LevelOne GTL-2890 User manual

Layer 3 Forward and ARP Configuration Content
http://www.level1.com 1
GTL-2890 / GTL-5260
Layer 3 Forward and ARP Configuration

Layer 3 Forward and ARP Configuration Content
http://www.level1.com 2
Content
CHAPTER 1 LAYER 3 MANAGEMENT CONFIGURATION......1-1
1.1 LAYER 3MANAGEMENT INTERFACE ......................................................1-1
1.1.1 Introduction to Layer 3 Management Interface....................................1-1
1.1.2 Layer 3 Interface Configuration Task List............................................1-1
1.2 IP CONFIGURATION .............................................................................1-2
1.2.1 Introduction to IPv4, IPv6.......................................................................1-2
1.2.2 IP Configuration ......................................................................................1-4
1.2.3 IPv6 Troubleshooting .............................................................................1-6
1.3 STATIC ROUTE ....................................................................................1-6
1.3.1 Introduction to Static Route...................................................................1-6
1.3.2 Introduction to Default Route................................................................1-6
1.3.3 Static Route Configuration Task List....................................................1-7
1.3.4 Static Route Configuration Examples...................................................1-7
1.4 ARP ..................................................................................................1-8
1.4.1 Introduction to ARP ................................................................................1-8
1.4.2 ARP Configuration Task List..................................................................1-8
1.4.3 ARP Troubleshooting .............................................................................1-8
CHAPTER 2 ARP SCANNING PREVENTION FUNCTION
CONFIGURATION .....................................................................2-1
2.1 INTRODUCTION TO ARP SCANNING PREVENTION FUNCTION ...................2-1
2.2 ARP SCANNING PREVENTION CONFIGURATION TASK SEQUENCE............2-1
2.3 ARP SCANNING PREVENTION TYPICAL EXAMPLES ................................2-4
2.4 ARP SCANNING PREVENTION TROUBLESHOOTING HELP .......................2-5
CHAPTER 3 PREVENT ARP SPOOFING CONFIGURATION...3-1
3.1 OVERVIEW..........................................................................................3-1
3.1.1 ARP (Address Resolution Protocol) .....................................................3-1
3.1.2 ARP Spoofing ..........................................................................................3-1

Layer 3 Forward and ARP Configuration Content
http://www.level1.com 3
3.1.3 How to prevent void ARP Spoofing ......................................................3-1
3.2 PREVENT ARP SPOOFING CONFIGURATION ...........................................3-2
3.3 PREVENT ARP SPOOFING EXAMPLE.....................................................3-3
CHAPTER 4 ARP GUARD CONFIGURATION..........................4-1
4.1 INTRODUCTION TO ARP GUARD.........................................................4-1
4.2 ARP GUARD CONFIGURATION TASK LIST ...........................................4-2
CHAPTER 5 GRATUITOUS ARP CONFIGURATION................5-1
5.1 INTRODUCTION TO GRATUITOUS ARP...................................................5-1
5.2 GRATUITOUS ARP CONFIGURATION TASK LIST......................................5-1
5.3 GRATUITOUS ARP CONFIGURATION EXAMPLE.......................................5-2
5.4 GRATUITOUS ARP TROUBLESHOOTING.................................................5-3
CHAPTER 6 DYNAMIC ARP INSPECTION CONFIGURATION 6-1
6.1 INTRODUCTION TO DYNAMIC ARP INSPECTION CONFIGURATION .............6-1
6.2 DYNAMIC ARP INSPECTION CONFIGURATION TASK LIST.........................6-1
6.3 DYNAMIC ARP INSPECTION CONFIGURATION EXAMPLE..........................6-2

Layer 3 Forward and ARP Configuration
Chapter 1 Layer 3 Management Configuration
http://www.level1.com 1-1
Chapter 1 Layer 3 Management
Configuration
Switch only support Layer 2 forwarding, but can configure a Layer 3 management
port for the communication of all kinds of management protocols based on IP protocol.
1.1 Layer 3 Management Interface
1.1.1 Introduction to Layer 3 Management Interface
Only one layer 3 management interface can be created on switch. The Layer 3
interface is not a physical interface but a virtual interface. Layer 3 interface is built on
VLANs. The Layer 3 interface can contain one or more layer 2 ports which belong to the
same VLAN, or contain no layer 2 ports. At least one of the Layer 2 ports contained in
Layer 3 interface should be in UP state for Layer 3 interface in UP state, otherwise, Layer
3 interface will be in DOWN state. The switch can use the IP addresses set in the layer 3
management interface to communicate with the other devices via IP.
1.1.2 Layer 3 Interface Configuration Task List
Layer 3 Interface Configuration Task List:
1. Create Layer 3 management interface
2. Configure VLAN interface description
1. Create Layer 3 Management Interface
Command
Explanation
Global Mode
interface vlan <vlan-id>
no interface vlan <vlan-id>
Creates a management VLAN interface; the no
command deletes the VLAN interface created in the
switch.
2. Configure VLAN interface description
Command
Explanation
VLAN Interface Mode
description <text>
Configure the description information of VLAN interface.

Layer 3 Forward and ARP Configuration
Chapter 1 Layer 3 Management Configuration
http://www.level1.com 1-2
1.2 IP Configuration
1.2.1 Introduction to IPv4, IPv6
IPv4 is the current version of global universal Internet protocol. The practice has
proved that IPv4 is simple, flexible, open, stable, strong and easy to implement while
collaborating well with various protocols of upper and lower layers. Although IPv4 almost
has not been changed since it was established in 1980’s, it has kept growing to the current
global scale with the promotion of Internet. However, as Internet infrastructure and
Internet application services continue boosting, IPv4 has shown its deficiency when facing
the present scale and complexity of Internet.
IPv6 refers to the sixth version of Internet protocol which is the next generation
Internet protocol designed by IETF to replace the current Internet protocol version 4 (IPv4).
IPv6 was specially developed to make up the shortages of IPv4 addresses so that Internet
can develop further.
The most important problem IPv6 has solved is to add the amount of IP addresses.
IPv4 addresses have nearly run out, whereas the amount of Internet users has been
increasing in geometric series. With the greatly and continuously boosting of Internet
services and application devices (Home and Small Office Network, IP phone and Wireless
Service Information Terminal which make use of Internet,) which require IP addresses, the
supply of IP addresses turns out to be more and more tense. People have been working
on the problem of shortage of IPv4 addresses for a long time by introducing various
technologies to prolong the lifespan of existing IPv4 infrastructure, including Network
Address Translation(NAT for short), and Classless Inter-Domain Routing(CIDR for short),
etc.
Although the combination of CIDR, NAT and private addressing has temporarily
mitigated the problem of IPv4 address space shortage, NAT technology has disrupted the
end-to-end model which is the original intention of IP design by making it necessary for
router devices that serve as network intermediate nodes to maintain every connection
status which increases network delay greatly and decreases network performance.
Moreover, the translation of network data packet addresses baffles the end-to-end
network security check, IPSec authentication header is such an example.
Therefore, in order to solve all kinds of problems existing in IPv4 comprehensively,
the next generation Internet Protocol IPv6 designed by IETF has become the only feasible
no description
The no command will cancel the description information
of VLAN interface.

Layer 3 Forward and ARP Configuration
Chapter 1 Layer 3 Management Configuration
http://www.level1.com 1-3
solution at present.
First of all, the 128 bits addressing scheme of IPv6 Protocol can guarantee to provide
enough globally unique IP addresses for global IP network nodes in the range of time and
space. Moreover, besides increasing address space, IPv6 also enhanced many other
essential designs of IPv4.
Hierarchical addressing scheme facilitates Route Aggregation, effectively reduces
route table entries and enhances the efficiency and expansibility of routing and data
packet processing.
The header design of IPv6 is more efficient compared with IPv4. It has less data fields
and takes out header checksum, thus expedites the processing speed of basic IPv6
header. In IPv6 header, fragment field can be shown as an optional extended field, so that
data packets fragmentation process won’t be done in router forwarding process, and Path
MTU Discovery Mechanism collaborates with data packet source which enhances the
processing efficiency of router.
Address automatic configuration and plug-and-play is supported. Large amounts of
hosts can find network routers easily by address automatic configuration function of IPv6
while obtaining a globally unique IPv6 address automatically as well which makes the
devices using IPv6 Internet plug-and-play. Automatic address configuration function also
makes the readdressing of existing network easier and more convenient, and it is more
convenient for network operators to manage the transformation from one provider to
another.
Support IPSec. IPSec is optional in IPv4, but required in IPv6 Protocol. IPv6 provides
security extended header, which provides end-to-end security services such as access
control, confidentiality and data integrity, consequently making the implement of
encryption, validation and Virtual Private Network easier.
Enhance the support for Mobile IP and mobile calculating devices. The Mobile IP
Protocol defined in IETF standard makes mobile devices movable without cutting the
existing connection, which is a network function getting more and more important. Unlike
IPv4, the mobility of IPv6 is from embedded automatic configuration to get transmission
address (Care-Of-Address); therefore it doesn’t need Foreign Agent. Furthermore, this
kind of binding process enables Correspondent Node communicate with Mobile Node
directly, thereby avoids the extra system cost caused by triangle routing choice required in
IPv4.
Avoid the use of NetworkAddress Translation. The purpose of the introduction of NAT
mechanism is to share and reuse same address space among different network segments.
This mechanism mitigates the problem of the shortage of IPv4 address temporally;
meanwhile it adds the burden of address translation process for network device and
application. Since the address space of IPv6 has increased greatly, address translation

Layer 3 Forward and ARP Configuration
Chapter 1 Layer 3 Management Configuration
http://www.level1.com 1-4
becomes unnecessary, thus the problems and system cost caused by NAT deployment
are solved naturally.
Support extensively deployed Routing Protocol. IPv6 has kept and extended the
supports for existing Internal Gateway Protocols (IGP for short), and Exterior Gateway
Protocols (EGP for short). For example, IPv6 Routing Protocol such as RIPng, OSPFv3,
IS-ISv6 and MBGP4+, etc.
Multicast addresses increased and the support for multicast has enhanced. By
dealing with IPv4 broadcast functions such as Router Discovery and Router Query, IPv6
multicast has completely replaced IPv4 broadcast in the sense of function. Multicast not
only saves network bandwidth, but enhances network efficiency as well.
1.2.2 IP Configuration
Layer 3 interface can be configured as IPv4 interface, IPv6 interface.
1.2.2.1 IPv4 Address Configuration
IPv4 address configuration task list:
1. Configure the IPv4 address of three-layer interface
1．Configure the IPv4 address of three-layer interface
Command
Explanation
VLAN Interface Configuration Mode
ip address <ip-address> <mask>
[secondary]
no ip address [<ip-address> <mask>]
Configure IP address of VLAN
interface; the no ip address
[<ip-address> <mask>] command
cancels IP address of VLAN
interface.
1.2.2.2 IPv6 Address Configuration
The configuration Task List of IPv6 is as follows:
1. IPv6 basic configuration
(1) Configure interface IPv6 address
2. IPv6 Neighbor Discovery Configuration
(1) Configure DAD neighbor solicitation message number
(2) Configure send neighbor solicitation message interval
(3) Configure static IPv6 neighbor entries

Layer 3 Forward and ARP Configuration
Chapter 1 Layer 3 Management Configuration
http://www.level1.com 1-5
(4) Delete all entries in IPv6 neighbor table
1. IPv6 Basic Configuration
(1) Configure interface IPv6 address
Command
Explanation
Interface Configuration Mode
ipv6 address
<ipv6-address/prefix-length>
[eui-64]
no ipv6 address
<ipv6-address/prefix-length>
Configure IPv6 address, including
aggregatable global unicast addresses,
site-local addresses and link-local addresses.
The no ipv6 address
<ipv6-address/prefix-length> command
cancels IPv6 address.
2. IPv6 Neighbor Discovery Configuration
(1) Configure DAD Neighbor solicitation Message number
Command
Explanation
Interface Configuration Mode
ipv6 nd dad attempts <value>
no ipv6 nd dad attempts
Set the neighbor query message number sent
in sequence when the interface makes
duplicate address detection. The no command
resumes default value (1).
(2) Configure Send Neighbor solicitation Message Interval
Command
Explanation
Interface Configuration Mode
ipv6 nd ns-interval <seconds>
no ipv6 nd ns-interval
Set the interval of the interface to send
neighbor query message. The NO command
resumes default value (1 second).
(3) Configure static IPv6 neighbor Entries
Command
Explanation
Interface Configuration Mode
ipv6 neighbor <ipv6-address>
<hardware-address> interface
<interface-type interface-name>
Set static neighbor table entries, including
neighbor IPv6 address, MAC address and
two-layer port.
no ipv6 neighbor <ipv6-address>
Delete neighbor table entries.
(4) Delete all entries in IPv6 neighbor table

Layer 3 Forward and ARP Configuration
Chapter 1 Layer 3 Management Configuration
http://www.level1.com 1-6
Command
Explanation
Admin Mode
clear ipv6 neighbors
Clear all static neighbor table entries.
1.2.3 IPv6 Troubleshooting
If the connected PC has not obtained IPv6 address, you should check the RA
announcement switch (the default is turned off)
1.3 Static Route
1.3.1 Introduction to Static Route
As mentioned earlier, the static route is the manually specified path to a network or a
host. Static route is simple and consistent, and can prevent illegal route modification, and
is convenient for load balance and route backup. However, it also has its own defects.
Static route, as its name indicates, is static, it won’t modify the route automatically on
network failure, and manual configuration is required on such occasions, therefore it is not
suitable for mid and large-scale networks.
Static route is mainly used in the following two conditions: 1) in stable networks to
reduce load of route selection and routing data streams. For example, static route can be
used in route to STUB network. 2) For route backup, configure static route in the backup
line, with a lower priority than the main line.
Static route and dynamic route can coexist; layer3 switch will choose the route with
the highest priority according to the priority of routing protocols. At the same time, static
route can be introduced (redistribute) in dynamic route, and change the priority of the
static route introduced as required.
1.3.2 Introduction to Default Route
Default route is a kind of static route, which is used only when no matching route is
found. In the route table, default route in is indicated by a destination address of 0.0.0.0
and a network mask of 0.0.0.0, too. If the route table does not have the destination of a
packet and has no default route configured, the packet will be discarded, and an ICMP
packet will be sent to the source address indicate the destination address or network is
unreachable.

Layer 3 Forward and ARP Configuration
Chapter 1 Layer 3 Management Configuration
http://www.level1.com 1-7
1.3.3 Static Route Configuration Task List
1. Static route configuration
1. Static route configuration
Command
Explanation
Global mode
ip route {<ip-prefix> <mask> |
<ip-prefix>/<prefix-length>} {<gateway-address>
| <gateway-interface>} [<distance>]
no ip route {<ip-prefix> <mask> |
<ip-prefix>/<prefix-length>} [<gateway-address>
| <gateway-interface>] [<distance>]
Set static routing; the no ip
route {<ip-prefix> <mask> |
<ip-prefix>/<prefix-length>}
[<gateway-address> |
<gateway-interface>]
[<distance>]command
deletes a static route entry
1.3.4 Static Route Configuration Examples
The figure shown below is a simple network consisting of three layer3 switches, the
network mask for all switches and PC is 255.255.255.0. PC-A and PC-C are connected
via the static route set in SwtichA and SwitchC; PC3 and PC-B are connected via the
static route set in SwtichC to SwitchB; PC-B and PC-C is connected via the default route
set in SwitchB.
Fig 1-1 Static Route Configurations
Configuration steps:
Configuration of layer3 SwitchA
SwitchB
PC-A:10.1.1.2
PC-B:10.1.4.2
vlan3:10.1.5.1
vlan1:10.1.1.1
vlan2:10.1..2.1
vlan2:10.1.4.1
vlan2:10.1.2.2
vlan1:10.1.3.2
SwitchA
SwitchC
vlan1:10.1.3.1
PC-C:10.1.5.2