HPE FlexFabric 5700 Series User manual
HPE FlexFabric 5700 Switch Series
Network Management and Monitoring Configuration
Guide
Part number: 5998-5594R
Software version: Release 2422P01 and later
Document version: 6W100-20160331
© Copyright 2016 Hewlett Packard Enterprise Development LP
The information contained herein is subject to change without notice. The only warranties for Hewlett Packard
Enterprise products and services are set forth in the express warranty statements accompanying such
products and services. Nothing herein should be construed as constituting an additional warranty. Hewlett
Packard Enterprise shall not be liable for technical or editorial errors or omissions contained herein.
Confidential computer software. Valid license from Hewlett Packard Enterprise required for possession, use, or
copying. Consistent with FAR 12.211 and 12.212, Commercial Computer Software, Computer Software
Documentation, and Technical Data for Commercial Items are licensed to the U.S. Government under vendor’s
standard commercial license.
Links to third-party websites take you outside the Hewlett Packard Enterprise website. Hewlett Packard
Enterprise has no control over and is not responsible for information outside the Hewlett Packard Enterprise
website.
Acknowledgments
Intel®, Itanium®, Pentium®, Intel Inside®, and the Intel Inside logo are trademarks of Intel Corporation in the
United States and other countries.
Microsoft® and Windows® are trademarks of the Microsoft group of companies.
Adobe® andAcrobat® are trademarks ofAdobe Systems Incorporated.
Java and Oracle are registered trademarks of Oracle and/or its affiliates.
UNIX® is a registered trademark of The Open Group.
i
Contents
Using ping, tracert, and system debugging·····················································1
Ping····································································································································································1
Using a ping command to test network connectivity··················································································1
Ping example ·············································································································································1
Tracert································································································································································3
Prerequisites··············································································································································4
Using a tracert command to identify failed or all nodes in a path·······························································4
Tracert example·········································································································································4
System debugging ·············································································································································5
Debugging information control switches ····································································································6
Debugging a feature module······················································································································6
Configuring NTP ·····························································································7
Overview····························································································································································7
How NTP works ·········································································································································7
NTP architecture········································································································································8
Association modes·····································································································································9
NTP security·············································································································································10
Protocols and standards ··························································································································11
Configuration restrictions and guidelines·········································································································11
Configuration task list·······································································································································11
Enabling the NTP service ································································································································12
Configuring NTP association mode ·················································································································12
Configuring NTP in client/server mode ····································································································12
Configuring NTP in symmetric active/passive mode················································································13
Configuring NTP in broadcast mode········································································································13
Configuring NTP in multicast mode··········································································································14
Configuring access control rights·····················································································································15
Configuring NTP authentication·······················································································································15
Configuring NTP authentication in client/server mode·············································································15
Configuring NTP authentication in symmetric active/passive mode ························································17
Configuring NTP authentication in broadcast mode·················································································19
Configuring NTP authentication in multicast mode··················································································21
Configuring NTP optional parameters··············································································································23
Specifying the source interface for NTP messages·················································································23
Disabling an interface from receiving NTP messages ·············································································24
Configuring the maximum number of dynamic associations····································································24
Setting a DSCP value for NTP packets····································································································25
Configuring the local clock as a reference source ···························································································25
Displaying and maintaining NTP······················································································································26
NTP configuration examples····························································································································26
NTP client/server mode configuration example ·······················································································26
IPv6 NTP client/server mode configuration example···············································································27
NTP symmetric active/passive mode configuration example···································································28
IPv6 NTP symmetric active/passive mode configuration example···························································30
NTP broadcast mode configuration example···························································································31
NTP multicast mode configuration example·····························································································33
IPv6 NTP multicast mode configuration example ····················································································35
Configuration example for NTP client/server mode with authentication···················································38
Configuration example for NTP broadcast mode with authentication······················································40
Configuring SNTP·························································································43
Configuration restrictions and guidelines·········································································································43
Configuration task list·······································································································································43
Enabling the SNTP service······························································································································43
Specifying an NTP server for the device··········································································································43
Configuring SNTP authentication·····················································································································44
ii
Displaying and maintaining SNTP ···················································································································45
SNTP configuration example ···························································································································45
Configuring PTP····························································································47
Overview··························································································································································47
Basic concepts·········································································································································47
Synchronization mechanism····················································································································49
Protocols and standards ··························································································································51
Configuring clock nodes···································································································································51
Configuration task list·······························································································································51
Specifying a PTP standard·······················································································································53
Specifying a clock node type····················································································································53
Specifying a PTP domain·························································································································53
Configuring an OC to operate only as a member clock ···········································································53
Configuring the role of a PTP port············································································································54
Configuring the mode for carrying timestamps ························································································54
Specifying a delay measurement mechanism for a BC or an OC····························································55
Configuring the port type for a TC+OC ····································································································55
Setting the interval for sending announce messages ··············································································55
Specifying the number of announcement intervals before the receiving node stops receiving announce
messages·················································································································································56
Setting the interval for sending Pdelay_Req messages···········································································56
Setting the interval for sending Sync messages······················································································56
Setting the minimum interval for sending Delay_Req messages·····························································57
Configuring the MAC address for non-pdelay messages·········································································57
Specifying the protocol for encapsulating PTP messages as UDP (IPv4)···············································58
Specifying the source IP address for UDP packets ·················································································58
Setting the delay correction value············································································································58
Setting the cumulative offset between the UTC and TAI ·········································································58
Setting the correction date of the UTC·····································································································59
Configuring the parameters of the BITS clock ·························································································59
Configuring a priority of the clock·············································································································60
Specifying the system time source as PTP······························································································60
Enabling PTP on a port····························································································································60
Displaying and maintaining PTP······················································································································60
PTP configuration examples····························································································································61
PTP configuration example (IEEE 1588 version 2)··················································································61
PTP configuration example (IEEE 802.1AS)····························································································63
Configuring the information center································································66
Overview··························································································································································66
Log types··················································································································································66
Log levels·················································································································································66
Log destinations·······································································································································67
Default output rules for logs·····················································································································67
Default output rules for diagnostic logs····································································································67
Default output rules for security logs········································································································67
Default output rules for hidden logs ·········································································································68
Default output rules for trace logs············································································································68
Log formats··············································································································································68
FIPS compliance··············································································································································70
Information center configuration task list ·········································································································71
Outputting logs to the console ·························································································································71
Outputting logs to the monitor terminal············································································································71
Outputting logs to a log host ····························································································································72
Outputting logs to the log buffer·······················································································································73
Saving logs to the log file·································································································································73
Managing security logs ····································································································································74
Saving security logs to the security log file ······························································································74
Managing the security log file···················································································································75
Saving diagnostic logs to the diagnostic log file·······························································································75
Configuring the maximum size of the trace log file ··························································································76
iii
Enabling synchronous information output········································································································76
Enabling duplicate log suppression ·················································································································77
Disabling an interface from generating link up or link down logs·····································································77
Displaying and maintaining information center ································································································77
Setting the minimum storage time for logs·······································································································78
Information center configuration examples······································································································78
Configuration example for outputting logs to the console········································································78
Configuration example for outputting logs to a UNIX log host ·································································79
Configuration example for outputting logs to a Linux log host ·································································80
Configuring SNMP························································································82
Overview··························································································································································82
SNMP framework·····································································································································82
MIB and view-based MIB access control·································································································82
SNMP operations·····································································································································83
Protocol versions······································································································································83
Access control modes······························································································································83
SNMP silence···········································································································································84
FIPS compliance··············································································································································84
Configuring SNMP basic parameters···············································································································84
Configuring SNMPv1 or SNMPv2c basic parameters··············································································84
Configuring SNMPv3 basic parameters···································································································86
Configuring SNMP logging·······························································································································89
Configuring SNMP notifications ·······················································································································90
Enabling SNMP notifications····················································································································90
Configuring the SNMP agent to send notifications to a host····································································91
Displaying the SNMP settings··························································································································92
SNMPv1/SNMPv2c configuration example······································································································93
SNMPv3 in VACM mode configuration example ·····························································································94
SNMPv3 in RBAC mode configuration example······························································································96
Configuring RMON························································································99
Overview··························································································································································99
RMON groups··········································································································································99
Sample types for the alarm group and the private alarm group·····························································101
Protocols and standards ························································································································101
Configuring the RMON statistics function ······································································································101
Creating an RMON Ethernet statistics entry··························································································101
Creating an RMON history control entry································································································101
Configuring the RMON alarm function···········································································································102
Displaying and maintaining RMON settings···································································································103
RMON configuration examples······················································································································103
Ethernet statistics group configuration example ····················································································103
History group configuration example······································································································104
Alarm function configuration example····································································································106
Configuring NQA·························································································108
Overview························································································································································108
NQA operation ·······································································································································108
Collaboration··········································································································································109
Threshold monitoring ·····························································································································109
NQA configuration task list·····························································································································110
Configuring the NQA server···························································································································110
Enabling the NQA client·································································································································111
Configuring NQA operations on the NQA client·····························································································111
NQA operation configuration task list·····································································································111
Configuring the ICMP echo operation····································································································111
Configuring the DHCP operation············································································································112
Configuring the DNS operation··············································································································113
Configuring the FTP operation···············································································································114
Configuring the HTTP operation ············································································································115
Configuring the UDP jitter operation ······································································································116
iv
Configuring the SNMP operation ···········································································································117
Configuring the TCP operation···············································································································117
Configuring the UDP echo operation ·····································································································118
Configuring the UDP tracert operation···································································································119
Configuring the voice operation ·············································································································120
Configuring the DLSw operation············································································································122
Configuring the path jitter operation·······································································································123
Configuring optional parameters for the NQA operation········································································124
Configuring the collaboration feature·····································································································125
Configuring threshold monitoring···········································································································125
Configuring the NQA statistics collection feature···················································································128
Configuring the saving of NQA history records······················································································128
Scheduling the NQA operation on the NQA client ·················································································129
Configuring NQA templates on the NQA client······························································································129
Configuring the ICMP template··············································································································129
Configuring the DNS template ···············································································································130
Configuring the TCP template················································································································131
Configuring the UDP template ···············································································································132
Configuring the HTTP template··············································································································133
Configuring the FTP template················································································································134
Configuring optional parameters for the NQA template·········································································135
Displaying and maintaining NQA ···················································································································136
NQA configuration examples ·························································································································137
ICMP echo operation configuration example·························································································137
DHCP operation configuration example·································································································138
DNS operation configuration example ···································································································139
FTP operation configuration example····································································································141
HTTP operation configuration example··································································································142
UDP jitter operation configuration example····························································································143
SNMP operation configuration example·································································································145
TCP operation configuration example····································································································147
UDP echo operation configuration example···························································································148
UDP tracert operation configuration example························································································149
Voice operation configuration example··································································································151
DLSw operation configuration example ·································································································153
Path jitter operation configuration example····························································································154
NQA collaboration configuration example······························································································156
ICMP template configuration example···································································································158
DNS template configuration example·····································································································159
TCP template configuration example·····································································································160
UDP template configuration example·····································································································160
HTTP template configuration example···································································································161
FTP template configuration example ·····································································································162
Configuring port mirroring···········································································164
Overview························································································································································164
Terminology ···········································································································································164
Port mirroring classification and implementation····················································································165
Configuring local port mirroring······················································································································166
Local port mirroring configuration task list······························································································166
Creating a local mirroring group·············································································································167
Configuring source ports for the local mirroring group···········································································167
Configuring the monitor port for the local mirroring group······································································168
Configure local port mirroring with multiple monitor ports······································································168
Configuring Layer 2 remote port mirroring·····································································································170
Configuring a remote destination group on the destination device························································170
Configuring a remote source group on the source device ·····································································172
Displaying and maintaining port mirroring······································································································174
Port mirroring configuration examples ···········································································································174
Local port mirroring configuration example····························································································174
Layer 2 remote port mirroring configuration example ············································································176
Local port mirroring with multiple monitor ports configuration example·················································178
v
Configuring flow mirroring···········································································180
Overview························································································································································180
Flow mirroring configuration task list··············································································································180
Configuring match criteria······························································································································180
Configuring a traffic behavior·························································································································181
Configuring a QoS policy ·······························································································································181
Applying a QoS policy····································································································································181
Applying a QoS policy to an interface····································································································181
Applying a QoS policy to a VLAN···········································································································182
Applying a QoS policy globally···············································································································182
Applying a QoS policy to the control plane ····························································································182
Flow mirroring configuration example············································································································182
Network requirements····························································································································182
Configuration procedure·························································································································183
Verifying the configuration······················································································································184
Configuring sFlow·······················································································185
Protocols and standards ································································································································185
sFlow configuration task list···························································································································185
Configuring the sFlow agent and sFlow collector information········································································186
Configuring flow sampling······························································································································186
Configuring counter sampling ························································································································187
Displaying and maintaining sFlow··················································································································187
sFlow configuration example ·························································································································187
Network requirements····························································································································187
Configuration procedure·························································································································188
Verifying the configuration······················································································································188
Troubleshooting sFlow configuration ·············································································································189
The remote sFlow collector cannot receive sFlow packets····································································189
Monitoring and maintaining processes ·······················································190
Displaying and maintaining processes···········································································································190
Displaying and maintaining user processes···································································································190
Monitoring kernel threads ······························································································································191
Configuring kernel thread deadloop detection ·······················································································191
Configuring kernel thread starvation detection·······················································································192
Displaying and maintaining kernel threads ····························································································192
Configuring EAA ·························································································194
Overview························································································································································194
EAA framework······································································································································194
Elements in a monitor policy··················································································································195
EAA environment variables····················································································································196
Configuring a user-defined EAA environment variable··················································································197
Configuring a monitor policy ··························································································································198
Configuration restrictions and guidelines·······························································································198
Configuring a monitor policy from the CLI······························································································198
Configuring a monitor policy by using Tcl ······························································································199
Suspending monitor policies··························································································································200
Displaying and maintaining EAA settings ······································································································200
EAA configuration examples··························································································································201
CLI-defined policy configuration example······························································································201
CLI-defined policy with EAA environment variables configuration example ··········································202
Tcl-defined policy configuration example·······························································································203
Configuring CWMP·····················································································205
Overview························································································································································205
CWMP network framework ····················································································································205
Basic CWMP functions···························································································································205
How CWMP works·································································································································206
Configuration task list·····································································································································208
vi
Enabling CWMP from the CLI························································································································209
Configuring ACS attributes ····························································································································209
Configuring the preferred ACS attributes·······························································································209
Configuring the default ACS attributes from the CLI··············································································210
Configuring CPE attributes ····························································································································211
Configuring ACS authentication parameters··························································································211
Configuring the provision code···············································································································211
Configuring the CWMP connection interface·························································································212
Configuring autoconnect parameters·····································································································212
Enabling NAT traversal for the CPE·······································································································213
Specifying an SSL client policy for HTTPS connection to ACS ·····························································214
Displaying and maintaining CWMP················································································································214
CWMP configuration example ·······················································································································214
Network requirements····························································································································214
Configuration procedure·························································································································215
Verifying the configuration······················································································································224
Configuring NETCONF···············································································225
Overview························································································································································225
NETCONF structure·······························································································································225
NETCONF message format···················································································································226
How to use NETCONF···························································································································227
Protocols and standards ························································································································227
FIPS compliance············································································································································228
NETCONF configuration task list···················································································································228
Enabling NETCONF over SOAP····················································································································228
Enabling NETCONF over SSH ······················································································································229
Enabling NETCONF logging··························································································································229
Establishing a NETCONF session·················································································································229
Entering xml view···································································································································230
Exchanging capabilities··························································································································230
Subscribing to event notifications ··················································································································230
Subscription procedure··························································································································230
Example for subscribing to event notifications·······················································································231
Locking/unlocking the configuration···············································································································233
Locking the configuration·······················································································································233
Unlocking the configuration····················································································································233
Example for locking the configuration····································································································234
Performing service operations ·······················································································································235
Performing the <get>/<get-bulk> operation ···························································································235
Performing the <get-config>/<get-bulk-config> operation······································································236
Performing the <edit-config> operation··································································································237
All-module configuration data retrieval example····················································································237
Syslog configuration data retrieval example ··························································································239
Example for retrieving a data entry for the interface table ·····································································240
Example for changing the value of a parameter ····················································································241
Saving, rolling back, and loading the configuration························································································242
Saving the configuration·························································································································242
Rolling back the configuration················································································································243
Loading the configuration·······················································································································243
Example for saving the configuration·····································································································243
Filtering data ··················································································································································244
Example for filtering data with regular expression match·······································································247
Example for filtering data by conditional match······················································································248
Performing CLI operations through NETCONF ·····························································································249
Configuration procedure·························································································································249
CLI operation example···························································································································250
Retrieving NETCONF session information ····································································································251
Terminating another NETCONF session ·······································································································252
Configuration example···························································································································252
Returning to the CLI·······································································································································253
vii
Appendix·····································································································254
Appendix A Supported NETCONF operations·······························································································254
Configuring the packet capture···································································262
Overview························································································································································262
Filter elements········································································································································262
Building a capture filter···························································································································267
Building a display filter ···························································································································268
Configuring packet capture····························································································································269
Saving captured packets to a file···········································································································269
Filtering packet data to display···············································································································269
Displaying the contents in a packet file··········································································································270
Packet capture configuration examples·········································································································270
Filtering packet data to display configuration example ··········································································270
Saving captured packets to a file configuration example·······································································271
Document conventions and icons·······························································272
Conventions···················································································································································272
Network topology icons··································································································································273
Support and other resources ······································································274
Accessing Hewlett Packard Enterprise Support ····························································································274
Accessing updates·········································································································································274
Websites ················································································································································275
Customer self repair·······························································································································275
Remote support······································································································································275
Documentation feedback ·······················································································································275
Index···········································································································277
1
Using ping, tracert, and system
debugging
This chapter covers ping, tracert, and information about debugging the system.
Ping
Use the ping utility to determine if a specific address is reachable.
Ping sends ICMP echo requests (ECHO-REQUEST) to the destination device. Upon receiving the
requests, the destination device responds with ICMP echo replies (ECHO-REPLY) to the source
device. The source device outputs statistics about the ping operation, including the number of
packets sent, number of echo replies received, and the round-trip time. You can measure the
network performance by analyzing these statistics.
Using a ping command to test network connectivity
Execute ping commands in any view.
Task Command
Determine if an address in an IP network is
reachable.
When you configure the ping command for a low-speed
network, set a larger value for the timeout timer (indicated by
the -t keyword in the command).
•For IPv4 networks:
ping [ ip ] [ -a source-ip | -c count | -f | -httl | -i
interface-type interface-number | -m interval | -n | -p pad |
-q | -r | -s packet-size | -t timeout | -tos tos | -v ] * host
•For IPv6 networks:
ping ipv6 [ -a source-ipv6 | -c count | -i interface-type
interface-number | -m interval | -q | -s packet-size | -t
timeout | -v | -tc traffic-class ] * host
Ping example
Network requirements
As shown in Figure 1, determine if Device A and Device C can reach each other. If they can reach
each other, get detailed information about routes from Device A to Device C.
2
Figure 1 Network diagram
Configuration procedure
# Use the ping command on DeviceA to test connectivity to Device C.
<DeviceA> ping 1.1.2.2
Ping 1.1.2.2 (1.1.2.2): 56 data bytes, press CTRL_C to break
56 bytes from 1.1.2.2: icmp_seq=0 ttl=254 time=2.137 ms
56 bytes from 1.1.2.2: icmp_seq=1 ttl=254 time=2.051 ms
56 bytes from 1.1.2.2: icmp_seq=2 ttl=254 time=1.996 ms
56 bytes from 1.1.2.2: icmp_seq=3 ttl=254 time=1.963 ms
56 bytes from 1.1.2.2: icmp_seq=4 ttl=254 time=1.991 ms
--- Ping statistics for 1.1.2.2 ---
5 packet(s) transmitted, 5 packet(s) received, 0.0% packet loss
round-trip min/avg/max/std-dev = 1.963/2.028/2.137/0.062 ms
The output shows the following information:
•Device A sends five ICMP packets to Device C and Device A receives five ICMP packets.
•No ICMP packet is lost.
•The route is reachable.
# Get detailed information about routes from DeviceA to Device C.
<DeviceA> ping -r 1.1.2.2
Ping 1.1.2.2 (1.1.2.2): 56 data bytes, press CTRL_C to break
56 bytes from 1.1.2.2: icmp_seq=0 ttl=254 time=4.685 ms
RR: 1.1.2.1
1.1.2.2
1.1.1.2
1.1.1.1
56 bytes from 1.1.2.2: icmp_seq=1 ttl=254 time=4.834 ms (same route)
56 bytes from 1.1.2.2: icmp_seq=2 ttl=254 time=4.770 ms (same route)
56 bytes from 1.1.2.2: icmp_seq=3 ttl=254 time=4.812 ms (same route)
56 bytes from 1.1.2.2: icmp_seq=4 ttl=254 time=4.704 ms (same route)
--- Ping statistics for 1.1.2.2 ---
5 packet(s) transmitted, 5 packet(s) received, 0.0% packet loss
round-trip min/avg/max/std-dev = 4.685/4.761/4.834/0.058 ms
The test procedure of ping –r is as shown in Figure 1:
3
1. The source device (Device A) sends an ICMP echo request to the destination device (Device C)
with the RR option blank.
2. The intermediate device (Device B) adds the IP address of its outbound interface (1.1.2.1) to
the RR option of the ICMP echo request, and forwards the packet.
3. Upon receiving the request, the destination device copies the RR option in the request and
adds the IP address of its outbound interface (1.1.2.2) to the RR option. Then the destination
device sends an ICMP echo reply.
4. The intermediate device adds the IP address of its outbound interface (1.1.1.2) to the RR option
in the ICMP echo reply, and then forwards the reply.
5. Upon receiving the reply, the source device adds the IP address of its inbound interface (1.1.1.1)
to the RR option. The detailed information of routes between Device A and Device C is
formatted as: 1.1.1.1 <-> {1.1.1.2; 1.1.2.1} <-> 1.1.2.2.
Tracert
Tracert (also called Traceroute) retrieves the IP addresses of Layer3 devices in the path to a specific
destination. In the event of network failure, use tracert to test network connectivity and identify failed
nodes.
Figure 2 Tracert operation
Tracert uses received ICMP error messages to get the IP addresses of devices. Tracert works as
shown in Figure 2:
1. The source device sends a UDP packet with a TTL value of 1 to the destination device. The
destination UDP port is not used by any application on the destination device.
2. The first hop (Device B, the first Layer 3 device that receives the packet) responds by sending a
TTL-expired ICMP error message to the source, with its IP address (1.1.1.2) encapsulated. This
way, the source device can get the address of the first Layer 3 device (1.1.1.2).
3. The source device sends a packet with a TTL value of 2 to the destination device.
4. The second hop (Device C) responds with a TTL-expired ICMP error message, which gives the
source device the address of the second Layer 3 device (1.1.2.2).
5. This process continues until a packet sent by the source device reaches the ultimate
destination device. Because no application uses the destination port specified in the packet, the
destination device responds with a port-unreachable ICMP message to the source device, with
its IP address encapsulated. This way, the source device gets the IP address of the destination
device (1.1.3.2).
6. The source device thinks that the packet has reached the destination device after receiving the
port-unreachable ICMP message, and the path to the destination device is 1.1.1.2 to 1.1.2.2 to
1.1.3.2.
Device A Device B Device DDevice C
1.1.1.1/24
1.1.1.2/24
Hop Lmit=1
TTL exceeded
1.1.2.1/24 1.1.3.1/24
1.1.2.2/24 1.1.3.2/24
Hop Lmit=2
TTL exceeded
UDP port unreachable
Hop Lmit=n
4
Prerequisites
Before you use a tracert command, perform the tasks in this section.
For an IPv4 network:
•Enable sending of ICMP timeout packets on the intermediate devices (devices between the
source and destination devices). If the intermediate devices are HPE devices, execute the ip
ttl-expires enable command on the devices. For more information about this command, see
Layer 3—IP Services Command Reference.
•Enable sending of ICMP destination unreachable packets on the destination device. If the
destination device is an HPE device, execute the ip unreachables enable command. For more
information about this command, see Layer 3—IP Services Command Reference.
For an IPv6 network:
•Enable sending of ICMPv6 timeout packets on the intermediate devices (devices between the
source and destination devices). If the intermediate devices are HPE devices, execute the ipv6
hoplimit-expires enable command on the devices. For more information about this command,
see Layer 3—IP Services Command Reference.
•Enable sending of ICMPv6 destination unreachable packets on the destination device. If the
destination device is an HPE device, execute the ipv6 unreachables enable command. For
more information about this command, see Layer 3—IP Services Command Reference.
Using a tracert command to identify failed or all nodes in a
path
Execute tracert commands in any view.
Task Command
Display the routes from source
to destination.
•For IPv4 networks:
tracert [ -a source-ip | -f first-ttl |-m max-ttl | -p port | -q
packet-number | -t tos | -w timeout ] * host
•For IPv6 networks:
tracert ipv6 [ -f first-hop | -m max-hops | -p port | -q packet-number |
-t traffic-class | -w timeout ] * host
Tracert example
Network requirements
As shown in Figure 3, Device Afailed to Telnet to Device C.
Test the network connectivity between Device A and Device C. If they cannot reach each other,
locate the failed nodes in the network.
Figure 3 Network diagram
Configuration procedure
1. Configure the IP addresses for devices as shown in Figure 3. (Details not shown.)
Device A Device B Device C
1.1.1.1/24 1.1.1.2/24 1.1.2.1/24 1.1.2.2/24
5
2. Configure a static route on DeviceA.
<DeviceA> system-view
[DeviceA] ip route-static 0.0.0.0 0.0.0.0 1.1.1.2
[DeviceA] quit
3. Use the ping command to test connectivity between DeviceA and Device C.
<DeviceA> ping 1.1.2.2
Ping 1.1.2.2(1.1.2.2): 56 -data bytes, press CTRL_C to break
Request time out
Request time out
Request time out
Request time out
Request time out
--- Ping statistics for 1.1.2.2 ---
5 packet(s) transmitted,0 packet(s) received,100.0% packet loss
The output shows that DeviceA and Device C cannot reach each other.
4. Use the tracert command to identify failed nodes:
# Enable sending of ICMP timeout packets on Device B.
<DeviceB> system-view
[DeviceB] ip ttl-expires enable
# Enable sending of ICMP destination unreachable packets on Device C.
<DeviceC> system-view
[DeviceC] ip unreachables enable
# Execute the tracert command on Device A.
<DeviceA> tracert 1.1.2.2
traceroute to 1.1.2.2(1.1.2.2) 30 hops at most,40 bytes each packet, press CTRL_C to
break
1 1.1.1.2 (1.1.1.2) 1 ms 2 ms 1 ms
2 * * *
3 * * *
4 * * *
5
<DeviceA>
The output shows that Device A can reach Device B but cannot reach Device C. An error has
occurred on the connection between Device B and Device C.
5. To identify the cause of the problem, execute the following commands on Device A and Device
C:
{Execute the debugging ip icmp command and verify that Device Aand Device C can send
and receive the correct ICMP packets.
{Execute the display ip routing-table command to verify that Device Aand Device C have a
route to each other.
System debugging
The device supports debugging for the majority of protocols and features and provides debugging
information to help users diagnose errors.
6
Debugging information control switches
The following switches control the display of debugging information:
•Module debugging switch—Controls whether to generate the module-specific debugging
information.
•Screen output switch—Controls whether to display the debugging information on a certain
screen. Use terminal monitor and terminal logging level commands to turn on the screen
output switch. For more information about these two commands, see Network Management
and Monitoring Command Reference.
As shown in Figure 4, the device can provide debugging for the three modules 1, 2, and 3. The
debugging information can be output on a terminal only when both the module debugging switch and
the screen output switch are turned on.
Debugging information is typically displayed on a console. You can also send debugging information
to other destinations. For more information, see "Configuring the information center."
Figure 4 Relationship between the module and screen output switch
Debugging a feature module
Output of debugging commands is memory intensive. To guarantee system performance, enable
debugging only for modules that are in an exceptional condition. When debugging is complete, use
the undo debugging all command to disable all the debugging functions.
To debug a feature module:
Step Command Remarks
1. Enable debugging for a
module in user view. debugging { all [ timeout time ] |
module-name [ option ] } By default, all debugging
functions are disabled.
2. (Optional.) Display the
enabled debugging in any
view. display debugging
[module-name ] N/A
7
Configuring NTP
Synchronize your device with a trusted time source by using the Network Time Protocol (NTP) or
changing the system time before you run it on a live network. Various tasks, including network
management, charging, auditing, and distributed computing depend on an accurate system time
setting, because the timestamps of system messages and logs use the system time.
Overview
NTP is typically used in large networks to dynamically synchronize time among network devices. It
guarantees higher clock accuracy than manual system clock setting. In a small network that does not
require high clock accuracy, you can keep time synchronized among devices by changing their
system clocks one by one.
NTP runs over UDP and uses UDP port 123.
NOTE:
The term "interface" in this chapter collectively refers to Layer 3 interfaces.
How NTP works
Figure 5 shows how NTP synchronizes the system time between two devices, in this example,
Device A and Device B. Assume that:
•Prior to the time synchronization, the time is set to 10:00:00 am for Device Aand 11:00:00 am
for Device B.
•Device B is used as the NTP server. Device A is to be synchronized to Device B.
•It takes 1 second for an NTPmessage to travel from Device Ato Device B, and from Device B to
Device A.
•It takes 1 second for Device B to process the NTP message.
Figure 5 Basic work flow
The synchronization process is as follows:
8
1. Device A sends Device B an NTP message, which is timestamped when it leaves Device A.
The time stamp is 10:00:00 am (T1).
2. When this NTP message arrives at Device B, Device B adds a timestamp showing the time
when the message arrived at Device B. The timestamp is 11:00:01 am (T2).
3. When the NTP message leaves Device B, Device B adds a timestamp showing the time when
the message left Device B. The timestamp is 11:00:02 am (T3).
4. When Device A receives the NTP message, the local time of Device A is 10:00:03 am (T4).
Up to now, Device A can calculate the following parameters based on the timestamps:
•The roundtrip delay of the NTP message: Delay = (T4 – T1) – (T3 – T2) = 2 seconds.
•Time difference between Device A and Device B: Offset = ((T2 – T1) + (T3 – T4)) /2 = 1 hour.
Based on these parameters, DeviceA can be synchronized to Device B.
This is only a rough description of the work mechanism of NTP. For more information, see the related
protocols and standards.
NTP architecture
NTP uses stratums 1 to 16 to define clock accuracy, as shown in Figure 6. A lower stratum value
represents higheraccuracy. Clocks at stratums 1 through 15 are in synchronized state, and clocks at
stratum 16 are not synchronized.
Figure 6 NTP architecture
Typically, a stratum 1 NTP server gets its time from an authoritative time source, such as an atomic
clock, and provides time for other devices as the primary NTPserver. The accuracy of each server is
the stratum, with the topmost level (primary servers) assigned as one and each level downwards in
the hierarchy assigned as one greater than the preceding level. NTPuses a stratum to describe how
many NTP hops away a device is from the primary time server. A stratum 2 time server receives its
time from a stratum 1 time server, and so on.
To ensure time accuracy and availability, you can specify multiple NTP servers for a device. The
device selects an optimal NTP server as the clock source based on parameters such as stratum. The
clock that the device selects is called the reference source. For more information about clock
selection, see the related protocols and standards.
Primary servers
(Stratum 1)
Authoritative
clock
Server
Secondary servers
(Stratum 2)
Tertiary servers
(Stratum 3)
Quaternary servers
(Stratum 4)
Client Symmetric
peer
Symmetric
peer
Broadcast/multicast
server
Broadcast/multicast
client
9
If the devices in a network cannot synchronize to an authoritative time source, you can select a
device that has a relatively accurate clock from the network, and use the local clock of the device as
the reference clock to synchronize other devices in the network.
Association modes
NTP supports the following association modes:
•Client/server mode
•Symmetric active/passive mode
•Broadcast mode
•Multicast mode
Table 1 NTP association modes
Mode Working process Principle Application scenario
Client/server
On the client, specify the IP
address of the NTP server.
A client sends a clock
synchronization message to the
NTP servers. Upon receiving the
message, the servers
automatically operate in server
mode and send a reply.
If the client can be synchronized
to multiple time servers, it selects
an optimal clock and
synchronizes its local clock to the
optimal reference source after
receiving the replies from the
servers.
A client can be
synchronized to a
server, but a server
cannot be synchronized
to a client.
As Figure 6 shows, this
mode is intended for
configurations where
devices of a higher
stratum are synchronized
to devices with a lower
stratum.
Symmetric
active/passive
On the symmetric active peer,
specify the IP address of the
symmetric passive peer.
A symmetric active peer
periodically sends clock
synchronization messages to a
symmetric passive peer. The
symmetric passive peer
automatically operates in
symmetric passive mode and
sends a reply.
If the symmetric active peer can
be synchronized to multiple time
servers, it selects an optimal
clock and synchronizes its local
clock to the optimal reference
source after receiving the replies
from the servers.
A symmetric active peer
and a symmetric
passive peer can be
synchronized to each
other. If both of them are
synchronized, the peer
with a higher stratum is
synchronized to the
peer with a lower
stratum.
As Figure 6 shows, this
mode is most often used
between two or more
servers with the same
stratum to operate as a
backup for one another. If
a server fails to
communicate with all the
servers of a higher
stratum, the server can be
synchronized to the
servers of the same
stratum.
Broadcast
A server periodically sends clock
synchronization messages to the
broadcast address
255.255.255.255. Clients listen
to the broadcast messages from
the servers to synchronize to the
server according to the
broadcast messages.
When a client receives the first
A broadcast client can
be synchronized to a
broadcast server, but a
broadcast server cannot
be synchronized to a
broadcast client.
A broadcast server sends
clock synchronization
messages to synchronize
clients in the same
subnet. As Figure 6
shows, broadcast mode is
intended for
configurations involving
one or a few servers and a
potentially large client
10
Mode Working process Principle Application scenario
broadcast message, the client
and the server start to exchange
messages to calculate the
network delay between them.
Then, only the broadcast server
sends clock synchronization
messages.
population.
The broadcast mode has
a lower time accuracy
than the client/server and
symmetric active/passive
modes because only the
broadcast servers send
clock synchronization
messages.
Multicast
A multicast server periodically
sends clock synchronization
messages to the user-configured
multicast address. Clients listen
to the multicast messages from
servers and synchronize to the
server according to the received
messages.
A multicast client can be
synchronized to a
multicast server, but a
multicast server cannot
be synchronized to a
multicast client.
A multicast server can
provide time
synchronization for clients
in the same subnet or in
different subnets.
The multicast mode has a
lower time accuracy than
the client/server and
symmetric active/passive
modes.
In this document, an "NTP server" or a "server" refers to a device that operates as an NTP server in
client/server mode. Time servers refer to all the devices that can provide time synchronization,
including NTP servers, NTP symmetric peers, broadcast servers, and multicast servers.
NTP security
To improve time synchronization security, NTP provides the access control and authentication
functions.
NTP access control
You can control NTPaccess by using an ACL. The access rights are in the following order, from least
restrictive to most restrictive:
•Peer—Allows time requests and NTP control queries (such as alarms, authentication status,
and time server information) and allows the local device to synchronize itself to a peer device.
•Server—Allows time requests and NTP control queries, but does not allow the local device to
synchronize itself to a peer device.
•Synchronization—Allows only time requests from a system whose address passes theaccess
list criteria.
•Query—Allows only NTP control queries from a peer device to the local device.
The device processes an NTP request, as follows:
•If no NTP access control is configured, peer is granted to the local device and peer devices.
•If the IP address of the peer device matches a permit statement in anACL for more than one
access right, the least restrictive access right is granted to the peer device. If a deny statement
or no ACL is matched, no access right is granted.
•If no ACL is created for an access right, the associated access right is not granted.
•If no ACL is created for any access right, peer is granted.
This feature provides minimal security for a system running NTP. A more secure method is NTP
authentication.
NTP authentication
Use this feature to authenticate the NTP messages for security purposes. If an NTP message
passes authentication, the device can receive it and get time synchronization information. If not, the
11
device discards the message. This function makes sure the device does not synchronize to an
unauthorized time server.
Figure 7 NTP authentication
As shown in Figure 7, NTP authentication works as follows:
1. The sender uses the MD5 algorithm to calculate the NTP message according to the key
identified by a key ID, and sends the calculated digest together with the NTP message and key
ID to the receiver.
2. Upon receiving the message, the receiver finds the key according to the key ID in the message,
uses the MD5 algorithm to calculate the digest, and compares the digest with the digest
contained in the NTP message. If they are the same, the receiver accepts the message.
Otherwise, it discards the message.
Protocols and standards
•RFC 1305, Network Time Protocol (Version 3) Specification, Implementation and Analysis
•RFC 5905, Network Time Protocol Version 4: Protocol and Algorithms Specification
Configuration restrictions and guidelines
Follow these restrictions and guidelines when you configure NTP:
•You cannot configure both NTP and SNTP on the same device.
•Do not configure NTP on an aggregate member port.
•The NTP service and SNTP service are mutually exclusive. You can only enable either NTP
service or SNTP service at a time.
•To ensure time synchronization accuracy, do not specify more than one reference source.
Doing so might cause frequent time changes or even synchronization failures.
•Make sure you use the clock protocol command to specify the time protocol as NTP. For more
information about the clock protocol command, see Fundamentals Command Reference.
Configuration task list
Tasks at a glance
(Required.) Enabling the NTP service
(Required.) Perform one or both of the following tasks:
•Configuring NTP association mode
•Configuring the local clock as a reference source
Key value
Message
Sender
Message
Sends to the
receiver Digest
Receiver
Compare
Compute the
digest
Compute the
digest
Digest
Key ID Message
Digest
Key ID
Key value
Other manuals for FlexFabric 5700 Series
2
Table of contents
Other HPE Switch manuals
HPE
HPE OfficeConnect 1420 Series User manual
HPE
HPE FlexNetwork 5510 HI Series User manual
HPE
HPE Aruba 6200F Assembly instructions
HPE
HPE FlexFabric 5700 Series User manual
HPE
HPE FlexFabric 12900E User manual
HPE
HPE 1410-16G User manual
HPE
HPE FlexNetwork 7500 Series User manual
HPE
HPE Aruba Networking 2930M Instruction Manual
HPE
HPE 5140 24G PoE+ 4SFP+ EI Sw Assembly instructions
HPE
HPE FlexFabric 7900 Series User manual
HPE
HPE FlexFabric 5950 Series Installation manual
HPE
HPE FlexNetwork 5130 EISeries User manual
HPE
HPE 12500 Series Installation manual
HPE
HPE Aruba 6200F Assembly instructions
HPE
HPE JH390A User manual
HPE
HPE Aruba 6200F Owner's manual
HPE
HPE 5900 series User manual
HPE
HPE LSQM2MPUD0 User manual
HPE
HPE Aruba Networking CX 6200 Series User manual
HPE
HPE FlexFabric 5710 Series User manual
