Example for Configuring IP Address-based Microsegmentation

CloudEngine 12800 and 12800E V200R005C10 Configuration Guide - Security

This document describes the configurations of Security, including AAA, 802.1x Authentication, ACL, TCAM ACL Customization, local attack defense, Microsegmentation, MFF, attack defense, traffic suppression and storm control, ARP security, Port security, MACsec, DHCP snooping, IPSG, URPF, SSL, Keychain and FIPS.

About This Document
AAA Configuration
- Overview of AAA
- Understanding AAA
- Application Scenarios for AAA
- Licensing Requirements and Limitations for AAA
- Summary of AAA Configuration Tasks
- Configuring Local Authentication and Authorization
- Configuring RADIUS AAA
- Configuring HWTACACS AAA
- Clearing AAA Statistics
- Configuration Examples for AAA
  - Example for Configuring RADIUS Authentication and Accounting
  - Example for Configuring HWTACACS Authentication, Accounting, and Authorization
- Troubleshooting AAA
  - An AAA Local User Cannot Be Created Due to Incorrect Password Setting
802.1x Authentication Configuration
- Understanding 802.1x Authentication
- Application Scenarios for 802.1x Authentication
- Licensing Requirements and Limitations for 802.1x Authentication
- Default Settings for 802.1x Authentication
- Configuring 802.1x Authentication
- Maintaining 802.1x Authentication
  - Clearing Statistics on 802.1x Authentication Packets
  - Forcing Users Offline
- Configuration Examples for 802.1x Authentication
  - Example for Configuring 802.1x Authentication to Control Users' Internal Access
ACL Configuration
- Overview of ACLs
- Understanding ACLs
- Application Scenarios for ACLs
- Licensing Requirements and Limitations for ACLs
- Default Settings for ACLs
- Configuring a Basic ACL
- Configuring an Advanced ACL
- Configuring a Layer 2 ACL
- Configuring a User-defined ACL
- Configuring an ARP-based ACL
- Configuring a Basic ACL6
- Configuring an Advanced ACL6
- Maintaining an ACL
  - Clearing ACL Statistics
  - Checking ACL Resource Usages
- Configuration Examples for ACLs
- ACL FAQ
  - Which Packets Cannot Be Filtered by the ACL Used by a Traffic Policy?
TCAM ACL Customization Configuration
- Overview of TCAM ACL Customization
- Licensing Requirements and Limitations for TCAM ACL Customization
- Configuring TCAM ACL Customization
  - Enabling TCAM ACL Customization
  - Configuring the TCAM ACL Customization Function for Services
- Displaying Information about a TCAM ACL Customization Profile or Preset Profile
- Configuration Examples for TCAM ACL Customization
  - Example for Configuring TCAM ACL Customization
Microsegmentation Configuration
- Overview of Microsegmentation
- Understanding Microsegmentation
- Application Scenarios for Microsegmentation
- Licensing Requirements and Limitations for Microsegmentation
- Configuring Microsegmentation
- Maintaining Microsegmentation
  - Checking Microsegmentation Statistics
  - Clearing Microsegmentation Statistics
- Configuration Examples for Microsegmentation
  - Example for Configuring IP Address-based Microsegmentation
Local Attack Defense Configuration
- Overview of Local Attack Defense
- Licensing Requirements and Limitations for Local Attack Defense
- Default Settings for Local Attack Defense
- Configuring CPU Attack Defense
- Configuring Attack Source Tracing
- Maintaining Local Attack Defense
- Configuration Examples for Local Attack Defense
  - Example for Configuring Local Attack Defense
- Troubleshooting Local Attack Defense
MFF Configuration
- Overview of MFF
- Understanding MFF
- Application Scenarios for MFF
- Licensing Requirements and Limitations for MFF
- Configuring MFF
- Configuration Examples for MFF
  - Example for Configuring MFF to Implement Layer 2 Isolation and Layer 3 Connection
- Troubleshooting MFF
  - Users Fail to Access the Internet After MFF Is Configured
Attack Defense Configuration
- Overview of Attack Defense
- Understanding Attack Defense
- Application Scenarios for Attack Defense
- Licensing Requirements and Limitations for Attack Defense
- Default Settings for Attack Defense
- Configuring Defense Against Malformed Packet Attacks
- Configuring Defense Against Packet Fragment Attacks
- Configuring Defense Against Flood Attacks
- Clearing Attack Defense Statistics
- Configuration Examples for Attack Defense
  - Example for Configuring Attack Defense
Traffic Suppression and Storm Control Configuration
- Overview of Traffic Suppression and Storm Control
- Understanding Traffic Suppression and Storm Control
  - Traffic Suppression
  - Storm Control
- Application Scenarios for Traffic Suppression and Storm Control
  - Traffic Suppression
  - Storm Control
- Licensing Requirements and Limitations for Traffic Suppression and Storm Control
- Default Settings for Traffic Suppression and Storm Control
- Configuring Traffic Suppression
- Configuring Storm Control
- Configuration Examples for Traffic Suppression and Storm Control
  - Example for Configuring Traffic Suppression
  - Example for Configuring Storm Control
ARP Security Configuration
- Overview of ARP Security
- Understanding ARP Security
- Application Scenarios for ARP Security
  - Defense Against ARP Flood Attacks
  - Defense Against ARP Spoofing Attacks
- Licensing Requirements and Limitations for ARP Security
- Default Settings for ARP Security
- Configuring Defense Against ARP Flood Attacks
- Configuring Defense Against ARP Spoofing Attacks
- Maintaining ARP Security
- Configuration Examples for ARP Security
  - Example for Configuring ARP Security Functions
  - Example for Configuring Defense Against ARP MITM Attacks
Port Security Configuration
- Overview of Port Security
- Understanding Port Security
- Application Scenarios for Port Security
- Licensing Requirements and Limitations for Port Security
- Default Settings for Port Security
- Configuring Port Security
- Configuration Examples for Port Security
  - Example for Configuring Port Security
MACsec Configuration
- Overview of MACsec
- Understanding MACsec
- Application Scenarios for MACsec
- Default Configuration
- Licensing Requirements and Limitations for MACsec
- Configuring MACsec
- Maintaining MACsec
  - Displaying MACsec Statistics
  - Clearing MACsec Statistics
- Configuration Examples for MACsec
  - Example for Configuring Point-to-Point MACsec
DHCP Snooping Configuration
- Overview of DHCP Snooping
- Understanding DHCP Snooping
  - DHCP Snooping Fundamentals
  - Option 82 Supported by DHCP Snooping
- Application Scenarios for DHCP Snooping
- Licensing Requirements and Limitations for DHCP Snooping
- Default Settings for DHCP Snooping
- Configuring Basic Functions of DHCP Snooping
- Configuring DHCP Snooping Attack Defense
- Inserting the Option 82 Field in a DHCP Message
- Maintaining DHCP Snooping
- Configuration Examples for DHCP Snooping
  - Example for Configuring DHCP Snooping Attack Defense
- Troubleshooting DHCP Snooping
  - DHCP Clients Cannot Go Online Due to DHCP Snooping
IPSG Configuration
- Overview of IPSG
- Licensing Requirements and Limitations for IPSG
- Default Settings for IPSG
- Configuring IPSG
- Maintaining IPSG
  - Checking Statistics on Discarded IP Packets
  - Clearing Statistics on Discarded IP Packets
- Configuration Examples for IPSG
  - Example for Configuring IPSG to Check Interface + IP + MAC Binding Entries
URPF Configuration
- Overview of URPF
- Understanding URPF
- Application Scenarios for URPF
- Licensing Requirements and Limitations for URPF
- Default Settings for URPF
- Configuring URPF
- Configuration Examples for URPF
  - Example for Configuring URPF (CE12800)
  - Example for Configuring URPF (CE12800E)
SSL Configuration
- Overview of SSL
- Understanding SSL
- Application Scenarios for SSL
  - Application of SSL in Information Center
- Licensing Requirements and Limitations for SSL
- Configuring SSL
  - Configuring an SSL Policy
  - Applying an SSL Policy
- Configuration Examples for SSL
  - Example for Outputting SSL-Encrypted Logs to a Log Host
Keychain Configuration
- Overview of Keychains
- Understanding Keychains
- Application Scenarios for Keychains
- Licensing Requirements and Limitations for Keychain
- Configuring a Keychain
- Configuration Examples for Keychains
  - Example for Applying the Keychain to RIP
  - Example for Applying the Keychain to BGP
FIPS Configuration
- Overview of FIPS
- Configuring the FIPS Mode
Separating the Management Port from the Service Plane
Checking Security Risks
Setting the System Master Key

Rate and give feedback:

Huawei uses machine translation combined with human proofreading to translate this document to different languages in order to help you better understand the content of this document. Note: Even the most advanced machine translation cannot match the quality of professional translators. Huawei shall not bear any responsibility for translation accuracy and it is recommended that you refer to the English document (a link for which has been provided).

Example for Configuring IP Address-based Microsegmentation

Networking Requirements

On a distributed VXLAN gateway network (BGP EVPN) shown in Figure 5-5, the physical server, database server, VM1, and VM2 are deployed in the data center. The requirements on the communication between them are as follows:

The physical server, VM1, and VM2 can access the database server.
VM1 and VM2 cannot communicate with the physical server.
VM1 and VM2 can communicate with each other.

Figure 5-5 Network diagram for configuring IP address-based microsegmentation

Table 5-2 Interface IP addresses

Device	Interface	IP Address
SwitchA	10GE1/0/1	192.168.2.1/24
SwitchA	LoopBack0	2.2.2.2/32
SwitchB	10GE1/0/1	192.168.3.1/24
SwitchB	LoopBack0	1.1.1.1/32
SwitchC	10GE1/0/1	192.168.2.2/24
	10GE1/0/2	192.168.3.2/24
	LoopBack0	3.3.3.3/32

Configuration Roadmap

The configuration roadmap is as follows:

Enable microsegmentation.
Configure a default microsegmentation policy.
Configure EPGs and specify GBPs.

Procedure

Configure the VXLAN. For details, see configuration files.
Enable microsegmentation.
# Configure SwitchA. The configuration of SwitchB is similar to the configuration of SwitchA, and is not mentioned here.
```
<HUAWEI> system-view
[~HUAWEI] sysname SwitchA
[*HUAWEI] commit
[~SwitchA] traffic-segment enable
[*SwitchA] commit
```

Configure a default microsegmentation policy.

# Configure SwitchA. The configuration of SwitchB is similar to the configuration of SwitchA, and is not mentioned here.

[~SwitchA] traffic-segment unknown-segment permit    //Configure the default access control policy for unknown EPG members. By default, the permit policy is used.
[~SwitchA] traffic-segment default-policy deny       //Configure the default access control policy for EPG members. By default, the deny policy is used.
[~SwitchA] traffic-segment same-segment permit       //Configure the default access control policy for members in an EPG. By default, the none policy is used.
[*SwitchA] commit

Configure EPGs and specify GBPs.

# On SwitchA, add VM1 and VM2 to EPG1. The configuration of SwitchB is similar to the configuration of SwitchA, and is not mentioned here.

[~SwitchA] traffic-segment segment-id 32768 segment-name EPG1
[*SwitchA-traffic-segment-32768] segment-member ip 192.168.10.1 32 vpn-instance vpn1
[*SwitchA-traffic-segment-32768] segment-member ip 192.168.20.1 32 vpn-instance vpn1
[*SwitchA-traffic-segment-32768] quit
[*SwitchA] commit

# On SwitchA, specify GBPs. The configuration of SwitchB is similar to the configuration of SwitchA, and is not mentioned here.

[~SwitchA] segment classifier EPG1-EPG3    //Configure matching rules for traffic transmitted between EPG1 and EPG3.
[*SwitchA-segmentclassifier-EPG1-EPG3] rule permit source-segment 32768 destination-segment 32770
[*SwitchA-segmentclassifier-EPG1-EPG3] rule permit source-segment 32770 destination-segment 32768
[*SwitchA-segmentclassifier-EPG1-EPG3] quit
[*SwitchA] commit
[~SwitchA] segment classifier EPG2-EPG3    //Configure matching rules for traffic transmitted between EPG2 and EPG3.
[*SwitchA-segmentclassifier-EPG2-EPG3] rule permit source-segment 32769 destination-segment 32770
[*SwitchA-segmentclassifier-EPG2-EPG3] rule permit source-segment 32770 destination-segment 32769
[*SwitchA-segmentclassifier-EPG2-EPG3] quit
[*SwitchA] commit
[~SwitchA] segment behavior EPG1-EPG3    //Configure behaviors for traffic transmitted between EPG1 and EPG3.
[*SwitchA-segmentbehavior-EPG1-EPG3] quit
[*SwitchA] commit
[~SwitchA] segment behavior EPG2-EPG3    //Configure behaviors for traffic transmitted between EPG2 and EPG3.
[*SwitchA-segmentbehavior-EPG2-EPG3] quit
[*SwitchA] commit
[~SwitchA] segment policy GBP    //Configure and apply a policy for traffic between EPGs.
[*SwitchA-segmentpolicy-GBP] classifier EPG1-EPG3 behavior EPG1-EPG3
[*SwitchA-segmentpolicy-GBP] classifier EPG2-EPG3 behavior EPG2-EPG3
[*SwitchA-segmentpolicy-GBP] quit
[*SwitchA] commit

Verify the configuration.

# Run the display traffic-segment configured-information command on SwitchA to check the EPG configuration.

[~SwitchA] display traffic-segment configured-information
------------------------------------------------------------------------------                                                      
 Segment-Id          Segment-Name          Segment-Type          MemberNum                                                          
------------------------------------------------------------------------------                                                      
      32768          EPG1                  IPv4                          2                                                          
------------------------------------------------------------------------------                                                      
 Total:1 Segment,2 Member.                                                                                                          
------------------------------------------------------------------------------

After the configuration, the following functions can be implemented:

The physical server, VM1, and VM2 can access the database server.
VM1 and VM2 cannot communicate with the physical server.
VM1 and VM2 can communicate with each other.

Configuration Files

SwitchA configuration file

#
sysname SwitchA
#
evpn-overlay enable
#
traffic-segment same-segment permit
#
traffic-segment segment-id 32768 segment-name EPG1                                                                                   
 segment-member ip 192.168.10.1 255.255.255.255 vpn-instance vpn1                                                                   
 segment-member ip 192.168.20.1 255.255.255.255 vpn-instance vpn1                                                                   
#
segment classifier EPG1-EPG3                                                                                                        
 rule permit source-segment 32768 destination-segment 32770                                                                         
 rule permit source-segment 32770 destination-segment 32768                                                                         
#                                                                                                                                   
segment classifier EPG2-EPG3                                                                                                        
 rule permit source-segment 32769 destination-segment 32770                                                                         
 rule permit source-segment 32770 destination-segment 32769                                                                         
#                                                                                                                                   
segment behavior EPG1-EPG3                                                                                                          
#                                                                                                                                   
segment behavior EPG2-EPG3                                                                                                          
#                                                                                                                                   
segment policy GBP                                                                                                                  
 classifier EPG1-EPG3 behavior EPG1-EPG3 precedence 3                                                                               
 classifier EPG2-EPG3 behavior EPG2-EPG3 precedence 6                                                                               
#
traffic-segment enable
#
ip vpn-instance vpn1
 ipv4-family
  route-distinguisher 11:11
  vpn-target 1:1 export-extcommunity
  vpn-target 11:1 export-extcommunity evpn
  vpn-target 1:1 import-extcommunity
  vpn-target 11:1 import-extcommunity evpn
 vxlan vni 5010
#
bridge-domain 10
 vxlan vni 10
 evpn 
  route-distinguisher 10:1
  vpn-target 10:1 export-extcommunity
  vpn-target 11:1 export-extcommunity
  vpn-target 10:1 import-extcommunity
#
bridge-domain 20
 vxlan vni 20
 evpn 
  route-distinguisher 20:1
  vpn-target 20:1 export-extcommunity
  vpn-target 11:1 export-extcommunity
  vpn-target 20:1 import-extcommunity
#
interface Vbdif10
 ip binding vpn-instance vpn1
 ip address 192.168.10.2 255.255.255.0
 vxlan anycast-gateway enable
 arp collect host enable
#
interface Vbdif20
 ip binding vpn-instance vpn1
 ip address 192.168.20.2 255.255.255.0
 vxlan anycast-gateway enable
 arp collect host enable
#
interface 10GE1/0/1
 undo portswitch
 ip address 192.168.2.1 255.255.255.0
#
interface 10GE1/0/2.1 mode l2
 encapsulation dot1q vid 10
 bridge-domain 10
#
interface 10GE1/0/3.1 mode l2
 encapsulation dot1q vid 20
 bridge-domain 20
#
interface LoopBack0
 ip address 2.2.2.2 255.255.255.255
#
interface Nve1
 source 2.2.2.2
 vni 10 head-end peer-list protocol bgp
 vni 20 head-end peer-list protocol bgp
#
bgp 200
 peer 192.168.2.2 as-number 100
 #
 ipv4-family unicast
  network 2.2.2.2 255.255.255.255
  peer 192.168.2.2 enable
#
bgp 100 instance evpn1
 peer 3.3.3.3 as-number 100
 peer 3.3.3.3 connect-interface LoopBack0
 #
 l2vpn-family evpn
  policy vpn-target
  peer 3.3.3.3 enable
  peer 3.3.3.3 advertise irb
#
return

SwitchB configuration file

#
sysname SwitchB
#
evpn-overlay enable
#
traffic-segment same-segment permit
#
traffic-segment segment-id 32769 segment-name EPG2                                                                                   
 segment-member ip 192.168.30.1 255.255.255.255 vpn-instance vpn1                                                                   
#                                                                                                                                   
traffic-segment segment-id 32770 segment-name EPG3                                                                                   
 segment-member ip 192.168.40.1 255.255.255.255 vpn-instance vpn1
#
segment classifier EPG1-EPG3                                                                                                        
 rule permit source-segment 32768 destination-segment 32770                                                                         
 rule permit source-segment 32770 destination-segment 32768                                                                         
#                                                                                                                                   
segment classifier EPG2-EPG3                                                                                                        
 rule permit source-segment 32769 destination-segment 32770                                                                         
 rule permit source-segment 32770 destination-segment 32769                                                                         
#                                                                                                                                   
segment behavior EPG1-EPG3                                                                                                          
#                                                                                                                                   
segment behavior EPG2-EPG3                                                                                                          
#                                                                                                                                   
segment policy GBP                                                                                                                  
 classifier EPG1-EPG3 behavior EPG1-EPG3 precedence 3                                                                               
 classifier EPG2-EPG3 behavior EPG2-EPG3 precedence 6                                                                               
#
traffic-segment enable
#
ip vpn-instance vpn1
 ipv4-family
  route-distinguisher 22:22
  vpn-target 2:2 export-extcommunity
  vpn-target 11:1 export-extcommunity evpn
  vpn-target 2:2 import-extcommunity
  vpn-target 11:1 import-extcommunity evpn
 vxlan vni 5010
#
bridge-domain 30
 vxlan vni 30
 evpn 
  route-distinguisher 30:1
  vpn-target 30:1 export-extcommunity
  vpn-target 11:1 export-extcommunity
  vpn-target 30:1 import-extcommunity
#
bridge-domain 40
 vxlan vni 40
 evpn 
  route-distinguisher 40:1
  vpn-target 40:1 export-extcommunity
  vpn-target 11:1 export-extcommunity
  vpn-target 40:1 import-extcommunity
#
interface Vbdif30
 ip binding vpn-instance vpn1
 ip address 192.168.30.2 255.255.255.0
 vxlan anycast-gateway enable
 arp collect host enable
#
interface Vbdif40
 ip binding vpn-instance vpn1
 ip address 192.168.40.2 255.255.255.0
 vxlan anycast-gateway enable
 arp collect host enable
#
interface 10GE1/0/1
 undo portswitch
 ip address 192.168.3.1 255.255.255.0
#
interface 10GE1/0/2.1 mode l2
 encapsulation dot1q vid 30
 bridge-domain 30
#
interface 10GE1/0/3.1 mode l2
 encapsulation dot1q vid 40
 bridge-domain 40
#
interface LoopBack0
 ip address 1.1.1.1 255.255.255.255
#
interface Nve1
 source 1.1.1.1
 vni 30 head-end peer-list protocol bgp
 vni 40 head-end peer-list protocol bgp
#
bgp 300
 peer 192.168.3.2 as-number 100
 #
 ipv4-family unicast
  network 1.1.1.1 255.255.255.255
  peer 192.168.3.2 enable
#
bgp 100 instance evpn1
 peer 3.3.3.3 as-number 100
 peer 3.3.3.3 connect-interface LoopBack0
 #
 l2vpn-family evpn
  policy vpn-target
  peer 3.3.3.3 enable
  peer 3.3.3.3 advertise irb
#
return

SwitchC configuration file

#
sysname SwitchC
#
evpn-overlay enable
#
interface 10GE1/0/1
 undo portswitch
 ip address 192.168.2.2 255.255.255.0
#
interface 10GE1/0/2
 undo portswitch
 ip address 192.168.3.2 255.255.255.0
#
interface LoopBack0
 ip address 3.3.3.3 255.255.255.255
#
bgp 100
 peer 192.168.2.1 as-number 200
 peer 192.168.3.1 as-number 300
 #
 ipv4-family unicast
  network 3.3.3.3 255.255.255.255
  peer 192.168.2.1 enable
  peer 192.168.3.1 enable
#
bgp 100 instance evpn1
 peer 2.2.2.2 as-number 100
 peer 2.2.2.2 connect-interface LoopBack0
 peer 1.1.1.1 as-number 100
 peer 1.1.1.1 connect-interface LoopBack0
 #
 l2vpn-family evpn
  undo policy vpn-target
  peer 2.2.2.2 enable
  peer 2.2.2.2 advertise irb
  peer 2.2.2.2 reflect-client
  peer 1.1.1.1 enable
  peer 1.1.1.1 advertise irb
  peer 1.1.1.1 reflect-client
#
return

Translation

简体中文

Download

Updated: 2021-09-17

Document ID: EDOC1100075347

Downloads: 100

Average rating:

This Document Applies to these Products

Related Version

Digital Signature File

Digital Signature Authentication Mode

Enterprise

Huawei Cloud

Carrier

Consumer

Corporate