No relevant resource is found in the selected language.

This site uses cookies. By continuing to browse the site you are agreeing to our use of cookies. Read our privacy policy>Search

Reminder

To have a better experience, please upgrade your IE browser.

upgrade

S2700, S3700, S5700, S6700, S7700, and S9700 Series Switches Typical Configuration Examples

This document provides examples for configuring features in typical usage scenarios.
Rate and give feedback:
Huawei uses machine translation combined with human proofreading to translate this document to different languages in order to help you better understand the content of this document. Note: Even the most advanced machine translation cannot match the quality of professional translators. Huawei shall not bear any responsibility for translation accuracy and it is recommended that you refer to the English document (a link for which has been provided).
Example for Configuring IPSG to Prevent Hosts with Static IP Addresses from Changing Their Own IP Addresses

Example for Configuring IPSG to Prevent Hosts with Static IP Addresses from Changing Their Own IP Addresses

IPSG Overview

As shown in Figure 15-13, a hacker (Host_2) uses the IP and MAC addresses of Host_1, which belongs to an R&D engineer, to construct IP packets to attack the intranet. The network administrator thinks the R&D engineer is the attacker. Such attacks can be prevented by configuring IPSG. On the access switch, after a static binding table is configured and IP packet check is enabled on the interfaces connected to terminals, only the packets matching the static binding entries can access the intranet and the Internet, and the packets not matching the entries are discarded.

Configuration Notes

This example applies to all versions and models except the following:
  • S2700SI of V100R006C05 does not support IPSG.
  • After hardware-based Layer 3 forwarding for IPv4 packets is enabled in the following versions, the switches do not support IPSG:
    • V200R007C00, V200R008C00, V200R011 and later versions: S2750EI, S5700-10P-LI-AC, and S5700-10P-PWR-LI-AC
    • V200R009C00 and V200R010C00: S2720EI, S2750EI, S5700-10P-LI-AC, and S5700-10P-PWR-LI-AC

Networking Requirements

As shown in Figure 15-13, the user gateway is configured on the core switch (Core). An ACL is configured on the Core to allow fixed hosts to access the Internet. The hosts connected to the access switch (ACC) use statically configured IP addresses. The administrator requires that the hosts can only use fixed IP addresses to access the Internet. Users are not allowed to change their own IP addresses to access the Internet.

Figure 15-13  Configuring IPSG to prevent hosts with static IP addresses from changing their own IP addresses

Data Plan

To perform the configuration, you need to the following data.

Table 15-6  Data Plan

Item

Data

Description

VLAN

  • ACC:

    VLAN ID: 10, including interfaces GE0/0/1, GE0/0/2, and GE0/0/3

  • Core:

    VLAN ID: 10, including interface GE0/0/1

None

Gateway IP address of hosts

VLANIF10: 10.0.0.1/24

None

IP addresses of the hosts allowed to access the network.

10.0.0.2, 10.0.0.3

None

Configuration Roadmap

The configuration roadmap is as follows:

  1. Configure an ACL on the user gateway (Core) to allow the hosts with IP addresses 10.0.0.2 and 10.0.0.3 to access the Internet.
  2. Create static binding entries for the hosts on the ACC to fix the mappings between IP addresses and MAC addresses.
  3. Enable IPSG on the ACC's interfaces connected to user hosts so that the hosts can only use the fixed IP addresses to access the network. Host_1 can access the Internet, and Host_2 cannot access the Internet, even if it changes its IP address.

Procedure

  1. Configure an ACL.

    <HUAWEI> system-view
    [HUAWEI] sysname Core
    [Core] vlan batch 10
    [Core] interface gigabitethernet 0/0/1 
    [Core-GigabitEthernet0/0/1] port link-type trunk
    [Core-GigabitEthernet0/0/1] port trunk allow-pass vlan 10
    [Core-GigabitEthernet0/0/1] quit
    [Core] interface vlanif 10   //Configure the gateway address.
    [Core-Vlanif10] ip address 10.0.0.1 255.255.255.0
    [Core-Vlanif10] quit
    [Core] acl number 3001   //Configure an ACL.
    [Core-acl-adv-3001] rule permit ip source 10.0.0.2 0
    [Core-acl-adv-3001] rule permit ip source 10.0.0.3 0
    [Core-acl-adv-3001] rule deny ip source 10.0.0.0 0.0.0.255
    [Core-acl-adv-3001] quit
    [Core] traffic classifier c1   //Configure an ACL-based traffic classifier.
    [Core-classifier-c1] if-match acl 3001
    [Core-classifier-c1] quit
    [Core] traffic behavior b1   //Configure a traffic behavior.
    [Core-behavior-b1] permit
    [Core-behavior-b1] quit
    [Core] traffic policy p1   //Configure a traffic policy.
    [Core-trafficpolicy-p1] classifier c1 behavior b1
    [Core-trafficpolicy-p1] quit
    [Core] interface gigabitethernet 0/0/2
    [Core-GigabitEthernet0/0/2] traffic-policy p1 outbound   //Apply the traffic policy.
    [Core-GigabitEthernet0/0/2] quit

  2. Create static binding entries for the hosts.

    <HUAWEI> system-view
    [HUAWEI] sysname ACC
    [ACC] vlan batch 10   //Configure a VLAN to connect to hosts.
    [ACC] interface gigabitethernet 0/0/1 
    [ACC-GigabitEthernet0/0/1] port link-type access
    [ACC-GigabitEthernet0/0/1] port default vlan 10
    [ACC-GigabitEthernet0/0/1] quit
    [ACC] interface gigabitethernet 0/0/2 
    [ACC-GigabitEthernet0/0/2] port link-type access
    [ACC-GigabitEthernet0/0/2] port default vlan 10
    [ACC-GigabitEthernet0/0/2] quit
    [ACC] interface gigabitethernet 0/0/3 
    [ACC-GigabitEthernet0/0/3] port link-type trunk
    [ACC-GigabitEthernet0/0/3] port trunk allow-pass vlan 10
    [ACC-GigabitEthernet0/0/3] quit
    [ACC] user-bind static ip-address 10.0.0.2 mac-address 0002-0002-0002 interface gigabitethernet 0/0/1   //Create a static binding entry for Host_1.
    [ACC] user-bind static ip-address 10.0.0.5 mac-address 0005-0005-0005 interface gigabitethernet 0/0/2   //Create a static binding entry for Host_2.
    

  3. Enable IPSG.

    # Enable IPSG on GE0/0/1 connected to Host_1.

    [ACC] interface gigabitethernet 0/0/1
    [ACC-GigabitEthernet0/0/1] ip source check user-bind enable
    [ACC-GigabitEthernet0/0/1] quit

    # Enable IPSG on GE0/0/2 connected to Host_2.

    [ACC] interface gigabitethernet 0/0/2
    [ACC-GigabitEthernet0/0/2] ip source check user-bind enable
    [ACC-GigabitEthernet0/0/2] quit

  4. Verify the configuration.

    Run the display dhcp static user-bind all command on the ACC to view static binding entries.

    [ACC] display dhcp static user-bind all
    DHCP static Bind-table:                                                         
    Flags:O - outer vlan ,I - inner vlan ,P - Vlan-mapping                          
    IP Address                      MAC Address     VSI/VLAN(O/I/P) Interface       
    --------------------------------------------------------------------------------
    10.0.0.2                        0002-0002-0002  --  /--  /--    GE0/0/1
    10.0.0.5                        0005-0005-0005  --  /--  /--    GE0/0/2
    --------------------------------------------------------------------------------
    Print count:           2          Total count:           2           

    Run the display dhcp static user-bind all verbose command on the ACC to view IPSG status. If the status is effective, the static entry has taken effect.

    [ACC] display dhcp static user-bind all verbose
    DHCP static Bind-table:                                                         
    Flags:O - outer vlan ,I - inner vlan ,P - Vlan-mapping                          
    --------------------------------------------------------------------------------
     IP Address  : 10.0.0.2                                                         
     MAC Address : 0002-0002-0002                                                   
     VSI         : --                                                               
     VLAN(O/I/P) : --  /--  /--                                                     
     Interface   : GE0/0/1
     IPSG Status : effective   slot: <0>                                            
    --------------------------------------------------------------------------------
     IP Address  : 10.0.0.5                                                         
     MAC Address : 0005-0005-0005                                                   
     VSI         : --                                                               
     VLAN(O/I/P) : --  /--  /--                                                     
     Interface   : GE0/0/2
     IPSG Status : effective   slot: <0>                                            
    --------------------------------------------------------------------------------
    Print count:           2          Total count:           2                      

    Host_1 can access the Internet, and Host_2 cannot access the Internet. After the IP address of Host_2 is changed to 10.0.0.3, Host_2 cannot access the Internet and the intranet.

Configuration Files

  • Configuration file of the Core

    #
    sysname Core
    #
    vlan batch 10
    #
    acl number 3001
     rule 5 permit ip source 10.0.0.2 0
     rule 10 permit ip source 10.0.0.3 0
     rule 15 deny ip source 10.0.0.0 0.0.0.255
    #
    traffic classifier c1 operator or precedence 5
     if-match acl 3001
    #
    traffic behavior b1
     permit
    #
    traffic policy p1 match-order config
     classifier c1 behavior b1
    #
    interface Vlanif10
     ip address 10.0.0.1 255.255.255.0
    #
    interface GigabitEthernet0/0/1
     port link-type trunk
     port trunk allow-pass vlan 10
    #
    interface GigabitEthernet0/0/2
     traffic-policy p1 outbound
    #
    return
  • Configuration file of the ACC

    #
    sysname ACC
    #
    vlan batch 10
    # 
    user-bind static ip-address 10.0.0.2 mac-address 0002-0002-0002 interface GigabitEthernet0/0/1
    user-bind static ip-address 10.0.0.5 mac-address 0005-0005-0005 interface GigabitEthernet0/0/2
    #
    interface GigabitEthernet0/0/1
     port link-type access
     port default vlan 10
     ip source check user-bind enable 
    #
    interface GigabitEthernet0/0/2
     port link-type access
     port default vlan 10
     ip source check user-bind enable
    #
    interface GigabitEthernet0/0/3
     port link-type trunk
     port trunk allow-pass vlan 10
    #
    return

Related Content

Videos

Bind IP and MAC Addresses

Download
Updated: 2019-04-20

Document ID: EDOC1000069520

Views: 658007

Downloads: 29810

Average rating:
This Document Applies to these Products
Related Documents
Related Version
Share
Previous Next