HPE FlexNetwork MSR Series User manual

HPE FlexNetwork MSR Router Series
Comware 7 Layer 3 - IP Services Configuration Guides
Part number: 5998-8785
Software version: CMW710-E0407
Document version: 6W100-20160526

© Copyright 2016 Hewlett Packard Enterprise Development LP
The information contained herein is subject to change without notice. The only warranties for Hewlett Packard
Enterprise products and services are set forth in the express warranty statements accompanying such
products and services. Nothing herein should be construed as constituting an additional warranty. Hewlett
Packard Enterprise shall not be liable for technical or editorial errors or omissions contained herein.
Confidential computer software. Valid license from Hewlett Packard Enterprise required for possession, use, or
copying. Consistent with FAR 12.211 and 12.212, Commercial Computer Software, Computer Software
Documentation, and Technical Data for Commercial Items are licensed to the U.S. Government under vendor’s
standard commercial license.
Links to third-party websites take you outside the Hewlett Packard Enterprise website. Hewlett Packard
Enterprise has no control over and is not responsible for information outside the Hewlett Packard Enterprise
website.
Acknowledgments
Intel®, Itanium®, Pentium®, Intel Inside®, and the Intel Inside logo are trademarks of Intel Corporation in the
United States and other countries.
Microsoft® and Windows® are trademarks of the Microsoft group of companies.
Adobe® andAcrobat® are trademarks ofAdobe Systems Incorporated.
Java and Oracle are registered trademarks of Oracle and/or its affiliates.
UNIX® is a registered trademark of The Open Group.

i
Contents
Configuring ARP·····························································································1
Overview····························································································································································1
ARP message format·································································································································1
ARP operating mechanism ························································································································1
ARP table···················································································································································2
Command and hardware compatibility···············································································································3
Configuring a static ARP entry···························································································································3
Setting the maximum number of dynamic ARP entries for a device··································································4
Setting the maximum number of dynamic ARP entries for an interface ····························································5
Setting the aging timer for dynamic ARP entries ·······························································································5
Enabling dynamic ARP entry check···················································································································5
Enabling ARP logging········································································································································6
Displaying and maintaining ARP························································································································6
Configuration examples ·····································································································································7
Long static ARP entry configuration example····························································································7
Short static ARP entry configuration example····························································································8
Configuring gratuitous ARP ··········································································10
Overview··························································································································································10
Gratuitous ARP packet learning···············································································································10
Periodic sending of gratuitous ARP packets····························································································10
Configuration procedure ··································································································································11
Enabling IP conflict notification ························································································································12
Configuring proxy ARP ·················································································13
Enabling common proxy ARP··························································································································13
Enabling local proxy ARP ································································································································13
Displaying proxy ARP ······································································································································13
Common proxy ARP configuration example····································································································14
Network requirements······························································································································14
Configuration procedure···························································································································14
Verifying the configuration························································································································15
Configuring ARP snooping············································································16
Overview··························································································································································16
Feature and hardware compatibility·················································································································16
Configuration procedure ··································································································································16
Displaying and maintaining ARP snooping······································································································17
Configuring ARP fast-reply ···········································································18
Overview··························································································································································18
Configuration procedure ··································································································································18
ARP fast-reply configuration example··············································································································18
Network requirements······························································································································18
Configuration procedure···························································································································19
Configuring ARP PnP ···················································································20
Overview··························································································································································20
Configuration prerequisites······························································································································20
Configuration procedure ··································································································································20
Displaying and maintaining ARP PnP··············································································································21
ARP PnP configuration example······················································································································21
Network requirements······························································································································21
Configuration procedure···························································································································21
Verifying the configuration························································································································22

ii
Configuring ARP suppression·······································································23
Overview··························································································································································23
Configuration procedure ··································································································································23
Displaying and maintaining ARP suppression ·································································································24
ARP suppression configuration example·········································································································24
Network requirements······························································································································24
Configuration procedure···························································································································25
Verifying the configuration························································································································25
Configuring ARP direct route advertisement·················································26
Overview··························································································································································26
Configuration procedure ··································································································································26
Configuring IP addressing·············································································27
Overview··························································································································································27
IP address classes···································································································································27
Special IP addresses ·······························································································································28
Subnetting and masking···························································································································28
Assigning an IP address to an interface ··········································································································28
Configuration guidelines···························································································································29
Configuration procedure···························································································································29
Configuring IP unnumbered·····························································································································29
Configuration guidelines···························································································································29
Configuration prerequisites······················································································································30
Configuration procedure···························································································································30
Displaying and maintaining IP addressing·······································································································30
Configuration examples ···································································································································30
IP address configuration example············································································································30
IP unnumbered configuration example ····································································································32
DHCP overview·····························································································34
DHCP address allocation·································································································································34
Allocation mechanisms ····························································································································34
IP address allocation process··················································································································35
IP address lease extension······················································································································35
DHCP message format····································································································································36
DHCP options ··················································································································································37
Common DHCP options···························································································································37
Custom DHCP options·····························································································································37
Protocols and standards ··································································································································39
Configuring the DHCP server ·······································································40
Overview··························································································································································40
DHCP address pool ·································································································································40
IP address allocation sequence···············································································································42
DHCP server configuration task list ·················································································································42
Configuring an address pool on the DHCP server···························································································43
Configuration task list·······························································································································43
Creating a DHCP address pool················································································································43
Specifying IP address ranges for a DHCP address pool ·········································································43
Specifying gateways for DHCP clients·····································································································46
Specifying a domain name suffix for DHCP clients··················································································47
Specifying DNS servers for DHCP clients································································································47
Specifying WINS servers and NetBIOS node type for DHCP clients·······················································47
Specifying BIMS server for DHCP clients································································································48
Specifying the configuration file for DHCP client auto-configuration························································48
Specifying a server for DHCP clients·······································································································49
Configuring Option 184 parameters for DHCP clients ·············································································50
Customizing DHCP options······················································································································50
Configuring the DHCP user class whitelist·······························································································52
Enabling DHCP················································································································································52

iii
Enabling the DHCP server on an interface······································································································53
Applying an address pool on an interface········································································································53
Configuring a DHCP policy for dynamic address assignment ·········································································53
Configuring IP address conflict detection·········································································································54
Enabling handling of Option 82························································································································55
Configuring DHCP server compatibility············································································································55
Configuring the DHCP server to broadcast all responses········································································55
Configure the DHCP server to ignore BOOTP requests··········································································56
Configuring the DHCP server to send BOOTP responses in RFC 1048 format······································56
Setting the DSCP value for DHCP packets sent by the DHCP server·····························································56
Configuring DHCP binding auto backup ··········································································································57
Configuring address pool usage alarming ·······································································································57
Binding gateways to a common MAC address································································································58
Advertising subnets assigned to clients···········································································································58
Applying a DHCP address pool to a VPN instance··························································································59
Enabling client offline detection on the DHCP server ······················································································60
Enabling DHCP logging on the DHCP server··································································································60
Displaying and maintaining the DHCP server··································································································61
DHCP server configuration examples··············································································································61
Static IP address assignment configuration example ··············································································61
Dynamic IP address assignment configuration example ·········································································63
DHCP user class configuration example··································································································65
DHCP user class whitelist configuration example····················································································66
Primary and secondary subnets configuration example ··········································································67
DHCP option customization configuration example·················································································69
Troubleshooting DHCP server configuration ···································································································70
Symptom··················································································································································70
Analysis····················································································································································70
Solution····················································································································································70
Configuring the DHCP relay agent································································72
Overview··························································································································································72
Operation ·················································································································································72
DHCP relay agent support for Option 82 ·································································································73
DHCP relay agent configuration task list ·········································································································73
Enabling DHCP················································································································································74
Enabling the DHCP relay agent on an interface ······························································································74
Specifying DHCP servers on a relay agent······································································································74
Specifying the source address and gateway address in DHCP requests························································75
Configuring the DHCP relay agent security features ·······················································································75
Enabling the DHCP relay agent to record relay entries ···········································································75
Enabling periodic refresh of dynamic relay entries ··················································································76
Enabling DHCP starvation attack protection····························································································76
Configuring the DHCP relay agent to release an IP address···········································································77
Configuring Option 82······································································································································78
Setting the DSCP value for DHCP packets sent by the DHCP relay agent·····················································78
Enabling DHCP server proxy on a DHCP relay agent·····················································································79
Configuring a DHCP relay address pool··········································································································79
Specifying a gateway address for DHCP clients······························································································80
Enabling client offline detection on the DHCP relay agent ··············································································80
Configuring the DHCP smart relay feature ······································································································81
Displaying and maintaining the DHCP relay agent··························································································82
DHCP relay agent configuration examples······································································································83
DHCP relay agent configuration example································································································83
Option 82 configuration example ·············································································································84
Troubleshooting DHCP relay agent configuration····························································································84
Symptom··················································································································································84
Analysis····················································································································································84
Solution····················································································································································84
Configuring the DHCP client·········································································86
Enabling the DHCP client on an interface········································································································86

iv
Configuring a DHCP client ID for an interface ·································································································86
Enabling duplicated address detection ············································································································87
Setting the DSCP value for DHCP packets sent by the DHCP client ······························································87
Displaying and maintaining the DHCP client ···································································································87
DHCP client configuration example ·················································································································88
Network requirements······························································································································88
Configuration procedure···························································································································88
Verifying the configuration························································································································89
Configuring DHCP snooping·········································································91
Overview··························································································································································91
Application of trusted and untrusted ports································································································91
DHCP snooping support for Option 82·····································································································92
Command and hardware compatibility·············································································································93
DHCP snooping configuration task list·············································································································93
Configuring basic DHCP snooping ··················································································································94
Configuring Option 82······································································································································95
Configuring DHCP snooping entry auto backup ······························································································96
Enabling DHCP starvation attack protection····································································································97
Enabling DHCP-REQUEST attack protection··································································································97
Setting the maximum number of DHCP snooping entries ···············································································98
Configuring DHCP packet rate limit ·················································································································99
Configuring a DHCP packet blocking port ·······································································································99
Enabling DHCP snooping logging··················································································································100
Displaying and maintaining DHCP snooping ·································································································100
DHCP snooping configuration examples ·······································································································101
Basic DHCP snooping configuration example ·······················································································101
Option 82 configuration example ···········································································································102
Configuring the BOOTP client·····································································104
BOOTP application ········································································································································104
Obtaining an IP address dynamically·············································································································104
Protocols and standards ································································································································104
Configuring an interface to use BOOTP for IP address acquisition·······························································104
Displaying and maintaining BOOTP client·····································································································105
BOOTP client configuration example·············································································································105
Network requirements····························································································································105
Configuration procedure·························································································································105
Verifying the configuration······················································································································105
Configuring DNS·························································································106
Overview························································································································································106
Static domain name resolution···············································································································106
Dynamic domain name resolution··········································································································106
DNS proxy··············································································································································107
DNS spoofing·········································································································································108
DNS configuration task list·····························································································································109
Configuring the IPv4 DNS client ····················································································································109
Configuring static domain name resolution····························································································109
Configuring dynamic domain name resolution·······················································································110
Configuring the IPv6 DNS client ····················································································································111
Configuring static domain name resolution····························································································111
Configuring dynamic domain name resolution·······················································································111
Configuring the DNS proxy ····························································································································112
Configuring DNS spoofing ·····························································································································113
Configuring network mode tracking for an output interface ···········································································113
Specifying the source interface for DNS packets···························································································114
Configuring the DNS trusted interface ···········································································································114
Setting the DSCP value for outgoing DNS packets ·······················································································115
Displaying and maintaining DNS ···················································································································115
IPv4 DNS configuration examples ·················································································································115
Static domain name resolution configuration example···········································································115

v
Dynamic domain name resolution configuration example······································································116
DNS proxy configuration example··········································································································119
IPv6 DNS configuration examples ·················································································································120
Static domain name resolution configuration example···········································································120
Dynamic domain name resolution configuration example······································································121
DNS proxy configuration example··········································································································123
Troubleshooting IPv4 DNS configuration·······································································································125
Symptom················································································································································125
Solution··················································································································································125
Troubleshooting IPv6 DNS configuration·······································································································125
Symptom················································································································································125
Solution··················································································································································125
Configuring DDNS ······················································································126
Overview························································································································································126
DDNS application···································································································································126
DDNS client configuration task list·················································································································127
Configuring a DDNS policy ····························································································································127
Configuration prerequisites····················································································································128
Configuration procedure·························································································································128
Applying the DDNS policy to an interface······································································································129
Setting the DSCP value for outgoing DDNS packets·····················································································129
Displaying DDNS ···········································································································································130
DDNS configuration examples·······················································································································130
DDNS configuration example with www.3322.org ·················································································130
DDNS configuration example with PeanutHull server············································································131
Configuring NAT ·························································································133
Overview························································································································································133
Terminology ···········································································································································133
NAT types ··············································································································································133
NAT control············································································································································134
Command and hardware compatibility···········································································································134
NAT implementations·····································································································································134
Static NAT··············································································································································134
Dynamic NAT·········································································································································134
NAT Server ············································································································································135
NAT444··················································································································································136
DS-Lite NAT444·····································································································································138
NAT entries····················································································································································139
NAT session entry··································································································································139
EIM entry················································································································································139
NO-PAT entry·········································································································································139
NAT444 entry·········································································································································139
Using NAT with other features·······················································································································140
VRF-aware NAT·····································································································································140
NAT with DNS mapping·························································································································140
NAT with ALG ········································································································································141
NAT configuration task list ·····························································································································141
NAT configuration restrictions and guidelines································································································141
Configuring static NAT···································································································································142
Configuration prerequisites····················································································································142
Configuring outbound one-to-one static NAT·························································································142
Configuring outbound net-to-net static NAT···························································································142
Configuring object group-based outbound static NAT ···········································································143
Configuring inbound one-to-one static NAT···························································································144
Configuring inbound net-to-net static NAT·····························································································144
Configuring object group-based inbound static NAT··············································································145
Configuring dynamic NAT······························································································································145
Configuration restrictions and guidelines·······························································································146
Configuration prerequisites····················································································································146
Configuring outbound dynamic NAT······································································································146

vi
Configuring inbound dynamic NAT ········································································································147
Configuring NAT Server·································································································································148
Configuring common NAT Server··········································································································148
Configuring load sharing NAT Server ····································································································149
Configuring ACL-based NAT Server······································································································150
Configuring NAT444 ······································································································································150
Configuring static NAT444·····················································································································150
Configuring dynamic NAT444················································································································151
Enabling global mapping sharing for dynamic NAT444·········································································152
Configuring DS-Lite NAT444 ·························································································································152
Configuring NAT with DNS mapping··············································································································153
Configuring NAT hairpin·································································································································153
Configuring NAT with ALG·····························································································································154
Configuring NAT logging································································································································154
Configuring NAT session logging···········································································································154
Configuring NAT444 user logging··········································································································155
Configuring NAT444 alarm logging········································································································156
Enabling sending ICMP error messages for NAT failures ·············································································156
Displaying and maintaining NAT····················································································································157
NAT configuration examples··························································································································158
Outbound one-to-one static NAT configuration example·······································································158
Outbound dynamic NAT configuration example (non-overlapping addresses)······································160
Outbound bidirectional NAT configuration example···············································································162
NAT Server for external-to-internal access configuration example························································165
NAT Server for external-to-internal access through domain name configuration example····················168
Bidirectional NAT for external-to-internal NAT Server access through domain name configuration example
·······························································································································································171
NAT hairpin in C/S mode configuration example···················································································175
NAT hairpin in P2P mode configuration example ··················································································178
Twice NAT configuration example ·········································································································180
NAT with DNS mapping configuration example·····················································································183
Static NAT444 configuration example····································································································186
Dynamic NAT444 configuration example·······························································································188
DS-Lite NAT444 configuration example·································································································190
NAT444 gateway unified with BRAS device configuration example······················································192
Basic IP forwarding on the device·······························································195
FIB table·························································································································································195
Displaying FIB table entries ···························································································································195
Configuring load sharing·············································································197
Command and hardware compatibility···········································································································197
Configuring per-packet or per-flow load sharing····························································································197
Configuring load sharing based on bandwidth·······························································································198
Configuring fast forwarding·········································································199
Overview························································································································································199
Command and hardware compatibility···········································································································199
Configuring the aging time for fast forwarding entries ···················································································199
Configuring fast forwarding load sharing ·······································································································199
Displaying and maintaining fast forwarding ···································································································200
Configuring flow classification·····································································201
Feature and hardware compatibility···············································································································201
Specifying a flow classification policy ············································································································201
Displaying the adjacency table ···································································202
Overview························································································································································202
Command and hardware compatibility···········································································································203
Displaying commands····································································································································203

vii
Configuring IRDP························································································204
Overview························································································································································204
IRDP operation·······································································································································204
Basic concepts·······································································································································204
Protocols and standards ························································································································205
Configuration procedure ································································································································205
IRDP configuration example ··························································································································206
Network requirements····························································································································206
Configuration procedure·························································································································206
Verifying the configuration······················································································································207
Optimizing IP performance ·········································································208
Command and hardware compatibility···········································································································208
Enabling an interface to receive and forward directed broadcasts destined for the directly connected network
·······································································································································································208
Configuration procedure·························································································································208
Configuration example···························································································································209
Setting MTU for an interface··························································································································210
Setting TCP MSS for an interface··················································································································210
Configuring TCP path MTU discovery ···········································································································210
Enabling TCP SYN Cookie ····························································································································211
Setting the TCP buffer size····························································································································212
Setting TCP timers·········································································································································212
Enabling sending ICMP error messages ·······································································································212
Configuring rate limit for ICMP error messages·····························································································214
Specifying the source address for ICMP packets ··························································································214
Enabling IPv4 local fragment reassembly······································································································215
Displaying and maintaining IP performance optimization ··············································································215
Configuring UDP helper··············································································218
Overview························································································································································218
Configuration restrictions and guidelines·······································································································218
Configuring UDP helper to convert broadcast to unicast···············································································218
Configuring UDP helper to convert broadcast to multicast ············································································219
Configuring UDP helper to convert multicast to broadcast or unicast····························································220
Displaying and maintaining UDP helper ········································································································220
UDP helper configuration examples ··············································································································221
Configuring UDP helper to convert broadcast to unicast·······································································221
Configuring UDP helper to convert broadcast to multicast ····································································221
Configuring UDP helper to convert multicast to broadcast ····································································223
Configuring basic IPv6 settings···································································224
Overview························································································································································224
IPv6 features··········································································································································224
IPv6 addresses ······································································································································225
IPv6 ND protocol····································································································································227
IPv6 path MTU discovery·······················································································································229
IPv6 transition technologies···························································································································230
Dual stack ··············································································································································230
Tunneling ···············································································································································230
NAT-PT··················································································································································231
6PE ························································································································································231
Command and hardware compatibility···········································································································231
Protocols and standards ································································································································231
IPv6 basics configuration task list··················································································································232
Assigning IPv6 addresses to interfaces·········································································································233
Configuring an IPv6 global unicast address···························································································233
Configuring an IPv6 link-local address···································································································235
Configuring an IPv6 anycast address ····································································································236
Configuring IPv6 ND ······································································································································236
Configuring a static neighbor entry ········································································································237

viii
Setting the maximum number of dynamic neighbor entries···································································237
Setting the aging timer for ND entries in stale state···············································································238
Minimizing link-local ND entries·············································································································238
Setting the hop limit································································································································238
Configuring parameters for RA messages·····························································································239
Setting the maximum number of attempts to send an NS message for DAD········································241
Enabling ND proxy·································································································································241
Configuring IPv6 ND suppression··········································································································243
Configuring IPv6 ND direct route advertisement····················································································244
Configuring path MTU discovery····················································································································244
Setting the interface MTU ······················································································································244
Setting a static path MTU for an IPv6 address·······················································································245
Setting the aging time for dynamic path MTUs······················································································245
Controlling sending ICMPv6 messages·········································································································245
Configuring the rate limit for ICMPv6 error messages···········································································246
Enabling replying to multicast echo requests·························································································246
Enabling sending ICMPv6 destination unreachable messages·····························································246
Enabling sending ICMPv6 time exceeded messages············································································247
Enabling sending ICMPv6 redirect messages ·······················································································247
Specifying the source address for ICMPv6 packets···············································································248
Enabling router renumbering ·························································································································248
Enabling IPv6 local fragment reassembly······································································································249
Configuring IPv6 load sharing based on bandwidth·······················································································249
Enabling a device to discard IPv6 packets that contain extension headers ··················································249
Displaying and maintaining IPv6 basics·········································································································250
IPv6 configuration examples··························································································································254
Basic IPv6 configuration example··········································································································254
IPv6 ND suppression configuration example·························································································258
Troubleshooting IPv6 basics configuration ····································································································259
Symptom················································································································································259
Solution··················································································································································259
DHCPv6 overview·······················································································260
DHCPv6 address/prefix assignment··············································································································260
Rapid assignment involving two messages ···························································································260
Assignment involving four messages·····································································································260
Address/prefix lease renewal·························································································································261
Stateless DHCPv6 ·········································································································································262
Protocols and standards ································································································································262
Configuring the DHCPv6 server··································································263
Overview························································································································································263
IPv6 address assignment·······················································································································263
IPv6 prefix assignment···························································································································263
Concepts················································································································································264
DHCPv6 address pool····························································································································264
IPv6 address/prefix allocation sequence································································································265
Configuration task list·····································································································································266
Configuring IPv6 prefix assignment ···············································································································266
Configuration guidelines·························································································································266
Configuration procedure·························································································································267
Configuring IPv6 address assignment ···········································································································267
Configuration guidelines·························································································································268
Configuration procedure·························································································································268
Configuring network parameters assignment ································································································269
Configuring network parameters in a DHCPv6 address pool·································································269
Configuring network parameters in a DHCPv6 option group·································································270
Configuring a DHCPv6 policy for IPv6 address and prefix assignment·························································271
Configuring the DHCPv6 server on an interface····························································································272
Configuration guidelines·························································································································272
Configuration procedure·························································································································272
Setting the DSCP value for DHCPv6 packets sent by the DHCPv6 server···················································273

ix
Configuring DHCPv6 binding auto backup ····································································································273
Advertising subnets assigned to clients·········································································································274
Applying a DHCPv6 address pool to a VPN instance····················································································274
Enabling DHCPv6 logging on the DHCPv6 server ························································································275
Displaying and maintaining the DHCPv6 server····························································································275
DHCPv6 server configuration examples········································································································276
Dynamic IPv6 prefix assignment configuration example········································································276
Dynamic IPv6 address assignment configuration example····································································278
Configuring the DHCPv6 relay agent··························································281
Overview························································································································································281
DHCPv6 relay agent configuration task list····································································································282
Enabling the DHCPv6 relay agent on an interface ························································································282
Specifying DHCPv6 servers on the relay agent·····························································································282
Setting the DSCP value for DHCPv6 packets sent by the DHCPv6 relay agent ···········································283
Specifying a padding mode for the Interface-ID option··················································································283
Configuring a DHCPv6 relay address pool ····································································································284
Specifying a gateway address for DHCPv6 clients························································································284
Displaying and maintaining the DHCPv6 relay agent ····················································································285
DHCPv6 relay agent configuration example··································································································285
Network requirements····························································································································285
Configuration procedure·························································································································286
Verifying the configuration······················································································································286
Configuring the DHCPv6 client···································································288
Overview························································································································································288
Configuration restrictions and guidelines·······································································································288
DHCPv6 client configuration task list·············································································································288
Configuring IPv6 address acquisition·············································································································288
Configuring IPv6 prefix acquisition·················································································································289
Configuring IPv6 address and prefix acquisition····························································································289
Configuring stateless DHCPv6 ······················································································································289
Configuring the DHCPv6 client DUID ············································································································290
Setting the DSCP value for DHCPv6 packets sent by the DHCPv6 client·····················································290
Displaying and maintaining DHCPv6 client····································································································291
DHCPv6 client configuration examples··········································································································291
IPv6 address acquisition configuration example····················································································291
IPv6 prefix acquisition configuration example························································································293
IPv6 address and prefix acquisition configuration example···································································294
Stateless DHCPv6 configuration example·····························································································296
Configuring DHCPv6 snooping···································································299
Overview························································································································································299
Application of trusted and untrusted ports······························································································299
Command and hardware compatibility···········································································································300
DHCPv6 snooping configuration task list·······································································································300
Configuring basic DHCPv6 snooping·············································································································300
Configuring Option 18 and Option 37 ············································································································301
Configuring DHCPv6 snooping entry auto backup ························································································301
Setting the maximum number of DHCPv6 snooping entries··········································································302
Enabling DHCPv6-REQUEST check·············································································································302
Configuring a DHCPv6 packet blocking port··································································································303
Enabling DHCPv6 snooping logging··············································································································303
Displaying and maintaining DHCPv6 snooping ·····························································································304
DHCPv6 snooping configuration example ·····································································································304
Network requirements····························································································································304
Configuration procedure·························································································································305
Verifying the configuration······················································································································305
Configuring IPv6 fast forwarding·································································306
Overview························································································································································306
Command and hardware compatibility···········································································································306

x
Configuring the aging time for IPv6 fast forwarding entries ···········································································306
Configuring IPv6 fast forwarding load sharing ·······························································································307
Displaying and maintaining IPv6 fast forwarding ···························································································307
Configuring tunneling··················································································308
Overview························································································································································308
IPv6 over IPv4 tunneling························································································································308
IPv4 over IPv4 tunneling························································································································310
IPv4 over IPv6 tunneling························································································································311
IPv6 over IPv6 tunneling························································································································315
Protocols and standards ························································································································315
Compatibility information································································································································316
Feature and hardware compatibility·······································································································316
Command and hardware compatibility···································································································316
Tunneling configuration task list·····················································································································316
Configuring a tunnel interface························································································································317
Configuring an IPv6 over IPv4 manual tunnel································································································318
Configuration example···························································································································319
Configuring an automatic IPv4-compatible IPv6 tunnel ·················································································321
Configuration example···························································································································322
Configuring a 6to4 tunnel·······························································································································323
6to4 tunnel configuration example·········································································································324
6to4 relay configuration example···········································································································325
Configuring an ISATAP tunnel·······················································································································327
Configuration example···························································································································328
Configuring an IPv4 over IPv4 tunnel ············································································································330
Configuration example···························································································································331
Configuring an IPv4 over IPv6 manual tunnel································································································333
Configuration example···························································································································334
Configuring a DS-Lite tunnel··························································································································335
Configuration example···························································································································337
Configuring an IPv6 over IPv6 tunnel ············································································································339
Configuration example···························································································································340
Displaying and maintaining tunneling configuration·······················································································342
Troubleshooting tunneling configuration········································································································342
Symptom················································································································································342
Analysis··················································································································································342
Solution··················································································································································342
Configuring GRE·························································································343
Overview························································································································································343
GRE encapsulation format·····················································································································343
GRE tunnel operating principle··············································································································343
GRE security mechanisms·····················································································································344
GRE application scenarios·····················································································································344
Protocols and standards ························································································································346
Configuring a GRE/IPv4 tunnel······················································································································347
Configuration guidelines·························································································································347
Configuration procedure·························································································································347
Configuring a GRE/IPv6 tunnel······················································································································349
Configuration guidelines·························································································································349
Configuration procedure·························································································································349
Displaying and maintaining GRE ···················································································································351
GRE configuration examples ·························································································································351
Configuring an IPv4 over IPv4 GRE tunnel····························································································351
Configuring an IPv4 over IPv6 GRE tunnel····························································································353
Troubleshooting GRE ····································································································································356
Symptom················································································································································356
Analysis··················································································································································356
Solution··················································································································································356

xi
Configuring ADVPN····················································································357
Overview························································································································································357
ADVPN structures··································································································································357
How ADVPN operates····························································································································359
NAT traversal·········································································································································362
ADVPN configuration task list························································································································362
Configuring AAA ············································································································································362
Configuring the VAM server···························································································································362
Creating an ADVPN domain ··················································································································363
Enabling the VAM server ·······················································································································363
Configuring a pre-shared key for the VAM server··················································································363
Configuring hub groups··························································································································364
Setting the port number of the VAM server····························································································365
Specifying authentication and encryption algorithms for the VAM server··············································366
Configuring an authentication method ···································································································366
Configuring keepalive parameters ·········································································································367
Setting the retry timer·····························································································································367
Configuring the VAM client ····························································································································367
Creating a VAM client ····························································································································368
Enabling VAM clients·····························································································································368
Specifying VAM servers·························································································································368
Specifying an ADVPN domain for a VAM client·····················································································369
Configuring a pre-shared key for a VAM client ······················································································369
Setting the retry interval and retry number for a VAM client ··································································369
Setting the dumb timer for a VAM client·································································································370
Configuring a username and password for a VAM client·······································································370
Configuring an ADVPN tunnel interface·········································································································370
Configuring routing·········································································································································372
Configuring IPsec for ADVPN tunnels ···········································································································372
Displaying and maintaining ADVPN···············································································································373
ADVPN configuration examples·····················································································································374
IPv4 full-mesh ADVPN configuration example·······················································································374
IPv6 full-mesh ADVPN configuration example·······················································································381
IPv4 hub-spoke ADVPN configuration example·····················································································389
IPv6 hub-spoke ADVPN configuration example·····················································································396
IPv4 multi-hub-group ADVPN configuration example············································································404
IPv6 multi-hub-group ADVPN configuration example············································································417
IPv4 full-mesh NAT traversal ADVPN configuration example································································432
Configuring AFT··························································································440
Overview························································································································································440
Command and hardware compatibility···········································································································440
AFT implementations·····································································································································440
Static AFT ··············································································································································440
Dynamic AFT ·········································································································································440
Prefix translation ····································································································································441
AFT internal server·································································································································442
AFT translation process·································································································································442
IPv6-initiated communication·················································································································443
IPv4-initiated communication·················································································································444
AFT configuration task list······························································································································445
IPv6-initiated communication·················································································································445
IPv4-initiated communication·················································································································445
Enabling AFT ·················································································································································445
Configuring an IPv6-to-IPv4 destination address translation policy·······························································445
Configuring an IPv6-to-IPv4 source address translation policy ·····································································446
Configuring an IPv4-to-IPv6 destination address translation policy·······························································447
Configuring an IPv4-to-IPv6 source address translation policy ·····································································448
Configuring AFT logging ································································································································448
Setting the ToS field to 0 for translated IPv4 packets····················································································449
Setting the Traffic Class field to 0 for translated IPv6 packets·······································································449

xii
Displaying and maintaining AFT ····················································································································449
AFT configuration examples ··························································································································451
Allowing IPv4 Internet access from an IPv6 network·············································································451
Providing FTP service from an IPv6 network to the IPv4 Internet··························································453
Allowing mutual access between IPv4 and IPv6 networks ····································································455
Allowing IPv6 Internet access from an IPv4 network·············································································457
Providing FTP service from an IPv4 network to the IPv6 Internet··························································459
Configuring WAAS······················································································462
TFO································································································································································462
Slow start optimization···························································································································462
Increased buffering ································································································································462
Congestion algorithm optimization·········································································································462
Selective acknowledgement···················································································································463
DRE ·······························································································································································463
DRE compression process·····················································································································463
DRE decompression process·················································································································463
LZ compression ·············································································································································464
Protocols and standards ································································································································464
Command and hardware compatibility···········································································································464
WAAS configuration task list··························································································································464
Configuring a WAAS class·····························································································································465
Configuring a WAAS policy····························································································································465
Applying a WAAS policy to an interface·········································································································466
Configuring TFO parameters ·························································································································466
Configuring the TFO blacklist autodiscovery feature ·····················································································467
Deleting all WAAS settings ····························································································································467
Restoring predefined WAAS settings·············································································································467
Displaying and maintaining WAAS ················································································································468
WAAS configuration examples ······················································································································468
Predefined WAAS policy configuration example····················································································468
User-defined WAAS policy configuration example·················································································470
Document conventions and icons·······························································474
Conventions···················································································································································474
Network topology icons··································································································································475
Support and other resources ······································································476
Accessing Hewlett Packard Enterprise Support ····························································································476
Accessing updates·········································································································································476
Websites ················································································································································477
Customer self repair·······························································································································477
Remote support······································································································································477
Documentation feedback ·······················································································································477
Index···········································································································479

1
Configuring ARP
Overview
ARP resolves IP addresses into MAC addresses on Ethernet networks.
ARP message format
ARP uses two types of messages: ARP request and ARP reply. Figure 1 shows the format of ARP
request/reply messages. Numbers in the figure refer to field lengths.
Figure 1 ARP message format
•Hardware type—Hardware address type. The value 1 represents Ethernet.
•Protocol type—Type of the protocol address to be mapped. The hexadecimal value 0x0800
represents IP.
•Hardware address length and protocol address length—Length, in bytes, of a hardware
address and a protocol address. For an Ethernet address, the value of the hardware address
length field is 6. For an IPv4 address, the value of the protocol address length field is 4.
•OP—Operation code, which describes the type of ARP message. The value 1 represents an
ARP request, and the value 2 represents an ARP reply.
•Sender hardware address—Hardware address of the device sending the message.
•Sender protocol address—Protocol address of the device sending the message.
•Target hardware address—Hardware address of the device to which the message is being
sent.
•Target protocol address—Protocol address of the device to which the message is being sent.
ARP operating mechanism
As shown in Figure 2, Host Aand Host B are on the same subnet. Host Asends a packet to Host B as
follows:
1. Host A looks through the ARP table for an ARP entry for Host B. If one entry is found, Host A
uses the MAC address in the entry to encapsulate the IP packet into a data link layer frame.
Then Host A sends the frame to Host B.
2. If Host A finds no entry for Host B, Host A buffers the packet and broadcasts an ARP request.
The payload of the ARP request contains the following information:
{Sender IP address and sender MAC address—HostA's IP address and MAC address.
{Target IP address—Host B's IP address.
{Target MAC address—An all-zero MAC address.

2
All hosts on this subnet can receive the broadcast request, but only the requested host (Host B)
processes the request.
3. Host B compares its own IP address with the target IP address in the ARP request. If they are
the same, Host B operates as follows:
a. Adds the sender IP address and sender MAC address into its ARP table.
b. Encapsulates its MAC address into an ARP reply.
c. Unicasts the ARP reply to Host A.
4. After receiving the ARP reply, Host A operates as follows:
a. Adds the MAC address of Host B into its ARP table.
b. Encapsulates the MAC address into the packet and sends the packet to Host B.
Figure 2 ARP address resolution process
If Host A and Host B are on different subnets, Host A sends a packet to Host B as follows:
5. Host A broadcasts an ARP request where the target IP address is the IP address of the
gateway.
6. The gateway responds with its MAC address in an ARP reply to Host A.
7. Host A uses the gateway's MAC address to encapsulate the packet, and then sends the packet
to the gateway.
8. If the gateway has an ARP entry for Host B, it forwards the packet to Host B directly. If not, the
gateway broadcasts an ARP request, in which the target IP address is the IP address of Host B.
9. After the gateway gets the MAC address of Host B, it sends the packet to Host B.
ARP table
An ARP table stores dynamic, static, OpenFlow, and Rule ARP entries.
Dynamic ARP entry
ARP automatically creates and updates dynamic entries. A dynamic ARP entry is removed when its
aging timer expires or the output interface goes down. In addition, a dynamic ARP entry can be
overwritten by a static ARP entry.
Static ARP entry
A static ARP entry is manually configured and maintained. It does not age out and cannot be
overwritten by any dynamic ARP entry.
Static ARP entries protect communication between devices because attack packets cannot modify
the IP-to-MAC mapping in a staticARP entry.
The device supports the following types of staticARP entries:

3
•Long static ARP entry—It contains the IP address, MAC address, and one of the following
combinations:
{VLAN and output interface.
{Receiving and output interfaces.
A long static ARP entry is directly used for forwarding packets.
•Short static ARP entry—It contains only the IP address and MAC address.
{If the output interface is a Layer 3 Ethernet interface, the short ARP entry can be directly
used to forward packets.
{If the output interface is a VLAN interface, the device sends an ARP request whose target IP
address is the IP address in the short entry. If the sender IP and MAC addresses in the
received ARP reply match the short static ARP entry, the device performs the following
operations:
−Adds the interface that received theARP reply to the short staticARP entry.
−Uses the resolved short staticARP entry to forward IP packets.
To communicate with a host by using a fixed IP-to-MAC mapping, configure a short staticARP entry
on the device. To communicate with a host by using a fixed IP-to-MAC mapping through an interface
in a VLAN, configure a long staticARP entry on the device.
OpenFlow ARP entry
ARP creates OpenFlow ARP entries by learning from the OpenFlow module. An OpenFlow ARP
entry does not age out, and it cannot be updated. It can be overwritten by a static ARP entry. An
OpenFlow ARP entry canbe used directly to forwardpackets. For more information about OpenFlow,
see OpenFlow Configuration Guide.
Rule ARP entry
ARP creates Rule ARP entries by learning from the IPoE, portal, VXLAN, and OVSDB modules. A
Rule ARP entry does not age out, and it cannot be updated. It can be overwritten by a static ARP
entry. A RuleARP entry can be used directly to forward packets.
For more information about IPoE, see Layer 2—WAN Access Configuration Guide. For more
information about portal, see Security Configuration Guide. For more information about VXLAN and
OVSDB, see VXLAN Configuration Guide.
Command and hardware compatibility
Commands and descriptions for centralized devices apply to the following routers:
•MSR1002-4/1003-8S.
•MSR2003.
•MSR2004-24/2004-48.
•MSR3012/3024/3044/3064.
•MSR954(JH296A/JH297A/JH298A/JH299A/JH373A).
•MSR958(JH300A/JH301A).
Commands and descriptions for distributed devices apply to MSR4060 and MSR4080 routers.
Configuring a static ARP entry
Static ARP entries are effective when the device functions correctly.
A resolved short static ARP entry becomes unresolved upon certain events, for example, when the
resolved output interface goes down, or the corresponding VLAN or VLAN interface is deleted.

4
Long static ARP entries can be effective or ineffective. Ineffective long static ARP entries cannot be
used for packet forwarding. Along static ARPentry is ineffective when any of thefollowing conditions
exists:
•The corresponding VLAN interface or output interface is down.
•The IP address in the entry conflicts with a local IP address.
•No local interface has an IP address in the same subnet as the IP address in the ARP entry.
A long static ARP entry in a VLAN is deleted if the VLAN or VLAN interface is deleted.
To configure a static ARP entry:
Step Command Remarks
1. Enter system view. system-view N/A
2. Configure a static ARP
entry.
•Configure a long static ARP entry:
arp static ip-address mac-address
[ vlan-id interface-type
interface-number ] [ vpn-instance
vpn-instance-name ]
•Configure a short static ARP entry:
arp static ip-address mac-address
[ vpn-instance vpn-instance-name ]
By default, no static ARP entries
exist.
Setting the maximum number of dynamic ARP
entries for a device
Adevice can dynamically learn ARP entries. To prevent a device from holding too manyARP entries,
you can set the maximum number of dynamic ARP entries that the device can learn. When the
maximum number is reached, the device stops learningARP entries.
If you set a value lower than the number of existing dynamic ARP entries, the device does not
remove the existing entries unless they are aged out.
To set the maximum number of dynamic ARP entries for a device:
Step Command Remarks
3. Enter system view. system-view N/A
4. Set the maximum
number of dynamic
ARP entries for the
device.
•Centralized devices in standalone
mode:
arp max-learning-number
max-number
•Distributed devices in standalone
mode/centralized devices in IRF mode:
arp max-learning-number
max-number slot slot-number [ cpu
cpu-number ]
•Distributed devices in IRF mode:
arp max-learning-number
max-number chassis chassis-number
slot slot-number [ cpu cpu-number ]
For information about the default
maximum number of dynamic
ARP entries for a device, see
Layer 3—IP Services Command
Reference.
To disable the device from
learning dynamic ARP entries,
set the number to 0.

5
Setting the maximum number of dynamic ARP
entries for an interface
An interface can dynamically learnARP entries. To prevent an interface from holding too many ARP
entries, you can set the maximum number of dynamic ARPentries that the interface can learn. When
the maximum number is reached, the interface stops learningARP entries.
You can set limits for both a Layer 2 interface and the VLAN interface for a permitted VLAN on the
Layer 2 interface. The Layer 2 interface learns anARP entry only when neither limit is reached.
The total number of dynamic ARP entries that all interfaces learn will not be larger than the maximum
number of dynamic ARP entries set for the device.
To set the maximum number of dynamic ARP entries for an interface:
Step Command Remarks
1. Enter system view. system-view N/A
2. Enter interface view. interface interface-type
interface-number N/A
3. Set the maximum number
of dynamic ARP entries for
the interface. arp max-learning-num
max-number
For information about the default
maximum number of dynamic ARP
entries for an interface, see Layer
3—IP Services Command Reference.
To disable the interface from learning
dynamic ARP entries, set the number
to 0.
Setting the aging timer for dynamic ARP entries
Each dynamic ARP entry in the ARP table has a limited lifetime, called an aging timer. The aging
timer of a dynamic ARP entry is reset each time the dynamic ARP entry is updated. Adynamic ARP
entry that is not updated before its aging timer expires is deleted from the ARP table.
To set the aging timer for dynamic ARP entries:
Step Command Remarks
1. Enter system view. system-view N/A
2. Set the aging timer for dynamic
ARP entries. arp timer aging aging-time The default setting is 20 minutes.
Enabling dynamic ARP entry check
The dynamic ARPentry check feature disables the device from supporting dynamic ARP entries that
contain multicast MAC addresses. The device cannot learn dynamic ARP entries containing
multicast MAC addresses. You cannot manually add static ARP entries containing multicast MAC
addresses.
When dynamic ARP entry check is disabled, ARP entries containing multicast MAC addresses are
supported. The device can learn dynamic ARP entries containing multicast MAC addresses obtained
from the ARP packets sourced from a unicast MAC address. You can also manually add static ARP
entries containing multicast MAC addresses.

6
To enable dynamic ARP entry check:
Step Command Remarks
1. Enter system view. system-view N/A
2. Enable dynamic ARP entry
check. arp check enable By default, dynamic ARP entry check is
enabled.
Enabling ARP logging
This feature enables a device to log ARP events when ARP cannot resolve IP addresses correctly.
The device can log the followingARP events:
•On a proxy ARP-disabled interface, the target IPaddress of a received ARPpacket is not one of
the following IP addresses:
{The IP address of the receiving interface.
{The virtual IP address of the VRRP group.
{The public IP address after NAT.
•The sender IPaddress of a received ARPreply conflicts with one of the following IPaddresses:
{The IP address of the receiving interface.
{The virtual IP address of the VRRP group.
{The public IP address after NAT.
The device sends ARPlog messages to the information center. You can use the info-center source
command to specify the log output rules for the information center. For more information about
information center, see Network Management and Monitoring Configuration Guide.
To enable the ARP logging feature:
Step Command Remarks
1. Enter system view. system-view N/A
2. Enable the ARP logging
feature. arp check log enable By default, ARP logging is disabled.
Displaying and maintaining ARP
IMPORTANT:
Clearing ARP entries from the ARP tablemight cause communication failures. Make sure the entries
to be cleared do not affect current communications.
Execute display commands in any view and reset commands in user view.
Task Command
Display ARP entries (centralized devices
in standalone mode). display arp [ [ all | dynamic | static ] | vlan vlan-id | interface
interface-type interface-number ] [ count | verbose ]
Display ARP entries (distributed devices
in standalone mode/centralized devices in
IRF mode).
display arp [ [ all | dynamic | static ] [ slot slot-number ] | vlan
vlan-id | interface interface-type interface-number ] [ count |
verbose ]