 unicast-server

{ipv6-address |server-name }

[ vpn-instance

vpn-instance-name ]

[authentication-keyid keyid |

priority |source interface-type

interface-number ] *

By default, no NTP server is

specified for the device.

Configuring NTP in symmetric active/passive mode

When the device operates in symmetric active/passive mode, specify on a symmetric-active peer the IP

address for a symmetric-passive peer.

Follow these guidelines when you configure a symmetric-active peer:

•Execute the ntp-service enable command on a symmetric passive peer to enable NTP. Otherwise,

the symmetric-passive peer will not process NTP messages from a symmetric-active peer.

•Either the symmetric-active peer, or the symmetric-passive peer, or both of them must be in

synchronized state. Otherwise, their time cannot be synchronized.

•You can configure multiple symmetric-passive peers by repeating the ntp-service unicast-peer or

ntp-service ipv6 unicast-peer command.

To configure a symmetric-active peer:

Other manuals for 6125XLG

Table of contents

Other HP Switch manuals

HP StorageWorks Edge Switch 2/32 User manual

HP J3128A AdvanceStack 10Base-T Hub-8E User manual

HP StorageWorks 2/32 - SAN Switch User manual

HP A5120 EI Series Installation manual

HP 6400cl User manual

HP ProCurve Switch 2650 User manual

HP StorageWorks 2/32 - SAN Switch User manual

HP 8/20q User instructions

HP Q.11. (2510-24) User manual

HP 12500 Series User manual

HP HP 830 Series Installation manual

HP 438031-B21 - 1:10Gb Ethernet BL-c Switch User manual

HP ProCurve Switch xl Module Manual

HP 1920 Gigabit Ethernet Switch Series User manual

HP 6125G Installation manual

HP A7533A - Brocade 4Gb SAN Switch Base Instruction Manual

HP Aruba 6400 Series User manual

HP 316095-B21 - StorageWorks Edge Switch 2/24 User manual

HP 5920 Installation manual

HP StorageWorks 7110 - Virtual Array User manual

HP 10500 series Installation instructions

HP 5120 EI Series User manual

HP 6125G Installation manual

HP JE069A User instructions

Popular Switch manuals by other brands

Daintree

Daintree GE current WWS3 installation guide

EtherWAN

EtherWAN EX17242 installation guide

Kramer

Kramer VS-21HDCP-IR user manual

Belkin

Belkin F5U302 - Wireless USB Hub Quick install guide

ATEN

ATEN Master View CS-82A quick start guide

Gefen

Gefen EXT-DVIKVM-241 user manual

AGS

AGS Merlin FS1 user guide

Cisco

Cisco Catalyst 4948E Installing guide

Speaka Professional

Speaka Professional 1574602 operating instructions

Ruijie

Ruijie RG-IS2700-P Series Command reference

Sun Microsystems

Sun Microsystems Secure Application Switch N1216 Release notes

Aruba

Aruba 6400 Series Installation, Safety, and Regulatory Information

Alps Electric

Alps Electric SDKT Series Specifications

TechniSat

TechniSat GigaSwitch 11/20K Installation Manual and User Instructions

D-Link

D-Link DGS-1005D - Switch manual

Anker

Anker 68ANHUB-B10A Welcome guide

Cisco

Cisco Catalyst WS-C3850-24T-L Product overview

Artesyn

Artesyn ATCA-F140 Installation and use

HP 6125XLG User manual

Popular Switch manuals by other brands