Huawei Quidway S3000-EI Series User manual

Operation Manual - Network Protocol
Quidway S3000-EI Series Ethernet Switches Table of Contents
Huawei Technologies Proprietary
i
Table of Contents
Chapter 1 ARP Configuration.......................................................................................................1-1
1.1 Introduction to ARP............................................................................................................1-1
1.2 Configure ARP...................................................................................................................1-2
1.2.1 Manually Add/Delete Static ARP Mapping Entries .................................................1-2
1.2.2 Configure the Dynamic ARP Aging Timer............................................................... 1-2
1.2.3 Enabling/Disabling ARP the Checking Function of ARP Entry...............................1-3
1.3 Gratuitous ARP Configuration ...........................................................................................1-3
1.3.1 Gratuitous ARP Overview....................................................................................... 1-3
1.3.2 Configuration Tasks................................................................................................1-4
1.3.3 Configuration Example............................................................................................1-4
1.4 Display and debug ARP.....................................................................................................1-4
Chapter 2 DHCP-Snooping Configuration.................................................................................. 2-1
2.1 DHCP-Snooping Overview................................................................................................2-1
2.2 Configure DHCP-Snooping................................................................................................2-1
2.2.1 Enable/Disable the DHCP-Snooping Function of the Switch..................................2-1
2.2.2 Setting the Port as Trusted Port..............................................................................2-2
2.3 Display and debug DHCP-Snooping .................................................................................2-2
Chapter 3 DHCP Client Configuration......................................................................................... 3-1
3.1 Overview of DHCP Client ..................................................................................................3-1
3.2 DHCP Client Configuration................................................................................................3-2
3.2.1 Configuring a VLAN Interface to Obtain IP Address Using DHCP .........................3-2
3.3 Displaying and Debugging DHCP Client Configuration.....................................................3-3
Chapter 4 BOOTP Client Configuration ......................................................................................4-1
4.1 Overview of BOOTP Client................................................................................................4-1
4.2 BOOTP Client Configuration.............................................................................................. 4-1
4.2.1 Configuring a VLAN Interface to Obtain the IP Address Using BOOTP................. 4-1
4.3 Displaying and Debugging BOOTP Client.........................................................................4-2
Chapter 5 Access Management Configuration ..........................................................................5-1
5.1 Access Management Overview......................................................................................... 5-1
5.2 Configure Access Management.........................................................................................5-1
5.2.1 Enable Access Management Function ...................................................................5-2
5.2.2 Configure Layer 2 Isolation between Ports.............................................................5-2
5.2.3 Configure Port, IP Address and MAC Address Binding..........................................5-2
5.3 Display and debug Access Management.......................................................................... 5-3
5.4 Access Management Configuration Example....................................................................5-4

Operation Manual - Network Protocol
Quidway S3000-EI Series Ethernet Switches Table of Contents
Huawei Technologies Proprietary
ii
Chapter 6 IP Performance Configuration.................................................................................... 6-1
6.1 IP Performance Configuration ...........................................................................................6-1
6.1.1 Configure TCP Attributes........................................................................................ 6-1
6.2 Display and debug IP Performance...................................................................................6-2
6.3 Troubleshoot IP Performance............................................................................................ 6-2

Operation Manual - Network Protocol
Quidway S3000-EI Series Ethernet Switches Chapter 1 ARP Configuration
Huawei Technologies Proprietary
1-1
Chapter 1 ARP Configuration
1.1 Introduction to ARP
I. Necessity of ARP
An IP address cannot be directly used for communication between network devices
because network devices can only identify MAC addresses. An IP address is only an
address of a host in the network layer. To send the data packets transmitted through the
network layer to the destination host, physical address of the host is required. So the IP
address must be resolved into a physical address.
II. ARP implementation procedure
When two hosts on the Ethernet communicate, they must know the MAC addresses of
each other. Every host will maintain the IP-MAC address translation table, which is
known as ARP mapping table. A series of maps between IP addresses and MAC
addresses of other hosts which were recently used to communicate with the local host
are stored in the ARPmapping table. When a dynamicARP mapping entry is not in use
for a specified period of time, the host will remove it from the ARP mapping table so as
to save the memory space and shorten the interval for switch to search ARP mapping
table.
Suppose there are two hosts on the same network segment: HostAand Host B. The IP
address of Host A is IP_A and the IP address of Host B is IP_B. Host A will transmit
messages to Host B. Host A checks its own ARP mapping table first to make sure
whether there are correspondingARP entries of IP_B in the table. If the corresponding
MAC address is detected, Host A will use the MAC address in the ARP mapping table
to encapsulate the IP packet in frame and send it to Host B. If the corresponding MAC
address is not detected, Host A will store the IP packet in the queue waiting for
transmission, and broadcast it throughout the Ethernet. The ARP request packet
contains the IP address of Host B and IP address and MAC address of Host A. Since
the ARPrequest packet is broadcast, all hosts on the network segment can receive the
request. However, only the requested host (i.e., Host B) needs to process the request.
Host B will first store the IP address and the MAC address of the request sender (Host
A) in the ARP request packet in its own ARP mapping table. Then Host B will generate
an ARP reply packet into which, it will add MAC address of Host B, and then send it to
Host A. The reply packet will be directly sent to Host A in stead of being broadcast.
Receiving the reply packet, Host A will extract the IP address and the corresponding
MAC address of Host B and add them to its own ARP mapping table. Then Host A will
send Host B all the packets standing in the queue.

Operation Manual - Network Protocol
Quidway S3000-EI Series Ethernet Switches Chapter 1 ARP Configuration
Huawei Technologies Proprietary
1-2
Normally, dynamic ARP executes and automatically searches for the resolution from
the IP address to the Ethernet MAC address without the administrator.
1.2 Configure ARP
The ARP mapping table can be maintained dynamically or manually. Usually, the
manually configured mapping from the IP addresses to the MAC addresses is known
as staticARP. The user can display, add or delete the entries in the ARP mapping table
through relevant manual maintenance commands.
The staticARP configuration includes:
zManually Add/delete static ARP Mapping Entries
zConfigure the dynamic ARP aging timer
zEnabling/Disabling ARP the Checking Function of ARP Entry
1.2.1 Manually Add/Delete Static ARP Mapping Entries
Perform the following configuration in System view.
Table 1-1 Manually add/delete static ARP mapping Entries
Operation Command
Manually add a static ARP mapping
entry
arp static ip-address mac-address
[ vlan-id { interface-type
interface-number | interface-name } ]
Manually delete a static ARP mapping
entry undo arp ip-address
Static ARP map entry will be always valid as long as Ethernet switch works normally.
But if the VLAN corresponding ARP mapping entry is deleted, the ARP mapping entry
will be also deleted. The valid period of dynamic ARP map entries will last only 20
minutes by default.
The parameter vlan-id must be the ID of a VLAN thathas been created by the user, and
the Ethernet port specified behind this parameter must belong to the VLAN.
By default, the ARP mapping table is empty and the address mapping is obtained
through dynamic ARP.
1.2.2 Configure the Dynamic ARP Aging Timer
For purpose of flexible configuration, the system provides the following commands to
assign dynamic ARP aging period. When the system learns a dynamic ARP entry, its
aging period is based on the current value configured.
Perform the following configuration in system view.

Operation Manual - Network Protocol
Quidway S3000-EI Series Ethernet Switches Chapter 1 ARP Configuration
Huawei Technologies Proprietary
1-3
Table 1-2 Configure the dynamic ARP aging timer
Operation Command
Configure the dynamic ARP aging timer arp timer aging aging-time
restore the default dynamic ARP aging time undo arp timer aging
By default, the aging time of dynamic ARP aging timer is 20 minutes.
1.2.3 Enabling/Disabling ARP the Checking Function of ARP Entry
You can use the following command to control the device whether to learn the ARP
entry where the MAC address is multicast MAC address.
Perform the following configuration in system view.
Table 1-3 Enabling/Disabling ARP the checking function of ARP entry
Operation Command
Enable the checking of ARP entry, that is, the device
does not learn the ARP entry where the MAC address is
multicast MAC address arp check enable
Disable the checking of ARP entry, that is, the device
learns the ARP entry where the MAC address is
multicast MAC address undo arp check enable
By default, the checking of ARP entry is enabled, that is, the device does not learn the
ARP entry where the MAC address is multicast MAC address.
1.3 Gratuitous ARP Configuration
1.3.1 Gratuitous ARP Overview
Gratuitous ARP function is to implement the following functions by sending out
gratuitous ARP packets:
zBy sending gratuitous ARPpackets, network devices can figure out whether the IP
addresses of other devices conflict with that of its own.
zIf the device which sends the gratuitous ARP packet changed its hardware
address (probably, it turns off, has its interface card changed, and then reboots),
this packet can make old hardware address in the cache of other devices update
accordingly. For example, when a device receives a gratuitous ARP request
existing in the cache of the device from an IP address, then the sending hardware
address (such as Ethernet address) in the gratuitous ARP request needs to
update the content in the cache. The above operation must be done when a
device receives any gratuitous ARP request. ARP request is broadcast on the

Operation Manual - Network Protocol
Quidway S3000-EI Series Ethernet Switches Chapter 1 ARP Configuration
Huawei Technologies Proprietary
1-4
network, so all hosts on the network must do this every time the ARP request is
sent.
Characteristics of gratuitousARP packets:
zThe source and destination IP addresses are all native addresses, and the source
MAC address of the packet is native MAC address.
zIf another device receives a gratuitous ARP packet and finds out that the IP
address in the ARP packet conflicts with that of its own, it sends an ARP reply
back to the device sending the ARP packet.
1.3.2 Configuration Tasks
The configuration tasks of the gratuitous ARP are described in the following table:
Table 1-4 Configure gratuitous ARP
Sequence
number Configuration item Command Description
1 Enter system
view <Quidway> system-view —
2 Enable ARP
packet learning [Quidway]
gratuitous-arp-learning enable Required
Use the corresponding undo command to cancel the configuration.
1.3.3 Configuration Example
I. Network requirements
Enable gratuitous ARP packet learning on the switch QuidwayA.
II. Configuration procedure
<QuidwayA> system-view
[QuidwayA] gratuitous-arp-learning enable
1.4 Display and debug ARP
After the above configuration, execute display command in any view to display the
running of the ARP configuration, and to verify the effect of the configuration. Execute
debugging command in user view to debug ARP configuration. Execute reset
command in user view to clearARP mapping table.

Operation Manual - Network Protocol
Quidway S3000-EI Series Ethernet Switches Chapter 1 ARP Configuration
Huawei Technologies Proprietary
1-5
Table 1-5 Display and debug ARP
Operation Command
Display ARP mapping table display arp [ static | dynamic | ip-address ]
Display the current setting of the
dynamic ARP map aging timer display arp timer aging
Reset ARP mapping table reset arp [ dynamic | static |interface { interface-type interface-number |
interface-name }]
Enable ARP information
debugging debugging arp packet
Disable ARP information
debugging undo debugging arp packet

Operation Manual - Network Protocol
Quidway S3000-EI Series Ethernet Switches Chapter 2 DHCP-Snooping Configuration
Huawei Technologies Proprietary
2-1
Chapter 2 DHCP-Snooping Configuration
2.1 DHCP-Snooping Overview
For security, the IP addresses used by online users may be recorded to confirm the
association between the users’ IP addresses and their MAC addresses. The Layer 3
Ethernet switch records the IP addresses obtained by the clients with DHCP Relay,
while the Layer 2 Ethernet switch listens to the DHCP broadcast packets for this
purpose.
To assign IP addresses to the clients, DHCP server transmits DHCPACK packets.After
received the packets, theclient can obtain an IPaddress. Snooping DHCPACK is a way
to know the clients’ IP addresses.
The client broadcasts DHCPREQUEST packet to request DHCP server to assign
address. The IP address requested through DHCPREQUEST is the same as that
assigned through DHCPACK. So snooping DHCPREQUEST is another way to know
clients’ IP addresses.
With DHCP-Snooping enabled, the switch can distract IP address and MAC address
from the DHCPACK or DHCPREQUEST packets received and record them.
In addition, pseudo-DHCP servers in the network may cause users to get incorrect IP
addresses. To guarantee that users can obtain IP address from the legal DHCP servers,
DHCP-Snooping allows ports to be set as trusted or distrusted. The former ports
connect DHCP servers or other switches and the latter ports connect users or network.
Distrusted ports discard the DHCPACK and DHCPOFF packets from DHCP servers,
whereas trusted ports forward these types of packets. In this way, users can get correct
IP address.
2.2 Configure DHCP-Snooping
DHCP-Snooping configuration includes:
zEnable/Disable the DHCP-Snooping function of the Switch
zSetting the port as trusted port
2.2.1 Enable/Disable the DHCP-Snooping Function of the Switch
Perform the following configuration in System view.

Operation Manual - Network Protocol
Quidway S3000-EI Series Ethernet Switches Chapter 2 DHCP-Snooping Configuration
Huawei Technologies Proprietary
2-2
Table 2-1 Enable/Disable the DHCP-Snooping function of the switch
Operation Command
Enable the DHCP-Snooping function of the switch dhcp-snooping
Disable the DHCP-Snooping function of the switch undo dhcp-snooping
By default, the switch does not enable DHCP-Snooping function.
2.2.2 Setting the Port as Trusted Port
Perform the following configuration in Ethernet port view.
Table 2-2 Setting the port as trusted port
Operation Command
Set the port as trusted port dhcp-snooping trust
Restore the port as distrusted port undo dhcp-snooping trust
By default, the ports of a switch are distrusted port.
2.3 Display and debug DHCP-Snooping
After the above configuration, execute display command in any view to display the
clients’ IP address and MAC address bindings recorded through DHCP-Snooping.
Table 2-3 Display and debug DHCP-Snooping
Operation Command
Display the information of the
DHCP-Snooping correspondence table display dhcp-snooping [ vlan { vlan_list | all } ]
Display the number of the DHCP-Snooping
entries in the binding table display dhcp-snooping count
Display the status of DHCP-Snooping
function and the information of trusted ports display dhcp-snooping trust

Operation Manual - Network Protocol
Quidway S3000-EI Series Ethernet Switches Chapter 3 DHCP Client Configuration
Huawei Technologies Proprietary
3-1
Chapter 3 DHCP Client Configuration
3.1 Overview of DHCP Client
With expansion of network size and complication of network structure, network
configuration becomes more and more complex. It is often the case that computers
change physical positions frequently (portable computers and wireless networks for
example) and that computers exceed the IP addresses available. Dynamic host
configuration protocol (DHCP) has been developed right for this situation. DHCP is in
client/server structure, with DHCP client dynamic requesting configuration information,
while DHCP server returning configuration information base on the specific policies.
A typical DHCP application often contains a DHCP server and several clients (desktop
and laptop PCs). See the following figure.
LAN
DHCP Server
DHCP Client DHCP Client
DHCP Client DHCP Client
Figure 3-1 Typical DHCP application
To obtain valid dynamic IP addresses, DHCP client exchanges different types of
information with the server at different stages. One of the following three situations may
occur:
1) DHCP client logs into the network for the first time
When DHCP client logs into the network for the first time, its communication with the
DHCP server includes these four stages:
zDiscover stage, the stage when the DHCP client looks for the DHCP server. The
client broadcasts the DHCP_Discover message and only the DHCP server can
respond.
zOffer stage, the stage when the DHCP server allocates the IP address. After
receiving the DHCP_Discover message from the client, the DHCP server chooses
an IP address still available in IP address pool for the client, and sends to the client
the DHCP_Offer message containing the leased IP address and other settings.
zSelect stage, the stage when the client selects the IP address. If several DHCP
servers send DHCP_Offer messages to the client, the client only accepts the first

Operation Manual - Network Protocol
Quidway S3000-EI Series Ethernet Switches Chapter 3 DHCP Client Configuration
Huawei Technologies Proprietary
3-2
received one and then broadcasts DHCP_Request messages respectively to
those DHCP servers. The message contains the information of IP address request
from the selected DHCP server.
zAcknowledge stage, the stage when the DHCP server acknowledges the IP
address. When receiving the DHCP_Request message from the client, the DHCP
server sends the DHCP_ACK message containing the allocated IP address and
other settings back to the client. Then the DHCP client binds its TCP/IP
components to the NIC (network interface card).
Other DHCP servers not selected still can allocate their IP addresses to other clients
later.
2) DHCP client logs into the network for a second time
When DHCP client logs into the network for a second time, its communication with the
DHCP server includes these stages:
zWhen the DHCP client logs into the network at the first time, then at later login the
client only needs to broadcast the DHCP_Request message containing the IP
address obtained last time, other than the DHCP_Dsicover message.
zAfter the reception of the DHCP_Request message, the DHCP server returns the
DHCP_ACK message if the requested IP address is still not allocated, to indicate
the client to continue use of the IP address.
zIf the requested IP address becomes unavailable (for example, having been
allocated to another client), the DHCP server returns the DHCP_NAK message.
After receiving the DHCP_NAK message, the client sends the DHCP_Discover
message to request another new IP address.
3) DHCP client extends its IP lease period
There is time limit for the IP addresses leased to DHCP clients. The DHCP server shall
withdraw the IP addresses when their lease period expires. If the DHCP client wants to
continue use of the old IP address, it has to extend the IP lease.
In practice, the DHCP client, by default, shall originate the DHCP_Request message to
the DHCP server right in the middle of the IP lease period, to update the IP lease. If the
IP address is still available, the DHCP server responds with the DHCP_ACK message,
notifying the client that it has got the new IP lease.
The DHCP client implemented on the switch supports automatic IP lease update.
3.2 DHCP Client Configuration
DHCP client configuration include:
Configuring a VLAN interface to obtain IP address using DHCP
3.2.1 Configuring a VLAN Interface to Obtain IP Address Using DHCP
Perform the following configuration in VLAN interface view.

Operation Manual - Network Protocol
Quidway S3000-EI Series Ethernet Switches Chapter 3 DHCP Client Configuration
Huawei Technologies Proprietary
3-3
Table 3-1 Configuring a VLAN interface to obtain IP address using DHCP
Operation Command
Configure VLAN interface to obtain IP
address using DHCP ip address dhcp-alloc
Remove the configuration undo ip address dhcp-alloc
By default, the VLAN interface does not obtain IP address using DHCP.
3.3 Displaying and Debugging DHCP Client Configuration
After the above configuration, execute display command in any view to display the
running of the DHCP Client configuration, and to verify the effect of the configuration.
Execute debugging command in user view to debug DHCP Client configuration.
Table 3-2 Displaying and debugging DHCP Client configuration
Operation Command
Display address allocation
information of DHCP client display dhcp client [ verbose ]
Enable/disable DHCP client
debugging [ undo ] debugging dhcp client { all | error | event | packet }

Operation Manual - Network Protocol
Quidway S3000-EI Series Ethernet Switches Chapter 4 BOOTP Client Configuration
Huawei Technologies Proprietary
4-1
Chapter 4 BOOTP Client Configuration
4.1 Overview of BOOTP Client
BOOTP client can request the server to allocate an IP address to it using BOOTP
(bootstrap protocol). These two major processes are included on the BOOTP client:
zSending BOOTP Request message to the server
zProcessing BOOTP Response message returned from the server
In obtaining IP address using BOOTP, BOOTP client sends the server the BOOTP
Request message. Upon receiving the request message, the server returns the
BOOTP Response message. BOOTP client then can obtain the allocated IP address
from the received response message.
The BOOTP message is based on UDP, so retransmission mechanism in the event of
timeout is used to guarantee its reliable transmission. BOOTP client also starts a
retransmission timer when it sends the request message to the server. If the timer
expires before the return of the response message from the server, the request
message will be retransmitted. The retransmission occurs every five seconds and the
maximum number of retransmission is 3, that is, the message shall not be
retransmitted after the third time.
4.2 BOOTP Client Configuration
BOOTP client configuration includes:
Configuring a VLAN interface to obtain the IP address using BOOTP
4.2.1 Configuring a VLAN Interface to Obtain the IP Address Using BOOTP
Perform the following configuration in VLAN interface view.
Table 4-1 Configuring a VLAN interface to obtain the IP address using BOOTP
Operation Command
Configure VLAN interface to obtain IP address
using BOOTP ip address bootp-alloc
Remove the configuration undo ip address bootp-alloc
By default, the VLAN interface cannot use BOOTP to get IP address.

Operation Manual - Network Protocol
Quidway S3000-EI Series Ethernet Switches Chapter 4 BOOTP Client Configuration
Huawei Technologies Proprietary
4-2
4.3 Displaying and Debugging BOOTP Client
After the above configuration, execute display command in any view to display the
running of the BOOTP client configuration, and to verify the effect of the configuration.
Execute debugging command in user view to debug BOOTP client.
Table 4-2 Displaying and debugging BOOTP client
Operation Command
Display information of BOOTP client display bootp client [ interface
vlan-interface vlan_id ]
Disable/enable BOOTP client debugging [ undo ] debugging bootp client

Operation Manual - Network Protocol
Quidway S3000-EI Series Ethernet Switches Chapter 5 Access Management Configuration
Huawei Technologies Proprietary
5-1
Chapter 5 Access Management Configuration
5.1 Access Management Overview
One of the typical Ethernet access networking scenario is that the users access
external network through the Ethernet switches. In this case, the external network is
connected to the Ethernet switch. The Ethernet switch connects to the Hubs, each of
which centralizes several PCs. The following figure illustrates the networking scenario.
External network
Ethernet Switch
Port 1 Port 2 Port n
...
HUB_1 HUB_mHUB_2
Port
...... ...... ......
PC1_1 PC1_1 PC1_a PC2_1 PC2_2 PC2_b PCn_1 PCn_2 PCn_x
...
Organization 1 Organization 2 Organization n
Figure 5-1 Typical Ethernet access networking scenario
If not-so-many users are connected to the switch, the ports allocated to different
enterprises need to belong to the same VLAN and different enterprises should be
isolated in the light of cost and security. All these requirements can be achieved with
the access management function by the Ethernet switches. See Figure 5-1.
Isolation measure is required, because otherwise the PCs in two organizations may
interwork with each other. The L2 isolation function at the switch port can ensure two
ports do not receivethe packets from the other port, so that only those PCs in the same
organization can communicate with each other
5.2 Configure Access Management
Access management configuration includes:
zEnable access management function
zConfigure Layer 2 isolation between ports

Operation Manual - Network Protocol
Quidway S3000-EI Series Ethernet Switches Chapter 5 Access Management Configuration
Huawei Technologies Proprietary
5-2
zConfigure port, IP address and MAC address binding
5.2.1 Enable Access Management Function
You can use the following command to enable access management function. Only after
the access management function is enabled will the access management features (IP
and port binding and Layer 2 port isolation) take effect.
Perform the following configuration in System view.
Table 5-1 Enable/Disable access management function
Operation Command
Enable access management function am enable
Disable access management function undo am enable
By default, the system disables the access management function.
5.2.2 Configure Layer 2 Isolation between Ports
You can use the following command to set Layer 2 isolation on a port so as to prevent
the packets from being forwarded on Layer 2 between the specified port and some
other ports (group).
Perform the following configuration in Ethernet interface view.
Table 5-2 Configure Layer 2 isolation between ports
Operation Command
Configure Layer 2 isolation between ports am isolate interface-list
Cancel Layer 2 isolation between ports undo am isolate interface-list
By default, the isolation port pool is null and the packets are allowed to be forwarded
between the specified port and all other ports on Layer 2.
5.2.3 Configure Port, IP Address and MAC Address Binding
Perform the following actions to bind the port, IP address and MAC address.
The system supports the following binding combination: Port+IP, Port+MAC,
Port+IP+MAC, and IP+MAC.
zPort+IP binding: binding the packet’s receiving port and its source IP address. The
specified port will only allow the packet with specified IP address to pass;
meanwhile the packet with specified IP address can only pass through the
specified port.

Operation Manual - Network Protocol
Quidway S3000-EI Series Ethernet Switches Chapter 5 Access Management Configuration
Huawei Technologies Proprietary
5-3
zPort+MAC binding: binding the packet’s receiving port and its source MAC
address. The specified port will only allow the packet with specified MAC address
to pass; meanwhile the packet with specified MAC address can only pass through
the specified port.
zPort+IP+MAC binding: binding the packet’s receiving port, source IP address and
source MAC address. The specified port will only allow the packet with specified IP
and MAC address to pass. The packet with specified IP address can only pass
through the specified port. Likewise, the packet with specified MAC address can
only pass from the specified port.
zIP+MAC binding: binding the packet’s source IP address and its source MAC
address. If the packet’s source IP address and its specified IP is the same, then
the packet is relayed only when its source MAC address is the specified MAC
address. Likewise, if the packet’s source MAC is the same as the specified MAC
address, then the packet is relayed only when its source IP address is the same as
the specified IP address.
Perform the following configuration in the system view.
Table 5-3 Binding Port, IP Address and MAC Address
Operation Command
Bind port, IP
address and
MAC address
am user-bind { interface { interface-name | interface-type
interface-number } { mac-addr mac | ip-addr ip }* | mac-addr
mac { interface { interface-name | interface-type
interface-number } | ip-addr ip }* | ip-addr ip { interface
{ interface-name | interface-type interface-number } | mac-addr
mac }* }
Remove the
binding of port,
IP address and
MAC address
binding
undo am user-bind {interface { interface-name | interface-type
interface-number } { mac-addr mac | ip-addr ip }* | mac-addr
mac { interface { interface-name | interface-type
interface-number } | ip-addr ip }* | ip-addr ip { interface
{ interface-name | interface-type interface-number } | mac-addr
mac }* }
Note that:
zOne MAC address or one IP address cannot be bound more than once.
zThe maximum binding number is 128.
zDo not perform “Port+IP+MAC” and “Port+IP” on the same port.
5.3 Display and debug Access Management
After the above configuration, execute display command in any view to display the
current configurations of access management on the ports, and to verify the effect of
the configuration.

Operation Manual - Network Protocol
Quidway S3000-EI Series Ethernet Switches Chapter 5 Access Management Configuration
Huawei Technologies Proprietary
5-4
Table 5-4 Display current configuration of access management
Operation Command
Display current configuration of
access management display am [ interface-list ]
Display Port, IP address and
MAC address binding
display am user-bind [ interface
{ interface-name | interface-type
interface-number } | mac-addr mac | ip-addr ip ]
5.4 Access Management Configuration Example
I. Networking requirements
Organization 1 is connected to the port 1 of the switch, and organization 2 to the port
2.The ports 1 and 2 belong to the same VLAN. Organization 1 and organization 2
cannot communicate with each other.
II. Networking diagram
See Figure 5-1.
III. Configuration procedure
# Enable access management globally.
[Quidway] am enable
# Configures Layer 2 isolation between port 1 and port 2.
[Quidway-Ethernet0/1] am isolate ethernet0/2

Operation Manual - Network Protocol
Quidway S3000-EI Series Ethernet Switches Chapter 6 IP Performance Configuration
Huawei Technologies Proprietary
6-1
Chapter 6 IP Performance Configuration
6.1 IP Performance Configuration
IP performance configuration includes:
Configure TCP attributes
6.1.1 Configure TCP Attributes
TCP attributes that can be configured include:
zsynwait timer: When sending the syn packets, TCP starts the synwait timer. If
response packets are not received before synwait timeout, the TCP connection
will be terminated. The timeout of synwait timer ranges 2 to 600 seconds and it is
75 seconds by default.
zfinwait timer: When the TCP connection state turns from FIN_WAIT_1 to
FIN_WAIT_2, finwait timer will be started. If FIN packets are not received before
finwait timer timeout, the TCP connection will be terminated. Finwait timer ranges
76 to 3600 seconds. By default, finwait timer is 675 seconds.
zThe receiving/sending buffer size of connection-oriented Socket is in the range
from 1 to 32K bytes and is 8K bytes by default.
Perform the following configuration in System view.
Table 6-1 Configure TCP attributes
Operation Command
Configure synwait timer time for TCP connection
establishment
tcp timer syn-timeout
time-value
Restore synwait timer time for TCP connection
establishment to default value undo tcp timer syn-timeout
Configure FIN_WAIT_2 timer time of TCP tcp timer fin-timeout
time-value
Restore FIN_WAIT_2 timer time of TCP to default
value undo tcp timer fin-timeout
Configure the Socket receiving/sending buffer size
of TCP tcp window window-size
Restore the socket receiving/sending buffer size of
TCP to default value undo tcp window
By default, the TCP finwait timer is 675 seconds, the synwait timer is 75 seconds, and
the receiving/sending buffer size of connection-oriented Socket is 8K bytes.

Operation Manual - Network Protocol
Quidway S3000-EI Series Ethernet Switches Chapter 6 IP Performance Configuration
Huawei Technologies Proprietary
6-2
6.2 Display and debug IP Performance
After the above configuration, execute display command in any view to display the
running of the IP Performance configuration, and to verify the effect of the configuration.
Execute reset command in user view to clear IP and TCP statistics information.
Table 6-2 Display and debug IP performance
Operation Command
Display TCP connection state display tcp status
Display TCP connection statistics data display tcp statistics
Display IP statistics information display ip statistics
Display ICMP statistics information display icmp statistics
Display socket interface information of
current system display ip socket [ socktype sock-type ] [ task-id socket-id ]
Display the summary of the Forwarding
Information Base display fib
Reset IP statistics information reset ip statistics
Reset TCP statistics information reset tcp statistics
6.3 Troubleshoot IP Performance
Fault: IP layer protocol works normally but TCP and UDP cannot work normally.
In the event of such a fault, you can enable the corresponding debugging information
output to view the debugging information.
zUse the terminal debugging command to output the debugging information to the
console.
zUse the command debugging udp packet to enable the UDP debugging to trace
the UDP packet.
The following are the UDP packet formats:
UDP output packet:
Source IP address:202.38.160.1
Source port:1024
Destination IP Address 202.38.160.1
Destination port: 4296
zUse the debugging tcp packet command to enable the TCP debugging to trace
the TCP packets.
Operations include:
[Quidway] terminal debugging