CloudCampus Solution V100R022C10 Deployment Guide for Multi-Campus Network Interconnection

Single-Device Configuration Guide for Tenant Administrators

You can quickly deploy some functions on a single device on the Single Device Configuration page. The single-device configuration is available only to ARs, NE routers, and LSWs.

Overview
Fundamentals
Precautions
GUI Overview
Single Device Configuration (AR600&6100&6200&6300&SRGSeries Devices)
Single Device Configuration (NE Devices and V600 LSWs/FWs/ARs)

Overview

Definition

The single device configuration function uses generic NE driver (GND) packages to define service models which help automatically generate web UI pages and GND APIs and to map service models to device models, so as to deliver configurations to a single device. This function helps users deliver configurations and implement quickly service rollout.

Application Scenario

The single device configuration function is applied to the scenario where a single device needs to be configured after it goes online. When customers require few network configurations, you can quickly deploy some functions on a single device by using this function for rapid configuration delivery.

Fundamentals

By using the single device configuration function based on the GND-based configuration capability, you can configure features on a single device.

Implementation Framework

A GND package consists of model packages and mapping packages. A model package can be used together with multiple mapping packages and each mapping package is applicable to a specific device model.

The single device configuration function works as follows:

Model packages define service models, which classify device features in the navigation pane on the single device configuration page.
Based on model packages, controller web UI pages are automatically generated and guide users through the entire configuration process, more easily through UI internationalization files and redirection between pages.
Mapping packages translate service models to device models, that is, translate feature configurations on the single device configuration page to commands that need to be delivered to devices.
On the single device configuration page, users set parameters for a service, verify the service configuration integrity, and then deliver the configuration to a certain device. Service integrity verification ensures the integrity of the configurations to be delivered and prevents errors if necessary configurations are missing during delivery.

Precautions

Feature Requirements

When you configure a feature for a device, ensure that the values of the parameters that require pre-configurations are the same as those that have been set on the device and must be case-sensitive. For example, when you configure Telnet, the source interface name must be the same as the name of an existing interface on the target device.
When you attempt to configure a function for a single device, check whether the function has been configured on the device. If so, services may be interrupted after the configuration is committed.
To ensure consistency of service configurations, some configurations that are automatically generated cannot be modified on the single device configuration page, including the following: configurations with sdwan_srv6_wan_link as the configuration source name (indicating WAN deployment configurations), configurations with sdwan_srv6_orchestrator as the configuration source name (indicating configurations delivered on the pages for traffic policy orchestration, RR connection, adding sites to VPNs, creating locators, topology configuration, and fault protection).

GUI Overview

This section describes the GUI functions and basic operations on the Single Device Configuration page.

Homepage

The homepage displays device information, feature configurations, and configuration results.

Device information area:

Click the drop-down list next to a device name. A device list that shows Device name, Device type, ESN, and Site is displayed.

Configuration status, Device type, Device model, ESN, Site, Model negotiation status, and Synchronization Status of the device are displayed under the device name.

Table 2-450 Description of the device information area

Name	Description
Configuration status	Configuration delivery status of a feature. Successful: The configuration is successfully delivered to the device. Failed: The configuration fails to be delivered to the device. Pre-configured: The device is not online and the configuration is waiting to be delivered.
Device type	Type of the selected device.
Device model	Model of the selected device.
ESN	ESN of the selected device.
Site	Site where the selected device belongs.
Model negotiation status	Not negotiated: The device and controller do not negotiate their service models. If the model negotiation status of an AR is Not negotiated, manually trigger negotiation. If the model negotiation status of a NE device is Not negotiated, verify that NETCONF parameters have been set on the device and the file server is running properly, and then manually trigger negotiation. If the status remains unchanged, contact the system administrator. failed: The device and controller fail to negotiate their service models. Negotiating: The device and controller are negotiating their service models. Wait until the negotiation is complete. Queuing: The model negotiation for the current device is queuing. Succeeded: The device and controller successfully negotiate their service models.
Synchronization Status	Synchronized: The configuration on the device has been synchronized to the controller. Unsynchronized: The configuration on the device is not synchronized to the controller.

Feature Configuration tab page:

The feature configuration list shows all configurable features. You can click to expand all features configurable on the device.

After you set parameters of a feature, the Reset, Dry run, and Commit buttons are displayed in the upper right corner on the Feature Configuration tab page.

Table 2-451 Description of the buttons on the configuration delivery page

Name	Description
Reset	Click Reset to discard the parameters that have been set and reset parameter settings.
Dry run	Click Dry run to check the data packets to be delivered, differences between the controller data and device configuration, and device model data.
Commit	Click Commit to deliver the configuration to the specified device. If the device is online, the configuration is directly delivered to the device. If the device is not online, the configuration will be delivered to the device after it goes online. If the configuration status of a feature is Failed after the feature configuration is committed, click Repair or Re-deliver to configure the feature again.

After the feature configuration is completed, you can perform operations as needed by clicking buttons in the Operation column.

Table 2-452 Description of buttons in the Operation column

Name	Description
Edit	If you want to modify a created feature on the device, click Edit.
Repair	This button is available only when Configuration status is Failed.
Re-deliver	After this button is clicked, iMaster NCE-Campus re-delivers configurations to the device.
Delete	If you want to delete a created feature from the device, click Delete.
Get Data Source	sdwan_srv6_wan_link: indicates the configuration source name for WAN link deployment. You cannot change it on the Single Device Configuration page. sdwan_srv6_orchestrator: indicates the default configuration source name for orchestration. You cannot change it on the Single Device Configuration page. gnd: indicates the default configuration source on the Single Device Configuration page. You can change it on this page.

After the feature configuration is committed, the configuration status will change to Succeeded or Failed.
The Batch Operation and Save As buttons are available on the Feature Configuration tab page.
- Click Batch Operation, select configured features, and perform batch operations.
- Click Save As, select a configured feature, and save parameters of the feature to your local host.

Configuration Result tab page:
1. The Configuration Result tab page displays information about committed features.
2. You can click View to check the information, such as the operating status, configuration status, and configuration log, of a configured feature.
3. The Full Configuration Repair and Full Re-deliver buttons are available on the Configuration Result page.
  - You can click Full Configuration Repair to repair all features with Configuration status being Failed
  - You can click Full Re-deliver to re-deliver all configurations on iMaster NCE-Campus to the device.

Single Device Configuration (AR600&6100&6200&6300&SRG Series Devices)

Local User Management

Configuring a Local User Policy

Context

To improve password security, you can set the validity period for the local user password. When the validity period expires, the password becomes invalid.

Prerequisites

Devices have been added to the controller.

Procedure

Choose Plan > Provision > Device Configuration > Single Device Configuration from the main menu.
Select the device to be configured and choose Local User Management > Local User Policy from the navigation pane.
Click the Password Policy tab and configure a password policy for the local user account.

Parameter Description

Table 2-453 Parameters on the Local User Policy tab page

Parameter	Description
Local User Policy	Password Policy	Password Expire Days(d)	Password validity period. The value ranges from 0 to 999. The default value is 90. If the value is 0, the password is permanently valid.
Password History Record Number	Maximum number of historical passwords that can be recorded for each user. The value ranges from 0 to 12. The default value is 5.

Parameter

Description

Local User Policy

Password Policy

Password Expire Days(d)

Password validity period. The value ranges from 0 to 999. The default value is 90.

If the value is 0, the password is permanently valid.

Password History Record Number

Maximum number of historical passwords that can be recorded for each user. The value ranges from 0 to 12. The default value is 5.

System Management

Configuring SNMP

Context

The Simple Network Management Protocol (SNMP) is a standard network management protocol widely used on UDP networks. SNMP uses a central computer (network management station) that runs network management software to manage network elements. Three SNMP versions are available — SNMPv1, SNMPv2c, and SNMPv3. One or more versions can be configured as required. Currently, the controller supports SNMPv2c and SNMPv3.

Prerequisites

Devices have been managed by the controller.

Procedure

Choose Plan > Provision > Device Configuration > Single Device Configuration from the main menu.
Select the device to configure and choose System Management > SNMP in the navigation pane.
1. Click the Global configuration tab and configure the global SNMP feature.
  - Version: sets the SNMP version to be enabled.
  - Trap enable: enables or disables the router to send trap messages.
  - Trap queue size: specifies the length of the queue for sending trap messages to the target host.
  - Complexity check: enables or disables the password complexity check function.
  - Source interface: specifies the source interface for sending trap messages.
  - Server source: specifies the source address used by the SNMP server to send packets.
    
    The parameter Server source is configurable on devices running V300R022C00 and later versions.
2. Click the SNMPv2c Version tab and then the Community tab. Click Create and configure the read-write community name.
  - Index: specifies the community name index.
  - Security name: specifies the community security name.
  - Authority: indicates that the community with a specified name has the read-only or read-write permission in the specified MIB view.
  - Basic ACL Identify: specifies the number of the ACL matching the community name.
3. Click the SNMPv2c Version tab and then the Trap target params tab. Click Create, and configure the parameters for sending trap messages.
  - Name: Set the name of the parameter list for sending trap messages.
  - Community index: Select the specified read-write community list.
4. Click the SNMPv2c Version tab and then the Target host tab. Click Create, and configure the target host to which trap messages are sent.
  - Target params: specifies the name of the parameter list for sending trap messages to the target host.
  - Name: specifies the name of the target host.
  - IP: specifies the IP address of the target host.
  - Port: specifies the port number used by the target host to receive trap messages.
  - VPN: specifies the name of a VPN instance.
5. Click the SNMPv3 Version tab and then the Group tab. Click Create, and configure the SNMP group.
6. Click the SNMPv3 Version tab and then the MIB view tab. Click Create, and create an MIB view.
7. Click the SNMPv3 Version tab and then the User tab. Click Create, and add a new user to the SNMP group.
  - Configure the group to which the SNMPv3 user belongs and the SNMPv3 username.
  - Configure the password used by the SNMPv3 user for authentication.
  - Configure the encryption algorithm and encryption password for the SNMPv3 user.
8. Click the SNMPv3 Version tab and then the Target params tab. Click Create, and configure the parameters for sending trap messages.
  - Name: specifies the name of the parameter list for sending trap messages.
  - User name: specifies the user name for sending trap messages.
  - Security level: specifies the security level of the specified packet.
9. Click the SNMPv3 Version tab and then the Target host tab. Click Create, and configure the target host to which trap messages are sent.
  - Target params name: specifies the name of the parameter list for sending trap messages to the target host.
  - Name: specifies the name of the target host.
  - IP: specifies the IP address of the target host.
  - Port: specifies the port number used by the target host to receive trap messages.
  - VPN: specifies the name of a VPN instance.

Parameter Description

Table 2-454 Description of SNMP parameters

Parameter					Description
SNMP	Global configuration	Version			SNMP version to use: v2c: indicates SNMPv2c. SNMPv2c is not secure enough. You are advised to use SNMPv3. v3: indicates SNMPv3.
		Trap enable			The value is an enumerated type and case-sensitive. The options include: enable-all: enables the router to send trap messages. disable-all: disables the router to send trap messages.
		Trap queue size			Specifies the length of the queue for sending trap messages.
		Complexity check			Enables or disables password complexity check.
		Source interface			Type and number of the source interface that sends trap messages. GigabitEthernet interface, for example, GigabitEthernet0/0/1 GigabitEthernet sub-interface, for example, GigabitEthernet0/0/1.10 XGigabitEthernet interface, for example, XGigabitEthernet0/0/2 XGigabitEthernet sub-interface, for example, XGigabitEthernet0/0/2.10 Ethernet interface, for example, Ethernet1/0/1 Ethernet sub-interface, for example, Ethernet1/0/1.10 Loopback interface, for example, LoopBack10 Tunnel interface, for example, Tunnel0/0/10 VLANIF interface, for example, Vlanif10 Eth-Trunk interface, for example, Eth-Trunk3
		Server source			Specifies the source IP address for sending trap messages.
	SNMPv2c Version	Community	Index		Index of an SNMP community name. The value is case sensitive.
			Security name		SNMP community name. The value is a string of case-sensitive characters and cannot contain spaces.
			Authority		read-only: indicates that the community with a specified name has the read-only permission in the specified MIB view. read-write: indicates that the community with a specified name has the read-write permission in the specified MIB view.
			Basic ACL Identify		Number of the ACL matching the community name.
		Trap target params	Name		Name of a parameter list for sending trap messages.
		Trap target params	Community index		SNMP community name.
		Target host	Target params		Specifies the name of the parameter list for sending trap messages to the target host.
			Name		Specifies the name of the target host.
			IP		Specifies the IP address of the target host.
			Port		Port number used by the target host to receive trap messages.
			VPN		Name of a VPN instance.
	SNMPv3 Version	Group	Name		Specifies a name of an SNMP group.
			Security level		Specifies the security level of an SNMP group. The options are as follows: no authentication,no privacy(There are safety risks, so it is not recommended to choose): indicates that packets are neither authenticated nor encrypted. authentication,no privacy(There are safety risks, so it is not recommended to choose): indicates that packets are authenticated but not encrypted. authentication and privacy: Packets are authenticated and encrypted.
			Basic ACL Identify		ACL corresponding to the user group.
			Readview		MIB view on which users in the group have the read-only permission.
			Writeview		MIB view on which users in the group have the read-write permission.
			Notifyview		MIB view on which users in the group have the notification permission.
		MIB view	Name		MIB view name. If both the whitelist A and the blacklist B are configured in the MIB view, subtrees that are included in the whitelist A but not included in the blacklist B take effect in the MIB view.
			WhiteList		MIB subtree included in the MIB view.
			BlackList		MIB subtree excluded from the MIB view.
		User	User	Group name	Specifies the group name of the user.
			User	Name	SNMPv3 user name.
			Authentication	Password	Password for HMAC-SHA-96 authentication.
			Privacy	Algorithm	Algorithm for encrypting the PDU in a packet. The options include: aes128: indicates the AES-128 encryption algorithm. aes256: indicates the AES-258 encryption algorithm.
			Privacy	Password	Password for the AES-128 or AES-256 encryption algorithm.
		Target params	Name		Name of a parameter list for sending trap messages.
			User name		SNMP user name.
			Security level		Indicates the security level of a trap message when the protocol for transmitting the trap message is SNMPv3. The options are as follows: no authentication,no privacy(There are safety risks, so it is not recommended to choose): indicates that packets are neither authenticated nor encrypted. authentication,no privacy(There are safety risks, so it is not recommended to choose): indicates that packets are authenticated but not encrypted. authentication and privacy: Packets are authenticated and encrypted.
		Target host	Target params name		Specifies the name of the parameter list for sending trap messages to the target host.
			Name		Specifies the name of the target host.
			IP		Specifies the IP address of the target host.
			Port		Specifies the port number used by the target host to receive trap messages.
			VPN		Specifies the name of a VPN instance.

Configuring NQA

Context

Network Quality Analysis (NQA) is a technology to measure network performance in real time and collect statistics on network information, such as the delay, jitter, and packet loss rate. NQA monitors network quality of service (QoS) indicators in real time, and effectively diagnoses and locate network faults.

Prerequisites

Devices have been managed by the controller.

Procedure

Choose Plan > Provision > Device Configuration > Single Device Configuration from the main menu.
Select the device to be configured and choose System Management > NQA from the navigation pane.
Click the Test instance tab, click Create, and configure an NQA test instance.
1. Click the Global tab and set Test instance name and Test instance type.
2. Click the ICMP tab and set ICMP parameters.
- The NQA configuration takes effect immediately on devices after being delivered.
- After the NQA configuration takes effect, it can be deleted but cannot be modified.

Follow-up Procedure

An event is generated after NQA is configured and when an NQA test completes. You can choose Monitoring and O&M > Monitoring > Alarm > Events to view events.

Parameter Description

Table 2-455 NQA parameters

Parameter			Description
NQA	Global	Test instance name	Name of an NQA test instance. The value is a string of 1 to 32 case-sensitive characters, excluding question marks (?), hyphens (-), and double quotation marks (").
	Global	Test instance type	Type of an NQA test instance. Only ICMP is supported.
	ICMP	Destination IP address type	Destination address type of the NQA test instance. The value can be IPv4 or IPv6.
		Destination IPv4/IPv6 address	Destination address for the NQA test instance.
		Source interface	Source interface of the NQA test instance.
		Test instance VPN	VPN instance for the NQA test instance. The value is a string of 1 to 31 case-sensitive characters without spaces. If spaces are used, the string must be enclosed in double quotation marks ("). NOTE: This parameter must be set when the interface to which the NQA test instance is bound has a VPN configured. Source interface and Test instance VPN cannot be empty at the same time. If the destination IPv6 address is configured, Test instance VPN must be configured and Source interface cannot be configured.
		Number of sent packets	Number of probe packets to be sent each time in the NQA test instance. The value is an integer from 1 to 15. The default value is 5.
		Packet sending interval (s)	Interval at which an NQA test instance sends a probe packet. The value ranges from 1 to 60. The default value is 4. When an NQA test instance starts, it will send multiple probe packets in each test. Network quality is detected based on the data collected through multiple probe packets. Probe packets are sent at a specified interval. On networks with poor quality, you can set a relatively large interval. If not, the network quality may deteriorate due to the test instance. On networks with good quality, you can set a relatively small interval to reduce the time waiting for the test instance to end. NOTE: The interval at which an NQA test instance sends a probe packet must be greater than the timeout interval.
		Timeout interval (s)	Timeout period for a probe of the NQA test instance. The value is an integer from 1 to 60, in seconds. The default value is 3. The timeout period refers to the time for waiting for a response packet after a probe is sent. If no response packet is received within the timeout period, the probe is considered failed. You need to set the timeout period based on the actual networking. If a small timeout period is set, the NQA test instance may fail.
		Cyclic Scheduling Period (s)	Interval at which the NQA test instance is automatically executed. The value range is from 1 to 604800. The default value is 22. If a test instance needs to be performed periodically during the period between the start time and end time, you can set the interval at which the NQA test instance is performed automatically. NOTE: The interval at which the NQA test instance is periodically executed must meet the following requirement: Interval at which the NQA test instance is periodically executed > Packet sending interval x (Number of sent packets - 1) + Timeout interval
		Data size (byte)	Size of an NQA probe packet. The value is an integer from 0 to 8100, in bytes. The default value is 0. If the configured packet size is smaller than the default packet size, the default packet size is used for packet processing.
		TTL	Time To Live (TTL) value for NQA probe packets. The value is an integer from 1 to 255. The default value is 30. To prevent probe packets from being transmitted endlessly, the test instance must be performed within a specified number of hops.
		ToS	Service type of an NQA probe packet. The value is an integer from 0 to 255. The default value is 0. You can set the priority of probe packets by setting the ToS value. When a large number of packets are received, packets of high priorities are processed preferentially.
		Conditions for sending traps	Condition for sending trap messages. Only the value testresult-change is supported, indicating that a trap message is sent upon a probe result change. NOTE: Only ARs running V300R022C00 and later versions support this function.
		Start-up Switch	Status of the NQA test instance. Open: The NQA test instance starts immediately. Close

Traffic Policy

Configuring an IPv4 ACL

Prerequisites

The tenant administrator has completed the deployment configuration, and devices have been successfully managed by the controller.
A VPN instance has been configured.

Context

Access Control Lists (ACLs) can be configured to deny and permit specific incoming and outgoing traffic. They accurately identify and control packets on a network to manage network access behaviors, prevent network attacks, and improve bandwidth utilization.

An ACL is a collection of one or more rules. A rule refers to a judgment statement that describes a packet matching condition, which may be a source address, destination address, or port number.

ACL rules can be classified by function, as shown in Table 2-456.

Table 2-456 ACL classification

Category	Application Scenario	Function
Basic ACL	Packets need to be filtered based only on the source IPv4 address.	Defines packet filtering rules based on information such as the source IPv4 address, action, and VPN instance.

Procedure

Choose Plan > Provision > Device Configuration > Single Device Configuration from the main menu.
Select the device to be configured and choose Traffic Policy > IPv4 ACL from the navigation pane.
Click Create. On the IPv4 ACL [Create] page that is displayed, configure global attributes for an IPv4 ACL.
ACL ID: specifies the number of an ACL. The number of a basic ACL ranges from 2000 to 2999.
Configure an IPv4 ACL rule.
- Configure a basic ACL.
  1. rule ID: specifies the ID of a basic ACL rule.
  2. Source ip network type: specifies the type of the IP addresses that match the rule.
  3. IPv4 address/Mask: specifies the source IP address and mask that match the rule.
  4. Action: specifies the action (permit or deny) to take on packets that match the rule. This parameter determines whether to permit or deny packets that match the ACL rule.
Click OK.

Verifying the Configuration

After the configuration is completed, click Commit and check the configuration delivery status in the Configuration status column.
After the configuration is completed, you can view the configuration status and operation logs on the Configuration Result tab page.

Parameter Description

Table 2-457 IPv4 ACL parameters

Parameter		Description
Global	Identify	Identifier of an ACL. It can contain digits and letters. Basic ACL: The value is an integer from 2000 to 2999.
Basic rule	ID	ID of an ACL rule. All ACL rules are sorted in ascending order of rule IDs.
	Source ip network type	Type of the IP addresses to be matched.
	IPv4 address/Mask	Source IP address and mask to be matched.
	Action	Whether to configure the device to accept or discard the data packets that match the ACL rule: permit: configures the device to accept the packets that match the rule. deny: configures the device to discard the packets that match the rule.

Interface

Interface Management

Context

You can configure tunnel interfaces on a single device through iMaster NCE-Campus.

Prerequisites

The tenant administrator has completed the SD-WAN network deployment. Devices have been managed.

Procedure

Choose Plan > Provision > Device Configuration > Single Device Configuration from the main menu.
Choose Interface > Interface Configuration from the navigation pane and click Create to create an interface.
Set an interface name, set Interface type to Tunnel or EthernetCsmacd, bind a VPN instance to the interface, enter the interface description, and set Enable status to decide whether to enable this interface. For details about how to set an interface name, see the parameter description.

When Interface type is set to EthernetCsmacd, Enable status must be set (Open or Close), and the IPv4, IPv6, Tunnel, and OSPF settings of the interface must be left empty. Otherwise, the configuration fails to be committed.
Click OK.
Click Edit in the Operation column, and modify basic information about the interface.
Configure an IP address for the interface. The IP address can be an IPv4 or IPv6 address.
- To configure an IPv4 address, click Edit in the Operation column. Choose IPv4 > IPv4 and configure priorities as needed.
- Choose IPv4 > Address list, click Create to configure an IPv4 address and a mask for the interface, and click OK.
- Configure an IPv6 address: Click Edit in the Operation column. Click Address list, click Create, enter an IPv6 address and mask, and then click OK.
Click Edit in the Operation column, click the Tunnel tab, and configure tunnel information.
Click Edit in the Operation column, click the OSPF tab, and set the OSPF cost for the interface.

Parameter Description

Table 2-458 Parameters for interface management

Parameter		Description
Creating an interface	Interface name	Name of an interface. Tunnel: Interfaces of this type are virtual tunnel interfaces. The interface name must be in the format of Tunnel0/0/A, where A ranges from 300 to 399. Such interfaces support all interface configurations available on the web UI. EthernetCsmacd: Interfaces of this type are universal interfaces. The Enable status can only be set to Open (undo shutdown) or Close (shutdown). Set a name in any of the following formats: GigabitEthernet0/0/1 XGigabitEthernet0/0/1 Loopback10 Eth-trunk10 Vlanif10
	Interface type	Tunnel: indicates the tunnel interface type. EthernetCsmacd: indicates the universal interface type.
	VPN	VPN instance to be bound to the interface.
	Description	Description of the tunnel interface. The value is a string of 1 to 242 case-sensitive characters, spaces supported.
	Enable status	Whether to enable or disable the interface.
IPv4	DSCP priority	DSCP priority of control packets.
	8021P priority	802.1p priority of control packets generated by the device.
	IPv4 address	IPv4 address for the tunnel interface.
	Mask	IPv4 mask for the tunnel interface.
IPv6	IPv6 address	IPv6 address for the tunnel interface.
IPv6	Mask	IPv6 mask for the tunnel interface.
Tunnel	Tunnel type	Tunneling protocol used by the tunnel interface. Currently, only GRE tunneling is supported.
	VPN	Name of the VPN instance to which the destination address of the tunnel belongs. The VPN instance must already exist.
	Source IPv4 address	Source address of a tunnel interface.
	Destination IPv4 address	Destination address of a tunnel interface.
OSPF	Cost	Cost of an OSPF-enabled interface. In multicast implementation using GRE over SD-WAN EVPN tunnels, if the peer site is a dual-gateway site, a GRE tunnel needs to be established between the local device and each of the two gateways at the peer site. You can set this parameter for each tunnel interface to determine the active and standby tunnels. The tunnel with the tunnel interface that has a smaller OSPF cost value assumes the active role.

IP Unicast Routing

OSPF Configuration

Context

You can configure the Open Shortest Path First (OSPF) function for a single device through iMaster NCE-Campus.

Prerequisites

The tenant administrator has completed the SD-WAN network deployment. The device has been managed.

Procedure

Choose Plan > Provision > Device Configuration > Single Device Configuration from the main menu.
Choose Routing > OSPF from the navigation pane. Click Create, create an OSPF instance, and click OK.
1. Process ID: indicates an OSPF process ID. You can create different processes for services of different types.
2. Router ID: indicates the router ID. The router IDs of any two routers in an AS must be different. Generally, a device uses the IP address of an interface as its router ID.
3. VPN: specifies a VPN instance. If a VPN instance is specified, the OSPF process belongs to this VPN instance. Otherwise, the OSPF process belongs to a public network instance.
Click OK to complete the global OSPF configuration.
Click Edit in the Operation column, and modify basic OSPF information.
Configure an OSPF area.
1. Click Edit in the Operation column. Click the Area tab and click Create to create an OSPF area and set the area type.
  Area ID: specifies an OSPF area ID.
  
  Area type: specifies the OSPF area type. The area type can be set to normal, stub, or NSSA.
2. Click OK to complete the global OSPF area configuration.
3. Select a created OSPF area, click Edit, and click the Area tab to modify the area ID and area type.
4. Click the Network tab, click Create, and configure the network segment in the OSPF area.
5. Click OK.
After the configuration is completed, click Dry run to view the data packets to be delivered, differences between the controller data and device configurations, and device model data.
Click Commit to deliver the configuration to the specified device. If the device is online, the configuration is directly delivered to the device. If the device is not online, the configuration will be delivered to the device after it goes online.
Check the configuration delivery result. If the device is online, the configuration status should be Successful. If the device is not online, the configuration status should be Pre-configured.

Parameter Description

Table 2-459 OSPF parameters

Parameter		Description
Basic Information	Process ID	ID of an OSPF process.
	Router ID	The router ID must be a unique IPv4 address on the network. By default, the router ID of the route management module is 0.0.0.0 when no IP address is configured on the device.
	VPN	Name of a VPN instance.
Area	Area ID	ID of an OSPF area. Area 0 is the backbone area.
	Area type	Type of an OSPF area, which can be normal, stub, or NSSA. normal: indicates that the OSPF area is a common area. Common areas include standard areas and backbone areas. stub: A stub area allows only intra-area and inter-area routes to be advertised within this area. nssa: An NSSA allows AS external routes to be imported.
	Network	OSPF route.

IPv4 Static Routes

Context

You can configure IPv4 static routes for a single device through iMaster NCE-Campus.

Prerequisites

The tenant administrator has completed the SD-WAN network deployment.

Procedure

Choose Plan > Provision > Device Configuration > Single Device Configuration from the main menu.
Choose Routing > IPv4 Static from the navigation pane and click Create. The IPv4 Static [Create] page is then displayed.
1. IPv4 address/Mask: specifies the destination IPv4 address and mask length of the static route.
2. VPN: specifies a VPN instance name.
3. Next-hop type: specifies where an outbound interface or an address is configured as the next hop.
Click Edit in the Operation column, and configure the destination VPN of the static route. You can set Next-Hop Type to outgoing-interface and configure an outbound interface.
Click Dry run to view the data packets to be delivered, differences between the controller data and device configurations, and device model data.
Click Submit to deliver single-device configurations. If the device is online, the configurations are delivered to the device. If the device is offline, the configurations will be delivered to the device after it goes online.
Click Configuration Result to view the configuration delivery result. If the device is online, the configuration status should be Successful. If the device is offline, the configuration status should be Pre-configuration.

Parameter Description

Table 2-460 Parameters for configuring IPv4 static routing

Parameter	Description	Value Range
Destination Prefix	Destination IPv4 address and mask length of a static route.	The format is X.X.X.X/Y, where Y is an integer in the range from 0 to 32.
VPN	Name of a VPN instance. If default-routing-instance is specified, no VPN instance is bound.	-
Next-Hop Type	Destination VPN: The static route will search the routing table of the VPN instance for the outgoing interface. Destination VPN + IP address: The static route will search for the outgoing interface in the routing table of the VPN instance based on the configured destination IP address. IP address + Outbound interface: Traffic is forwarded through the outgoing interface specified in the static route. IP address: The static route will search for the outgoing interface based on the next-hop IP address. Outbound interface: Traffic is forwarded through the outgoing interface specified in the static route.	-
Destination VPN	Name of a next-hop VPN instance.	The value is a string of 1 to 31 case-sensitive characters, spaces not supported. The character string can contain spaces if it is enclosed in double quotation marks (""). The value default-routing-instance indicates the next-hop public network.
Preference	Priority of a static route. A smaller value indicates a higher priority.	The value is an integer in the range from 1 to 255.
IPv4 Address	Next-hop IP address of a route.	The value is in dotted decimal notation.
Outgoing Interface Name	Name of the next-hop outgoing interface.	The value is an existing interface on the network devices, for example, Tunnel0/0/300.
Destination VPN	Name of a next-hop VPN instance.	The value is a string of 1 to 31 case-sensitive characters, spaces not supported. The character string can contain spaces if it is enclosed in double quotation marks (""). The value default-routing-instance indicates the next-hop public network.
Enable DHCP	Whether to associate DHCP with the static route. A static route can be used for traffic forwarding only when a next-hop IP address is available. If the next hop manually specified for a static route changes, the device on which the static route is configured is unaware of the change. As a result, traffic fails to be forwarded along the static route. To prevent this problem, you can associate a static route with DHCP, through which the next hop is dynamically obtained. Open: The outgoing interface is associated with DHCP. Close: The outgoing interface is not associated with DHCP. Unconfigured: DHCP is not associated.	-
Description	Description of the IPv4 static route.	The value is a string of 1 to 80 case-sensitive characters, which can contain spaces but not the question mark (?).
Tag	Tag of a static route. By configuring different tag values, you can classify static routes to implement different route management policies. For example, other protocols can import static routes with specified tag values through routing policies.	The value is an integer in the range from 1 to 4294967295. The default value is 0.
Site ID	ID of the site where the destination network segment is located. NOTE: This parameter is optional. However, in the VXLAN over SD-WAN EVPN tunnel scenario, a static route needs to be configured, with the outbound interface of user traffic being set to the tunnel interface Tunnel0/0/300 of control packets. In this case, the site ID needs to be set to the peer site ID of the VXLAN tunnel. You can check the site ID on the Design > Site Design > Site Management page.	-

Multicast

Configuring the Multicast Function

Context

To enable the multicast function, that is, to support multicast communication on an SD-WAN network, Huawei SD-WAN Solution can implement the multicast function by using GRE over SD-WAN EVPN tunnels.

On the network shown in Figure 2-159, GRE over SD-WAN EVPN tunnels are established between sites. Multicast traffic sent from the multicast source is encapsulated by GRE tunnels and then by SD-WAN EVPN tunnels, and forwarded to users at the destination site.

Figure 2-159 Multicast over GRE over SD-WAN EVPN tunnels
Click to enlarge

To improve reliability at a dual-gateway site, each of the dual gateways sets up a GRE over SD-WAN EVPN tunnel with its peer site. For example, in Figure 2-160, each of the dual gateways at Site1 sets up a GRE over SD-WAN EVPN tunnel with the devices at Site2 and Site3, respectively. That is, Site1 sets up two tunnels with Site2, and does the same as Site3. OSPF costs are set for GRE tunnel interfaces to determine active and standby roles of the tunnels. The tunnel with the tunnel interface that has a smaller cost value assumes the active role.

Figure 2-160 Dual-gateway multicast configuration
Click to enlarge

The following uses the configurations of Site1 and Site2 (both are single-gateway sites) as an example to describe the detailed configuration procedure:

Configure a GRE over SD-WAN EVPN tunnel between Site1 and Site2.
1. Create a loopback interface on each device at Site1 and Site2 (according to Configuring a Loopback Interface), and add the loopback interfaces to service VPNs. The loopback interface addresses are used as the GRE tunnel source and destination addresses.
2. Create tunnel interfaces at Site1 and Site2, respectively, bind the service VPN instance to each of the tunnel interfaces, and configure tunnel information. Set the tunnel source address on the local end to the local loopback interface address in the service VPN and the tunnel destination address to the peer loopback interface address in the service VPN.
Enable multicast routing globally on devices at Site1 and Site2, enable multicast routing in the service VPN instance, enable PIM DM on the interfaces connected to the multicast source, GRE tunnel interfaces, and interfaces connected to multicast receivers, and enable IGMP on the interfaces connected to multicast receivers. For details, see the multicast configuration procedure.
Configure OSPF on devices at Site1 and Site2, and advertise the IP addresses of the LAN interfaces and GRE tunnel interfaces in OSPF. In this way, routes for communication between the multicast source and receivers are exchanged.

Prerequisites

The deployment configuration has been completed, and devices have been successfully managed by the controller.
GRE tunnel interfaces and LAN interfaces have been created.

Procedure

Choose Plan > Provision > Device Configuration > Single Device Configuration from the main menu.
Choose Multicast > Multicast from the navigation pane. On the Global Configuration tab page, configure an address family and enable the global routing function.
Click the VPN list tab. Click Create, bind a VPN instance to an interface, enable the multicast routing function, and click OK.
Click the Binding interface tab. Click Create, select an interface, configure the multicast function for the interface, and click OK.
The selected interface must have been created.
1. Click Edit in the Operation column, click the PIM tab, and enable PIM on the interface connected to the multicast source, GRE tunnel interface, and interface connected to a multicast packet receiver.
2. Click the IGMP tab and enable IGMP on the interface connected to a multicast receiver.
After the configuration is complete, click Dry run to view the data packets to be delivered, differences between the controller data and device configurations, and device model data.
Click Submit to deliver single-device configurations. If the device is online, the configurations are delivered to the device. If the device is not online, the configurations will be delivered to the device after it goes online.
Click Configuration Result to view the configuration delivery result. If the device is online, the configuration status should be Successful. If the device is offline, the configuration status should be Pre-configuration.

Parameter Description

Table 2-461 Parameters for configuring the multicast function

Parameter		Description
Global Configuration	Address family	ipv4multicast: enables IPv4 multicast routing globally.
Global Configuration	Routing enable	Whether to enable the multicast routing function globally.
Binding VPN	VPN	VPN instance where multicast routing is to be enabled.
Binding VPN	Routing enable	Whether to enable the multicast routing function in the specified VPN instance.
Apply multicast	Interface name	Interface on which the multicast function is to be configured.
PIM	Type	Enable PIM-DM or PIM-SM on the interface. Enabling PIM on an interface is the prerequisite for the interface to set up PIM neighbor relationships with other routers and to process PIM messages from its neighbors. pim-dm: applies to small-scale networks with densely distributed multicast group members. Currently, the controller supports multicast configuration on a PIM-DM network. pim-sm: applies to networks with a large number of sparsely distributed group members. Currently, the controller can only enable PIM-SM on interfaces. To configure a PIM-SM network, commands need to be run on the target devices to complete other required configurations.
PIM	Address family	IPv4 family: Enable PIM in the IPv4 address family.
IGMP	Enable IGMP	Whether to enable IGMP on the interface. A multicast device can process IGMP messages sent from multicast packet receivers only after IGMP is enabled on the interfaces connected to the receivers.

Bridge Domain

Configuring a Bridge Domain

Context

A bridge domain (BD) is a Layer 2 broadcast domain on a large Layer 2 network constructed using VXLAN. VXLAN packets in a BD can be forwarded through the VXLAN tunnel at Layer 2. After a BD is created through the single-device configuration function, subsequent VXLAN-related deployment is performed based on the BD.

Prerequisites

The tenant administrator has completed SD-WAN network deployment configurations.

Procedure

Choose Plan > Provision > Device Configuration > Single Device Configuration from the main menu.
Choose BridgeDomain > BridgeDomain from the navigation pane.
Click Create and create a BD instance.
Click Edit in the Operation column of the area to associate the BD with related service interfaces. For details, see Interface Management.
Access VXLAN services based on the VLAN or the flow encapsulation type of packets.
- Port Tag: Services are accessed based on VLANs, and one-to-one or many-to-one mappings between VLANs and BDs are established on a VTEP. After receiving service packets, the VTEP forwards the packets in a BD based on the mapping between VLANs and BDs.
- Port UnTag: Services are accessed based on the flow encapsulation type of packets. Layer 2 sub-interfaces are created on a downlink physical interface of the VTEP, and different flow encapsulation types are configured so that different interfaces can receive and process different types of data packets. In addition, one-to-one mappings are established between Layer 2 sub-interfaces and BDs. Then, service packets are sent to specified Layer 2 sub-interfaces after reaching the VTEP. In this way, data packets are forwarded in a BD based on the mapping between Layer 2 sub-interfaces and BDs.
Click Dry run to view the data packets to be delivered, differences between the controller data and device configurations, and device model data.
Click Commit to deliver single-device configurations. If the device is online, the configurations are delivered to the device. If the device is offline, the configurations will be delivered to the device after it goes online.
Click Configuration Result to view the configuration delivery result. If the device is online, the configuration status should be Successful. If the device is offline, the configuration status should be Pre-configuration.

Parameter Description

Table 2-462 Parameters for configuring a BD

Parameter	Description	Setting
ID	ID of a BD.	The value is an integer. The value range varies according to devices. For details, see the description of the id parameter in the huawei-bd.yang file in the product documentation of the corresponding device model.
vlan ID	VLAN associated with a BD.	The value is an integer in the range from 1 to 4094.
Interface Name	Layer 2 interface associated with a BD.	The value must be an existing Layer 2 interface on the device, for example, GigabitEthernet0/0/1.

VXLAN

Configuring VXLAN

Context

To enable the L2VPN function, that is, to allow Layer 2 data forwarding on the SD-WAN network, Huawei SD-WAN Solution supports the VXLAN over SD-WAN EVPN tunnel solution.

As shown in Figure 2-161, the branch devices set up a static VXLAN tunnel to transmit Layer 2 user traffic between each other. Each branch device has a loopback interface address configured in the control VPN and uses it as the outer source or destination address of the VXLAN tunnel. As such, upon the receipt of a user packet, a branch site directs the packet to a VXLAN bridge domain (BD), encapsulate it in the VXLAN tunnel and then in the SD-WAN EVPN tunnel, and forwards it to the remote branch site.

Figure 2-161 VXLAN over SD-WAN EVPN tunnel solution
Click to enlarge

The configuration roadmap is as follows:

At Site1, create a BD instance, create a VXLAN instance, configure an address for the local NVE interface (which is the source VTEP address of the VXLAN tunnel), configure a VXLAN Network Identifier (VNI), bind the VNI to a BD, and configure remote VTEP addresses.
At Site2, create a BD instance and create a VXLAN instance. A static VXLAN tunnel is set up between Site1 and Site2.
Configure static routes at Site1 and Site2, with the next-hop outgoing interface of the user traffic being the tunnel interface Tunnel0/0/600 of the control tunnel.

Prerequisites

The tenant administrator has completed the SD-WAN network deployment.

Procedure

Choose Plan > Provision > Device Configuration > Single Device Configuration from the main menu.
Choose Vxlan > VXLAN from the navigation pane. On the VXLAN page that is displayed, create a VXLAN tunnel.
Click Create, create a VXLAN instance, and configure the NVE ID and local IP address.
Click Edit in the Operation column, click the Vni tab, set the VNI ID, and bind the VNI to a BD or VLAN.
Click OK.
Click Edit in the Operation column of the VNI list. Click the Peer Address tab to configure remote VTEP IP addresses.
Click Dry run to view the data packets to be delivered, differences between the controller data and device configurations, and device model data.
Click Submit to deliver single-device configurations. If the device is online, the configurations are delivered to the device. If the device is not online, the configurations will be delivered to the device after it goes online.
Click Configuration Result to view the configuration delivery result. If the device is online, the configuration status should be Successful. If the device is offline, the configuration status should be Pre-configuration.

Parameter Description

Table 2-463 Parameters for configuring the VXLAN

Parameter	Description	Setting
Nve ID	Number of an NVE interface.	The value is fixed at 1.
Local Address	Source VTEP IP address of a VXLAN tunnel.	The value is in dotted decimal notation.
Vni ID	VNI. Similar to a VLAN ID, a VNI identifies a VXLAN segment. Tenants on different VXLAN segments cannot communicate at Layer 2.	The value is an integer in the range from 0 to 16777215.
VNI Attachment	layer2: configures a Layer 2 VXLAN gateway to provide Layer 2 services for the tenants at the site. layer3: configures a Layer 3 VXLAN gateway to provide Layer 3 services for the tenants at the site. Tenants at the site can communicate with tenants on external networks or on other VXLAN networks at Layer 3 through the Layer 3 VXLAN gateway.	-
BridgeDomain ID	This parameter needs to be set when VNI Attachment is set to layer2. A BD has a one-to-one mapping with a VNI. After a VTEP receives packets, it selects the suitable VXLAN tunnel to forward the packets based on the mapping between BDs and VNIs.	The value must be the ID of a created BD.
VPN	Name of a VPN instance. This parameter needs to be set when VNI Attachment is set to layer3.	The value is an integer from 1 to 31.
Peer Address	Remote VTEP IPv4 address of a VXLAN tunnel.	The value is in dotted decimal notation.

DNS

TCP/IP allows devices to communicate through IP addresses, but users find it difficult to remember these IP addresses. To resolve this problem, a domain name system (DNS) was designed to match IP addresses with human-readable host names.

Context

Since IP addresses are hard to remember, users want to access network servers by using domain names. The customer expects the DNS server to correctly resolve domain names based only on some domain name fields, so that users can correctly access network services. For example, when a DNS client accesses the server (huawei.com), users only need to enter huawei. It is required that the DNS server can fast resolve common domain names.

Figure 2-162 Networking diagram for configuring a DNS client

Prerequisites

A device has been added.

Procedure

Choose Plan > Provision > Device Configuration > Single Device Configuration from the main menu.
Choose DNS > DNS server from the navigation pane.
Click the DNS server tab, enable or disable DNS as needed, set a DNS VPN instance name, and enable or disable DNS proxy as needed.
Click the DNS server list tab, click Create, and set the name and IPv4 address of a DNS server.
Click the DNS groups tab, click Create, and set the name and IPv4 address of a DNS group.
Click the DNS resolve policy tab and configure a DNS policy.
1. Click the DNS resolve policy tab and set Policy enable to enable or disable a policy.
2. Click the DNS rule list tab and click Create to create a DNS rule. Set a DNS rule ID, select a DNS rule type, and specify a domain name matching the DNS rule. Then click OK.

Parameter Description

Table 2-464 Parameters for configuring DNS

Parameter			Description	Value Range
DNS service	DNS resolve enable		Whether to enable DNS.	-
	DNS VPN instance name		Name of a VPN instance.	The value must be the name of an existing VPN instance.
	DNS proxy enable		Whether to enable DNS proxy.	-
DNS server list	Server name		Name of a DNS server.	-
DNS server list	IPv4 address		IP address of the DNS server.	The value is in dotted decimal notation.
DNS group	DNS group name		Name of a DNS group.	The value is a string of 1 to 32 case-sensitive characters. It cannot contain spaces. When quotation marks are used around the string, spaces are allowed in the string.
DNS group	IPv4 address		IP address of the DNS group.	The value is in dotted decimal notation.
DNS policy	Policy enable		Whether to enable the DNS policy.	-
	DNS rule	DNS rule ID	ID of a DNS rule. A smaller value indicates a higher priority.	The value is an integer in the range from 0 to 127.
		DNS rule type	Whether to enable the DNS resolution policy function for type A query requests.	a
		DNS rule match name	Domain name matching the DNS resolution rule. If this parameter is not specified, all domain names are matched.	The value is a string of 1 to 255 case-insensitive characters. It can contain digits (0 to 9), letters, hyphens (-), underscores (_), periods (.), and asterisks (), and cannot contain spaces. is a wildcard and can only be used once at the beginning of the domain name. For example, .example.com indicates that all host names with the suffix example.com* are matched.
		active type	group-name: specifies the name of a DNS group.	The value must be the name of an existing DNS group.

Monitoring

Context

You can configure ARs on iMaster NCE-Campus and deliver the NetStream interface configuration and global configuration to the ARs.

NetStream is a technology used to sample, collect, and distribute traffic information on networks. It collects traffic statistics based on the volume and resource consumption and helps users implement QoS management and accounting on various services.

A NetStream system consists of the NetStream Data Exporter (NDE), NetStream Collector (NSC), and NetStream Data Analyzer (NDA).

NDE: analyzes and processes service flows, extracts the flows that meet the conditions for statistics collection, and exports the statistics to the NSC. The NDE can process the statistics (such as aggregating statistics) before exporting them to the NSC.
NSC: stores the packets received from the NDE and saves statistics to its database for the NDA to analyze. The NSC can collect data exported from multiple NDEs for further processing.
NDA: a traffic analysis tool that extracts statistics from the NSC, processes the statistics, and generates a report. This report provides a basis for diverse applications such as accounting, network management, and network optimization. The NDA provides a graphical user interface (GUI) for users to easily obtain and analyze collected data.

In practice, the NDE is a network device enabled with NetStream, and the NSC and NDA are typically integrated into the same NetStream server. iMaster NCE-CampusInsight functions as the NDA.

Prerequisites

Interconnection between iMaster NCE-Campus and iMaster NCE-CampusInsight has been configured. Data synchronization between them has been completed. For details, see Synchronizing Data to iMaster NCE-CampusInsight.
The tenant administrator has completed the SD-WAN network deployment. Devices have been managed.

Procedure

Choose Plan > Provision > Device Configuration > Single Device Configuration from the main menu.
Choose monitor > NetStream Apply from the navigation pane and set NetStream parameters for an interface.
1. Click Create and enter the name of the interface to be configured.
2. Click Edit and set interface parameters.
  1. Click the interface tab to view the interface name.
  2. Click the after-decap flag tab and enable the function of aggregating tunnel-decapsulated packets.
  3. Click the export-tnp flag tab and enable the TNP sampling function.
  4. Click the ns-enable tab and select the direction in which aggregation flow statistics collection is to be enabled on the interface.
  5. Click the ns-sample tab and configure the sampling mode and sampling ratio for incoming and outgoing packets, respectively.
3. After the configuration is complete, click Dry run to view the data packets to be delivered, differences between the controller data and device configurations, and device model data.
4. Click Commit to deliver single-device configurations. If the device is online, the configurations are delivered to the device. If the device is not online, the configurations will be delivered to the device after it goes online.
5. Click NetStream Apply to view the configuration delivery result. If the device is online, the configuration status should be Successful. If the device is not online, the configuration status should be Pre-configured.
Choose monitor > NetStream Policy from the navigation pane and set global NetStream parameters for a device.
1. Click the NetStream Policy tab and set global NetStream parameters.
  
  When interconnection with iMaster NCE-CampusInsight is configured, set export version to 9 for AR devices.
2. Click the export-source tab and configure a WAN interface and its IP address on the device. When interconnection with iMaster NCE-CampusInsight is configured, you do not need to set port for AR devices.
3. Click the export-host tab and configure the IP address and port number of the target host. When interconnection with iMaster NCE-CampusInsight is configured, set the southbound IP address and port number.
4. Click the export-timeout tab and set the aging time of active and inactive flows, respectively.
5. After the configuration is complete, click Dry run to view the data packets to be delivered, differences between the controller data and device configurations, and device model data.
6. Click Commit to deliver single-device configurations. If the device is online, the configurations are delivered to the device. If the device is not online, the configurations will be delivered to the device after it goes online.
7. Click NetStream Policy to view the configuration delivery result. If the device is online, the configuration status should be Successful. If the device is not online, the configuration status should be Pre-configured.
(Optional) Check the NetStream configuration status of the device.
1. Log in to the device and run the following configuration to check the configuration status.
```
display ip netstream all
```
2. Perform a continuous ping on the device to construct NetStream flows.
```
ping ip-address -c count
```
3. Log in to iMaster NCE-CampusInsight, choose Application > Traffic Analysis > SDWAN, and view the data.

Parameter Description

Table 2-465 Parameters on the NetStream Apply page

Parameter		Description	Value Range
Global	Interface Name	Name of the device interface to be configured.	-
after-decap flag		Whether to enable the function of aggregating tunnel-decapsulated packets.	The options include Open and Close.
export-tnp flag		Whether to enable TNP sampling on the interface.	The options include Open and Close.
Ns-enable	Direction	Direction in which aggregation flow statistics collection is enabled on an interface. inbound outbound	-
Ns-sample	Direction	Direction in which NetStream sampling is enabled. inbound outbound	-
Ns-sample	Sample	sample type: indicates the type of data packets to be sampled by NetStream. packets-number: specifies the number of packets between two samplings.	sample type can be set to fix-packets. packets-number is an integer from 1 to 65535.

Table 2-466 Parameters on the NetStream Policy page

Parameter		Description	Value Range
NetStream Policy	export version	Version number of the exported packets.	The value can be 5, 9, or 10.
	tcp-flag	Whether to enable the aging function globally.	The value can be Open, Close, or Unconfigured.
	pre-classify flag	Whether to enable the pre-classify function globally.	The value can be Open, Close, or Unconfigured.
	tm-after	Whether to enable NetStream sampling before or after queue scheduling.	The value can be Open, Close, or Unconfigured. Open: NetStream sampling is enabled after queue scheduling. Close: NetStream sampling is enabled before queue scheduling.
	export-index-switch	Number of bits in the interface index.	The value can be 16 or 32.
	Interval for sending the NetStream export template (min)	Interval for sending the NetStream export template.	The value ranges from 1 to 3600, in minutes. The default value is 30.
	Config status	Success: The configuration is successfully delivered to the device. Failed: The configuration fails to be delivered to the device. Pre-configured: The device is not online and the configuration is to be delivered.	-
export-source	ip	Source IP address of the device, which is usually the interface IP address of a WAN link.	The value is in dotted decimal notation.
export-source	port	Source port number of the device.	The value is an integer from 0 to 65535.
export-host	ip	Address of the analyzer.	The value is in dotted decimal notation.
	port	Destination port number.	The value is an integer from 0 to 65535.
	vpn instance name	VPN instance that has been created on the device.	The value is a string of 1 to 31 characters.
export-timeout	Active timeout(minute)	Aging time for IPv4 active flows.	The value is an integer from 1 to 60, in minutes.
export-timeout	Inactive timeout(second)	Aging time for IPv4 inactive flows.	The value is an integer from 10 to 600, in seconds.

Single Device Configuration (NE Devices and V600 LSWs/FWs/ARs)

You can quickly deploy some functions on a single device on the Single Device Configuration page.

NE devices support the single-device configuration function if they are managed by the controller through NETCONF and the controller uses the SRv6 tunnel mode.
LSWs, firewalls, and ARs support the single-device configuration function if they run V600 versions and are managed by the controller through NETCONF.
Some functions are applicable only to devices managed in SRv6 tunnel mode. For details, see the description on the controller web UI.
The configurable parameters on the web UI vary according to the device model.

Basic Configuration

Configuring Device Registration with the Controller

Context

If a device needs to be managed by the controller, you need to deliver the controller information to the device.

Only ARs and LSWs running V600 support this function.

Prerequisites

A device has been added.

Procedure

Choose Plan > Provision > Device Configuration > Single Device Configuration from the main menu.
Select the device to configure and choose Basic Configuration > Controller Registration from the navigation pane.
Click the Controller Registration tab and configure the controller name.
Click the Registration Information tab, click Create, and set information about the controller with which the device is to be registered.
Click OK.

Parameter Description

Table 2-467 Parameters for configuring device registration with the controller

Parameter	Description
Controller name	Name of the controller with which the device is to be registered. The value must be the same as the actual controller name.
End point name	Name of the device after it is registered with the controller.
Southbound IPv4 or IPv6 address of the controller.	Southbound IPv4 or IPv6 address of the controller, which is used by the device to communicate with the controller.
Southbound port of the controller	Southbound port of the controller used by devices for registration.

Configuring the DTLS Server

Context

CPEs and RRs set up control channels over DTLS connections for information exchange. In SD-WAN scenarios, the device needs to be configured as a DTLS server only when it functions as an RR or RR-CPE. If the device functions as a CPE and is configured as a DTLS server, it cannot work properly.

Only ARs running V600 support this function.

Procedure

Choose Plan > Provision > Device Configuration > Single Device Configuration from the main menu.
Select the device to configure and choose Base Configuration > DTLS Server from the navigation pane.
Click Create. In the DTLS server Cipher Suite window, select the encryption suite to be used by the server.
For security purposes, you are advised not to use the weak security algorithm or weak security protocol provided by this feature.
Click OK.

Parameter Description

Table 2-468 DTLS server parameters

Parameter	Description
ecdhe_rsa_aes256_gcm_sha384	Indicates the ecdhe_rsa_aes256_gcm_sha384 cipher suite. The ecdhe_rsa_aes256_gcm_sha384 cipher suite uses the ECDHE RSA algorithm to compute the key, the 256-bit AES_GCM to encrypt data, and the SHA2-384 algorithm to compute the MAC.
ecdhe_rsa_aes128_gcm_sha256	Indicates the ecdhe_rsa_aes128_gcm_sha256 cipher suite. The ecdhe_rsa_aes128_gcm_sha256 cipher suite uses the ECDHE RSA algorithm to compute the key, the 128-bit AES_GCM to encrypt data, and the SHA2-256 algorithm to compute the MAC.
rsa-with-aes-128-sha (Insecure encryption algorithm. You are advised to use a more secure encryption algorithm)	Indicates the rsa_aes_128_sha256 cipher suite. The rsa_aes_128_sha256 cipher suite uses the RSA algorithm to compute the key, the 128-bit AES_CBC to encrypt data, and the SHA2-256 algorithm to compute the MAC. This encryption suite uses an insecure encryption algorithm. You are advised to use a more secure encryption algorithm.

Configuring SSH

iMaster_NCE-Campus allows users to configure a device as a Secure Shell (SSH) server, so that clients can set up secure connections with the SSH server for remote management.

Context

SSH is a cryptographic network protocol for operating network services (such as remote access and file transfer) securely over an unsecured network. SSH uses TCP to exchange data, building secure connections over TCP. In addition to the standard well-known service port (port 22), SSH supports other non-well-known service ports, using which can effectively survive attacks.

ssh server hmac command: An SSH server and a client need to negotiate an HMAC algorithm for the packets exchanged between them. iMaster_NCE-Campus can issue this command to configure an HMAC algorithm list for the SSH server.
ssh server key-exchange command: An SSH server and a client need to negotiate a key exchange algorithm for the packets exchanged between them. iMaster_NCE-Campus can issue this command to configure a key exchange algorithm list for the SSH server.

Only LSWs, firewalls, and ARs running V600 support this function.

Procedure

Choose Plan > Provision > Device Configuration > Single Device Configuration from the main menu.
Select the device to configure and choose Base Configuration > SSH from the navigation pane.
Click the HMAC Settings tab and configure authentication algorithms for the SSH server.
Set SHA1 96, SHA2 256, and SHA2 256 96. For security purposes, you are advised to use the HMAC algorithm SHA2_256, which is more secure.
Click the Key Exchange Algorithm tab and configure the key exchange algorithms that can be used on the SSH server.
Set Diffie Hellman Group14 SHA1 Algorithm, Diffie Hellman Group1 SHA1 Algorithm, and Diffie Hellman Group exchange SHA1 Algorithm.

By default, the SSH server uses the dh_group_exchange_sha256, dh_group16_sha512, and curve25519_sha256 key exchange algorithms. Diffie Hellman Group14 SHA1 Algorithm, Diffie Hellman Group1 SHA1 Algorithm, and Diffie Hellman Group exchange SHA1 Algorithm are insecure and are disabled by default. Exercise caution when using these algorithms.
Click the SSH server enable tab and enable the IPv4 or IPv6 STelnet service on the SSH server. Firewalls support only the IPv4 STelnet service when they function as SSH servers.
Click the Source Interface Configuration tab and configure all valid interfaces as IPv4/IPv6 source interfaces of the SSH server.
Click the Configure SSH server port tab and change the port checked by an IPv4 SSH server.

Parameter Description

Table 2-469 SSH parameters

Parameter	Option	Description
HMAC Settings	SHA1 96 (Insecure algorithm, please operate with caution.) SHA2 256 SHA2 256 96 (Insecure algorithm, please operate with caution.)	HMAC algorithm list of an SSH server. After an SSH server receives a packet from an SSH client, the server matches the algorithm list of the client against its local list and uses the first matching algorithm. If no matching algorithm exists, the negotiation fails.
Key Exchange Algorithm	Diffie Hellman Group14 SHA1 Algorithm (Insecure algorithm, please operate with caution.) Diffie Hellman Group1 SHA1 Algorithm (Insecure algorithm, please operate with caution.) Diffie Hellman Group exchange SHA1 Algorithm (Insecure algorithm, please operate with caution.)	Key exchange algorithm list of an SSH server. After an SSH server receives a packet from an SSH client, the server matches the key exchange algorithm list of the client against its local list and uses the first matching key exchange algorithm. If no matching key exchange algorithms exist, the negotiation fails.
SSH Server Enable	STelnet IPv6 service enable STelnet IPv4 server enable	Whether to enable the IPv4 or IPv6 STelnet service on the SSH server. Clients can set up STelnet connections with the SSH server only after the STelnet service is enabled on the SSH server. NOTE: Only the IPv4 STelnet service can be enabled on firewalls when they function as SSH servers.
Source Interface Configuration	All IPv6 interfaces enable All IPv4 interfaces enable	Whether to configure all IPv4 or IPv6 interfaces as source interfaces.
Configure SSH server port	User can change the number of the port monitored by the IPv4 SSH server	Port used by the SSH server to connect to clients through the IPv4 STelnet service.

Configuring Telnet

Context

If one or more devices need to be configured and managed, you do not need to connect your terminal to each of the devices for local maintenance. If you have obtained the IP addresses of the devices and it is not the first time for you to log in to the devices, you can use Telnet to log in to the devices from the user terminal and perform remote device configuration. This method allows you to maintain multiple devices using a single user terminal, greatly facilitating operations.

Telnet has security risks. Exercise caution when using Telnet.
Only ARs running V600 support this function.

Prerequisites

An interface has been created.

Procedure

Choose Plan > Provision > Device Configuration > Single Device Configuration from the main menu.
Select the device to be configured and choose Base Configuration > Telnet from the navigation pane.
Click the Telnet Server Configuration tab and choose whether to enable the Telnet service.
Click the Source Interface Configuration tab, click Create, and enter a source interface number.
Click OK.

Parameter Description

Table 2-470 Telnet parameters

Parameter	Description
Telnet Server Configuration	Telnet Service Enable (Telnet is an insecure protocol, please operate with caution.)	Whether to enable the Telnet service. A Telnet server can be connected by clients through Telnet only when it has the Telnet service enabled. enable: enables the IPv4 Telnet service on the server. disable: After the Telnet service is disabled on the server, all clients that log in to the server through Telnet are disconnected.
Telnet IPv6 Service Enable (Telnet is an insecure protocol, please operate with caution.)	Whether to enable the Telnet service. A Telnet server can be connected by clients through Telnet only when it has the Telnet service enabled. After the Telnet service is disabled on the server, all clients that log in to the server through Telnet are disconnected. enable: enables the IPv6 Telnet service. disable: disables the IPv6 Telnet service.
Source Interface Configuration	Source Interface	Source interface for a Telnet server. Authorized users are allowed to log in to the Telnet server only through this interface. Before setting this parameter, ensure that you have created an interface and configured an IP address for the interface.

Parameter

Description

Telnet Server Configuration

Telnet Service Enable (Telnet is an insecure protocol, please operate with caution.)

Whether to enable the Telnet service. A Telnet server can be connected by clients through Telnet only when it has the Telnet service enabled.

enable: enables the IPv4 Telnet service on the server.
disable: After the Telnet service is disabled on the server, all clients that log in to the server through Telnet are disconnected.

Telnet IPv6 Service Enable (Telnet is an insecure protocol, please operate with caution.)

Whether to enable the Telnet service. A Telnet server can be connected by clients through Telnet only when it has the Telnet service enabled. After the Telnet service is disabled on the server, all clients that log in to the server through Telnet are disconnected.

enable: enables the IPv6 Telnet service.
disable: disables the IPv6 Telnet service.

Source Interface Configuration

Source Interface

Source interface for a Telnet server. Authorized users are allowed to log in to the Telnet server only through this interface.

Before setting this parameter, ensure that you have created an interface and configured an IP address for the interface.

Configuring VTY

Context

To locally or remotely maintain a device using Secure Shell (SSH), Telnet, or STelnet, you can configure a virtual type terminal (VTY) user interface as needed.

A VTY is a virtual port. When SSH, Telnet, or STelnet connections are established between terminals and devices, VTY connections are established for users to log in to the devices.

When configuring a VTY ACL to restrict user login, you need to permit IP address 127.0.0.1. Otherwise, iMaster NCE-Campus will fail to log in to devices through reverse SSH.
Only ARs and firewalls running V600 support this function.

When a user logs in to a device, the device allocates the idle user interface with the smallest number to the user based on the user's login mode. User interfaces are numbered in either of the following methods:

Table 2-471 Absolute and relative numbers of user interfaces

User Interface	Description	Absolute Number	Relative Number
VTY user interface	Manages and controls users who log in to the device using SSH, Telnet, or STelnet.	34–54	The first VTY user interface is VTY 0, the second VTY user interface is VTY 1, and so on. By default, VTY 0 to VTY 4 are available. Absolute numbers 34 to 54 correspond to relative numbers VTY 0 to VTY 20, respectively, on AR devices.

User Interface

Description

Absolute Number

Relative Number

VTY user interface

Manages and controls users who log in to the device using SSH, Telnet, or STelnet.

34–54

The first VTY user interface is VTY 0, the second VTY user interface is VTY 1, and so on. By default, VTY 0 to VTY 4 are available.

Absolute numbers 34 to 54 correspond to relative numbers VTY 0 to VTY 20, respectively, on AR devices.

Prerequisites

The tenant administrator has completed the SD-WAN network deployment. Devices have been managed.
The maximum number of VTY user interfaces has been set to a value greater than 5.
```
user-interface maximum-vty number
```
Run the save command to save the configuration.

Procedure

Choose Plan > Provision > Device Configuration > Single Device Configuration from the main menu.
Select the device to configure and choose Base Configuration > VTY from the navigation pane.
Click Create. In the VTY window that is displayed, set global VTY attributes.
Set VTY ID.
Set Authentication Mode. You can select aaa.
(Optional) Configure ACL-based login control for a VTY user interface. For details, see Configuring an IPv4 ACL and Configuring an IPv6 ACL.
- Set ACL Inbound Identity for IPv4 or ACL Inbound Identity for IPv6 to restrict users with a specified IPv4 address or within a specified IPv4 address segment from logging in to the device.
- Set ACL Outbound Identity for IPv4 or ACL Outbound Identity for IPv6 to restrict users who have logged in to the device from logging in to other devices.
  - The current device allows access from other devices if the permit action is specified in the ACL and denies access from other devices if the deny action is specified in this ACL.
  - Users who have logged in to the current device can access other devices if the permit action is specified in the ACL and cannot access other devices if the deny action is specified in this ACL.
Set VTY Protocol Inbound Name. The value can be set to all, ssh, or telnet.
Click OK.

Parameter Description

Table 2-472 VTY parameters

Parameter	Description	Value Range
VTY ID	Absolute number of a VTY user interface. Absolute numbers 34 to 54 map relative numbers VTY 0 to VTY 20, respectively. When configuring VTY 0 to VTY 4, you can only select SSH as the inbound protocol. To configure VTY 5 to VTY 20, you need to manually change the maximum number of VTY user interfaces on the device.	34–54
Authentication Mode	Authentication mode for user interface login.	aaa
ACL Inbound Identity for IPv4	ACL-based login control for a VTY user interface. ACL Inbound Identity for IPv4 restricts users with a specified address or within an address segment from logging in to the device. ACL Outbound Identity for IPv4 restricts users who have logged in to the device from logging in to other devices.	-
ACL Outbound Identity for IPv4		-
ACL Inbound Identity for IPv6	ACL-based login control for a VTY user interface. ACL Inbound Identity for IPv6 restricts users with a specified address or within an address segment from logging in to the device. ACL Outbound Identity for IPv6 restricts users who have logged in to the device from logging in to other devices.	-
ACL Outbound Identity for IPv6		-
VTY Protocol Inbound Name	Access type of local users.	The value can be set to all, ssh, or telnet.

Configuring TTY

Context

A True type terminal (TTY) user interface manages and monitors users who log in using TTY.

Only LSWs running V600 support this function.

Procedure

Choose Plan > Provision > Device Configuration > Single Device Configuration from the main menu.
Select the device to be configured and choose Basic Configuration > TTY from the navigation pane.
Click the Console tab and configure the authentication mode.

Parameter Description

Table 2-473 TTY parameters

Parameter	Description
Auth mode	None Password AAA Init	Authentication mode for TTY login users: None: indicates that no authentication is performed. Password: indicates that password authentication is performed. AAA: indicates that AAA authentication is used. Init: indicates that the authentication mode is revoked.

Parameter

Description

Auth mode

None
Password
AAA
Init

Authentication mode for TTY login users:

None: indicates that no authentication is performed.
Password: indicates that password authentication is performed.
AAA: indicates that AAA authentication is used.
Init: indicates that the authentication mode is revoked.

System Management

Configuring LLDP

Context

Link Layer Discovery Protocol (LLDP) is a Layer 2 discovery protocol defined in the IEEE 802.1ab standard. By running LLDP, a device can obtain Layer 2 information about all connected devices, for example, the interface types of a device and device interconnection information. If no LLDP is deployed, most network management software can obtain only Layer 3 information. LLDP enables a larger network management scope and provides more detailed network topology and interface change information.

To view the Layer 2 link status between network devices and analyze the network topology, you need to enable LLDP globally.

Prerequisites

Devices have been added to the controller.

Global LLDP can be disabled on a device only when LLDP is disabled both for the site where the device resides (on the Site Configuration page) and for the device on the Single Device Configuration page.

Procedure

Choose Plan > Provision > Device Configuration > Single Device Configuration from the main menu.
Select the device to be configured and choose System Management > LLDP from the navigation pane.
Click the LLDP tab and select Open to enable LLDP globally. After LLDP is enabled globally, all interfaces on the device have LLDP enabled. That is, all interfaces will exchange information with neighbors through LLDP frames.
Click the Interface LLDP tab and click Create in the upper right corner. On the Global page, select the interface where LLDP needs to be enabled and set LLDP Enable to Open, CDP Enable to Open, and MED Enable to Open.
Click OK.

Parameter Description

Table 2-474 LLDP parameters

Parameter	Description
Global LLDP enable	After LLDP is enabled globally, LLDP is enabled on all interfaces by default. An interface can send and receive LLDP frames only when LLDP is enabled globally and on the interface. LLDP is disabled on all interfaces after LLDP is disabled globally. The operation of enabling or disabling LLDP on an interface does not take effect when LLDP is disabled globally.
Interface name	Name of a physical interface on which LLDP is to be enabled.
LLDP Enable	Whether to enable LLDP on an interface.
CDP Enable	Operating mode of an LLDP-enabled interface. After this function is enabled, an LLDP-enabled interface works in TxRx mode, that is, it can send and receive LLDP frames.
MED Enable	Whether to configure the interface to advertise MED TLVs. By default, an interface does not advertise the MED Network Policy TLV, but the MED Network Policy TLV is enabled.

Configuring NTP

Context

When a device reports performance data, it carries timestamps in packets. If the time on the device and iMaster NCE-Campus is inconsistent, the time in performance data is inconsistent with the actual time. As a result, the site traffic and quality data cannot be displayed. To ensure time consistency, you need to configure NTP on iMaster NCE-Campus.

Prerequisites

A device has been added.

Procedure

Choose Plan > Provision > Device Configuration > Single Device Configuration from the main menu.
Select the device to be configured and choose System Management > NTP from the navigation pane.
Click the Address Family tab, click Create, and select the protocol type of an address family.
Click the Auth Config tab.
1. Enable or disable authentication as needed. To ensure time reliability on the network, enable NTP authentication.
2. Click the NTP Authentication tab, click Create, and configure an NTP authentication key.
  The HMAC-SHA256 algorithm is recommended for NTP key authentication because it provides higher security than the MD5 algorithm.
Click the NTP Client tab, click Create, and configure authentication in NTP client mode.
Click the clock tab, click Create, and set the local clock as the NTP master clock from which other devices synchronize their clocks.
Click the access-control tab, click Create, and configure access authority.
Set access-level to configure NTP access authority on the local router.

Select IPv4 ACL or IPv6 ACL to specify a basic ACL.
Click OK.

Parameter Description

Table 2-475 Parameters for configuring NTP

Parameter			Description
Address family	Family type		Set this parameter to IPv4 or IPv6 based on the actual situation.
Auth config	Auth enable		Whether to enable the authentication function. If NTP authentication is enabled on the NTP server, the authentication function must also be enabled on NTP clients. Otherwise, clock synchronization cannot be performed.
	NTP authentication keyID		Key ID used for NTP authentication.
	NTP authentication mode		Authentication mode, which can be MD5 or HMAC-SHA256. The authentication mode selected here must be the same as that enabled on the NTP server. HMAC-SHA256 is recommended, because it is more secure than MD5.
	NTP authentication key value		Key used for NTP authentication.
NTP client	NTP server address		IP address of the NTP server.
	Type		Type of the NTP server. The value can be Peer or Server.
	Vpn name		VPN instance bound to the NTP server.
	Address family		Select IPv4 or IPv6 based on the server type.
	Interface		Source interface used by the device to send NTP packets.
	Preferred		Whether to set this NTP server as the preferred one.
	Authentication ID		Key ID used for NTP authentication.
clock	local-addr		IP address of the local clock, in the format of 127.127.1.u. The value of u ranges from 0 to 3, indicating the NTP process ID. When no IP address is assigned, the local clock at 127.127.1.0 is set as the default NTP master clock. The IP address must be a local address and cannot be a loopback address, host address, multicast address, or broadcast address.
clock	stratum		Stratum of the NTP master clock. The value is an integer in the range from 1 to 15. The default value is 8. A smaller value indicates higher clock accuracy.
access-control	access-level	Peer	Maximum access authority. The remote end can perform time requests and control queries for the local NTP service. The local clock can also be synchronized with the clock of the remote server. If the action in the ACL for a source IP address is set to permit: The local clock can be synchronized with the peer clock. The peer clock can be synchronized with the local clock.
		Query	Minimum access authority. The remote end can perform only control queries for the local NTP service.
		Server	Allowed server access and query. The remote end can perform time requests and control queries for the local NTP service. The local clock cannot be synchronized with the clock of the remote server. If the action in the ACL for a source IP address is set to permit: The local clock cannot be synchronized with the peer clock. The peer clock can be synchronized with the local clock.
		Synchronization	Allowed server access. The remote end can perform time requests for the local NTP service. The local clock cannot be synchronized with the clock of the remote server. If the action in the ACL for a source IP address is set to permit: The local clock cannot be synchronized with the peer clock. The peer clock can be synchronized with the local clock.
		Limited	Controlled incoming packet rate. A kiss code is sent when Kiss-o'-Death (KoD) is enabled.
	acl4-identity		Number of an IPv4 ACL.
	acl6-identity		Number of an IPv6 ACL.

Configuring a Time Zone

Context

Configure a time zone for devices based on the time zone where the devices are located. If no time zone is set, the default time zone is used.

Only ARs and firewalls running V600 and NE devices support this function.

Prerequisites

A device has been added.

Procedure

Choose Plan > Provision > Device Configuration > Single Device Configuration from the main menu.
Select the device to be configured and choose System Management > Time Zone from the navigation pane.
Click the Time Zone tab and configure the UTC time for the device.
(Optional) Click the Daylight Saving Time tab and configure daylight saving time (DST).
Click Commit.

Parameter Description

Table 2-476 Time zone parameters

Parameter		Description
Time zone		Time zone where the device is located.
Daylight Saving Time	Name	Name of the DST zone.
	Type	DST type: OneYear: indicates that the DST takes effect within one year. Repeat-date and Repeat-week: indicate that the DST takes effect at a regular basis.
	Start year	Year when the DST starts to take effect.
	Start month	Month when the DST starts to take effect.
	Start time	Time when the DST starts to take effect.
	End year	End year of the DST.
	End month	End month of the DST.
	End time	End time of the DST.
	Offset	DST offset.

Configuring an SNMP User

Context

The Simple Network Management Protocol (SNMP) is a standard network management protocol widely used on UDP networks. It uses a central computer, that is the network management station (NMS), that runs network management software to manage network elements. Three SNMP versions are available — SNMPv1, SNMPv2c, and SNMPv3. One or more versions can be configured as required.

An SNMP managed network consists of the following three roles:

NMS: sends various packets to query managed devices and receives alarms from these devices.
Agent: is a network-management process on a managed device. An agent has the following functions:
- Receives and parses query messages sent from the NMS.
- Reads or writes management variables based on the query type and generates and sends response messages to the NMS.
- Sends alarms to the NMS when an event occurs. For example, the system view is displayed or closed, or the device is restarted. Protocol modules on the device define the conditions that lead to the alarms.
Managed device: is managed by an NMS and generates and reports alarms to the NMS.

Only LSWs, firewalls, and ARs running V600 support this function.

Procedure

Choose Plan > Provision > Device Configuration > Single Device Configuration from the main menu.
Select the device to be configured, choose System Management > SNMP Configuration from the navigation pane, and enter basic SNMP information.

If SNMPv3 is enabled, perform the following steps to configure an SNMPv3 user group and an SNMPv3 user.
Click the MIB view tab and create an MIB view.
Click the SNMPv3 group tab, click Create, and create an SNMPv3 user group. This operation maps SNMP users to the SNMP view, binds the SNMP group to an MIB view, and defines the permission (read-only, read-write, and notification) of the MIB view.
Click the USM User tab, click Create, create an SNMPv3 user to implement access control, and identity authentication and encryption using the local processing module and user-based security model (USM).
Click the Community Configuration tab, click Create, and create a read/write community name and an ACL.

Parameter Description

Table 2-477 Parameters for configuring an SNMP user

Parameter		Description
SNMP Configuration	SNMP Agent Switch	Whether to enable the SNMP agent function. An SNMP agent is a process running on a managed device. It maintains data on the managed device, responds to requests from the NMS, and reports management data to the NMS. To configure SNMP on a device, the SNMP agent must be enabled. Open: enables the SNMP agent function. Close: disables the SNMP agent function.
	Supported Versions	SNMP version to be used. v2c: enables SNMPv2c which supports access control based on community names and based on MIB views. v3: enables SNMPv3. In addition to access control based on community names and based on MIB views, SNMPv3 supports user groups, access control based on user groups or users, and authentication and encryption. v2c and v3: Features in SNMPv2c and SNMPv3 are supported.
	Bind all IPv4 interface	Open: enables the device to listen on all IPv4 interfaces. Close: disables the device from listening on all IPv4 interfaces.
	Password minimum length	Minimum length of a user password.
	Enable user password complexity check	After the password complexity check function is enabled, the configured user password must meet the complexity check requirements. If this function is disabled, the device does not check whether the password meets the complexity requirements. For security purposes, you are advised to enable password complexity check. Open: The password complexity check is enabled. Close: The password complexity check is disabled.
	Enable community name complexity check	After the community name complexity check is enabled, a configured community name must meet complexity requirements. If this function is disabled, the device does not check whether the password meets the complexity requirements. If the configured community name is simple and does not meet complexity requirements, the device is vulnerable to attacks and cracking by unauthorized users, affecting device security. Therefore, you are advised to enable community name complexity check. Open: enables community name complexity check. Close: disables community name complexity check.
	System contact information	Contact information about the SNMP device.
	System location information	Physical location of the SNMP device.
SNMPv3 group	Group name	Name of an SNMP group.
	Security level	SNMPv3 provides authentication and encryption through the USM. SNMPv3 defines the following three security levels: authentication,no privacy(There are safety risks, so it is not recommended to choose): indicates that packets are authenticated but not encrypted. noAuthNoPriv: indicates that packets are neither authenticated nor encrypted. Authentication and privacy: Packets are authenticated and encrypted. NOTE: For security purposes, you are advised to set the security level of an SNMP group to authentication and privacy.
	Readview	MIB view on which users in the group have the read-only permission.
	Writeview	MIB view on which users in the group have the read-write permission.
	Notifyview	MIB view on which users in the group have the notification permission.
	Basic ACL Identify	ACL corresponding to the user group.
MIB view	View name	MIB view name. If both the whitelist A and the blacklist B are configured in the MIB view, subtrees that are included in the whitelist A but not included in the blacklist B take effect in the MIB view.
	WhiteList	Included MIB subtrees.
	BlackList	Excluded MIB subtrees.
USM user	USM user name	Name of an SNMPv3 user.
	Group name	Name of the group to which a user belongs. The value must be the name of an existing SNMPv3 group.
	Authentication protocol	Authentication algorithm used by an SNMPv3 user. The options are as follows: NOTE: SHA2-256 and more complex algorithms are more secure than SHA2-224, SHA, and MD5, and are therefore recommended. NOAUTH(You are advised to use a secure authentication mode.): No authentication is performed. MD5(Insecure protocol. You are advised to use a secure authentication mode.): Hashed Message Authentication Code for Message Digest 5-96 (HMAC-MD5-96) is used. sha(Insecure protocol. You are advised to use a secure authentication mode.): HMAC-SHA-96 is used. sha2-224: HMAC-SHA2-224 is used. sha2-256: HMAC-SHA2-256 is used. sha2-384: HMAC-SHA2-384 is used. sha2-512: HMAC-SHA2-512 is used.
	Authentication password	Authentication password.
	Encryption protocol	Encryption algorithm used by an SNMPv3 user. NOTE: AES128 and other algorithms with higher encryption security are more secure than DES56 and 3DES168, and therefore are recommended. NOPRIV(You are advised to use a secure authentication mode.): indicates that no encryption is performed. DES56(Insecure protocols. AES128 and higher encryption algorithms are recommended.): indicates that the Data Encryption Standard 56 (DES56) encryption algorithm is used. 3DES168(Insecure protocols. AES128 and higher encryption algorithms are recommended.): indicates that the Triple Data Encryption Standard 168 (3DES168) encryption algorithm is used. aes128: indicates that the Advanced Encryption Standard 128 (AES128) encryption algorithm is used. aes192: indicates that the Advanced Encryption Standard 192 (AES192) encryption algorithm is used. aes256: indicates that the Advanced Encryption Standard 256 (AES256) encryption algorithm is used.
	Encryption password	Encryption password. When the user password complexity check is disabled, the password can contain 1 to 432 characters. When the user password complexity check is enabled or not configured, the password length must be greater than or equal to the minimum SNMP password length. The default minimum SNMP password length is 8.
Community Configuration	Alias name	Alias of a community name. It is saved in simple text in the configuration file. The alias of a community name must be unique and differs from the community name. Only one alias can be configured for a community name.
	Community security name	Community name.
	Access right	read: indicates that the community with the specified name has the read-only permission in the specified MIB view. write: indicates that the community with the specified name has the read-write permission in the specified MIB view.
	Basic ACL Identify	Number of the ACL matching the community name.

Configuring the SNMP Trap Function

Context

You can configure devices to send specified SNMP traps to an NMS to facilitate fault locating.

Only ARs and firewalls running V600 support this function.

Procedure

Choose Plan > Provision > Device Configuration > Single Device Configuration from the main menu.
Select the device to be configured, choose System Management > SNMP Trap Configuration from the navigation pane, enable the trap function, and configure the source interface of trap messages.
Click the Target host tab, click Create, and configure the target host that receives trap messages.
Click the Feature alarm message configuration tab, click Create, and configure the features whose trap messages need to be sent by the device to the NMS.

Parameter Description

Table 2-478 Parameters for configuring the SNMP trap function

Parameter		Description
SNMP Trap Configuration	Supported versions	The SNMP version used by a device must be the same as that used by the trap host.
	Trap source interface name	Type and number of the source interface on a server that sends SNMP traps.
	SNMP protocol level ACL	ACL for SNMP that takes effect globally. The value is a string of 1 to 64 characters.
	Enable all feature alarm switch	Enable: enables the trap function for all modules. To configure a device to send traps for all features, the target host for receiving SNMP traps must be configured on the device at the same time, so that the device knows where to send traps.
Target host	Target host name	Name of an SNMP target host. The value is a string of 1 to 32 characters without spaces.
	Address domain	Whether to use UDP to transmit trap messages.
	Network address	Address of the target host that receives SNMP messages.
	Notify type	Notification type. The options are as follows: Trap: trap messages Inform: inform messages
	VPN Instance name	Name of a VPN instance. The value is a string of 1 to 31 case-sensitive characters without spaces. The value must be the name of an existing VPN instance.
	Enable Public Net-manager	Whether to connect to the trap host on the public network.
	UDP port number	Port number used by the target host to receive trap messages.
	Interface name	Source interface that sends trap messages.
	Security model parameters	SNMP protocol version. Security model SNMPv3: configures SNMPv3. Security model v2c: configures SNMPv2c. SNMPv3 is recommended, because it is more secure than SNMPv2c.
	Security name	SNMPv2c security name.
	Usm name	Security name for an SNMPv3 user.
	Security level	Authentication and encryption mode. no authentication,no privacy(There are safety risks, so it is not recommended to choose.): This mode applies to secure networks with fixed administrators. authentication,no privacy(There are safety risks, so it is not recommended to choose.): Only authenticated administrators can access the device. This mode is applicable to secure networks managed by many administrators who may frequently perform operations on the same device. authentication and privacy: In this mode, only the authenticated administrators can access the device, and transmitted data is encrypted. This mode is applicable to insecure networks managed by many administrators who may frequently perform operations on the same device.
	Interface name	Interface of the target host.
Feature alarm message configuration	Feature name	Name of a feature that generates traps. The value is a string of 1 to 32 uppercase letters. Run the display snmp-agent trap all command using the entry query function to check the trap information. For details about how to specify parameters for query after a feature (for example, BGP) is selected, see Viewing Entries on an AR.
	Alam name	Name of an alarm module. The value must be a string of 1 to 63 characters. Run the display snmp-agent trap all command using the entry query function to check the trap information. For details about how to specify parameters for query after a trap (for example, bgpBackwardTransNotification) is selected, see Viewing Entries on an AR.
	status	Whether to enable the trap function for the module.

Configuring Syslog

Prerequisites

The tenant administrator has completed the deployment configuration, and devices have been successfully managed by the controller.
A physical interface has been configured.
A VPN instance has been configured.

Context

If an exception or a fault occurs on a device, you need to immediately collect accurate information generated during device operation. You can configure syslog to classify or filter information generated by the device based on the information type and severity level so that you can flexibly control information output. After configuring syslog on the device, you can view information saved on the log host to monitor the device's running status and locate faults.

Only ARs running V600 support this function.

Procedure

Choose Plan > Provision > Device Configuration > Single Device Configuration from the main menu.
Select the device to be configured and choose System Management > Syslog from the navigation pane.
Click the Global parameter tab and configure global syslog attributes.
1. Interface name: specifies the source interface used by the device to output logs to the log host.
2. Log buffer size: specifies the log buffer size, that is, the number of logs that cannot be buffered.
3. Log timestamp: specifies the timestamp format of the output logs.
4. Debug timestamp: specifies the timestamp format of the output debugging messages.
Click the Server tab and configure a syslog log host.
1. Ip address: specifies the address type of the log host, which can be IPv4 or IPv6. After selecting the address type, you can set the IP address of the log host.
2. VPN name: specifies the VPN instance where the log host belongs.
3. Channel id: specifies the channel ID of the log host.
Click Info center source and configure a rule for filtering syslog messages.
1. Module name: specifies the module on which the filtering rule takes effect.
2. Channel id: specifies the ID of the channel used by the device to output logs to the log host.
3. Enable log level: specifies the severity level of the logs to be output to the log host. The logs at and above the selected level will be output to the log host.

Parameter Description

Table 2-479 Parameters for configuring syslog

Parameter		Description
Global parameter	Interface name	Source interface used by the device to output information to the log host.
	Log buffer size	Number of logs that can be buffered.
	Log timestamp	Timestamp format of the output logs. Boot: indicates that the timestamp is the period of time elapsed since the system startup. Date: indicate that the timestamp is the current system date and time. Short-date: indicates that the timestamp uses the short date format. Format-date: indicates that the timestamp uses the YYYY-MM-DD hh:mm:ss format.
	Debug timestamp	Timestamp format for debugging messages.
Server	Ip address	Address type and IP address of the log host.
	VPN name	VPN instance to which the log host belongs.
	Transport mode	Transmission protocol of the log host. udp: UDP is used. tcp: TCP is used.
	Channel id	Channel ID of the log host.
Info center source	Module name	Module on which the filtering rule takes effect, for filtering information that does not need to be output to the log host through the specified channel. default: indicates that the filtering rule takes effect on all modules for the specified channel. For details about other module names, see Log Reference in the corresponding device documentation.
	Channel id	ID of the channel used by the device to output logs to the log host.
	Enable log level	Level of the logs to be output to the log host. You can select a level as required to output logs of this level or higher. emergencies: A fault that makes the device unable to run normally unless it is restarted. alert: A major fault that needs to be rectified immediately. critical: A fault that needs to be analyzed and processed. error: An improper operation that is performed or exceptions that occur during service processing. The fault does not affect services but needs to be analyzed. warning: An anomaly that occurs when the device is operating and requires attention because it may cause service processing faults. notification: A key operation that is performed to ensure normal operation of the device. informational: A common operation that is performed to ensure normal operation of the device. debugging: General information generated when the device is running properly, which is mainly the internal running status of the device.

Configuring a Local User Account

Context

The password policy of local users is vital to user security. Devices support the security policy for local user accounts, password complexity check, and password policy for local user accounts, preventing unauthorized users from logging in to devices and improving system security.

Only ARs and firewalls running V600 support this function.

Prerequisites

Devices have been added to the controller.

Procedure

Choose Plan > Provision > Device Configuration > Single Device Configuration from the main menu.
Select the device to be configured and choose System Management > Local User from the navigation pane.
Click the Local user tab. Then, click Create and configure a local user account.
Click the Password Policy tab and configure a password policy for the local user account.

Parameter Description

Table 2-480 Parameters for configuring a local user account

Parameter		Description
Local user	User name	Username of a local user account. After the security policy function is enabled for a local user account, the username must meet the following requirement: Username of a local user.
	Password type	irreversible-cipher: uses an irreversible secure encryption algorithm to encrypt the user password. When this parameter is set, unauthorized users cannot decrypt the passwords of authorized users, ensuring user security.
	Password	Password of a local user.
	Login timeout period(s)	Idle timeout period of a local user account, that is, time period after which a local user account is logged out of the UI. If the local user account has been idle for longer than the specified idle period, the user automatically goes offline.
	Login level	User level of a local user account. A larger value indicates a higher user level. After logging in to the device, a user can run only the commands of the same level or lower levels. Level 0 (visit level): Users at this level can run diagnosis commands such as ping and tracert commands and commands that are used to access a remote device (such as using STelnet). They have no permission to save configuration files. Level 1 (monitoring level): Users at this level can run commands for system maintenance, including display commands. They have no permission to save configuration files. Level 2 (configuration level): Users at this level can run commands used for service configuration, including routing commands and commands at each network layer to provide network services for users. Level 3 (management level): Users at this level can run commands used for basic system operations to support services, including commands concerned with file systems, FTP, Trivial File Transfer Protocol (TFTP), configuration file switching, slave board control, user management, and command level configuration. In addition, users at this level can also run commands for service fault diagnosis, such as debugging commands.
	HTTP service(Insecure protocol. You are advised to use a more secure service type.)	After you specify the access type of a user, the user can successfully log in only when the user uses the configured access type for login. To allow the local user account to log in to devices through HTTP, enable the HTTP service. NOTE: HTTP has security risks. Exercise caution when using HTTP.
	SSH service	After you specify the access type of a user, the user can successfully log in only when the user uses the configured access type for login. To allow the local user account to log in to devices through SSH, enable the SSH service.
	Telnet service(Insecure protocol. You are advised to use a more secure service type.)	After you specify the access type of a user, the user can successfully log in only when the user uses the configured access type for login. To allow the local user account to log in to devices through Telnet, enable the Telnet service. NOTE: Telnet has security risks. Exercise caution when using Telnet.
	Terminal service	After you specify the access type of a user, the user can successfully log in only when the user uses the configured access type for login. To allow the local user account to log in to devices through terminals, enable this service.
Password policy	Password expire days(d)	Password validity period. If the value is 0, the password is permanently valid.
Password policy	Password history record number	Maximum number of historical passwords that can be recorded for each user. For example, if the value is 5, the new password cannot be the same as the previous five passwords (including the current one).

Configuring PoE Management

Context

Power over Ethernet (PoE), also known as Power over LAN (PoL) or active Ethernet, provides electrical power through the Ethernet. PoE technology is used on the wired Ethernet and allows power to be transmitted to terminal devices through data pairs or unused pairs. A PoE-capable device can provide DC power supply for multiple terminal devices, facilitating centralized power supply management. The following table lists the devices that support PoE.

Table 2-481 Devices that support this feature

Series	Supported Product
S8700 series	S8700-10/S8700-4/S8700-6 Only the LSG7M24VX1E1, LSG7X48PX1E0, LSG7M48VX1E1, LSG7G48VX1E0 and LSG7M48VX1E0 support this function.

Series

Supported Product

S8700 series

S8700-10/S8700-4/S8700-6

Only the LSG7M24VX1E1, LSG7X48PX1E0, LSG7M48VX1E1, LSG7G48VX1E0 and LSG7M48VX1E0 support this function.

Procedure

Choose Plan > Provision > Device Configuration > Single Device Configuration from the main menu.
Select the device to be configured and choose System Management > PoE Manager from the navigation pane.
Click Create and configure the slot ID and port PoE information of the device.
Click OK.

Parameter Description

Table 2-482

Parameter		Description
Global	Position	Slot ID of the device.
Port	Power enable	Whether to enable PoE on a port.
	Power off time range	Port power-off time range.
	Legacy enable	Whether to enable the power sourcing equipment (PSE) to check the compatibility of power devices (PDs). If the device is enabled to check the compatibility of PDs, the ports can provide power to non-standard PDs, allowing high inrush current during power-on.
	Power on delay	Power supply delay on a port.
	Interface name	Device port selected for PoE management.

Configuring a Time Range

Context

A time range defines a special time range within which services take effect or expire. It includes periodic time ranges with the interval being one week and absolute time ranges. These time ranges determine service validity.

Only LSWs and firewalls running V600 support this function.

Procedure

Choose Plan > Provision > Device Configuration > Single Device Configuration from the main menu.
Select the device to be configured and choose System Management > Time Range from the navigation pane.
Click Create and configure the time range name, absolute time range, and periodic time range.
Click OK.

Parameter Description

Table 2-483 Parameters for configuring a time range

Parameter		Description
Global	Name	Name of a time range.
Absolute range	Start time	Start time of a time range.
Absolute range	End time	End time of a time range.
Period range	Day of week	Day on which a configured time range is valid.
	Start time	Start time of the time range.
	End time	End time of the time range.

Configuring Time Management

Context

System time is the current time that a device keeps track of and is recorded in timestamps of sent packets. Users in different regions can configure the system time according to their own country's or region's regulations. To calculate the current or local time, add or subtract the specified time zone offset from the Coordinated Universal Time (UTC). The time format of local logs on devices is UTC time±time zone offset.

Only LSWs running V600 support this function.

Procedure

Choose Plan > Provision > Device Configuration > Single Device Configuration from the main menu.
Select the device to be configured and choose System Management > Time Manager from the navigation pane.
Set parameters of the time zone options and time zone offset.

Parameter Description

Table 2-484 Parameters for configuring time management

Parameter	Description
Option	Whether an offset is added or subtracted. add: indicates adding an offset. The default value is add. mius: indicates subtracting an offset.
Timezone offset	Offset between the specified time zone value and UTC time value.

Parameter

Description

Option

Whether an offset is added or subtracted.

add: indicates adding an offset. The default value is add.
mius: indicates subtracting an offset.

Timezone offset

Offset between the specified time zone value and UTC time value.

Interface

Configuring Interface Management

Context

You can configure Layer 3 and Layer 2 interfaces for CPE gateways at sites to connect to the LAN. Interfaces of a device are used to exchange data and interact with other network devices. Interfaces are classified as physical or logical interfaces. You can configure interfaces of a device on the Single Device Configuration page.

Table 2-485 Interface types and description

Interface Type	Description
Physical interface	Management interface	Interface used for configuration and management, but not for service transmission.
Service interface	Interface used for service transmission. Layer 2 Ethernet interface: an interface working at the data link layer and processes Layer 2 protocol packets, implementing rapid Layer 2 forwarding. Layer 3 Ethernet interface: an interface working at the network layer. It processes Layer 3 protocol packets and implements the routing function. It can be configured with an IPv4 or IPv6 address.
Logical interface	Logical interfaces are manually configured and do not physically exist. They are responsible for transmitting service data. Logical interfaces include VLANIF interfaces, Eth-Trunk interfaces, Ethernet sub-interfaces, and Eth-Trunk sub-interfaces.

Interface Type

Description

Physical interface

Management interface

Interface used for configuration and management, but not for service transmission.

Service interface

Interface used for service transmission.

Layer 2 Ethernet interface: an interface working at the data link layer and processes Layer 2 protocol packets, implementing rapid Layer 2 forwarding.

Layer 3 Ethernet interface: an interface working at the network layer. It processes Layer 3 protocol packets and implements the routing function. It can be configured with an IPv4 or IPv6 address.

Logical interface

Logical interfaces are manually configured and do not physically exist. They are responsible for transmitting service data.

Logical interfaces include VLANIF interfaces, Eth-Trunk interfaces, Ethernet sub-interfaces, and Eth-Trunk sub-interfaces.

Prerequisites

A device has been added.

Eth-Trunk Requirements on Device Models

Table 2-486 Device models that support Eth-Trunk

Device Model	Eth-Trunk ID Range
AR5710-H8T2TS1, AR5710-H8T2TS1-T	0-7
AR6710-L50T2X4, AR6710-L26T2X4, AR6710-L8T3TS1X2, AR6710-L50T2X4-T, AR6710-L26T2X4-T, AR6710-L8T3TS1X2-T	0-15
AR8140-12G10XG, AR8140-T-12G10XG, AR8700-8	0-63
NetEngine 8000 M6, NetEngine 8000 M8, NetEngine 8000 M14, NE40E-X8A, NE40E-X3A, NetEngine 8000E M8, NetEngine 8000E M14, NetEngine 8000 M1A, NetEngine 8000 M1C, NetEngine A821 E NetEngine A813, NetEngine A813 E, NetEngine A822 E, NetEngine A831 E, NetEngine 8000 M1D-B, NetEngine 8000 F1A-8H20Q, NetEngine 8000 M4, NetEngine 8000 M8K, NetEngine 8000 M14K, NetEngine 8000E M14-Z, NetEngine 8000 F8, NetEngine 8000E F8, NetEngine 8000E F8-Z	0-65535
S16700-4, S16700-8, S8700-6, S8700-10, S6730-H-V2, S5732-H-V2	0-127

Procedure

Choose Plan > Provision > Device Configuration > Single Device Configuration from the main menu.
Select the device to configure and choose Interface Management > Interface Manager from the navigation pane.
Click Create and set global attributes of an interface.
Click the Bandwidth tab and configure the interface bandwidth.
Click the Interface physical attributes tab, and set the parameters such as the negotiation mode and working mode of the interface.
Click OK.

Parameter Description

Table 2-487 Interface parameters

Parameter		Description
Global	Interface name	Name of an interface, which is automatically generated based on Physical type and Interface number.
	Interface category	Type of an interface. The value can be Main interface or Sub-interface.
	Main interface name	Name of a main interface. When Interface category is set to Sub-interface, you need to configure a main interface.
	Physical type	Type of an interface. It can be a physical or logical interface.
	Interface number	Number of an interface, which must be consistent with that on the device.
	Interface type	Working mode of an interface. The value can be L3 or L2.
	VPN instance	VPN instance to which the interface belongs. If the interface belonging to a VPN instance is not bound to the VPN instance, the interface functions as a public network interface and cannot forward VPN data.
	Admin status	Interface administrative status. It can be up or down.
	Description	Description of an interface.
Bandwidth	Bandwidth Type	Bandwidth unit, kbit/s or Mbit/s.
Bandwidth	Bandwidth	Interface bandwidth.
Interface physical attributes	Negotiation mode	Auto-negotiation: The Ethernet interface works in auto-negotiation mode. Non-auto-negotiation: The Ethernet interface works in non-auto-negotiation mode.
	Combo mode	Whether an interface works as an optical or electrical interface. Only combo interfaces support both optical and electrical interface modes. You can select either of the two modes for combo interfaces based on networking requirements. For interfaces of other types, set this parameter based on the working mode supported by the interfaces. NOTE: If an interface cannot work as an optical interface but its working mode is set to the optical mode, the configuration fails to take effect after being delivered to the CPE where the interface is located.
	Duplex	Duplex mode of the interface. Interfaces on both ends of a link must have the same duplex mode. For optical interfaces, the duplex mode is fixed at the full duplex mode. For electrical interfaces, you can select the full-duplex or half-duplex mode according to the actual situation.
	Speed	Interface rate. If the negotiation mode is set to non-auto-negotiation, you need to manually set the interface rate. Interfaces on both ends of a link must have the same rate.
Eth-Trunk members	Interface name	Eth-Trunk member interface.

Activating a License on a Port

Context

You can bind an activated license to a port in a port group of a device.

Only LSWs running V600 support this function.

Procedure

Choose Plan > Provision > Device Configuration > Single Device Configuration from the main menu.
Select the device to be configured and choose Interface Management > Activated License Ports from the navigation pane.
Click Create, and configure the start and end ports to which licenses are bound, as well as the license type.
Click OK.

Parameter Description

Table 2-488 Parameters for activating a license on a port

Parameter	Description
Global	Start port name	Start port of a port group.
End port name	End port of a port group.
Activated license	License type	Type of the activated license. The value can be: 10G 25G 50G 100G 200G 400G 2.5G 5G

Parameter

Description

Global

Start port name

Start port of a port group.

End port name

End port of a port group.

Activated license

License type

Type of the activated license. The value can be:

10G
25G
50G
100G
200G
400G
2.5G
5G

Configuring FlexE

Context

Flexible Ethernet (FlexE) is an interface technology used to implement service isolation and network slicing on a bearer network. By eliminating the one-to-one mapping between the MAC and PHY layers, FlexE implements flexible and refined management of interface resources. This not only solves the problem of imbalance between different customers' service requirements and network capabilities, but also meets the requirements of some industries for hard pipe isolation and on-demand bandwidth allocation.

FlexE can help implement network slicing. Network slicing provides multiple logical networks (slices) on a shared network infrastructure. Each logical network serves a specific service type or industry user. Each network slice can flexibly define its logical topology, SLA requirements, reliability, and security level to meet differentiated requirements of different services, industries, and users.

As shown in the following figure, multiple routers use FlexE to transmit data. Each of a router's physical interfaces can be configured as multiple FlexE interfaces (logical interfaces). A FlexE interface is equivalent to a physical interface, and bandwidth resources are strictly isolated between FlexE interfaces. In this way, FlexE can be used to implement network slices for different services, achieving a secure, reliable network for multiple purposes.

Figure 2-163 Network slicing through FlexE

Only NE devices support FlexE.

Prerequisites

Devices have been added to the controller.

Procedure

Choose Plan > Provision > Device Configuration > Single Device Configuration from the main menu.
Select the device to be configured and choose Interface Management > FlexE from the navigation pane.
Click the Card attribute tab and configure a sub-timeslot granularity for a FlexE subcard. For example, set the sub-timeslot granularity for the subcard 15/11 to 1 Gbit/s.
Click the Enable port tab, configure a physical interface to work in FlexE mode, and configure a PHY number for the FlexE physical interface. For example, configure interface 0/11/0 to work in FlexE mode and set its PHY number to 1.
Click the FlexE group tab, create a FlexE group, set a group number, and add the FlexE physical interface to this group. For example, create FlexE group 1 (with index 1), set the group number to 1, and add interface 0/11/0 to this group.
Click the FlexE client tab, create a FlexE client, and configure a client ID and bandwidth for the client. For example, create FlexE client 1 (with index 1), bind it to FlexE group 1, set the FlexE port ID to 40, set the client ID to 1, and set the bandwidth to 2 Gbit/s.
Click OK, and then click Commit.

Parameter Description

Table 2-489 Parameters for configuring FlexE

Parameter			Description
Card attribute	Card position		Subcard number.
Card attribute	Slot granularity		Sub-timeslot granularity of a subcard. The default value is 5 Gbit/s. The sub-timeslot granularity of a FlexE client restricts the FlexE client's bandwidth configuration. If the bandwidth lower than 5 Gbit/s needs to be configured for a FlexE client, configure a sub-timeslot granularity for the subcard as required. The configuration rules are as follows: If the default sub-timeslot granularity (5 Gbit/s) is used, the bandwidth value of a FlexE client can be set to an integer multiple of 5 Gbit/s, such as 5 Gbit/s, 10 Gbit/s, or 15 Gbit/s. If the sub-timeslot granularity is set to 1 Gbit/s, the bandwidth value of a FlexE client can be set to 1 Gbit/s, 2 Gbit/s, 3 Gbit/s, 4 Gbit/s, or an integer multiple of 5 Gbit/s. If the sub-timeslot granularity is 1.25 Gbit/s, the bandwidth value of a FlexE client can be set to 1.25 Gbit/s, 2.5 Gbit/s, 3.75 Gbit/s, or integer multiple of 5 Gbit/s. NOTE: When the sub-timeslot granularity is 1.25 Gbit/s, only NE40Es are supported.
Enable port	Enable port	Port position	Interface number.
	Enable port	Enable	Whether to configure the physical interface to work in FlexE mode.
	Attribute	Phy-Number	Number of the FlexE physical interface in a FlexE group. This parameter is used to identify packets. This parameter value for FlexE clients on interconnected devices must be the same.
FlexE group	FlexE group	Index	Index of a FlexE group.
	FlexE group	Number	Number of the FlexE group. To ensure normal communication between the interconnected devices, configure the same number for FlexE groups on the two devices.
	Interface	Port position	Interface number. The specified FlexE physical interface is added to the created FlexE group.
FlexE client	FlexE client	Index	Index of a FlexE client.
		Group Index	FlexE group to which the client is to be bound.
		FlexE port ID	ID of a FlexE interface. You are advised to set a number beyond the range of 1000 to 3000 (this range is reserved for network slicing services). The port ID range varies according to the board model. For details about the port ID range supported by boards of different models, see section Configuration > Interface and Data Link > Interface Management Configuration > FlexE Interface Configuration > Creating a FlexE Client and Configuring an ID and Bandwidth for It in the NE product documentation.
		Client ID	Service ID of the FlexE client in the FlexE group. This parameter is used to identify packets. This parameter value for FlexE clients on interconnected devices must be the same.
		binding-type	If bandwidth is selected, the bandwidth of a FlexE client can be configured as needed.
	Bandwidth	Bandwidth	Bandwidth for the FlexE client, in Gbit/s. Configuration rules are as follows: If the default sub-timeslot granularity (5 Gbit/s) is used, the bandwidth value of a FlexE client can be set to an integer multiple of 5 Gbit/s, such as 5 Gbit/s, 10 Gbit/s, or 15 Gbit/s. If the sub-timeslot granularity is set to 1 Gbit/s, the bandwidth value of a FlexE client can be set to 1 Gbit/s, 2 Gbit/s, 3 Gbit/s, 4 Gbit/s, or an integer multiple of 5 Gbit/s. If the sub-timeslot granularity is 1.25 Gbit/s, the bandwidth value of a FlexE client can be set to 1.25 Gbit/s, 2.5 Gbit/s, 3.75 Gbit/s, or integer multiple of 5 Gbit/s. NOTE: When the sub-timeslot granularity is 1.25 Gbit/s, only NE40Es are supported. The bandwidth specified by this parameter must be less than the remaining bandwidth of the FlexE group to which the FlexE client is bound. Remaining bandwidth = FlexE interface bandwidth – Bandwidth sum of all FlexE clients.

Ethernet Switching Configuration

MAC Address Entry Configuration

A Media Access Control (MAC) address, also called a physical address, hardware address, or link address, is burned into the network interface card (NIC) of a network device by a vendor to uniquely identify the device's location.

Configuring a Static MAC Address Entry

Context

A device cannot distinguish packets from authorized and unauthorized users when it learns source MAC addresses of packets to maintain the MAC address table. This causes network risks. If an unauthorized user uses the MAC address of an authorized user as the source MAC address of attack packets and connects to another interface of the device, the device learns an incorrect MAC address entry. As a result, packets destined for the authorized user are forwarded to the unauthorized user. For security purposes, you can create static MAC address entries to bind MAC addresses of authorized users to specified interfaces. This prevents unauthorized users from intercepting data of authorized users.

Only LSWs running V600 support this function.

Prerequisites

Devices have been added.

Procedure

Choose Plan > Provision > Device Configuration > Single Device Configuration from the main menu.
Select the device to be configured and choose Ethernet Configuration > MAC Configuration > Static Mac address from the navigation pane.
Click Create. On the Static Mac address [Create] page that is displayed, set parameters in the Global area.
Click OK.

Parameter Description

Table 2-490 Parameters on the Static Mac address page

Parameter	Description
Interface name	Name of an outbound interface to be bound.
Vlan	VLAN to which an outbound interface belongs.
Address	Destination MAC address.

Configuring a BPDU MAC Address List

Context

By default, the device does not forward BPDUs at layer 2. When proprietary protocol packets of devices from other vendors need to be processed as BPDUs, you can configure the MAC addresses of these packets as BPDU MAC addresses. In this way, the device discards these packets with BPDU MAC addresses.

Prerequisites

A device has been added.

Procedure

Choose Plan > Provision > Device Configuration > Single Device Configuration from the main menu.
Select the device to be configured and choose Ethernet Configuration > MAC Configuration > BPDU MAC List from the navigation pane.
Click Create. On the page that is displayed, set BPDU MAC address parameters on the Global tab page.
Click OK. A BPDU MAC address is configured.

By default, the device has the following BPDU MAC addresses:

0180-c200-008a ffff-ffff-ffff
0180-c200-8585 ffff-ffff-ffff
010f-e200-0001 ffff-ffff-ffff
0100-0ccc-cccc ffff-ffff-ffff
0180-c200-0000 ffff-ffff-ffff
0180-c200-0001 ffff-ffff-ffff
0180-c200-0002 ffff-ffff-ffff
0180-c200-0003 ffff-ffff-ffff
0180-c200-0004 ffff-ffff-ffff
0180-c200-0005 ffff-ffff-ffff
0180-c200-0006 ffff-ffff-ffff
0180-c200-0007 ffff-ffff-ffff
0180-c200-0008 ffff-ffff-ffff
0180-c200-0009 ffff-ffff-ffff
0180-c200-000a ffff-ffff-ffff
0180-c200-000b ffff-ffff-ffff
0180-c200-000c ffff-ffff-ffff
0180-c200-000d ffff-ffff-ffff
0180-c200-000e ffff-ffff-ffff
0180-c200-000f ffff-ffff-ffff
0180-c200-0010 ffff-ffff-ffff
0180-c200-0011 ffff-ffff-ffff
0180-c200-0012 ffff-ffff-ffff
0180-c200-0013 ffff-ffff-ffff
0180-c200-0016 ffff-ffff-ffff
0180-c200-0017 ffff-ffff-ffff
0180-c200-0018 ffff-ffff-ffff
0180-c200-0019 ffff-ffff-ffff
0180-c200-001a ffff-ffff-ffff
0180-c200-001b ffff-ffff-ffff
0180-c200-001c ffff-ffff-ffff
0180-c200-001d ffff-ffff-ffff
0180-c200-001e ffff-ffff-ffff
0180-c200-001f ffff-ffff-ffff
0180-c200-0020 ffff-ffff-ffe0

Parameter Description

Table 2-491 Parameters for configuring a BPDU MAC address list

Parameter	Description	Value
MASK	Length of the BPDU MAC address.	The value is an integer from 1 to 48.

VLAN Configuration

Virtual Local Area Network (VLAN) technology logically divides a physical LAN into multiple broadcast domains, each of which is called a VLAN. Hosts within a VLAN can directly communicate with other hosts in the same VLAN but not with those in other VLANs. In this way, broadcast packets are confined within a single VLAN.

Configuring a VLAN

Context

On a complex network, VLANs can be created to isolate hosts that do not need to communicate with each other, with an aim to reduce broadcast domains and improve network security.

Prerequisites

Devices have been added.

Procedure

Choose Plan > Provision > Device Configuration > Single Device Configuration from the main menu.
Select the device to be configured and choose Ethernet Configuration > VLAN Configuration > VLAN from the navigation pane.
Click Create. On the VLAN [Create] page that is displayed, set parameters in the Global area.
Click OK.

Parameter Description

Table 2-492 Parameters on the VLAN page

Parameter		Description
Global	ID	VLAN ID.
	Name	VLAN name.
	Description	Configuration description.
	Unknown flow drop	Whether to enable unknown packet isolation in a VLAN. By default, unknown packet isolation is disabled in a VLAN.
IP subnet VLAN	Index	Start subnet number.
IP subnet VLAN	IP prefix	Source IP address or network segment with a mask to be associated with a VLAN.
ARP snooping	ARP snooping enable	Whether to enable ARP snooping. After ARP snooping is enabled, the device sends the received ARP packets to the CPU for processing, obtains the VLAN information of the ARP packets, and creates ARP snooping entries for recording user information.
MAC Address	Address	MAC address of the interface to be added to the VLAN.
	MAC type	Currently, only static MAC addresses can be configured.
	Out interface name	Interface whose MAC address is assigned to the VLAN.
DHCP snooping	DHCP snooping enable	Whether to enable DHCP snooping on an interface. When you set DHCP snooping enable to Open, DHCP snooping is enabled globally.
	DHCP snooping check user bind enable	Whether to enable the DHCP snooping check function.
	DHCP snooping alarm user bind enable	Whether to enable the DHCP snooping alarm function. After the alarm function is enabled, alarm messages are displayed if DHCP attacks occur and the number of discarded attack messages reaches the threshold.

Adding an Interface to a VLAN

Context

Interface-based VLAN assignment is the easiest and most effective method for assigning VLANs. After you add an interface to a VLAN, the interface can only forward packets from that VLAN. This limits broadcast packets to a single VLAN, as hosts in the same VLAN can directly communicate with each other at Layer 2, while those in different VLANs cannot.

VLAN Tag

A LAN can be divided into multiple VLANs, each of which is identified by a unique VLAN tag.

Each device that can identify VLAN tags identifies the VLAN to which a frame belongs based on the VLAN ID, and processes the frame based on whether it carries a VLAN tag and the specific VLAN tag value. Frames are classified into the following types based on whether they carry VLAN tags:

Tagged frame: a frame with a 4-byte VLAN tag.
Untagged frame: an original frame without a 4-byte VLAN tag.

Table 2-493 Types of VLAN interfaces

Type	Description
Access interface	An access interface often connects to a user terminal (such as a PC or server) that cannot or does not need to identify VLAN tags.
Trunk interface	A trunk interface often connects to a switch, router, AP, or voice terminal that can receive and send both tagged and untagged frames. It allows tagged frames of multiple VLANs but untagged frames from only the default VLAN to pass through.
Hybrid interface	A hybrid interface can connect to a terminal that cannot identify VLAN tags, or to a switch, router, AP, or voice terminal that can receive and send both tagged and untagged frames. It allows tagged frames of multiple VLANs. Depending on your configuration, frames sent out from a hybrid interface may be tagged or untagged.

Type

Description

Access interface

An access interface often connects to a user terminal (such as a PC or server) that cannot or does not need to identify VLAN tags.

Trunk interface

A trunk interface often connects to a switch, router, AP, or voice terminal that can receive and send both tagged and untagged frames. It allows tagged frames of multiple VLANs but untagged frames from only the default VLAN to pass through.

Hybrid interface

A hybrid interface can connect to a terminal that cannot identify VLAN tags, or to a switch, router, AP, or voice terminal that can receive and send both tagged and untagged frames.

It allows tagged frames of multiple VLANs. Depending on your configuration, frames sent out from a hybrid interface may be tagged or untagged.

Prerequisites

Devices have been added.
A VLAN has been configured.
A Layer 2 interface has been created.

Procedure

Choose Plan > Provision > Device Configuration > Single Device Configuration from the main menu.
Select the device to be configured and choose Ethernet Configuration > VLAN Configuration > Interface VLAN from the navigation pane.
Click Create. On the Interface VLAN [Create] page that is displayed, set parameters in the Global area.
Click OK.

Parameter Description

Table 2-494 Parameters on the Interface VLAN page

Parameter	Description
Interface name	Layer 2 interface to be added to a VLAN.
Link type	Link type to be set for an interface.
Default VLAN	Default VLAN of an interface. The interface is added to the default VLAN.
Allow VLAN	List of allowed VLANs.
Tagged VLAN	Mode in which a hybrid interface is to be added to a VLAN, including the tagged or untagged mode. These parameters specify whether the outgoing packets of the interface carry VLAN tags.
Untagged VLAN
IP subnet vlan	Whether to enable subnet-based VLAN assignment. If this function is enabled, a device adds a VLAN ID to a packet according to the source IP address of the packet.

Configuring a Voice VLAN OUI

Context

A voice VLAN is a dedicated VLAN used to transmit voice traffic. Multiple types of traffic, such as data, voice, and video traffic, are transmitted on a network simultaneously. Packet loss and delay have a great impact on the quality of voice services. As such, users are more sensitive to the quality of voice services than that of data or video services. Therefore, the quality of voice services must be ensured preferentially when the bandwidth is limited. To achieve this, you can configure a voice VLAN on the device. The device then can identify voice traffic, add the voice VLAN tag to the voice traffic for transmission in the voice VLAN, and provide QoS services for preferentially transmitting voice traffic in the case of network congestion.

When a MAC address-based voice VLAN is configured, the device determines whether a data packet received by an interface is a voice data packet based on the source MAC address field in the packet. When the source MAC address in a data packet matches the organizationally unique identifier (OUI) that has been preconfigured in the system for a voice device, the device considers the data packet as a voice data packet. Such a preconfigured OUI applies to the scenario where IP phones send untagged voice packets.

Only LSWs running V600 support this function.

Procedure

Choose Plan > Provision > Device Configuration > Single Device Configuration from the main menu.
Select the device to be configured and choose Ethernet Configuration > VLAN Configuration > Voice VLAN from the navigation pane.
Click Create and configure the global attribute of a voice VLAN OUI.
Click OK.

Parameter Description

Table 2-495 Description of voice VLAN OUI

Parameter		Description
Global	Mac	OUI address of voice packets that can be transmitted in the voice VLAN.
	Mask	Mask of the OUI address.
	Description	Description of the OUI address.

Configuring a Voice VLAN

Context

A voice VLAN is a dedicated VLAN used to transmit voice traffic. Packet loss and delay have a great impact on the quality of voice services. Users are more sensitive to the quality of voice services than that of data or video services. Therefore, the quality of voice services must be ensured preferentially when the bandwidth is limited. To achieve this, you can configure a voice VLAN on a device. The device then can identify voice traffic and add the voice VLAN tag to the voice traffic for transmission in the voice VLAN, preferentially transmitting voice traffic in the case of network congestion.

Only LSWs running V600 support this function.

VLAN Tag

A device configured with a voice VLAN can identify voice traffic in either of the modes listed in the table below.

Type	Description
VLAN-based mode	You can configure a device to increase the priority of voice data packets based on VLAN IDs. The device then determines whether a data packet received by an interface is a voice data packet based on the VLAN ID in the packet. When the VLAN ID in a data packet matches the voice VLAN ID configured in the system, the device considers the data packet as a voice data packet.
MAC address-based mode	A device determines whether a data packet received by an interface is a voice data packet based on the source MAC address field in the packet.

Prerequisites

A Layer 2 interface has been created and added to a VLAN.

Procedure

Choose Plan > Provision > Device Configuration > Single Device Configuration from the main menu.
Select the device to be configured and choose Ethernet Configuration > VLAN Configuration > Voice VLAN from the navigation pane.
Click Create. On the Voice VLAN [Create] page that is displayed, set parameters in the Global area.
Click OK.

Parameter Description

Table 2-496 Parameters on the Voice VLAN page

Parameter	Description
Interface name	Layer 2 interface added to a VLAN.
Voice VLAN ID	Voice VLAN ID to be set for an interface.

STP Configuration

Spanning Tree Protocol (STP), Rapid Spanning Tree Protocol (RSTP), and Multiple Spanning Tree Protocol (MSTP), proposed by Institute of Electrical and Electronics Engineers (IEEE), are protocols for eliminating loops and enhancing link redundancy on LANs.

On a complex network, multiple physical links are often deployed between two devices for link redundancy, one of which is the master and the others are the backup. As such, loops may occur.

To solve this problem, spanning tree protocols can be deployed on the network. Devices running spanning tree protocols exchange information to discover loops on the network and block appropriate ports. This enables a ring topology to be trimmed into a loop-free tree topology. This prevents packets from being infinitely replicated or propagated on the network, and protects device performance from being deteriorated by repeated packets.

Configuring STP Globally

Context

A designated port on the network edge is called an edge port. An edge port directly connects to a terminal and does not connect to any other devices.

Edge ports directly connect to a terminal and generally do not receive BPDUs. Some attackers may send forged BPDUs to attack the device. If the edge ports receive these BPDUs, the device automatically configures the edge ports as non-edge ports and triggers new spanning tree calculation. Network flapping then occurs. After BPDU protection is enabled, devices can be prevented from being attacked by forged BPDUs.

Only LSWs running V600 support this function.

Procedure

Choose Plan > Provision > Device Configuration > Single Device Configuration from the main menu.
Select the device to be configured and choose Ethernet Configuration > STP Configuration > Global STP from the navigation pane.
Click the Global STP tab and toggle on Enable Global STP to enable STP, RSTP, or MSTP globally.
Click the STP Protection tab and determine whether to enable BPDU Protection and Global Edge Port Enable.

Parameter Description

Table 2-497 Parameters on the Global STP page

Parameter	Description
Enable Global STP	Whether to enable STP, RSTP, or MSTP globally.
BPDU Protection	Whether to enable the BPDU protection function. After this function is enabled, devices can be prevented from being attacked by forged BPDUs.
Global Edge Port Enable	Whether to enable the global edge port function. After this function is enabled, all ports on the device are configured as edge ports.

Configuring STP on a Port

After a port is configured as an edge port, the port can still send BPDUs. The BPDUs may be sent to another network, which may encounter network flapping. To prevent this problem, configure the BPDU filtering function on the edge port so that the edge port does not process or send BPDUs.

Only LSWs running V600 support this function.

Prerequisites

A Layer 2 port has been created.
STP has been enabled globally.

Procedure

Choose Plan > Provision > Device Configuration > Single Device Configuration from the main menu.
Select the device to be configured and choose Ethernet Configuration > STP Configuration > Interface STP from the navigation pane.
Click Create. On the Interface STP [Create] page that is displayed, set parameters in the Global area.
1. Interface Name: Layer 2 port that has been created.
2. Interface STP Enable: whether to enable STP, RSTP, or MSTP on a port.
3. STP Edge Port: whether to configure a port as an STP edge port.

Parameter Description

Table 2-498 Parameters on the Interface STP page

Parameter	Description
Interface Name	Layer 2 port.
Interface STP Enable	Whether to enable STP, RSTP, or MSTP on a port.
STP Edge Port	Whether to configure a port as an STP edge port. disable: A port is configured as a non-edge port. enable: A port is configured as an edge port. default: All ports on a device are configured as non-edge ports by default.
BPDU Filter	Whether to enable BPDU filtering: disable: BPDU filtering is disabled. enable: BPDU filtering is enabled. default: The default setting is used. BPDU filtering is disabled by default.

Port Isolation Configuration

Context

Port isolation isolates ports in the same VLAN. To implement Layer 2 or Layer 3 isolation between ports, you only need to add them to a port isolation group.

Only LSWs running V600 support this function.

Prerequisites

A Layer 2 port has been created.

Procedure

Choose Plan > Provision > Device Configuration > Single Device Configuration from the main menu.
Select the device to be configured and choose Ethernet Configuration > Port Isolate > Port Isolate from the navigation pane.
Click Create. On the Port Isolate [Create] page that is displayed, set parameters in the Global area.
1. Interface name: Layer 2 port that has been created.
2. Port isolate enable: whether to enable the port isolation group function and add a port to the port isolation group.

Parameter Description

Table 2-499 Parameters on the Port Isolate page

Parameter	Description
Interface name	Layer 2 port.
Port isolate enable	Whether to enable the port isolation group function and add a port to the port isolation group. The port isolation group ID is 1 by default.

Layer 3 Sub-interface Configuration

Context

You can configure Layer 3 interfaces for CPE gateways at sites to connect to the LAN.

Only ARs running V600 and NE devices support this function.

Procedure

Choose Plan > Provision > Device Configuration > Single Device Configuration from the main menu.
Select the device to be configured and choose Ethernet Configuration > L3 Sub Interface from the navigation pane.
Click Create, select a Layer 3 sub-interface, and select a flow type.
On the Dot1q vlans tab page, configure the VLAN range.
Click OK.

Parameter Description

Table 2-500 Parameters for configuring a Layer 3 sub-interface

Parameter		Description
Global	L3 sub interface name	Name of a sub-interface.
Global	Flow type	Flow attributes of the Layer 3 sub-interface. The value can only be Dot1q termination.
Dot1q vlans	VLAN range	List of inner VLANs for dot1q termination sub-interfaces.

Layer 2 Protocol Tunneling

Configuring L2PT

Context

Layer 2 protocol tunneling (L2PT) is a Layer 2 tunneling technology that enables devices to transparently transmit Layer 2 protocol packets of private network users at different locations over a specified tunnel on an Internet service provider (ISP) network.

Only LSWs running V600 support this function.

Prerequisites

Port isolation has been configured for access switches. For details, see Port Isolation Configuration.

Procedure

Choose Plan > Provision > Device Configuration > Single Device Configuration from the main menu.
Select a device and choose Ethernet Configuration > L2protocol Tunnel > L2protocol Tunnel from the navigation pane.
Click the User Defined Protocol tab, click Create in the upper right corner, set Protocol Name, Protocol Mac, and Group Mac, and click OK.
Click the Interface L2protocol Enable tab and click Create in the upper right corner. Set parameters on the Global and L2protocol Enable List page and click OK.
Click the Interface L2protocol Enable (Vlan) tab and click Create in the upper right corner. Set parameters on the Global and L2protocol Enable List page and click OK.

Parameter Description

Table 2-501 Parameter description

Parameter			Description
User Defined Protocol	Global	Protocol Name	Name of a user-defined Layer 2 protocol whose packets are transparently transmitted.
		Protocol Mac	Multicast destination MAC address of the user-defined Layer 2 protocol packets.
		Group Mac	Multicast MAC address that replaces the destination MAC address of the user-defined Layer 2 protocol packets.
Interface L2protocol Enable	Global	Interface Name	Interface to be configured. NOTE: Only L2 interfaces are supported.
	L2protocol Enable List	Protocol Name	Select a created user-defined protocol.
	L2protocol Enable List	Action	Select enable to enable transparent transmission of Layer 2 protocol packets.
Interface L2protocol Enable (Vlan)	Global	Interface Name	Interface to be configured. NOTE: Only L2 interfaces are supported.
	L2protocol Enable List	Protocol Name	Select a created user-defined protocol.
		Vlan List	VLANs of Layer 2 protocol packets that can be transparently transmitted. You can specify multiple VLAN IDs.
		Action	Select enable to enable transparent transmission of Layer 2 protocol packets.

IP Service

Basic IP Service Configuration

Configuring IPv4

Prerequisites

A Layer 3 interface has been created.
A VPN instance has been configured.

Context

Each host on an IP network must have an IP address. An IP address is a numerical label assigned to each device on a computer network.

Procedure

Choose Plan > Provision > Device Configuration > Single Device Configuration from the main menu.
Select the device to be configured and choose IP Service Configuration > IP Basic Configuration > IPv4 Configuration from the navigation pane.
Click Create. In the IPv4 Configuration [Create] view that is displayed, set IPv4 global attributes.
Interface name: specifies an existing Layer 3 interface for which an IP address needs to be set.

Address type: Select Address or Unnumbered address.

Access type: specifies the mode in which an IP address is assigned to the interface. If this parameter is set to Static, configure an IPv4 address and mask. If this parameter is set to DHCP, the DHCP server automatically assigns an IPv4 address to the interface.

IPv4 address and Mask: specify the IPv4 address and mask to be set for the interface. Ensure that the IPv4 address and mask set for the interface are correct. If the configuration is incorrect, the device may go offline.

Mtu: specifies the maximum transmission unit (MTU) to be set for the interface, which defines the size of a packet fragment.
If Access type is set to Static, click IPv4 sub address and configure a secondary IP address for the interface.
Click OK.

Verifying the Configuration

After the configuration is completed, click Commit and check the configuration delivery status in the Configuration status column.
After the configuration is completed, you can view the configuration status and operation logs on the Configuration Result tab page.

Parameter Description

Table 2-502 Parameters for configuring IPv4

Parameter	Description
Interface name	Interface name. You can only select an existing Layer 3 interface for this parameter.
Address type	Address type of the interface. Address: The IP address of the local interface is used. Unnumbered address: When IP address resources are insufficient, an interface borrows an IP address from another interface. The following interfaces support IP borrowing from other interfaces such as Ethernet and loopback interfaces: Interfaces encapsulated with PPP Tunnel interfaces
Access type	Mode in which the interface obtains an IP address. The options are as follows: Static: A static IP address needs to be configured for the interface. DHCP: The interface dynamically obtains an IP address.
IPv4 address	IPv4 address to be set for the interface.
Mask	IPv4 mask to be set for the interface.
Mtu	Maximum number of bytes in a packet that a sender can send each time. The default value is 1500.
IPv4 sub address	Each interface can be configured with multiple IP addresses. If IP addresses are configured in primary/secondary mode, one primary and multiple secondary IP addresses can be configured on the interface. If the primary or secondary status of IP addresses is ignored, the interface does not distinguish the primary and secondary IP addresses. By default, IP addresses are configured in primary/secondary mode.

Configuring IPv6

Prerequisites

A Layer 3 interface has been created.
A VPN instance has been configured.

Context

Internet Protocol version 6 (IPv6) is the second-generation standard network layer protocol and an upgraded version of IPv4.

Procedure

Choose Plan > Provision > Device Configuration > Single Device Configuration from the main menu.
Select the device to be configured and choose IP Service Configuration > IP Basic Configuration > IPv6 Configuration from the navigation pane.
Click Create. In the IPv6 Configuration [Create] view that is displayed, set IPv6 global attributes.
Interface name: specifies an existing Layer 3 interface for which an IP address needs to be set.

Access type: specifies the mode in which an IP address is assigned to the interface. If this parameter is set to Static, configure an IPv6 address and mask.

IPv6 address and Mask: specify the IPv6 address and mask to be set for the interface. Ensure that the IPv6 address and mask set for the interface are correct. If the configuration is incorrect, the device may go offline.

Mtu: specifies the maximum transmission unit (MTU) to be set for the interface, which defines the size of a packet fragment.
Click IPv6 sub addressList to configure a secondary IP address for the interface.
Click OK.

Verifying the Configuration

After the configuration is completed, click Commit and check the configuration delivery status in the Configuration status column.
After the configuration is completed, you can view the configuration status and operation logs on the Configuration Result tab page.

Parameter Description

Table 2-503 Parameters for configuring IPv6

Parameter	Description
Interface name	Interface name. You can only select an existing Layer 3 interface for this parameter.
Access type	Mode in which the interface obtains an IP address. The option is as follows: Static: A static IP address needs to be configured for the interface.
IPv6 address	IPv6 address to be set for the interface.
Mask	IPv6 mask to be set for the interface.
Mtu	Maximum number of bytes in a packet that a sender can send each time.
IPv6 sub addressList	Each interface can be configured with multiple IP addresses. If IP addresses are configured in primary/secondary mode, one primary and multiple secondary IP addresses can be configured on the interface. If the primary or secondary status of IP addresses is ignored, the interface does not distinguish the primary and secondary IP addresses. By default, IP addresses are configured in primary/secondary mode.

ARP/ND Configuration

Configuring ARP

Prerequisites

A VLANIF interface has been created.
A VPN instance has been created.

Context

The Address Resolution Protocol (ARP) resolves IP addresses to MAC addresses.

You can deploy proxy ARP on an intermediate device. Proxy ARP enables devices that reside on different physical network segments but on the same IP network to resolve IP addresses to MAC addresses. This feature helps reduce system resource consumption caused by routing table queries and improves the efficiency of system processing.

Only LSWs running V600 support this function.

Table 2-504 Proxy ARP

Proxy ARP Type	Description	Application Scenario
Proxy ARP anyway	You can enable proxy ARP anyway on a host gateway. In this way, the gateway sends its interface MAC address to a source host and communication between hosts is implemented through route forwarding.	Two hosts that need to communicate belong to the same network segment but different physical networks. The gateways to which hosts are connected have the same IP address.

Procedure

Choose Plan > Provision > Device Configuration > Single Device Configuration from the main menu.
Select the device to be configured and choose IP Service Configuration > ARP/ND Configuration > ARP Configuration from the navigation pane.
Click Create. In the ARP Configuration [Create] view that is displayed, set global ARP attributes.
Interface name: specifies an existing VLANIF interface for which ARP needs to be configured.

Proxy ARP enable: specifies whether to enable proxy ARP anyway.
Click OK.

Verifying the Configuration

After the configuration is completed, click Commit and check the configuration delivery status in the Configuration status column.
After the configuration is completed, you can view the configuration status and operation logs on the Configuration Result tab page.

Parameter Description

Table 2-505 Parameters for configuring ARP

Parameter

Description

Interface name

Name of the interface where ARP is to be configured. You can only select an existing VLANIF interface.

ARP proxy enable

Whether to enable proxy ARP anyway.

Proxy ARP enables the source host on a network to mistakenly consider that the destination host and itself are on the same network segment. In this way, the network details can be hidden, thereby achieving transparent subnet division.

Configuring ND

Prerequisites

A VLANIF interface has been created.
A VPN instance has been created.

Context

Neighbor Discovery Protocol (NDP), an important basic protocol in the IPv6 protocol suite, is an enhancement of Address Resolution Protocol (ARP) and Internet Control Management Protocol (ICMP) router discovery in IPv4. To communicate with a destination host, a source host needs to first obtain the link-layer address of the destination host. In IPv4, this is achieved through ARP, whereas in IPv6, this is achieved through NDP.

Only LSWs running V600 support this function.

Table 2-506 Proxy ND

Proxy ND Type	Description	Application Scenario
Intra-VLAN proxy ND	Hosts that belong to the same VLAN are unable to communicate with each other if Layer 2 interface isolation is configured in the VLAN. In this case, intra-VLAN proxy ND needs to be enabled on the interfaces associated with the VLAN to which the hosts belong in order to allow the hosts to communicate with each other.	Two hosts that need to communicate with each other belong to the same network segment and the same VLAN where user isolation is configured.

Procedure

Choose Plan > Provision > Device Configuration > Single Device Configuration from the main menu.
Select the device to be configured and choose IP Service Configuration > ARP/ND Configuration > ND Configuration from the navigation pane.
Click Create. In the ND Configuration [Create] view that is displayed, set global ND attributes.
Interface name: specifies an existing VLANIF interface for which ND needs to be configured.

ND proxy enable: specifies whether to enable intra-VLAN proxy ND.

RA flag: specifies whether to enable the device to send Router Advertisement (RA) messages.
- After this function is enabled, routing devices periodically send RA messages to their connected hosts.
- You do not need to enable this function when routing devices are not connected to hosts.
MA flag: specifies whether to set the managed address configuration flag (M flag) in RA messages for stateful address autoconfiguration.
- After the function is enabled, hosts obtain IPv6 addresses through stateful address autoconfiguration.
- After the function is disabled, hosts obtain IPv6 addresses through stateless address autoconfiguration.
O flag: specifies whether to set the other configuration flag (O flag) in RA messages for stateful address autoconfiguration. If MA flag is set to Open, O flag must be set to Open.
Click OK.

Verifying the Configuration

After the configuration is completed, click Commit and check the configuration delivery status in the Configuration status column.
After the configuration is completed, you can view the configuration status and operation logs on the Configuration Result tab page.

Parameter Description

Table 2-507 Parameters for configuring ND

Parameter	Description
Interface name	Name of the interface for which ND is to be configured. You can only select an existing VLANIF interface.
ND proxy enable	Whether to enable intra-VLAN proxy ND.
RA flag	Whether to enable the device to send RA messages. By default, routing devices do not send RA messages. When hosts are connected to routing devices through Layer 2 forwarding devices, the hosts obtain the prefix lists and other configurations through RA messages received from the routing devices.
MA flag	Whether to set the M flag in RA messages for stateful address autoconfiguration. If MA flag is set to Open, hosts obtain IPv6 addresses through stateful address autoconfiguration. Routing devices automatically allocate IPv6 addresses/prefixes and other network configuration parameters to hosts, such as addresses of domain name server (DNS), network information service (NIS), and Simple Network Time Protocol (SNTP) servers. If M flag is set to Close, hosts obtain IPv6 addresses through stateless address autoconfiguration. Hosts automatically generate their IPv6 addresses based on the information in received RA messages. Routing devices allocate configuration information other than IPv6 addresses to hosts, such as the DNS, NIS, and SNTP server addresses.
O flag	Whether to set the O flag in RA messages for stateful address autoconfiguration. If O flag is set to Open, hosts obtain configuration information other than IPv6 addresses through stateful autoconfiguration. If O flag is set to Close, hosts obtain configuration information other than IPv6 addresses through stateless address autoconfiguration. That is, routing devices send configuration information other than IPv6 addresses to hosts through RA messages.

DHCP

Configuring DHCPv4

Prerequisites

A VLANIF interface and other Layer 3 interfaces have been created.
A VPN instance has been created.

Context

As networks expand and become more complex, network configurations also become more complex. In addition, a sharp increase in computers and their location changes cause their IPv4 addresses to frequently change and available addresses become insufficient. To properly and dynamically allocate IPv4 addresses to hosts, Dynamic Host Configuration Protocol (DHCPv4) is used.

DHCPv4 offers the following benefits:

Reduced client configuration and maintenance costs
DHCPv4 is easy to configure and deploy. For non-technical users, DHCPv4 minimizes configuration-related operations on clients and reduces remote deployment and maintenance costs.
Centralized management
A DHCPv4 server can manage the configurations of multiple network segments. When the configuration of a network segment changes, an administrator only needs to update the corresponding configuration on the DHCPv4 server.

Figure 2-164 DHCPv4 networking

Procedure (Configuring a Global DHCP Address Pool)

Only NE devices and ARs and LSWs running V600 support this function.

Choose Plan > Provision > Device Configuration > Single Device Configuration from the main menu.
Select the device to be configured and choose IP Service Configuration > DHCP Configuration > DHCPv4 Configuration > Global IP Pool from the navigation pane.
Click Create. On the Global IP Pool [Create] page that is displayed, set global attributes of a DHCP address pool.
Name: specifies the name of an address pool.

VPN: specifies the VPN instance for the address pool.

Network address and Mask: specify the IP address and mask of the gateway for the address pool.

Domain name: specifies the domain name suffix to be allocated to DHCP clients.
Configure an address segment.
Set Index to specify the ID of an IP address segment in the IP address pool.

Set Start IP and End IP to specify the start and end IP addresses of an IP address segment. The end IP address must be greater than the start IP address. If the end IP address is not specified, there is only one IP address in the address segment.
Configure Gateway list. Set Gateway address to specify the gateway IP address and mask of the address pool.
Configure static mappings between IP and MAC addresses, so that static IP addresses are allocated to clients with specific MAC addresses.
Set DNS IP to specify the IP address of a DNS server.
Configure IP addresses not to be assigned. Set Start IP and End IP to specify the IP address segment where addresses are not automatically assigned from the IPv4 address pool.
Configure DHCP options. Set Option Code and Format to configure user-defined options for the DHCP global address pool.
Click OK.

Procedure (Configuring an interface DHCP Address Pool)

Choose Plan > Provision > Device Configuration > Single Device Configuration from the main menu.
Select the device to be configured and choose IP Service Configuration > DHCP Configuration > DHCPv4 Configuration > Interface DHCP Configuration from the navigation pane.
Click Create. On the Interface DHCP Configuration [Create] page that is displayed, set global attributes of an interface DHCP address pool.
1. Interface name: specifies an existing interface for which DHCP needs to be configured.
2. DHCP mode: specifies the DHCP mode. The options include Server and Relay.
If the DHCP mode is set to Server, set related parameters. For details, see Procedure (Configuring a Global DHCP Address Pool).
If the DHCP mode is set to Relay, set related parameters.
1. Set the DHCP server address.
2. Set the relay agent address.
Click OK.

Verifying the Configuration

After the configuration is completed, click Commit and check the configuration delivery status in the Configuration status column.
After the configuration is completed, you can view the configuration status and operation logs on the Configuration Result tab page.

Parameter Description

Table 2-508 Parameters for configuring DHCPv4

Parameter		Description
Global	Name	Name of an address pool.
	VPN	VPN instance for the address pool.
	Network address	Network address segment.
	Mask	Network mask.
	Domain name	Domain name suffix to be assigned to DHCP clients.
Section	Index	ID of the address segment in the IP address pool.
	Start IP	Start IP address of an address segment.
	End IP	End IP address of an address segment. The end IP address must be greater than the start IP address. If the end IP address is not specified, there is only one IP address in the address segment.
Gateway list	Gateway address	Gateway address for DHCP clients.
Gateway list	Mask	Mask of the gateway address.
Bind MAC address	IP address	IP address in the global address pool to be statically bound to a MAC address.
Bind MAC address	MAC address	MAC address of a user.
DNS list	DNS IP	DNS server address.
Excluded IP address	Start IP	Start IPv4 address of the address segment in which IP addresses are not automatically assigned to clients from the IPv4 address pool.
Excluded IP address	End IP	End IPv4 address of the address segment in which IP addresses are not automatically assigned to clients from the IPv4 address pool.
Option	Option Code	Code of a user-defined option.
Option	Format	ascii-format: specifies the user-defined option code as an ASCII character string. cipher-format: specifies the user-defined option code as a ciphertext character string. You can enter a plaintext or ciphertext option code, but the option code is displayed in ciphertext in the configuration file. hex-format: specifies the user-defined option code as a hexadecimal string. ip-format: specifies the user-defined option code as an IP address. Sub option: specifies the code of a user-defined sub-option.
DHCP mode	Server	Whether to configure the device as a DHCPv4 server that uses an interface address pool to assign addresses.
DHCP mode	Relay	A DHCPv4 server selects an address pool based on whether a DHCPv4 relay agent is deployed. Server address: specifies the IP address of the DHCP server. Gateway server: specifies the IP address of the gateway server.

Configuring DHCPv6

Prerequisites

A VLANIF interface and other Layer 3 interfaces have been created.
A VPN instance has been created.

Design Description

Dynamic Host Configuration Protocol for IPv6 (DHCPv6) is a stateful protocol that assigns IPv6 addresses or prefixes and other configuration parameters to hosts. It provides the following functions:

Controls IPv6 address allocation more effectively. DHCPv6 records the IPv6 addresses that have been allocated and allocates available IPv6 addresses to hosts based on certain rules, facilitating network management.
Allocates IPv6 address prefixes to network devices, facilitating network-wide automatic configuration and hierarchical management.
Provides other network configuration parameters such as the DNS server IPv6 address.

The following figure shows the DHCPv6 architecture, which involves three roles:

Figure 2-165 DHCPv6 architecture
Click to enlarge

DHCPv6 client
A DHCPv6 client initiates requests to obtain IPv6 addresses/prefixes and other network configuration parameters from a DHCPv6 server to configure its address.
DHCPv6 server
A DHCPv6 server responds to requests for address allocation, address lease extension, and address release from a DHCPv6 client or a DHCPv6 relay agent, and allocates IPv6 addresses/prefixes and other network configuration parameters to the client.
DHCPv6 relay agent
A DHCPv6 relay agent delivers DHCPv6 messages between a DHCPv6 client and server to help the client configure its address.

Context

If a DHCPv6 client and server reside on the same link, the client uses a link-local multicast address to obtain an IPv6 address/prefix and other configuration parameters from the server. If a DHCPv6 client and server reside on different links, a DHCPv6 relay agent must be used to forward DHCPv6 messages between the client and server. DHCPv6 relay allows a single DHCPv6 server to serve DHCPv6 clients on different links, reducing costs and facilitating centralized management.

Only ARs and LSWs running V600 and NE devices support this function.

Procedure (Configuring DHCPv6)

Only ARs running V600 and NE devices support this function.

Choose Plan > Provision > Device Configuration > Single Device Configuration from the main menu.
Select the device to be configured and choose IP Service Configuration > DHCP Configuration > DHCPv6 Configuration > DHCPv6 from the navigation pane.
Enable or disable DHCPv6.

Procedure (Configuring DHCPv6 on an Interface)

Choose Plan > Provision > Device Configuration > Single Device Configuration from the main menu.
Select the device to be configured and choose IP Service Configuration > DHCP Configuration > DHCPv6 Configuration > Interface DHCPv6 Configuration from the navigation pane.
Click Create. On the Interface DHCPv6 Configuration [Create] page that is displayed, set global attributes of an interface DHCPv6 address pool.
Interface name: specifies the interface where the IPv6 address of a DHCPv6 server or a next-hop relay agent needs to be configured.
Click DHCPv6 relay and configure the DHCPv6 relay agent, including the gateway address for clients and the source IPv6 address used to relay DHCPv6 messages.
- Configure a DHCPv6 relay-enabled interface.
- Configure a gateway address and source IPv6 address for the DHCPv6 relay agent to relay DHCPv6 messages as needed.
Enable DHCPv6 relay on the interface in either of the following ways based on the actual situation:
1. Configure the DHCPv6 relay destination address, which can be the IPv6 address of a DHCPv6 server or a next-hop relay agent.
2. Configure the outbound interface of the DHCPv6 relay agent for connecting to the DHCPv6 server or next-hop relay agent.
Click OK.

Verifying the Configuration

After the configuration is completed, click Commit and check the configuration delivery status in the Configuration status column.
After the configuration is completed, you can view the configuration status and operation logs on the Configuration Result tab page.

Parameter Description

Table 2-509 Parameters for configuring DHCPv6

Parameter		Description
DHCPv6	Enable	Whether to enable or disable the DHCPv6 function.
Global	Interface name	Interface name. You can only select an existing VLANIF interface for this parameter.
DHCPv6 relay	DHCPv6 relay source interface	To meet requirements in some scenarios, you can configure a client's gateway address on the DHCPv6 relay agent and a source IPv6 address used by the DHCPv6 relay agent to relay DHCPv6 messages. For example, this configuration is suitable if the source IPv6 address of DHCPv6 messages must remain unchanged and the DHCPv6 server must know the message forwarding path of a client for address allocation and parameter configuration. The IP addresses can be configured in either of the following ways: Configure a DHCPv6 relay-enabled interface. The DHCPv6 relay agent selects the global unicast IPv6 address first configured on the DHCPv6 relay-enabled interface as its gateway address, and uses the gateway IPv6 address as the source address of DHCPv6 relayed messages. Configure a gateway address and source IPv6 address for the DHCPv6 relay agent to relay DHCPv6 messages as needed.
	DHCPv6 relay source address
	DHCPv6 relay link address
	DHCPv6 relay destination address	IPv6 address of the destination DHCPv6 server or a next-hop DHCPv6 relay agent. This parameter needs to be set when DHCP clients are in the same VPN.
	DHCPv6 relay destination interface	Outbound interface connecting to the destination DHCPv6 server or a next-hop DHCPv6 relay agent. This parameter needs to be set when DHCP clients are in the same VPN.

DNS

Context

Domain Name System (DNS) provides a conversion and query mechanism between IP addresses and domain names.

DNS supports dynamic and static domain name resolution.

Static domain name resolution requires a static domain name resolution table that is set up manually, describing the mappings between domain names and IP addresses.
Dynamic domain name resolution requires a dedicated DNS server. This server runs the domain name resolution program, maps domain names to IP addresses, and receives DNS requests from clients.

A DNS server can be configured on a network to establish mappings between domain names and IP addresses. These mappings give users easy-to-remember alternatives for identifying devices.

Only LSWs, firewalls, and ARs running V600 support this function.

Prerequisites

A VLANIF interface has been created.
A VPN instance has been created.
A route between the device and DNS server has been configured.

Procedure

Choose Plan > Provision > Device Configuration > Single Device Configuration from the main menu.
Select the device to be configured and choose IP Service Configuration > DNS Configuration from the navigation pane.
Click DNS and set Enable DNS to Open.
On the DNS Server tab page, set parameters of the DNS server to be accessed by the device.
On the IPv4 source address for server interconnection tab page, configure the source IPv4 address and VPN used by the device to communicate with the DNS server.
On the IPv4 host sheet, set host parameters.
On the DNS relay tab page, enable DNS proxy.
On the DNS relay tab page, enable the DNS relay function.
On the DNSv6 Server tab page, set parameters of the DNSv6 server to be accessed by the device.
On the IPv6 source address for server interconnection tab page, configure the source IPv6 address and VPN used by the device to communicate with the DNS server.

Verifying the Configuration

After the configuration is completed, click Commit and check the configuration delivery status in the Configuration status column.
After the configuration is completed, you can view the configuration status and operation logs on the Configuration Result tab page.

Parameter Description

Table 2-510 Parameters for configuring DNS

Parameter		Description
DNS	Enable DNS	Whether to enable the DNS service on the device.
DNSv4 Server	DNS ipv4 address	IPv4 address of the DNS server to be accessed by the device.
DNSv4 Server	VPN Instance	VPN used by the device to communicate with the DNS server.
IPv4 source address for server interconnection	IPv4 source address for interconnection	Source IPv4 address used by the device to communicate with the DNS server.
IPv4 source address for server interconnection	VPN Instance	VPN used by the device to communicate with the DNS server.
IPv4 host	Host name	Domain name.
	Host address	IP address mapping the domain name.
	VPN instance	VPN to which the IP address mapping the domain name belongs.
DNS relay	Enable dns proxy	Whether to enable the DNS proxy function.
DNS relay	Enable dns relay	Whether to enable the DNS relay function. This function enables a device to forward a DNS request packet from a DNS client to a DNS server and a response packet from the DNS server to the DNS client. The DNS client on a LAN considers the DNS relay agent as the DNS server and sends DNS request packets to the DNS relay agent. The DNS relay agent forwards the request packets to the real DNS server, and returns the response packets to the DNS client, therefore implementing domain name resolution. The device functions as a DNS relay agent to provide the DNS server function for enterprise users. Users do not need to directly interact with the DNS server, which simplifies route deployment and improves DNS server performance and security.
DNSv6 Server	DNSv6 IPv6 address	IPv6 address of the DNS server to be accessed by the device.
	VPN Instance	VPN used by the device to communicate with the DNS server.
	Source Interface	Interface whose IP address is used as the source address by the device to communicate with the DNS server.
IPv6 source address for server interconnection	IPv6 source address for interconnection	Source IPv6 address used by the device to communicate with the DNS server.
IPv6 source address for server interconnection	VPN Instance	VPN used by the device to communicate with the DNS server.

ACL

Configuring an IPv4 ACL

Context

An ACL is a collection of one or more rules. A rule refers to a judgment statement that describes a packet matching condition, which may be a source address, destination address, or port number.

ACL rules can be classified by function, as shown in Table 2-511.

Table 2-511 ACL classification

Category	Application Scenario	Function
Basic ACL	Packets need to be filtered based only on the source IPv4 address.	Defines packet filtering rules based on information such as the source IPv4 address, action, and VPN instance.
Advanced ACL	Packets need to be matched in a more refined manner. Advanced ACLs can be used to deny traffic from or destined for a specific host or an entire network segment.	Defines packet filtering rules based on information such as the source IPv4 address, destination IPv4 address, IP protocol type, DSCP value, and VPN instance.

Prerequisites

The tenant administrator has completed the deployment configuration, and devices have been successfully managed by the controller.
A VPN instance has been configured.

Procedure

Choose Plan > Provision > Device Configuration > Single Device Configuration from the main menu.
Select the device to be configured and choose IP Service Configuration > ACL Configuration > IPv4 ACL from the navigation pane.
Click Create. On the IPv4 ACL [Create] page that is displayed, configure global attributes for an IPv4 ACL.
Identify: specifies the number of an ACL. The number of a basic ACL ranges from 2000 to 2999. The number of an advanced ACL ranges from 3000 to 3999 and can start with a letter.

Type: specifies the ACL type. You can set Type to Basic or Advance.
Configure an IPv4 ACL rule.
- Configure rules for a basic ACL, if you set Type to Basic.
  1. Name: specifies the name of a basic rule.
  2. ID: specifies the rule ID. Each ACL rule has an ID. Rules in an ACL are sorted in ascending order of rule IDs.
  3. Action: specifies the matching mode. The value can be permit or deny. This parameter determines whether to permit or deny packets matching the ACL rule.
  4. Source address: specifies the source IP address to be matched.
  5. Source wild: specifies the wildcard mask of the source IP address to be matched.
  6. VPN: specifies the VPN instance of the packets to be matched.
- Configure rules for an advanced ACL, if you set Type to Advance.
  1. Name: specifies the name of an advanced rule.
  2. ID: specifies the rule ID. Each ACL rule has an ID. Rules in an ACL are sorted in ascending order of rule IDs.
  3. Action: specifies the matching mode. The value can be permit or deny. This parameter determines whether to permit or deny packets matching the ACL rule.
  4. Protocol: specifies the protocol of the packets to be matched. The options include ICMP, TCP, and UDP.
  5. Source address: specifies the source IP address to be matched.
  6. Source wild: specifies the wildcard mask of the source IP address to be matched.
  7. Destination address: specifies the destination IP address to be matched.
  8. Destination wild: specifies the wildcard mask of the destination IP address to be matched.
  9. DSCP: specifies the 6-bit DSCP value of the IPv4 packets to be matched.
  10. VPN: specifies the VPN instance of the packets to be matched.
Click OK.

Parameter Description

Table 2-512 IPv4 ACL parameters

Parameter		Description
Global	Identify	Identifier of an ACL. It can contain digits and letters. Basic ACL: The value is an integer ranging from 2000 to 2999. Advanced ACL: The value can start with a letter and contain a number from 3000 to 3999.
Global	Type	Type of an ACL rule. Basic: indicates a basic ACL. Advance: indicates an advanced ACL.
Basic rule/Advance rule	Name	Name of an ACL rule.
	ID	ID of an ACL rule. All ACL rules are sorted in ascending order of rule IDs.
	Action	Whether to configure the device to accept or discard the data packets that match the ACL rule: permit: configures the device to accept the packets that match the rule. deny: configures the device to discard the packets that match the rule.
	Protocol	Protocol of packets that match the rule. For details about protocol IDs, see the corresponding product manual.
	Source address	Source IP address.
	Source wild	Mask length of the source IP address.
	Destination address	Destination IP address.
	Destination wild	Mask length of the destination IP address.
	DSCP	6-bit DSCP value of the IPv4 packets to be matched.
	VPN	VPN instance of the packets to be matched. The parameter specifies a Layer 3 VPN instance that IP packets matching this rule belong. If the ACL rule needs to match packets from a Layer 3 VPN instance, this parameter must be set. If this parameter is not set, this rule matches public IP packets.

Configuring an IPv6 ACL

Context

ACLs can be configured to deny and permit specific incoming and outgoing traffic. They accurately identify and control packets on a network to manage network access behaviors, prevent network attacks, and improve bandwidth utilization.

An ACL is a collection of one or more rules. A rule refers to a judgment statement that describes a packet matching condition, which may be a source address, destination address, or port number.

ACL rules can be classified by function, as shown in Table 2-513.

Table 2-513 ACL classification

Category	Application Scenario	Function
Basic ACL	Packets need to be filtered based only on the source IPv4 address.	Defines packet filtering rules based on information such as source IPv6 addresses, fragment information, and time ranges.
Advanced ACL	Packets need to be matched in a more refined manner. Advanced ACLs can be used to deny traffic from or destined for a specific host or an entire network segment.	Defines packet filtering rules based on information such as source and destination IPv6 addresses, IP protocol types, TCP source and destination port numbers, UDP source and destination port numbers, fragment information, and time ranges.

Prerequisites

The tenant administrator has completed the deployment configuration, and devices have been successfully managed by the controller.
A VPN instance has been configured.

Procedure

Choose Plan > Provision > Device Configuration > Single Device Configuration from the main menu.
Select the device to be configured and choose IP Service Configuration > ACL Configuration > IPv6 ACL from the navigation pane.
Click Create. On the IPv6 ACL [Create] page that is displayed, configure global attributes for an IPv6 ACL.
Identify: specifies the number of an ACL. The value is a string of 1 to 32 characters and must start with a letter. It can contain digits.

Type: specifies the ACL type. You can set Type to Basic or Advance.
Configure an IPv6 ACL rule.
- Configure rules for a basic ACL, if you set Type to Basic.
  1. Name: specifies the name of a basic rule.
  2. ID: specifies the rule ID. Each ACL rule has an ID. Rules in an ACL are sorted in ascending order of rule IDs.
  3. Action: specifies the matching mode. The value can be permit or deny. This parameter determines whether to permit or deny packets matching the ACL rule.
  4. Source address: specifies the source IP address to be matched.
  5. Source wild: specifies the wildcard mask of the source IP address to be matched.
  6. VPN: specifies the VPN instance of the packets to be matched.
- Configure rules for an advanced ACL, if you set Type to Advance.
  1. Name: specifies the name of an advanced rule.
  2. ID: specifies the rule ID. Each ACL rule has an ID. Rules in an ACL are sorted in ascending order of rule IDs.
  3. Action: specifies the matching mode. The value can be permit or deny. This parameter determines whether to permit or deny packets matching the ACL rule.
  4. Protocol: specifies the protocol of the packets to be matched. The options include IP, ICMP, TCP, and UDP.
  5. Source address: specifies the source IP address to be matched.
  6. Source wild: specifies the wildcard mask of the source IP address to be matched.
  7. Destination address: specifies the destination IP address to be matched.
  8. Destination wild: specifies the wildcard mask of the destination IP address to be matched.
  9. DSCP: specifies the leftmost six bits of the traffic class (TC) field of the IPv6 packets to be matched.
  10. VPN: specifies the VPN instance of the packets to be matched.
Click OK.

Parameter Description

Table 2-514 IPv6 ACL parameters

Parameter		Description
Global	Identify	Identifier of an ACL. It can contain digits and letters. Basic ACL: For a numbered basic ACL6, the value must be an integer from 2000 to 2999. For a named basic ACL6, the value must be a string of 1 to 32 characters, can contain letters and digits, and must start with a letter. Advanced ACL: For a numbered basic ACL6, the value must be an integer from 3000 to 3999. For a named basic ACL6, the value must be a string of 1 to 32 characters, can contain letters and digits, and must start with a letter.
Global	Type	Type of an ACL rule. Basic: indicates a basic ACL. Advance: indicates an advanced ACL.
Basic rule/Advance rule	Name	Name of an ACL rule.
	ID	ID of an ACL rule. All ACL rules are sorted in ascending order of rule IDs.
	Action	Whether to configure the device to accept or discard the data packets that match the ACL rule: permit: configures the device to accept the packets that match the rule. deny: configures the device to discard the packets that match the rule.
	Protocol	Protocol of packets that match the rule. For details about protocol IDs, see the corresponding product manual.
	Source address	Source IP address.
	Source wild	Mask length of the source IP address.
	Destination address	Destination IP address.
	Destination wild	Mask length of the destination IP address.
	DSCP	Leftmost six bits of the traffic class (TC) field of the IPv6 packets to be matched.
	VPN	VPN instance of the packets to be matched. The parameter specifies a Layer 3 VPN instance that IP packets matching this rule belong. If the ACL rule needs to match packets from a Layer 3 VPN instance, this parameter must be set. If this parameter is not set, this rule matches public IP packets.

NAT

Configuring a Source NAT Address Pool

Context

Source NAT translates source addresses of packets. Specifically, source NAT translates private IP addresses into public IP addresses so that intranet users can use public IP addresses to access the Internet. Figure 1 shows the translation process.

Figure 2-166 Source NAT mechanism
Click to enlarge

When a host on the intranet accesses the web server on the Internet, the source NAT process on DeviceA is as follows:

When receiving a packet from the host, DeviceA translates the private source IP address of the packet into a public IP address.
When receiving a return packet from the web server, DeviceA translates the public destination IP address of the packet back into the private IP address of the host.

Only firewalls running V600 support this function.

Procedure

Choose Plan > Provision > Device Configuration > Single Device Configuration from the main menu.
Select the device to be configured and choose IP Service Configuration > NAT Configuration > Source NAT address pool from the navigation pane.
Click Create and set the name of a source NAT address pool and the NAT mode.
Click OK.

Parameter Description

Table 2-515 Parameters for configuring a source NAT address pool

Parameter		Description
Global	Name	Name of a source NAT address pool.
	NAT mode	NAT mode of an address pool. The default value is pat. When an address pool is referenced by a NAT policy, the NAT mode cannot be modified. The options include: pat no-pat full-cone
	VRRP backup group ID	ID of a VRRP group, that is, a virtual router ID (VRID). The VRID is used in dual-system hot standby networking to control traffic distribution and implement load balancing. Typically, you do not need to configure a VRID. The system automatically binds a public IP address in the NAT address pool to a VRRP group whose virtual IP address is on the same network segment as the public address and whose VRID is the smallest, so that traffic can be transmitted by the master device in the VRRP group. If there are multiple VRRP groups, you can configure a VRID to direct traffic to the master device in the specified VRRP group. The VRID configuration does not depend on whether VRRP exists. Exercise caution when configuring a VRID.
NAT Mode Extension	Servermap reverses	Whether to enable the function of creating reverse server mapping entries. If the value is true, both server mapping entries and reverse server mapping entries are created.
NAT Mode Extension	Security domain	Address pool mode. This parameter is available only when NAT mode is set to no-pat or full-cone.
Address segment	section-id	ID of an IP address segment.
	Start IP Address	Start IP address of the IP address segment.
	End IP Address	End IP address of the IP address segment.
Port pre-allocation	Pre-allocated Port Block Size	Pre-allocated port block size for the port pre-allocation and incremental allocation function.
	Incremental allocation times	Number of incremental allocations. This parameter is available only for 3-tuple NAT.
	Start Port	Start port number.
	End Port	End port number.

Configuring NAT Rules in a NAT Policy

Context

The NAT function is implemented using NAT rules in a NAT policy. You need to create a NAT rule to specify the data flow that requires NAT translation and the translation action. If multiple NAT rules are configured, the device matches packets against the rules from top to bottom in the NAT rule list until a match is found. As such, ensure that NAT rules are configured in the correct sequence.

Only firewalls running V600 support this function.

Procedure

Choose Plan > Provision > Device Configuration > Single Device Configuration from the main menu.
Select the device to be configured and choose IP Service Configuration > NAT Configuration > NAT Policy Rule from the navigation pane.
Click Create and configure a NAT rule in a NAT policy.
Click OK.

Parameter Description

Table 2-516 Parameters for configuring a NAT rule

Parameter			Description
Global	Name		Name of a NAT rule.
	Source NAT Group Name		Source NAT address group that has been configured.
	NAT Policy Egress		Egress type of a NAT policy. You can select an outbound interface or a destination zone as the egress of a NAT policy.
Source NAT Address Group Name	Source NAT Address Group Name		Name of the source security zone referenced by a NAT policy.
egress-interface	egress-interface		Outbound interface of a NAT policy.
destination-zone	destination-zone		Destination security zone of a NAT policy.
Source/Destination IPv4 Address Range	Start Address		Start source/destination IPv4 address.
Source/Destination IPv4 Address Range	End Address		End source/destination IPv4 address.
NAT Policy Service Protocol	Protocols and Ports	Protocol	Protocol type.
		Source Port	Source port range. A maximum of 64 port numbers or port ranges are supported.
		Destination Port	Destination port range. A maximum of 64 port numbers or port ranges are supported.
	protocol-id	protocol-id	Protocol ID.

ASPF

Context

Application specific packet filter (ASPF) filters packets at the application layer, which is also known as stateful packet filtering. ASPF enables a device to automatically detect the application layer information of certain packets and create access rules (generating a server mapping table) accordingly. The server mapping table is equivalent to a refined security policy, allowing the device to permit subsequent packets in the data channel.

Only firewalls running V600 support this function.

Procedure

Choose Plan > Provision > Device Configuration > Single Device Configuration from the main menu.
Select the device to be configured and choose IP Service Configuration > ASPF Configuration from the navigation pane.
On the Enabled protocol type tab page, click Create and configure the protocols on which ASPF is to be performed.
Click OK.

Parameter Description

Table 2-517 Parameters for configuring ASPF

Parameter

Description

Enabled protocol type

Name of the protocol on which ASPF is to be performed.

The options include:

dns
ftp
h323
msn
netbios
pptp
qq
rsh
rtsp
sip
sqlnet
ipv6-ftp
ipv6-rstp
ipv6-sip

Address and Address Group

Context

An address object is a set of IPv4 or IPv6 addresses, and an address group is a set of address objects or sub-address groups. Each policy can reference an IP address as a matching condition. If complete address information is required each time you configure a policy, the configuration process will become complex and address segments are difficult to remember. To resolve this issue, the address object and address group are introduced. An address object contains one or more IPv4 or IPv6 addresses. Similar to a basic component, an address object can be referenced by various policies, once being defined. An address group contains multiple address objects or sub-address groups, improving the flexibility of address management.

Only firewalls running V600 support this function.

Procedure

Choose Plan > Provision > Device Configuration > Single Device Configuration from the main menu.
Select the device to be configured and choose IP Service Configuration > Address and Address Group Configuration > Address from the navigation pane.
Click Create and configure the address object information.
Click OK. The address object configuration is completed.
Select the device to be configured and choose IP Service Configuration > Address and Address Group Configuration > Address Group from the navigation pane.
Click Create and configure address group information.
Click OK. The address group configuration is completed.

Parameter Description

Table 2-518 Address and address group parameters

Parameter			Description
Address	Global	Name	Name of an address object.
	Global	Description	Description of an address object.
	ElementList	ID	Element ID of an address object.
		Address Element	Address object element.
		IPv4 Address	IPv4 address.
		Mask	IPv4 address mask.
		Start Address	Start IPv4 address.
		End Address	End IPv4 address.
		IPv6 Address	IPv6 address.
		Prefix	IPv6 address prefix.
		Start Address	Start IPv6 address.
		End Address	End IPv6 address.
		MAC Address	MAC address.
Address Group	Global	Name	Name of an address group.
	Global	Description	Description of an address group.
	ElementList	ID	Element ID of an address group.
		Address Group Element	Address group element.
		Group Name	Name of an address group.
		Address	Name of an address object.

IP Routing Configuration

Before configuring an edge site to connect to an RR, do not delete the last route on the single device configuration page. Otherwise, the device will fail to be managed. If the last route is incorrectly deleted, perform the following operations to reconfigure the route:

For NE devices, manually reconfigure an IPv4 route destined for the controller.
For AR5700&6700&8000 series devices, re-deploy them. For details, see Configuring WAN-side Routing.

Configuring an IPv4 Static Route

Prerequisites

The tenant administrator has completed the deployment configuration, and devices have been successfully managed by the controller.
A VPN instance has been configured.

Procedure

Choose Plan > Provision > Device Configuration > Single Device Configuration from the main menu.
Select the device to be configured and choose Routing Configuration > IPv4 Static Routing from the navigation pane.
Choose Create. On the IPv4 Static Route [Create] page, set global attributes for an IPv4 static route.
- Set IPv4 address/Mask to specify the destination IPv4 address and mask.
- Set VPN to the name of an existing VPN instance which is to be bound to the route.
- Set Next-hop type. You can set this parameter to IP address, Outbound interface, or IP address + Outbound interface as needed.
Configure the next hop of the IPv4 static route.
- If Next-hop type is set to IP address, choose IP address from the navigation pane.
- If Next-hop type is set to Outbound interface, choose Outbound interface from the navigation pane.
- If Next-hop type is set to IP address + Outbound interface, choose IP address + Outbound interface from the navigation pane.

Parameter Description

Table 2-519 Parameters for configuring an IPv4 static route

Parameter		Description
Global	IPv4 address/Mask	Destination network segment and mask of an IPv4 static route.
	VPN	VPN instance name. If a VPN instance name is specified, the device searches the routing table of the VPN instance for the outbound interface of the static route with the specified next-hop address.
	Next-hop type	Type of the next hop in the static route: IP address Outbound interface IP address + Outbound interface Black_hole: indicates that the packets destined for the destination network segment will be discarded. For example, it can be used to block packets destined for a particular Internet website.
	Track setting	NQA: associates the static route with an NQA test instance. BFD Enable: associates the static route with a BFD session.
	NQA	After an IP static route is associated with an NQA test instance, an ICMP NQA test instance is created to check whether the IP address of the static route is reachable. If the NQA test instance fails, the IP static route is withdrawn. In this manner, invalid IP static routes can be detected in a timely manner. For details, see Configuring NQA.
	BFD Enable	Whether to associate the IPv4 static route with a BFD session. When the BFD session associated with an IPv4 static route detects a link fault, the BFD session goes Down and the route is withdrawn from the IP routing table. When the BFD session goes Up, the route is added to the IP routing table. For details, see Configuring a BFD Template.
IP address	IPv4 address	Next-hop IP address of the static route.
IP address	Priority	Priority of the static route.
Outbound interface	Interface name	Outbound interface of the static route.
	Priority	Priority of the static route.
	DHCP Enable	Whether to enable DHCP on the outbound interface.
IP address + Outbound interface	IPv4 address	Next-hop IP address of the static route.
	Interface name	Outbound interface of the static route.
	Priority	Priority of the static route.

Configuring an IPv6 Static Route

Prerequisites

The tenant administrator has completed the deployment configuration, and devices have been successfully managed by the controller.
A VPN instance has been configured.

Procedure

Choose Plan > Provision > Device Configuration > Single Device Configuration from the main menu.
Select the device to be configured and choose Routing Configuration > IPv6 Static Routing from the navigation pane.
Choose Create. On the IPv6 Static Route [Create] page, set global attributes for an IPv6 static route.
- Set IPv6 address/mask to specify the destination IPv6 address and mask.
- Set VPN to the name of an existing VPN instance which is to be bound to the route.
- Set Next-hop type. You can set this parameter to IP address, Outbound interface, or IP address + Outbound interface as needed.
Configure the next hop of the IPv6 static route.
- If Next-hop type is set to IP address, choose IP address from the navigation pane.
- If Next-hop type is set to Outbound interface, choose Outbound interface from the navigation pane.
- If Next-hop type is set to IP address + Outbound interface, choose next-hop-interface-addresses from the navigation pane.

Parameter Description

Table 2-520 Parameters for configuring an IPv6 static route

Parameter		Description
Global	IPv6 address/mask	Destination network segment and mask of an IPv6 static route.
	VPN	VPN instance name. If a VPN instance name is specified, the device searches the routing table of the VPN instance for the outbound interface of the static route with the specified next-hop address.
	Next-hop type	Type of the next hop in the static route: IP address Outbound interface IP address + Outbound interface Black_hole: indicates that the packets destined for the destination network segment will be discarded. For example, it can be used to block packets destined for a particular Internet website.
	Track setting	NQA: associates the static route with an NQA test instance. BFD Enable: associates the static route with a BFD session.
	NQA	After an IP static route is associated with an NQA test instance, an ICMP NQA test instance is created to check whether the IP address of the static route is reachable. If the NQA test instance fails, the IP static route is withdrawn. In this manner, invalid IP static routes can be detected in a timely manner. For details, see Configuring NQA.
	BFD Enable	Whether to associate the IPv6 static route with a BFD session. When the BFD session associated with an IPv6 static route detects a link fault, the BFD session goes Down and the route is withdrawn from the IP routing table. When the BFD session goes Up, the route is added to the IP routing table. For details, see Configuring a BFD Template.
IP address	IPv6 address	Next-hop IP address of the static route.
IP address	Priority	Priority of the static route.
Outbound interface	Interface name	Outbound interface of the static route.
Outbound interface	Priority	Priority of the static route.
next-hop-interface-addresses	IPv6 address	Next-hop IP address of the static route.
	Interface name	Outbound interface of the static route.
	Priority	Priority of the static route.

Configuring OSPF

Prerequisites

The tenant administrator has completed the deployment configuration, and devices have been successfully managed by the controller.
A VPN instance has been configured.

Procedure

Choose Plan > Provision > Device Configuration > Single Device Configuration from the main menu.
Select the device to be configured and choose Routing Configuration > OSPF from the navigation pane.
Choose Create. On the OSPF [Create] page that is displayed, configure global OSPF attributes.
Process ID: indicates an OSPF process ID. You can create different processes for services of different types.

Router ID: indicates the router ID. The router IDs of any two routers in an AS must be different. Generally, a device uses the IP address of an interface as its router ID.

Enable OPAQUE LSA: enables or disables the Opaque-LSA capability. This setting may delete and re-establish all sessions and instances.

Enable OSPF IETF GR: enables or disables OSPF to gracefully restart the router through IETF GR. This parameter can be set only when Opaque LSA is enabled.

VPN: specifies a VPN instance. If a VPN instance is specified, the OSPF process belongs to this VPN instance. Otherwise, the OSPF process belongs to a public network instance.

Advertise default route: specifies whether to advertise default routes to common OSPF areas. After this function is enabled, the device keeps advertising OSPF default routes.

Default route cost: indicates the cost of the advertised OSPF default routes.

Inner priority: indicates the priority of OSPF routes (excluding AS external routes). A smaller value indicates a higher priority.

ASE priority: indicates the priority of AS external routes in OSPF. A smaller value indicates a higher priority.
Configure an OSPF area.
Area ID: specifies the ID of an OSPF area.

Area: specifies the OSPF area type, which can be normal, stub, or NSSA.
Configure route import in OSPF.
Protocol: specifies the protocol to the routes to be imported. Direct, static, OSPF, BGP, UNR, RIP, IS-IS, and OPR routes can be imported.

Process ID: specifies the ID of the OSPF process whose routes are to be imported.

Cost: indicates the cost of the imported route. The value of this parameter will overwrite the cost in the original route.

Type: specifies the type of routes to be imported. The options include type1 and type2.

Route policy: specifies the routing policy for route import.
Configure BFD for OSPF.
Enable: specifies whether to enable BFD for OSPF.

Min rx: specifies the minimum interval for receiving BFD packets from the peer end.

Min tx: specifies the minimum interval for sending BFD packets to the peer end.

Local detection multiplier: specifies the local detection multiplier of a BFD session.

Frr binding: specifies whether to bind the BFD session to all interfaces.
Configure FRR for OSPF.
Enable: specifies whether to enable BFD for OSPF.

LFA: specifies whether to enable OSPF Loop-Free Alternate (LFA) Fast Reroute (FRR).
Configure the device as a stub router in OSPF.
Type: indicates the type of the stub router.

Interval: indicates the period during which the device remains as a stub router.

Parameter Description

Table 2-521 Parameters for configuring OSPF

Parameter		Description
Global	Process ID	ID of an OSPF process.
	Router ID	Router ID of the local device. The value must be a unique IPv4 address on the network. By default, the router ID of the route management module is 0.0.0.0 when no IP address is configured on the device.
	Enable OPAQUE LSA	Enabling or disabling the Opaque-LSA capability may delete and re-establish all sessions and instances.
	Enable OSPF IETF GR	Enables or disables OSPF to enable routers to restart gracefully through IETF GR. This parameter can be set only when Opaque LSA is enabled.
	VPN	VPN instance name.
	Advertise default route	Whether to advertise default routes to common OSPF areas. After this function is enabled, the device keeps advertising OSPF default routes.
	Default route cost	Cost of advertised OSPF default routes.
	Inner priority	Priority of an OSPF route (excluding AS external routes). A smaller value indicates a higher priority.
	ASE priority	Priority of an OSPF AS external route. A smaller value indicates a higher priority.
Area	Area ID	OSPF area ID.
Area	Area	OSPF area type, which can be normal, stub, or NSSA.
Bind interface	Interface name	Interface to be configured.
	Hello interval	Hello packets are sent periodically from OSPF interfaces to establish and confirm adjacency relationships. A Hello packet includes information about the designated router (DR), backup designated router (BDR), known neighbors, and timers, including the Hello timer. The smaller the Hello timer, the faster the network topology changes can be detected, and the larger the route cost. This parameter defines the interval at which an interface sends Hello packets. The value is an integer from 0 to 65535, in seconds.
	DR priority	The priority of an interface determines whether the interface is qualified to be a DR or BDR. The interface with the highest priority is elected as the DR. However, an interface with the priority of 0 cannot be elected as a DR or BDR. On a broadcast or NBMA network, you can set the DR priority for an interface to determine whether it is qualified to be a DR or a BDR. This parameter defines the priority of an interface that participates in DR or BDR election. A larger value indicates a higher priority. The value is an integer from 1 to 255.
	Cost	Cost of an OSPF interface.
	Check model	With the increase in attacks on TCP/IP networks and inherent defects and flawed implementation of the TCP/IP protocol suite, the attacks have increasing impacts on the networks. Attacks on network devices may even cause a network crash or lead to network unavailability. To improve OSPF network security, configure authentication. none: configures no authentication. This mode has security risks. You are advised to use a more secure authentication mode. md5: configures MD5 authentication. This mode has security risks. You are advised to use a more secure authentication mode. hmac-sha256: configures HMAC-SHA256 ciphertext authentication. hmac-md5: configures HMAC-MD5 authentication. This mode has security risks. You are advised to use a more secure authentication mode.
	Key ID	Authentication key ID for ciphertext authentication on the interface. It must be consistent with that on the peer end. The value is an integer from 1 to 255.
	Password	Password for ciphertext authentication on an interface.
	Peer Hold Max Timer(ms)	When an OSPF interface changes from down to up, the OSPF neighbor relationship is re-established. After IGP route convergence is completed, traffic is switched back. In most cases, IGP routes converge quickly. However, many services that depend on IGP routes may require a delayed switchback. To address this issue, you can set this parameter to specify a period during which OSPF keeps the maximum cost in local LSAs. After the OSPF neighbor relationship reaches the Full state, the traffic forwarding path remains unchanged during the specified period. After this period expires, the maximum cost is restored to the original cost, and traffic is switched back. This parameter defines a period during which OSPF keeps the maximum cost in local LSAs.
enable address	enable address	IP address of the interface to be added to the OSPF area.
enable address	Mask	Mask of the IP address of the interface to be added to the OSPF area.
Import route	Protocol	Protocol of routes to be imported. Direct, static, OSPF, BGP, UNR, RIP, IS-IS, and OPR routes can be imported.
	Process ID	OSPF process whose routes need to be imported.
	Cost	Cost of an imported route. The value of this parameter will overwrite the cost in the original route.
	Type	Type of the routes to be imported. The options include type1 and type2.
	Route policy	Routing policy that controls the routes to be imported.
BFD	Enable	Whether to enable BFD for OSPF.
	Min rx(ms)	Minimum interval for sending BFD packets to the peer end.
	Min tx(ms)	Minimum interval for receiving BFD packets from the peer end.
	Local detection multiplier	Local detection multiplier for the BFD session.
	Frr binding	Whether to bind the BFD session to all interfaces.
FRR	Enable	Whether to enable OSPF IP FRR.
FRR	LFA	Whether to enable OSPF LFA FRR.
Stub Router	Type	no-config: The device is not configured as a stub router. stub-on-hand: The device is configured as a stub router. stub-on-boot: The device keeps functioning as a stub device during an active/standby switchover. The default value is no-config.
Stub Router	Interval(s)	Time period during which the device keeps functioning as a stub router. The default value is 500 seconds.

Configuring OSPFv3

Prerequisites

The tenant administrator has completed the deployment configuration, and devices have been successfully managed by the controller.
A VPN instance has been configured.

Procedure

Choose Plan > Provision > Device Configuration > Single Device Configuration from the main menu.
Select the device to be configured and choose Routing Configuration > OSPFv3 from the navigation pane.
Choose Create. On the OSPFv3 [Create] page that is displayed, configure global OSPFv3 attributes.
Process ID: indicates an OSPFv3 process ID. You can create different processes for services of different types.

Router ID: indicates the router ID. The router IDs of any two routers in an AS must be different. Generally, a device uses the IP address of an interface as its router ID.

VPN: specifies a VPN instance. If a VPN instance is specified, the OSPFv3 process belongs to this VPN instance. Otherwise, the OSPFv3 process belongs to a public network instance.

Advertise default route: specifies whether to advertise default routes to common OSPFv3 areas. After this function is enabled, the device keeps advertising OSPFv3 default routes.

Default route cost: indicates the cost of the advertised OSPFv3 default routes.

Inner priority: indicates the priority of OSPFv3 routes (excluding AS external routes). A smaller value indicates a higher priority.

ASE priority: indicates the priority of AS external routes in OSPFv3. A smaller value indicates a higher priority.

Export IP prefix: specifies the routing policy that filters the routes to be advertised. You need to configure such a routing policy in advance.

Import route policy: specifies the routing policy that filters the routes to be received. You need to configure such a routing policy in advance.
Configure an OSPFv3 area.
Area ID: specifies the ID of an OSPFv3 area.
Configure route import in OSPFv3.
Protocol: specifies the protocol to the routes to be imported. Direct, static, OSPFv3, BGP, UNR, RIPng, IS-IS, and OPR routes can be imported.

Process ID: specifies the ID of the OSPFv3 process whose routes are to be imported.

Cost: indicates the cost of the imported routes. The value of this parameter will overwrite the cost in the original route.

Type: specifies the type of routes to be imported. The options include type1 and type2.

Route policy: specifies the routing policy that filters the routes to be imported. Only routes matching this policy can be imported.
Configure BFD for OSPFv3.
Enable: specifies whether to enable BFD for OSPFv3.

Min rx: specifies the minimum interval for receiving BFD packets from the peer end.

Min tx: specifies the minimum interval for sending BFD packets to the peer end.

Local detection multiplier: specifies the local detection multiplier of a BFD session.

Frr binding: specifies whether to bind the BFD session to all interfaces.
Configure FRR for OSPFv3.
Enable: specifies whether to enable BFD for OSPFv3.

LFA: specifies whether to enable OSPFv3 LFA FRR.
Configure locators for OSPFv3.
locator-name: specifies the locator associated with OSPFv3 routes. Locator information is advertised through OSPFv3 routes.

auto-sid: whether to enable dynamic SID allocation in OSPFv3.
Configure the device as a stub router in OSPFv3.
Type: indicates the type of the stub router.

Interval: indicates the period during which the device remains as a stub router.

Parameter Description

Table 2-522 Parameters for configuring OSPFv3

Parameter		Description
Global	Process ID	ID of an OSPFv3 process.
	Router ID	Router ID of the local device. The value must be a unique IPv4 address on the network. By default, the router ID of the route management module is 0.0.0.0 when no IP address is configured on the device.
	VPN	VPN instance name.
	Advertise default route	Whether to advertise default routes to common OSPFv3 areas. After this function is enabled, the device keeps advertising OSPFv3 default routes.
	Default route cost	Cost of advertised OSPFv3 default routes.
	Inner priority	Priority of an OSPFv3 route (excluding AS external routes). A smaller value indicates a higher priority.
	ASE priority	Priority of an OSPFv3 AS external route. A smaller value indicates a higher priority.
	Export IPv6 prefix	Routing policy that filters the routes to be advertised. You need to configure such a routing policy in advance.
	import-route-policy	Routing policy that filters the routes to be imported. You need to configure such a routing policy in advance.
Area	Area ID	OSPFv3 area ID.
Bind interface	Interface name	Interface to be configured.
	Instance ID	ID of the instance to which the interface belongs.
	Hello interval	Hello packets are sent periodically from OSPFv3 interfaces to establish and confirm adjacency relationships. A Hello packet includes information about the designated router (DR), backup designated router (BDR), known neighbors, and timers, including the Hello timer. The smaller the Hello timer, the faster the network topology changes can be detected, and the larger the route cost. This parameter defines the interval at which an interface sends Hello packets. The value is an integer from 0 to 65535, in seconds.
	DR priority	The priority of an interface determines whether the interface is qualified to be a DR or BDR. The interface with the highest priority is elected as the DR. However, an interface with the priority of 0 cannot be elected as a DR or BDR. On a broadcast or NBMA network, you can set the DR priority for an interface to determine whether it is qualified to be a DR or a BDR. This parameter defines the priority of an interface that participates in DR or BDR election. A larger value indicates a higher priority.
	Cost	Cost of an OSPFv3 interface.
	Check model	With the increase in attacks on TCP/IP networks and inherent defects and flawed implementation of the TCP/IP protocol suite, the attacks have increasing impacts on the networks. Attacks on network devices may even cause a network crash or lead to network unavailability. To improve OSPFv3 network security, configure authentication. none: configures no authentication. This mode has security risks. You are advised to use a more secure authentication mode. hmac-sha256: configures HMAC-SHA256 authentication.
	Key ID	Authentication key ID for ciphertext authentication on the interface. It must be consistent with that on the peer end. The value is an integer from 1 to 65535.
	Password	Password for ciphertext authentication on an interface.
	Peer Hold Max Timer(ms)	When an OSPFv3 interface changes from down to up, the OSPFv3 neighbor relationship is re-established. After IGP route convergence is completed, traffic is switched back. In most cases, IGP routes converge quickly. However, many services that depend on IGP routes may require a delayed switchback. To address this issue, you can set this parameter to specify a period during which OSPFv3 keeps the maximum cost in local LSAs. After the OSPFv3 neighbor relationship reaches the Full state, the traffic forwarding path remains unchanged during the specified period. After this period expires, the maximum cost is restored to the original cost, and traffic is switched back. This parameter defines a period during which OSPFv3 keeps the maximum cost in local LSAs. The value is an integer from 100 to 1000000, in milliseconds.
Import route	Protocol	Protocol of routes to be imported. Direct, static, OSPFv3, BGP, UNR, RIPng, IS-IS, and OPR routes can be imported.
	Process ID	OSPFv3 process whose routes need to be imported.
	Cost	Cost of an imported route. The value of this parameter will overwrite the cost in the original route.
	Type	Type of the routes to be imported. The options include type1 and type2.
	Route policy	Name of a route policy. Only the routes matching the policy can be imported.
BFD	Enable	Whether to enable BFD for OSPFv3.
	Min rx(ms)	Minimum interval for sending BFD packets to the peer end.
	Min tx(ms)	Minimum interval for receiving BFD packets from the peer end.
	Local detection multiplier (ms)	Local detection multiplier for the BFD session.
	Frr binding	Whether to bind the BFD session to all interfaces.
FRR	Enable	Whether to enable OSPFv3 IP FRR.
FRR	LFA	Whether to enable OSPFv3 LFA FRR.
locators	locator-name	Locator to be associated with OSPFv3 routes. Locator information is advertised through OSPFv3 routes.
locators	auto-sid	Whether to enable dynamic SID allocation in OSPFv3.
Stub Router	Type	no-config: The device is not configured as a stub router. stub-on-hand: The device is configured as a stub router. stub-on-boot: The device keeps functioning as a stub device during an active/standby switchover. The default value is no-config.
Stub Router	Interval(s)	Time period during which the device keeps functioning as a stub router. The default value is 500 seconds.

Configuring BGP

Context

You can configure BGP on a single device through agile configuration.

Prerequisites

A device has been added.

Procedure

Choose Plan > Provision > Device Configuration > Single Device Configuration from the main menu.
Select the device to be configured and choose Routing Configuration > BGP from the navigation pane.
Configure whether to enable GR for BGP speakers in the local AS.

Parameter Description

Table 2-523 Parameters for configuring BGP

Parameter

Description

BGP

Local AS

AS number of the local device. If this parameter is left empty, the AS number in the global configuration is used by default.

Enable GR

Whether to enable GR for BGP speakers globally.

After GR is enabled, the device can assist other GR-enabled devices in performing GR when BGP restarts. This prevents traffic interruption.

Configuring VPN BGP

Context

Border Gateway Protocol (BGP) is a dynamic routing protocol used between autonomous systems (ASs).

BGP exchanges reachable routing information between ASs, establishes inter-AS paths, prevents routing loops, and applies routing policies between ASs.

The configuration in the BGP-VPN instance view takes effect for the routes and peers of all address families in the specified VPN instance.

Prerequisites

A VPN instance has been created.

Procedure

Choose Plan > Provision > Device Configuration > Single Device Configuration from the main menu.
Select the device to be configured and choose Routing Configuration > VPN BGP from the navigation pane.
Click Create. Select a VPN, set a router ID, and set other VPN BGP parameters as needed.
Expand IPv4 address or IPv6 address on the left and configure BGP IPv4/IPv6 address family information to advertise locator routes through BGP.
Expand BGP PeerList on the left and configure BGP peer information.
Set other parameters based on the site requirements.
Click OK.

Parameter Description

Table 2-524 Parameters for configuring VPN BGP

Parameter			Description
Global	VPN		Select an existing VPN.
Global	Router ID		Router ID of the local device. The value must be a unique IPv4 address on the network. By default, the router ID of the route management module is 0.0.0.0 when no IP address is configured on the device.
IPv4 family/IPv6 family	Select family		Whether to enable or disable the IPv4 or IPv6 address family.
	Import default route		Whether to import the default routes in the local IP routing table to the BGP routing table.
	Route select delay(s)		Route switchback delay.
	Reflector cluster ID		Cluster ID of an RR. Configuring multiple RRs in a cluster can enhance the stability of the network. If more than one RR is configured in a cluster, you can use this parameter to set the same cluster ID for all the RRs to prevent routing loops. To enable clients to receive routes reflected by RRs, ensure that the cluster ID of the RRs is different from the router ID of any client. If the cluster ID of the RRs is the same as the router ID of a client, the client will discard received routes.
	reflect-change-path		Whether to enable an RR to modify the path attributes of BGP routes using an export policy.
	Auto frr		Whether to enable the BGP Auto Fast Reroute (FRR) function. BGP Auto FRR allows a routing device to select the optimal route from the routes destined for the same network and automatically add the second best route to the backup forwarding entries of the optimal route. If the primary path fails, the routing device quickly switches traffic to the backup path.
	SRv6 mode		In the IPv4/IPv6 over SRv6 scenario, you can configure the SRv6 mode to recurse private network routes to SRv6 BE tunnels or SRv6 TE Policies based on the SIDs carried in the routes. te: VPN routes are recursed to SRv6 TE Policies based on the SIDs carried in the routes. be: VPN routes are recursed to SRv6 BE tunnels based on the SIDs carried in the routes.
	Enable TE-to-BE switchover		In the scenario where IPv4/IPv6 over SRv6 is used on the public network and both SRv6 BE and SRv6 TE Policy modes are configured, if SRv6 TE Policies fail, SRv6 BE tunnels are used as the best-effort paths for services.
	Tunnel selector		In the scenario where IPv4/IPv6 over SRv6 is used on the public network, you can specify a tunnel selector to recurse public network routes to an IPv6 tunnel.
	Preference	External	Protocol preference of an EBGP external route. EBGP routes are the optimal routes learned from peers outside the local AS.
		Internal	Protocol preference of an IBGP internal route. IBGP routes are those learned from peers inside the local AS.
		Local	Specifies the protocol preference of a local BGP route. A larger value indicates a higher preference. The local preference helps determine the optimal route when traffic leaves an AS.
	Aggregate route	Address	Specific routes in the local BGP routing table are aggregated, and both the specific routes and aggregated route are advertised.
	Aggregate route	Mask
	enable route	Address	You can manually import a route in the local routing table to the BGP routing table so that the route is advertised to peers.
	enable route	Mask
	Import route	Protocol	Routes to be imported to BGP. The value is of the enumerated type: direct: direct routes ospf/ospfv3: OSPF routes isis: IS-IS routes static: static routes rip/ripng: RIP routes unr: UNRs User network routes (UNRs) are generated for user traffic when dynamic routing protocols cannot generate routes during user login. op-route: open programming routes.
		Process ID	Process ID of the routes to be imported. A process ID needs to be specified if OSPF, IS-IS, or RIP routes need to be imported.
		Cost	Cost of an imported route.
		Route policy	Routing policy to filter routes to be imported.
	EVPN	SRv6 mode	Whether to enable the SRv6 mode. After this mode is enabled, private network routes are recursed to SRv6 BE tunnels or SRv6 TE Policies based on the SIDs carried in the routes. te: VPN routes are recursed to SRv6 TE Policies based on the SIDs carried in the routes. be: VPN routes are recursed to SRv6 BE Policies based on the SIDs carried in the routes.
	EVPN	Locator name	Locator to be bound to the private network routes. The locator information is advertised through BGP together with routes.
	L2 EVPN	Protocol	Protocol for advertising L2 EVPN routes.
	L2 EVPN	Mode	Mode for advertising L2 EVPN routes: all: advertises all L2 EVPN routes. best: advertises only optimal L2 EVPN routes. valid: advertises only valid L2 EVPN routes.
	Locator	Locator name	Locator to be bound to public network routes. In the scenario where IPv4/IPv6 over SRv6 is used on the public network, the locator information is advertised through BGP together with routes.
VPNv4 family	Enable		Whether to enable the BGP-VPNv4 address family.
VPNv4 family	VPN target		Whether to filter the received VPN routes based on VPN target values. By default, this function is enabled. Only the VPN route whose export RT attribute matches the local import RT attribute can be added to the routing table.
L2 EVPN	Select family		Whether to enable the BGP-EVPN address family.
	Config VPN Target		Whether to filter the received VPN routes based on VPN target values. By default, this function is enabled. Only the VPN route whose export RT attribute matches the local import RT attribute can be added to the routing table.
	Reflector change path		Whether an RR can modify the path attributes of BGP routes through an export policy.
BGP-LS	Enable		Whether to enable BGP-LS. Border Gateway Protocol - Link State (BGP-LS) allows BGP to summarize topology information collected by IGPs and report it to the controller.
	domain-identifier		A BGP-LS domain ID identifies a device on which BGP-LS is enabled. If no BGP-LS domain ID is set, a BGP router ID is used as a BGP-LS domain ID by default. The same BGP-LS domain ID can be configured for different devices. This is required if the controller needs to compute paths based on the combined topology information reported by the devices.
	Reflector cluster ID		You are advised to set the same cluster ID for all route reflectors in a cluster to identify this cluster and prevent routing loops.
IPv6 SR-Policy	Enable		Whether to enable the BGP IPv6 SR-Policy address family.
	Recurse to IP participate in route selection		Whether to enable the function of allowing routes to participate in route selection if they recurse to IP addresses.
	Router ID Filter		Whether to enable the router ID filtering function.
BGP Peer	Peer IPv4 or IPv6 address		IP address of the peer device. In most cases, a BGP peer relationship is established with a legacy site.
	Peer AS		AS number of the peer device.
	Local AS number		AS number of the local device.
	Interface		Interface on which a BGP peer relationship is set up.
	Interface address		IP address of the interface on which the BGP peer relationship is established.
	EBGP max hop		This function enables a BGP device to establish an EBGP connection with a peer on an indirectly-connected network, and set the maximum number of hops. Generally, directly connected physical links must be available between EBGP peers. If no directly connected physical links exist, you must configure the maximum number of EBGP connection hops to ensure that a TCP connection can be set up between the EBGP peers through multiple hops.
	auth type		BGP authentication mode: null: no authentication password: encrypted authentication cipher: SHA1 authentication password simple: cleartext password keychain: Keychain authentication is mutually exclusive with password authentication. Configuring Keychain authentication improves the security of the TCP connection. Configure keychain authentication on both ends of BGP peers. The keychains configured at both ends must use the same encryption algorithm and password so that a TCP connection can be set up and BGP messages can be exchanged properly.
	Timer	Keep alive time(s)	BGP Keepalive time. A pair of BGP peers periodically send Keepalive messages to each other to inform their local states.
	Timer	Host time(s)	BGP hold time. If a device receives no Keepalive message from its peer after the Hold timer expires, the device considers the BGP connection to be closed. The hold time must be at least three times longer than the lifetime.
	IPv4 family/IPv6 family	Select family	Whether to enable the IPv4 or IPv6 address family for the VPN instance.
		AS allow loop	Maximum number of times the local AS number can be included in the AS_Path attribute of a route.
		Advertise community	Whether a device advertises community attributes to a peer.
		Advertise extended community	Whether to advertise extended community attributes to peers.
		Next hop configuration	Whether to modify the Next-hop attribute. local: The device uses its own address as the next hop of the routes to be advertised. invariable: The device advertises routes with the next hop unchanged to an EBGP peer.
		Prefix SIDs	Whether to send prefix SIDs to peers.
		Reflect client	Whether to enable route reflection by RRs.
		Export route policy	After a route advertisement policy is configured on a BGP device, the device advertises only routes that match the policy to its BGP peers.
		Route import policy	After a route import policy is configured on a BGP device, the device receives only routes that match this policy and modify route attributes to control traffic forwarding paths.
	VPNv4 family	Enable	Whether to enable the BGP-VPNv4 address family.
		Export route policy	After a route advertisement policy is configured on a BGP device, the device advertises only routes that match the policy to its BGP peers.
		Route import policy	After a route import policy is configured on a BGP device, the device receives only routes that match this policy and modify route attributes to control traffic forwarding paths.
	L2 EVPN	Select family	Whether to enable the BGP-EVPN address family.
		Reflect client	Whether to enable route reflection by RRs.
		Export route policy	After a route advertisement policy is configured on a BGP device, the device advertises only routes that match the policy to its BGP-EVPN peers.
		Import route policy	After a route import policy is configured on a BGP device, the device receives only routes that match this policy and modify route attributes to control traffic forwarding paths.
	BGP-LS	Enable	Whether to enable BGP-LS.
		Reflect client	Whether to enable route reflection by RRs.
		Export route policy	After a route advertisement policy is configured on a BGP device, the device advertises only routes that match the policy to its BGP-LS peers.
	IPv6 SR-Policy	Enable	Whether to enable the BGP IPv6 SR-Policy address family.
		Reflect client	Whether to enable route reflection by RRs.
		Advertise ext community	Whether to advertise extended community attributes to a specified peer.
		Graceful restart static timer(s)	Maximum hold-off time for the local device to wait for GR recovery on the peer end.
	BFD	-	BGP periodically sends Keepalive messages to a peer to monitor the peer's status, but this mechanism takes an excessively long time, more than 1 second, to detect a fault. If data is transmitted at Gbit/s rates and a link fault occurs, such a lengthy detection period will result in a large amount of data being lost, making it impossible to meet the high reliability requirements of carrier-grade networks. Association between BGP and BFD can solve this problem. BFD is a millisecond-level fault detection mechanism. It can fast detect faults on the link between BGP peers within 50 ms. Therefore, BFD speeds up BGP route convergence, ensures fast link switching, and reduces traffic loss. Effective interval at which BFD packets are sent by the local end = MAX { Configured minimum interval at which BFD packets are sent by the local end, Configured minimum interval at which BFD packets are received by the remote end } Effective interval at which BFD packets are received by the local end = MAX { Configured minimum interval at which BFD packets are sent by the remote end, Configured minimum interval at which BFD packets are received by the local end } Actual period for BFD detection on the local device = Actual interval at which BFD packets are received on the local device x BFD detection multiplier on the peer device
		Enable	Whether to enable BFD globally.
		Multiplier	Local detection time multiplier.
		Min-rx-interval(ms)	Interval at which BFD packets are sent.
		Min-tx-interval(ms)	Interval at which BFD packets are received.

Configuring IS-IS

Context

You can configure IS-IS on a single device through agile configuration.

Only ARs running V600 and NE devices support this function.

Prerequisites

A device has been added.

Procedure

Choose Plan > Provision > Device Configuration > Single Device Configuration from the main menu.
Select the device to be configured and choose Routing Configuration > IS-IS from the navigation pane.
Click Create. In the dialog box that is displayed, configure basic IS-IS information.
1. Set an IS-IS process ID.
2. (Optional) Select a VPN instance to be bound to the IS-IS process.
3. (Optional) Set an IS-IS process name.
4. Set the device level. If the device is located on the backbone network, set it to a level-2 device; if the device is located on a boundary network, set it to a level-1 device; if the device connects the backbone network and a boundary network, set it to a level-1-2 device.
5. (Optional) Select the cost type.
6. Click OK.
(Optional) Click Edit in the Operation column to modify basic IS-IS information.
Click Edit in the Operation column, click the Network entities tab, click Create to configure an IS-IS network entity, and click OK.
Click the Avoid microloop tab and configure the microloop avoidance function.
Click Binding interface to bind the IS-IS configuration to an interface.
- Click Create, configure the interface where the configuration is to be bound, and click OK.
- Click Edit in the Operation column, click Create, and configure an address family.
- Click Edit in the Operation column, click the FRR tab, and configure FRR for the interface.
Click the IPv6 tab and configure IPv6 information.
- Click the Import Routes tab, click Create, and configure route import to IPv6 IS-IS.
- Click the Preference tab and configure a route priority.
- Click the BFD tab and configure BFD for IPv6 IS-IS.
- Click the FRR tab and configure FRR for SRv6.
  - Click the FRR tab. If FRR for SRv6 needs to be configured, enable FRR for the corresponding IS-IS level.
  - Click the tiebreaker tab and set the solution of selecting a backup path for SRv6 FRR.
- Click the Locators tab, click Create, and configure locator routes.
- Click the Avoid microloop tab and configure the microloop avoidance function.
- Click the Inter Level Protect tab and enable inter-level protection in IS-IS Level-1.
- Click the More > Ipv6 advertise link attributes tab and decide whether to enable IPv6 link attributes.
- Choose More > IPv6 TE to configure IPv6 TE.
  
  AR devices do not support advertisement of IPv6 delay information. Only NE devices support this function.
Click Edit in the Operation column, click the IPv4 tab, and configure IPv4 information.
- Click the Import Routes tab, click Create, and configure route import to IPv4 IS-IS.
- Click the Preference tab and configure a route priority.
- Click the BFD tab and configure BFD for IPv4 IS-IS.
- Click the FRR tab and set FRR parameters.
Click the Timer tab and set LSP intervals and SPF parameters.
Click Edit in the Operation column, choose More > Lsp auths tab, and click Create to configure authentication for IS-IS.
Click Edit in the Operation column, choose More > Set overload, and configure an overload bit.
Click Edit in the Operation column, choose More > BGP ls, and configure BGP-LS identifiers.
Click Commit.

Parameter Description

Table 2-525 Parameters for configuring IS-IS

Parameter			Description
Basic IS-IS information	Process ID		ID of an IS-IS process. Once an IS-IS process ID is set, the process is started.
	VPN		VPN instance where IS-IS is to be configured.
	Is name		Name of an IS-IS process.
	Level		Level of an IS-IS device: level-1: Sets the level of the router to Level-1. A Level-1 router is responsible for intra-area routing and maintains the Level-1 LSDB. level-1-2: Sets the level of the router to Level-1-2. A Level-1-2 router calculates both Level-1 and Level-2 routes and maintains the LSDBs of Level-1 and Level-2. level-2: Sets the level of the router to Level-2. A Level-2 router calculates only Level-2 routes and maintains the Level-2 LSDB.
	Cost style		Cost style of routes received and sent by the IS-IS device: narrow: Configures an IS-IS device to receive and send only routes with the cost style of narrow. When the cost style is narrow, the cost of routes ranges from 1 to 63. wide: Configures an IS-IS device to receive and send only routes with the cost style of wide. When the cost style is wide, the cost of routes ranges from 1 to 16777215. transition: Configures an IS-IS device to receive and send routes with the cost style of either narrow or wide. ntransition: Configures an IS-IS device to receive routes with the cost style of either narrow or wide and sent only routes with the cost style of narrow. wtransition: Configures an IS-IS device to receive routes with the cost style of either narrow or wide and sent only routes with the cost style of wide.
Network entities			Network entity title (NET) for an IS-IS process. The value is in the X…X.XXXX.XXXX.XXXX.00 format, in which the first "X…X" indicates the area address, the 12 Xs in the middle indicate the system ID of the router, and 00 in the end indicates the selector (SEL). The NET length is the same as the length of a network service access point (NSAP) address, varying from 8 bytes to 20 bytes. Assume that there is a NET ab.cdef.1234.5678.9abc.00. In this NET, the area address is ab.cdef, the system ID is 1234.5678.9abc, and the SEL is 00.
Avoid microloop	FRR avoid microloop function		Whether to enable the microloop avoidance function for IS-IS. If a network failure occurs or is rectified, an IGP performs route convergence. A transient forwarding status inconsistency between nodes results in different convergence rates on devices, presenting the risk of microloops. Such microloops are a kind of transient loops that disappear after all the nodes on the forwarding path have converged. After the microloop avoidance function for SRv6 is enabled, if a network topology change may cause a loop, the source node creates a loop-free SRv6 segment list to steer traffic to the destination address. Normal traffic forwarding is restored only after all the involved network nodes complete convergence. This can effectively avoid loops on the network.
Avoid microloop	The route delivery delay for FRR avoid microloop		Delay in delivering IS-IS routes. The value is an integer ranging from 100 to 5000. The default value is 100, in milliseconds. After the original active path fails, traffic is first steered to the loop-free backup path. The source node performs route convergence after a certain delay, that is, it converges routes after its downstream nodes complete convergence. This helps prevent loops.
Binding interface	Bind interface	Interface	Interface where IS-IS needs to be enabled.
		Peer Hold Max Timer	Interval during which the maximum link cost of the interface is advertised.
		Enable P2P	Whether to enable P2P.
	Address Family	Type	IPv4 or IPv6 address family.
		Cost	Link cost of the interface, which is used for SPF calculation. If the IS-IS cost style is set to narrow, narrow-compatible, or compatible, the value range is from 1 to 63. If the IS-IS cost style is set to wide or wide-compatible, the value range is from 1 to 16777215. For a loopback interface, the value can be 0.
		FRR > Tilfa disable level1	Whether to disable interfaces from being selected as backup interfaces in Level-1 LFA calculation.
		FRR > Tilfa disable level2	Whether to disable interfaces from being selected as backup interfaces in Level-2 LFA calculation.
IPv6	Import Routes	Protocol	Protocol of routes to be imported. The process ID needs to be set only when OSPF or IS-IS routes need to be imported.
		Process ID	Process ID of the routes to be imported. This parameter is mandatory only when OSPFv3, IS-IS, or RIPng routes need to be imported.
		Cost	New cost for imported routes.
		Permit IBGP	Whether to import IBGP routes in public network instances. If this function is disabled, IS-IS can import only EBGP routes but not IBGP routes.
		Inherit cost	Whether to retain the original cost of the imported routes. If this function is enabled, no other cost style or cost value can be configured for the routes imported to IS-IS, and static routes cannot be imported.
		Tag	Administrative tag of the imported routes.
		Route policy	Name of a routing policy. Only the routes matching the policy can be imported.
		Level	Level of imported routes.
		No-sid flag	Whether to import SR labels when routes are imported.
	Preference	Preference	Priority of an IS-IS route. A smaller value indicates a higher priority.
	Preference	Route policy	Name of a routing policy.
	BFD	Enable	Whether to enable BFD in the IS-IS process. BFD can provide millisecond-level fault detection. It can work with IS-IS to fast detect faults on neighboring devices and instruct IS-IS to recalculate routes for correct packet forwarding.
		Binding all interface	Whether to enable BFD on all interfaces.
		Min tx(ms)	Minimum interval for sending BFD packets to the peer end.
		Min rx(ms)	Minimum interval for receiving BFD packets from the peer end.
	FRR	Enable	Whether to enable FRR for IS-IS.
		Enable lfa Level1	Whether to enable Level-1 LFA FRR to generate loop-free backup routes.
		Enable lfa Level2	Whether to enable Level-2 LFA FRR to generate loop-free backup routes.
		Enable tilfa Level1	Whether to enable Level-1 TI-LFA FRR to generate loop-free backup routes.
		Enable tilfa Level2	Whether to enable Level-2 TI-LFA FRR to generate loop-free backup routes.
	FRR > tiebreaker	-	By default, the preference value is 40 for the node-protection path first solution, 20 for the smallest-cost path first solution, 15 for the maximum cost path first solution, and 5 for the SRLG disjoint first solution. The solution of selecting a backup path for SRv6 TI-LFA FRR is determined in descending order of preference. You can change preference values of the preceding solutions to specify the required solution for FRR to select a backup path. A larger value indicates a higher preference.
		Node Protect Level1	Preference to be set for the node-protection path first solution on Level-1 nodes.
		Node Protect Level2	Preference to be set for the node-protection path first solution on Level-2 nodes.
		Lowest Cost Level1	Preference to be set for the smallest-cost path first solution on Level-1 nodes.
		Lowest Cost Level2	Preference to be set for the smallest-cost path first solution on Level-2 nodes.
		Srlg Disjoint Level1	Preference to be set for the SRLG disjoint first solution on Level-1 nodes.
		Srlg Disjoint Level2	Preference to be set for the SRLG disjoint first solution on Level-2 nodes.
		Hold Max Cost Level1	Preference to be set for the maximum cost path first solution on Level-1 nodes.
		Hold Max Cost Level2	Preference to be set for the maximum cost path first solution on Level-2 nodes.
	SRv6 > Locators	Locator Name	Name of the Locator field in an SID.
	SRv6 > Locators	Auto SID	Open: enables dynamic allocation of End and End.X SIDs. If static End and End.X SIDs exist, the static SIDs are used. If no static SIDs exist, dynamically allocated End and End.X SIDs are used. Close: disables dynamic allocation of End and End.X SIDs and imports static End and End.X SIDs from the specified locator. By default, dynamic SID allocation is disabled.
	SRv6 > Avoid microloop	Enable IPv6 segment routing avoid microloop	Whether to enable the microloop avoidance function for SRv6. If a network failure occurs or is rectified, an IGP performs route convergence. A transient forwarding status inconsistency between nodes results in different convergence rates on devices, presenting the risk of microloops. Such microloops are a kind of transient loops that disappear after all the nodes on the forwarding path have converged. After the microloop avoidance function for SRv6 is enabled, if a network topology change may cause a loop, the source node creates a loop-free SRv6 segment list to steer traffic to the destination address. Normal traffic forwarding is restored only after all the involved network nodes complete convergence. This can effectively avoid loops on the network.
	SRv6 > Avoid microloop	The route delivery delay for IPv6 segment routing avoid microloop	Delay in delivering IS-IS routes in an SRv6 scenario. The value is an integer ranging from 1000 to 60000, in milliseconds. The default value is 5000. If the original active path fails, traffic is steered to the loop-free backup path. After route convergence is complete, traffic is steered to a path after convergence after a certain delay.
	SRv6 > Inter Level Protect	-	By default, SRv6 TI-LFA computes backup paths only in the same IS-IS level. After inter-level protection is configured, if no SRv6 TI-LFA backup path exists in IS-IS Level-1, inter-level SRv6 TI-LFA backup path computation is performed.
		Inter level protect enable level1	Whether to enable inter-level protection in IS-IS Level-1.
		Inter level protect preferred	Whether to configure inter-level protection to have a higher priority than intra-level protection in IS-IS.
	Ipv6 advertise link attributes		Whether to enable IPv6 link attributes.
	IPv6 TE	Enable level-1 IPv6 TE	Whether to enable Level-1 IPv6 Traffic Engineering (TE).
		Enable level-2 IPv6 TE	Whether to enable Level-2 IPv6 TE.
		Enable Level-1 metric delay advertisement	Whether to enable the advertisement of Level-1 IPv6 delay information. NOTE: AR devices do not support advertisement of IPv6 delay information. Only NE devices support this function.
		Enable Level-2 metric delay advertisement	Whether to enable the advertisement of Level-2 IPv6 delay information. NOTE: AR devices do not support advertisement of IPv6 delay information. Only NE devices support this function.
IPv4	Import Routes	Protocol	Protocol of routes to be imported. The process ID needs to be set only when OSPF or IS-IS routes need to be imported.
		Process ID	Process ID of the routes to be imported. This parameter is mandatory only when OSPFv3, IS-IS, or RIP routes need to be imported.
		Cost Type	external: IS-IS external route internal: IS-IS internal route
		Cost	New cost for imported routes.
		Permit IBGP	Whether to import IBGP routes in public network instances. If this function is disabled, IS-IS can import only EBGP routes but not IBGP routes.
		Inherit cost	Whether to retain the original cost of the imported routes. If this function is enabled, no other cost style or cost value can be configured for the routes imported to IS-IS, and static routes cannot be imported.
		Tag	Administrative tag of the imported routes.
		Route policy	Name of a routing policy. Only the routes matching the policy can be imported.
		Level	Level of imported routes.
		No-sid flag	Whether to import SR labels when routes are imported.
	Preference	Preference	Priority of an IS-IS route. A smaller value indicates a higher priority.
	Preference	Route policy	Name of a routing policy.
	BFD	Enable	Whether to enable BFD in the IS-IS process. BFD can provide millisecond-level fault detection. It can work with IS-IS to fast detect faults on neighboring devices and instruct IS-IS to recalculate routes for correct packet forwarding.
		Binding all interface	Whether to enable BFD on all interfaces.
		Min tx(ms)	Minimum interval for sending BFD packets to the peer end.
		Min rx(ms)	Minimum interval for receiving BFD packets from the peer end.
	FRR	Enable	Whether to enable FRR for IS-IS.
		Enable lfa Level1	Whether to enable Level-1 LFA FRR to generate loop-free backup routes.
		Enable lfa Level2	Whether to enable Level-2 LFA FRR to generate loop-free backup routes.
		Enable tilfa Level1	Whether to enable Level-1 TI-LFA FRR to generate loop-free backup routes.
		Enable tilfa Level2	Whether to enable Level-2 TI-LFA FRR to generate loop-free backup routes.
Lsp generation	Lsp generation	Level-1 max interval	Maximum interval at which Level-1 link state protocol data units (LSPs) are generated in an IS-IS process.
		Level-2 max interval	Maximum interval at which Level-2 LSPs are generated in an IS-IS process.
		Level-1 init interval	Initial interval at which Level-1 LSPs are generated in an IS-IS process.
		Level-2 init interval	Initial interval at which Level-2 LSPs are generated in an IS-IS process.
		Level-1 incr interval	Incremental interval between two times of Level-1 LSP generation.
		Level-2 incr interval	Incremental interval between two times of Level-2 LSP generation.
	SPF	SPF type	SPF calculation interval set through an intelligent timer.
		max	Maximum delay for route calculation.
		init	Initial delay for route calculation.
		incr	Incremental delay between two route calculations.
	Lsp auths	Auth cmd type	Authentication mode in IS-IS. area: In this mode, the authentication password is encapsulated into IS-IS packets in Level-1 areas. Only authenticated packets are accepted. To implement Level-1 area authentication, configure IS-IS area authentication. domain: In this mode, the authentication password is encapsulated into IS-IS packets in Level-2 areas. Only authenticated packets are accepted. To implement Level-2 area authentication, configure IS-IS routing domain authentication.
		pwType	Encryption algorithm for the passwords used to authenticate IS-IS packets. Only the IS-IS packets that pass authentication can be accepted. md5: uses MD5 as the encryption algorithm for the passwords used to authenticate IS-IS packets. hmac-sha256: uses HMAC-SHA256 as the encryption algorithm for the passwords used to authenticate IS-IS packets. NOTE: To ensure IS-IS security, you are advised to use the hmac-sha256 encryption algorithm.
		md5	Authentication password in MD5 or HMAC-SHA256 mode.
		service	Authentication type: IP: indicates an IP authentication password. This option cannot be used in keychain authentication mode. osi: indicates an OSI authentication password. This option cannot be used in keychain authentication mode.
		usage	Sequence number PDU (SNP) authentication type: usage-default: The default authentication mode is used. authentication-avoid: Neither encapsulates generated SNPs with authentication information nor authenticates received SNPs. Encapsulates the generated LSPs with authentication information and authenticates the received LSPs. send-only: Encapsulates the generated LSPs and SNPs with authentication information, authenticates the received LSPs, but does not authenticate the received SNPs. all-send-only: Encapsulates the generated LSPs and SNPs with authentication information and does not authenticate the received LSPs and SNPs.
		keyId	Key ID of the HMAC-SHA256 algorithm.
	Set overload	Type	on-startup: indicates that the overload bit remains set within the specified period when a device is restarted or faulty.
		Wait type	Type of the period during which the overload bit remains set: wait-for-bgp: specifies the period during which the overload bit remains set according to the BGP convergence status. wait-for-nbr: specifies the period during which the overload bit remains set according to the status of the neighbor with a specific system ID. no-wait: indicates that the period during which the overload bit remains set is not set.
		Nbr systemId	System ID of the neighbor whose status determines the period during which the overload bit remains set.
		on-startup timeout	Period during which the overload bit remains set after the system is started.
		start-from-nbr timeout	Period during which the overload bit remains set based on the neighbor status.
		InterLevel	Whether to allow the advertisement of IP address prefixes learned from IS-IS of different levels.
		External	Whether to allow the advertisement of IP address prefixes learned from other protocols.
		Send sa bit	Whether to carry the Suppress-Advertisement (SA) bit in Hello packets after the device is started.
		SA bit time	Period during which the SA bit is carried in Hello packets after the device is started.
		Route delay time	Delay after which routes are advertised.
		Route max metric	Whether to set the metric value of routes to the maximum value.
	Bgp ls	Bgp ls identifier	BGP-LS domain ID.
		Enable level-1 IPv6 bgp ls	Whether to advertise IPv6 topology information of Level-1 areas.
		Enable level-2 IPv6 bgp ls	Whether to advertise IPv6 topology information of Level-2 areas.

Routing Policy Configuration

Configuring a Community Filter

Context

A community filter is used to filter BGP routes based on community attributes contained in the BGP routes. A community attribute is a set of destination addresses with the same characteristics. Filtering rules defined based on community attributes can be used to filter BGP routes. Before advertising a route carrying a community attribute to peers, a BGP device can be configured to change the original community attribute of this route.

A community attribute is a 4-byte value in the format of aa:nn. According to standards, the most significant 2 bytes indicate an AS number, and the least significant 2 bytes indicate an identifier for management purposes.
A community attribute is a BGP route tag used to simplify the execution of route policies. You can assign a specific community attribute value to certain routes. Then, the routes can be filtered based on the community attribute value and the corresponding policies can be executed.

Only ARs running V600 and NE devices support this function.

Procedure

Choose Plan > Provision > Device Configuration > Single Device Configuration from the main menu.
Select the device to be configured and choose Routing Configuration > Route Policy > Community Filter from the navigation pane.
Click Create and configure the community filter name and type.
Configure community attribute rules based on the community type.
Click OK.

Parameter Description

Table 2-526 Parameters of configuring a community filter

Parameter		Description
Global	Name	Name of a community filter.
Global	Type	Type of a community filter, which can be basic or advanced. Only a community number or well-known community attribute can be specified for a basic community filter, whereas a regular expression can also be specified for an advanced community filter.
Node	Sequence	Sequence number of a node in the basic community filter.
Node	Match Mode	Matching mode of a node in the basic community filter. Permit: The matching mode of the filter is permit. Deny: The matching mode of the filter is deny.
Community member	Value	Community value.
Advanced community filter node	Sequence	Sequence number of a node in the advanced community filter.
	Matching mode	Matching mode of a node in the advanced community attribute filter. Permit: The matching mode of the filter is permit. Deny: The matching mode of the filter is deny.
	Regular expression	Regular expression used for filtering.

Configuring an Extended Community Filter

Context

An extended community filter is used to filter BGP routes based on extended community attributes. BGP extended community attributes are classified as follows:

VPN target: VPN targets are used to control route learning between VPN instances, isolating routes of VPN instances from each other.
Source of Origin (SoO): SoO attributes can be configured for VPN sites to distinguish routes from different VPN sites, preventing routing loops.
Encapsulation: indicates the VXLAN encapsulation extended community attribute. In an EVPN VXLAN scenario, EVPN routes carry the VXLAN encapsulation extended community attribute. You can set the attribute value to 0:8 to filter EVPN routes in this scenario.
Priority-Color: In scenarios where an SD-WAN tunnel needs to be established based on BGP EVPN routes, you can set the Priority-Color extended community attribute for EVPN routes to identify sites. The priority-color extended community attribute is used to generate SD-WAN tunnel encapsulation information so that a device can forward packets through the SD-WAN tunnel.

Only ARs running V600 support this function.

Procedure

Choose Plan > Provision > Device Configuration > Single Device Configuration from the main menu.
Select the device to be configured and choose Routing Configuration > Route Policy > Extended Community Filter from the navigation pane.
Click Create and configure the extended community filter name and type.
Configure extended community attribute rules based on the community type.
Click OK.

Parameter Description

Table 2-527 Parameters of configuring an extended community filter

Parameter		Description
Global	Name	Name of an extended community filter. The value can be either an integer (from 1 to 199) or a character string (that contains no more than 51 characters and cannot contain digits only).
Global	Type	Type of an extended community filter, which can be basic or advanced. Only the extended community number can be specified for a basic extended community filter. The regular expression can be used as a matching rule in an advanced extended community filter.
Node	Sequence	Sequence number of a node in the basic extended community filter.
Node	Match Mode	Matching mode of a node in the basic extended community filter. Permit: The matching mode of the filter is permit. Deny: The matching mode of the filter is deny.
Extended community member	Value	Extended community number.

Configuring an IPv4 Prefix

Context

An IP prefix list is a filter that contains a group of matching rules and is used to filter routes to be advertised or accepted. You can specify an IP prefix and a mask length range in an IP prefix list so that the destination network segment addresses or next-hop addresses of routes can be matched against the IP prefix list. An IPv4 prefix list includes IPv4 prefixes of IPv4 routes. An IP prefix list is matched against routes using either of the following parameters:

Mask length: A mask length, together with an IP address, identifies an IP prefix. The IP prefix in an IP prefix list is used to filter routes with the same IP prefix. For example, the mask length of a route to 10.1.1.1/16 is 16, indicating that the valid prefix is 16 (10.1.0.0).
Mask length range: A mask length range can be defined in an IP prefix list to match routes with the same IP prefix and different mask lengths within the specified mask length range.

Only ARs running V600 support this function.

Procedure

Choose Plan > Provision > Device Configuration > Single Device Configuration from the main menu.
Select the device to be configured and choose Routing Configuration > Route Policy > IPv4 Prefix from the navigation pane.
Click Create and configure the IPv4 prefix name.
On the Node tab page, configure an IPv4 prefix matching rule.
Click OK.

Parameter Description

Table 2-528 Parameters of configuring an IPv4 prefix

Parameter		Description
Global	Name	Name of an IPv4 prefix filter. The value is a string of 1 to 169 characters.
Node	Sequence	Sequence number of a node in the IPv4 prefix filter. The value is an integer in the range from 1 to 4294967295.
	Filter type	Matching mode of a node in the IPv4 prefix filter. Permit: The matching mode of the filter is permit. Deny: The matching mode of the filter is deny.
	IP address	IPv4 address. A prefix is matched if both the address and mask are strictly matched.
	Mask	Mask length. The value is an integer that ranges from 0 to 32.
	Lower limit mask	Lower limit of the mask range. If both the IP address and the mask length are matched, this parameter can be used for specifying the IP prefix range. The following rule must be met: Mask length ≤ Least mask length ≤ Largest mask length ≤ 32. If only the least mask length is specified, the mask ranges from the least mask length to 32.
	Upper limit mask	End mask length of a range. If both the IP address and the mask length are matched, this parameter can be used for specifying the IP prefix range. The following rule must be observed: Mask length ≤ Least mask length ≤ Largest mask length ≤ 32. If only the largest mask length is specified, the prefix ranges from the mask length to the largest mask length.

Configuring an IPv6 Prefix

Context

An IP prefix list is a filter that contains a group of matching rules and is used to filter routes to be advertised or accepted. You can specify an IP prefix and a mask length range in an IP prefix list so that the destination network segment addresses or next-hop addresses of routes can be matched against the IP prefix list. An IPv6 prefix list includes IPv6 prefixes of IPv6 routes. An IP prefix list is matched against routes using either of the following parameters:

Mask length: A mask length, together with an IP address, identifies an IP prefix. The IP prefix in an IP prefix list is used to filter routes with the same IP prefix.
Mask length range: A mask length range can be defined in an IP prefix list to match routes with the same IP prefix and different mask lengths within the specified mask length range.

Only ARs running V600 support this function.

Procedure

Choose Plan > Provision > Device Configuration > Single Device Configuration from the main menu.
Select the device to be configured and choose Routing Configuration > Route Policy > IPv6 Prefix from the navigation pane.
Click Create and configure the IPv6 prefix name.
On the Node tab page, configure an IPv6 prefix matching rule.
Click OK.

Parameter Description

Table 2-529 Parameters of configuring an IPv6 prefix

Parameter		Description
Global	Name	Name of an IPv6 prefix filter.
Node	Sequence	Sequence number of a node in the IPv6 prefix filter.
	Filter type	Matching mode of a node in the IPv4 prefix filter. Permit: The matching mode of the filter is permit. Deny: The matching mode of the filter is deny.
	IP address	IPv6 address. A prefix is matched if both the address and mask are strictly matched.
	Mask	Mask length.
	Lower limit mask	Lower limit of the mask range. If both the IPv6 address and the mask length are matched, this parameter can be used for specifying the IP prefix range. The following rule must be met: Mask length ≤ Least mask length ≤ Largest mask length ≤ 128. If only the least mask length is specified, the mask ranges from the least mask length to 128.
	Upper limit mask	Upper limit of the mask range. If both the IPv6 address and the mask length are matched, this parameter can be used for specifying the IP prefix range. The following rule must be observed: Mask length ≤ Least mask length ≤ Largest mask length ≤ 128. If only the largest mask length is specified, the prefix ranges from the mask length to the largest mask length.

Configuring a Tunnel Selector

Context

You can configure a tunnel selector, which is mainly used in BGP Option B and Option C scenarios (VPNv4 or VPNv6 view). A tunnel policy is selected based on the matching rules set in the tunnel selector.

Only ARs running V600 support this function.

Procedure

Choose Plan > Provision > Device Configuration > Single Device Configuration from the main menu.
Select the device to be configured and choose Routing Configuration > Route Policy > Tunnel Selector from the navigation pane.
Click Create and enter the tunnel selector name.
On the Node tab page, configure filtering rules and tunnel policies.
Click OK.

Parameter Description

Table 2-530 Parameters for configuring a tunnel selector

Parameter		Description
Global	Name	Name of a tunnel selector.
Node	Sequence	Sequence number of a node.
	Filter type	Matching mode of a node. Permit: The matching mode of the filter is permit. Deny: The matching mode of the filter is deny.
	Apply tunnel policy	Name of a tunnel policy.

Configuring a Routing Policy

Context

A routing policy is used to match routes or route attributes, and to change route attributes when the matching rules are met. Matching conditions can be community filters and extended community filters. They can match certain attributes of specified routes or change the attributes of routes when the matching conditions are met.

Only ARs running V600 support this function.

Procedure

Choose Plan > Provision > Device Configuration > Single Device Configuration from the main menu.
Select the device to be configured and choose Routing Configuration > Route Policy > Routing Policy from the navigation pane.
Click Create. Set a routing policy name.
On the Node tab page, configure a routing policy rule.
On the Condition and Apply tab pages, configure matching conditions and the actions to take on routes that match these conditions.
Click OK.

Parameter Description

Table 2-531 Routing policy parameters

Parameter					Description
Global	Name				Name of a routing policy.
Node	Sequence				Sequence number of a node in the routing policy.
	Match type				Matching mode of the node in the routing policy. Permit: The matching mode of the filter is permit. Deny: The matching mode of the filter is deny.
	Condition	Tag			Route tag, which is used for route classification.
		IPv4 match type			Using an IPv4 prefix filter to match routes.
		IPv4 prefix			Name of an IPv4 prefix filter used to filter routes based on IPv4 destination addresses.
		IPv6 match type			Using an IPv6 prefix filter to match routes.
		IPv6 prefix			Name of an IPv6 prefix filter used to filter routes based on IPv6 destination addresses.
		Community filter	Name		Name of a community filter used to filter routes, which is specified under a routing policy node.
		Extended community filter	Name		Name of an extended community filter used to filter routes, which is specified under a routing policy node.
	Apply	Tag			Route tag, which is used for route classification.
		Cost			Route cost, which is used to control route selection.
		Local preference			Local preference of BGP routes.
		Extended community color			Priority-color extended community attribute values for a priority-color extended community filter.
		Community	Operation		Application mode of a community attribute. Additive: appends the configured community attribute to the original community attribute of a route. Replace: replaces the original community attribute of a route with the configured community attribute.
			Type		Type can only be set to Value.
			Community	Value	Community value.
		Extended community member	Operation		Whether configured extended community values are added to the original extended community values of a route.
		Extended community member	Extended community member	Value	Extended community number.

Configuring Global Routing Parameters

Context

You can set global BFD parameters for static routes.

Only ARs running V600 and NE devices support this function.

Prerequisites

A device has been added.

Procedure

Choose Plan > Provision > Device Configuration > Single Device Configuration from the main menu.
Select the device to be configured, choose Routing Configuration > Routing Global Setting from the navigation pane, and set global BFD parameters for static routes.

Parameter Description

Table 2-532 Global routing configuration

Parameter		Description
IPV4/IPV6 setting	-	Global BFD parameters for static routes. By default, the minimum intervals at which BFD packets are received and sent is 1000 ms, and the detection multiplier is 3.
	IPV4/IPV6 Interval at which BFD packets are sent(ms)	Minimum interval at which BFD packets are sent.
	IPV4/IPV6 interval at which BFD packets are received(ms)	Minimum interval at which BFD packets are received.
	IPV4/IPV6 Local detection time multiplier	Local detection multiplier.

Configuring PBR

Context

Policy-based routing (PBR) selects routes based on a user-defined policy. PBR can be used for security and load balancing purposes. Without PBR, the system selects routes from the routing table based on the destination IP address of each IP packet.

Only firewalls running V600 support this function.

Procedure

Choose Plan > Provision > Device Configuration > Single Device Configuration from the main menu.
Select the device to be configured and choose Routing Configuration > Policy Based Routing from the navigation pane.
Click Create and configure a PBR rule.
Click OK.

Parameter Description

Table 2-533 PBR parameters

Parameter			Description
Global	Name		Name of a PBR rule.
	Description		Description of the PBR rule.
	Health Check		Name of a configured health check. When you configure a health check, ensure that the destination IP address of the monitored link is the same as the specified next hop in the PBR rule, and associate the PBR rule with the health check. The health check monitors the reachability of the links of the next hop and determines the validity of the PBR rule based on the health check status. When the health check is Up, the link is reachable and PBR is valid and can guide packet forwarding. When the health check is Down, the link is unreachable, and PBR is invalid. Packets are forwarded based on the routing table.
	Ingress Type		Matching condition of the PBR rule. The value can be Ingress Interface or Ingress Security Zones.
Ingress Interface	Ingress Interface		Incoming interface as a matching condition of the PBR rule.
Ingress Security Zone	Ingress Security Zone		Source security zone as a matching condition of the PBR rule.
Source/Destination Address	Source/Destination IPv4 address	IP	Source or destination IP address of the PBR rule.
	Source/Destination IPv4 address	Mask	Source or destination IP address mask of the PBR rule.
	Source/Destination IPv4 address range	Start IP	Start IP address of the source or destination IP address range of the PBR rule.
	Source/Destination IPv4 address range	End IP	End IP address of the source or destination IP address range of the PBR rule.
Protocol and Port	Protocol		Currently, the ICMP, TCP, UDP, ICMPv6, and SCTP protocols can be specified in PBR.
	Source Port		Source port number.
	Destination Port		Destination port number.
Action	Action		Action to take when the PBR rule is matched. The value can be Basic Egress, Multiple Egress, or No Route.
	Basic Egress	Egress Interface	Name of an outbound interface.
		Nexthop Type	Address type of the next hop.
		Nexthop	Next-hop IP address.
	Multiple Egress	Selection Mode	Parameter used for intelligent traffic steering. The value can be priority, weight, or bandwidth.
		Health Check	Name of a configured health check. When you configure a health check, ensure that the destination IP address of the monitored link is the same as the specified next hop in the PBR rule, and associate the PBR rule with the health check. The health check monitors the reachability of the links of the next hop and determines the validity of the PBR rule based on the health check status. When the health check is Up, the link is reachable and PBR is valid and can guide packet forwarding. When the health check is Down, the link is unreachable, and PBR is invalid. Packets are forwarded based on the routing table.
		SLA	Select an existing link quality index.
	Member Interface	Name	Interface name.
		Weight	Weight of the outbound interface.
		Priority	Priority of the outbound interface.
	No Route		PBR does not take effect when this parameter is enabled.

Segment Routing

Configuring SRv6

Context

You can configure Segment Routing over IPv6 (SRv6) for a single device through agile configuration.

Only ARs and LSWs running V600 and NE devices support this function.

Prerequisites

A device has been added.

Procedure

Choose Plan > Provision > Device Configuration > Single Device Configuration from the main menu.
Select a device to configure, choose Segment Routing > Segment Routing IPv6 from the navigation pane, and enable or disable SRv6 as needed.
Click the Encapsulation tab and configure the source address for SRv6 encapsulation.
Click the Locator tab, click Create, and configure locator route information.
Click the TE Policy tab, and configure the traffic statistics collection and BGP-LS functions for a specified locator.
Click the TE Flow Group tab and configure a TE flow group.
DSCP-based traffic steering: marks DSCP values of packets of different applications and steers the packets to different tunnels for forwarding based on the DSCP value.

SPR-based traffic steering: marks TE Class values of packets of specified applications and steers the packets to different tunnels for forwarding based on the TE Class value and tunnel quality.

DSCP-based traffic steering and TE Class-based traffic steering are mutually exclusive. That is, in the same VPN, only one type of traffic steering can be configured on a device.
1. Click the SPR > SPR tab and configure the SPR update interval and measurement count mode.
2. Click the SPR > SPR Policy tab, click Create, and create an SPR policy.
3. Click the TE Path tab and configure TE path information.
4. Click the Mapping Policy tab, click Create, and configure a TE mapping policy.
  - To configure a DSCP-based traffic steering policy, click the DSCP Map tab.
  - To configure an SPR-based traffic steering policy, click the TE-CLASS Map tab.
Click Commit.

Parameter Description

Table 2-534 Parameters for configuring SRv6

Parameter				Description
Segment Routing IPv6	Enable			Whether to enable SRv6 on a device.
	FRR			Whether to enable SRv6 midpoint protection.
	FRR delay time			FRR delay for SRv6 midpoints.
	Srh enable			Whether to enable the reduced SRH function. An SRH consumes a large number of bits. During SRH encapsulation, the SRv6 source node encapsulates the first SID to be processed into the destination address (DA) field of the IPv6 header. Therefore, the first SID in the SRH is meaningless for forwarding. To reduce the SRH size, you can enable the reduced SRH function. With this function enabled, the SRv6 source node can encapsulate a reduced SRH that does not contain the first SID to be processed.
	Path MTU			Set the global path MTU for SRv6 TE Policies and SRv6 BE tunnels. Transit nodes are not allowed to fragment IPv6 packets during forwarding. If the size of an IPv6 packet entering a transit node exceeds the IPv6 MTU of the specified outbound interface, the transit node discards the packet. Conversely, if the size of an IPv6 packet is less than the MTU configured for an SRv6 BE path or an SRv6 TE Policy, the bandwidth of the associated link is not fully utilized. Therefore, an appropriate SRv6 path MTU needs to be configured to prevent packet loss and maximize link bandwidth utilization.
	Path MTU Reserved			Global path MTU reserved for SRv6 TE Policies and SRv6 BE tunnels. In TI-LFA protection or binding SID scenarios, an SRH that has segment lists associated with TI-LFA or the binding SID needs to be inserted into IPv6 packets. This increases the packet size and must be taken into account when an SRv6 path MTU is configured. To allow for this additional SRH length in TI-LFA or binding SID scenarios, configure a reserved path MTU on the SRv6 source node. The configured SRv6 path MTU minus the reserved value is called the active MTU. The smaller of either the active MTU or the IPv6 MTU of physical interfaces takes effect on SRv6 packets. The configured path MTU minus the reserved path MTU value must be greater than or equal to 1280 bytes.
Encapsulation	Encapsulation source address			Source address for SRv6 VPN encapsulation. When traffic enters an SRv6 VPN tunnel, the address set here functions as the source address in the IPv6 header. The source address must be an existing interface address on the device.
Locator	Global	Locator Name		Name of the Locator field in an SID. The value is a string of 1 to 31 case-sensitive characters. If spaces are used, the string must be enclosed in double quotation marks (" ").
		Prefix		IPv6 address prefix. The value is a 32-digit hexadecimal number, in the format of X:X:X:X:X:X:X:X.
		Prefix Length		IPv6 address prefix length.
		Static Length		Static segment length in the Function field. This length determines the number of static opcodes that can be configured in the locator.
		Args Length		Length of the Arguments field, which is the right-most field of an SID. If this parameter is set, the Arguments field is reserved and will not be occupied by other fields in configured static SIDs or generated dynamic SIDs.
	Srv6lb	Srv6lb index		Identifier of the reserved BSID space.
	Srv6lb	Srv6lb side reserve number		Number of BSIDs reserved in a local block.
TE Policy Attributes	Locator			SRv6 locator associated with an SRv6 TE Policy.
	Traffic Statistics			Whether to enable traffic statistics collection for a specified SRv6 TE Policy.
	BGP-LS			Whether to enable BGP-LS for an SRv6 TE Policy.
TE Flow Group	SPR	SPR Refresh Period		Interval at which SPR updates path selection results. Links are selected for traffic steering based on their performance at the configured interval.
	SPR	Measure Count Mode		SPR measurement count mode. The options include one-way and two-way-average. You are advised to set this parameter to two-way-average.
	SPR Policy	Name		Name of an SPR instance.
		Switch Period		Delay after which SPR switching is performed, in seconds. The default value is 5.
		Wait To Store Period		SPR wait-to-restore (WTR) time, in seconds. The default value is 5.
		Delay Threshold		Delay threshold of SPR services, in milliseconds. The default value is 5000.
		Jitter Threshold		Jitter threshold of SPR services, in milliseconds. The default value is 3000.
		Loss Threshold		Threshold of the packet loss rate for SPR services. The default value is 1000‰.
		CMI Threshold		Composite measure indicator (CMI) threshold of SPR services. The default value is 9000.
		TE Path	-	SRv6 TE Policy to be referenced in an SPR policy. Traffic specified in the SPR policy is steered to the referenced SRv6 TE Policy for forwarding.
			Color	Color value of an SRv6 TE Policy.
			Priority	Priority of the SRv6 TE Policy. The value is an integer from 1 to 8. The default value is 8. A smaller value indicates a higher priority.
	Mapping Policy	Color		Color of a mapping policy, which is the color of the VPN that needs to be mapped to an SRv6 TE tunnel.
		Name		Name of a mapping policy.
		Match Type		Mapping type of an SRv6 TE Policy. All: indicates that all mapping types are configured. dscp: maps DSCP values of packets to be steered. te-class: maps TE Class values of packets to be steered.
		DSCP Map	Default	Default path where packets with the mapped DSCP value are to be steered. If application traffic flows do not match any mapping policies with non-default paths, the flows are steered to the default path.
			Index	ID of a DSCP mapping policy.
			AF Type	Address type of the packets to be steered based on the DSCP value.
			DSCP Range	DSCP values of the packets to be steered.
			Match Tunnel	TE Policy: steers application packets with the specified DSCP values to TE Policies.
			Color	Color of the tunnel where packets with the specified DSCP values are to be steered.
		TE-CLASS MAP	Index	ID of a TE Class mapping policy.
			TE-CLASS ID	TE Class value of the packets to be steered.
			Match Tunnel	SPR Policy: switches packets between TE Policies based on the configured SPR policies. TE Policy: steers application packets with the specified TE Class values to TE Policies. Native-IP: forwards application packets based on IPv6 routes.

TE

Context

After receiving TE attributes configured for links, IS-IS advertises them to the controller through BGP-LS. This enables the controller to adjust links based on the TE attributes during SRv6 TE Policy computation.

Only ARs running V600 and NE devices support this function.

Prerequisites

Devices have been added to the controller.

Procedure

Choose Plan > Provision > Device Configuration > Single Device Configuration from the main menu.
Select the device to be configured and choose Segment Routing > TE from the navigation pane.
Click the Global tab and set global parameters.
Click the Configure affinity define function tab and set affinity attributes.
1. Click the Configure affinity define function > Configure affinity define function tab and configure a description.
2. Click the Configure affinity define function > Configure affinity mapping tab and click Create to configure an affinity name and an affinity bit sequence.

Parameter Description

Table 2-535 TE parameters

Parameter			Description
TE	Global	Enable	Whether to enable or disable the global configuration.
	Global	IPv6 Router ID	IPv6 address.
	Affinity	Description	Description of an affinity name mapping template. The value is a string of 1 to 80 characters and can contain spaces.
	Affinity mapping	Attribute Name	Name of an affinity bit. The value is a string of 1 to 31 characters.
	Affinity mapping	Bit Sequence	Affinity bit number. The value is an integer in the range from 0 to 127. Value 0 indicates the left-most bit, and value 127 indicates the right-most bit.

Configuring TE Attributes of an Interface

Context

Traffic Engineering (TE) attributes of interfaces describe bandwidth usages, route costs, and link reliability of physical links, including the following:

Total link bandwidth: It indicates the total bandwidth of a physical link.
Maximum reservable bandwidth: It indicates the maximum bandwidth of a link that can be reserved for a TE tunnel. The maximum reservable bandwidth of a link must be less than or equal to the total bandwidth of the link.
Metric: Links with smaller metrics are selected to set up TE label switched paths (LSPs).
Administrative group: Administrative group attributes, together with an affinity, are used to determine the links that a TE tunnel uses.
Shared risk link group (SRLG): It refers to a group of links that share a common physical resource (for example, a fiber). All the links in an SRLG are at the same risk of failure — if one link fails, all other links in the SRLG will also fail.

Only ARs running V600 and NE devices support this function.

Prerequisites

A device has been added.

Procedure

Choose Plan > Provision > Device Configuration > Single Device Configuration from the main menu.
Select the device to configure, click the Feature Configuration tab, and choose Segment Routing > Interface TE Information from the navigation pane.
Click Create , select an interface, and select a VPN instance.
Expand TE interface attributes on the left and configure TE attributes for the selected interface.
- Click TE configuration parameters and set a metric and an administrative group.
- Expand Admin groups name, configure an administrative group name, and specify an affinity name.
- Expand Srlg group to configure SRLG groups.
- Click TE link bandwidth attributes and configure bandwidth for a TE interface.
Click OK.
Click Commit.

Parameters

Table 2-536 Parameters for configuring interface TE attributes

Parameter		Description
Interface name		Name of the interface to be enabled with the TE function. The value must be the name of an existing interface on the device, for example, GigabitEthernet1/0/0.
VPN		Name of the VPN instance to be bound to the interface.
TE configuration parameters	Metric value	Metric of the TE interface. Links with smaller metrics are selected to set up TE LSPs.
TE configuration parameters	Administrative group attribute	An administrative group attribute is a 32-bit vector representing a set of link attributes. Administrative group attributes are used together with an affinity to determine the links that a TE tunnel traverses.
Affinity name		Name of an affinity bit. The affinity is compared with administrative group attributes to determine whether an LSP passes through links with specified attributes.
Srlg number		Number of the SRLG to which the interface belongs. If an SRLG is configured for links, an IGP floods the TE link information along with the SRLG membership information to all devices in an IGP area. The SRLG membership information is then also added into the traffic engineering database (TEDB) on each device in the IGP area.
TE link bandwidth attributes	Maximum reservable bandwidth	Static maximum reservable bandwidth for the interface.
	Bc0 bandwidth	Static BC0 bandwidth for the interface. This parameter can be set only when Maximum reservable bandwidth is set. The value of Bc0 bandwidth must be less than or equal to that of Maximum reservable bandwidth. Bc0 bandwidth cannot be set together with Dynamic maximum reservable bandwidth percent and Dynamic Bc0 bandwidth percent.
	Dynamic maximum reservable bandwidth percent	Proportion of the maximum dynamic reservable bandwidth to the physical bandwidth on the interface. This parameter cannot be set together with Maximum reservable bandwidth, and this setting cannot be deleted if Dynamic Bc0 bandwidth percent has been set.
	Dynamic Bc0 bandwidth percent	Dynamic BC0 bandwidth for the interface, in percentage. This parameter can be set only when Dynamic maximum reservable bandwidth percent or Maximum reservable bandwidth has been set. If Maximum reservable bandwidth has been set, the value of Dynamic Bc0 bandwidth percent must be less than or equal to that of Maximum reservable bandwidth and Bc0 bandwidth cannot be set.

VPN

Configuring a VPN

Context

You can configure VPN instances, RDs, and VPN targets for a single device.

Prerequisites

A device has been added.

Procedure

Choose Plan > Provision > Device Configuration > Single Device Configuration from the main menu.
Select the device to be configured, choose VPN Configuration > VPN from the navigation pane, and click Create to create a VPN instance.
Click Address Family and configure the address family type and RD for the VPN instance.
Click VPN Target and configure a VPN target (VT) for the VPN instance.
Click EVPN and configure a routing policy, tunnel policy, and default color value for the VPN instance.

Parameter Description

Table 2-537 Parameters for configuring a VPN

Parameter	Description
VN Instance Name	Name of the VPN instance to be created.
Address Family Type	Address family type. After a VPN instance is created, you need to configure an address family for the VPN instance if VPN route advertisement and data forwarding are required. IPv4 address family: enables the IPv4 unicast address family for the VPN instance. IPv6 address family: enables the IPv6 unicast address family for the VPN instance.
Route distinguisher	Route distinguisher. An address family takes effect only after an RD is set. RDs in IPv4 address families of different VN instances on the same device must be different.
VPN Target Value	VPN-Target extcommunity filter. A VPN target can be in one of the following formats: 2-byte AS number:4-byte user-defined number, for example, 1:3. The AS number is in the range from 0 to 65535, and the user-defined number is in the range from 0 to 4294967295. The AS number and user-defined number cannot both be 0s, that is, the VPN target cannot be 0:0. Integral 4-byte AS number:2-byte user-defined number, for example, 65537:3. The AS number is in the range from 65536 to 4294967295, and the user-defined number is in the range from 0 to 65535. 4-byte AS number in dotted notation:2-byte user-defined number, for example, 0.0:3 or 0.1:0. Generally, a 4-byte AS number in dotted notation is in the format of x.y, where x and y are both integers in the range from 0 to 65535. A user-defined number is an integer in the range from 0 to 65535. The AS number and user-defined number cannot both be 0s. That is, a VPN target cannot be 0.0:0. 4-byte IP address:2-byte user-defined number, such as 192.168.122.15:1. The IP address is in the range from 0.0.0.0 to 255.255.255.255, and the user-defined number is an integer in the range from 0 to 65535.
vpn-target-type	import-extcommunity: Adds a VPN target to the import VPN target list of a VPN instance address family. export-extcommunity: Adds a VPN target to the export VPN target list of a VPN instance address family.

Configuring a Tunnel Policy

Context

Only after a tunnel policy is applied, the system can select tunnels for VPNs based on the tunnel policy.

Only ARs running V600 and NE devices support this function.

Prerequisites

Devices have been managed by the controller.

Procedure

Choose Plan > Provision > Device Configuration > Single Device Configuration from the main menu.
Select the device to be configured and choose VPN Configuration > Tunnel policy from the navigation pane.
Click Create. In the Tunnel policy dialog box that is displayed, set global attributes for a tunnel policy.
Set a tunnel policy name.
Configure an IPv6 tunnel policy.
- Set the tunnel policy type.
- Set the number of tunnels participating in load balancing.
- Configure the tunnel type.

Parameter Description

Table 2-538 Description of tunnel policy parameters

Parameter			Description
Tunnel policy	Name		Name of a tunnel policy to be applied to routes.
IPv6 tunnel policy	IPv6 tunnel policy	Tunnel policy type	Tunnel selection sequence.
	Tunnel select sequence	Load balance	Number of tunnels taking part in load balancing.
	Select tunnel type		Tunnel type: srv6-te-policy: indicates SRv6 TR Policies TE flow group: indicates SRv6 TE flow groups

Binding a GRE Tunnel

Context

A tunnel interface must be configured on each end of a GRE tunnel to be established. You need to set the tunnel encapsulation type of the tunnel interfaces to GRE and specify a source address (or source interface) and a destination address for the interfaces. If the tunnel interfaces need to be advertised using dynamic routing protocols, you also need to configure IP addresses for the tunnel interfaces.

Only NE devices support this function.

Prerequisites

A device has been added.

Procedure

Choose Plan > Provision > Device Configuration > Single Device Configuration from the main menu.
Select the device to be configured and choose VPN Configuration > Binding GRE Tunnel Protocol.
Click the Binding GRE tunnel protocol > Binding GRE tunnel protocol tab and select a VPN.
Click the Interface Name tab, click Create, and select an interface.

Parameter Description

Table 2-539 Parameters for binding a GRE tunnel

Parameter		Description
Binding GRE tunnel protocol	VPN	Name of the VPN instance to be configured.
Interface name	Interface name	Name of the interface to be configured.

Configuring a Tunnel and Its Interfaces

Context

The tunnel management (TNLM) module selects a tunnel for an application according to specific configurations and notifies the application of the tunnel status.

Only ARs running V600 and NE devices support this function.

Procedure

Choose Plan > Provision > Device Configuration > Single Device Configuration from the main menu.
Select the device to be configured and choose VPN Configuration > Interface Tunnel Configuration from the navigation pane.
Click Create, and set the interface name, tunnel type, and other tunnel-related parameters.
Click OK.

Parameter Description

Table 2-540 Parameters for configuring a tunnel and its interfaces

Parameter		Description
Global	Interface name	Interface name. Only tunnel interfaces are supported.
Global	Tunnel type	Tunnel mode for a tunnel interface. The value can be GRE tunnel or IPSec tunnel.
GRE tunnel	Source type	Type of the outbound interface of a tunnel. The value can be Source interface or Source IPv4 address.
	Source interface	Outbound interface of a tunnel.
	Source IPv4 address	Source IP address of the outbound interface of a tunnel.
	Destination IPv4 address	Destination IP address of a tunnel.
IPSec tunnel	Enable	Whether to enable the IPsec tunnel mode.

Configuring Network Slicing

Context

If the SR Policy associated with a slice goes Down, traffic is switched to SRv6 BE. However, SRv6 BE does not use slices by default. Therefore, you need to map network slice IDs with VPN colors so that the bypass function can take effect.

Mapping between network slices and color values can be configured on a device.

VPN routes on the device carry color values based on routing policies and map to network slices based on mapping between color values and network slices.

When receiving a VPN data packet, the device searches for Locator routes based on the VPN SID, obtains the outbound interface of the route, searches for the sub-interface corresponding to the mapped network slice on the outbound interface, and forwards the packet through the sub-interface.

Only NE devices support network slicing.

Prerequisites

Devices have been added to the controller.
A network slice instance has been created.

Procedure

Choose Plan > Provision > Device Configuration > Single Device Configuration from the main menu.
Select the device to be configured and choose VPN Configuration > Network Slice.
Click Create and configure mapping between color values and network slices. For example, you can configure mapping between network slice instance 1 and color 200.
Click Commit.

Description

Table 2-541 Parameters for configuring network slicing

Parameter	Description
Color Index	Color value.
Network Slice Id	ID of a network slice instance.

VXLAN

Bridge Domain

Context

A bridge domain (BD) is a Layer 2 broadcast domain on a large Layer 2 network constructed using VXLAN. VXLAN packets in a BD can be forwarded through the VXLAN tunnel at Layer 2. After a BD is created through the single device configuration function, subsequent VXLAN-related deployment is performed based on the BD.

Only LSWs running V600 support this function.

Prerequisites

The tenant administrator has completed the SD-WAN network deployment.

Procedure

Choose Plan > Provision > Device Configuration > Single Device Configuration from the main menu.
Select the device to be configured and choose Vxlan > Bridge Domain from the navigation pane. The Bridge Domain page is displayed.
Click Create and create a BD instance.
On the Global tab page, configure the BD ID and BD-associated VXLAN network identifier (VNI) ID and VLAN ID.
On the dhcp-snooping tab page, enable the DHCP snooping function.
Click OK.

Parameter Description

Table 2-542 Parameters for configuring a BD

Parameter		Description
Global	BD ID	BD ID.
	VNI ID	VNI ID.
	VLAN ID	VLAN associated with a BD.
dhcp-snooping	DHCP snooping enable	Whether to enable the DHCP snooping function.
	DHCP snooping nni trusted enable	Whether to enable the trusted interface on a network node.
	DHCP snooping check request enable	Whether to enable the device to check DHCP messages against the DHCP snooping binding table.
	DHCP snooping alarm request enable	Whether to enable the DHCP snooping alarm function.

Layer 3 Network Virtualization

Context

Each tenant can be identified by a VNI. VNIs can be mapped to BDs in 1:1 mode, and a BD can function as a VXLAN network entity to transmit VXLAN data packets. You can create a VBDIF interface (logical Layer 3 interface) for each BD to implement communication between VXLAN segments, between VXLAN segments and non-VXLAN segments, and between Layer 2 and Layer 3 networks. After you configure an IP address for a VBDIF interface, the interface functions as the gateway for tenants in the BD to forward packets at Layer 3 based on the IP address.

Only LSWs running V600 support this function.

Procedure

Choose Plan > Provision > Device Configuration > Single Device Configuration from the main menu.
Select the device to be configured and choose VxLan > Network Virtualization over Layer 3 from the navigation pane. The Network Virtualization over Layer 3 page is displayed.
Click Create. On the Global tab page that is displayed, select a source interface and set a source address.
On the VXLAN Network Identifier tab page, set the VNI ID and peer address.
Click OK.

Parameter Description

Table 2-543 Description of Layer 3 network virtualization parameters

Parameter		Description
Global	Source NVE	Network Virtualization Edge (NVE) interface.
Global	Source NVE IP	Source address bound to the NVE interface.
VXLAN Network Identifier	VNI ID	VNI ID.
Ingress replication list	Peer IP address	IP address of the peer virtual tunnel end point (VTEP).

Reliability

Saving Device Configurations

Context

To prevent configuration loss caused by device restart and service interruption, the controller can save device configurations at a regular interval.

Only NE devices support this function.

Prerequisites

Devices have been managed by the controller.

Procedure

Choose Provision > Device > Single Device Configuration from the main menu.
Select the device to be configured and choose Reliability Configuration> Device Configuration from the navigation pane.
Click the Auto save tab and set an interval at which device configurations are automatically saved.

Parameter Description

Table 2-544 Parameters on the Device Configuration page

Parameter				Description
Device Configuration	Auto save	Interval time		Interval at which configurations are automatically saved.

Configuring BFD

Context

This section describes how to configure a time period after which a BFD session goes Up.

On a network with a large proportion of negotiation aspects, Seamless Bidirectional Forwarding Detection (S-BFD) can greatly reduce the negotiation time, rapidly detect communication faults between devices, and notify the upper-layer services of the faults.

You need to configure global S-BFD before creating an SR Policy with S-BFD.

Only ARs and LSWs running V600 and NE devices support this function.

Prerequisites

A device has been added.

Procedure

Choose Plan > Provision > Device Configuration > Single Device Configuration from the main menu.
Select the device to be configured and choose Reliability Configuration > BFD from the navigation pane.
Click the BFD tab and set the start delay time.
Click the SBFD tab and set Reflector discriminator ID and Reflector discriminator IP.

Parameter Description

Table 2-545 BFD parameters

Parameter

Description

BFD

Delay up timer

Time period after which a BFD session goes Up.

SBFD

Discriminator ID

Integer-type discriminator.

S-BFD is a simplified BFD state machine that shortens the negotiation time and improves network-wide flexibility. You can configure S-BFD to implement fast link detection. An S-BFD session consists of an initiator and a reflector. Before link fault detection, an S-BFD initiator and an S-BFD reflector exchange S-BFD Control packets to notify each other of S-BFD parameters (for example, discriminators). After receiving an S-BFD Control packet from the initiator, the reflector checks whether the S-BFD discriminator carried in the packet matches the global S-BFD discriminator configured on itself. If they do not match, the packet is discarded. If they match and the reflector is in the working state, the reflector sends back a response S-BFD Control packet to the initiator. The initiator determines the local state based on the received response packet:

The initiator is responsible for detection and runs both an S-BFD state machine and a detection mechanism and triggers service protection.
The reflector is not running a state machine or detection mechanism and is not associated with services. It only sends S-BFD Control packets in response to S-BFD Control packets sent by the initiator.

Discriminator IP address

IP-address-type discriminator. The value is in dotted decimal notation and must be a unicast address.

Configuring a BFD Session

Context

To minimize the impact of device faults on services and enhance network reliability, a network device must be able to quickly detect faults in communication with adjacent devices. Measures can then be taken to promptly rectify the faults to ensure service continuity. Bidirectional Forwarding Detection (BFD) provides a method of monitoring the connectivity of a data protocol on the path between two adjacent devices by detecting faults on this path. The path can be either a physical or logical link (including a tunnel).

Only ARs and LSWs running V600 and NE devices support this function.

Prerequisites

Devices have been managed by the controller.

Procedure

Choose Plan > Provision > Device Configuration > Single Device Configuration from the main menu.
Select the device to be configured and choose Reliability Configuration > BFD Session from the navigation pane.
Click Create. In the BFD Session dialog box that is displayed, configure global attributes of a BFD session.
Enter the BFD session name in the Name text box. The name uniquely identifies a BFD session.
Configure a BFD session with automatically negotiated discriminators. Choose Auto from the navigation pane and set Source Interface and Address Type, which indicate the interface bound to the BFD session and IP address type of the interface, respectively.
- When Address Type is set to IPv4:
  Destination IPv4 address: specifies the destination IP address to be bound to the BFD session.
  
  Source IPv4 address: specifies the source IPv4 address carried in BFD packets.
  
  Min-tx-interval(ms) and Min-rx-interval(ms): specify the minimum interval for sending BFD packets and the minimum interval for receiving BFD packets, respectively.
  
  VPN: specifies the VPN instance to be bound to the BFD session for negotiation and authentication.
  
  Bundle mode: specifies the mode of a BFD for link-bundle session.
- When Address Type is set to IPv6:
  Destination IPv6 address: specifies the destination IP address to be bound to the BFD session.
  
  Source IPv6 address: specifies the source IPv6 address carried in BFD packets.
  
  Min-tx-interval(ms) and Min-rx-interval(ms): specify the minimum interval for sending BFD packets and the minimum interval for receiving BFD packets, respectively.
  
  VPN: specifies the VPN instance to be bound to the BFD session for negotiation and authentication.
  
  Bundle mode: specifies the mode of a BFD for link-bundle session.
Configure a BFD session with static discriminators. Choose Static from the navigation pane.
- Address Type: supports only IPv6.
  Destination IPv6 address: specifies the destination IP address to be bound to the BFD session.
  
  Source IPv6 address: specifies the source IP address of the BFD session.
  
  Min-tx-interval(ms) and Min-rx-interval(ms): specify the minimum interval for sending BFD packets and the minimum interval for receiving BFD packets, respectively.
  
  Select board slot: specifies the board to be forcibly selected by the BFD session state machine.
  
  Out interface: specifies the interface to be bound to the BFD session.
  
  VPN: specifies the VPN instance to be bound to a BFD session.
  
  One arm echo: specifies whether to enable the one-arm BFD echo function.
  
  One arm echo min rx interval(ms): specifies the minimum interval for receiving BFD packets of the BFD session enabled with the one-arm echo function.
  
  Process pst: specifies whether to enable the function of modifying the Port State Table (PST).

Parameter Description

Table 2-546 Parameters for configuring a BFD session

Parameter				Description
Global	Name			Name of a BFD session.
Auto	Source Interface			Interface to be bound to the BFD session.
	Address Type	IPv4	Destination IPv4 address	Destination IP address to be bound to the BFD session.
			Source IPv4 address	Source IP address to be carried in BFD packets.
			Min-tx-interval	Minimum interval at which BFD packets are sent.
			Min-rx-interval	Minimum interval at which BFD packets are received.
			VPN	Name of the VPN instance to be bound to the BFD session.
			Bundle mode	none: indicates that the session is not a BFD for link-bundle session. bundle-standard: indicates the standard bundle mode. bundle-compatible: indicates the compatible bundle mode. bundle-std-unshare: indicates the unshared standard bundle mode. bundle-com-unshare: indicates the unshared compatible bundle mode.
			Pis auto	Whether to enable link fault detection on the interface. If this function is enabled, the IPv4 BFD session with automatically negotiated discriminators is enabled after the device restarts. If this function is disabled, the IPv4 BFD session with automatically negotiated discriminators is disabled after the device restarts.
			Pis no impact	Whether to enable association with the interface status. If this function is enabled, when the status of the IPv4 BFD session changes, the status of the associated interface changes accordingly. This parameter can be set for only one BFD session on each interface. If this function is disabled, when the status of the IPv4 BFD session changes, the status of the associated interface does not change accordingly. This parameter can be set for only one BFD session on each interface.
		IPv6	Destination IPv6 address	Destination IP address to be bound to the BFD session.
			Source IPv6 address	Source IP address to be carried in BFD packets.
			Min-tx-interval	Minimum interval at which BFD packets are sent.
			Min-rx-interval	Minimum interval at which BFD packets are received.
			VPN	Name of the VPN instance to be bound to the BFD session.
			Bundle mode	none: The session is not a BFD for link-bundle session. bundle-standard: indicates the standard bundle mode. bundle-compatible: indicates the compatible bundle mode. bundle-std-unshare: indicates the unshared standard bundle mode. bundle-com-unshare: indicates the unshared compatible bundle mode.
			Pis auto	Whether to enable link fault detection on the interface. If this function is enabled, the IPv6 BFD session with automatically negotiated discriminators is enabled after the device restarts. If this function is disabled, the IPv6 BFD session with automatically negotiated discriminators is disabled after the device restarts.
			Pis no impact	Whether to enable association with the interface status. If this function is enabled, when the status of the IPv6 BFD session changes, the status of the associated interface changes accordingly. This parameter can be set for only one BFD session on each interface. If this function is disabled, when the status of the IPv6 BFD session changes, the status of the associated interface does not change accordingly. This parameter can be set for only one BFD session on each interface.
Static	Address Type	IPv6	Destination IPv6 address	Peer IP address to be bound to the BFD session.
			Source IPv6 address	Source IP address to be carried in BFD packets.
			Min tx interval	Interval at which BFD packets are sent.
			Min rx interval	Interval at which BFD packets are received.
			Select board slot	Board to be forcibly selected by the BFD session state machine.
			Local discriminator	Local discriminator of the BFD session. This attribute is not required when the static auto-negotiation mode is used. Note: The local discriminator of the local end must be the same as the remote discriminator of the peer end.
			Remote discriminator	Remote discriminator of the BFD session. This attribute is not required when the static auto-negotiation mode is used. Note: The remote discriminator of the local end must be the same as the local discriminator of the peer end.
			Out interface	Interface to be bound to the BFD session.
			VPN	Name of the VPN instance to be bound to the BFD session.
			One arm echo	Whether to enable the BFD echo function.
			One arm echo min rx interval	Minimum interval at which BFD packets of the BFD session enabled with the one-arm echo function are received.
			Process pst	Whether to enable the function of modifying the PST. If this function is enabled, when a BFD session detects a fault, the interface status in the PST is changed to trigger FRR. If this function is disabled, the interface status in the PST is not updated when the BFD session status changes.
			Is group	Whether to enable a session group.

Configuring VRRP

Context

The Virtual Router Redundancy Protocol (VRRP) is a standard-defined fault-tolerant protocol that groups several physical devices into a virtual one. If a physical device (master) that serves as the next hop of hosts fails, the virtual device switches traffic to a different physical device (backup), thereby ensuring service continuity and reliability.

You can configure VRRP to virtualize a group of physical devices into a single virtual device and configure the IP address of the virtual device as the default gateway address. This implements default gateway backup. If a gateway fails, VRRP elects a different gateway to transmit traffic, ensuring reliable network communication.

Only ARs and LSWs running V600 and NE devices support this function.

Prerequisites

A Layer 3 physical interface has been created and configured with an IP address.

Procedure

Choose Plan > Provision > Device Configuration > Single Device Configuration from the main menu.
Select the device to be configured and choose Reliability Configuration > VRRP from the navigation pane.
Click Create. On the Global tab page, select an interface.
On the VRRP group tab page, configure VRRP.
1. Click Virtual ipsList and configure a VRRP virtual IP address.
2. Click Track interfacesList and configure association between the VRRP group and an interface.
3. Click Track IP routeList and configure association between the VRRP group and a route.
4. Click Track BFDList and configure association between the VRRP group and a BFD session.
On the Interface VRRP backup group tab page, set a delay before the VRRP group recovers.
Click OK.

Parameter Description

Table 2-547 Parameters for configuring VRRP

Parameter		Description
VRRP	Interface	Interface on which VRRP is to be configured.
VRRP group	ID	ID of a VRRP group.
	Priority	Priority of the device in the VRRP group. A larger value indicates a higher priority.
	Delay time	Preemption delay for the VRRP group. You are advised to set the preemption delay to 0 on a backup device to allow it to assume the master role immediately after the master device fails or set the preemption delay to a non-0 value on the master device so that it can assume the master role after a specified delay if a master/backup VRRP switchover is performed.
	Address	Virtual IP address of the VRRP group. It must be on the same network segment as the IP address of the interface configured with the VRRP group. You do not need to specify a virtual IP address for the VRRP group if the VRRP group is configured as a Load-Balance Redundancy Group (LBRG) member group.
	Track interfaces	Interface name: indicates the name of the interface to be associated with the VRRP group.
		Priority: indicates the value by which the device priority increases or decreases when the interface associated with the VRRP group becomes Down.
		Track mode: indicates whether to increase or decrease the device priority when the interface associated with the VRRP group becomes Down. The options are as follows: increase: The priority is increased. reduce: The priority is decreased.
	Track IP route	VPN: VPN instance to which the IPv4 route to be associated with the VRRP group belongs.
		Address: IP address of the IPv4 route associated with the VRRP group.
		Mask: Mask of the IPv4 route associated with the VRRP group.
	Track BFD	BFD session: specifies the name of the BFD session to be associated with the VRRP group.
		BFD type: indicates the type of the BFD session associated with the VRRP group.
		Priority: indicates the value by which the device priority increases or decreases when a normal BFD session associates with the VRRP group.
		Track mode: indicates whether to increase or decrease the device priority when the BFD session associates with the VRRP group. The options are as follows: increase: The priority is increased. reduce: The priority is decreased.
Interface VRRP backup group	State recovery delay (s)	Delay before which the VRRP group recovers.

Configuring VRRP6

Context

VRRP for IPv6 (VRRP6) groups multiple gateways into a virtual gateway, and the host uses the virtual gateway's IPv6 address as the default gateway address to communicate with the external network. If a gateway fails, VRRP elects a different gateway to transmit traffic, ensuring reliable network communication.

Only ARs running V600 and NE devices support this function.

Prerequisites

A Layer 3 physical interface has been created and configured with an IP address.

Procedure

Choose Plan > Provision > Device Configuration > Single Device Configuration from the main menu.
Select the device to be configured and choose Reliability Configuration > VRRP6 from the navigation pane.
Click Create. On the Global tab page, select an interface.
On the VRRP6 group tab page, configure a VRRP6 group.
1. Click Preempt and enable the VRRP6 group with a higher priority to assume the master role.
2. Click Virtual ipsList and configure a VRRP6 virtual IP address.
3. Click Track interfacesList and configure association between the VRRP6 group and an interface.
4. Click Track IP routeList and configure association between the VRRP6 group and a route.
5. Click Track BFDList and configure association between the VRRP6 group and a BFD session.
On the Interface VRRP6 backup group tab page, set a delay before the VRRP6 group recovers.
Click OK.

Parameter Description

Table 2-548 Parameters for configuring VRRP6

Parameter		Description
VRRP6	Interface	Interface on which VRRP6 is to be configured.
VRRP6 group	ID	ID of a VRRP6 group.
	Priority	Priority of the device in the VRRP6 group. A larger value indicates a higher priority.
	Advertisement packet interval(ms)	Interval at which the master device sends VRRP Advertisement packets. The value is an integer ranging from 100 to 4095, in centiseconds.
	Link-local address	Link-local IP address of the VRRP6 group.
	Backup device timeout period	Multiplier of the interval at which VRRP6 Advertisement packets are sent for the timeout period of a backup device in a VRRP6 group. The value is an integer ranging from 3 to 10.
	Preempt	Whether the VRRP6 group with a higher priority can assume the master role.
	Address	Virtual IPv6 address of the VRRP6 group. It must be on the same network segment as the IP address of the interface configured with the VRRP6 group. You do not need to specify a virtual IPv6 address for the VRRP6 group if the VRRP6 group is configured as an LBRG member group.
	Track interfaces	track-ifname: indicates the name of the interface to be associated with the VRRP6 group.
		Priority: indicates the value by which the device priority increases or decreases when the interface associated with the VRRP6 group becomes Down.
		Track mode: indicates whether to increase or decrease the device priority when the interface associated with the VRRP6 group becomes Down. The options are as follows: increase: The priority is increased. reduce: The priority is decreased.
	Track IP route	VPN: VPN instance to which the IPv6 route to be associated with the VRRP6 group belongs.
		Address: IP address of the IPv6 route associated with the VRRP6 group.
		Mask: Mask of the IPv6 route associated with the VRRP6 group.
	Track BFD	BFD session: specifies the name of the BFD session to be associated with the VRRP6 group.
		BFD type: indicates the type of the BFD session associated with the VRRP6 group.
		Priority: indicates the value by which the device priority increases or decreases when a normal BFD session associates with the VRRP6 group.
		Track mode: indicates whether to increase or decrease the device priority when the BFD session associates with the VRRP6 group. The options are as follows: increase: The priority is increased. reduce: The priority is decreased.
Interface VRRP6 backup group	State recovery delay (s)	Delay before which the VRRP6 group recovers.

Configuring NQA

Context

Only LSWs, firewalls, and ARs running V600 support this function.

Prerequisites

Devices have been managed by the controller.

Procedure

Choose Plan > Provision > Device Configuration > Single Device Configuration from the main menu.
Select the device to be configured and choose Reliability Configuration > NQA from the navigation pane.
Click Create to configure an NQA test instance.
- The NQA configuration takes effect immediately on devices after being delivered.
- After the NQA configuration takes effect, it can be deleted but cannot be modified.

Follow-up Procedure

An event is generated after NQA is configured and when an NQA test completes. You can choose Monitoring and O&M > Monitoring > Alarm > Events to view events.

Parameter Description

Table 2-549 NQA parameters

Parameter			Description
NQA	Global	Test instance name	Name of an NQA test instance. The value is a string of 1 to 32 case-sensitive characters, excluding question marks (?), hyphens (-), and double quotation marks (").
		Destination IP address type	Destination address type of the NQA test instance. The value can be IPv4 or IPv6.
		Destination IPv4/IPv6 address	Destination address for the NQA test instance.
		Source interface	Source interface of the NQA test instance.
		Test instance VPN	VPN instance for the NQA test instance. The value is a string of 1 to 31 case-sensitive characters without spaces. When double quotation marks (") are used to include the string, spaces are allowed in the string. The default value is _public_. NOTE: This parameter must be set when the interface to which the NQA test instance is applied has a VPN configured. Source interface and Test instance VPN cannot be empty at the same time.
		Number of sent packets	Number of probe packets to be sent each time in the NQA test instance. The value is an integer from 1 to 15. The default value is 5.
		Packet sending interval (s)	Interval at which an NQA test instance sends a probe packet. The value ranges from 1 to 60. The default value is 4. When an NQA test instance starts, it will send multiple probe packets in each test. Network quality is detected based on the data collected through multiple probe packets. Probe packets are sent at a specified interval. On networks with poor quality, you can set a relatively large interval. If not, the network quality may deteriorate due to the test instance. On networks with good quality, you can set a relatively small interval to reduce the time waiting for the test instance to end. NOTE: The interval at which an NQA test instance sends a probe packet must be greater than the timeout interval.
		Timeout interval (s)	Timeout period for a probe of the NQA test instance. The value is an integer from 1 to 60, in seconds. The default value is 3. The timeout period refers to the time for waiting for a response packet after a probe is sent. If no response packet is received within the timeout period, the probe is considered failed. You need to set the timeout period based on the actual networking. If a small timeout period is set, the NQA test instance may fail.
		Cyclic Scheduling Period (s)	Interval at which the NQA test instance is automatically executed. The value range is from 1 to 604800. The default value is 22. If a test instance needs to be performed periodically during a specified period, you can set the interval at which the NQA test instance is performed automatically. NOTE: The interval at which the NQA test instance is periodically executed must meet the following requirement: Interval at which the NQA test instance is periodically executed > Packet sending interval x (Number of sent packets - 1) + Timeout interval
		Data size (byte)	Size of an NQA probe packet. The value is an integer from 0 to 8100, in bytes. The default value is 0. If the configured packet size is smaller than the default packet size, the default packet size is used for packet processing.
		TTL	Time To Live (TTL) value for NQA probe packets. The value is an integer in the range from 1 to 255. The default value is 30. To prevent probe packets from being transmitted endlessly, the test instance must be performed within a specified number of hops.
		ToS	Service type of an NQA probe packet. The value is an integer from 0 to 255. The default value is 0. You can set the priority of probe packets by setting the ToS value. When a large number of packets are received, packets of high priorities are processed preferentially.
		Conditions for sending traps	Condition for sending trap messages. Only the value testresult-change is supported, indicating that a trap message is sent upon a probe result change. NOTE: Only ARs running V600R022C00 and later versions support this function.
		Start-up Switch	Status of the NQA test instance. Open: The NQA test instance starts immediately. Close

Configuring a BFD Template

Context

BFD for IPv4/IPv6 static routes allows an IPv4/IPv6 static route to be bound to a BFD session so that the BFD session monitors the status of the link related to the IPv4/IPv6 static route. This function allows each IPv4/IPv6 static route to be bound to a BFD session. If the BFD session that monitors an IPv4/IPv6 static route detects a link fault (the BFD session goes down), the BFD session reports the fault to the system. Then, the system deletes the static route from the IP routing table. After the BFD session finds that the link is re-established successfully (the BFD session is up), the BFD session reports the event to the system. Then, the system adds the IPv4/IPv6 static route to the IP routing table.

Only ARs running V600 and NE devices support this function.

Prerequisites

A device has been added.

Procedure

Choose Plan > Provision > Device Configuration > Single Device Configuration from the main menu.
Select the device to be configured, choose Reliability Configuration > BFD Template from the navigation pane, and configure BFD for a static route.

Parameter Description

Table 2-550 Parameters for configuring a BFD template

Parameter	Description
vpnInstance	VPN instance that the next hop belongs to.
Next-hop	Next-hop address. The outbound interface and next hop configured in the BFD template must be the same as those of the corresponding IPv4 static route.
interface-name	Outbound interface.
Local address	Local address.
min-tx-interval(ms)	Minimum interval at which BFD packets are sent. If this parameter is not set, the corresponding value in the global BFD configuration is used.
min-rx-interval(ms)	Minimum interval at which BFD packets are received. If this parameter is not set, the corresponding value in the global BFD configuration is used.
multiplier	Local detection multiplier for BFD. If this parameter is not set, the corresponding value in the global BFD configuration is used.

Health Check

Context

Health check is used to detect service availability, link availability, or link delay. The detection result is used as the basis for traffic distribution adjustment during PBR-based intelligent uplink selection and dual-device hot standby. Health check can detect network changes in real time to ensure that the server or link to be accessed is available. When multiple servers or links are available, the device can select the optimal server to process service traffic based on the service type or select the link best suiting the requirements based on the link delay, jitter, and packet loss rate for traffic transmission.

Only firewalls running V600 support this function.

Procedure

Choose Plan > Provision > Device Configuration > Single Device Configuration from the main menu.
Select the device to be configured and choose Reliability Configuration > Health Check from the navigation pane.
Click Create. On the Global tab page, set basic parameters about health check.
On the Destination IP tab page, configure the destination IP address for health check.
Click OK.

Parameter Description

Table 2-551 Parameters for configuring health check

Parameter		Description
Global	Name	Name of a health check task.
	Least Active Link	Minimum number of active links for health check. When the number of active links is smaller than this value, the status of health check changes to Down. The value is an integer from 1 to 16. The default value is 1.
	Failed Times	Maximum number of consecutive health check probe failures. When the number of consecutive probe failures reaches a specific value, the system considers the corresponding link unavailable and changes the state of the link to Down. The value is an integer from 2 to 10. The default value is 3.
	Interval(s)	Interval at which probe packets are sent during health check. The value is an integer from 1 to 10. The default value is 5.
	Source IP	Source IP address of health check probe packets.
Destination IP	IP	Destination IP address of health check probe packets.
	Protocol	Type of the protocol used by health check probe packets.
	Port	Port number of the protocol used by health check probe packets.
	Outbound Interface	Outbound interface of health check probe packets.
	Next Hop	Next-hop address of health check probe packets.

Link Quality Indicator

Context

Health check can detect the delay, jitter, and packet loss rate of links in real time. When health check and link quality indicators are referenced in intelligent uplink selection, the links that meet quality indicator requirements are preferentially selected, making link selection more intelligent.

Only firewalls running V600 support this function.

Procedure

Choose Plan > Provision > Device Configuration > Single Device Configuration from the main menu.
Select the device to be configured and choose Reliability Configuration > SLA Instance from the navigation pane.
Click Create and set link quality indicator parameters.
Click OK.

Parameter Description

Table 2-552 Parameters of link quality indicators

Parameter		Description
Global	Name	SLA name.
	Delay(ms)	Maximum delay.
	Jitter(ms)	Maximum jitter.
	Loss	Maximum packet loss rate.

QoS

Configuring QoS

Configuring a DiffServ Domain Template

Context

By configuring differentiated services (DiffServ) domains, you can implement differentiated service policies and Per-Hop Behaviors (PHBs) based on packet external priorities. A DiffServ domain maps packet priorities to PHBs and colors.

Only NE devices and ARs and LSWs running V600 support this function.

Prerequisites

A device has been added.

Procedure

Choose Plan > Provision > Device Configuration > Single Device Configuration from the main menu.
Select the device to be configured, and choose QOS Configuration > QOS Configuration > Diffserv Domains Template from the navigation pane.
Click Create and set the DiffServ domain template name.
Click Behavior Aggregation to configure BA traffic classification.
Click Per-Hop Behavior to configure a per-hop behavior list.

Parameter Description

Table 2-553 Parameters for configuring a DiffServ domain template

Parameter		Description
Global	Name	Name of a DiffServ domain.
Behavior Aggregation	Type	ip-dscp: maps the DSCP value of IP packets.
	Value	Value of the selected external priority to be mapped.
	Service Class	PHB to which the selected external priority needs to be mapped.
	Color	Color to be marked for packets.
Per Hop Behavior	Type	ip-dscp: maps the DSCP value of IP packets.
	Service Class	PHB to which the selected external priority needs to be mapped.
	Color	Color to be marked for packets.
	Value	Value of the selected external priority to be mapped.

Configuring a Port WRED Template

Context

By configuring WRED templates, you can set the upper and lower drop thresholds for packets in different queues or with different colors.

Only NE devices support this function.

Prerequisites

A device has been added.

Procedure

Choose Plan > Provision > Device Configuration > Single Device Configuration from the main menu.
Select the device to be configured, and choose QoS Configuration > QOS Configuration > Port WRED Template from the navigation pane.
Click Create. Create the name and queue depth of a WRED template, configure a WRED color list, and click OK.

Parameter Description

Table 2-554 Parameters for configuring a port WRED template

Parameter			Description
Port WRED List	Global	Name	Name of a port WRED template.
	Global	Queue Depth	Buffer length of a queue.
	WRED Color List	Color	Color to be marked for packets. The options include green, yellow, and red. You can set upper and lower drop thresholds and the drop probability for packets with different colors separately. Generally, green packets have the smallest drop probability and the highest thresholds (both lower and upper drop thresholds); yellow packets have the medium drop probability and thresholds; red packets have the highest drop probability and the lowest thresholds (both lower and upper drop thresholds).
		Low Limit Percentage	Lower drop threshold specified in the WRED template. When the percentage of the packet count in a queue to the queue length reaches this value, packets start to be discarded.
		High Limit Percentage	Upper drop threshold specified in the WRED template. When the percentage of the packet count in a queue to the queue length reaches this value, all subsequent packets are discarded.
		Discard Percentage	WRED maximum drop probability.

Configuring a Port Queue Template

Context

You can configure queue-based packet scheduling to ensure that packets of services (such as VoIP and video services) in high-priority queues are scheduled preferentially in the case of network congestion. When packets arrive at an interface, packets are placed into different queues based on the configured policies. An interface that is not congested can send packets in its queues at the traffic shaping rate, whereas an interface where congestion occurs can send packets in its queues at the weighted rate at least. If congestion occurs in a queue carrying high-priority services, you can increase the weight of the queue properly to prevent packet loss in the queue.

Only NE devices support this function.

Prerequisites

A device has been added.

Procedure

Choose Plan > Provision > Device Configuration > Single Device Configuration from the main menu.
Select the device to be configured, and choose QoS Configuration > QOS Configuration > Port Queue Template from the navigation pane.
Click Create, set a name for the port queue template, configure a port queue, and click OK.

Parameter Description

Table 2-555 Parameters for configuring a port queue template

Parameter					Description
Port Queue Template	Global		Name		Name of a port queue template.
	Port Queue	Global	Service Class		Class of Service (CoS) of a port queue. The value can be set to one of the following values: cs7, cs6, ef, af4, af3, af2, af1, and be.
		Global	Port WRED Name		WRED template to be bound to the port queue.
		Config Type	shaping-mode	Queue Schedule Mode	pq: configures the Priority Queuing (PQ) scheduling mode for the port queue. wfq: configures the Weighted Fair Queuing (WFQ) scheduling mode for the port queue. lpq: configures the low priority queuing (LPQ) scheduling mode for the port queue.
				Weight	Queue weight in the selected scheduling mode.
				Low Latency	Whether to enable low latency queuing. The value enable indicates that the function is enabled.
				Shaping Parameters	shaping: specifies the absolute value of the traffic shaping rate. shaping-percent: specifies the traffic shaping rate for the port queue, in percentage. This parameter indicates the percentage of the port queue's traffic shaping rate to the configured port outbound bandwidth.
			Cir Mode	Cir Schedule Mode	pq: specifies the Priority Queuing (PQ) scheduling mode.
				Pir Schedule Mode	pq: configures the Priority Queuing (PQ) scheduling mode for the port queue. wfq: configures the Weighted Fair Queuing (WFQ) scheduling mode for the port queue. lpq: configures the low priority queuing (LPQ) scheduling mode for the port queue.
				Pir Weight	Queue weight in the selected scheduling mode.
				CBS	Committed burst size (CBS).
				PIR-PBS	Peak burst size (PBS).
				CIR Parameters	CIR Value: sets the CIR value to an absolute value. CIR Percentage: sets the CIR value to a percent value.

Configuring an Interface QoS Policy

Context

On traditional networks, quality of service (QoS) issues are mainly caused by network congestion, which refers to the low data forwarding rate and extra delay resulting from insufficient network resources. Congestion extends the delay of packet transmission, lowers throughput, and consumes more resources. However, network congestion is very common in a complex environment with a variety of services. Congestion avoidance uses specific packet drop algorithms to prevent congestion from intensifying and makes full use of network bandwidth. When network congestion occurs, packets are buffered in queues and congestion management schedules the packets based on a scheduling algorithm, ensuring that QoS-demanding services, such as latency-sensitive services, are preferentially scheduled.

Only NE devices and ARs and LSWs running V600 support this function.

Prerequisites

A device has been added to the controller.

Procedure

Choose Provision > Device > Single Device Configuration from the main menu.
Select the device to be configured and choose QOS Configuration > QOS Configuration > Interface QOS from the navigation pane.
Click Create, select the interface to which the QoS policy is to be applied, configure the interface to map packets based on the 802.1p priority and then queue scheduling for the interface.

Parameter description

Table 2-556 Interface QoS parameters

Parameter			Description
Interface QOS	interface name		Interface to which a QoS policy is to be applied.
Trust	Trust Type		Inner 802.1p: performs behavior aggregate (BA) classification for packets passing through the interface based on inner 802.1p values. Outer 802.1p: performs BA classification for packets passing through the interface based on outer 802.1p values. DSCP: specifies the DSCP priority.
Trust upstream	Diffserv domain name		DiffServ domain template. NOTE: V600 LSWs do not support this parameter.
queue schedule List	queue index		Index of a queue.
	schedule mode		drr: Deficit Weighted Round Robin (DWRR) schedules packets based on the packet length, which is used as the weight. If a packet is too long, DWRR allows a negative weight value so that long packets can be scheduled. In the next round, the queue with a negative weight value is not scheduled until its weight value becomes positive.
	weight		Weight of a WDRR queue.
Traffic Shaping	Queue-based Traffic Shaping	Interface Queue Index	Index of a queue on the interface.
		Queue Config Mode	Traffic control policy. The default value is Shaping Mode. Traffic shaping adjusts the rate at which traffic is sent to reduce traffic bursts, thereby ensuring a stable transmission rate and preventing congestion on the downstream device.
		Shaping Parameter type	Value type of traffic shaping parameters, which can be the percentage or absolute value.
		CIR (kbit/s)	Absolute value of the committed information rate (CIR) for traffic shaping.
		CBS (Byte)	Absolute value of the committed burst size (CBS), which is the average volume of burst traffic that can pass through an interface.
		PIR (kbit/s)	Absolute value of the peak information rate (PIR) for traffic shaping.
		PBS (Byte)	Absolute value of the peak burst size (PBS), which is the maximum volume of burst traffic that can pass through an interface.
		Percentage of CIR(%)	CIR for traffic shaping, in percentage.
		Percentage of PIR(%)	PIR for traffic shaping, in percentage.
	Interface-based Traffic Shaping	CIR (kbit/s)	CIR, which is the allowed rate at which traffic can pass through.
	Interface-based Traffic Shaping	CBS (Byte)	Absolute value of the committed burst size (CBS), which is the average volume of burst traffic that can pass through an interface.

Configuring MQC

Configuring a Traffic Classifier

Context

You can configure traffic classifiers on a single device through agile configuration.

Only ARs and LSWs running V600 and NE devices support this function.

Prerequisites

A device has been added.

Procedure

Choose Plan > Provision > Device Configuration > Single Device Configuration from the main menu.
Select the device to be configured. Choose QOS Configuration > MQC Configuration > Traffic Classification from the navigation pane, click Create, create a traffic classifier, and click OK.
Click Edit in the Operation column and configure a traffic classification rule.
- Click the IPv4 ACL rule tab, click Create, select a configured IPv4 ACL rule, and click OK.
- Click the IPv6 ACL rule tab, click Create, select a configured IPv6 ACL rule, and click OK.
- Click the Rule Priority tab and click Create. Set a priority value and click OK.
- Click the MAC Address tab and click Create. Select source or destination from the Source/Destination drop-down list box, specify a MAC address, and click OK.
- Click the Any Rule tab, click Create, select the IPv4 or IPv6 address family, and click OK.
- Choose More > rule-address-ipv4, click Create, configure an IPv4 address rule list, and click OK.
- Choose More > IPv6 Protocol Rule, click Create, configure an IPv6 protocol rule list, and click OK.
- Choose More > Service Class Rule, click Create, configure a service class rule list, and click OK.
- Choose More > IPv4 TCP Flag Rule, click Create, configure an IPv4 TCP flag rule list, and click OK.
- Choose More > IPv6 TCP Flag Rule, click Create, configure an IPv6 TCP flag rule list, and click OK.
- Choose More > VLAN Rule, click Create, configure a VLAN rule list, and click OK.

Parameter Description

Table 2-557 Parameters for configuring a traffic classifier

Parameter			Description
Traffic classifier	Name		Name of a traffic classifier.
	Operator		Logical operator between rules in a traffic classifier. and: indicates that the relationship between rules is AND. If a traffic classifier contains ACL and non-ACL rules, a packet matches the traffic classifier only when it matches one of the ACL rules and all the non-ACL rules. If a traffic classifier contains non-ACL rules only, a packet matches the traffic classifier only when it matches all the rules in the traffic classifier. or: indicates that the relationship between rules is OR. Packets match a traffic classifier as long as they match one of rules in the classifier.
	Description		Description of the traffic classifier to indicate the configuration and usage of the traffic classifier.
IPv4 ACL Rule	ACL Name		IPv4 ACL rule for matching packets. You need to select an existing IPv4 ACL.
IPv6 ACL Rule	ACL Name		IPv6 ACL rule for matching packets. You need to select an existing IPv6 ACL.
Rule Priority	Type		8021p: configures a matching rule for traffic classification based on 802.1p values of VLAN packets. ip-precedence: configures a matching rule for multi-field traffic classification based on IP precedence values of IPv4 or IPv6 packets. dscp: configures a matching rule for multi-field traffic classification based on DSCP values of IPv4 or IPv6 packets. ipv6-dscp: configures a matching rule for multi-field traffic classification based on DSCP values of IPv6 packets. ipv6-ip-precedence: configures a matching rule for multi-field traffic classification based on IP precedence values of IPv6 packets.
Rule Priority	Value		Priority value. When Type is set to 8021p, ip-precedence, or ipv6-ip-precedence, the value is an integer that ranges from 0 to 7. A larger value indicates a higher priority. When Type is set to dscp or ipv6-dscp, the value is an integer that ranges from 0 to 63.
MAC Address	Source/Destination		source: configures a matching rule for traffic classification based on source MAC addresses. destination: configures a matching rule for traffic classification based on destination MAC addresses.
MAC Address	MAC Address		Source or destination MAC address.
Any Rule	Protocol family		iPv4: All IPv4 packets are matched. ipv6: All IPv6 packets are matched.
More	rule-address-ipv6	address-type	IPv6 address type used for multi-field traffic classification. The options include source and destination.
		address-value	Source or destination IPv6 address to be matched.
		prefix-length	Mask length of an IPv6 address.
	IPv6 Protocol Rule	Next-header Value	Next IPv6 header value used for multi-field traffic classification. It indicates the type of header following the IPv6 header.
	Service Class Rule	Service Class	Service class used for multi-field traffic classification. You can select a CoS value from the drop-down list. The options include ef, af1, af2, af3, af4, be, cs6, and cs7.
	IPv4 TCP Tag Rule	Type	Matches TCP packets based on the SYN flag.
		TCP flag	Value of the SYN flag in TCP packet headers.
		Mask	Mask corresponding to the SYN flag value in TCP packet headers.
	IPv6 TCP Tag Rule	Type	Matches TCP packets based on the SYN flag.
		TCP flag	Value of the SYN flag in TCP IPv6 packet headers.
		Mask	Mask corresponding to the SYN flag value in TCP IPv6 packet headers.
	VLAN Based Rule	Start VLAN	Start outer VLAN ID.
	VLAN Based Rule	End VLAN ID	End outer VLAN ID.
	VLAN Rule	VLAN ID	VLAN ID used for traffic classification.
	VLAN Rule	CE VLAN ID	Inner VLAN ID.

Configuring a Traffic Behavior

Context

You can configure traffic behaviors on a single device through agile configuration.

Only ARs and LSWs running V600 and NE devices support this function.

Prerequisites

A device has been added.

Procedure

Choose Plan > Provision > Device Configuration > Single Device Configuration from the main menu.
Select the device to be configured and choose QOS Configuration > MQC Configuration > Traffic Behavior from the navigation pane.
Click Create and set global attributes of a traffic behavior.
1. Click Edit in the Operation column, click the Filter action tab, and configure the action to take.
2. Click the Remark tab, click Create, and configure re-marking.
  
  Marking DSCP values of specific traffic flows is mainly used for DSCP-based traffic steering. AR5700&6700&8000 series devices do not support DSCP-based traffic steering.
3. Click the TE Class tab and set a TE Class ID.
  
  Marking TE class values for specified traffic flows is mainly used for intelligent traffic steering.
4. Click the Specifying Service Class And Color tab, click Create, and configure a service class and a color.
5. Click the Statistics action tab and enable or disable the statistics collection function.
6. Click the More > Car action tab, click Create, and configure global attributes of traffic policing.
  - Click Edit in the Operation column on the Car action page. Click the Car action > Green action parameters tab and select the action to take on green-colored packets.
  - Click the Car action > Yellow action parameters tab and select the action to take on yellow-colored packets.
  - Click the Car action > Red action parameters tab and select the action to take on red-colored packets.
7. Click the More > Redirect tab.
  - Click the Redirect IPv4 tab and configure IPv4 redirection.
  - Click the Redirect IPv6 tab and configure IPv6 redirection.

Parameter Description

Table 2-558 Parameters for configuring a traffic behavior

Parameter			Description
Traffic Behavior	Template name		Name of a traffic behavior. When configuring a traffic behavior, do not set the traffic behavior name to the name of the pre-defined traffic behavior on the system.
Traffic Behavior	Description		Description of the traffic behavior, which helps you understand its usage.
Filter action	Filter type		Action to take on packets matching the traffic classifier to which the traffic behavior is bound. permit: forwards packets matching specified rules according to the original policy. Deny: denies packets matching the traffic classifier. If the permit action is configured in an ACL rule of a traffic behavior, the action to take on packets matching the traffic behavior is determined by that in the traffic behavior. If the deny action is configured in an ACL rule of a traffic behavior, packets matching the traffic behavior are denied, regardless of the action configured in the traffic behavior.
Remark	Action type		8021p: remarks the 802.1p value of a VLAN packet. iPv4-dscp: remarks the DSCP value of an IPv4 packet. tos: remarks the ToS value of an IP packet. ipv6-dscp: remarks the DSCP value of an IPv6 packet. ip-precedence: remarks the precedence value of an IP packet.
	Remark value		When Action type is set to 8021p or ip-precedence, the value is an integer ranging from 0 to 7. When Action type is set to iPv4-dscp or ipv6-dscp, the value is an integer ranging from 0 to 63. When Action type is set to tos, the value is an integer ranging from 0 to 15.
	After trust		This parameter can be set to enable when Action type to set to 8021p.
TE Class	Class ID		Re-marked SRv6 TE Class value.
Specifying Service Class And Color	Action Type		service-class: configures a traffic policy for matching traffic with specified CoS and color values. service-class-master-bfd: marks CoS and color values of packets matching the traffic policy based on the status of the specified master BFD session. service-class-slave-bfd: marks CoS and color values of packets matching the traffic policy based on the status of the specified slave BFD session.
	Service Class		You can select a CoS value from the drop-down list. The options include ef, af1, af2, af3, af4, be, cs6, and cs7.
	color		Color used to mark packets. The options include green, yellow, and red.
	Remark Switch		Whether to enable the remarking function.
	BFD Session Name		Name of a BFD session. The value can be only the name of a configured BFD session.
Statistic action	Enable statistic		Whether to enable statistics collection.
More	Traffic action	Action	car: applies the committed access rate (CAR) configuration to the traffic behavior.
		CIR	Committed information rate (CIR).
		PIR	Peak information rate (PIR). The PIR must be greater than or equal to the CIR.
		CBS	Committed burst size (CBS), that is, the committed traffic that can pass through instantly, or the depth of the first token bucket. The CBS value that can take effect depends on the board type.
		PBS	Peak burst size (PBS), that is, the peak traffic that can pass at an instant, that is, the depth of the second token bucket.
		Adjust	Packet compensation length.
		Green Action	pass: allows green-colored packets to pass. discard: discards green-colored packets.
		Yellow Action	pass: allows yellow-colored packets to pass. discard: discards yellow-colored packets.
		Red Action	pass: allows red-colored packets to pass. discard: discards red-colored packets.
		Color aware	Whether to enable the color-aware mode.
		Limit type	pps: use pps as the unit of CIR and PIR values when rate limiting is performed per packet. When Limit type is set to pps, the device limits the rate of and collects statistics on packets matching the traffic policy based on the Layer 2 and Layer 3 packet lengths. If the qos link-adjustment link-layer-exclude command is configured in the traffic policy, the qos link-adjustment link-layer-exclude configuration does not take effect.
	Redirect	Redirect IPv4	IPv4 Next Hop: redirects packets to a next-hop IPv4 address. Redirect Policy: redirects IPv4 packets to an SRv6 TE Policy. Redirect Tunnel: redirects packets to a tunnel. A traffic policy can apply the action to a specific tunnel interface to redirect packets matching a traffic classifier.
		Redirect IPv6	IPv6 Next Hop: redirects packets to a next-hop IPv6 address.
		Next Hop Address	Next-hop IPv4 or IPv6 address to which packets are redirected.
		Action Type	When Action Type is set to Interface, set the outbound interface through which packets are redirected to the next hop. An outbound interface can be a GE interface, GE sub-interface, Eth-Trunk interface, or Eth-Trunk sub-interface. When Action Type is set to None, configure whether to enable the block function. With this function enabled, packets are discarded if the specified next hop does not exist.
		Redirect Policy	Endpoint IPv6: specifies the destination address of an SRv6 TE Policy. Color: specifies a color value. Sid Type: sid indicates that the specified segment ID is a public network segment ID. vpnsid indicates that the specified segment ID is a private network segment ID. Sid IPv6: specifies an SID IPv6 address.
		Redirection Tunnel	Tunnel Name: specifies the next-hop tunnel to which packets are redirected. A traffic policy can apply the redirection action to a specific tunnel interface to redirect packets matching a traffic classifier. The value can only be Tunnel.

Configuring a Traffic Policy

Context

You can configure traffic policies on a single device through agile configuration.

Only ARs and LSWs running V600 and NE devices support this function.

Prerequisites

A device has been added.

Procedure

Choose Plan > Provision > Device Configuration > Single Device Configuration from the main menu.
Select the device to be configured and choose QOS Configuration > MQC Configuration > Traffic Policy from the navigation pane.
Click Create and configure global attributes of a traffic policy.
Click the Bind interfaces tab, click Create, select an interface, and bind the policy to the selected interface.

Parameter Description

Table 2-559 Parameters for configuring a traffic policy

Parameter		Description
Traffic Policy	Name	Name of a traffic policy. It cannot be set to default, which is the pre-defined policy name.
	Description	Description of the traffic policy, which helps you understand its usage.
	Statistics Switch	Whether to enable statistics collection in the traffic policy.
Traffic classifier/Traffic behavior	Traffic classification template name	Name of a traffic classifier. Traffic behavior and traffic classifier to be bound to the traffic policy. After creating a traffic policy, bind a pair of traffic classifier and traffic behavior to the traffic policy.
	Traffic behavior template name	Name of a traffic behavior. Traffic behavior and traffic classifier to be bound to the traffic policy. After creating a traffic policy, bind a pair of traffic classifier and traffic behavior to the traffic policy.
	Priority	Priority of the traffic policy. The system matches packets against traffic policies based on policy priorities. A smaller value indicates a higher priority.

Applying a Traffic Policy

Context

After a traffic policy is configured successfully, you can apply the traffic policy to a device, to an interface, or to a VLAN.

Only ARs and LSWs running V600 and NE devices support this function.

Prerequisites

A traffic policy has been configured.
A physical interface has been created.

Procedure

Choose Plan > Provision > Device Configuration > Single Device Configuration from the main menu.
Select the device to be configured and choose QOS Configuration > MQC Configuration > Traffic Policy Apply from the navigation pane.
Click the Global Application Configuration tab, click Create, and apply a traffic policy to a device.
Click the Interface Application Configuration tab, click Create, and apply a traffic policy to an interface.
Click OK.

Parameter Description

Table 2-560 Parameters for applying a traffic policy

Parameter		Description
Global Application Configuration	Traffic Policy Name	Name of a traffic policy. You need to create a traffic policy in advance.
	Direction	inbound: applies the traffic policy to a device in the inbound direction. outbound: applies the traffic policy to a device in the outbound direction.
	Slot ID	ID of a device slot to which the traffic policy is applied.
Interface Application Configuration	Interface Name	Interface to which a traffic policy is applied.
	Traffic Policy Name	Name of a traffic policy.
	Direction	inbound: applies the traffic policy to an interface in the inbound direction. outbound: applies the traffic policy to an interface in the outbound direction.
	Priority	Priority of the traffic policy applied to an interface.

User Access and Authentication

Configuring an HWTACACS Template

Context

Huawei Terminal Access Controller Access Control System (HWTACACS) is an enhanced security protocol based on TACACS (RFC 1492). HWTACACS is a centralized information exchange protocol using the client/server architecture, operates over TCP, and uses TCP port 49. HWTACACS provides independent authentication, authorization, and accounting, which can be implemented on different servers.

Only LSWs running V600 support this function.

Procedure

Choose Plan > Provision > Device Configuration > Single Device Configuration from the main menu.
Select the device to be configured and choose User Access and Authentication > HWTACACS from the navigation pane.
Click Create to configure an HWTACACS template.
Click the Global Attribute tab, and set the HWTACACS template name, domain mode, shared key, and source address.
Click the Server host tab, and set the server type, priority, IP address, and port number.

Parameter Description

Table 2-561 Parameters for configuring an HWTACACS template

Parameter		Description
Global	Name	Name of an HWTACACS template.
	Domain mode	Format of the user name in the packets sent to an HWTACACS server. The value can be Domain exclude, Domain include, or Original.
	Shared key	Shared key of an HWTACACS server. The value is a string of 20 to 432 characters in cipher text. Configuring a shared key improves the security of communication between the device and HWTACACS server. By default, no shared key is configured.
	Source address	Source IPv4 address used by the device to communicate with the HWTACACS server.
	Source ip address
Server host	Type	Type of an HWTACACS server. The value can be Authentication, Authorization, Accounting, or Common.
	Priority	Level of an HWTACACS server. Master: configures the HWTACACS accounting server as the active server. Secondary: configures the second HWTACACS accounting server as a standby server. Third: configures the third HWTACACS accounting server as a standby server. Fourth: configures the fourth HWTACACS accounting server as a standby server.
	Ip address	IPv4 address of an HWTACACS server.
	Port	Port number of an HWTACACS authentication server.

Configuring NAC

Context

Network Admission Control (NAC) is an end-to-end security technology that authenticates clients and users to ensure network security. NAC provides two authentication methods: 802.1X authentication and MAC address authentication.

Table 2-562 Hardware that supports this feature

Series	Supported Product
S8700 series	S8700-10/S8700-4/S8700-6

Procedure

Choose Plan > Provision > Device Configuration > Single Device Configuration from the main menu.
Select the device to be configured and choose User Access and Authentication > NAC from the navigation pane.
Click the Global Function tab, click the Pre authen access tab, and select Open under Enable.
Click the MAC move tab, select All VLAN from the Enable VLAN drop-down list box, and select Open or Close under All.
Click the Detect tab and enable the detection function.
Click the Authentication profile tab and set the name of an NAC authentication profile.

Parameter Description

Table 2-563 Parameters for configuring NAC

Parameter			Description
Global	Pre authen access		Whether to enable the function of keeping users who fail to be authenticated in the pre-connection state.
	MAC move	Enabling VLAN	VLAN where MAC address migration is to be enabled. Currently, the value can only be All VLAN, indicating that MAC address migration is enabled in all VLANs.
		All	Whether to enable MAC address migration in all VLANs.
		Detect	Whether to enable the device to detect users' online status before MAC address migration.
Authentication profile	Name		Name of an NAC authentication profile.

Security Group

Context

A security group is a set of communication objects on the network. Users can be authorized to join specific security groups based on 5W1H conditions. Alternatively, the administrator can specify user IP addresses in security groups. Security groups are authorized to users through Huawei proprietary RADIUS attributes (26-160).

Only V600 firewalls support this function.

Procedure

Choose Plan > Provision > Device Configuration > Single Device Configuration from the main menu.
Select the device to be configured and choose User Access and Authentication > Security Group from the navigation pane.
Click Create and set the security group name.
Click OK.

Parameter Description

Table 2-564 Parameters for configuring a security group

Parameter	Description
Name	Name of a security group.

User Context Profile

Context

To simplify the authentication server configuration, administrators can add users requiring the same network access rights to the same user context profile based on the user context, and configure network access rights for the users based on the user context profile. When a user goes online after the user context identification function is enabled, the device can identify the user context information and add the user to the corresponding user context profile based on the identification result.

If a user is authenticated successfully, the authentication server can assign the user with network access rights based on the user context reported by the device.
If a user fails the authentication, the device assigns the user with network access rights in each phase before successful user authentication based on the context profile.

For example, VLANs are used to divide a network into different areas with various security levels. Administrators require that a user obtain different network access rights when the user connects to the network from different areas. In this case, enable the user context identification function on access devices, and add a group of VLANs that belong to the same area to the same user context profile. Administrators then assign corresponding network access rights to different user context profiles based on the security levels of areas. When a user connects to the network from different areas, the user is added to different user context profiles matching their access VLANs and therefore obtains different network access rights.

Only V600 LSWs running support this function.

Prerequisites

The AAA authentication mode has been set to none authentication.
An AAA domain has been configured and delivered.

Procedure

Choose Plan > Provision > Device Configuration > Single Device Configuration from the main menu.
Select the device to be configured and choose User Access and Authentication > Access context profile from the navigation pane.
Click the Access Context Profile tab, click Create in the upper right corner, configure global attributes and a VLAN list, and click OK.
Click the Access Author Policy tab, click Create in the upper right corner, configure global attributes and an authentication domain list, and click OK.
Perform global configuration.
1. Click Global > Access Context, and set Access ContextData Source to Open or Close as needed.
2. Click the Access Author tab, select the policy created on the Access Author Policy tab page, and click OK.

The priority of user authorization based on a user context profile is higher than that of user authorization using an authentication template.
During 802.1X authentication, if the client does not respond, even if it matches a user context profile, 802.1X authentication cannot be triggered. In this case, the user context profile does not take effect.

Parameter Description

Table 2-565 Parameter description

Parameter			Description
Access Context Profile	Global	Name	Name of a user context profile.
Access Context Profile	VlanList	Vlan	VLANs where the profile takes effect.
Access Author Policy	Global	Name	Name of a user authentication event authorization policy.
	Match Access Domain	Access Context Profile	Select the profile created on the Access Context Profile tab page.
		Access Domain	Domain to which the template is to be applied.
		Force Domain Enable	Select Open or Close. If Open is selected, the user context profile takes effect preferentially. If Close is selected, the user context profile has a low priority.
Global	Access Context	Access ContextData Source	Select Open or Close.
Global	Access Author	Access AuthorData Source	Select the policy created on the Access Author Policy tab page.

AAA

Context

Currently, in the fabric scenario, iMaster NCE-Campus supports policy association on V300 devices, but does not support this function on V600 devices. You can set the AAA authentication mode to none authentication to implement policy association.

Only V600 LSWs running support this function.

Procedure

Choose Plan > Provision > Device Configuration > Single Device Configuration from the main menu.
Select the device to be configured and choose User Access and Authentication > AAA from the navigation pane.
Click the Authentication Scheme tab, click Create in the upper right corner, configure the global attributes and authentication mode list, and click OK.
Click the Domain tab, click Create in the upper right corner, configure global attributes, and click OK.

Parameter Description

Table 2-566 Parameter description

Parameter			Description
Authentication Scheme	Global	Authen Scheme Name	Name of an AAA authentication scheme.
Authentication Scheme	Authen ModeList	Authen Mode	The default value is none. Set the authentication mode to none authentication.
Domain	Global	Name	Name of a domain.
Domain	Global	Authen Scheme Name	Select the authentication scheme created on the Authentication Scheme tab page.

Security

Configuring IPsec

Context

Internet Protocol Security (IPsec) is a suite of protocols and services that provide security for IP networks. You can configure IPsec for a single device. Devices will set up an IPsec tunnel between each other after the controller delivers IPsec configuration to them.

Only ARs and firewalls running V600 support this function.

Prerequisites

A device has been added to the controller.

Procedure

Choose Plan > Provision > Device Configuration > Single Device Configuration from the main menu.
Select the device to be configured and choose Security Configuration > IPSec from the navigation pane.
Click the Global config tab and set time-based and traffic-based hard lifetimes.
(Optional) Click the DPD tab, configure dead peer detection (DPD) to detect the aliveness of IPsec peers, and set the DPD idle timeout period, DPD packet retransmission interval, and maximum number of DPD packet retransmissions.
Click the IPsec proposal tab and create an IPsec proposal.
Click the IKE proposal tab and create an Internet Key Exchange (IKE) proposal.
Click the IKE peer tab, create an IKE peer, and bind the created IKE proposal to this peer.
Click the Policy tab, create an IPsec policy, and bind the created IPsec proposal and IKE peer to this policy.
Choose More > IPsec connection, select a tunnel interface for which IPsec is configured, and bind the IPsec policy to this interface.

Parameter Description

Table 2-567 Parameters for configuring IPsec

Parameter			Description
DPD	Type		DPD mode to be configured on the local end to detect the aliveness of its IPsec peer. The local end sends DPD packets to detect the aliveness of the peer end when the local end does not receive any IPsec packet from the peer end within a given period of time. periodic: configures periodic DPD. If the local end does not receive any IPsec or DPD request packet from the peer end before the DPD idle timeout period expires, the local end sends DPD request packets to the peer end. on-demand: configures on-demand DPD. If the local end needs to send an IPsec packet to the peer end and does not receive any IPsec packet from the peer end before the DPD idle timeout period expires, the local end sends DPD request packets to the peer end. none: disables DPD. After sending DPD request packets to the peer end, the local end retransmits DPD request packets to the peer end if it does not receive any DPD response packet from the peer end within the retransmission interval. If the local end still does not receive any DPD response packet within the retransmission interval after having made the maximum number of retransmission attempts, the local end considers that the peer end is offline and deletes the IKE security association (SA) and IPsec SA established with the peer end.
	Interval(s)		DPD idle timeout period.
	Retransmission interval (s)		DPD packet retransmission interval.
	Retry limit		Maximum number of DPD packet retransmissions.
Global configuration	SA duration by traffic(kB)		Traffic-based IPsec SA hard lifetime. The value is an integer ranging from 256 to 200000000. The default value is 5242880.
	SA duration by time(s)		Time-based IPsec SA hard lifetime. The value is an integer ranging from 30 to 604800. The default value is 3600.
	DPD	Type	DPD mode to be configured on the local end to detect the aliveness of its IPsec peer. The local end sends DPD packets to detect the aliveness of the peer end when the local end does not receive any IPsec packet from the peer end within a given period of time. periodic: configures periodic DPD. If the local end does not receive any IPsec or DPD request packet from the peer end before the DPD idle timeout period expires, the local end sends DPD request packets to the peer end. on-demand: configures on-demand DPD. If the local end needs to send an IPsec packet to the peer end and does not receive any IPsec packet from the peer end before the DPD idle timeout period expires, the local end sends DPD request packets to the peer end. none: disables DPD. After sending DPD request packets to the peer end, the local end retransmits DPD request packets to the peer end if it does not receive any DPD response packet from the peer end within the retransmission interval. If the local end still does not receive any DPD response packet within the retransmission interval after having made the maximum number of retransmission attempts, the local end considers that the peer end is offline and deletes the IKE security association (SA) and IPsec SA established with the peer end.
		Interval(s)	DPD idle timeout period.
		Retransmission interval (s)	DPD packet retransmission interval.
		Retry limit	Maximum number of DPD packet retransmissions.
IPsec proposal	Global	Name	Name of an IPsec proposal.
		Transform protocol	Security protocol to be used in IPsec. ah: indicates that the IPsec proposal uses the Authentication Header (AH) protocol. esp: indicates that the IPsec proposal uses the Encapsulating Security Payload (ESP) protocol. ah-esp: indicates that the IPsec proposal uses the ESP and AH protocols.
		Encapsulation mode	Packet encapsulation mode to be used in IPsec. The tunnel mode is used by default. tunnel: encapsulates packets in tunnel mode. transport: encapsulates packets in transport mode. auto: encapsulates packets in auto-sensing mode. With this option selected, the device uses the tunnel mode if it serves as an IKE initiator. If the device serves as a responder, it determines whether to use the tunnel or transport mode based on the mode used by the peer end.
	Ah auth algorithm		Authentication algorithm to be used when AH or AH and ESP are used in IPsec. The options are as follows: MD5: This algorithm is insecure. You are advised to use a more secure encryption algorithm. SHA-1: This algorithm is insecure. You are advised to use a more secure encryption algorithm. SHA2-256 SHA2-384 SHA2-512 SM3
	Esp auth algorithm		Authentication algorithm to be used when ESP is used in IPsec. The options are as follows: MD5: This algorithm is insecure. You are advised to use a more secure encryption algorithm. SHA-1: This algorithm is insecure. You are advised to use a more secure encryption algorithm. SHA2-256 SHA2-384 SHA2-512 SM3
	Esp encryption algorithm		Encryption algorithm to be used when ESP is used in IPsec. The options are as follows: DES-CBC: This algorithm is insecure. You are advised to use a more secure encryption algorithm. 3DES-CBC: This algorithm is insecure. You are advised to use a more secure encryption algorithm. SM4-CBC AES-128-CBC: This algorithm is insecure. You are advised to use a more secure encryption algorithm. AES-192-CBC: This algorithm is insecure. You are advised to use a more secure encryption algorithm. AES-256-CBC: This algorithm is insecure. You are advised to use a more secure encryption algorithm. AES-128-GCM AES-192-GCM AES-256-GCM AES-128-GMAC AES-192-GMAC AES-256-GMAC
IKE proposal	Global	Proposal number	Number of the IKE proposal to be referenced. A smaller number indicates a higher priority. The value is an integer that ranges from 1 to 1025.
		Authentication method	Authentication method to be used in IKE. pre-shared-key: uses pre-shared key (PSK) authentication.
		SA lifetime (s)	Lifetime of an IPsec SA. When two devices negotiate an IPsec SA, the actual lifetime of the IPsec SA is the smaller of the two hard lifetime values configured on the two devices. The default value is 86400s.
	Encryption algorithm		Encryption algorithm to be used in IKE negotiation. DES-CBC: This algorithm is insecure. You are advised to use a more secure encryption algorithm. 3DES-CBC: This algorithm is insecure. You are advised to use a more secure encryption algorithm. SM4-CBC AES-128-CBC: This algorithm is insecure. You are advised to use a more secure encryption algorithm. AES-192-CBC: This algorithm is insecure. You are advised to use a more secure encryption algorithm. AES-256-CBC: This algorithm is insecure. You are advised to use a more secure encryption algorithm. AES-128-GCM AES-192-GCM AES-256-GCM AES-128-GMAC AES-192-GMAC AES-256-GMAC
	Negotiation algorithm (This parameter is valid only for IKEv1.)		Authentication algorithm used in IKEv1 negotiation: MD5: This algorithm is insecure. You are advised to use a more secure encryption algorithm. SHA-1: This algorithm is insecure. You are advised to use a more secure encryption algorithm. SHA2-256 SHA2-384 SHA2-512 SM3: This algorithm applies only to IKEv1-capable devices.
	Integrity algorithm		Integrity algorithm to be used in IKEv2 negotiation. HMAC-MD5-96: When used as a PRF algorithm, it is an unsafe algorithm. You are advised to use a more secure integrity algorithm. HMAC-SHA1-96: When used as a PRF algorithm, it is an unsafe algorithm. You are advised to use a more secure integrity algorithm. HMAC-SHA2-256 HMAC-SHA2-384 HMAC-SHA2-512 AES-XCBC-96 AES-XCBC-128
	PRF algorithm		Pseudorandom function (PRF) algorithm to be used in IKEv2 negotiation. HMAC-MD5-96: When used as a PRF algorithm, it is an unsafe algorithm. You are advised to use a more secure integrity algorithm. HMAC-SHA1-96: When used as a PRF algorithm, it is an unsafe algorithm. You are advised to use a more secure integrity algorithm. HMAC-SHA2-256 HMAC-SHA2-384 HMAC-SHA2-512 AES-XCBC-96 AES-XCBC-128
	DH group		Diffie-Hellman (DH) group to be used in IKE negotiation. group1: This DH group is insecure. You are advised to use a more secure DH group. group2: This DH group is insecure. You are advised to use a more secure DH group. group5: This DH group is insecure. You are advised to use a more secure DH group. group8 group15 group16 group18 group19 group20 group21 group24
IKE peer	Global	name	Name of an IKE peer.
		IKE proposal	IKE proposal to be used in IKE negotiation for an IPsec connection. Note that the IPsec proposal must be configured in advance.
		Version	IKE version to be used in IKE negotiation for an IPsec connection. This parameter is mandatory.
		Phase1 mode (This parameter is valid only for IKEv1.)	Authentication algorithm used in IKEv1 negotiation: main aggressive auto
		Authentication method	pre-shared-key: uses PSK authentication.
		pre-shared-key	PSK to be used in IKE negotiation. You need to configure the same PSK on the local and peer ends that require IKE negotiation.
		Flow vpn name	VPN instance to which an IPsec connection belongs.
	Local ID	Type	Local ID type used in IKE negotiation.
	Local ID	ID	Local ID used in IKE negotiation.
	Peer ID	Type	Peer ID type used in IKE negotiation.
	Peer ID	ID	Peer ID used in IKE negotiation.
	DPD	Type	DPD mode to be configured on the local end to detect the aliveness of its IPsec peer. The local end sends DPD packets to detect the aliveness of the peer end when the local end does not receive any IPsec packet from the peer end within a given period of time. periodic: configures periodic DPD. If the local end does not receive any IPsec or DPD request packet from the peer end before the DPD idle timeout period expires, the local end sends DPD request packets to the peer end. on-demand: configures on-demand DPD. If the local end needs to send an IPsec packet to the peer end and does not receive any IPsec packet from the peer end before the DPD idle timeout period expires, the local end sends DPD request packets to the peer end. none: disables DPD. After sending DPD request packets to the peer end, the local end retransmits DPD request packets to the peer end if it does not receive any DPD response packet from the peer end within the retransmission interval. If the local end still does not receive any DPD response packet within the retransmission interval after having made the maximum number of retransmission attempts, the local end considers that the peer end is offline and deletes the IKE security association (SA) and IPsec SA established with the peer end.
		Interval(s)	DPD idle timeout period.
		Retransmit interval	Interval for retransmitting DPD packets.
		Retry limit	Maximum number of times DPD packets are retransmitted.
	Peer Address	Peer Address	Peer IPv4/IPv6 address of an IPsec connection.
	Peer Address	VPN Name	Name of the VPN instance to be bound to the peer IP address.
Policy	Global	name	Name of an IPsec policy.
	Sub policy	Sequence number	Sequence number of an IPsec policy.
		Enable	Whether to enable an IPsec policy.
		Policy mode	Mode in which an IPsec policy is to be created. isakmp: uses the Security Association and Key Management Protocol (ISAKMP) mode. In this mode, IPsec parameters to be negotiated are defined in an ISAKMP IPsec policy, and the negotiation initiator and responder must use the same IPsec parameter settings.
		ACL	Type of the ACL to be referenced by an IPsec policy.
		ACL number	Number of the ACL to be referenced by an IPsec policy. ACL rules must be created in advance.
		SA trigger mode	Mode in which IPsec tunnel establishment is triggered. auto: indicates that IPsec tunnel establishment is triggered automatically. traffic-based: indicates that IPsec tunnel establishment is triggered by traffic.
	Local address	Address	Local address of an IPsec tunnel
	Local address	Use interface address	Whether to specify the primary address of the interface to which the IPsec policy is applied as the IP address for the local end of an IPsec tunnel.
	Generate route information	Mode	There are two IPsec route injection modes: static and dynamic. Static route injection: The automatically generated route is immediately added to the routing table of the local device, and is independent of IPsec tunnel status changes. Dynamic route injection: If the IPsec tunnel is Up, the automatically generated route is immediately added to the routing table of the local device. If the IPsec tunnel is Down, the automatically generated route is immediately removed from the routing table of the local device. In dynamic route injection, the automatically generated route is associated with the IPsec tunnel status to prevent IPsec peers from sending IPsec packets over the IPsec tunnel in Down state, reducing packet loss.
		Next hop	Next-hop address type of routes. This parameter can be set to Auto or Address.
		Auto	This parameter is configurable when Next hop is set to Auto. After this parameter is set to Open, the next-hop IP address is automatically generated.
		Address	This parameter is configurable when Next hop is set to Address. Set this parameter to a specific next-hop IP address.
		Preference	Priority of a route generated after IPsec route injection is enabled.
	Policy common attributes	IKE peer name	IKE peer referenced by the IPsec policy.
		SA duration traffic-based(kB)	Traffic-based IPsec SA hard lifetime.
		SA duration time-based(s)	Time-based IPsec SA hard lifetime.
		PFS	PFS function used for IPsec tunnel negotiation initiated by the local end. group1: indicates that the 768-bit DH group is used for negotiation. This DH group is insecure. You are advised to use a more secure DH group. group2: indicates that the 1024-bit DH group is used for negotiation. This DH group is insecure. You are advised to use a more secure DH group. group5: indicates that the 1536-bit DH group is used for negotiation. This DH group is insecure. You are advised to use a more secure DH group. group14: 2048-bit DH group is used during negotiation. group15: 3072-bit DH group is used during negotiation. group16: 4096-bit DH group is used during negotiation. group18: 8192-bit DH group is used during negotiation. group19: 256-bit Elliptic Curve Groups modulo a Prime (ECP) DH group is used during negotiation. group20: 384-bit ECP DH group is used during negotiation. group21: 521-bit ECP DH group is used during negotiation. group24: 2048-bit DH group that contains 256-bit sub-groups is used during negotiation.
		IPsec proposal name	IPsec proposal to be applied to the IPsec policy.
IPsec connection	Interface Name		Tunnel interface to which an IPsec policy is to be applied.
IPsec connection	Policy name		IPsec policy to be applied to a tunnel interface.

Configuring IPsec Intelligent Traffic Steering

Prerequisites

A device has been added.

Only firewalls running V600 support this function.

Procedure

Choose Plan > Provision > Device Configuration > Single Device Configuration from the main menu.
Select the device to be configured and choose Security Configuration > IPSec smart link from the navigation pane.
Click Smart link profile. The page for configuring intelligent traffic steering is displayed.
Configure intelligent traffic steering.
1. Click Create. The Smart link profile [Create] page is displayed.
2. Click Global and set global attributes, including Name, Enable, Link switch mode, and Max switch cycles.
3. Click LinkList and set parameters to create a link, including Id, Interface, Local address, Next hop, and Remote address.
4. Click OK.

Configuring an SSL Policy

Context

SSL uses data encryption, identity authentication, and message integrity check mechanisms to ensure security of TCP-based application layer protocols. An SSL policy can be applied to application layer protocols to provide secure connections.

Link and tunnel traffic on an SRv6 network needs to be periodically collected to control and optimize SRv6 network paths. Therefore, you need to subscribe to the gRPC protocol–based telemetry data reporting function on network devices. You also need to create an SSL policy, and associate it with gRPC for secure data transmission.

Only ARs running V600 and NE devices support this function.

Prerequisites

You need to complete the following tasks before loading a trusted CA file to an SSL policy:

Devices have been added to the controller.
You have applied for certificate files, and have uploaded the certificate files listed in the following table (including the root CA certificate, identity certificate, and private key file) to the security directory in the system directory of the device. For details, see the product documentation of the network device.

Table 2-568 Certificate and relevant files

Certificate File	Example	Description
Root CA certificate	Huawei_Root_CA.cer	There are no special requirements for the certificate file name and file name extension. The file name extension can be .pem, .crt, or .cer.
Device public key certificate	Device-cert.pem	Device identity certificates in PEM format. There are no special requirements for the certificate file name and file name extension. The file name extension can be .pem, .crt, or .cer.
Device private key certificate	Device-key.pem	There are no special requirements for the private key certificate file name and file name extension. The file name extension can be .pem or .key.
Password of the device private key certificate	Example@123	-

Procedure

Choose Plan > Provision > Device Configuration > Single Device Configuration from the main menu.
Select the device to be configured and choose Security Configuration > SSL Policy from the navigation pane.
Create an SSL policy, and configure certificates and a trust list.

Parameter Description

Table 2-569 Parameters for configuring an SSL policy

Parameter	Description
policy name	Name of an SSL policy.
cert file	Device identity certificate.
key file	Private key file.
auth code cert	Private key authentication password.
Level 1 ca file	A trusted CA file in PEM format loaded to an SSL policy.
Level 1 auth code ca	Authentication code of a trusted CA file.
Level 2 ca file	A trusted CA file in PEM format loaded to an SSL policy.
Level 2 auth code ca	Authentication code of a trusted CA file.

Configuring Access Security

Context

You can configure DHCP snooping, ARP security, and IP security on the Single Device Configuration page.

Only LSWs running V600 support this function.

Function	Description	Application Scenario
DHCP snooping	DHCP snooping is a security feature of DHCP. It ensures that DHCP clients obtain IP addresses from valid DHCP servers and records parameters such as mappings between the IP and MAC addresses of the DHCP clients. This prevents DHCP attacks on the network.	To ensure security for communication services, DHCP snooping is introduced to create a firewall between DHCP clients and servers to prevent DHCP attacks on networks.
ARP snooping	ARP snooping analyzes ARP packets to obtain information such as IP addresses and MAC addresses and create ARP snooping entries.	To obtain the IP addresses and MAC addresses of terminals in order to draw a topology, you can configure ARP snooping on the terminals.
Dynamic ARP inspection (DAI)	DAI uses DHCP snooping binding entries to prevent man-in-the-middle (MITM) attacks. When a device receives an ARP packet, it compares the source IP address, source MAC address, as well as interface and VLAN information of the ARP packet with the information in DHCP snooping binding entries. If the ARP packet matches a binding entry, the device considers the ARP packet valid and allows the packet to pass through. If the ARP packet does not match any binding entry, the device considers that an attack occurs and discards the packet.	To defend against MITM attacks, configure DAI on a device.
IP source guard (IPSG)	IPSG implements source IP address filtering based on Layer 2 interfaces. It prevents unauthorized hosts from using IP addresses of authorized hosts or specified IP addresses to access or attack networks.	To prevent IP address spoofing attacks, configure IPSG on a device to check IP packets received by an interface and discard invalid packets.

Prerequisites

A physical interface has been created.

Procedure

Choose Plan > Provision > Device Configuration > Single Device Configuration from the main menu.
Select the device to be configured and choose Security Configuration > Access Security Configuration from the navigation pane.
Click Create. The Access Security Configuration [Create] page is displayed.
Click Global and select the created interface.
Click DHCP snooping and configure DHCP snooping and the interface as a trusted interface of DHCP snooping.
Click ARP Security and configure ARP snooping and DAI. DAI is configurable only after DHCP snooping is enabled.
Click IP Security and configure IPSG. IPSG is configurable only after DHCP snooping is enabled.
Click OK.

Parameter Description

Table 2-570 Parameters on the Access Security Configuration page

Parameter		Description
Access Security Configuration	Interface name	Interface for which access security is to be configured.
DHCP snooping	DHCP snooping enable	Whether to enable the DHCP snooping function on an interface. When you toggle on DHCP snooping enable, DHCP snooping is enabled globally.
DHCP snooping	DHCP snooping trusted enable	Whether to configure an interface as a trusted interface. After you configure the interfaces directly or indirectly connected to the trusted DHCP servers as the trusted interfaces, the device can obtain IP addresses only from trusted DHCP servers.
ARP security	ARP snooping enable	Whether to enable the ARP snooping function. When you toggle on ARP snooping enable, the device sends the received ARP packets to the CPU. The CPU analyzes the ARP packets to obtain the source IP address, source MAC address, VLAN ID, and inbound interface of the packets, and creates an ARP snooping entry to record user information.
ARP security	DAI enable	Whether to enable the DAI function. When you toggle on DAI enable, the device checks all ARP packets received on the interface against the binding entries.
IP Security	IPv4 check enable	Whether to enable the IPSG function for IPv4 packets. When you toggle on IPv4 check enable, the device performs IPSG checks on all packets received by the interface.

Configuring Port Security

Context

Port security converts the dynamic MAC addresses learned on a port into secure MAC addresses. You can configure port security on a device to prevent unauthorized users from launching attacks using the MAC address of a port on the device.

Only LSWs running V600 support this function.

Prerequisites

A Layer 2 port has been created.

Procedure

Choose Plan > Provision > Device Configuration > Single Device Configuration from the main menu.
Select the device to be configured and choose Security Configuration > Port Security from the navigation pane.
Click Create. The Port Security [Create] page is displayed. Click Global and configure port security.
1. Interface name: Layer 2 port that has been created.
2. Port security enable: whether to enable port security.
3. Maximum: maximum number of MAC addresses that a port can learn.
4. Sticky MAC: whether to enable the sticky MAC function. The function is configurable only when Port security enable is enabled.
Click OK.

Parameter Description

Table 2-571 Parameters on the Port Security page

Parameter	Description
Interface name	Port for which port security is to be configured.
Port security enable	Whether to enable the port security function. When you toggle on Port security enable, the dynamic secure MAC address function takes effect. Then, dynamic MAC address entries that have been learned on a port are deleted, and MAC address entries learned subsequently are converted into dynamic secure MAC address entries.
Maximum	Maximum number of MAC addresses that a port can learn.
Sticky MAC	Whether to enable the sticky MAC function. When you toggle on Sticky MAC, both existing dynamic secure MAC address entries and MAC address entries learned subsequently on the port are converted into sticky MAC address entries.

Configuring Storm Control

Context

Storm control prevents broadcast storms caused by broadcast packets, unknown multicast packets, and unknown unicast packets.

Only LSWs running V600 support this function.

Prerequisites

A Layer 2 interface has been created.

Procedure

Choose Plan > Provision > Device Configuration > Single Device Configuration from the main menu.
Select the device to be configured and choose Security Configuration > Storm Control from the navigation pane.
Click Create. The Storm Control [Create] page is displayed. Click Global and configure storm control.
1. Interface name: Layer 2 interface that has been created.
2. Storm control enable: whether to enable the storm control function.
3. Rate type: measurement unit of the upper and lower thresholds.
4. Min rate and Max rate: upper and lower thresholds for broadcast packets, unknown multicast packets, or unknown unicast packets on an interface.
5. Action: storm control action.
6. Log: whether to record logs during storm control.
7. Trap: whether to report traps during storm control.
8. Interval(s): interval for detecting storms.
Click OK.

Parameter Description

Table 2-572 Parameters on the Storm Control page

Parameter	Description
Interface name	Layer 2 interface for which storm control is to be configured.
Storm control enable	Whether to enable the storm control function.
Rate type	Measurement unit of the upper and lower thresholds. cir: kbit/s packet: pps percent: percentage of the interface bandwidth occupied by packets
Min rate	Upper and lower thresholds for broadcast, unknown multicast, and unknown unicast packets on an interface. In a detection interval, a device monitors the average rate of incoming packets on an interface and compares the average rate with the upper and lower thresholds. If the average rate is greater than the upper threshold, the device performs storm control on the interface by taking the configured storm control action; if the average rate falls below the lower threshold, the interface cancels the storm control action.
Max rate
Action	Storm control action. The value can be error-down, Block, or Suppress. error-down: When the average rate of incoming packets on an interface exceeds the configured upper threshold, the interface will be disabled. To enable the interface again, you need to manually unblock the interface or enable the interface to automatically revert to the up state. Block: When the average rate of incoming packets on an interface exceeds the configured upper threshold, the interface is blocked and cannot forward packets. When the average rate of packets received on a blocked interface falls below the lower threshold, the interface starts forwarding packets again. Suppress: When the average rate of incoming packets on an interface exceeds the configured upper threshold, the system discards the excess traffic until the average rate of packets falls below the threshold.
Log	Whether to record logs during storm control.
Trap	Whether to report traps during storm control.
Interval(s)	Interval for detecting storms.

Configuring Host Security

Context

Local attack defense is a central processing unit (CPU) protection mechanism designed to ensure that the CPU can properly process normal services. In addition to numerous normal service packets, the CPU of a device on a network may also receive large numbers of attack packets.

If the CPU receives a large number of normal service packets, its usage surges. This severely impacts device performance, ultimately disrupting services.

If the CPU is congested with malicious attack packets, normal services will be interrupted, and in some cases even the entire system will crash.

To solve these issues, the local attack defense function is introduced. With this function enabled, the CPU can run properly even when receiving a large number of normal service packets or attack packets, ensuring normal service running.

Only LSWs running V600 support this function.

Procedure

Choose Plan > Provision > Device Configuration > Single Device Configuration from the main menu.
Select the device to be configured and choose Security Configuration > Host Security from the navigation pane.
Click Create, set the name of an attack defense policy, filter, and mode in which the attack defense policy is applied.
Click OK.

Parameter Description

Table 2-573 Parameters for configuring an attack defense policy

Parameter		Description
Global	Name	Name of an attack defense policy. The value is a string of 1 to 31 characters.
Filter	Filter id	ID of a filter. The value is an integer from 1 to 8.
	Acl type	Type of an ACL. Only IPv4 ACLs are supported.
	IPV4 ACL	ACL used to filter packets. You need to create an IPv4 ACL policy in advance.
Applied policy	Applied type	Mode in which an attack defense policy is applied. The value can be all, mcu, or slot.
Applied policy	Slot	Slot ID of the interface card where an attack defense policy is to be applied. The value is an integer from 1 to 31.

Configuring a Security Zone

Context

A security zone is a logical entity to which one or more physical or logical interfaces are bound. The networks connected to the interfaces in the same security zone have the same security attributes. You can add interfaces on a device to different security zones so that the networks connected to the interfaces are assigned different security levels.

Only firewalls running V600 support this function.

Procedure

Choose Plan > Provision > Device Configuration > Single Device Configuration from the main menu.
Select the device to be configured and choose Security Configuration > Security Zone from the navigation pane.
Click Create. On the Global tab page, set basic parameters for the security zone.
Click the Interface security zone tab and specify the security zone to which interfaces are to be added.
Click OK.

Parameter Description

Table 2-574 Parameters for configuring a security zone

Parameter		Description
Global	Name	Name of a security zone.
	zone-instance-id	ID of a security zone.
	Description	Description of a security zone.
	Priority	Priority of a security zone. A larger value indicates a higher priority.
Interface security zone	Interface security zone	Security zone to which interfaces are to be added.

Traffic Management

Configuring a Bandwidth Profile

Context

Bandwidth management enables a device to manage and control traffic based on the inbound interface/source security zone, outbound interface/destination security zone, source address, destination address, service, application, time range, and DSCP priority of packets. Bandwidth management is used to improve bandwidth efficiency and prevent bandwidth exhaustion by providing functions such as bandwidth limit, bandwidth guarantee, limit on the maximum number of connections.

Maximum bandwidth: A limit is set for the amount of bandwidth that non-critical services are allowed to use to prevent these services from consuming large amounts of bandwidth and affecting other services.
Bandwidth guarantee: When a link is busy, sufficient bandwidth is still available for critical services transmitted over the link.

Only firewalls running V600 support this function.

Procedure

Choose Plan > Provision > Device Configuration > Single Device Configuration from the main menu.
Select the device to be configured and choose Traffic Management Configuration > Bandwidth Profile from the navigation pane.
Click Create, set the file name and priority of a bandwidth profile, and upstream and downstream traffic of the maximum bandwidth and guaranteed bandwidth.
Click OK.

Parameter Description

Table 2-575 Parameters for configuring a bandwidth profile

Parameter			Description
Global	Name		Name of a bandwidth profile file.
Global	DSCP priority		DSCP priority of a bandwidth profile.
Maximum Bandwidth	Whole Maximum Bandwidth	Upstream Bandwidth(kbit/s)	Upstream traffic of the overall maximum bandwidth in a bandwidth profile.
	Whole Maximum Bandwidth	Downstream Bandwidth(kbit/s)	Downstream traffic of the overall maximum bandwidth in a bandwidth profile.
	Maximum Bandwidth Per IP	Upstream Bandwidth(kbit/s)	Upstream traffic of the maximum bandwidth for each IP address in a bandwidth profile.
	Maximum Bandwidth Per IP	Downstream Bandwidth(kbit/s)	Downstream traffic of the maximum bandwidth for each IP address in a bandwidth profile.
Guaranteed Bandwidth	Whole Guaranteed Bandwidth	Upstream Bandwidth(kbit/s)	Upstream traffic of the overall guaranteed bandwidth in a bandwidth profile.
	Whole Guaranteed Bandwidth	Downstream Bandwidth(kbit/s)	Downstream traffic of the overall guaranteed bandwidth in a bandwidth profile.
	Guaranteed Bandwidth Per IP	Upstream Bandwidth(kbit/s)	Upstream traffic of the guaranteed bandwidth for each IP address in a bandwidth profile.
	Guaranteed Bandwidth Per IP	Downstream Bandwidth(kbit/s)	Downstream traffic of the guaranteed bandwidth for each IP address in a bandwidth profile.

Configuring a Bandwidth Policy

Context

A bandwidth policy references a bandwidth profile. All traffic that matches a specified bandwidth policy can only use bandwidth resources defined by this bandwidth profile. A bandwidth policy contains a set of rules, each consisting of conditions and actions.

Only firewalls running V600 support this function.

Procedure

Choose Plan > Provision > Device Configuration > Single Device Configuration from the main menu.
Select the device to be configured and choose Traffic Management Configuration > Bandwidth Policy from the navigation pane.
Click Create and set the bandwidth policy name and other related parameters.
Click the Source/Destination Security Zone tab and specify the source/destination security zone of the bandwidth policy rule.
Click the Source/Destination Address tab and specify the source/destination address of the bandwidth policy rule.
Click the Protocol and Port tab and specify the protocol to be referenced in the bandwidth policy.
Click the Security Group tab and specify the security group to be referenced.
Click the DSCP Priority tab and specify the DSCP priority of the bandwidth policy rule.
Click the Action tab and configure actions of the bandwidth policy rule.
Click OK.

Parameter Description

Table 2-576 Parameters for configuring a bandwidth policy

Parameter			Description
Global	Name		Name of a bandwidth policy.
	Description		Description of a bandwidth policy rule.
	Ingress Type		Inbound interface of a bandwidth policy rule.
	Egress Type		Outbound interface of a bandwidth policy rule.
Source/Destination Security Zone	Source/Destination Security Zone		Source/Destination security zone of a bandwidth policy rule.
Source/Destination Address	Source/Destination IPv4 Address	IP	Source/Destination IP address of a bandwidth policy rule.
	Source/Destination IPv4 Address	Mask	Mask of the source/destination IP address of a bandwidth policy rule.
	Source/Destination IPv4 Address Range	Start IP	Source/Destination start IP address of a bandwidth policy rule.
	Source/Destination IPv4 Address Range	End IP	Source/Destination end IP address of a bandwidth policy rule.
Protocol and Port	Protocol		Protocol to be referenced in a bandwidth policy. The value can be icmp, tcp, udp, icmpv6, or sctp.
	Source Port		Source port number.
	Destination Port		Destination port number.
Security Group	Security Group		Security group to be referenced.
DSCP Priority	DSCP Priority		DSCP priority of a bandwidth policy rule.
Action	Action Type		Action of a bandwidth policy rule. The value can be Bandwidth Profile or No Qos.
	Bandwidth Profile		Bandwidth profile to be referenced.
	No Qos		Whether bandwidth management is performed on the traffic that matches the bandwidth policy rule. Open: Bandwidth management is disabled for the traffic that matches the bandwidth policy rule. Close: Bandwidth management is enabled for the traffic that matches the bandwidth policy rule.

System Monitoring

Configuring gRPC

Context

Google Remote Procedure Call (gRPC) is a high-performance open-source RPC software framework based on the HTTP/2 transport layer protocol. It provides an application programming interface (API) design method for managing and configuring network devices. gRPC provides multiple programming languages, such as C, Java, Golang, and Python. gRPC can be used together with telemetry as a data transmission protocol to accurately monitor the running status of network devices in real time and at a high speed. In addition, gRPC provides the configuration, query, and capability obtaining methods for device management, which are used by devices interconnected with the controller for collecting device data.

As shown in Figure 2-167, gRPC uses the client/server model. The network device functions as a gRPC client and the controller functions as a gRPC server. The following describes the gRPC interaction process:

A gRPC-enabled device functions as a gRPC client, and the controller functions as a gRPC server.
The device constructs the data format (GPB/JSON) based on the application service (such as customized events based on a telemetry subscription) and compiles a .proto file through ProtoBuf (Protocol Buffers). The device then establishes a gRPC channel with the controller and sends a request message to the controller through gRPC.
After receiving the request message, the controller uses ProtoBuf to parse the .proto file and restores the predefined data structure for service processing.
After processing the data, the controller needs to use ProtoBuf to recompile the response data and sends a response message to the device through gRPC.
After receiving the response message, the device ends the gRPC interaction.

Simply speaking, the device proactively establishes a gRPC connection with the controller to push the subscribed data configured on the device to the controller. In the entire gRPC interaction process, the device and controller need to use ProtoBuf to define the .proto file.

Figure 2-167 gRPC interaction process

When the controller uses the telemetry subscription function to collect link and tunnel traffic on an SRv6 network, you need to enable the gRPC function on network devices.

Only ARs and firewalls running V600 and NE devices support this function.

Prerequisites

A device has been added.
An SSL policy has been configured according to Configuring an SSL Policy.

Procedure

Choose Plan > Provision > Device Configuration > Single Device Configuration from the main menu.
Select the device to be configured and choose System Monitor > GRPC from the navigation pane.
On the Grpc client tab page, enter the name of the SSL policy to be bound for the gRPC service.

Parameter Description

Table 2-577 Parameters for configuring gRPC

Parameter	Description
SSL Policy Name	Name of an SSL policy bound to the gRPC service.

Configuring Telemetry

Context

Telemetry is a technology that remotely collects data from physical or virtual devices at a high speed. Devices periodically send interface traffic statistics, CPU usage, and memory usage to the controller in push mode.

Only ARs and firewalls running V600 and NE devices support this function.

As shown in Figure 2-168, iMaster NCE-Campus can subscribe to the data of a specified module on the device after establishing a gRPC connection with a network device.

Figure 2-168 gRPC-based telemetry technology

Prerequisites

A device has been added.
An SSL policy has been created on the device, and certificates and a trust list have been configured according to Configuring an SSL Policy.
The gRPC function has been enabled on the device according to Configuring gRPC.

Procedure

Choose Plan > Provision > Device Configuration > Single Device Configuration from the main menu.
Select the device to be configured and choose System Monitor > Telemetry from the navigation pane.
On the Destination Group tab page, configure a telemetry destination group to which sampled data is sent.
On the Sensor Group tab page, set a sampling path and sampling path depth.
On the Subscription tab page, set parameters such as the telemetry sampling interval, transport protocol, packet encoding format, and source IP address.

After the telemetry function is enabled during agile WAN configuration, telemetry subscription is automatically delivered. You can use this function to configure or modify the related source address and source port under the existing telemetry subscription.

Parameter Description

Table 2-578 Parameters for configuring telemetry

Parameter			Description
Destination Group	Global		Name of a destination group to which sampled data is sent.
	Destination	IP	Destination IP address of a telemetry flow. If the controller is iMaster NCE-Campus, set this parameter to the southbound IP address of iMaster NCE-Campus.
		Port	Destination protocol (UDP or TCP) port number of a telemetry flow. If the controller is iMaster NCE-Campus and both the controller and network devices use Huawei default certificates, the port number is 10034. If the controller and network devices use non-Huawei default certificates, the port number is 10035.
		Vpn	VPN instance for matching telemetry flows.
Sensor Group	Global		Name of a sensor group.
	Sensor	Path	Telemetry sampling path.
	Sensor	Depth	Depth of the telemetry sampling path.
Subscription	Global	Name	Subscription name.
		sampling cycle	Sampling interval. Number of milliseconds between telemetry data source sampling by devices. For example, if the parameter is set to 100, the local device needs to collect telemetry data every 100 ms. Delay or jitter may occur during data transmission, but sampling must be performed at the specified interval. The timestamp must reflect the actual time during data sampling, instead of simply adding the last sampling timestamp to the sampling interval. If the parameter is set to 0, the telemetry sensor triggers sampling based on events. The sensor must send the sampled data when the underlying data source changes.
		Protocol	Protocol and encryption mode for the target collector associated with this subscription.
		Encoding	Encoding format for the packets to be sent.
		Local Source Address	Source IPv4/IPv6 address to be listened after gRPC configuration.
		Sensor Group	Select a configured sensor group.
		Destination Group	Select a configured destination group.

Real-time Monitoring Period

Context

After network services are provisioned, the controller monitors interface traffic and link quality at a regular interval to learn about the network status and quality in a timely manner.

Only ARs running V600 support this function.

Prerequisites

Devices have been managed by the controller.

Procedure

Choose Plan > Provision > Device Configuration > Single Device Configuration from the main menu.
Select the device to configure and choose System Monitor > Real time monitoring Interval from the navigation pane.
Click Create. In the Real time monitoring interval window, set global attributes for real-time monitoring.
Set Interface name to specify the interface where traffic is to be monitored in real time.

Set Statistic interval to specify the interval for collecting traffic statistics on the monitored interface.

Parameter Description

Table 2-579 Real-time monitoring parameters

Parameter

Description

Global

Interface name

Interface where traffic is to be monitored.

Statistical interval

Interval for collecting traffic statistics on the monitored interface.

Configuring NetStream

Context

You can configure ARs on iMaster NCE-Campus and deliver the NetStream interface configuration and global configuration to the ARs.

NetStream is a technology used to collect traffic information on networks. It collects traffic statistics based on the volume and resource consumption and helps users implement QoS management and accounting on various services.

A NetStream system consists of the NetStream Data Exporter (NDE), NetStream Collector (NSC), and NetStream Data Analyzer (NDA).

Figure 2-169 NetStream system

NDE: analyzes and processes service flows, extracts the flows that meet the conditions for statistics collection, and exports the statistics to the NSC. The NDE can process the statistics (such as aggregating statistics) before exporting them to the NSC.
NSC: stores the packets received from the NDE and saves statistics to its database for the NDA to analyze. The NSC can collect data exported from multiple NDEs for further processing.
NDA: a traffic analysis tool that extracts statistics from the NSC, processes the statistics, and generates a report. This report provides a basis for diverse applications such as accounting, network management, and network optimization. The NDA provides a graphical user interface (GUI) for users to easily obtain and analyze collected data.

In practice, the NDE is a network device enabled with NetStream, and the NSC and NDA are typically integrated into the same NetStream server. iMaster NCE-CampusInsight functions as the NDA.

Original flow statistics export

In this mode, statistics about each flow are exported to the NSC when the flow aging time expires, enabling the NSC to obtain details about each flow.

Flexible flow statistics export

In this mode, the NDE creates flexible flows based on a customized template, and exports flow statistics to the NSC. This mode allows you to collect flow statistics based on the protocol type, ToS, source IP address, destination IP address, source port number, destination port number, source MAC address, destination MAC address, Ethernet type, VLAN, and flow label. Compared with original flow statistics export, flexible flow statistics export consumes fewer system resources, and allows you to collect NetStream flow statistics more flexibly.

Only ARs running V600 support this function.

Prerequisites

Devices have been managed by the controller.

Procedure

Choose Plan > Provision > Device Configuration > Single Device Configuration from the main menu.
Choose System Monitor > NetStream Policy from the navigation pane and set global NetStream parameters for a device.
1. Click the Flow Instance tab and click Create.
  1. Set global parameters for a flow instance.
  2. Configure a destination address and a destination UDP port number of the exported packets carrying flow statistics.
2. Click the Flex Flow Record tab and click Create to create an IPv4 flexible flow statistics template.
3. Click the Tm-after tab to enable or disable the tm-after function.
Choose System Monitor > NetStream Apply from the navigation pane and set NetStream parameters for an interface.
1. Enter an interface name.
2. Click the NetStream tab.
  1. Select a traffic type.
  2. Configure NetStream to sample incoming and outgoing IPv4 flows on the interface in a specified sampling mode and at a specified sampling ratio.
  3. Enable the NetStream function for sampling incoming and outgoing IPv4 flows on the interface.
  4. Create an IPv4 flexible flow statistics template.

Parameter Description

Table 2-580 Parameters on the NetStream Policy page

Parameter				Description
NetStream Policy	Flow instance	Global	Flow type	Flow type. Currently, only ip-flow is supported.
			Source IPv4 address	Source IPv4 address of the exported packets carrying IPv4 flow statistics.
			Export version	Version of the exported packets carrying IPv4 flow statistics. The NDE exports NetStream flow statistics to the NSC. In order for the NSC to parse the exported packets, the version of exported packets carrying these statistics must be the same as that configured on the NSC. The exported packets in V5 have fixed format and are difficult to expand. In contrast, the format of exported packets in V9 is defined in templates and is easy to expand. The statistics can be exported flexibly in such packets. Due to its advantages of being template-based and highly extendable, V9 is supported by most NSCs. As such, you are advised to set the version of exported packets to V9. NOTICE: When the exported packets carry a 32-bit or an empty interface index, the export version cannot be changed from V9 to V5.
			Template timeout rate	Template refresh interval. The value ranges from 1 to 3600, in minutes. The default value is 1 minute.
			TCP session timeout	The FIN or RST flag in a TCP packet indicates that the TCP connection is terminated. When receiving a packet with the FIN or RST flag, the device immediately ages out the corresponding NetStream flow. This mechanism saves memory space. true: enables the TCP session timeout flag. false: disables the TCP session timeout flag.
			Active timeout	Active aging time for NetStream original and flexible flows. Network traffic may burst intermittently and a large number of flows are generated in a short period of time. However, the memory capacity of the NDE is limited. Old flow entries in the memory need to be deleted to release memory space for new flow entries. The process of deleting old flow entries is called aging. Because the storage space of the NDE is also limited, all analyzed flows must be aged out and exported to the NSC for further processing. When the active time (from the flow creation time to the current time) of an original flow or a flexible flow exceeds the configured active aging time, the flow is exported to the specified destination.
			Inactive timeout	Inactive aging time of original flows and flexible flows. Network traffic may burst intermittently and a large number of flows are generated in a short period of time. However, the memory capacity of the NDE is limited. Old flow entries in the memory need to be deleted to release memory space for new flow entries. The process of deleting old flow entries is called aging. Because the storage space of the NDE is also limited, all analyzed flows must be aged out and exported to the NSC for further processing. When the inactive time (from the last packet receiving time to the current time) of an original flow or a flexible flow exceeds the configured inactive aging time, the flow is exported to the specified destination.
			Index switch	Number of bits of the interface index carried in the exported packets carrying flow statistics. This parameter needs to be set according to the type of the interface index that can be parsed by the NMS. For example, if the NMS can parse 32-bit interface indexes, configure the length of the interface indexes contained in exported NetStream packets to 32-bit. The value is an enumerated value and is case sensitive. The options include: 16 32 The default value is 32.
		Export host	Address	Destination information of the exported packets carrying flow statistics.
			Port	Destination UDP port number of the exported packets carrying flow statistics. NOTE: When iMaster NCE-Campus interconnects with iMaster NCE-CampusInsight, the destination port must be set to 30002.
			VPN name	VPN instance name of the exported packets carrying flow statistics.
			DSCP value	DSCP priority of the exported packets carrying flow statistics.
	Flex flow record	Global	Flow type	Flow type. Currently, only ip-flow is supported.
			Record name	Name of an IPv4 flexible flow statistics template.
			Protocol	Whether the protocol is included in the exported flexible flow statistics. The value can be true or false.
			Tos	Whether the type of service (ToS) is included in the exported flexible flow statistics. The value can be true or false.
			Source address	Whether the source address is included in the exported flexible flow statistics. The value can be true or false.
			Destination address	Whether the destination address is included in the exported flexible flow statistics. The value can be true or false.
			Source port	Whether the source port is included in the exported flexible flow statistics. The value can be true or false.
			Destination port	Whether the destination port is included in the exported flexible flow statistics. The value can be true or false.
			Bytes value	Whether the number of bytes is included in the exported flexible flow statistics. The value can be true or false.
			Packets value	Whether the number of packets is included in the exported flexible flow statistics. The value can be true or false.
			Input interface	Whether the inbound interface index is included in the exported flexible flow statistics. The value can be true or false.
			Output interface	Whether the outbound interface index is included in the exported flexible flow statistics. The value can be true or false.
			Sdwan connection	Whether tunnel information is included in the exported flexible flow statistics. The value can be true or false. NOTE: In SD-WAN scenarios with the GRE tunnel mode, Tunnel information must be set to true.
			Application name	Whether application information is included in the exported flexible flow statistics. The value can be true or false.
	Tm-after	Enable		true: enables NetStream sampling before and after queue scheduling. false: disables NetStream sampling before and after queue scheduling.

Table 2-581 Parameters on the NetStream Apply page

Parameter				Description
NetStream Apply	Interface	Interface name		Name of the device interface to be configured. The following interface types are supported: GE interface, for example, GE0/0/1 GE sub-interface, for example, GE0/0/1.10 10GE interface, for example, 10GE0/0/1 10GE sub-interface, for example, 10GE0/0/1.10 Tunnel interface, for example, Tunnel601 NOTE: In SD-WAN scenarios with the GRE tunnel mode, only tunnel interfaces can be configured. Eth-Trunk interface, for example, Eth-Trunk10 VLANIF interface, for example, Vlanif10
	netstream	Flow type		Flow type. Currently, only ip-flow is supported.
		Sampler rate list	Direction	inbound: samples incoming traffic on an interface. outbound: samples outgoing traffic on an interface.
			Sampler type	Type of data packets to be sampled by NetStream. The value can be fix-packets.
			Fix packets value	Number of packets between two sampled packets in packet-based random sampling mode. If NetStream is enabled on an interface, the system records NetStream-related information in a specific interface information table. If each packet on an interface is collected and counted, forwarding performance of the interface (especially high-speed interfaces) greatly deteriorates. To learn about the traffic characteristics of an interface and at the same time minimize the impact of packet statistics collection on interface forwarding performance, enable NetStream sampling on the interface. The lower the sampling ratio, the less the impact on the device performance. The NetStream sampling ratio must be a power of 2.
		Sampler enable list	Sampling enable direction	inbound: samples incoming traffic on an interface. outbound: samples outgoing traffic on an interface.
		Flexflow record list	Record name	Name of an existing IPv4 flexible flow statistics template.

Configuring IFIT

iFIT Common

Context

In-situ Flow Information Telemetry (IFIT) is an in-band Operations, Administration, and Maintenance (OAM) measurement technology that uses service packets to measure real performance indicators of an IP network, such as the packet loss rate and latency. IFIT can significantly improve the timeliness and effectiveness of network O&M, thereby promoting the development of intelligent O&M.

This section provides an example for configuring peer locator-based IFIT for end-to-end packet loss and latency measurement on an L3VPN over SRv6 network.

Only ARs running V600 and NE devices support this function.

Networking Requirements

L3VPN over SRv6 uses public SRv6 tunnels to carry L3VPN services. To meet users' higher requirements on service quality, IFIT is required on an L3VPN over SRv6 network to monitor the packet loss rate and latency of links between PEs in real time, enabling timely responses to service quality deterioration.

On the L3VPN over SRv6 network shown in Figure 2-170, service flows enter the network through PE1, traverses the P, and leaves the network through PE2.

Figure 2-170 Network diagram of IFIT performance measurement

Configuration Roadmap

Configure an EVPN L3VPNv6 over SRv6 network on each PE and the P.
- Enable IPv6 forwarding on each device and configure IPv6 addresses for involved interfaces.
- Enable IS-IS, configure an IS-IS level, and specify a network entity on each device.
- Configure an IPv6 L3VPN instance on each PE and bind it to an access-side interface.
- Establish a BGP EVPN peer relationship between the PEs.
Configure clock synchronization between devices.
Configure packet loss and latency measurement on the PEs to collect packet loss rate and latency statistics at intervals.
Configure the devices to send measurement data to the NMS through telemetry.

Prerequisites

Devices have been added to the controller.
ZTP has been performed on the devices.
NTP has been configured on the devices to implement clock synchronization between the devices. For details, see Configuring NTP.

Procedure

Choose Plan > Provision > Device Configuration > Single Device Configuration from the main menu.
Select the device to be configured and choose System Monitor > iFIT Configuration > iFIT Common from the navigation pane.
Click the Global tab and configure the IFIT node ID.
Click the WorkMode tab and configure the IFIT working mode.
Click the Static Instance tab and configure unidirectional or bidirectional flow measurement in the static IFIT instance.
Click the White List Group tab and create a whitelist group.
Click the Color bit for flow quality measurement tab and configure the color bit for IFIT measurement.

Parameter Description

Table 2-582 Parameters for configuring IFIT

Parameter					Description
Global	NodeId				ID of a node. You need to set this parameter when configuring an IFIT instance. With a node ID set on the controller, a unique network-wide flow ID is ensured, which is generated through a combination of a node ID and a node flow ID (automatically generated). The value is an integer from 1 to 1048575.
	Period Clock Mode				Timing mode for the IFIT measurement interval. By default, the NTP mode is used. NTP PTP
	NTP				Whether to use the NTP mode as the timing mode for the IFIT measurement interval.
	PTP UTC offset				UTC offset for the IFIT measurement interval. The value range is from 1 to 255.
	Leap Mode				leap59: indicates the negative leap second which is removed from the clock. leap61: indicates the positive leap second which is inserted.
	Preset Date				Date when the IFIT leap second is to be applied.
WorkMode	Mode				IFIT working mode of the node. You need to set this parameter when using IFIT to measure the packet loss rate and latency. The options are as follows: mcp: specifies the node as a Measurement Control Point (MCP). dcp: specifies the node as a Data Collecting Point (DCP).
WorkMode	ServiceType				Service to be measured through IFIT. Only the packet loss rate and latency of the specified service are measured through IFIT. srv6-segment-list: indicates the SRv6 TE Policy service.
Static instance	Global	Name			Name of an IFIT instance. You need to set this parameter when configuring an IFIT instance for static flow measurement.
		Interval(s)			Measurement interval for an IFIT instance. The measurement interval for an IFIT instance is the period between starting to count the number of packets or bytes and recording the send and receive timestamps.
		Measure Mode			Measurement mode for an IFIT instance, including end-to end and hop-by-hop measurement. End-to-end measurement is applicable to the scenarios where packet loss rate and latency on the entire network need to be measured, while hop-by-hop measurement is applicable to the scenarios where packet loss rate and latency on each network node need to be accurately obtained. e2e: indicates end-to-end measurement. trace: indicates hop-by-hop measurement. IFIT measurement results serve as a reliable reference for assessing IP network performance and therefore are useful for fault diagnosis and service statistics.
		Loss Measure Enable			Whether to enable packet loss rate measurement. This function is enabled by default. If you do not need to measure the packet loss rate of flows through IFIT, disable this function.
		Delay Measure Enable			Whether to enable latency measurement. This function is enabled by default. If you do not need to measure the latency of flows through IFIT, disable this function.
	Flow	Flow type			unidirection: indicates unidirectional static flow measurement for the IFIT instance. bidirection: indicates bidirectional static flow measurement for the IFIT instance.
		Flow filter			filter-condition1: indicates that IP flows are to be measured through IFIT. You need to set the source and destination IP addresses, protocol, and source and destination ports to specify the target flows. filter-condition2: indicates that flows in a specific VPN are to be measured through IFIT. You need to set a VPN instance and peer filter to specify the target flows.
		Ip Flow	Flow Address Type		IP protocol type. ipv4-condition: indicates that parameters of the IPv4 protocol can be configured. ipv6-condition: indicates that parameters of the IPv6 protocol can be configured.
			Protocol		Protocol type.
			Source Port		Start source port number of a target flow.
			Destination Port		Start destination port number of a target flow.
			ni-name		VPN instance of a target flow.
			Dscp		Field in the IP header of a packet, which identifies the Class of Service (CoS) and priority of the packet.
			Ipv4 Condition	Source Ip	Source IPv4 address. The value is in dotted decimal notation.
				Destination Ip	Destination IPv4 address. The value is in dotted decimal notation.
				Source Mask	Mask length for the source IPv4 address of a target flow.
				Destination Mask	Mask length for the destination IPv4 address of a target flow.
			Ipv6 Condition	Source Ipv6	Source IPv6 address.
				Destination Ipv6	Destination IPv6 address.
				Source Ipv6 Mask	Mask length for the source IPv6 address of a target flow.
				Destination Ipv6 Mask	Mask length for the destination IPv6 address of a target flow.
		Vpn Flow	Vpn Filter		After ni-condition is selected, you need to configure NETCONF instance conditions.
			Peer Filter		After locator-condition is selected, you need to configure locator conditions.
			Ni Condition	Address Type	iPv4-unicast: indicates that the next hop of a target flow is an IPv4 unicast address. iPv6-unicast: indicates that the next hop of a target flow is an IPv6 unicast address.
			Ni Condition	Peer Ni Name	Name of the NETCONF instance on the peer end.
			Locator Condition	Peer Locator Prefix	Next-hop locator prefix of a target flow. The value is a 32-bit hexadecimal integer in the format of X:X:X:X:X:X:X:X.
			Locator Condition	Peer Locator Prefix Mask Len	Mask length of the next-hop locator prefix of a target flow.
		Bind If			Interface to which the IFIT target flow is to be bound.
White List Group	Global	Name			Name of a whitelist group.
	White List Rule	Rule Name			Name of a whitelist rule.
		IP Address Type			IP address type. The value can be iPv4 or iPv6.
		Source IP			If IP Address Type is set to iPv4, set the source address to an IPv4 address. The value is in dotted decimal notation. If IP Address Type is set to iPv6, set the source address to an IPv6 address. The value is a 32-bit hexadecimal integer in the format of X:X:X:X:X:X:X:X.
		Source IP Mask			When IP Address Type is set to iPv4, Source IP Mask specifies the mask length of the source IPv4 address of the target flow. When IP Address Type is set to iPv6, Source IP Mask specifies the mask length of the source IPv6 address of the target flow.
		Destination IP			If IP Address Type is set to iPv4, set the destination address to an IPv4 address. The value is in dotted decimal notation. If IP Address Type is set to iPv6, set the destination address to an IPv6 address. The value is a 32-bit hexadecimal integer in the format of X:X:X:X:X:X:X:X.
		Destination IP Mask			When IP Address Type is set to iPv4, Destination IP Mask specifies the mask length of the destination IPv4 address of the target flow. When IP Address Type is set to iPv6, Destination IP Mask specifies the mask length of the destination IPv6 address of the target flow.
		Protocol			Protocol number.
		Source Port			Start source port number of a target flow.
		Source Port End			End source port number of a target flow.
		Destination Port			Start destination port number of a target flow.
		Destination Port End			End destination port number of a target flow.
Color bit for flow quality measurement	Color Flag				Color bit for IFIT measurement. You need to set this parameter when configuring IFIT for network performance measurement. You can select a color bit based on your requirements and network planning. ToS bit: With this option selected, you can select any bit from bits 3 to 7 in the ToS field of IP packets as the color bit for IFIT measurement. flags-bit0: With this option selected, bit 0 in the Flags field of IP packets is configured as the color bit for IFIT measurement.

Configuring IFIT Dynamic Learning

Performance measurement based on dynamic IFIT flows can be automatically triggered after IFIT is enabled globally on a device.

Context

IFIT supports automatic learning of dynamic flows on the ingress node by using the mask or exact match of the source or destination address. In addition, IFIT can flexibly monitor service quality in real time by configuring a learning whitelist. The generation of dynamic flows on transit and egress nodes is triggered by packets with the IFIT header.

Only ARs running V600 support this function.

Prerequisites

Devices have been added to the controller.
ZTP has been performed on the devices.
Static routes or dynamic routing protocols have been configured to ensure network connectivity between devices.

Procedure

Choose Plan > Provision > Device Configuration > Single Device Configuration from the main menu.
Select the device to be configured and choose System Monitor > iFIT Configuration > iFIT Learning from the navigation pane.
Click the iFIT Learning tab, create an IFIT VPN instance, and configure the measurement mode and interval for the IFIT instance.
Click the Bind Learning Interface tab and specify the ingress interface to which the IFIT instance is to be bound.

Parameter Description

Table 2-583 Parameters for configuring IFIT automatic learning of dynamic flows

Parameter		Description
IFIT dynamic learning	VN Instance Name	Name of a VPN instance. You can configure an IFIT VPN instance for dynamic flow learning.
	Interval (s)	Measurement interval for an IFIT instance. The measurement interval for an IFIT instance is the period between starting to count the number of packets or bytes and recording the send and receive timestamps.
	Measure Mode	Measurement mode for an IFIT instance, including end-to end and hop-by-hop measurement. End-to-end measurement is applicable to the scenarios where packet loss rate and latency on the entire network need to be measured, while hop-by-hop measurement is applicable to the scenarios where packet loss rate and latency on each network node need to be accurately obtained. e2e: indicates end-to-end measurement. trace: indicates hop-by-hop measurement. IFIT measurement results serve as a reliable reference for assessing IP network performance and therefore are useful for fault diagnosis and service statistics.
	iFIT Enable	If no option is selected, flow learning based on the color bit is disabled in the inbound direction. If Keep color big flag is selected, the color bits of incoming flows are retained. If Clear color big flag is selected, the color bits of incoming flows are cleared.
Binding Learning Interface	Learning Interface	Interface to which the IFIT instance is to be bound. All Interfaces: binds the instance to all interfaces. Specified Interface: binds the instance to a created interface.
Binding Learning Interface	Whitelist Group Name	Name of a whitelist group that has been created. For details, see iFIT Common.

Configuring IFIT on an Interface

Context

On a network where an IFIT-enabled AR and an iPCA 2.0-enabled switch are connected, the devices can be configured as ingress nodes for switching from IFIT measurement to iPCA 2.0 measurement or as egress nodes for switching from iPCA 2.0 measurement to IFIT measurement. The color bits for measurement are switched on these nodes to implement performance measurement in two modes.

Only ARs running V600 support this function.

Networking Requirements

On a live network, an IFIT-enabled AR may be connected to a switch that supports only iPCA 2.0. Since the packet format and color bit of iPCA measurement are different from those of IFIT measurement, the border nodes connecting IFIT and iPCA 2.0 measurement domains need to switch the color bits for measurement. On the network shown in Figure 2-171, PE1 and PE2 are the border nodes connecting IFIT and iPCA 2.0 measurement domains. After you configure color bits for IFIT and iPCA 2.0 measurement, respectively, on the border nodes, they can switch between IFIT and iPCA 2.0 measurement modes. In this case, service flow quality can be continuously monitored across measurement domains.

Figure 2-171 Networking diagram of IFIT-iPCA conversion

Prerequisites

Devices have been added to the controller.
Devices have been deployed in ZTP mode.

Procedure

Choose Plan > Provision > Device Configuration > Single Device Configuration from the main menu.
Select the device to be configured and choose System Monitor > iFIT Configuration > Interface iFIT from the navigation pane.
Click the Interface iFIT tab, click Create, and configure conversion on an interface.

Parameter Description

Table 2-584 IFIT-iPCA conversion parameters

Parameter		Description
Global	Interface name	Name of the device interface to be configured.
Global	iFIT Enable	Whether to enable IFIT-iPCA conversion on the interface.

Upgrading the Signature Database

Configuring Secure URL Filtering

Context

You can configure the controller to query URL categories used for URL filtering from a remote server and update its local URL categories accordingly. The URL filtering function takes effect after you configure URL filtering in a security policy.

URL filtering, also known as web filtering, regulates user online behaviors by controlling users' URL access requests, and permitting or denying users' access to certain web resources.

Only ARs running V600 support this function.

Prerequisites

The tenant administrator has completed the SD-WAN network deployment. Devices have been managed.
The tenant administrator has configured DNS and has not configured a VPN instance. For details, see DNS.
The tenant administrator has completed network configurations for devices. Ensure that there are reachable routes between the devices and the Huawei Security Center (isecurity.huawei.com).
The tenant administrator has configured DNS on the device, so that the device can properly resolve the domain name of the Huawei Security Center (isecurity.huawei.com).
The tenant administrator has configured a URL filtering policy. For details, see Configuring a Security Policy.

Procedure

Choose Plan > Provision > Device Configuration > Single Device Configuration from the main menu.
Choose Feature Functions > Sec Url Filter from the navigation pane to configure remote URL query for the selected device.
Click the country tab and set a country/region code for remote URL query. To use the remote URL query function, a country or region code must be specified. If no country or region code is specified or such information is inconsistent with the device's actual location, the remote URL query function will be unavailable.

Parameter Description

Table 2-585 Parameter for configuring the remote URL query function

Parameter	Description
country	Country or region code of the selected device.

Configuring Signature Database Updates

Context

As an indispensable part of the security protection system for a device, a signature database stores the behavior, virus, and application/protocol features of most identified attacks. The device analyzes passing data flows based on these features and subsequently processes traffic based on analysis results. You can use the signature database upgrade function to update the signature database files stored on the device to the latest versions.

Only ARs running V600 support this function.

Prerequisites

The tenant administrator has completed the SD-WAN network deployment. Devices have been managed.
The tenant administrator has completed the DNS configuration. For details about how to configure DNS, see DNS.
The following operations have been performed to connect the device to the update server at the Huawei Security Center. Otherwise, the device cannot upgrade its signature database in online mode.
1. Set parameters for connecting the device to the update server at the Huawei Security Center. By default, the domain name of the update server at the Huawei Security Center is https://isecurity.huawei.com/sec/web/urlClassification.do, the port used by the HTTPS protocol is 443, and the device uses the preset CA certificate for communication with the Huawei Security Center through HTTPS.
```
update server { domain domain-name | ip ip-address } [ port port-number ]
```
2. Run the ping host command to test the connectivity between the device and the update server at the Huawei Security Center. The host parameter specifies the domain name or IP address of the update server at the Huawei Security Center.
```
ping host
```

Procedure

Choose Plan > Provision > Device Configuration > Single Device Configuration from the main menu.
Choose Feature Functions > Security Signature Update from the navigation pane to configure a plan for upgrading the signature database of the selected device.
1. Click Create. On the Security Signature Update [Create] tab page that is displayed, set Security Signature Type.
2. Configure an upgrade plan. Determine whether to enable the signature database upgrade function. Set Schedule Time and a time period. The device automatically queries and downloads the latest signature database at the specified time, and updates its own signature database to the latest version.
  The recommended automatic upgrade interval varies according to the signature database type:
  - IPS signature database: once a week
  - Antivirus signature database: once a day

Parameter Description

Table 2-586 Parameters for configuring the signature database upgrade function

Parameter			Description
Security Signature Update	Global	Security Signature Type	Type of the signature database to be upgraded. intrusion-prevention: indicates the IPS signature database. antivirus: indicates the antivirus signature database.
	schedule	Enable	Whether to enable scheduled update.
		Schedule Time	Daily Hourly: at an interval of specific minutes Weekly
		Daily Time/Minute/Weekday Time	When Schedule Time is set to Daily, set the time for upgrading the database every day.
			When Schedule Time is set to Hourly, set the interval for upgrading the database, in minutes.
			When Schedule Time is set to Weekly, set the time for upgrading the database weekly.
		weekday (only when Schedule Time is set to Weekly)	Day in a week when the signature database is updated automatically.
Update Source	IP Address		IP address of the signature database to be updated.
Update Source	VPN Instance		VPN name of the signature database to be updated.

Checking the Configuration Result

Procedure

Choose Plan > Provision > Device Configuration > Single Device Configuration from the main menu.
Select a device and click the Configuration Result tab to check whether the configuration is successfully delivered to the device.
If the configuration of a feature fails to be delivered, click Repair or Re-deliver to re-configure the feature.
- If some data has been edited, a message is displayed when you click Repair, indicating that the data can be repaired only after being submitted or reset.
- If no edited data needs to be submitted, the Submit button changes to the Repair Commit button when you click Repair.
- For data to be submitted, buttons such as editing, creating, and deleting are unavailable. Data can be edited only after being submitted or reset.

Overview
Fundamentals
Precautions
GUI Overview
Single Device Configuration (AR600&6100&6200&6300&SRGSeries Devices)
Single Device Configuration (NE Devices and V600 LSWs/FWs/ARs)

Translation

Favorite

Download

Update Date：2023-05-05

Document ID：EDOC1100304337

Downloads：328

Average rating：0.0Points

Digital Signature File

digtal sigature tool