HPE FlexNetwork HSR6800 series User manual

HPE FlexNetwork HSR6800 Routers
Comware 7 Layer 3—IP Services
Configuration Guide
Part number: 5200-3510
Software version: HSR6800-CMW710-R7607
Document version: 6W100-20170412

© Copyright 2017 Hewlett Packard Enterprise Development LP
The information contained herein is subject to change without notice. The only warranties for Hewlett Packard
Enterprise products and services are set forth in the express warranty statements accompanying such
products and services. Nothing herein should be construed as constituting an additional warranty. Hewlett
Packard Enterprise shall not be liable for technical or editorial errors or omissions contained herein.
Confidential computer software. Valid license from Hewlett Packard Enterprise required for possession, use, or
copying. Consistent with FAR 12.211 and 12.212, Commercial Computer Software, Computer Software
Documentation, and Technical Data for Commercial Items are licensed to the U.S. Government under vendor’s
standard commercial license.
Links to third-party websites take you outside the Hewlett Packard Enterprise website. Hewlett Packard
Enterprise has no control over and is not responsible for information outside the Hewlett Packard Enterprise
website.
Acknowledgments
Intel®, Itanium®, Pentium®, Intel Inside®, and the Intel Inside logo are trademarks of Intel Corporation in the
United States and other countries.
Microsoft® and Windows® are either registered trademarks or trademarks of Microsoft Corporation in the
United States and/or other countries.
Adobe® andAcrobat® are trademarks ofAdobe Systems Incorporated.
Java and Oracle are registered trademarks of Oracle and/or its affiliates.
UNIX® is a registered trademark of The Open Group.

i
Contents
Configuring ARP··············································································1
Overview··································································································································1
ARP message format···········································································································1
ARP operating mechanism····································································································1
ARP table··························································································································2
Configuring a static ARP entry······································································································3
Setting the maximum number of dynamic ARP entries for a device·······················································3
Setting the maximum number of dynamic ARP entries for an interface ··················································4
Setting the aging timer for dynamic ARP entries ···············································································4
Enabling dynamic ARP entry check ·······························································································5
Enabling ARP logging·················································································································5
Displaying and maintaining ARP ···································································································5
Static ARP entry configuration example··························································································6
Network requirements ··········································································································6
Configuration procedure ·······································································································7
Verifying the configuration·····································································································7
Configuring gratuitous ARP································································8
Overview··································································································································8
Gratuitous ARP packet learning······························································································8
Periodic sending of gratuitous ARP packets··············································································8
Configuration procedure··············································································································9
Enabling IP conflict notification····································································································10
Configuring proxy ARP····································································11
Enabling common proxy ARP·····································································································11
Enabling local proxy ARP ··········································································································11
Displaying proxy ARP ···············································································································11
Common proxy ARP configuration example···················································································12
Network requirements ········································································································12
Configuration procedure ·····································································································12
Verifying the configuration···································································································13
Configuring ARP suppression···························································14
Overview································································································································14
Configuration procedure············································································································14
Displaying and maintaining ARP suppression ················································································15
ARP suppression configuration example·······················································································15
Network requirements ········································································································15
Configuration procedure ·····································································································15
Verifying the configuration···································································································16
Configuring ARP direct route advertisement·········································17
Overview································································································································17
Configuration procedure············································································································17
Configuring IP addressing································································18
Overview································································································································18
IP address classes ············································································································18
Special IP addresses ·········································································································19
Subnetting and masking ·····································································································19
Assigning an IP address to an interface························································································19
Configuration guidelines ·····································································································20
Configuration procedure ·····································································································20
Configuring IP unnumbered········································································································20
Configuration guidelines ·····································································································20
Configuration prerequisites··································································································21

ii
Configuration procedure ·····································································································21
Displaying and maintaining IP addressing ·····················································································21
Configuration examples·············································································································21
IP address configuration example ·························································································21
IP unnumbered configuration example···················································································23
DHCP overview ·············································································25
DHCP address allocation···········································································································25
Allocation mechanisms·······································································································25
IP address allocation process ······························································································26
IP address lease extension··································································································26
DHCP message format ·············································································································27
DHCP options ·························································································································28
Common DHCP options······································································································28
Custom DHCP options ·······································································································28
Protocols and standards············································································································30
Configuring the DHCP server····························································31
Overview································································································································31
DHCP address pool···········································································································31
IP address allocation sequence····························································································33
DHCP server configuration task list······························································································33
Configuring an address pool on the DHCP server ···········································································34
Configuration task list·········································································································34
Creating a DHCP address pool ····························································································34
Specifying IP address ranges for a DHCP address pool·····························································34
Specifying gateways for DHCP clients ···················································································37
Specifying a domain name suffix for DHCP clients····································································38
Specifying DNS servers for DHCP clients···············································································38
Specifying WINS servers and NetBIOS node type for DHCP clients ·············································39
Specifying BIMS server for DHCP clients················································································39
Specifying the configuration file for DHCP client auto-configuration··············································40
Specifying a server for DHCP clients ·····················································································40
Configuring Option 184 parameters for DHCP clients································································41
Customizing DHCP options ·································································································41
Configuring the DHCP user class whitelist ··············································································43
Enabling DHCP ·······················································································································43
Enabling the DHCP server on an interface ····················································································44
Applying an address pool on an interface······················································································44
Configuring a DHCP policy for dynamic address assignment·····························································44
Configuring IP address conflict detection·······················································································45
Enabling handling of Option 82 ···································································································46
Configuring DHCP server compatibility·························································································46
Configuring the DHCP server to broadcast all responses ···························································46
Configure the DHCP server to ignore BOOTP requests ·····························································47
Configuring the DHCP server to send BOOTP responses in RFC 1048 format ·······························47
Disabling Option 60 encapsulation in DHCP replies··································································47
Setting the DSCP value for DHCP packets sent by the DHCP server··················································48
Configuring DHCP binding auto backup························································································48
Configuring address pool usage alarming······················································································49
Binding gateways to DHCP server's MAC address··········································································49
Advertising subnets assigned to clients·························································································50
Applying a DHCP address pool to a VPN instance ··········································································51
Enabling client offline detection on the DHCP server ·······································································51
Enabling DHCP logging on the DHCP server ·················································································51
Displaying and maintaining the DHCP server·················································································52
DHCP server configuration examples···························································································52
Static IP address assignment configuration example·································································53
Dynamic IP address assignment configuration example·····························································54
DHCP user class configuration example·················································································56
DHCP user class whitelist configuration example ·····································································58
Primary and secondary subnets configuration example ·····························································59

iii
DHCP option customization configuration example···································································60
Troubleshooting DHCP server configuration ··················································································61
Symptom·························································································································61
Analysis ··························································································································61
Solution···························································································································62
Configuring the DHCP relay agent·····················································63
Overview································································································································63
Operation ························································································································63
DHCP relay agent support for Option 82·················································································64
DHCP relay agent configuration task list ·······················································································64
Enabling DHCP ·······················································································································65
Enabling the DHCP relay agent on an interface··············································································65
Specifying DHCP servers on a relay agent ····················································································66
Configuring the DHCP relay agent security features ········································································66
Enabling the DHCP relay agent to record relay entries ······························································66
Enabling periodic refresh of dynamic relay entries····································································66
Enabling DHCP starvation attack protection············································································67
Configuring the DHCP relay agent to release an IP address······························································68
Configuring Option 82···············································································································68
Setting the DSCP value for DHCP packets sent by the DHCP relay agent············································69
Enabling DHCP server proxy on a DHCP relay agent ······································································69
Configuring a DHCP relay address pool························································································70
Specifying a gateway address for DHCP clients ·············································································71
Enabling client offline detection on the DHCP relay agent·································································71
Configuring the DHCP smart relay feature·····················································································71
Specifying the source IP address for relayed DHCP requests····························································73
Configuring the DHCP relay agent to forward DHCP replies based on Option 82···································73
Displaying and maintaining the DHCP relay agent ··········································································74
DHCP relay agent configuration examples ····················································································75
DHCP relay agent configuration example ···············································································75
Option 82 configuration example ··························································································76
Troubleshooting DHCP relay agent configuration············································································76
Symptom·························································································································76
Analysis ··························································································································77
Solution···························································································································77
Configuring the DHCP client·····························································78
Enabling the DHCP client on an interface······················································································78
Configuring a DHCP client ID for an interface·················································································78
Enabling duplicated address detection··························································································79
Setting the DSCP value for DHCP packets sent by the DHCP client ···················································79
Displaying and maintaining the DHCP client ··················································································79
DHCP client configuration example······························································································80
Network requirements ········································································································80
Configuration procedure ·····································································································80
Verifying the configuration···································································································81
Configuring the BOOTP client···························································83
BOOTP application···················································································································83
Obtaining an IP address dynamically····························································································83
Protocols and standards············································································································83
Configuring an interface to use BOOTP for IP address acquisition······················································83
Displaying and maintaining BOOTP client ·····················································································84
BOOTP client configuration example····························································································84
Network requirements ········································································································84
Configuration procedure ·····································································································84
Verifying the configuration···································································································84
Configuring DNS············································································85
Overview································································································································85
Static domain name resolution ·····························································································85

iv
Dynamic domain name resolution ·························································································85
DNS proxy·······················································································································86
DNS spoofing···················································································································87
DNS configuration task list·········································································································88
Configuring the IPv4 DNS client··································································································88
Configuring static domain name resolution··············································································88
Configuring dynamic domain name resolution··········································································89
Configuring the IPv6 DNS client··································································································90
Configuring static domain name resolution··············································································90
Configuring dynamic domain name resolution··········································································90
Configuring the DNS proxy·········································································································91
Configuring DNS spoofing··········································································································92
Configuring network mode tracking for an output interface································································92
Specifying the source interface for DNS packets·············································································93
Configuring the DNS trusted interface ··························································································93
Setting the DSCP value for outgoing DNS packets··········································································94
Displaying and maintaining DNS ·································································································94
IPv4 DNS configuration examples ·······························································································94
Static domain name resolution configuration example ·······························································94
Dynamic domain name resolution configuration example···························································95
DNS proxy configuration example·························································································98
IPv6 DNS configuration examples ·······························································································99
Static domain name resolution configuration example ·······························································99
Dynamic domain name resolution configuration example························································· 100
DNS proxy configuration example······················································································· 102
Troubleshooting IPv4 DNS configuration····················································································· 104
Symptom······················································································································· 104
Solution························································································································· 104
Troubleshooting IPv6 DNS configuration····················································································· 104
Symptom······················································································································· 104
Solution························································································································· 104
Configuring DDNS········································································ 105
Overview······························································································································ 105
DDNS application············································································································ 105
DDNS client configuration task list····························································································· 106
Configuring a DDNS policy······································································································· 106
Configuration prerequisites································································································ 107
Configuration procedure ··································································································· 107
Applying the DDNS policy to an interface ···················································································· 108
Setting the DSCP value for outgoing DDNS packets······································································ 108
Displaying DDNS··················································································································· 109
DDNS configuration examples·································································································· 109
DDNS configuration example with www.3322.org··································································· 109
DDNS configuration example with PeanutHull server ······························································ 110
Configuring NAT ·········································································· 112
Overview······························································································································ 112
Terminology··················································································································· 112
NAT types······················································································································ 112
NAT control···················································································································· 113
NAT implementations·············································································································· 113
Static NAT ····················································································································· 113
Dynamic NAT················································································································· 113
NAT Server···················································································································· 114
NAT444························································································································· 115
DS-Lite NAT444·············································································································· 117
NAT entries ·························································································································· 117
NAT session entry··········································································································· 117
EIM entry······················································································································· 117
NO-PAT entry················································································································· 118
NAT444 entry················································································································· 118

v
Using NAT with other features ·································································································· 118
VRF-aware NAT·············································································································· 118
NAT with DNS mapping···································································································· 118
NAT with ALG················································································································· 119
NAT configuration task list ······································································································· 120
NAT configuration restrictions and guidelines··············································································· 120
Configuring static NAT ············································································································ 120
Configuration prerequisites································································································ 120
Configuring outbound one-to-one static NAT········································································· 121
Configuring outbound net-to-net static NAT··········································································· 121
Configuring object group-based outbound static NAT······························································ 122
Configuring inbound one-to-one static NAT··········································································· 123
Configuring inbound net-to-net static NAT············································································· 123
Configuring object group-based inbound static NAT································································ 124
Configuring dynamic NAT········································································································ 124
Configuration restrictions and guidelines ·············································································· 124
Configuration prerequisites································································································ 125
Configuring outbound dynamic NAT ···················································································· 125
Configuring inbound dynamic NAT······················································································ 126
Configuring NAT Server ·········································································································· 127
Configuring common NAT Server ······················································································· 127
Configuring load sharing NAT Server··················································································· 128
Configuring ACL-based NAT Server···················································································· 129
Configuring NAT444··············································································································· 129
Configuring static NAT444································································································· 129
Configuring dynamic NAT444 ···························································································· 130
Enabling global mapping sharing for dynamic NAT444 ···························································· 131
Configuring DS-Lite NAT444 ···································································································· 131
Configuring NAT with DNS mapping ·························································································· 132
Configuring NAT hairpin ·········································································································· 132
Configuring NAT with ALG······································································································· 133
Configuring NAT logging·········································································································· 133
Configuring NAT session logging························································································ 133
Configuring NAT444 user logging ······················································································· 134
Configuring NAT alarm logging··························································································· 135
Configuring port block usage threshold for dynamic NAT444 ···················································· 135
Enabling sending ICMP error messages for NAT failures································································ 135
Enabling NAT reply redirection·································································································· 136
Enabling the deletion of timestamps in TCP SYN and SYN ACK packets··········································· 136
Displaying and maintaining NAT································································································ 137
NAT configuration examples····································································································· 138
Outbound one-to-one static NAT configuration example ·························································· 138
Outbound dynamic NAT configuration example (non-overlapping addresses)······························· 139
Outbound bidirectional NAT configuration example································································· 142
NAT Server for external-to-internal access configuration example·············································· 144
NAT Server for external-to-internal access through domain name configuration example················ 147
Bidirectional NAT for external-to-internal NAT Server access through domain name configuration example
··································································································································· 149
NAT hairpin in C/S mode configuration example ···································································· 153
NAT hairpin in P2P mode configuration example···································································· 155
Twice NAT configuration example······················································································· 157
Load sharing NAT Server configuration example···································································· 160
NAT with DNS mapping configuration example······································································ 162
Static NAT444 configuration example ·················································································· 164
Dynamic NAT444 configuration example·············································································· 166
DS-Lite NAT444 configuration example················································································ 168
NAT444 gateway unified with BRAS device configuration example ············································ 170
Basic IP forwarding on the device···················································· 172
FIB table······························································································································ 172
Displaying FIB table entries······································································································ 172

vi
Configuring load sharing································································ 174
Configuring per-packet or per-flow load sharing············································································ 174
Configuring load sharing based on bandwidth ·············································································· 174
Configuring fast forwarding····························································· 176
Overview······························································································································ 176
Configuring the aging time for fast forwarding entries····································································· 176
Configuring fast forwarding load sharing ····················································································· 176
Displaying and maintaining fast forwarding·················································································· 177
Configuring flow classification························································· 178
Specifying a flow classification policy ························································································· 178
Displaying the adjacency table························································ 179
Configuring IRDP········································································· 181
Overview······························································································································ 181
IRDP operation··············································································································· 181
Basic concepts ··············································································································· 181
Protocols and standards ··································································································· 182
Configuration procedure·········································································································· 182
IRDP configuration example····································································································· 183
Network requirements ······································································································ 183
Configuration procedure ··································································································· 183
Verifying the configuration································································································· 184
Optimizing IP performance····························································· 185
Enabling an interface to receive and forward directed broadcasts destined for the directly connected network
·········································································································································· 185
Configuration procedure ··································································································· 185
Configuration example······································································································ 185
Setting MTU for an interface····································································································· 186
Setting TCP MSS for an interface······························································································ 187
Configuring TCP path MTU discovery························································································· 187
Enabling TCP SYN Cookie······································································································· 188
Setting the TCP buffer size ······································································································ 188
Setting TCP timers················································································································· 189
Enabling sending ICMP error messages ····················································································· 189
Disabling forwarding ICMP fragments························································································· 191
Configuring rate limit for ICMP error messages············································································· 191
Specifying the source address for ICMP packets ·········································································· 191
Enabling IPv4 local fragment reassembly···················································································· 192
Displaying and maintaining IP performance optimization ································································ 192
Configuring UDP helper································································· 194
Overview······························································································································ 194
Configuration restrictions and guidelines····················································································· 194
Configuring UDP helper to convert broadcast to unicast································································· 194
Configuring UDP helper to convert broadcast to multicast······························································· 195
Configuring UDP helper to convert multicast to broadcast or unicast················································· 196
Displaying and maintaining UDP helper······················································································ 196
UDP helper configuration examples··························································································· 197
Configuring UDP helper to convert broadcast to unicast ·························································· 197
Configuring UDP helper to convert broadcast to multicast························································ 197
Configuring UDP helper to convert multicast to broadcast ························································ 199
Configuring basic IPv6 settings ······················································· 200
Overview······························································································································ 200
IPv6 features·················································································································· 200
IPv6 addresses··············································································································· 201
IPv6 ND protocol············································································································· 203

vii
IPv6 path MTU discovery·································································································· 205
IPv6 transition technologies······································································································ 206
Dual stack······················································································································ 206
Tunneling ······················································································································ 206
6PE······························································································································ 207
Protocols and standards·········································································································· 207
IPv6 basics configuration task list······························································································ 207
Assigning IPv6 addresses to interfaces······················································································· 208
Configuring an IPv6 global unicast address··········································································· 208
Configuring an IPv6 link-local address ················································································· 211
Configuring an IPv6 anycast address··················································································· 212
Configuring IPv6 ND··············································································································· 212
Configuring a static neighbor entry······················································································ 212
Setting the maximum number of dynamic neighbor entries······················································· 213
Setting the aging timer for ND entries in stale state································································· 213
Minimizing link-local ND entries·························································································· 213
Setting the hop limit ········································································································· 214
Configuring parameters for RA messages············································································· 214
Setting the maximum number of attempts to send an NS message for DAD································· 216
Enabling ND proxy··········································································································· 217
Configuring IPv6 ND suppression ······················································································· 218
Configuring IPv6 ND direct route advertisement····································································· 219
Configuring path MTU discovery ······························································································· 220
Setting the interface MTU·································································································· 220
Setting a static path MTU for an IPv6 address ······································································· 221
Setting the aging time for dynamic path MTUs······································································· 221
Controlling sending ICMPv6 messages······················································································· 221
Configuring the rate limit for ICMPv6 error messages······························································ 221
Enabling replying to multicast echo requests········································································· 222
Enabling sending ICMPv6 destination unreachable messages ·················································· 222
Enabling sending ICMPv6 time exceeded messages ······························································ 223
Enabling sending ICMPv6 redirect messages········································································ 223
Specifying the source address for ICMPv6 packets································································· 223
Enabling IPv6 local fragment reassembly···················································································· 224
Configuring IPv6 load sharing based on bandwidth ······································································· 224
Enabling a device to discard IPv6 packets that contain extension headers ········································· 225
Displaying and maintaining IPv6 basics ······················································································ 225
IPv6 configuration examples····································································································· 227
Basic IPv6 configuration example ······················································································· 227
IPv6 ND suppression configuration example ········································································· 231
Troubleshooting IPv6 basics configuration··················································································· 232
Symptom······················································································································· 232
Solution························································································································· 232
DHCPv6 overview········································································ 233
DHCPv6 address/prefix assignment··························································································· 233
Rapid assignment involving two messages ··········································································· 233
Assignment involving four messages··················································································· 233
Address/prefix lease renewal···································································································· 234
Stateless DHCPv6 ················································································································· 235
Protocols and standards·········································································································· 235
Configuring the DHCPv6 server ······················································ 236
Overview······························································································································ 236
IPv6 address assignment·································································································· 236
IPv6 prefix assignment ····································································································· 236
Concepts······················································································································· 237
DHCPv6 address pool······································································································ 237
IPv6 address/prefix allocation sequence··············································································· 238
Configuration task list·············································································································· 239
Configuring IPv6 prefix assignment···························································································· 239
Configuration guidelines ··································································································· 239

viii
Configuration procedure ··································································································· 240
Configuring IPv6 address assignment ························································································ 240
Configuration guidelines ··································································································· 241
Configuration procedure ··································································································· 241
Configuring network parameters assignment ··············································································· 242
Configuring network parameters in a DHCPv6 address pool····················································· 242
Configuring network parameters in a DHCPv6 option group ····················································· 243
Configuring a DHCPv6 policy for IPv6 address and prefix assignment··············································· 244
Configuring the DHCPv6 server on an interface············································································ 245
Configuration guidelines ··································································································· 245
Configuration procedure ··································································································· 245
Setting the DSCP value for DHCPv6 packets sent by the DHCPv6 server·········································· 246
Configuring DHCPv6 binding auto backup··················································································· 246
Advertising subnets assigned to clients······················································································· 247
Applying a DHCPv6 address pool to a VPN instance····································································· 247
Enabling DHCPv6 logging on the DHCPv6 server········································································· 248
Displaying and maintaining the DHCPv6 server············································································ 248
DHCPv6 server configuration examples······················································································ 249
Dynamic IPv6 prefix assignment configuration example··························································· 249
Dynamic IPv6 address assignment configuration example ······················································· 251
Configuring the DHCPv6 relay agent················································ 254
Overview······························································································································ 254
DHCPv6 relay agent configuration task list ·················································································· 255
Enabling the DHCPv6 relay agent on an interface········································································· 255
Specifying DHCPv6 servers on the relay agent ············································································ 255
Setting the DSCP value for DHCPv6 packets sent by the DHCPv6 relay agent ··································· 256
Specifying a padding mode for the Interface-ID option ··································································· 256
Configuring a DHCPv6 relay address pool··················································································· 257
Specifying a gateway address for DHCPv6 clients ········································································ 257
Displaying and maintaining the DHCPv6 relay agent ····································································· 258
DHCPv6 relay agent configuration example················································································· 258
Network requirements ······································································································ 258
Configuration procedure ··································································································· 259
Verifying the configuration································································································· 259
Configuring the DHCPv6 client························································ 261
Overview······························································································································ 261
Configuration restrictions and guidelines····················································································· 261
DHCPv6 client configuration task list·························································································· 261
Configuring IPv6 address acquisition·························································································· 261
Configuring IPv6 prefix acquisition····························································································· 262
Configuring IPv6 address and prefix acquisition············································································ 262
Configuring stateless DHCPv6·································································································· 262
Configuring the DHCPv6 client DUID ························································································· 263
Setting the DSCP value for DHCPv6 packets sent by the DHCPv6 client ··········································· 263
Displaying and maintaining DHCPv6 client ·················································································· 263
DHCPv6 client configuration examples······················································································· 264
IPv6 address acquisition configuration example····································································· 264
IPv6 prefix acquisition configuration example ········································································ 265
IPv6 address and prefix acquisition configuration example······················································· 267
Stateless DHCPv6 configuration example············································································· 269
Configuring IPv6 fast forwarding······················································ 272
Overview······························································································································ 272
Configuring the aging time for IPv6 fast forwarding entries······························································ 272
Configuring IPv6 fast forwarding load sharing ·············································································· 272
Displaying and maintaining IPv6 fast forwarding ··········································································· 273
Configuring tunneling···································································· 274
Overview······························································································································ 274
IPv6 over IPv4 tunneling ··································································································· 274