User manual 3COM LS-5100-50C-EI-OVS

[. . . ] DHCP H3C Low-End Ethernet Switches Configuration Examples Table of Contents Table of Contents Chapter 1 DHCP Functions Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-1 1. 1 Supported DHCP Functions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-1 1. 1. 1 DHCP Functions Supported by the H3C Low-End Ethernet Switches . . . . . . . . . . . . . . . . . . . 1-1 1. 2 Configuration Guide. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . [. . . ] Define an if-match clause to permit routes whose destination addresses match IP prefix list rip_import. [S300] route-policy rip_import permit node 10 [S300-route-policy] if-match ip-prefix rip_import [S300-route-policy] quit # Redistribute BGP routes into RIP and apply routing policy rip_import. [S300] rip [S300-rip] import-route bgp route-policy rip_import Configure interaction between IGP and BGP on S400. # Redistribute OSPF routes into BGP. <S400> system-view [S400] bgp 400 [S400-bgp] import-route ospf 1 [S400-bgp] quit # Define a prefix list named ospf_import and permit the routes with IP prefixes 162. 1. 1. 0/24, 162. 1. 2. 0/24, 162. 1. 3. 0/24, and 162. 1. 4. 0/24. [S400] ip ip-prefix ospf_import index 10 permit 162. 1. 1. 0 24 3-14 Routing H3C Low-End Ethernet Switches Configuration Examples Chapter 3 Comprehensive Configuration Example [S400] ip ip-prefix ospf_import index 20 permit 162. 1. 2. 0 24 [S400] ip ip-prefix ospf_import index 30 permit 162. 1. 3. 0 24 [S400] ip ip-prefix ospf_import index 40 permit 162. 1. 4. 0 24 # Create a routing policy named ospf_import with the match mode as permit. Define an if-match clause to permit the routes whose destination addresses match IP prefix list ospf_import. [S400] route-policy ospf_import permit node 10 [S400-route-policy] if-match ip-prefix ospf_import [S400-route-policy] quit # Redistribute BGP routes into OSPF and apply the routing policy named ospf_import. [S400] ospf [S400-ospf-1] import-route bgp route-policy ospf_import 3. 2. 6 Route Backup Configuration Example I. Network requirements As shown in Figure 3-8, implement route backup on S200_10. Configure a default route between S200_10 and S300_A. When the primary route cannot work, the device switches to the backup route automatically. When the primary route becomes feasible, the device switches to the primary route automatically. To achieve the route backup of S200_10, configure a static route to S200_10 on S300_A and redistribute this route into RIPv2. II. Network diagram Device S300_A S200_10 Interface Vlan-int 665 Vlan-int 665 Vlan-int 621 Vlan-int 622 IP address 166. 1. 5. 2/24 166. 1. 5. 1/24 162. 1. 1. 1/24 162. 1. 2. 1/24 AS 300 200 Figure 3-8 Network diagram for route backup 3-15 Routing H3C Low-End Ethernet Switches Configuration Examples Chapter 3 Comprehensive Configuration Example III. Configuration procedure # Configure a default route on S200_10 and specify the next-hop IP address as 166. 1. 5. 2. Set the default preference to 200. <S200_10> system-view [S200_10] ip route-static 0. 0. 0. 0 0. 0. 0. 0 166. 1. 5. 2 preference 200 # Configure a static route on S300_A and specify the destination IP addresses as 162. 1. 1. 0/24 and 162. 1. 2. 0/24. Specify the next-hop IP address as 166. 1. 5. 1 and the default preference to 200. <S300_A> system-view [S300_A] ip route-static 162. 1. 1. 0 255. 255. 255. 0 166. 1. 5. 1 preference 200 [S300_A] ip route-static 162. 1. 2. 0 255. 255. 255. 0 166. 1. 5. 1 preference 200 # Redistribute the static route into RIP. [S300_A] rip [S300_A-rip] import-route static 3. 2. 7 BGP MED Attribute Configuration Example I. Network requirements As shown in Figure 3-9, S100_1 forwards packets from S400 to S200_10. S100_2 forwards packets from S400 to S300_B. Modify the MED value to achieve this goal. 3-16 Routing H3C Low-End Ethernet Switches Configuration Examples Chapter 3 Comprehensive Configuration Example II. Network diagram AS 400 VLAN-int 663 VLAN-int 664 S400_0 VLAN-int 16 S400 OSPF VLAN-int 15 EBGP IBGP VLAN-int 31 VLAN-int 11 EBGP EBGP VLAN-int 13 EBGP VLAN-int 22 EBGP VLAN-int 23 AS 100 S100_1 S100_2 AS 200 S200 VLAN-int 12 S200_0 VLAN-int 665 VLAN-int 661 AS 300 S300 VLAN-int 14 S300_A VLAN-int 662 S200_10 VLAN-int 621 VLAN-int 622 VLAN-int 623 S300_B VLAN-int 624 OSPF RIP Device S200_10 S300_B S400_0 Interface Vlan-int 621 Vlan-int 622 Vlan-int 623 Vlan-int 624 Vlan-int 663 Vlan-int 664 IP address 162. 1. 1. 1/24 162. 1. 2. 1/24 162. 1. 3. 1/24 162. 1. 4. 1/24 166. 1. 3. 1/24 166. 1. 4. 1/24 AS 200 300 400 Figure 3-9 Network diagram for MED attribute configuration III. Configuration procedure Configure S100_1. # Define a prefix list named as200_1 and permit the route with IP prefix 162. 1. 1. 0/24. <S100_1> system-view [S100_1] ip ip-prefix as200_1 index 10 permit 162. 1. 1. 0 24 # Define a prefix list named as200_2 and permit the route with IP prefix 162. 1. 2. 0/24. [S100_1] ip ip-prefix as200_2 index 10 permit 162. 1. 2. 0 24 # Define a prefix list named as300_1 and permit the route with IP prefix 162. 1. 3. 0/24. [S100_1] ip ip-prefix as300_1 index 10 permit 162. 1. 3. 0 24 # Define a prefix list named as300_2 and permit the route with IP prefix 162. 1. 4. 0/24. [S100_1] ip ip-prefix as300_2 index 10 permit 162. 1. 4. 0 24 # Define a prefix list named other and permit all the routes. 3-17 Routing H3C Low-End Ethernet Switches Configuration Examples Chapter 3 Comprehensive Configuration Example [S100_1] ip ip-prefix other index 10 permit 0. 0. 0. 0 0 less-equal 32 # Create a routing policy named as200, and specify node 10 with the permit matching mode in the routing policy. Set the MED value of the route matching prefix list as200_1 to 100. [S100_1] route-policy as200 permit node 10 [S100_1-route-policy] if-match ip-prefix as200_1 [S100_1-route-policy] apply cost 100 [S100_1-route-policy] quit # Create node 20 with the matching mode as permit in routing policy as200. Set the MED value of the route matching prefix list as200_2 to 100 [S100_1] route-policy as200 permit node 20 [S100_1-route-policy] if-match ip-prefix as200_2 [S100_1-route-policy] apply cost 100 [S100_1-route-policy] quit # Create node 30 with the permit matching mode in routing policy as200. Set the MED value of the route matching prefix list as300_1 to 200. [S100_1] route-policy as200 permit node 30 [S100_1-route-policy] if-match ip-prefix as300_1 [S100_1-route-policy] apply cost 200 [S100_1-route-policy] quit # Create node 40 with the permit matching mode in routing policy as200. Set the MED value of the route matching prefix list as300_2 to 200. [S100_1] route-policy as200 permit node 40 [S100_1-route-policy] if-match ip-prefix as300_2 [S100_1-route-policy] apply cost 200 [S100_1-route-policy] quit # Create node 50 with the permit matching mode in routing policy as200. [. . . ] The network requirements are as follows: The hosts can be configured with IP addresses statically or obtain IP addresses through DHCP. You need to install 802. 1x client software on the hosts so that the hosts need to pass 802. 1x authentication before accessing the network. The H3C CAMS server serves as an authentication, authorization, and accounting server that provides the gateway's IP-to-MAC binding to clients to prevent gateway spoofing attacks. You need to configure 802. 1x and AAA on the access switches. 2-7 H3C Low-End Ethernet Switches Configuration Examples ARP Attack Prevention Chapter 2 Configuration Examples 2. 2. 2 Network Diagram Figure 2-3 Network diagram for ARP attack prevention in authentication mode 2. 2. 3 Configuration Considerations Install 802. 1x client software on the hosts so that the hosts need to pass 802. 1x authentications before accessing the network. [. . . ]