Zte ZXR10 8900 Series User manual

ZXR108900Series
10GRoutingSwitch
UserManual(DPIVolume)
Version2.8.02.C
ZTECORPORATION
ZTEPlaza,KejiRoadSouth,
Hi-TechIndustrialPark,
NanshanDistrict,Shenzhen,
P .R.China
518057
Tel:(86)75526771900800-9830-9830
Fax:[phone]
URL:http://support.zte.com.cn
E-mail:[email protected]

LEGALINFORMATION
Copyright©2006ZTECORPORATION.
Thecontentsofthisdocumentareprotectedbycopyrightlawsandinternationaltreaties.Anyreproductionordistributionof
thisdocumentoranyportionofthisdocument,inanyformbyanymeans,withoutthepriorwrittenconsentofZTECORPO-
RATIONisprohibited.Additionally,thecontentsofthisdocumentareprotectedbycontractualcondentialityobligations.
Allcompany,brandandproductnamesaretradeorservicemarks,orregisteredtradeorservicemarks,ofZTECORPORATION
oroftheirrespectiveowners.
Thisdocumentisprovided“asis” ,andallexpress,implied,orstatutorywarranties,representationsorconditionsaredis-
claimed,includingwithoutlimitationanyimpliedwarrantyofmerchantability,tnessforaparticularpurpose,titleornon-in-
fringement.ZTECORPORATIONanditslicensorsshallnotbeliablefordamagesresultingfromtheuseoforrelianceonthe
informationcontainedherein.
ZTECORPORATIONoritslicensorsmayhavecurrentorpendingintellectualpropertyrightsorapplicationscoveringthesubject
matterofthisdocument.ExceptasexpresslyprovidedinanywrittenlicensebetweenZTECORPORATIONanditslicensee,
theuserofthisdocumentshallnotacquireanylicensetothesubjectmatterherein.
ZTECORPORATIONreservestherighttoupgradeormaketechnicalchangetothisproductwithoutfurthernotice.
UsersmayvisitZTEtechnicalsupportwebsitehttp://ensupport.zte.com.cntoinquirerelatedinformation.
TheultimaterighttointerpretthisproductresidesinZTECORPORATION.
RevisionHistory
RevisionNo.RevisionDateRevisionReason
R1.020090610FirstRelease
SerialNumber:sjzl20093842

Contents
AboutThisManual..............................................i
WhatisDPI?.....................................................1
WhatisDPI?..................................................................1
DPIApplications.............................................................2
ConguringSignatureSymbol...........................3
SignatureSymbolOverview.............................................3
ConguringSignatureSymbol..........................................3
AddingSignatureSymbol............................................3
SettingSignatureSymbolHit-Limit-Numberand
ApplicationType.................................................4
ShowingCongurationofDesignatedSignature
Symbol.............................................................4
SignatureSymbolCongurationExample...........................4
ConguringSignatureEntry..............................5
SignatureEntryOverview................................................5
ConguringSignatureEntry.............................................5
ConguringSignatureEntry.........................................5
ShowingCongurationofSignatureEntry......................6
SignatureEntryCongurationExample..............................6
ConguringPolicy.............................................7
DPIPolicyOverview........................................................7
ConguringFlowPool......................................................7
ConguringParameterUpstream..................................7
ConguringParameterDownstream..............................8
ConguringDefaultUpstream/Downstream
Parameters........................................................8
ShowingCongurationofFlowPool...............................8
FlowPoolCongurationExample......................................8
ConguringSubService....................................9
SubserviceOverview.......................................................9
ConguringSubservice....................................................9

AddingSignatureSymbolSequence..............................9
AddingSignatureSymbolApplication...........................10
BindingFlow-PoolwithCurrentSubservice....................10
SettingPermit/DenyPolicyforCurrentSubservice.........10
SettingAgingTimeforCurrentSubservice....................11
ShowingCongurationofDesignatedSubservice...........11
SubserviceCongurationExample...................................11
ConguringService.........................................13
ServiceOverview...........................................................13
ConguringService........................................................13
AddingOneSubservicetoCurrentService....................13
ImportingAnotherSubserviceintoOneSubservice.........14
BindingFlow-PoolwithCurrentService.........................14
ShowingServiceConguration....................................14
ServiceCongurationExample........................................14
ConguringDPITemplate...............................17
DPI-TemplateOverview..................................................17
ConguringDPI-T emplate...............................................17
BindingDirectionRulestoDataFlow............................17
BindingServicePolicy................................................18
SourceIPBindingRules..............................................18
BindingPortRules.....................................................18
ShowingCongurationofDPI-Template........................18
DPI-TemplateCongurationExample................................19
Glossary..........................................................21

AboutThisManual
ThismanualisZXR108900Series(V2.8.02.C)10GRout-
ingSwitchUserManual(DPIVolume)andappliestoZXR10
8902/8905/8908/891210Groutingswitch(V2.8.02.C).
ZXR108900series10Groutingswitchhasthefollowingrelated
manuals:
ManualSummary
ZXR108900Series(V2.8.02.C)10G
RoutingSwitchHardwareInstallation
Manual
Thismanualdescribes
installationpreparation,
19-inchcabinetinstallation,
maindeviceinstallation,
powercableconnection,cable
connectionandhardware
inspection.
ZXR108900Series(V2.8.02.C)10G
RoutingSwitchHardwareManual
Thismanualdescribes
devicefunctions,technical
characteristicsand
parameters,workingprinciple,
hardwarestructure,MCS,LIC,
powermoduleandfanplug-in
box.
ZXR108900Series(V2.8.02.C)10G
RoutingSwitchUserManual(Basic
ConfigurationVolume)
Thismanualdescribesusing
andoperationofdevice,
systemmanagement,
CLIprivilegeranking
configuration,port
configuration,network
protocolconfiguration,
DHCPconfiguration,
VRRPconfiguration,
ACLconfiguration,QoS
configuration,DOTIX
configuration,cluster
managementconfiguration,
networkmanagement
configuration,IPTV
configuration,VBAS
configuration,CPUguard,
URPFconfigurationandUDLD
configuration.
ZXR108900Series(V2.8.02.C)10G
RoutingSwitchUserManual(Ethernet
SwitchingVolume)
Thismanualdescribes
deviceVLANconfiguration,
STPconfiguration,MAC
addresstableoperation,link
aggregationconfiguration,
IGMPSnoopingconfiguration,
linkprotectionconfiguration,
EthernetOAMconfiguration
andEPONOLTconfiguration.
ConfidentialandProprietaryInformationofZTECORPORATIONi

ZXR108900SeriesUserManual(DPIVolume)
ManualSummary
ZXR108900Series(V2.8.02.C)10G
RoutingSwitchUserManual(IPv4
RoutingVolume)
Thismanualdescribes
staticroutingconfiguration,
RIPconfiguration,OSPF
configuration,IS-IS
configuration,BGP
configuration,loadbalancing
configuration,multicast
routingconfiguration,IP/LDP
FRRconfigurationandBFD
configuration.
ZXR108900Series(V2.8.02.C)10G
RoutingSwitchUserManual(MPLS
Volume)
Thismanualdescribesdevice
MPLSconfiguration,MPLS
L3VPNconfigurationandMPLS
L2VPNconfiguration.
ZXR108900Series(V2.8.02.C)10G
RoutingSwitchUserManual(IPv6
Volume)
Thismanualdescribesdevice
IPv6addressconfiguration,
IPv6neighbordiscovery
protocolconfiguration,IPv6
tunnelconfiguration,IPv6
staticroutingconfiguration,
RIPngconfiguration,OSPFv3
configuration,IS-ISv6
configurationandBGP+
configuration.
ZXR108900Series(V2.8.02.C)10G
RoutingSwitchCommandManual
(CommandIndexVolume)
Thismanualdescribesvolume
andsectioncorrespondingto
eachcommandinZXR108900
series10Groutingswitch.
ZXR108900Series(V2.8.02.C)10G
RoutingSwitchCommandManual
(IPv6Volume)
Thismanualdescribes
IPv6-relatedcommandsin
ZXR108900series10G
routingswitch.
ZXR108900Series(V2.8.02.C)10G
RoutingSwitchCommandManual(IP
RoutingVolumeI)
ThismanualdescribesRIP,
OSPFandIS-IS-related
commandsinZXR108900
series10Groutingswitch.
ZXR108900Series(V2.8.02.C)10G
RoutingSwitchCommandManual(IP
RoutingVolumeII)
ThismanualdescribesBGP,
routemapandrouting
policy-relatedcommands
inZXR108900series10G
routingswitch.
ZXR108900Series(V2.8.02.C)10G
RoutingSwitchCommandManual
(MPLSVolume)
Thismanualdescribes
MPLS-relatedcommands
inZXR108900series10G
routingswitch.
ZXR108900Series(V2.8.02.C)10G
RoutingSwitchCommandManual
(QoSVolume)
Thismanualdescribes
QoS-relatedcommandsin
ZXR108900series10G
routingswitch.
ZXR108900Series(V2.8.02.C)10G
RoutingSwitchCommandManual
(SecurityVolume)
Thismanualdescribes
securityconfiguration-related
commandsinZXR108900
series10Groutingswitch.
iiConfidentialandProprietaryInformationofZTECORPORATION

AboutThisManual
ManualSummary
ZXR108900Series(V2.8.02.C)10G
RoutingSwitchCommandManual
(BasicConfigurationVolumeI)
Thismanualdescribes
systemmanagement,file
management,userinterface,
logstatistics,FTP/TFTPserver
andIPvr-relatedcommands
inZXR108900series10G
routingswitch.
ZXR108900Series(V2.8.02.C)10G
RoutingSwitchCommandManual
(BasicConfigurationVolumeII)
Thismanualdescribes
interfaceconfiguration,DHCP
andVRRP-relatedcommands
inZXR108900series10G
routingswitch.
ZXR108900Series(V2.8.02.C)10G
RoutingSwitchCommandManual
(BasicConfigurationVolumeIII)
ThismanualdescribesNAT,
TimeRange,stackand
DEBUG-relatedcommands
inZXR108900series10G
routingswitch.
ZXR108900Series(V2.8.02.C)10G
RoutingSwitchCommandManual
(NetworkManagementVolume)
Thismanualdescribes
networkmanagement-related
commandsinZXR108900
series10Groutingswitch.
ZXR108900Series(V2.8.02.C)10G
RoutingSwitchCommandManual
(EthernetSwitchingVolume)
ThismanualdescribesMAC,
VLAN,SuperVLAN,STP,link
aggregation,VBAS,MACPING
andUDLD-relatedcommands
inZXR108900series10G
routingswitch.
ZXR108900Series(V2.8.02.C)10G
RoutingSwitchCommandManual
(VoiceandVideoVolume)
ThismanualdescribesVOIP
andIPTV-relatedcommands
inZXR108900series10G
routingswitch.
ZXR108900Series(V2.8.02.C)10G
RoutingSwitchCommandManual
(MulticastVolume)
Thismanualdescribes
multicastprotocol-related
commandsinZXR108900
series10Groutingswitch.
CommandssupportedbyZXR108900series(V2.8.02.C)10G
routingswitcharebasedonuniformplatformZXROSV4.8.22.
ZXR108900Series(V2.8.02.C)10GRoutingSwitchUserManual
(DPIVolume)containsthefollowingchapters:
ChapterSummary
Chapter1DPI
Overview
Thischapterdescribesbasicconceptand
applicationsofDPI.
Chapter2Signature
EntryConfiguration
Thischapterdescribesbasicconcept,
configurationandconfigurationexampleof
DPIsignatureentry.
Chapter3Signature
SymbolConfiguration
Thischapterdescribesbasicconcept,
configurationandconfigurationexampleof
DPIsignaturesymbol.
Chapter4Policy
Configuration
Thischapterdescribesbasicconcept,
configurationandconfigurationexampleof
DPIpolicy.
Chapter5SubService
Configuration
Thischapterdescribesbasicconcept,
configurationandconfigurationexampleof
DPIsubservice.
ConfidentialandProprietaryInformationofZTECORPORATIONiii

ZXR108900SeriesUserManual(DPIVolume)
ChapterSummary
Chapter6Service
Configuration
Thischapterdescribesbasicconcept,
configurationandconfigurationexampleof
DPIservice.
Chapter7DPI
TemplateConfiguration
Thischapterdescribesbasicconcept,
configurationandconfigurationexampleof
DPItemplate.
GlossaryThispartlistsglossariesusedinthismanual.
ivConfidentialandProprietaryInformationofZTECORPORATION

Chapter1
WhatisDPI?
TableofContents:
WhatisDPI?......................................................................1
DPIApplications.................................................................2
WhatisDPI?
DPIOverviewDPIisalsocalledDeepPacketInspection.Tosay“Deep”,itiscom-
paredwithcommonpacketresolutionlayers.“CommonPacket
Inspection”onlyresolvesitemsunderlayer4inIPpacket,includ-
ingsourceaddress,destinationaddress,sourceport,destination
portandprotocoltype.DPIresolvesnotonlytheselayers,but
alsoapplicationlayer ,identifyingvariousapplicationsandcorre-
spondingitems.
ThekeytechnologyofDPIistoidentifyvariousapplicationsin
network.
Commonpacketinspectionidentiesapplicationtypethroughport
id.Forexample,ifportidisdetectedtobe80,thisapplicationis
believedtobeacommonnetworkapplication.However ,currently
someillegalapplicationsinnetworkwillavoidinspectionandmon-
itoringbywayofhidingorimpersonatingportidandattacknet-
workactingasdataowoflegalpackets.Inthiscase,suchillegal
applicationsfailtobedetectedwithtraditionalL2-L4inspection.
DPItechnologyistoinspectthecontentofpacketsinapplication
dataowsoastoverifytheactualapplicationofthesepackets.
DPITechnology
Applications
BydeployingDPItechnologyinIPnetwork,systemcanimple-
mentsserviceidentication,servicecontrolandservicestatistics
functionsinnetworkoperation.
�ServiceIdentication
Generally,therearetwowaysforserviceidentication:oneis
legalservicefullledbycarrierandtheotherisservicemoni-
toredbycarrier .
Theformertypeofservicecanbeidentiedbyve-elementsof
servicetrafc.Forexample,theaddressofVODservicetrafc
belongstoVODservernetworksegmentanditsportisaxed
address.SystemadoptsACLtoidentifythistypeofservice.
Asforthelatterservice,resolvethedetailsofIPpacketwith
theserviceidenticationmethodmentionedaboveandlearn
thetypeofservicetrafcthroughsearchingofkeywordor
servicebehaviorstatistics.
ConfidentialandProprietaryInformationofZTECORPORATION1

ZXR108900SeriesUserManual(DPIVolume)
�ServiceControl
AfteridentifyingservicetrafcwithDPItechnology,controlser-
vicetrafcaccordingtocombinationconditionsofnetworkcon-
gurations,suchasuser ,timer ,bandwidth,history,trafcand
soon.Thereareseveralcontrolways:normalforwarding,
blocking,limitingbandwidth,trafcshaping,re-markingprior-
ityandsoon.
Takingoperationofservicesintoaccount,servicecontrolpoli-
ciesaremainlyconguredonpolicyserveranddistributedafter
usersgetonline.
�trafcstatistics
DPIservicestatisticsfunctionisusedtoviewservicetrafc
distributioninnetworkandusingofvariousservicesintuition-
istically.Inthisway,factorspromotingservicedevelopment
andinuencingnetworkoperationcanbedetected,whichpro-
videssupporttooptimizationofnetworkandservices.Forex-
ample,thisfunctioncanbeusedtondwhatservicesattract
moreusers,checkifprovidedservicelevelmeetsrequirement
ofuserSLA(Service-LevelAgreement),conductstatisticsto
percentofattacktrafcinnetwork,countthenumberofusers
usingonegameservice,andndwhatserversmostlyconsume
networkbandwidthsandwhichusersuseillegalVoIPandsoon.
DPIApplications
DPIcardcanperformDPIinspectiontoL3trafcredirectedtoDPI
card.IdentifyTCPconnectionorUDPconnectionestablishedby
eachtrafc,scanpacketsbasedoneachconnection,andnally
identifyconnection-basedapplications(suchasP2PVoIP ,FTPand
soon).Implementdifferentpolicies(supportingratelimit,modi-
cationtotosandpriofpacketandsoon)todifferentapplications
accordingtousercongurationssoastooptimizenetwork,pro-
videmeticulousservicestousersbasedonexistingnetwork,and
increasenetworkbenetsforcarrier .
DPIcard,withthehelpofNMsystem,haspowerfulcapabilitiesin
datarecord,statisticsandanalysis.DPIcardcanconductstatistics
toupstreamanddownstreamtrafcperuserbasedontcporudp
connection,andrecordthestatisticsinrealtime.Afteracertain
period(usercancustomizetheinterval),DPIcardautomatically
up-sendstherecordedstatisticstoremoteNMsystemthroughnet-
work.NMsystemanalysestheserecordsandconductsstatistics,
sothatusercanknowtrafcdistributionincurrentnetworkex-
actly.What’smore,usercanviewchangesofnetworktrafcand
networkapplicationsofdifferentperiods(byday,week,monthand
soon)andadoptdifferentmanagementmodesaccordingtothese
changes,sothatnetworkcanprovideservicesnormally.
2ConfidentialandProprietaryInformationofZTECORPORATION

Chapter2
ConfiguringSignature
Symbol
TableofContents:
SignatureSymbolOverview.................................................3
ConguringSignatureSymbol..............................................3
SignatureSymbolCongurationExample...............................4
SignatureSymbolOverview
Wedescribeeachsub-serviceincertaindescriptionmode,suchas
stringandsoon.Thesedescriptionmodesarecalledsignature
symbol.Asignaturesymbolisasetofsignatureentries,describ-
ingaminimumindependentapplication,suchasBT/FTP/HTTPand
soon.
ConfiguringSignature
Symbol
AddingSignatureSymbol
StepCommandFunction
1ZXR10(config)#dpiThisentersDPIconfiguration
mode.
2ZXR10(config-dpi)#signature-symbol
<signature-symbol-id>
Thisenterssignaturesymbol
configurationmode.
3ZXR10(config-dpi-signature-symbol-2)#add
signature-entry<signature-entry-id>
Thisaddsasignatureentryto
signaturesymbol.
ConfidentialandProprietaryInformationofZTECORPORATION3

ZXR108900SeriesUserManual(DPIVolume)
SettingSignatureSymbol
Hit-Limit-NumberandApplication
Type
StepCommandFunction
1ZXR10(config)#dpiThisentersDPIconfiguration
mode.
2ZXR10(config-dpi)#signature-symbol
<signature-symbol-id>
Thisenterssignaturesymbol
configurationmode.
3ZXR10(config-dpi-signature-symbol-2)#set
hit-limit-num<hit-limit-num>protocol-type
[normal|inherit]
Thiscommandsetssignature
symbolhit-limit-numand
applicationtype.Itindicates
theapplicationisconfirmed
andverifiedonlyafterthe
hitnumberofthissignature
symbolreachesorisabove
thevalueofhit-limit-num;
applicationtypebeinginherit
indicatesthisapplication
needsbeingprocessedby
stagesandsignaturesearchis
alwaysconductedforpackets
atsomestages.
ShowingConfigurationofDesignated
SignatureSymbol
CommandFunction
ZXR10(config)#showsignature-symbol<signature-sy
mbol-id>
Thisshowsconfigurationof
designatedsignaturesymbol.
Thisshowsidanddetailsofa
signatureentryboundunder
signaturesymbol.
SignatureSymbol
ConfigurationExample
Thefollowingpartisasignaturesymbolcongurationexample:
ZXR10(config)#dpiZXR10(config-dpi)#signature-symbol2
ZXR10(config-dpi-signature-symbol-2)#addsignature-entry2
ZXR10(config-dpi-signature-symbol-2)#sethit-limit-num10
protocol-typeinheritZXR10(config)#showsignature-symbol2
4ConfidentialandProprietaryInformationofZTECORPORATION

Chapter3
ConfiguringSignature
Entry
TableofContents:
SignatureEntryOverview....................................................5
ConguringSignatureEntry.................................................5
SignatureEntryCongurationExample..................................6
SignatureEntryOverview
Signaturesymbolcontainsasetofsignatureentries.Eachsig-
natureentryisastringoraseriesofsequentialstrings,which
indicatesonesignatureentry.
SignatureentryisacombinationofoneormoreKEYs.KEYcanbe
classiedintotwotypes:
�StaticKEY:Itiscontainedintherst16bytesatthexed
locationofpacket.Itsvalidbitnumbermustbeexpressedby
mask.PackethereindicatesUDPpacketorTCPpacket.The
rst16bytesherearetherst16bytesofpacketpayload,
notincludingpacketheader(L2header ,IPheader ,TCP/UDP
headerandsoon).
�DynamicKEY:Thelocationofsuchkeyisnotxedinthe
packet.However ,eachkeymustbeaspecicstringora
seriesofsequentialhexadecimalnumbers.Thesecharacters
mustbeconsecutive.
ConfiguringSignatureEntry
ConfiguringSignatureEntry
StepCommandFunction
1ZXR10(config)#dpiThisentersDPIconfiguration
mode.
ConfidentialandProprietaryInformationofZTECORPORATION5

ZXR108900SeriesUserManual(DPIVolume)
StepCommandFunction
2ZXR10(config-dpi)#signature-entry<signature-e
ntry-id>
Thisenterssignatureentry
configurationmode.
3ZXR10(config-dpi-signature-entry-2)#setcontent
<string>
Thissetscontentofthe
signatureentry.
ShowingConfigurationofSignature
Entry
CommandFunction
ZXR10(config)#showsignature-entry<signature-entr
y-id>
Thisshowsconfigurationofa
signatureentry.
SignatureEntry
ConfigurationExample
Thefollowingpartshowsasignatureentrycongurationexample:
ZXR10(config)#dpiZXR10(config-dpi)#signature-entry2
ZXR10(config-dpi-signature-entry-2)#setcontent
0xabcd(0xffffffff000000000000000000000000)+0x1234+0x5678
ZXR10(config)#showsignature-entry2
6ConfidentialandProprietaryInformationofZTECORPORATION

Chapter4
ConfiguringPolicy
TableofContents:
DPIPolicyOverview............................................................7
ConguringFlowPool..........................................................7
FlowPoolCongurationExample..........................................8
DPIPolicyOverview
DPIpolicycanalsobedescribedasapplication+policy.Thatis,
implementdifferentpoliciesfordifferentapplications.Thiscom-
binationiscalledDPIpolicy.Inentryow-pool,upstream/down-
streamrate-limitpolicyiscongured.
ConfiguringFlowPool
ConfiguringParameterUpstream
StepCommandFunction
1ZXR10(config)#dpiThisentersDPIconfiguration
mode.
2ZXR10(config-dpi)#flow-pool<flow-pool-id>Thisentersflowpool
configurationmode.
3ZXR10(config-dpi-flow-pool-2)#upstream-rate-li
mit<limit-rate>cbs<cbs-bytes>ebs<ebs-bytes>
Thisconfiguresparameter
upstreamofflowpool.
limit-rate:Itisratelimit,in
kbps.
cbs:Itiscommittedburst
size,inbytes.
ebs:Itisexcessburstsize,
inbytes.
ConfidentialandProprietaryInformationofZTECORPORATION7

ZXR108900SeriesUserManual(DPIVolume)
ConfiguringParameterDownstream
StepCommandFunction
1ZXR10(config)#dpiThisentersDPIconfiguration
mode.
2ZXR10(config-dpi)#flow-pool<flow-pool-id>Thisentersflowpool
configurationmode.
3ZXR10(config-dpi-flow-pool-2)#downstream
-rate-limit<limit-rate>cbs<cbs-bytes>ebs
<ebs-bytes>
Thisconfiguresparameter
downstreamofflowpool.
ConfiguringDefaultUpstream/Downs
treamParameters
StepCommandFunction
1ZXR10(config)#dpiThisentersDPIconfiguration
mode.
2ZXR10(config-dpi)#default-flow-pool{downs
tream|upstream}rate-limit<limit-rate>cbs
<cbs-bytes>ebs<ebs-bytes>
Thisconfiguresparameters
upstreamanddownstreamof
defaultflowpool(flowpool
1).
ShowingConfigurationofFlowPool
CommandFunction
ZXR10(config)#showflow-pool<flow-pool-id>Thisshowsconfigurationofflow
pool.
FlowPoolConfiguration
Example
Thefollowingpartshowsaowpoolcongurationexample:
ZXR10(config)#dpiZXR10(config-dpi)#flow-pool2
ZXR10(config-dpi-flow-pool-2)#upstream-rate-limit100cbs
3000ebs3000ZXR10(config-dpi-flow-pool-2)#
downstream-rate-limit200cbs3000ebs3000
8ConfidentialandProprietaryInformationofZTECORPORATION

Chapter5
ConfiguringSubService
TableofContents:
SubserviceOverview...........................................................9
ConguringSubservice........................................................9
SubserviceCongurationExample.......................................11
SubserviceOverview
Subservicedescribesonetypeofservicecontainedintheservice.
Eachsubservicecontainsoneormoresignature-symbolrelations,
andeachsignature-symbolrelationismadeupofasignature-sym-
bolserialnumber(separatedbyslash,suchas1/2/3/4).Each
subserviceisonlyboundwithoneow-pool.Otherpoliciescan
alsobebound.Atpresent,policiesactionandaging-timearesup-
ported.
ConfiguringSubservice
AddingSignatureSymbolSequence
StepCommandFunction
1ZXR10(config)#dpiThisentersDPIconfiguration
mode.
2ZXR10(config-dpi)#subservice<subservice-id>Toentersubservice
configurationmode,execute
thefollowingcommands:
3ZXR10(config-dpi-subservice-2)#addsignature-sy
mbol<signature-symbol-id-relation>[relation-name]
Thiscommandaddssignature
symbolsequenceforcurrent
subserviceandmeanwhile
namesthissequenceas
relation-name.
ConfidentialandProprietaryInformationofZTECORPORATION9

ZXR108900SeriesUserManual(DPIVolume)
AddingSignatureSymbolApplication
StepCommandFunction
1ZXR10(config)#dpiThisentersDPIconfiguration
mode.
2ZXR10(config-dpi)#subservice<subservice-id>Thisenterssubservice
configurationmode.
3ZXR10(config-dpi-subservice-2)#addprotocol
<protocol-name>
Thisaddsonesignature
symbolapplicationforcurrent
subservice.
BindingFlow-PoolwithCurrent
Subservice
StepCommandFunction
1ZXR10(config)#dpiThisentersDPIconfiguration
mode.
2ZXR10(config-dpi)#subservice<subservice-id>Thisenterssubservice
configurationmode.
3ZXR10(config-dpi-subservice-2)#bindflow-pool
<flow-pool-id>
Thisbindsflow-poolwith
currentsubservice
SettingPermit/DenyPolicyfor
CurrentSubservice
StepCommandFunction
1ZXR10(config)#dpiThisentersDPIconfiguration
mode.
2ZXR10(config-dpi)#subservice<subservice-id>Thisenterssubservice
configurationmode.
3ZXR10(config-dpi-subservice-2)#action
{permit|deny}
Thissetspermit/denypolicy
forcurrentsubservice.
10ConfidentialandProprietaryInformationofZTECORPORATION

Chapter5ConfiguringSubService
SettingAgingTimeforCurrent
Subservice
StepCommandFunction
1ZXR10(config)#dpiThisentersDPIconfiguration
mode.
2ZXR10(config-dpi)#subservice<subservice-id>Thisenterssubservice
configurationmode.
3ZXR10(config-dpi-subservice-2)#aging-time
<time>
Thissetsagingtimefor
currentsubservice.
ShowingConfigurationofDesignated
Subservice
CommandFunction
ZXR10(config)#showsubservice<subservice-id>Thisshowsconfigurationof
designatedsubservice.
SubserviceConfiguration
Example
Thefollowingpartshowsasubservicecongurationexample:
ZXR10(config)#dpiZXR10(config-dpi)#subservice2
ZXR10(config-dpi-subservice-2)#addsignature-symbol
1/2/3/4XXXX
ZXR10(config-dpi-subservice-2)#addprotocolHTTP
ZXR10(config-dpi-subservice-2)#bindflow-pool2
ZXR10(config-dpi-subservice-2)#actionpermit
ZXR10(config-dpi-subservice-2)#aging-time10
ZXR10(config)#showsubservice2
ConfidentialandProprietaryInformationofZTECORPORATION11

ZXR108900SeriesUserManual(DPIVolume)
Thispageisintentionallyblank.
12ConfidentialandProprietaryInformationofZTECORPORATION