assign forward ipv6 longer-mask resource share-mode

assign forward ipv6 longer-mask resource share-mode

For the CE6857EI, CE6857E, CE6857F, CE6865EI, CE6865E, CE8861, and CE8868 running a V2 version, set the resource allocation mode to shared mode for IPv6 addresses/IPv6 routes with the prefix length greater than 64 bits and less than 128 bits. In this mode, IPv4 addresses/IPv4 routes and IPv6 addresses/IPv6 routes share chip resources.

This configuration takes effect after the device is restarted.

user-interface console 0

user-interface console 0

Configure a console port login password to improve security. This configuration is mandatory.

authentication-mode password

authentication-mode password

set authentication password cipher Myrhgl@131

set authentication password cipher Myrhgl@131

#

#

-

user-interface maximum-vty 21

user-interface maximum-vty 21

Set the maximum number of VTY user interfaces to 21.

user-interface vty 0 20

user-interface vty 0 20

-

authentication-mode aaa

authentication-mode aaa

Set the authentication mode to AAA.

user privilege level 3

user privilege level 3

Set the user level to 3.

protocol inbound ssh

protocol inbound ssh

Specify the SSH protocol to improve security.

#

#

-

stelnet server enable

stelnet server enable

Enable the STelnet service on an SSH server.

#

#

-

aaa

aaa

Enter the AAA view.

local-user huawei password irreversible-cipher Myrhgl@520

local-user huawei password irreversible-cipher Myrhgl@520

Set the local user name to huawei and password to Myrhgl@520 for an administrator to log in to and maintain the device.

local-user huawei service-type ssh

local-user huawei service-type ssh

Specify the SSH protocol.

CE device running a V2 version:

local-user huawei level 3

CE device running a V3 version:

local-user huawei privilege level 3

CE device running a V2 version:

local-user huawei level 3

CE device running a V3 version:

local-user huawei privilege level 3

Set the user level of the huawei user.

#

#

-

ssh user huawei

ssh user huawei

Create an SSH user.

ssh user huawei authentication-type password

ssh user huawei authentication-type password

-

ssh user huawei service-type stelnet

ssh user huawei service-type stelnet

-

ssh server-source -i Meth0/0/0

ssh server-source -i Meth0/0/0

Specify the source interface of the SSH server (for example, use the MEth interface for out-of-band management) to restrict login and improve security.

If in-band management is used, you need to configure an in-band management interface, for example, VLANIF 4010 of a CE device running a V2 version or Loopback0 of a CE device running a V3 version.

If the device is upgraded from V200R005C20 to V200R019C10, this configuration is not required. If the device running V200R019C10 or a later version is deployed, perform this configuration.

ssh ipv6 server-source -a 2001:db8:21::16 -vpn-instance Management_out

ssh ipv6 server-source -a 2001:db8:21::17 -vpn-instance Management_out

Specify the source IP address of the SSH server to restrict login and improve security. For out-of-band management, enter the IP address of the MEth interface and specify a VPN instance. For in-band management, enter the IPv6 address of the in-band management interface (VLANIF 4010).

acl 2001

rule permit source 192.168.2.0 24

#

ssh server acl 2001

acl 2001

rule permit source 192.168.2.0 24

#

ssh server acl 2001

Configure an ACL for the SSH server to allow only clients with specified IP addresses to log in. The ACL for the SSH server also takes effect for STelnet, SFTP, and NETCONF.

snmp-agent

snmp-agent

Enable the SNMP agent.

snmp-agent sys-info version v3

snmp-agent sys-info version v3

Set the SNMP version to SNMPv3, which must be the same as the SNMP version used by the NMS.

snmp-agent mib-view included myview iso

snmp-agent mib-view included myview iso

Configure the MIB view that can be accessed by the NMS. To ensure that the NMS can manage devices normally (for example, discovering device links based on LLDP), the MIB view must contain the iso node.

snmp-agent group v3 uhmroot privacy write-view myview notify-view myview

snmp-agent group v3 uhmroot privacy write-view myview notify-view myview

-

snmp-agent usm-user v3 uhmroot group dc-admin

snmp-agent usm-user v3 uhmroot group dc-admin

Set the SNMPv3 user name to uhmroot, which must be the same as the security name on the NMS.

snmp-agent usm-user v3 uhmroot authentication-mode sha

snmp-agent usm-user v3 uhmroot authentication-mode sha

Configure the authentication mode and password for the uhmroot user, which must correspond to the authentication protocol and password on the NMS.

Myrhgl12#$

Myrhgl12#$

-

Myrhgl12#$

Myrhgl12#$

-

snmp-agent usm-user v3 uhmroot privacy-mode aes128

snmp-agent usm-user v3 uhmroot privacy-mode aes128

Set the encryption mode and password of the uhmroot user, which must correspond to the proprietary protocol and encryption password on the NMS.

Myrhgl12#$

Myrhgl12#$

-

Myrhgl12#$

Myrhgl12#$

-

acl 2002

rule permit source 192.168.3.0 24

#

snmp-agent usm-user v3 uhmroot acl 2002

acl 2002

rule permit source 192.168.3.0 24

#

snmp-agent usm-user v3 uhmroot acl 2002

Configure an ACL for SNMP users to allow only SNMP users with specified IP addresses to access the network.

#

#

-

snmp-agent trap enable

snmp-agent trap enable

Enable the trap function for all modules. By default, the trap function of some modules is disabled.

snmp-agent trap source MEth0/0/0

snmp-agent trap source MEth0/0/0

For out-of-band management, set the source interface for sending traps to MEth0/0/0.

If in-band management is used, you need to configure an in-band management interface, for example, VLANIF 4010 of a device running a V2 version or Loopback0 of a device running a V3 version.

#

#

-

snmp-agent protocol source-interface MEth0/0/0

snmp-agent protocol source-interface MEth0/0/0

Specify the source interface for SNMP to receive and respond to request packets from the NMS or controller.

If in-band management is used, you need to configure an in-band management interface, for example, VLANIF 4010 of a CE device running a V2 version or Loopback0 of a CE device running a V3 version.

If the device is upgraded from V200R005C20 to V200R019C10, this configuration is not required. If the device running V200R019C10 or a later version is deployed, perform this configuration.

#

#

-

rsa local-key-pair create

rsa local-key-pair create

Generate a local key pair.

#

#

-

user-interface vty 0 4

user-interface vty 0 4

-

authentication-mode aaa

authentication-mode aaa

-

protocol inbound ssh

protocol inbound ssh

Set the protocol type supported by VTY user interfaces to SSH.

#

#

-

stelnet server enable

stelnet server enable

Enable the STelnet service on an SSH server.

#

#

-

aaa

aaa

-

local-user client password irreversible-cipher Myrhgl@131

local-user client password irreversible-cipher Myrhgl@131

Create a user named client and set a password for the user, which must be the same as the STelnet user name and password used by the NMS.

CE device running a V2 version:

local-user client level 3

CE device running a V3 version:

local-user client privilege level 3

CE device running a V2 version:

local-user client level 3

CE device running a V3 version:

local-user client privilege level 3

Set the user level of the client user.

local-user client service-type ssh

local-user client service-type ssh

Set the access type of the client user to SSH, which must be the same as the login protocol on the NMS.

#

#

-

ssh user client

ssh user client

Create an SSH user.

ssh user client authentication-type password

ssh user client authentication-type password

Set the authentication mode of the client user to password authentication, which must be the same as that on the NMS.

ssh user client service-type stelnet

ssh user client service-type stelnet

Set the service type of the SSH user client to STelnet.

set net-manager vpn-instance Management_out (or Management_in)

set net-manager vpn-instance Management_out (or Management_in)

Set the default VPN instance for the NMS to manage devices to Management_out. For in-band management, set it to Management_in.

#

#

-

lldp enable

lldp enable

Enable LLDP.

#

#

-

vlan batch 4002 4010

vlan batch 4002 4010

Create VLANs in batches. For example, configure VLAN 4002 for forwarding storage data and VLAN 4010 for access of management interfaces on network devices and BMC interfaces on servers.

#

#

-

interface Eth-Trunk1

interface Eth-Trunk1

Deploy an independent Layer 3 interconnection link between the two leaf nodes to function as the M-LAG heartbeat link.

undo portswitch

undo portswitch

-

ip binding vpn-instance Management_in

ip binding vpn-instance Management_in

-

ip address 10.254.120.2 255.255.255.0

ip address 10.254.120.3 255.255.255.0

Configure IPv4 addresses for interconnection.

ipv6 enable

ipv6 address fc00:254:120::2/64

ipv6 enable

ipv6 address fc00:254:120::3/64

Configure IPv6 addresses for interconnection.

#

#

-

interface 10GE1/0/7

interface 10GE1/0/7

-

eth-trunk 1

eth-trunk 1

Configure the Eth-Trunk as the DAD link.

#

#

-

interface 10GE1/0/8

interface 10GE1/0/8

-

eth-trunk 1

eth-trunk 1

Configure the Eth-Trunk as the DAD link.

#

#

-

stp tc-protection

stp tc-protection

Enable TC BPDU attack defense.

stp bpdu-protection

stp bpdu-protection

Enable BPDU attack defense.

stp mode rstp

stp mode rstp

Configure the working mode as RSTP. RSTP should be configured before the V-STP mode is configured.

stp bridge-address 1-1-2

stp bridge-address 1-1-2

Configure the bridge MAC address used by the device to calculate the spanning tree. The bridge MAC addresses of the two leaf nodes in an M-LAG must be the same. It is recommended that the system MAC address of one device be used as the bridge MAC address. The bridge MAC addresses of devices in different M-LAGs are different.

stp v-stp enable

stp v-stp enable

Configure the M-LAG in V-STP mode on the leaf nodes.

#

#

-

dfs-group 1

dfs-group 1

Configure DFS.

priority 150

priority 100

Configure the DFS group priority. The default value is 100.

m-lag up-delay 240 auto-recovery interval 10

m-lag up-delay 240 auto-recovery interval 10

Configure the M-LAG member interfaces to go Up one by one at an interval of 10s after the delay.

Device running a V2 version:

source ip 10.254.120.2 vpn-instance Management_in peer 10.254.120.3

Device running a V3 version:

dual-active detection source ip 10.254.120.2 vpn-instance Management_in peer 10.254.120.3

Device running a V2 version:

source ip 10.254.120.3 vpn-instance Management_in peer 10.254.120.2

Device running a V3 version:

dual-active detection source ip 10.254.120.3 vpn-instance Management_in peer 10.254.120.2

(Either IPv4 or IPv6) Configure the IPv4 address of an independent Layer 3 interconnection interface as the source address of the DFS group and associate the address with VPN instance Management_in.

Device running a V2 version:

source ipv6 fc00:254:120::2 vpn-instance Management_in peer fc00:254:120::3

Device running a V3 version:

dual-active detection source ipv6 fc00:254:120::2 vpn-instance Management_in peer fc00:254:120::3

Device running a V2 version:

source ipv6 fc00:254:120::3 vpn-instance Management_in peer fc00:254:120::2

Device running a V3 version:

dual-active detection source ipv6 fc00:254:120::3 vpn-instance Management_in peer fc00:254:120::2

(Either IPv4 or IPv6) Configure the IPv6 address of an independent Layer 3 interconnection interface as the source address of the DFS group and associate the address with VPN instance Management_in.

Device running a V2 version:

dual-active detection enhanced enable

Device running a V2 version:

dual-active detection enhanced enable

Enable enhanced DAD for double-fault failures in an M-LAG scenario. Before enabling this function, you need to configure the interfaces on the DAD link as reserved interfaces, and set the peer IP address of the DFS group.

On a device running a V3 version, enhanced DAD for double-fault failures is enabled by default and does not need to be configured.

Device running a V2 version: N/A

Device running a V3 version:

authentication-mode hmac-sha256 password Myrhgl@1314

Device running a V2 version: N/A

Device running a V3 version:

authentication-mode hmac-sha256 password Myrhgl@1314

Configure the authentication mode and password for DFS group synchronization packets. This configuration is required only on a device running a V3 version.

#

#

-

interface Eth-Trunk0

interface Eth-Trunk0

Create an Eth-Trunk for the peer-link.

trunkport 40GE 1/0/1

trunkport 40GE 1/0/1

Deploy the peer-link on multiple links. If multiple cards are installed on the switch, the peer-link must be deployed on different cards. When the interfaces on a card are of different types, configure port speed decrease or bundle interfaces at different rates. (To bundle interfaces, run the lacp mixed-rate link enable command to forward packets after the interfaces are added to an Eth-Trunk interface in LACP mode, and run the distribute-weight command to configure the weight of load sharing for a member interface.)

trunkport 40GE 1/0/2

trunkport 40GE 1/0/2

mode lacp-static

mode lacp-static

-

peer-link 1

peer-link 1

-

port vlan exclude 1

port vlan exclude 1

Configure the interface to reject packets from VLAN 1.

#

#

-

interface Eth-Trunk1

interface Eth-Trunk1

-

m-lag unpaired-port reserved

m-lag unpaired-port reserved

Configure the interface not to enter the Error-Down state when the peer-link fails but DAD is normal.

#

interface Eth-Trunk100

interface Eth-Trunk100

Create an Eth-Trunk and configure physical interfaces.

description Linkto_Spine

description Linkto_Spine

-

trunkport 40GE 1/0/5 to 1/0/6

trunkport 40GE 1/0/5 to 1/0/6

-

port link-type trunk

port link-type trunk

-

undo port trunk allow-pass vlan 1

undo port trunk allow-pass vlan 1

Delete the Eth-Trunk interface from VLAN 1.

port trunk allow-pass vlan 4002 4010

port trunk allow-pass vlan 4002 4010

Configure the interface to allow packets from specific VLANs to pass through.

mode lacp-static

mode lacp-static

Deploy the static LACP mode.

dfs-group 1 m-lag 100

dfs-group 1 m-lag 100

Configure an M-LAG. You are advised to set the M-LAG ID to the Eth-Trunk ID.

lacp timeout fast

lacp timeout fast

-

stp disable

stp disable

Disable the STP function to speed up network convergence. Perform the same configuration on the peer interface.

Enabling the STP function will increase the convergence time by 1s to 2s.

Enable STP on interfaces where no service is deployed.

#

#

-

port-group group-member 10ge 1/0/1 to 10ge 1/0/18

port-group group-member 10ge 1/0/1 to 10ge 1/0/18

Create a temporary port group and add the unused physical interfaces to the port group.

shutdown

shutdown

Shut down the interfaces.

stp instance 0 cost 10000

stp instance 0 cost 10000

Increase the STP cost.

port link-type trunk

port link-type trunk

-

undo port trunk allow-pass vlan 1

undo port trunk allow-pass vlan 1

Delete the Eth-Trunk interface from VLAN 1.

#

#

-

port-group group-member 40ge 1/0/1 to 40ge 1/0/6

port-group group-member 40ge 1/0/1 to 40ge 1/0/6

Create a temporary port group. CRC needs to be performed for all interfaces.

trap-threshold crc-statistics 100 interval 10

trap-threshold crc-statistics 100 interval 10

Set the alarm threshold of CRC error packets to 100 and the alarm interval to 10s.

port crc-statistics trigger error-down

port crc-statistics trigger error-down

Configure the interface to enter the Error-Down state when the number of received CRC error packets exceeds the threshold. In this way, services can be switched to the backup link in a timely manner, ensuring reliable data transmission.

#

#

-

vlan 1

storm suppression multicast cir 64 kbps

storm suppression broadcast cir 64 kbps

storm suppression unknown-unicast cir 64 kbps

#

vlan 1

storm suppression multicast cir 64 kbps

storm suppression broadcast cir 64 kbps

storm suppression unknown-unicast cir 64 kbps

#

Configure traffic suppression in VLAN 1 to prevent broadcast storms.