Huawei Enterprise S2700 Series Operator's manual

S2700&S3700 Product Documentation
Product Version: V100R006C05
Library Version: 03
Date: 01/20/2014
For any question, please contact us .
Copyright © Huawei Technologies Co., Ltd. 2014. All rights reserved.
S2700 Product Description
Contents
1.4.1.1 S2700 Product Description
1.4.1.1.1 About This Document
1.4.1.1.2 Product Positioning and Characteristics
1.4.1.1.2.1 Product Positioning
1.4.1.1.2.2 Product Characteristics
1.4.1.1.2.2.1 Flexible Networking Capability
1.4.1.1.2.2.2 High Extensibility
1.4.1.1.2.2.3 Comprehensive Security Measures
1.4.1.1.2.2.4 Convenient Operation and Maintenance
1.4.1.1.2.2.5 Energy-Saving Design
1.4.1.1.2.2.6 Advanced Lightning Protection Technologies
1.4.1.1.2.2.7 Intelligent PoE Power Supply
1.4.1.1.3 Product Architecture
1.4.1.1.3.1 Introduction
1.4.1.1.3.2 Device Architecture
1.4.1.1.3.3 Hardware Modules
1.4.1.1.3.3.1 SCU
1.4.1.1.3.3.2 Power Supply
1.4.1.1.3.3.3 Fan
1.4.1.1.3.4 Software Architecture
1.4.1.1.4 Link Features
1.4.1.1.4.1 Ethernet Features
1.4.1.1.4.1.1 Link Aggregation
1.4.1.1.4.1.2 Flow Control on an Interface
1.4.1.1.4.1.3 Traffic Suppression
1.4.1.1.4.1.4 VLAN
1.4.1.1.4.1.5 QinQ
1.4.1.1.4.1.6 GVRP
1.4.1.1.4.2 STP/RSTP/MSTP
1.4.1.1.4.2.1 STP and RSTP
1.4.1.1.4.2.2 MSTP
1.4.1.1.4.2.3 MSTP Protection
1.4.1.1.4.2.4 Partitioned STP and BPDU Tunnel
1.4.1.1.4.3 Interface Security
1.4.1.1.4.4 Link Detection
Page
1
of
34
HEEX Startpage
12/10/2015
http://localhost:7890/printtopics.html?time=Thu Dec 10 16:53:17 UTC
-
0200 2015

1.4.1.1.5 Service Features
1.4.1.1.5.1 IPv6
1.4.1.1.5.2 Multicast
1.4.1.1.5.2.1 IGMP Snooping
1.4.1.1.5.2.2 IGMP Snooping Proxy
1.4.1.1.5.2.3 Prompt Leave of Multicast Member Interfaces
1.4.1.1.5.2.4 Multicast Traffic Control
1.4.1.1.5.2.5 Controllable Multicast
1.4.1.1.5.3 QoS
1.4.1.1.5.3.1 Traffic Classification
1.4.1.1.5.3.2 Access Control and Re-marking
1.4.1.1.5.3.3 Traffic Policing
1.4.1.1.5.3.4 Congestion Management
1.4.1.1.5.3.5 Rate Limit on an Interface
1.4.1.1.5.3.6 Aggregate CAR
1.4.1.1.5.4 Security
1.4.1.1.5.4.1 Device Security
1.4.1.1.5.4.2 Service Security
1.4.1.1.5.4.3 Security Authentication
1.4.1.1.5.5 MAC-Forced Forwarding
1.4.1.1.5.6 Reliability
1.4.1.1.5.7 LLDP
1.4.1.1.5.8 Stacking
1.4.1.1.8 System Technical Specifications
1.4.1.1.8.1 Physical Specifications
1.4.1.1.8.2 Optical Module Attributes
1.4.1.1.8.3 System Configuration
1.4.1.1.8.4 List of Software Features
1.4.1.1 S2700 Product Description
About This Document
Product Positioning and Characteristics
Product Architecture
Link Features
Service Features
Networking and Applications
Maintenance and Network Management System
System Technical Specifications
Parent topic: Product Description
1.4.1.1.1 About This Document
Page
2
of
34
HEEX Startpage
12/10/2015
http://localhost:7890/printtopics.html?time=Thu Dec 10 16:53:17 UTC
-
0200 2015

Purpose
This document describes the positioning, characteristics, architecture, link features, service features, application
scenarios, operation and maintenance functions, and technical specifications of the S2700.
This document helps you understand the characteristics and features of the S2700.
Intended Audience
This document is intended for:
 Network planning engineers
 Hardware installation engineers
 Commissioning engineers
 Data configuration engineers
 On-site maintenance engineers
 Network monitoring engineers
 System maintenance engineers
Statement
The device provides the mirroring function for network monitoring and fault management, during which
communication data of users may be collected. Huawei alone is unable to collect or save the content of users'
communications. It is suggested that you activate the interception-related functions based on the applicable laws
and regulations in terms of purpose and scope of usage. You are obligated to take considerable measures to
ensure that the content of users' communications is fully protected when the content is being used and saved.
Symbol Conventions
The symbols that may be found in this document are defined as follows.
Change History
Updates between document issues are cumulative. Therefore, the latest document version contains all updates
made to previous versions.
Changes in Issue 03 (2014-01-20)
The third commercial release has the following updates:
Some contents are optimized.
Symbol Description
Indicates a hazard with a high level or medium level of risk which, if not
avoided, could result in death or serious injury.
Indicates a hazard with a low level of risk which, if not avoided, could result in
minor or moderate injury.
Indicates a potentially hazardous situation that, if not avoided, could result in
equipment damage, data loss, performance deterioration, or unanticipated
results.
Provides a tip that may help you solve a problem or save time.
Provides additional information to emphasize or supplement important points
in the main text.
Page
3
of
34
HEEX Startpage
12/10/2015
http://localhost:7890/printtopics.html?time=Thu Dec 10 16:53:17 UTC
-
0200 2015

Changes in Issue 02 (2013-04-20)
The second commercial release has the following updates:
The documentation is modified according to updates in product features.
Changes in Issue 01 (2013-02-08)
Initial commercial release.
Parent topic: S2700 Product Description
1.4.1.1.2 Product Positioning and Characteristics
Product Positioning
Product Characteristics
Parent topic: S2700 Product Description
1.4.1.1.2.1 Product Positioning
NOTICE:
The S2700 Series Ethernet Switches are class A products. The switches that are operating may cause radio
interference. Customers need to take prevention measures.
The S2700 Series Ethernet Switches (hereinafter referred to as the S2700) provide the access and data transport
functions. They are developed by Huawei to meet the requirements for reliable access and high-quality
transmission of multiple services on the enterprise network.
Positioned for the access layer of the enterprise network, the S2700 provides large capacity, high port density,
and cost-effective packet forwarding capabilities. In addition, the S2700 provides multi-service access
capabilities, excellent extensibility, quality of service (QoS) guarantee, powerful multicast replication, and
carrier-class security, and can be used to build ring topologies of high reliability.
Parent topic: Product Positioning and Characteristics
1.4.1.1.2.2 Product Characteristics
Flexible Networking Capability
High Extensibility
Comprehensive Security Measures
Convenient Operation and Maintenance
Energy-Saving Design
Page
4
of
34
HEEX Startpage
12/10/2015
http://localhost:7890/printtopics.html?time=Thu Dec 10 16:53:17 UTC
-
0200 2015

Advanced Lightning Protection Technologies
Intelligent PoE Power Supply
Parent topic: Product Positioning and Characteristics
1.4.1.1.2.2.1 Flexible Networking Capability
The S2700 provides 10/100BASE-T Ethernet electrical interfaces, 10/100/1000BASE-T electrical interfaces, and
100/1000BASE-X Ethernet optical interfaces. It supports multiple interface types such as access, trunk, and
hybrid.
The S2700 provides swappable Small Form-Factor Pluggable (SFP) optical modules for optical fiber
connections.The length of optical fibers can be selected according to the transmission distance.
The S2700 can be used to construct a tree, star, or ring Ethernet network. For the ring Ethernet, the S2700
supports the Spanning Tree Protocol (STP) to prevent loops and provide rapid switchover.
Parent topic: Product Characteristics
1.4.1.1.2.2.2 High Extensibility
Based on the Huawei proprietary Versatile Routing Platform (VRP), the S2700 provides high-speed switching
and various service features by integrating network management technologies.
Parent topic: Product Characteristics
1.4.1.1.2.2.3 Comprehensive Security Measures
The S2700 guarantees the security of network devices and data transmission. It provides the following security
measures to protect the network against attacks initiated by malicious users:
 Packet filtering based on MAC addresses
 Various ACL policies
 Mechanism of searching the forwarding table based on VLAN IDs and MAC addresses
 Traffic suppression
In addition, the S2700 provides the following functions to ensure secure login of users:
 Providing login passwords and password encryption for login users
 Protecting commands through users levels and command levels
 Locking the configuration terminal through a certain command to prevent illegal use of the device
 Displaying confirm or prompt information for important commands that affect system performance
The S2700 provides the Automatic Laser Shutdown (ALS) function. That is, when the fiber is broken, the S2700
stops transmitting laser. This protects users against the laser.
Page
5
of
34
HEEX Startpage
12/10/2015
http://localhost:7890/printtopics.html?time=Thu Dec 10 16:53:17 UTC
-
0200 2015

Parent topic: Product Characteristics
1.4.1.1.2.2.4 Convenient Operation and Maintenance
In addition to collecting traffic statistics based on interfaces and VLANs, the S2700 provides fault detection and
location tools such as ping and traceroute on an IP network. It can also work with the Huawei eSight network
management system (NMS) to implement performance monitoring, alarm report, and fast fault location.
eSight provides various functions to help you manage the S2700, including resource management, topology
management, and configuration file management, batch configuration. In addition, eSight can show important
performance indicators in diagrams and tables to facilitate device management.
Parent topic: Product Characteristics
1.4.1.1.2.2.5 Energy-Saving Design
The S2700 adopts the following measures to save energy:
 It adopts natural heat dissipation so that power consumed by fans is saved.
NOTE:
Currently, The S2700-9TP-PWR-EI, S2700-9TP-SI/EI, S2700-18TP-SI/EI, and SS2700-26TP-SI/EI supports natural heat
dissipation.
 The chip switches to the power saving mode when no connected device is detected on a service interface, that
is, the interface is idle.
 It uses highly-integrated and energy-saving chips produced through advanced processing techniques. With the
help of the intelligent device management system, the chips not only improve system performance but also
greatly reduce power consumption of the entire system.
Natural heat dissipation has the following advantages:
 The product reliability is high.
 There is no noise pollution.
 You do not need to maintain the fans, which saves the maintenance cost.
 The system does not have additional power consumption generated by fans, which improves the power
efficiency.
 Boards are prevented from being eroded.
Parent topic: Product Characteristics
1.4.1.1.2.2.6 Advanced Lightning Protection
Technologies
The S2700 adopts the Huawei patented lightning protection technologies to protect the equipment. The lightning
Page
6
of
34
HEEX Startpage
12/10/2015
http://localhost:7890/printtopics.html?time=Thu Dec 10 16:53:17 UTC
-
0200 2015

protection technologies reduce the probability of damages caused by lightning and increase the safety factor by
30 times, thus greatly improving the device reliability.
Parent topic: Product Characteristics
1.4.1.1.2.2.7 Intelligent PoE Power Supply
The S2700 PoE switches has the PoE function. It provides centralized power supply for the attached IP phone,
wireless access point (AP), portable device charger, POS machine, camera, and data collector through twisted
pairs.
The PoE function of the S2700 PoE switches complies with IEEE 802.3af and IEEE 802.3at. The S2700 can
provide power for the devices of different vendors remotely. In IEEE 802.3at, the maximum power supply
capability is 30 W. This capability ensures adequate power for IP video phone, dualband WiFi AP, IP camera,
multi-function STB11, and RFID and simplifies the network.
The S2700 PoE switches has the ability to control power supply based on time range, thus effectively managing
network devices, reducing power consumption, and lowering the OPEX.
Parent topic: Product Characteristics
1.4.1.1.3 Product Architecture
Introduction
Device Architecture
Hardware Modules
Software Architecture
Parent topic: S2700 Product Description
1.4.1.1.3.1 Introduction
The S2700 series adopt the integrated hardware platform and have the front-access structure. The hardware
consists of the chassis, power supply, fan, and SCU. The width of the S2700 complies with the industry
standards, and the S2700 can be installed in an IEC 297 cabinet or an ETSI cabinet.
The S2700 series include the S2700-9TP-SI-AC, S2700-9TP-EI-AC, S2700-9TP-EI-DC, S2700-18TP-SI-AC,
S2700-18TP-EI-AC, S2700-26TP-SI-AC, S2700-26TP-EI-AC, S2700-26TP-EI-DC, S2700-52P-EI-AC, S2700-
9TP-PWR-EI, S2710-52P-SI-AC, S2710-52P-PWR-SI, S2700-52P-PWR-EI and S2700-26TP-PWR-EI.
Parent topic: Product Architecture
1.4.1.1.3.2 Device Architecture
Page
7
of
34
HEEX Startpage
12/10/2015
http://localhost:7890/printtopics.html?time=Thu Dec 10 16:53:17 UTC
-
0200 2015

The S2700 Ethernet switches adopt an integrated hardware platform. An S2700 consists of the chassis, power
supply unit, fan, and switch control unit (SCU).
NOTE:
The figures in this document are for reference only.
S2700 Appearances
Table 1 shows the front views of S2700.
Table 1 S2700 front views
Model Image
S2700-9TP-SI-
AC
S2700-9TP-EI-
AC
S2700-9TP-EI-
DC
S2700-9TP-
PWR-EI
S2700-18TP-SI-
AC
S2700-18TP-EI-
AC
S2700-26TP-SI-
AC
S2700-26TP-EI-
AC
S2700-26TP-EI-
DC
S2700-26TP-
PWR-EI
S2700-52P-EI-
AC
S2710-52P-SI-
AC
Page
8
of
34
HEEX Startpage
12/10/2015
http://localhost:7890/printtopics.html?time=Thu Dec 10 16:53:17 UTC
-
0200 2015

NOTE:
By default, a combo port works in auto mode, in which the port type is determined as follows:
 If the optical port has no optical module installed and the electrical port has no network cable connected, the port type depends on
which port is connected first. If the electrical port is connected by a network cable first, the electrical port is used for data switching.
If the optical port has an optical module installed first, the optical port is used for data switching.
 If the electrical port has a network cable connected and is in Up state, the electrical port is still used for data switching when the
optical port has an optical module installed.
 If the optical port, no matter in Up or Down state, has an optical module installed, the optical port is still used for data switching
when the electrical port has a network cable connected.
 If the optical port has an optical module installed and the electrical port has a network cable connected, the optical port is used for
data switching after the switch restarts.
You can configure a combo port as an electrical or optical port using the combo-port command.
Table 2 shows the rear views of S2700.
S2700-52P-
PWR-EI
S2710-52P-
PWR-SI
1. AC jack 2. DC terminal 3. Switch 4. Ground screw
5. Eight 10/100BASE-TX
Ethernet electrical interfaces
6. Sixteen 10/100BASE-TX
Ethernet electrical interfaces
7. Twenty-four 10/100BASE-
TX Ethernet electrical
interfaces
8. Forty-eight
10/100BASE-TX
Ethernet electrical
interfaces
9. One 1000M combo
interface
(10/100/1000BASE-
T+100/1000BASE-X)
10. Two 1000M combo
interfaces
(10/100/1000BASE-
T+100/1000BASE-X)
11. One console interface 12. Two 1000BASE-X
Ethernet optical interfaces
13. Two 100/1000BASE-X
Ethernet optical interfaces
Table 2 S2700 rear views
Model Image
S2700-9TP-SI-
AC
S2700-9TP-EI-
AC
S2700-9TP-EI-
DC
S2700-9TP-
PWR-EI
Page
9
of
34
HEEX Startpage
12/10/2015
http://localhost:7890/printtopics.html?time=Thu Dec 10 16:53:17 UTC
-
0200 2015

Parent topic: Product Architecture
1.4.1.1.3.3 Hardware Modules
Figure 1 shows the logical structure of hardware modules of the S2700.
Figure 1 Logical structure of hardware modules of the S2700
Hardware modules of the S2700 refer to the SCU, power supply, and fan.
SCU
Power Supply
Fan
S2700-18TP-SI-
AC
S2700-18TP-EI-
AC
S2700-26TP-SI-
AC
S2700-26TP-EI-
AC
S2700-26TP-EI-
DC
S2700-52P-EI-
AC
S2710-52P-SI-
AC
S2700-26TP-
PWR-EI
S2700-52P-
PWR-EI
S2710-52P-
PWR-SI
1. Ground screw 2. Switch 3. AC jack 4. ESD jack
5. Fan module 6. Power supply unit slot
Page
10
of
34
HEEX Startpage
12/10/2015
http://localhost:7890/printtopics.html?time=Thu Dec 10 16:53:17 UTC
-
0200 2015

Parent topic: Product Architecture
1.4.1.1.3.3.1 SCU
The SCU is fixed on the S2700. Each S2700 has one SCU.
The SCU is responsible for packet switching and device management. It integrates multiple functional modules,
namely, the main control module, switching module, and interface module.
Main Control Module
The main control module implements the following functions:
 Processing protocols
 Functioning as an agent of the user to manage the system and monitor the system performance according to
instructions of the user, and report the running status of the device to the user
 Monitoring and maintaining the interface module and switching module on the SCU.
Switching Module
The switching module, also called the switching fabric, is responsible for packet exchange, multicast replication,
QoS scheduling, and access control on the interface module of the SCU.
The switching module adopts high performance ASIC chips to implement line-speed forwarding and fast
switching of data with different priorities.
Interface Module
The interface module provides Ethernet interfaces for accessing Ethernet services.
Parent topic: Hardware Modules
1.4.1.1.3.3.2 Power Supply
Table 1 Power supply
Device Name AC DC 1:1 Backup power supplies
S2700-9TP-SI-AC Y N N
S2700-9TP-EI-AC Y N N
S2700-9TP-EI-DC N Y N
S2700-18TP-SI-AC YN N
S2700-18TP-EI-AC Y N N
S2700-26TP-SI-AC Y N N
S2700-26TP-EI-AC Y N N
S2700-26TP-EI-DC N Y N
S2700-52P-EI-AC YN N
Page
11
of
34
HEEX Startpage
12/10/2015
http://localhost:7890/printtopics.html?time=Thu Dec 10 16:53:17 UTC
-
0200 2015

Parent topic: Hardware Modules
1.4.1.1.3.3.3 Fan
The fans can work in the intelligent mode or forcible mode.
In the intelligent mode, the fans start to operate only when the environment temperature exceeds a specified
value.
The S2700-52P-EI-AC, S2710-52P-SI-AC support the intelligent mode.
The S2700-26TP-PWR-EI, S2710-52P-PWR-SI and S2700-52P-PWR-EI support the hot pluggable fans. The
fan module can be replaced on site and maintained in service.
Parent topic: Hardware Modules
1.4.1.1.3.4 Software Architecture
The S2700 runs on the latest VRP version 5 (VRPv5) to provide various features. VRPv5 consists of the
following parts:
Figure 1 Software architecture
 System service plane
This plane provides task and memory management, timer, software loading and patching on the basis of the
operating system. In addition, it enhances modular technology to facilitate system upgrade and customization.
 General control plane
This plane is the core of the VRP data communication platform, providing link management, IP protocol
S2710-52P-SI-AC Y N N
S2700-9TP-PWR-EI Y N N
S2700-26TP-PWR-EI Y N Y
S2700-52P-PWR-EI Y N Y
S2710-52P-PWR-SI Y N Y
Page
12
of
34
HEEX Startpage
12/10/2015
http://localhost:7890/printtopics.html?time=Thu Dec 10 16:53:17 UTC
-
0200 2015

stack, and implementing the security and QoS functions. It is used to control the data forwarding plane and
implement functions of the device.
 Data forwarding plane
This plane forwards data under the control of the general control plane. The VRPv5 supports data forwarding
based on software and hardware.
 Service control plane
This plane controls and manages services based on users or interfaces. It implements the authentication,
authorization, and accounting for users through DHCP Option 82 and implements authentication for access
interfaces through IEEE 802.1x.
 System management plane
This plane provides a graphic user interface and manages the input and output information for network
management and maintenance.
Parent topic: Product Architecture
1.4.1.1.4 Link Features
Ethernet Features
STP/RSTP/MSTP
Interface Security
Link Detection
Parent topic: S2700 Product Description
1.4.1.1.4.1 Ethernet Features
Link Aggregation
Flow Control on an Interface
Traffic Suppression
VLAN
QinQ
GVRP
Parent topic: Link Features
1.4.1.1.4.1.1 Link Aggregation
Page
13
of
34
HEEX Startpage
12/10/2015
http://localhost:7890/printtopics.html?time=Thu Dec 10 16:53:17 UTC
-
0200 2015

Link aggregation is a function that binds multiple physical interfaces on one device into a logical interface (such
as an Eth-Trunk). This logical interface is also called a load balancing group or a link aggregation group.
After multiple physical interfaces are bound into a logical interface, the S2700 load balances the traffic passing
through the logical interface among the member interfaces. When a member interface fails, the traffic on this
interface is shared by the other member interfaces without interrupting services. When the faulty interface
recovers, the traffic is balanced among all interfaces again.
Currently, the S2700 implements link aggregation between GE interfaces or FE interfaces. Load balancing can
be implemented based on the following information:
 Source MAC address
 Destination MAC address
 Source MAC address and destination MAC address
Using the link aggregation technology, you can increase the bandwidth and improve link reliability without
upgrading the hardware, thus saving costs.
Parent topic: Ethernet Features
1.4.1.1.4.1.2 Flow Control on an Interface
Flow control on an interface is a method of congestion management. It applies to all types of flows. The S2700
implements flow control on an interface by using the hardware backpressure mechanism. When an interface
works in full duplex mode, the S2700 implements flow control complying with IEEE 802.3x. When the interface
works in half duplex mode, the S2700 implements flow control through the backpressure mechanism.
When congestion occurs, the S2700 sends continuous Pause frames to the upstream device, requesting it to stop
sending data for a specified period of time. When the upstream device receives the pause frames, it reduces the
volume of traffic sent from its outbound interface. Flow control on an interface does not identify flow types.
Parent topic: Ethernet Features
1.4.1.1.4.1.3 Traffic Suppression
Traffic suppression limits the number of unknown unicast packets, multicast packets, and broadcast packets
within a proper range to ensure network efficiency.
The S2700 can suppress the packets based on interfaces. When traffic suppression is enabled on an interface, the
interface monitors received unknown unicast packets, multicast packets, and broadcast packets to check whether
their traffic exceeds the threshold. If traffic exceeds the threshold, the S2700 discards excessive packets to keep
the traffic volume within the limit and thus services on the network run normally.
The S2700 can also control the percentage of unknown unicast packets, multicast packets, and broadcast packets
on an interface.
Parent topic: Ethernet Features
1.4.1.1.4.1.4 VLAN
Page
14
of
34
HEEX Startpage
12/10/2015
http://localhost:7890/printtopics.html?time=Thu Dec 10 16:53:17 UTC
-
0200 2015

A local area network (LAN) can be divided into several logical LANs. Each logical LAN is a broadcast domain,
which is called a virtual LAN (VLAN). To put it simply, devices on a LAN are logically grouped into different
LAN segments, irrespective of their physical locations. In this manner, VLANs isolate broadcast domains on a
LAN.
Methods to Define VLANs
A physical LAN can be divided into several VLANs, and several physical LANs can be grouped into a VLAN.
Devices on a VLAN belong to the same broadcast domain and can communicate with each other. Different
VLANs are isolated from each other, so devices on different VLANs cannot communicate with each other.
The S2700 supports the following methods to define VLANs:
 Based on interfaces
After an interface is added to a VLAN, packets received by the interface are sent on the VLAN.
 Based on MAC addresses
VLAN members are defined according to source MAC addresses of packets. When an interface of the S2700
receives a packet, the S2700 determines the VLAN ID of the packet according to the source MAC address of
the packet and sends the packet on the corresponding VLAN.
NOTE:
The S2700SI and S2710SI do not support defining VLANs based on MAC addresses.
Voice VLAN
A voice VLAN is used to transmit voice data flows. You can create a voice VLAN and add the interface
connected to the voice device to the voice VLAN. Then voice data flows can be transmitted on the voice VLAN.
You can apply special QoS configuration to the voice data packets transmitted on the voice VLAN so that voice
data packets are transmitted with high priority. The quality of the voice service is ensured.
NOTE:
The S2700SI and S2710SI do not support the Voice VLAN.
VLAN Mapping
VLAN mapping means that the S2700 replaces the outer VLAN tags of data frames to the specified VLAN tags
according to the preset VLAN mapping table so that services are transmitted according to the network planning
of the carrier.
The S2700 supports the mapping from one or more customer VLAN IDs (C-VLANs) to a service VLAN ID (S-
VLAN).
NOTE:
 C-VLAN is the VLAN that a user-side interface belongs to. It identifies a user or a type of users.
 An S-VLAN is a VLAN defined on the public network by the carrier. The S-VLAN ID identifies a service.
 The S2700SI and S2710SI do not support the VLAN Mapping.
Parent topic: Ethernet Features
1.4.1.1.4.1.5 QinQ
Page
15
of
34
HEEX Startpage
12/10/2015
http://localhost:7890/printtopics.html?time=Thu Dec 10 16:53:17 UTC
-
0200 2015

NOTE:
The S2700SI does not support the QinQ.
The 802.1Q-in-802.1Q (QinQ) protocol is a Layer 2 tunneling protocol based on the IEEE 802.1Q. A frame
transmitted on the public network has double 802.1Q tags. One tag identifies the public network and the other
identifies the private network.
Usually, carriers define VLANs on the public network, and users define VLANs on their own private networks.
Therefore, different private networks may use the same VLAN ID. Through the QinQ function, the S2700 adds
public VLAN tags to the packets from private networks. Then the private VLAN tag becomes the inner VLAN
tag. In this way, packets from user networks are transmitted transparently on the public network, and thus user
networks are separated from the public network.
The S2700 supports the basic QinQ function. That is, all the frames that reach the public network through an
interface are tagged with the same public VLAN ID.
Parent topic: Ethernet Features
1.4.1.1.4.1.6 GVRP
NOTE:
The S2700SI does not support the GVRP.
GVRP is a protocol used for dynamic registration and deregistration of VLANs. GVRP maintains the dynamic
VLAN registration information in a switch and propagates the registration information to other switches on the
network through GARP.
GVRP enables switches on the network to dynamically maintain and update VLANs. With GVRP, you do not
need to expend time to analyze the topology and manage configurations. You can adjust the VLAN deployment
on the entire network by configuring only a few devices.
The S2700 supports GARP and GVRP. Through GVRP, the S2700 can send VLAN declaration to other devices
and dynamically create VLANs after receiving VLAN registration information from other devices.
Parent topic: Ethernet Features
1.4.1.1.4.2 STP/RSTP/MSTP
STP and RSTP
MSTP
MSTP Protection
Partitioned STP and BPDU Tunnel
Parent topic: Link Features
1.4.1.1.4.2.1 STP and RSTP
Page
16
of
34
HEEX Startpage
12/10/2015
http://localhost:7890/printtopics.html?time=Thu Dec 10 16:53:17 UTC
-
0200 2015

The Spanning Tree Protocol (STP) and the Rapid Spanning Tree Protocol (RSTP) are link-layer management
protocols and are mainly applied to LANs to prevent loops. STP blocks redundant links and trims a network into
a tree topology free from loops. RSTP enhances STP. It provides fast transition of interfaces status to speed up
network convergence.
STP and RSTP prevent broadcast storms caused by loops and provides backup links for data forwarding.
Parent topic: STP/RSTP/MSTP
1.4.1.1.4.2.2 MSTP
NOTE:
The S2700SI does not support MSTP.
The Multiple Spanning Tree Protocol (MSTP) is developed based on STP and RSTP. MSTP divides a network
into multiple regions. Based on VLAN tags, each region has several spanning trees that are independent of each
other. As a result, the entire network is trimmed to a tree topology that is free from loops. Broadcast storms are
thus prevented on the network.
MSTP associates VLANs with spanning trees so that packets of different VLANs are transmitted along different
spanning trees. This speeds up network convergence and implements load balancing.
Different from STP and RSTP, MSTP provides multiple backup links to implement load balancing among
VLANs.
Parent topic: STP/RSTP/MSTP
1.4.1.1.4.2.3 MSTP Protection
BPDU Protection
The S2700 provides Bridge Protocol Data Unit (BPDU) protection when MSTP is enabled. When BPDU
protection is enabled, the S2700 shuts down the edge port that receives a protocol BPDU instead of turning the
edge port into a non-edge port. In this case, the spanning tree is not recalculated, and thus network flapping is
prevented.
Root Protection
The S2700 provides root protection when MSTP is enabled. It retains the role of the root switch by maintaining
the role of the designated port as follows:
When the designated port enabled with root protection receives a BPDU of higher priority, the port does not
change to a non-designated port. Instead, it turns to the Listening state and stops forwarding packets. If the port
does not receive protocol BPDUs of higher priority for a long time, it restores the Forwarding state. This
prevents network flapping.
Loop Protection
After loop protection is enabled on the S2700, it sets the root port to the Blocking state if the root port does not
receive protocol BPDUs from the upstream device. If the port receives protocol BPDUs again, it becomes the
root port and changes to the Forwarding state. If no protocol BPDU is received, the port remains in the Blocking
state and does not forward packets. In this way, loops are prevented on the network.
Page
17
of
34
HEEX Startpage
12/10/2015
http://localhost:7890/printtopics.html?time=Thu Dec 10 16:53:17 UTC
-
0200 2015

Parent topic: STP/RSTP/MSTP
1.4.1.1.4.2.4 Partitioned STP and BPDU Tunnel
Partitioned STP
To improve the reliability of links on the enterprise network, the S2700 can be dual-homed to the upstream
Ethernet. In addition, MSTP needs to run on the whole enterprise network to prevent loops. The traditional
MSTP networks are not divided. In this case, the convergence speed of an MSTP network is low because the
network is large. As a result, the forwarding capability of the network is degraded.
By using the partitioned STP technology, the S2700 logically allocates a VLAN for each partitioned STP
network. The tagged BPDUs can be forwarded only within the VLAN that the tag belongs to. Partitioned STP
allows BPDUs to be transmitted within a certain range. This prevents loops and speeds up convergence.
BPDU Tunnel
On a partitioned STP network, the S2700 considers the tagged BPDUs as common Layer 2 frames. That is, the
S2700 forwards the BPDUs within the VLAN to which the tag belongs rather than sending them to the MSTP
module. After the BPDU tunnel is configured, the devices on the MAN do not participate in the topology
calculation of the partitioned STP network. Thus, the convergence speed of the network is improved.
To implement the BPDU tunnel function, the access device at the edge of the MAN must be configured with
MSTP Snooping. If the forwarding path is changed because of the topology change on the partitioned STP
network, the device can detect the topology change, and then notify other devices on the network of the topology
change. In this way, the packets are forwarded according to the new topology.
NOTE:
The S2700SI does not support the BPDU Tunnel.
Parent topic: STP/RSTP/MSTP
1.4.1.1.4.3 Interface Security
Interface security is a security mechanism to control the access to a network. It checks whether the source MAC
addresses of data frames received on an interface are valid. When detecting packets with invalid source MAC
addresses, it takes certain actions to protect the interface.
After security protection is enabled on an interface, the S2700 considers the following types of MAC addresses
valid:
 Static MAC addresses that are manually configured
 Dynamic or static MAC addresses in the DHCP snooping table
 Dynamic MAC addresses that are learned before the number of learned MAC addresses reaches the limit
When the interface receives frames with invalid source MAC addresses, the S2700 triggers the interface security
function to discard the frames or generates an alarm according to the configuration.
Parent topic: Link Features
Page
18
of
34
HEEX Startpage
12/10/2015
http://localhost:7890/printtopics.html?time=Thu Dec 10 16:53:17 UTC
-
0200 2015

1.4.1.1.4.4 Link Detection
Link detection includes loopback detection and virtual cable test (VCT). They provide users with two means to
detect link faults on LANs.
 Loopback detection is used to check whether loops exist on a LAN. The S-switch sends specific packets to
detect loopback on the entire LAN.
 VCT is mainly used to estimate the length of a network cable and locate the failure point of the cable. The S-
switch simulates radar to detect cable faults and locate the failure points on the basis of a single link.
Parent topic: Link Features
1.4.1.1.5 Service Features
IPv6
Multicast
QoS
Security
MAC-Forced Forwarding
Reliability
LLDP
Stacking
Parent topic: S2700 Product Description
1.4.1.1.5.1 IPv6
The S2700 provides the IPv6 host function, which protects the investment of customers and prevents repeat
investment during network upgrade.
The IPv6 functions supported by the S2700 include:
 IPv6 protocol stack
 ND, ICMP v6, Traceroute v6, Telnet v6, DNS, and IPv6 static route
 Simple IPv6 ACL
NOTE:
The S2700SI does not support the IPv6 ACL.
Parent topic: Service Features
Page
19
of
34
HEEX Startpage
12/10/2015
http://localhost:7890/printtopics.html?time=Thu Dec 10 16:53:17 UTC
-
0200 2015

1.4.1.1.5.2 Multicast
The Internet Group Management Protocol (IGMP) is a protocol used to manage IP multicast members. It sets up
and maintains the member relationship between IP hosts and their directly connected multicast routers.
IGMP Snooping
IGMP Snooping Proxy
Prompt Leave of Multicast Member Interfaces
Multicast Traffic Control
Controllable Multicast
Parent topic: Service Features
1.4.1.1.5.2.1 IGMP Snooping
Located between hosts and a multicast router, the S2700 supports static multicast forwarding entries and
generates a dynamic Layer 2 multicast forwarding table with multicast groups and outbound interfaces by
listening to IGMP messages.
When the S2700 receives a multicast packet, it forwards the packet only to the members on the VLAN
corresponding to the multicast group. The multicast packet is transmitted in multicast mode on the VLAN
according to the Layer 2 multicast forwarding table. This saves bandwidth and enhances the security of
information transfer.
Parent topic: Multicast
1.4.1.1.5.2.2 IGMP Snooping Proxy
IGMP Snooping proxy is deployed on the switch that is located between the router and hosts. Then the switch
serves as an agent server. The switch terminates IGMP protocol packets sent by hosts to the router and responds
to the IGMP Query messages for the hosts. In addition, the switch processes IGMP protocol packets sent by the
router and the hosts. In this manner, the forwarding entries for Layer 2 multicast are created.
Parent topic: Multicast
1.4.1.1.5.2.3 Prompt Leave of Multicast Member
Interfaces
When a multicast member leaves a multicast group, the host sends an IGMP Leave message. When an interface
on the S2700 is connected to only one host, the S2700 deletes the multicast forwarding entry of the interface
immediately after receiving the IGMP Leave message. This saves bandwidth and system resources and
Page
20
of
34
HEEX Startpage
12/10/2015
http://localhost:7890/printtopics.html?time=Thu Dec 10 16:53:17 UTC
-
0200 2015