Service Configuration Supported on an AS

Configure the SVF forwarding mode.

An SVF system supports two forwarding modes: centralized forwarding and distributed forwarding.

• In centralized forwarding mode, traffic forwarded by the local AS and forwarded between ASs is sent to the parent for forwarding.

• In distributed forwarding mode, an AS directly forwards local traffic and the parent forwards traffic between ASs.

By default, the forwarding mode of an SVF system is distributed forwarding.

Configure the URL encoding function for an AS (This function is supported in V200R009 and later versions).

To improve web application security, data from untrustworthy sources must be encoded before being sent to clients. URL encoding is most commonly used in web applications. After URL encoding is enabled for ASs, special characters in redirect URLs are converted to secure formats, preventing clients from mistaking them for syntax signs or instructions and unexpectedly modifying the original syntax. In this way, cross-site scripting attacks and injection attacks are prevented. By default, URL encoding is enabled in ASs. This function can be disabled using the portal url-encode disable command.

Configure authentication-free rules.

In addition to the configurations in service profiles, the parent delivers the configured Portal authentication-free rules to ASs. Authentication-free rules 0 to 127 can be delivered to ASs of the S5720-EI model; authentication-free rules 0 to 31 can be delivered to ASs of other models; authentication-free rules outside the two ranges will not be delivered to ASs.

Enable IGMP snooping for a service VLAN on an AS (This function is supported in V200R010 and later versions).

By default, IGMP snooping is disabled for service VLANs on an AS.

Enable the function of retaining the authentication configuration after an AS goes offline. (This function is supported in V200R019 and later versions.)

By default, the authentication configuration is cleared after an AS goes offline.

Device management

Administrator

User name and password of the local administrator

Traffic policing

Rate limit for outgoing ARP and DHCP packets on an uplink fabric port

BPDU protection

BPDU protection on ASs (supported only in V200R013C00 and later versions)

Basic network service

VLAN management

Addition and removal of ports to or from a VLAN

Configuration of the port that connects an AS to an AP

Voice VLAN based on LLDP or CDP negotiation

Enhanced network service

Basic QoS

Trust 802.1p (This function is not supported in V200R011C10 and later versions)

Traffic suppression

Broadcast, multicast, and unknown unicast traffic suppression on a port

Rate limiting

Port rate limiting

STP

STP edge port

Port security

(supported only in V200R019C00 and later versions)

Port security, aging time of secure dynamic MAC addresses, and sticky MAC.

Access security

DHCP snooping, IPSG, and DAI

MAC management

(supported only in V200R013C00 and later versions)

Action taken on an interface in case of MAC address flapping

Alarm function for MAC address learning and aging

Access service

Access authentication

• 802.1X authentication, MAC address authentication, and Portal authentication
• Access control over IPv6 users and single-stack authentication (supported in V200R019 and later versions)

Access control

MAC address limiting

Maximum number of access users on an AS port (This function is supported in V200R010 and later versions)

Traffic policing

Rate limit for incoming ARP and DHCP packets on an AS port

QoS service

(supported only in V200R013C00 and later versions)

Priority mapping

To configure priority mapping based on DSCP priorities, run the trust dscp command.

Queue scheduling mode

To configure a queue scheduling mode, run the qos { pq | wrr | drr } command.

Queue scheduling weight

To configure a queue scheduling weight, run the qos queue command.

Traffic policy services

(supported only in V200R019C00 and later versions)

Packet re-marking

To configure the packet re-marking rule and information, run the policy command.

Energy-saving management

port-auto-sleep enable

Interface view

Enables the port sleeping function on an electrical interface.

This command can be used on electrical interfaces (excluding MultiGE interfaces) and combo interfaces working as electrical interfaces.

PoE

poe force-power

Interface view

Enables forcible PoE power supply on an interface.

-

poe legacy enable

Interface view

Enables an interface to check compatibility of PDs.

-

poe priority { critical | high | low }

Interface view

Sets the power supply priority of a PoE interface.

-

poe af-inrush enable slot slot-id

System view

Configures the IEEE 802.3at-compliant device to provide power in accordance with IEEE 802.3af.

-

poe high-inrush enable slot slot-id

System view

Configures a device to allow high inrush current during power-on.

-

undo poe enable (supported in V200R011C10 and later versions)

Interface view

Disables the PoE function on an interface.

-

Ethernet interfaces

undo negotiation auto

Interface view

Configures an interface to work in non-auto negotiation mode.

After you run the undo direct-command command, the interface works in auto negotiation mode.

• This command cannot be configured on combo interfaces.

• Do not cancel the undo negotiation auto command when speed or duplex is specified.

speed { 10 | 100 | 1000 | 2500 | 5000 | 10000 }

Interface view

Sets the rate in non-auto negotiation mode.

• This command cannot be configured on combo interfaces.

• Ensure that the interface works in non-auto negotiation mode before configuring this command.

speed auto-negotiation

Interface view

Enables auto-negotiation on a GE optical interface.

• Support for this command varies depending on switch models. For details, see the speed auto-negotiation command in the Command Reference - Interface Management Commands - Ethernet Interface Configuration Commands.

• Ensure that the interface works in auto-negotiation mode before configuring this command.

duplex { full | half }

Interface view

Sets the duplex mode for an electrical interface in non-auto negotiation mode.

• This command cannot be configured on combo interfaces.

• Ensure that the interface works in non-auto negotiation mode before configuring this command.

• When the working rate of a GE electrical interface is 1000 Mbit/s, the interface supports only the full duplex mode.

loopback internal

Interface view

Configures a loopback detection mode on an interface.

-

description description (supported in V200R011C10 and later versions)

Interface view

Configures the description for an interface.

The description contains a maximum of 52 characters in V200R011C10, and the description contains a maximum of 116 characters in V200R012C00 and later versions.

Eth-Trunk interface

description description (supported in V200R019C00 and later versions)

Eth-Trunk interface view

Configures the description for an Eth-Trunk interface.

The description contains a maximum of 116 characters.

The description can be configured for a service Eth-Trunk interface or an Eth-Trunk interface used in an SVF system to connect upstream and downstream devices. The description cannot be configured for Eth-Trunk0.

Port bridge

port bridge enable

Interface view

Enables the bridging function on an interface.

-

Port Security

(supported in V200R019C00 and later versions)

port-security max-mac-num max-number

Interface view

Sets the maximum number of secure MAC addresses that can be learned on an interface.

• The port-security max-mac-num max-number command in direct configuration mode is mutually exclusive with the mac-limit maximum max-num command configured in a user access profile and cannot be both configured.
• Port security (and sticky MAC if needed) must be enabled in a network enhanced profile, and then run the direct-command command to deliver this command.

port-security mac-address sticky mac-address vlan vlan-id

Interface view

Configures a sticky MAC address entry.

Port security and sticky MAC must be enabled in a network enhanced profile, and then run the direct-command command to deliver this command.

save sticky-mac configuration

System view

Saves the sticky MAC addresses on an AS to a file named unimng-xxxx.ztbl. xxxx in the file name represents the management MAC address of the AS.

-

Voice VLAN

voice-vlan mac-address mac-address mask mask (supported in V200R011C10 and later versions)

System view

Configures the OUI address of the voice VLAN.

-

LBDT

loopback-detect enable

Interface view

Enables loopback detection on an interface.

-

loopback-detect packet vlan vlan-id

Interface view

Enables loopback detection for a specified VLAN.

If you configure this command multiple times, loopback detection is enabled for multiple VLANs.

ARP rate limiting

arp speed-limit source-mac maximum maximum

System view

Configures ARP rate limiting based on source MAC addresses.

• Only some models support this command. For details, see the arp speed-limit source-mac command in the Command Reference - Security Commands - ARP Security Configuration Commands.

• The value of maximum maximum ranges from 0 to 256.

• This function takes effect only for the ARP packets sent to the CPU.

arp speed-limit source-ip maximum maximum

System view

Configures ARP rate limiting based on source IP addresses.

• The value of maximum maximum ranges from 0 to 256.

• This function takes effect only for the ARP packets sent to the CPU.

Stack

port interface { interface-type interface-number1 [ to interface-type interface-number2 ] } enable (supported in V200R010 and later versions)

Stack interface view:

stack-port member-id/port-id

Configures a service interface as a stack member port and adds it to a stack port.

Before restoring the stack member ports that are added to a stack port in direct configuration mode as common service interfaces, you do not need to run the shutdown interface command in the stack interface view.

stack slot slot-id priority priority (supported in V200R010 and later versions)

System view

Sets a stack priority for a member switch in a stack.

-

stack slot slot-id renumber new-slot-id (supported in V200R011C10 and later versions)

System view

Changes the stack ID of a specified member switch in a stack.

User Access and Authentication (supported in V200R012C00 and later versions)

access-user arp-detect vlan vlan-id ip-address ip-address mac-address mac-address

System view

Sets the source IP address and source MAC address of offline detection packets in a VLAN.

• In other V200R012C00 versions except V200R012C00SPC710, this command can be configured only one. If you want to modify the configuration, delete the existing configuration and then perform the configuration again.
• In V200R012C00SPC710 and V200R013C00, when vlan, ip-address, and mac-address are all different, multiple configurations of this command can be generated. If any one of vlan, ip-address, and mac-address has been configured, delete the existing configuration before reconfiguring them.
• In V200R019 and later versions, multiple configurations of this command can be generated regardless of whether the VLAN, IP address, and MAC address are the same. You do not need to delete the existing configuration. If the newly configured VLAN is the same as the existing one, the IP address and MAC address in the original configuration are replaced with the newly configured IP address and MAC address. If the newly configured VLAN is different from the existing one, a new configuration is generated.

access-user arp-detect default ip-address ip-address

System view

Sets the default source IP address of offline detection packets.

-

undo user-detect

System view

Disables the online user detection function.

-

authentication speed-limit max-num max-num-value interval interval-value (supported in V200R013C00 and later versions)

System view

Configures the rate limit for an access device to send user association and disassociation request messages.

-

access-user arp-detect fallback ip-address mask-length (supported in V200R013C00 and later versions)

System view

Configures an IP address required for calculating the source address of offline detection packets.

If you run this command multiple times, only the latest configuration takes effect.

access-user arp-detect delay delay (supported in V200R013C00 and later versions)

System view

Configures the delay for sending offline detection packets.

-

static-user start-ip-address [ end-ip-address ] [ mac-address mac-address | vlan vlan-id ] (supported in V200R019C00 and later versions)

System view

Configures a static user.

If the IP address of a static user is set to an IP address range, any IP address in this address range cannot be modified or deleted.

Basic Configuration

CLI overview commands

File management commands

System startup commands

Device Management

Hardware configuration commands

Energy-saving configuration commands

PoE configuration commands

Stack configuration commands (except the smooth upgrade commands)

Commands for configuring rules for outputting information to information channels in the information center (supported in V200R019 and later versions)

Interface Management

Basic interface configuration commands

Ethernet interface configuration commands

Logical interface configuration commands

Ethernet Switching

MAC address table configuration commands

Link aggregation commands

VLAN configuration commands

VLAN aggregation configuration commands

MUX VLAN configuration commands

Voice VLAN configuration commands

QinQ configuration commands

VLAN mapping configuration commands

Loopback detection configuration commands

BPDU protection configuration commands (supported in V200R012C00 and later versions)

Layer 2 protocol tunneling commands

IP Service

IPv4 configuration commands

ARP configuration commands

DHCP policy VLAN configuration commands

Reliability

DLDP configuration commands

MAC swap loopback configuration commands

User Access and Authentication

AAA configuration commands

NAC configuration commands (unified mode)

Policy association configuration commands

Security

ACL configuration commands

Local attack defense configuration commands

Attack defense configuration commands

MFF configuration commands

Traffic suppression and storm control configuration commands

ARP security configuration commands

Port security configuration commands

DHCP snooping configuration commands

ND snooping configuration commands

PPPoE+ configuration commands

IP source guard configuration commands

SAVI configuration commands

MPAC configuration commands

QoS

MQC configuration commands

Priority mapping commands

Traffic policing, traffic shaping, and interface-based rate limiting commands

Congestion avoidance and congestion management commands

Filtering configuration commands

Redirection configuration commands

Statistics configuration commands

ACL-based simplified traffic policy commands

Network Management and Monitoring

display and snmp-agent trap enable feature-name commands in SNMP configuration commands

LLDP configuration commands

Service diagnosis configuration commands

Mirroring configuration commands

Packet obtaining configuration command

Ping and tracert configuration commands