Part 8 - Security

17-MFF Commands

Chapters Download  (36.14 KB)

17-MFF Commands


MFF Configuration Commands

display mac-forced-forwarding interface

Syntax

display mac-forced-forwarding interface

View

Any view

Default Level

1: Monitor level

Parameters

None

Description

Use the display mac-forced-forwarding interface command to display MFF port configuration information.

Related commands: mac-forced-forwarding network-port.

Examples

# Display MFF port configuration information.

<Sysname> display mac-forced-forwarding interface

Network Port:

  GigabitEthernet1/0/1              GigabitEthernet1/0/2

User Port:

  GigabitEthernet1/0/3              GigabitEthernet1/0/4

Table 1-1 display mac-forced-forwarding interface command output description

Field

Description

Network Port

List of network ports

User Port

List of user ports

 

display mac-forced-forwarding vlan

Syntax

display mac-forced-forwarding vlan vlan-id

View

Any view

Default Level

1: Monitor level

Parameters

vlan-id: VLAN ID.

Description

Use the display mac-forced-forwarding vlan command to display the MFF configuration information of a specified VLAN.

Related commands: mac-forced-forwarding, mac-forced-forwarding server.

Examples

# Display the MFF configuration information of VLAN 1.

<Sysname> display mac-forced-forwarding vlan 1

VLAN 1

Mode: Auto/Single

Gateway:

--------------------------------------------------------------------------

192.168.1.42     (000f-e200-8046)

 

Server:

--------------------------------------------------------------------------

192.168.1.48         192.168.1.49

Table 1-2 display mac-forced-forwarding vlan command output description

Field

Description

VLAN 1

ID of the VLAN to which the gateways belong

Mode

MFF operating mode, which can be automatic (Auto), manual (Manual), and single-gateway (Single).

Gateway

IP and MAC addresses of gateways. If no information is learned, N/A is displayed.

Server

Server IP addresses

 

mac-forced-forwarding

Syntax

mac-forced-forwarding { auto | default-gateway gateway-ip }

undo mac-forced-forwarding

View

VLAN view

Default Level

2: System level

Parameters

auto: Specifies the automatic mode.

default-gateway gateway-ip: Specifies the IP address of the default gateway in the manual mode.

Description

Use the mac-forced-forwarding command to enable MFF and specify an MFF operating mode. To enable the manual mode, you need to specify a default gateway.

Use the undo mac-forced-forwarding command to disable MFF.

By default, MFF is disabled.

Note that:

l   If you execute this command repeatedly, the last configuration takes effect.

l   If the automatic mode is specified, make sure that DHCP snooping works normally; if the manual mode is configured, make sure that ARP snooping works normally.

l   For a network (or VLAN) with IP addresses manually configured, the gateway IP address should be configured manually as well; for a network (or VLAN) running DHCP, the gateway IP address can be configured manually, or can be resolved from the Option field in the DHCP messages.

Examples

# Enable MFF in the automatic mode for VLAN 1.

<Sysname> system-view

[Sysname] vlan 1

[Sysname-vlan1] mac-forced-forwarding auto

mac-forced-forwarding gateway probe

Syntax

mac-forced-forwarding gateway probe

undo mac-forced-forwarding gateway probe

View

VLAN view

Default Level

2: System level

Parameters

None

Description

Use the mac-forced-forwarding gateway probe command to enable periodic gateway MAC address probe. The probe interval is 30 seconds, and the probe mode can be manual or automatic.

Use the undo mac-forced-forwarding gateway probe command to restore the default.

By default, periodic gateway MAC address probe is disabled.

Make sure you have enabled MFF before executing the mac-forced-forwarding gateway probe command.

Examples

# Enable periodic gateway MAC address probe.

<Sysname> system-view

[Sysname] vlan 1

[Sysname-vlan1] mac-forced-forwarding gateway probe

mac-forced-forwarding network-port

Syntax

mac-forced-forwarding network-port

undo mac-forced-forwarding network-port

View

Layer 2 Ethernet port view

Default Level

2: System level

Parameters

None

Description

Use the mac-forced-forwarding network-port command to configure the Ethernet port as a network port.

Use the undo mac-forced-forwarding network-port command to restore the default.

By default, the port is a user port.

Note that:

l   The upstream ports connecting to a gateway or the ports between devices in a ring network should be configured as network ports. You can configure multiple ports as network ports.

l   You can configure a port as a network port regardless of whether MFF is enabled for the VLAN of the port; however, the configuration takes effect only after MFF is enabled.

l   Link aggregation is supported by network ports in an MFF-enabled VLAN, but is not supported by user ports in the VLAN. If a network port is added to a link aggregation group belonging to an MFF-enabled VLAN, you need to remove the network port from the link aggregation group before you can cancel the network port configuration. For detailed information about link aggregation, refer to Ethernet Link Aggregation Configuration in the Configuration Guide - Part 3 – Access.

Examples

# Configure GigabitEthernet1/0/1 as a network port.

<Sysname> system-view

[Sysname] interface GigabitEthernet1/0/1

[Sysname-GigabitEthernet1/0/1] mac-forced-forwarding network-port

mac-forced-forwarding server

Syntax

mac-forced-forwarding server server-ip&<1-10>

undo mac-forced-forwarding server [ server-ip&<1-10> ]

View

VLAN view

Default Level

2: System level

Parameters

server-ip&<1-10>: IP address of a server in the network. &<1-10> means you can specify up to ten server IP addresses in one command line.

Description

Use the mac-forced-forwarding server command to specify the IP addresses of servers.

Use the undo mac-forced-forwarding server command to remove the specified server IP addresses. If no parameter is specified, all the server IP addresses are removed.

By default, no server IP address is specified.

You can use this command (in either manual or automatic MFF operating mode) to specify the IP address of a DHCP server, the IP address of a server providing some other service, or the real IP address of a VRRP group.

If the MFF device receives an ARP request from a server, it will search the IP-to-MAC address entries it has stored, and reply the corresponding MAC address to the server. In this way, packets from a server to a host are not forwarded by the gateway, while packets from a host to a server are forwarded by the gateway.

Note that:

l   MFF does not check whether the IP address of a server is on the same network segment as that of a gateway; instead, it checks whether the IP address of a server is all-zero or all-one. An all-zero or all-one server IP address is invalid.

l   If no server IP address is specified using this command, the clients cannot communicate with any server.

l   Make sure MFF is enabled before you execute the mac-forced-forwarding server command.

l   If no IP address is specified in the undo mac-forced-forwarding server command, all specified server IP addresses are removed.

Examples

# Specify the server at 192.168.1.100.

<Sysname> system-view

[Sysname] vlan 1

[Sysname-vlan1] mac-forced-forwarding server 192.168.1.100

H3C reserves the right to modify its collaterals without any prior notice. For the latest information of the collaterals, please consult H3C sales or call 400 hotline.