An Ethernet device uses a MAC address table to forward frames. A MAC address entry includes a destination MAC address, an outgoing interface, and a VLAN ID. When the device receives a frame, it uses the destination MAC address of the frame to look for a match in the MAC address table.

· The device forwards the frame out of the outgoing interface in the matching entry if a match is found.

· The device floods the frame in the VLAN of the frame if no match is found.

How a MAC address entry is created

The entries in the MAC address table include entries automatically learned by the device and entries manually added.

MAC address learning

The device can automatically populate its MAC address table by learning the source MAC addresses of incoming frames on each interface.

The device performs the following operations to learn the source MAC address of incoming packets:

1. Checks the source MAC address (for example, MAC-SOURCE) of the frame.

2. Looks up the source MAC address in the MAC address table.

? The device updates the entry if an entry is found.

? The device adds an entry for MAC-SOURCE and the incoming port if no entry is found.

When the device receives a frame destined for MAC-SOURCE after learning this source MAC address, the device performs the following operations:

3. Finds the MAC-SOURCE entry in the MAC address table.

4. Forwards the frame out of the port in the entry.

The device performs the learning process for each incoming frame with an unknown source MAC address until the table is fully populated.

Manually configuring MAC address entries

Dynamic MAC address learning does not distinguish between illegitimate and legitimate frames, which can invite security hazards. When Host A is connected to port A, a MAC address entry will be learned for the MAC address of Host A (for example, MAC A). When an illegal user sends frames with MAC A as the source MAC address to port B, the device performs the following operations:

1. Learns a new MAC address entry with port B as the outgoing interface and overwrites the old entry for MAC A.

2. Forwards frames destined for MAC A out of port B to the illegal user.

As a result, the illegal user obtains the data of Host A. To improve the security for Host A, manually configure a static entry to bind Host A to port A. Then, the frames destined for Host A are always sent out of port A. Other hosts using the forged MAC address of Host A cannot obtain the frames destined for Host A.

Types of MAC address entries

A MAC address table can contain the following types of entries:

· Static entries—A static entry is manually added to forward frames with a specific destination MAC address out of the associated interface, and it never ages out. A static entry has higher priority than a dynamically learned one.

· Dynamic entries—A dynamic entry can be manually configured or dynamically learned to forward frames with a specific destination MAC address out of the associated interface. A dynamic entry might age out. A manually configured dynamic entry has the same priority as a dynamically learned one.

· Blackhole entries—A blackhole entry is manually configured and never ages out. A blackhole entry is configured for filtering out frames with a specific source or destination MAC address. For example, to block all frames destined for or sourced from a user, you can configure the MAC address of the user as a blackhole MAC address entry. A blackhole entry has higher priority than a dynamically learned one.

A static or blackhole MAC address entry can overwrite a dynamic MAC address entry, but not vice versa. A static entry and a blackhole entry cannot overwrite each other.

Compatibility information

Feature and hardware compatibility

This feature is supported only on the following ports:

· Layer 2 Ethernet ports on Ethernet switching modules.

· Fixed Layer 2 Ethernet ports of the following routers:

? MSR810/810-W/810-W-DB/810-LM/810-W-LM/810-LM-HK/810-W-LM-HK/810-10-PoE/810-LMS/810-LUS.

? MSR2600-6-X1/2600-10-X1.

? MSR3600-28/3600-51.

? MSR3600-28-SI/3600-51-SI.

? MSR810-LM-GL/810-W-LM-GL/830-6EI-GL/830-10EI-GL/830-6HI-GL/830-10HI-GL/2600-6-X1-GL/3600-28-SI-GL.

Command and hardware compatibility

Commands and descriptions for centralized devices apply to the following routers:

· MSR810/810-W/810-W-DB/810-LM/810-W-LM/810-10-PoE/810-LM-HK/810-W-LM-HK/810-LMS/810-LUS.

· MSR2600-6-X1/2600-10-X1.

· MSR 2630.

· MSR3600-28/3600-51.

· MSR3600-28-SI/3600-51-SI.

· MSR3610-X1/3610-X1-DP/3610-X1-DC/3610-X1-DP-DC.

· MSR 3610/3620/3620-DP/3640/3660.

· MSR810-LM-GL/810-W-LM-GL/830-6EI-GL/830-10EI-GL/830-6HI-GL/830-10HI-GL/2600-6-X1-GL/3600-28-SI-GL.

Commands and descriptions for distributed devices apply to the following routers:

· MSR5620.

· MSR 5660.

· MSR 5680.

MAC address table configuration task list

The configuration tasks discussed in the following sections can be performed in any order.

To configure the MAC address table, perform the following tasks:

Tasks at a glance
(Optional.) Configuring MAC address entries · Adding or modifying a static or dynamic MAC address entry globally · Adding or modifying a static or dynamic MAC address entry on an interface · Adding or modifying a blackhole MAC address entry
(Optional.) Disabling MAC address learning on an interface
(Optional.) Setting the aging timer for dynamic MAC address entries

Configuring MAC address entries

Configuration guidelines

· You cannot add a dynamic MAC address entry if a learned entry already exists with a different outgoing interface for the MAC address.

· The manually configured static and blackhole MAC address entries cannot survive a reboot if you do not save the configuration. The manually configured dynamic MAC address entries are lost upon reboot whether or not you save the configuration.

A frame whose source MAC address matches different types of MAC address entries is processed differently.

Type	Description
Static MAC address entry	Forwards the frame according to the destination MAC address regardless of whether the frame's ingress interface is the same as that in the entry.
Blackhole MAC address entry	Drops the frame.
Dynamic MAC address entry	· Learns the MAC address of the frames received on a different interface from that in the entry and overwrites the original entry. · Forwards the frame received on the same interface as that in the entry and updates the aging timer for the entry.

Adding or modifying a static or dynamic MAC address entry globally

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Add or modify a static or dynamic MAC address entry.	mac-address { dynamic \| static } mac-address interface interface-type interface-number vlan vlan-id	By default, no MAC address entry is configured globally. Make sure you have created the VLAN and assigned the interface to the VLAN.

Step

Command

Remarks

1. Enter system view.

system-view

N/A

2. Add or modify a static or dynamic MAC address entry.

mac-address { dynamic | static } mac-address interface interface-type interface-number vlan vlan-id

By default, no MAC address entry is configured globally.

Make sure you have created the VLAN and assigned the interface to the VLAN.

Adding or modifying a static or dynamic MAC address entry on an interface

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Enter Layer 2 Ethernet interface view.	interface interface-type interface-number	N/A
3. Add or modify a static or dynamic MAC address entry.	mac-address { dynamic \| static } mac-address vlan vlan-id	By default, no MAC address entry is configured on the interface. Make sure you have created the VLAN and assigned the interface to the VLAN.

Adding or modifying a blackhole MAC address entry

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Add or modify a blackhole MAC address entry.	mac-address blackhole mac-address vlan vlan-id	By default, no blackhole MAC address entry is configured. Make sure you have created the VLAN.

Step

Command

Remarks

1. Enter system view.

system-view

N/A

2. Add or modify a blackhole MAC address entry.

mac-address blackhole mac-address vlan vlan-id

By default, no blackhole MAC address entry is configured.

Make sure you have created the VLAN.

Disabling MAC address learning on an interface

MAC address learning is enabled by default. To prevent the MAC address table from being saturated when the device is experiencing attacks, disable MAC address learning. For example, you can disable MAC address learning to prevent the device from being attacked by a large amount of frames with different source MAC addresses.

You can disable MAC address learning on a single interface.

To disable MAC address learning on an interface:

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Enter Layer 2 Ethernet interface view.	interface interface-type interface-number	N/A
3. Disable MAC address learning on the interface.	undo mac-address mac-learning enable	By default, MAC address learning on the interface is enabled.

Setting the aging timer for dynamic MAC address entries

For security and efficient use of table space, the MAC address table uses an aging timer for each dynamic MAC address entry. If a dynamic MAC address entry is not updated before the aging timer expires, the device deletes the entry. This aging mechanism ensures that the MAC address table can promptly update to accommodate latest network topology changes.

A stable network requires a longer aging interval, and an unstable network requires a shorter aging interval.

An aging interval that is too long might cause the MAC address table to retain outdated entries. As a result, the MAC address table resources might be exhausted, and the MAC address table might fail to update its entries to accommodate the latest network changes.

An interval that is too short might result in removal of valid entries, which would cause unnecessary floods and possibly affect the device performance.

To reduce floods on a stable network, set a long aging timer or disable the timer to prevent dynamic entries from unnecessarily aging out. Reducing floods improves the network performance. Reducing flooding also improves the security because it reduces the chances for a data frame to reach unintended destinations.

To set the aging timer for dynamic MAC address entries:

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Set the aging timer for dynamic MAC address entries.	mac-address timer { aging seconds \| no-aging }	The default setting is 300 seconds. The no-aging keyword disables the aging timer.

Step

Command

Remarks

1. Enter system view.

system-view

N/A

2. Set the aging timer for dynamic MAC address entries.

mac-address timer { aging seconds | no-aging }

The default setting is 300 seconds.

The no-aging keyword disables the aging timer.

Displaying and maintaining the MAC address table

Execute display commands in any view.

Task	Command
Display MAC address table information.	display mac-address [ mac-address [ vlan vlan-id ] \| [ [ dynamic \| static ] [ interface interface-type interface-number ] \| blackhole ] [ vlan vlan-id ] [ count ] ]
Display the aging timer for dynamic MAC address entries.	display mac-address aging-time
Display the system or interface MAC address learning state.	display mac-address mac-learning [ interface interface-type interface-number ]

MAC address table configuration example

Network requirements

As shown in Figure 1:

· Host A at MAC address 000f-e235-dc71 is connected to GigabitEthernet 1/0/1 of Device and belongs to VLAN 1.

· Host B at MAC address 000f-e235-abcd, which behaved suspiciously on the network, also belongs to VLAN 1.

Configure the MAC address table as follows:

· To prevent MAC address spoofing, add a static entry for Host A in the MAC address table of Device.

· To drop all frames destined for Host B, add a blackhole MAC address entry for Host B.

· Set the aging timer to 500 seconds for dynamic MAC address entries.

Figure 1 Network diagram

Configuration procedure

# Add a static MAC address entry for MAC address 000f-e235-dc71 on GigabitEthernet 1/0/1 that belongs to VLAN 1.

<Device> system-view

[Device] mac-address static 000f-e235-dc71 interface gigabitethernet 1/0/1 vlan 1

# Add a blackhole MAC address entry for MAC address 000f-e235-abcd that belongs to VLAN 1.

[Device] mac-address blackhole 000f-e235-abcd vlan 1

# Set the aging timer to 500 seconds for dynamic MAC address entries.

[Device] mac-address timer aging 500

Verifying the configuration

# Display the static MAC address entries for interface GigabitEthernet 1/0/1.

[Device] display mac-address static interface gigabitethernet 1/0/1

MAC Address VLAN ID State Port/Nickname Aging

000f-e235-dc71 1 Static GE1/0/1 N

# Display the blackhole MAC address entries.

[Device] display mac-address blackhole

MAC Address VLAN ID State Port/Nickname Aging

000f-e235-abcd 1 Blackhole N/A N

# Display the aging time of dynamic MAC address entries.

[Device] display mac-address aging-time

MAC address aging time: 500s.

Configuring Ethernet link aggregation

Overview

Ethernet link aggregation bundles multiple physical Ethernet links into one logical link, called an aggregate link.

Link aggregation has the following benefits:

· Increased bandwidth beyond the limits of any single link. In an aggregate link, traffic is distributed across the member ports.

· Improved link reliability. The member ports dynamically back up one another. When a member port fails, its traffic is automatically switched to other member ports.

Ethernet link aggregation application scenario

As shown in Figure 2, Device A and Device B are connected by three physical Ethernet links. These physical Ethernet links are combined into an aggregate link called link aggregation 1. The bandwidth of this aggregate link can reach up to the total bandwidth of the three physical Ethernet links. At the same time, the three Ethernet links back up one another. When a physical Ethernet link fails, the traffic previously transmitted on the failed link is switched to the other two links.

Figure 2 Ethernet link aggregation diagram

Aggregation group, member port, and aggregate interface

An aggregation group is a group of Ethernet interfaces bundled together. These Ethernet interfaces are called member ports of the aggregation group. Each aggregation group has a corresponding logical interface (called an aggregate interface).

When an aggregate interface is created, the device automatically creates an aggregation group of the same type and number as the aggregate interface.

An aggregate interface can be one of the following types:

· Layer 2—A Layer 2 aggregate interface is created manually. The member ports of the corresponding Layer 2 aggregation group can only be Layer 2 Ethernet interfaces.

· Layer 3—A Layer 3 aggregate interface is created manually. The member ports of the corresponding Layer 3 aggregation group can only be Layer 3 Ethernet interfaces.

On a Layer 3 aggregate interface, you can create subinterfaces.

The port rate of an aggregate interface equals the total rate of its Selected member ports. Its duplex mode is the same as that of the Selected member ports. For more information about Selected member ports, see "Aggregation states of member ports in an aggregation group."

Aggregation states of member ports in an aggregation group

A member port in an aggregation group can be in any of the following aggregation states:

· Selected—A Selected port can forward traffic.

· Unselected—An Unselected port cannot forward traffic.

· Individual—An Individual port can forward traffic as a normal physical port. A port is placed in the Individual state when the following conditions exist:

? Its aggregate interface is configured as an edge aggregate interface.

? The port has not received Link Aggregation Control Protocol Data Units (LACPDUs) from its peer port.

Operational key

When aggregating ports, the system automatically assigns each port an operational key based on port information, such as port rate and duplex mode. Any change to this information triggers a recalculation of the operational key.

In an aggregation group, all Selected ports have the same operational key.

Configuration types

Port configurations include attribute configurations and protocol configurations. Attribute configurations of a link aggregation member port affect its aggregation state.

Attribute configurations

To become a Selected port, a member port must have the same attribute configurations as the aggregate interface. Table 1 describes the attribute configurations.

Table 1 Attribute configurations

Feature	Considerations
Port isolation	Indicates whether the port has joined an isolation group and which isolation group the port belongs to.
VLAN	VLAN attribute configurations include the following: · Permitted VLAN IDs. · PVID. · Link type (trunk, hybrid, or access). · PVLAN port type (promiscuous, trunk promiscuous, host, or trunk secondary). · VLAN tagging mode. For information about VLANs, see "Configuring VLANs."

Feature

Considerations

Port isolation

Indicates whether the port has joined an isolation group and which isolation group the port belongs to.

VLAN

VLAN attribute configurations include the following:

· Permitted VLAN IDs.

· PVID.

· Link type (trunk, hybrid, or access).

· PVLAN port type (promiscuous, trunk promiscuous, host, or trunk secondary).

· VLAN tagging mode.

For information about VLANs, see "Configuring VLANs."

Attribute configuration changes made on an aggregate interface are automatically synchronized to all member ports. If the changes fail to be synchronized to a Selected port, the port might change to the Unselected state. To make the port become Selected again, you can change the attribute configurations on the aggregate interface or on the port. The synchronization failure does not affect the attribute configuration changes made on the aggregate interface. The configurations that have been synchronized from the aggregate interface are retained on the member ports even after the aggregate interface is deleted.

Any attribute configuration change on a member port might affect the aggregation states and running services of the member ports. The system displays a warning message every time you try to change an attribute configuration setting on a member port.

Protocol configurations

Settings that do not affect the aggregation state of a member port even if they are different from those on the aggregate interface. Spanning tree settings are examples of protocol configurations.

For an aggregation, only the protocol configurations on the aggregate interface take effect. The protocol configurations on the member ports will not take effect until after the ports leave the aggregation group.

Link aggregation modes

An aggregation group operates in one of the following modes:

· Static—Static aggregation is stable. An aggregation group in static mode is called a static aggregation group. The aggregation states of the member ports in a static aggregation group are not affected by the peer ports.

· Dynamic—An aggregation group in dynamic mode is called a dynamic aggregation group. The local system and the peer system automatically maintain the aggregation states of the member ports. Dynamic link aggregation reduces the administrators' workload.

Layer 2 aggregation groups and Layer 3 aggregation groups support both the static and dynamic modes.

How static link aggregation works

Choosing a reference port

When setting the aggregation states of the ports in an aggregation group, the system automatically chooses a member port as the reference port. A Selected port must have the same operational key and attribute configurations as the reference port.

The system chooses a reference port from the member ports in up state.

The candidate reference ports are organized into different priority levels following these rules:

1. In descending order of port priority.

2. Full duplex.

3. In descending order of speed.

4. Half duplex.

5. In descending order of speed.

From the candidate ports with the same attribute configurations as the aggregate interface, the one with the highest priority level is chosen as the reference port.

· If multiple ports have the same priority level, the port that has been Selected (if any) is chosen. If multiple ports with the same priority level have been Selected, the one with the smallest port number is chosen.

· If multiple ports have the same priority level and none of them has been Selected, the port with the smallest port number is chosen.

Setting the aggregation state of each member port

After the reference port is chosen, the system sets the aggregation state of each member port in the static aggregation group.

Figure 3 Setting the aggregation state of a member port in a static aggregation group

After the limit on Selected ports is reached, the aggregation state of a new member port varies by following conditions:

· The port is placed in Unselected state if the port and the Selected ports have the same port priority. This mechanism prevents traffic interruption on the existing Selected ports. A device reboot can cause the device to recalculate the aggregation states of member ports.

· The port is placed in Selected state when the following conditions are met:

? The port and the Selected ports have different port priorities, and the port has a higher port priority than a minimum of one Selected port.

? The port has the same attribute configurations as the aggregate interface.

Any operational key or attribute configuration change might affect the aggregation states of link aggregation member ports.

LACP

Dynamic aggregation is implemented through IEEE 802.3ad Link Aggregation Control Protocol (LACP).

LACP uses LACPDUs to exchange aggregation information between LACP-enabled devices. Each member port in a dynamic aggregation group can exchange information with its peer. When a member port receives an LACPDU, it compares the received information with information received on the other member ports. In this way, the two systems reach an agreement on which ports are placed in Selected state.

LACP functions

LACP offers basic LACP functions and extended LACP functions, as described in Table 2.

Table 2 Basic and extended LACP functions

Category	Description
Basic LACP functions	Implemented through the basic LACPDU fields, including the system LACP priority, system MAC address, port priority, port number, and operational key.
Extended LACP functions	Implemented by extending the LACPDU with new TLV fields. Extended LACP can implement LACP MAD for the IRF feature. For more information about IRF and the LACP MAD mechanism, see Virtual Technologies Configuration Guide.

LACP operating modes

LACP can operate in active or passive mode.

When LACP is operating in passive mode on a local member port and its peer port, both ports cannot send LACPDUs. When LACP is operating in active mode on either end of a link, both ports can send LACPDUs.

LACP priorities

LACP priorities include system LACP priority and port priority, as described in Table 3. The smaller the priority value, the higher the priority.

Table 3 LACP priorities

Type	Description
System LACP priority	Used by two peer devices (or systems) to determine which one is superior in link aggregation. In dynamic link aggregation, the system that has higher system LACP priority sets the Selected state of member ports on its side. The system that has lower priority sets the aggregation state of local member ports the same as their respective peer ports.
Port priority	Determines the likelihood of a member port to be a Selected port on a system. A port with a higher port priority is more likely to become Selected.

Type

Description

System LACP priority

Used by two peer devices (or systems) to determine which one is superior in link aggregation.

In dynamic link aggregation, the system that has higher system LACP priority sets the Selected state of member ports on its side. The system that has lower priority sets the aggregation state of local member ports the same as their respective peer ports.

Port priority

Determines the likelihood of a member port to be a Selected port on a system. A port with a higher port priority is more likely to become Selected.

LACP timeout interval

The LACP timeout interval specifies how long a member port waits to receive LACPDUs from the peer port. If a local member port has not received LACPDUs from the peer within the LACP timeout interval, the member port considers the peer as failed.

The LACP timeout interval also determines the LACPDU sending rate of the peer. LACP timeout intervals include the following types:

· Short timeout interval—3 seconds. If you use the short timeout interval, the peer sends one LACPDU per second.

· Long timeout interval—90 seconds. If you use the long timeout interval, the peer sends one LACPDU every 30 seconds.

How dynamic link aggregation works

Choosing a reference port

The system chooses a reference port from the member ports in up state. A Selected port must have the same operational key and attribute configurations as the reference port.

The local system (the actor) and the peer system (the partner) negotiate a reference port by using the following workflow:

1. The two systems determine the system with the smaller system ID.

A system ID contains the system LACP priority and the system MAC address.

a. The two systems compare their LACP priority values.

The lower the LACP priority, the smaller the system ID. If the LACP priority values are the same, the two systems proceed to step b.

b. The two systems compare their MAC addresses.

The lower the MAC address, the smaller the system ID.

2. The system with the smaller system ID chooses the port with the smallest port ID as the reference port.

A port ID contains a port priority and a port number. The lower the port priority, the smaller the port ID.

a. The system chooses the port with the lowest priority value as the reference port.

If the ports have the same priority, the system proceeds to step b.

b. The system compares their port numbers.

The smaller the port number, the smaller the port ID.

The port with the smallest port number and the same attribute configurations as the aggregate interface is chosen as the reference port.

Setting the aggregation state of each member port

After the reference port is chosen, the system with the smaller system ID sets the state of each member port on its side.

Figure 4 Setting the state of a member port in a dynamic aggregation group

The system with the greater system ID can detect the aggregation state changes on the peer system. The system with the greater system ID sets the aggregation state of local member ports the same as their peer ports.

When you aggregate interfaces in dynamic mode, follow these guidelines:

· A dynamic link aggregation group chooses only full-duplex ports as the Selected ports.

· For stable aggregation and service continuity, do not change the operational key or attribute configurations on any member port.

· After the Selected port limit is reached, a newly joining port becomes a Selected port if it is more eligible than a current Selected port.

Edge aggregate interface

Dynamic link aggregation fails on a server-facing aggregate interface if dynamic link aggregation is configured only on the device. The device forwards traffic by using only one of the physical ports that are connected to the server.

To improve link reliability, configure the aggregate interface as an edge aggregate interface. This feature enables all member ports of the aggregation group to forward traffic. When a member port fails, its traffic is automatically switched to other member ports.

After dynamic link aggregation is configured on the server, the device can receive LACPDUs from the server. Then, link aggregation between the device and the server operates correctly.

An edge aggregate interface takes effect only when it is configured on an aggregate interface corresponding to a dynamic aggregation group.

Load sharing modes for link aggregation groups

In a link aggregation group, traffic can be load shared across the Selected ports based on any of the following modes:

· Per-flow load sharing—Distributes traffic on a per-flow basis. The load sharing mode classifies packets into flows and forwards packets of the same flow on the same link. This mode can be one or any combination of the following traffic classification criteria:

? Ingress port.

? Source or destination IP address.

? Source or destination MAC address.

? Source or destination port number.

? MPLS label.

· Bandwidth usage-based load sharing—Distributes a data flow to the Selected port that has the lowest bandwidth usage when the first packet of that data flow arrives. In this mode, each flow is identified by an IP five-tuple (source and destination IP addresses, source and destination ports, and protocol). For packets that do not contain the IP five-tuple, the default load sharing mode applies.

· Per-packet load sharing—Distributes traffic on a per-packet basis.

Compatibility information

Feature and hardware compatibility

Layer 2 aggregation groups and Layer 2 aggregate interfaces are not supported on the following interface modules:

· DSIC-9FSW.

· DSIC-9FSW-PoE.

· MSR810-LMS.

· MSR810-LUS.

· SIC-4FSW.

· SIC-4FSW-PoE.

Multicard or multichassis Layer 2 aggregation groups are not supported.

Command and hardware compatibility

Commands and descriptions for centralized devices apply to the following routers:

· MSR810/810-W/810-W-DB/810-LM/810-W-LM/810-10-PoE/810-LM-HK/810-W-LM-HK.

· MSR2600-6-X1/2600-10-X1.

· MSR 2630.

· MSR3600-28/3600-51.

· MSR3600-28-SI/3600-51-SI.

· MSR3610-X1/3610-X1-DP/3610-X1-DC/3610-X1-DP-DC.

· MSR 3610/3620/3620-DP/3640/3660.

· MSR810-LM-GL/810-W-LM-GL/830-6EI-GL/830-10EI-GL/830-6HI-GL/830-10HI-GL/2600-6-X1-GL/3600-28-SI-GL.

Commands and descriptions for distributed devices apply to the following routers:

· MSR5620.

· MSR 5660.

· MSR 5680.

Ethernet link aggregation configuration task list

Tasks at a glance
(Required.) Configuring an aggregation group: · Configuring a Layer 2 aggregation group · Configuring a Layer 3 aggregation group
(Optional.) Configuring an aggregate interface: · Configuring the description of an aggregate interface · Configuring jumbo frame support · Specifying ignored VLANs for a Layer 2 aggregate interface · Setting the MTU for a Layer 3 aggregate interface · Specifying a traffic processing slot for a Layer 3 aggregate interface · Setting the minimum and maximum numbers of Selected ports for an aggregation group · Setting the expected bandwidth for an aggregate interface · Configuring an edge aggregate interface · Shutting down an aggregate interface · Restoring the default settings for an aggregate interface
(Optional.) Configuring load sharing for link aggregation groups: · Setting load sharing modes for link aggregation groups · Enabling link-aggregation load sharing enhancement for MPLS packets · Enabling local-first load sharing for link aggregation
Enabling link-aggregation traffic redirection

Tasks at a glance

(Required.) Configuring an aggregation group:

· Configuring a Layer 2 aggregation group

· Configuring a Layer 3 aggregation group

(Optional.) Configuring an aggregate interface:

· Configuring the description of an aggregate interface

· Configuring jumbo frame support

· Specifying ignored VLANs for a Layer 2 aggregate interface

· Setting the MTU for a Layer 3 aggregate interface

· Specifying a traffic processing slot for a Layer 3 aggregate interface

· Setting the minimum and maximum numbers of Selected ports for an aggregation group

· Setting the expected bandwidth for an aggregate interface

· Configuring an edge aggregate interface

· Shutting down an aggregate interface

· Restoring the default settings for an aggregate interface

(Optional.) Configuring load sharing for link aggregation groups:

· Setting load sharing modes for link aggregation groups

· Enabling link-aggregation load sharing enhancement for MPLS packets

· Enabling local-first load sharing for link aggregation

Enabling link-aggregation traffic redirection

Configuring an aggregation group

This section explains how to configure an aggregation group.

Configuration restrictions and guidelines

Aggregation member interface restrictions

· You cannot assign an interface to a Layer 2 aggregation group if any features in Table 4 are configured on the interface.

Table 4 Features incompatible with Layer 2 aggregation member interfaces

Feature on the interface	Reference
MAC authentication	MAC authentication in Security Configuration Guide
Port security	Port security in Security Configuration Guide
Interface configured with 802.1X	802.1X in Security Configuration Guide
Service instance bound to a cross connect	MPLS L2VPN in MPLS Configuration Guide
Service instance bound to a VSI	VPLS in MPLS Configuration Guide

· You cannot assign an interface to a Layer 3 aggregation group if any features in Table 5 are configured on the interface.

Table 5 Features incompatible with Layer 3 aggregation member interfaces

Interface type	Reference
Interface bound to a cross connect	MPLS L2VPN in MPLS Configuration Guide
Interface bound to a VSI	VPLS in MPLS Configuration Guide

· Do not assign a reflector port for port mirroring to an aggregation group. For more information about reflector ports, see Network Management and Monitoring Configuration Guide.

Configuration consistency requirements

· You must configure the same aggregation mode at the two ends of an aggregate link.

· For a successful static aggregation, make sure the ports at both ends of each link are in the same aggregation state.

· For a successful dynamic aggregation, make sure the peer ports of the ports aggregated at one end are also aggregated. The two ends can automatically negotiate the aggregation state of each member port.

Miscellaneous

Deleting an aggregate interface also deletes its aggregation group and causes all member ports to leave the aggregation group.

Configuring a Layer 2 aggregation group

Configuring a Layer 2 static aggregation group

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Create a Layer 2 aggregate interface and enter Layer 2 aggregate interface view.	interface bridge-aggregation interface-number	When you create a Layer 2 aggregate interface, the system automatically creates a Layer 2 static aggregation group numbered the same.
3. Exit to system view.	quit	N/A
4. Assign an interface to the specified Layer 2 aggregation group.	a Enter Layer 2 Ethernet interface view: interface interface-type interface-number b Assign the interface to the specified Layer 2 aggregation group: port link-aggregation group group-id	Repeat these two substeps to assign more Layer 2 Ethernet interfaces to the aggregation group.

Configuring a Layer 2 dynamic aggregation group

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Set the system LACP priority.	lacp system-priority priority	By default, the system LACP priority is 32768. Changing the system LACP priority might affect the aggregation states of the ports in a dynamic aggregation group.
3. Create a Layer 2 aggregate interface and enter Layer 2 aggregate interface view.	interface bridge-aggregation interface-number	When you create a Layer 2 aggregate interface, the system automatically creates a Layer 2 static aggregation group numbered the same.
4. Configure the aggregation group to operate in dynamic mode.	link-aggregation mode dynamic	By default, an aggregation group operates in static mode.
5. Exit to system view.	quit	N/A
6. Assign an interface to the specified Layer 2 aggregation group.	a Enter Layer 2 Ethernet interface view: interface interface-type interface-number b Assign the interface to the specified Layer 2 aggregation group: port link-aggregation group group-id	Repeat these two substeps to assign more Layer 2 Ethernet interfaces to the aggregation group.
7. Set the LACP operating mode for the interface.	· Set the LACP operating mode to passive: lacp mode passive · Set the LACP operating mode to active: undo lacp mode	By default, LACP is operating in active mode.
8. Set the port priority for the interface.	link-aggregation port-priority priority	The default setting is 32768.
9. Set the short LACP timeout interval (3 seconds) for the interface.	lacp period short	By default, the long LACP timeout interval (90 seconds) is used by the interface. To avoid traffic interruption during an ISSU, do not set the short LACP timeout interval before performing the ISSU. For more information about ISSU, see Fundamentals Configuration Guide.

Configuring a Layer 3 aggregation group

Configuring a Layer 3 static aggregation group

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Create a Layer 3 aggregate interface and enter Layer 3 aggregate interface view.	interface route-aggregation interface-number	When you create a Layer 3 aggregate interface, the system automatically creates a Layer 3 static aggregation group numbered the same.
3. Exit to system view.	quit	N/A
4. Assign an interface to the specified Layer 3 aggregation group.	a Enter Layer 3 Ethernet interface view: interface interface-type interface-number b Assign the interface to the specified Layer 3 aggregation group: port link-aggregation group group-id	Repeat these two substeps to assign more Layer 3 Ethernet interfaces to the aggregation group.

Configuring a Layer 3 dynamic aggregation group

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Set the system LACP priority.	lacp system-priority priority	By default, the system LACP priority is 32768. Changing the system LACP priority might affect the aggregation states of the ports in the dynamic aggregation group.
3. Create a Layer 3 aggregate interface and enter Layer 3 aggregate interface view.	interface route-aggregation interface-number	When you create a Layer 3 aggregate interface, the system automatically creates a Layer 3 static aggregation group numbered the same.
4. Configure the aggregation group to operate in dynamic mode.	link-aggregation mode dynamic	By default, an aggregation group operates in static mode.
5. Exit to system view.	quit	N/A
6. Assign an interface to the specified Layer 3 aggregation group.	a Enter Layer 3 Ethernet interface view: interface interface-type interface-number b Assign the interface to the specified Layer 3 aggregation group: port link-aggregation group group-id	Repeat these two substeps to assign more Layer 3 Ethernet interfaces to the aggregation group.
7. Set the LACP operating mode for the interface.	· Set the LACP operating mode to passive: lacp mode passive · Set the LACP operating mode to active: undo lacp mode	By default, LACP is operating in active mode.
8. Set the port priority for the interface.	link-aggregation port-priority priority	The default setting is 32768.
9. Set the short LACP timeout interval (3 seconds) for the interface.	lacp period short	By default, the long LACP timeout interval (90 seconds) is used by the interface. To avoid traffic interruption during an ISSU, do not set the short LACP timeout interval before performing the ISSU. For more information about ISSU, see Fundamentals Configuration Guide.

Configuring an aggregate interface

Most configurations that can be made on Layer 2 or Layer 3 Ethernet interfaces can also be made on Layer 2 or Layer 3 aggregate interfaces.

Configuring the description of an aggregate interface

You can configure the description of an aggregate interface for administration purposes, for example, describing the purpose of the interface.

To configure the description of an aggregate interface:

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Enter aggregate interface or subinterface view.	· Enter Layer 2 aggregate interface view: interface bridge-aggregation interface-number · Enter Layer 3 aggregate interface or subinterface view: interface route-aggregation { interface-number \| interface-number.subnumber }	N/A
3. Configure the description of the aggregate interface or subinterface.	description text	By default, the description of an interface is interface-name Interface.

Configuring jumbo frame support

An aggregate interface might receive frames larger than 1536 bytes during high-throughput data exchanges, such as file transfers. These frames are called jumbo frames.

How an aggregate interface processes jumbo frames depends on whether jumbo frame support is enabled on the interface.

· If configured to deny jumbo frames, the aggregate interface discards jumbo frames.

· If enabled with jumbo frame support, the aggregate interface performs the following operations:

? Processes the jumbo frames that are within the allowed length.

? Discards the jumbo frames that exceed the allowed length.

To configure jumbo frame support on an aggregate interface:

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Enter aggregate interface view.	· Enter Layer 2 aggregate interface view: interface bridge-aggregation interface-number · Enter Layer 3 aggregate interface or subinterface view: interface route-aggregation { interface-number \| interface-number.subnumber }	N/A
3. Configure jumbo frame support.	· Allow jumbo frames to pass through: jumboframe enable [ size ] · Prevent jumbo frames from passing through: undo jumboframe enable	By default, an aggregate interface allows jumbo frames with a maximum length of 1536 bytes to pass through. To restore the default, use the undo jumboframe enable size command.

Specifying ignored VLANs for a Layer 2 aggregate interface

The system ignores the permit state and tagging mode of an ignored VLAN when choosing Selected ports.

By default, to become Selected, the member ports must have the same VLAN permit state and tagging mode as the corresponding Layer 2 aggregate interface.

To specify ignored VLANs for a Layer 2 aggregate interface:

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Enter Layer 2 aggregate interface view.	interface bridge-aggregation interface-number	N/A
3. Specify ignored VLANs.	link-aggregation ignore vlan vlan-id-list	By default, a Layer 2 aggregate interface does not ignore any VLANs.

Setting the MTU for a Layer 3 aggregate interface

The MTU of an interface affects IP packets fragmentation and reassembly on the interface.

To set the MTU for a Layer 3 aggregate interface:

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Enter Layer 3 aggregate interface or subinterface view.	interface route-aggregation { interface-number \| interface-number.subnumber }	N/A
3. Set the MTU for the Layer 3 aggregate interface or subinterface.	mtu size	The default setting is 1500 bytes.

Specifying a traffic processing slot for a Layer 3 aggregate interface

The following matrix shows the feature and hardware compatibility:

Hardware	Layer 3 aggregate interface traffic processing slot compatibility
MSR810/810-W/810-W-DB/810-LM/810-W-LM/810-10-PoE/810-LM-HK/810-W-LM-HK	No
MSR2600-6-X1/2600-10-X1	No
MSR 2630	Yes
MSR3600-28/3600-51	Yes
MSR3600-28-SI/3600-51-SI	No
MSR3610-X1/3610-X1-DP/3610-X1-DC/3610-X1-DP-DC	Yes
MSR 3610/3620/3620-DP/3640/3660	Yes
MSR5620/5660/5680	Yes

Hardware	Layer 3 aggregate interface traffic processing slot compatibility
MSR810-LM-GL	No
MSR810-W-LM-GL	No
MSR830-6EI-GL	No
MSR830-10EI-GL	No
MSR830-6HI-GL	No
MSR830-10HI-GL	No
MSR2600-6-X1-GL	No
MSR3600-28-SI-GL	No

By default, traffic on a Layer 3 aggregate interface is processed on the slot at which the traffic arrives. You can specify a traffic processing slot for all traffic on a Layer 3 aggregate interface to be processed on the same slot. If the aggregate interface contains subinterfaces, traffic on the subinterfaces is also processed on the specified slot.

To specify a traffic processing slot for a Layer 3 aggregate interface:

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Enter Layer 3 aggregate interface view.	interface route-aggregation interface-number	N/A
3. Specify a primary traffic processing slot for the interface.	· Distributed devices in standalone mode/centralized devices in IRF mode: service slot slot-number · Distributed devices in IRF mode: service chassis chassis-number slot slot-number	By default, no primary traffic processing slot is specified for an interface.
4. Specify a backup traffic processing slot for the interface.	· Distributed devices in standalone mode/centralized devices in IRF mode: service standby slot slot-number · Distributed devices in IRF mode: service standby chassis chassis-number slot slot-number	By default, no backup traffic processing slot is specified for an interface.

Setting the minimum and maximum numbers of Selected ports for an aggregation group

IMPORTANT:

The minimum and maximum numbers of Selected ports must be the same for the local and peer aggregation groups.

The bandwidth of an aggregate link increases as the number of Selected member ports increases. To avoid congestion, you can set the minimum number of Selected ports required for bringing up an aggregate interface.

This minimum threshold setting affects the aggregation states of aggregation member ports and the state of the aggregate interface.

· When the number of member ports eligible to be Selected ports is smaller than the minimum threshold, the following events occur:

? The eligible member ports are placed in Unselected state.

? The link layer state of the aggregate interface becomes down.

· When the number of member ports eligible to be Selected ports reaches or exceeds the minimum threshold, the following events occur:

? The eligible member ports are placed in Selected state.

? The link layer state of the aggregate interface becomes up.

The maximum number of Selected ports allowed in an aggregation group is limited by either manual configuration or hardware limitation, whichever value is smaller.

To set the minimum and maximum numbers of Selected ports for an aggregation group:

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Enter aggregate interface view.	· Enter Layer 2 aggregate interface view: interface bridge-aggregation interface-number · Enter Layer 3 aggregate interface view: interface route-aggregation interface-number	N/A
3. Set the minimum number of Selected ports for the aggregation group.	link-aggregation selected-port minimum min-number	By default, the minimum number of Selected ports is not specified for an aggregation group.
4. Set the maximum number of Selected ports for the aggregation group.	link-aggregation selected-port maximum max-number	By default, the maximum number of Selected ports for an aggregation group depends on hardware limitation.

Setting the expected bandwidth for an aggregate interface

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Enter aggregate interface view.	· Enter Layer 2 aggregate interface view: interface bridge-aggregation interface-number · Enter Layer 3 aggregate interface or subinterface view: interface route-aggregation { interface-number \| interface-number.subnumber }	N/A
3. Set the expected bandwidth for the interface.	bandwidth bandwidth-value	By default, the expected bandwidth (in kbps) is the interface baud rate divided by 1000.

Configuring an edge aggregate interface

When you configure an edge aggregate interface, follow these restrictions and guidelines:

· This configuration takes effect only on the aggregate interface corresponding to a dynamic aggregation group.

· Link-aggregation traffic redirection cannot operate correctly on an edge aggregate interface. For more information about link-aggregation traffic redirection, see "Enabling link-aggregation traffic redirection."

To configure an edge aggregate interface:

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Enter aggregate interface view.	· Enter Layer 2 aggregate interface view: interface bridge-aggregation interface-number · Enter Layer 3 aggregate interface view: interface route-aggregation interface-number	N/A
3. Configure the aggregate interface as an edge aggregate interface.	lacp edge-port	By default, an aggregate interface does not operate as an edge aggregate interface.

Shutting down an aggregate interface

Shutting down or bringing up an aggregate interface affects the aggregation states and link states of member ports in the corresponding aggregation group as follows:

· When an aggregate interface is shut down, all Selected ports in the corresponding aggregation group become Unselected ports and all member ports go down.

· When an aggregate interface is brought up, the aggregation states of member ports in the corresponding aggregation group are recalculated.

To shut down an aggregate interface:

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Enter aggregate interface view.	· Enter Layer 2 aggregate interface view: interface bridge-aggregation interface-number · Enter Layer 3 aggregate interface or subinterface view: interface route-aggregation { interface-number \| interface-number.subnumber }	N/A
3. Shut down the aggregate interface or subinterface.	shutdown	By default, an aggregate interface or subinterface is up.

Restoring the default settings for an aggregate interface

You can restore all configurations on an aggregate interface to the default settings.

To restore the default settings for an aggregate interface:

Step	Command
1. Enter system view.	system-view
2. Enter aggregate interface view.	· Enter Layer 2 aggregate interface view: interface bridge-aggregation interface-number · Enter Layer 3 aggregate interface or subinterface view: interface route-aggregation { interface-number \| interface-number.subnumber }
3. Restore the default settings for the aggregate interface.	default

Configuring load sharing for link aggregation groups

This section explains how to configure the load sharing modes for link aggregation groups and how to enable local-first load sharing for link aggregation.

Setting load sharing modes for link aggregation groups

You can set the global or group-specific load sharing mode. A link aggregation group preferentially uses the group-specific load sharing mode. If the group-specific load sharing mode is not available, the group uses the global load sharing mode.

Setting the global link-aggregation load sharing mode

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Set the global link-aggregation load sharing mode.	link-aggregation global load-sharing mode { destination-ip \| destination-mac \| destination-port \| mpls-label1 \| source-ip \| source-mac \| source-port } *	For information about support for the keywords of this command, see Layer 2—LAN Switching Command Reference.

Setting the group-specific load sharing mode

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Enter Layer 3 aggregate interface view.	interface route-aggregation interface-number	N/A
3. Set the load sharing mode for the aggregation group.	link-aggregation load-sharing mode { { bandwidth-usage \| destination-ip \| destination-port \| source-ip \| source-port } * \| per-packet }	For information about support for the keywords of this command, see Layer 2—LAN Switching Command Reference.

Enabling link-aggregation load sharing enhancement for MPLS packets

In an MPLS L3VPN network, MPLS packets might not be distributed evenly on aggregate links if traffic load sharing is performed based on MPLS labels. To improve load sharing performance, enable this feature for aggregate interfaces to use the IP five-tuple for MPLS packet distribution. The IP five-tuple contains the source IP address, source port number, destination IP address, destination port number, and protocol number. The actual load sharing result depends on the load sharing modes you set.

When you use this feature, follow these restrictions and guidelines:

· Enable this feature only on the provider (P) device. For information about the P device, see MPLS L3VPN configuration in MPLS Configuration Guide.

· MPLS L2VPN does not support MPLS packet distribution based on IP five-tuple information. Do not use this feature on an MPLS L2VPN network. For more information about MPLS L2VPN, see MPLS Configuration Guide.

To enable link-aggregation load sharing enhancement for MPLS packets:

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Enter Layer 3 aggregate interface view.	interface route-aggregation interface-number	N/A
3. Enable the aggregate interface to use the IP five-tuple for MPLS packet distribution.	link-aggregation load-sharing mpls enhanced	By default, link-aggregation load sharing enhancement is disabled for MPLS packets.

Enabling local-first load sharing for link aggregation

The following matrix shows the feature and hardware compatibility:

Hardware	Local-first load sharing for link aggregation compatibility
MSR810/810-W/810-W-DB/810-LM/810-W-LM/810-10-PoE/810-LM-HK/810-W-LM-HK	No
MSR2600-6-X1/2600-10-X1	No
MSR 2630	Yes
MSR3600-28/3600-51	Yes
MSR3600-28-SI/3600-51-SI	No
MSR3610-X1/3610-X1-DP/3610-X1-DC/3610-X1-DP-DC	Yes
MSR 3610/3620/3620-DP/3640/3660	Yes
MSR5620/5660/5680	Yes

Hardware	Local-first load sharing for link aggregation compatibility
MSR810-LM-GL	No
MSR810-W-LM-GL	No
MSR830-6EI-GL	No
MSR830-10EI-GL	No
MSR830-6HI-GL	No
MSR830-10HI-GL	No
MSR2600-6-X1-GL	No
MSR3600-28-SI-GL	No

Use local-first load sharing in a multidevice link aggregation scenario to distribute traffic preferentially across member ports on the ingress card or device.

When you aggregate ports on different member devices in an IRF fabric, you can use local-first load sharing to reduce traffic on IRF links, as shown in Figure 5. For more information about IRF, see IRF Configuration Guide.

Figure 5 Load sharing for multidevice link aggregation in an IRF fabric

To enable local-first load sharing for link aggregation:

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Enable local-first load sharing for link aggregation.	link-aggregation load-sharing mode local-first	By default, local-first load sharing for link aggregation is enabled.

Enabling link-aggregation traffic redirection

Link-aggregation traffic redirection prevents traffic interruption.

When you shut down a Selected port in an aggregation group, this feature redirects traffic of the Selected port to other Selected ports. (Centralized devices in standalone mode.)

When you restart a card that contains Selected ports, this feature redirects traffic of the card to other cards. (Distributed devices in standalone mode.)

When you restart an IRF member device that contains Selected ports, this feature redirects traffic of the IRF member device to other IRF member devices. (Centralized devices in IRF mode.)

When you restart an IRF member device that contains Selected ports, this feature redirects traffic of the IRF member device to other IRF member devices. When you restart a card that contains Selected ports, this feature redirects traffic of the card to other cards. (Distributed devices in IRF mode.)

NOTE:

The device does not distribute traffic to member ports that become Selected during the traffic redirection process.

Configuration restrictions and guidelines

When you enable link-aggregation traffic redirection, follow these restrictions and guidelines:

· Link-aggregation traffic redirection applies only to dynamic link aggregation groups.

· To prevent traffic interruption, enable link-aggregation traffic redirection on devices at both ends of the aggregate link.

· To prevent packet loss that might occur at a reboot, do not enable spanning tree together with link-aggregation traffic redirection.

· Link-aggregation traffic redirection does not operate correctly on an edge aggregate interface.

Configuration procedure

To enable link-aggregation traffic redirection:

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Enter Layer 3 aggregate interface view.	interface route-aggregation interface-number	N/A
3. Enable link-aggregation traffic redirection.	link-aggregation lacp traffic-redirect-notification enable	By default, link-aggregation traffic redirection is disabled.

Displaying and maintaining Ethernet link aggregation

Execute display commands in any view and reset commands in user view.

Task	Command
Display information for an aggregate interface or multiple aggregate interfaces.	display interface [ { bridge-aggregation \| route-aggregation } [ interface-number ] ] [ brief [ description \| down ] ]
Display the local system ID.	display lacp system-id
Display the global or group-specific link-aggregation load sharing modes.	display link-aggregation load-sharing mode [ interface [ { bridge-aggregation \| route-aggregation } interface-number ] ]
Display detailed link aggregation information for link aggregation member ports.	display link-aggregation member-port [ interface-list ]
Display summary information about all aggregation groups.	display link-aggregation summary
Display detailed information about the specified aggregation groups.	display link-aggregation verbose [ { bridge-aggregation \| route-aggregation } [ interface-number ] ]
Clear LACP statistics for the specified link aggregation member ports.	reset lacp statistics [ interface interface-list ]
Clear statistics for the specified aggregate interfaces.	reset counters interface [ { bridge-aggregation \| route-aggregation } [ interface-number ] ]

Ethernet link aggregation configuration examples

Layer 2 static aggregation configuration example

Network requirements

On the network shown in Figure 6, perform the following tasks:

· Configure a Layer 2 static aggregation group on both Device A and Device B.

· Enable VLAN 10 at one end of the aggregate link to communicate with VLAN 10 at the other end.

· Enable VLAN 20 at one end of the aggregate link to communicate with VLAN 20 at the other end.

Figure 6 Network diagram

Configuration procedure

1. Configure Device A:

# Create VLAN 10, and assign port GigabitEthernet 1/0/4 to VLAN 10.

<DeviceA> system-view

[DeviceA] vlan 10

[DeviceA-vlan10] port gigabitethernet 1/0/4

[DeviceA-vlan10] quit

# Create VLAN 20, and assign port GigabitEthernet 1/0/5 to VLAN 20.

[DeviceA] vlan 20

[DeviceA-vlan20] port gigabitethernet 1/0/5

[DeviceA-vlan20] quit

# Create Layer 2 aggregate interface Bridge-Aggregation 1.

[DeviceA] interface bridge-aggregation 1

[DeviceA-Bridge-Aggregation1] quit

# Assign ports GigabitEthernet 1/0/1 through GigabitEthernet 1/0/3 to link aggregation group 1.

[DeviceA] interface gigabitethernet 1/0/1

[DeviceA-GigabitEthernet1/0/1] port link-aggregation group 1

[DeviceA-GigabitEthernet1/0/1] quit

[DeviceA] interface gigabitethernet 1/0/2

[DeviceA-GigabitEthernet1/0/2] port link-aggregation group 1

[DeviceA-GigabitEthernet1/0/2] quit

[DeviceA] interface gigabitethernet 1/0/3

[DeviceA-GigabitEthernet1/0/3] port link-aggregation group 1

[DeviceA-GigabitEthernet1/0/3] quit

# Configure Layer 2 aggregate interface Bridge-Aggregation 1 as a trunk port and assign it to VLANs 10 and 20.

[DeviceA] interface bridge-aggregation 1

[DeviceA-Bridge-Aggregation1] port link-type trunk

[DeviceA-Bridge-Aggregation1] port trunk permit vlan 10 20

[DeviceA-Bridge-Aggregation1] quit

2. Configure Device B in the same way Device A is configured. (Details not shown.)

Verifying the configuration

# Display detailed information about all aggregation groups on Device A.

[DeviceA] display link-aggregation verbose

Loadsharing Type: Shar -- Loadsharing, NonS -- Non-Loadsharing

Port Status: S -- Selected, U -- Unselected, I -- Individual

Flags: A -- LACP_Activity, B -- LACP_Timeout, C -- Aggregation,

D -- Synchronization, E -- Collecting, F -- Distributing,

G -- Defaulted, H -- Expired

Aggregate Interface: Bridge-Aggregation1

Aggregation Mode: Static

Loadsharing Type: Shar

Port Status Priority Oper-Key

--------------------------------------------------------------------------------

GE1/0/1 S 32768 1

GE1/0/2 S 32768 1

GE1/0/3 S 32768 1

The output shows that link aggregation group 1 is a Layer 2 static aggregation group that contains three Selected ports.

Layer 2 dynamic aggregation configuration example

Network requirements

On the network shown in Figure 7, perform the following tasks:

· Configure a Layer 2 dynamic aggregation group on both Device A and Device B.

· Enable VLAN 10 at one end of the aggregate link to communicate with VLAN 10 at the other end.

· Enable VLAN 20 at one end of the aggregate link to communicate with VLAN 20 at the other end.

Figure 7 Network diagram

Configuration procedure

1. Configure Device A:

# Create VLAN 10, and assign the port GigabitEthernet 1/0/4 to VLAN 10.

<DeviceA> system-view

[DeviceA] vlan 10

[DeviceA-vlan10] port gigabitethernet 1/0/4

[DeviceA-vlan10] quit

# Create VLAN 20, and assign the port GigabitEthernet 1/0/5 to VLAN 20.

[DeviceA] vlan 20

[DeviceA-vlan20] port gigabitethernet 1/0/5

[DeviceA-vlan20] quit

# Create Layer 2 aggregate interface Bridge-Aggregation 1, and set the link aggregation mode to dynamic.

[DeviceA] interface bridge-aggregation 1

[DeviceA-Bridge-Aggregation1] link-aggregation mode dynamic

[DeviceA-Bridge-Aggregation1] quit

# Assign ports GigabitEthernet 1/0/1 through GigabitEthernet 1/0/3 to link aggregation group 1.

[DeviceA] interface gigabitethernet 1/0/1

[DeviceA-GigabitEthernet1/0/1] port link-aggregation group 1

[DeviceA-GigabitEthernet1/0/1] quit

[DeviceA] interface gigabitethernet 1/0/2

[DeviceA-GigabitEthernet1/0/2] port link-aggregation group 1

[DeviceA-GigabitEthernet1/0/2] quit

[DeviceA] interface gigabitethernet 1/0/3

[DeviceA-GigabitEthernet1/0/3] port link-aggregation group 1

[DeviceA-GigabitEthernet1/0/3] quit

# Configure Layer 2 aggregate interface Bridge-Aggregation 1 as a trunk port and assign it to VLANs 10 and 20.

[DeviceA] interface bridge-aggregation 1

[DeviceA-Bridge-Aggregation1] port link-type trunk

[DeviceA-Bridge-Aggregation1] port trunk permit vlan 10 20

[DeviceA-Bridge-Aggregation1] quit

2. Configure Device B in the same way Device A is configured. (Details not shown.)

Verifying the configuration

# Display detailed information about all aggregation groups on Device A.

[DeviceA] display link-aggregation verbose

Loadsharing Type: Shar -- Loadsharing, NonS -- Non-Loadsharing

Port Status: S -- Selected, U -- Unselected, I -- Individual

Flags: A -- LACP_Activity, B -- LACP_Timeout, C -- Aggregation,

D -- Synchronization, E -- Collecting, F -- Distributing,

G -- Defaulted, H -- Expired

Aggregate Interface: Bridge-Aggregation1

Aggregation Mode: Dynamic

Loadsharing Type: Shar

System ID: 0x8000, 000f-e267-6c6a

Local:

Port Status Priority Oper-Key Flag

--------------------------------------------------------------------------------

GE1/0/1 S 32768 1 {ACDEF}

GE1/0/2 S 32768 1 {ACDEF}

GE1/0/3 S 32768 1 {ACDEF}

Remote:

Actor Partner Priority Oper-Key SystemID Flag

--------------------------------------------------------------------------------

GE1/0/1 1 32768 1 0x8000, 000f-e267-57ad {ACDEF}

GE1/0/2 2 32768 1 0x8000, 000f-e267-57ad {ACDEF}

GE1/0/3 3 32768 1 0x8000, 000f-e267-57ad {ACDEF}

The output shows that link aggregation group 1 is a Layer 2 dynamic aggregation group that contains three Selected ports.

Layer 2 edge aggregate interface configuration example

Network requirements

As shown in Figure 8, a Layer 2 dynamic aggregation group is configured on the device. The server is not configured with dynamic link aggregation.

Configure an edge aggregate interface so that both GigabitEthernet 1/0/1 and GigabitEthernet 1/0/2 can forward traffic to improve link reliability.

Figure 8 Network diagram

Configuration procedure

# Create Layer 2 aggregate interface Bridge-Aggregation 1, and set the link aggregation mode to dynamic.

<Device> system-view

[Device] interface bridge-aggregation 1

[Device-Bridge-Aggregation1] link-aggregation mode dynamic

# Configure Layer 2 aggregate interface Bridge-Aggregation 1 as an edge aggregate interface.

[Device-Bridge-Aggregation1] lacp edge-port

[Device-Bridge-Aggregation1] quit

# Assign ports GigabitEthernet 1/0/1 and GigabitEthernet 1/0/2 to link aggregation group 1.

[Device] interface gigabitethernet 1/0/1

[Device-GigabitEthernet1/0/1] port link-aggregation group 1

[Device-GigabitEthernet1/0/1] quit

[Device] interface gigabitethernet 1/0/2

[Device-GigabitEthernet1/0/2] port link-aggregation group 1

[Device-GigabitEthernet1/0/2] quit

Verifying the configuration

# Display detailed information about all aggregation groups on the device when the server is not configured with dynamic link aggregation.

[Device] display link-aggregation verbose

Loadsharing Type: Shar -- Loadsharing, NonS -- Non-Loadsharing

Port Status: S -- Selected, U -- Unselected, I -- Individual

Flags: A -- LACP_Activity, B -- LACP_Timeout, C -- Aggregation,

D -- Synchronization, E -- Collecting, F -- Distributing,

G -- Defaulted, H -- Expired

Aggregate Interface: Bridge-Aggregation1

Aggregation Mode: Dynamic

Loadsharing Type: Shar

System ID: 0x8000, 000f-e267-6c6a

Local:

Port Status Priority Oper-Key Flag

--------------------------------------------------------------------------------

GE1/0/1 I 32768 1 {AG}

GE1/0/2 I 32768 1 {AG}

Remote:

Actor Partner Priority Oper-Key SystemID Flag

--------------------------------------------------------------------------------

GE1/0/1 0 32768 0 0x8000, 0000-0000-0000 {DEF}

GE1/0/2 0 32768 0 0x8000, 0000-0000-0000 {DEF}

The output shows that GigabitEthernet 1/0/1 and GigabitEthernet 1/0/2 are in Individual state when they do not receive LACPDUs from the server. Both GigabitEthernet 1/0/1 and GigabitEthernet 1/0/2 can forward traffic. When one port fails, its traffic is automatically switched to the other port.

Layer 3 static aggregation configuration example

Network requirements

On the network shown in Figure 9, perform the following tasks:

· Configure a Layer 3 static aggregation group on both Device A and Device B.

· Configure IP addresses and subnet masks for the corresponding Layer 3 aggregate interfaces.

Figure 9 Network diagram

Configuration procedure

1. Configure Device A:

# Create Layer 3 aggregate interface Route-Aggregation 1, and configure an IP address and subnet mask for the aggregate interface.

<DeviceA> system-view

[DeviceA] interface route-aggregation 1

[DeviceA-Route-Aggregation1] ip address 192.168.1.1 24

[DeviceA-Route-Aggregation1] quit

# Assign Layer 3 Ethernet interfaces GigabitEthernet 1/0/1 through GigabitEthernet 1/0/3 to aggregation group 1.

[DeviceA] interface gigabitethernet 1/0/1

[DeviceA-GigabitEthernet1/0/1] port link-aggregation group 1

[DeviceA-GigabitEthernet1/0/1] quit

[DeviceA] interface gigabitethernet 1/0/2

[DeviceA-GigabitEthernet1/0/2] port link-aggregation group 1

[DeviceA-GigabitEthernet1/0/2] quit

[DeviceA] interface gigabitethernet 1/0/3

[DeviceA-GigabitEthernet1/0/3] port link-aggregation group 1

[DeviceA-GigabitEthernet1/0/3] quit

2. Configure Device B in the same way Device A is configured. (Details not shown.)

Verifying the configuration

# Display detailed information about all aggregation groups on Device A.

[DeviceA] display link-aggregation verbose

Loadsharing Type: Shar -- Loadsharing, NonS -- Non-Loadsharing

Port Status: S -- Selected, U -- Unselected, I -- Individual

Flags: A -- LACP_Activity, B -- LACP_Timeout, C -- Aggregation,

D -- Synchronization, E -- Collecting, F -- Distributing,

G -- Defaulted, H -- Expired

Aggregate Interface: Route-Aggregation1

Aggregation Mode: Static

Loadsharing Type: Shar

Port Status Priority Oper-Key

--------------------------------------------------------------------------------

GE1/0/1 S 32768 1

GE1/0/2 S 32768 1

GE1/0/3 S 32768 1

The output shows that link aggregation group 1 is a Layer 3 static aggregation group that contains three Selected ports.

Layer 3 dynamic aggregation configuration example

Network requirements

On the network shown in Figure 10, perform the following tasks:

· Configure a Layer 3 dynamic aggregation group on both Device A and Device B.

· Configure IP addresses and subnet masks for the corresponding Layer 3 aggregate interfaces.

Figure 10 Network diagram

Configuration procedure

1. Configure Device A:

# Create Layer 3 aggregate interface Route-Aggregation 1.

<DeviceA> system-view

[DeviceA] interface route-aggregation 1

# Set the link aggregation mode to dynamic.

[DeviceA-Route-Aggregation1] link-aggregation mode dynamic

# Configure an IP address and subnet mask for Route-Aggregation 1.

[DeviceA-Route-Aggregation1] ip address 192.168.1.1 24

[DeviceA-Route-Aggregation1] quit

# Assign Layer 3 Ethernet interfaces GigabitEthernet 1/0/1 through GigabitEthernet 1/0/3 to aggregation group 1.

[DeviceA] interface gigabitethernet 1/0/1

[DeviceA-GigabitEthernet1/0/1] port link-aggregation group 1

[DeviceA-GigabitEthernet1/0/1] quit

[DeviceA] interface gigabitethernet 1/0/2

[DeviceA-GigabitEthernet1/0/2] port link-aggregation group 1

[DeviceA-GigabitEthernet1/0/2] quit

[DeviceA] interface gigabitethernet 1/0/3

[DeviceA-GigabitEthernet1/0/3] port link-aggregation group 1

[DeviceA-GigabitEthernet1/0/3] quit

2. Configure Device B in the same way Device A is configured. (Details not shown.)

Verifying the configuration

# Display detailed information about all aggregation groups on Device A.

[DeviceA] display link-aggregation verbose

Loadsharing Type: Shar -- Loadsharing, NonS -- Non-Loadsharing

Port Status: S -- Selected, U -- Unselected, I -- Individual

Flags: A -- LACP_Activity, B -- LACP_Timeout, C -- Aggregation,

D -- Synchronization, E -- Collecting, F -- Distributing,

G -- Defaulted, H -- Expired

Aggregate Interface: Route-Aggregation1

Aggregation Mode: Dynamic

Loadsharing Type: Shar

System ID: 0x8000, 000f-e267-6c6a

Local:

Port Status Priority Oper-Key Flag

--------------------------------------------------------------------------------

GE1/0/1 S 32768 1 {ACDEF}

GE1/0/2 S 32768 1 {ACDEF}

GE1/0/3 S 32768 1 {ACDEF}

Remote:

Actor Partner Priority Oper-Key SystemID Flag

--------------------------------------------------------------------------------

GE1/0/1 1 32768 1 0x8000, 000f-e267-57ad {ACDEF}

GE1/0/2 2 32768 1 0x8000, 000f-e267-57ad {ACDEF}

GE1/0/3 3 32768 1 0x8000, 000f-e267-57ad {ACDEF}

The output shows that link aggregation group 1 is a Layer 3 dynamic aggregation group that contains three Selected ports.

Layer 3 aggregation load sharing configuration example

Network requirements

On the network shown in Figure 11, perform the following tasks:

· Configure Layer 3 static aggregation groups 1 and 2 on Device A and Device B, respectively.

· Configure IP addresses and subnet masks for the corresponding Layer 3 aggregate interfaces.

· Configure link aggregation group 1 to load share packets based on source IP addresses.

· Configure link aggregation group 2 to load share packets based on destination IP addresses.

Figure 11 Network diagram

Configuration procedure

1. Configure Device A:

# Create Layer 3 aggregate interface Route-Aggregation 1.

<DeviceA> system-view

[DeviceA] interface route-aggregation 1

# Configure Layer 3 aggregation group 1 to load share packets based on source IP addresses.

[DeviceA-Route-Aggregation1] link-aggregation load-sharing mode source-ip

# Configure an IP address and subnet mask for Layer 3 aggregate interface Route-Aggregation 1.

[DeviceA-Route-Aggregation1] ip address 192.168.1.1 24

[DeviceA-Route-Aggregation1] quit

# Assign Layer 3 Ethernet interfaces GigabitEthernet 1/0/1 and GigabitEthernet 1/0/2 to aggregation group 1.

[DeviceA] interface gigabitethernet 1/0/1

[DeviceA-GigabitEthernet1/0/1] port link-aggregation group 1

[DeviceA-GigabitEthernet1/0/1] quit

[DeviceA] interface gigabitethernet 1/0/2

[DeviceA-GigabitEthernet1/0/2] port link-aggregation group 1

[DeviceA-GigabitEthernet1/0/2] quit

# Create Layer 3 aggregate interface Route-Aggregation 2.

[DeviceA] interface route-aggregation 2

# Configure Layer 3 aggregation group 2 to load share packets based on destination IP addresses.

[DeviceA-Route-Aggregation2] link-aggregation load-sharing mode destination-ip

# Configure an IP address and subnet mask for Layer 3 aggregate interface Route-Aggregation 2.

[DeviceA-Route-Aggregation2] ip address 192.168.2.1 24

[DeviceA-Route-Aggregation2] quit

# Assign Layer 3 Ethernet interfaces GigabitEthernet 1/0/3 and GigabitEthernet 1/0/4 to aggregation group 2.

[DeviceA] interface gigabitethernet 1/0/3

[DeviceA-GigabitEthernet1/0/3] port link-aggregation group 2

[DeviceA-GigabitEthernet1/0/3] quit

[DeviceA] interface gigabitethernet 1/0/4

[DeviceA-GigabitEthernet1/0/4] port link-aggregation group 2

[DeviceA-GigabitEthernet1/0/4] quit

2. Configure Device B in the same way Device A is configured. (Details not shown.)

Verifying the configuration

# Display detailed information about all aggregation groups on Device A.

[DeviceA] display link-aggregation verbose

Loadsharing Type: Shar -- Loadsharing, NonS -- Non-Loadsharing

Port Status: S -- Selected, U -- Unselected, I -- Individual

Flags: A -- LACP_Activity, B -- LACP_Timeout, C -- Aggregation,

D -- Synchronization, E -- Collecting, F -- Distributing,

G -- Defaulted, H -- Expired

Aggregate Interface: Route-Aggregation1

Aggregation Mode: Static

Loadsharing Type: Shar

Port Status Priority Oper-Key

--------------------------------------------------------------------------------

GE1/0/1 S 32768 1

GE1/0/2 S 32768 1

Aggregate Interface: Route-Aggregation2

Aggregation Mode: Static

Loadsharing Type: Shar

Port Status Priority Oper-Key

--------------------------------------------------------------------------------

GE1/0/3 S 32768 2

GE1/0/4 S 32768 2

The output shows that:

· Link aggregation groups 1 and 2 are both load-shared Layer 3 static aggregation groups.

· Each aggregation group contains two Selected ports.

# Display all the group-specific load sharing modes on Device A.

[DeviceA] display link-aggregation load-sharing mode interface

Route-Aggregation1 load-sharing mode:

source-ip address

Route-Aggregation2 load-sharing mode:

destination-ip address

The output shows that:

· Link aggregation group 1 load shares packets based on source IP addresses.

· Link aggregation group 2 load shares packets based on destination IP addresses.

Layer 3 edge aggregate interface configuration example

Network requirements

As shown in Figure 12, a Layer 3 dynamic aggregation group is configured on the device. The server is not configured with dynamic link aggregation.

Configure an edge aggregate interface so that both GigabitEthernet 1/0/1 and GigabitEthernet 1/0/2 can forward traffic to improve link reliability.

Figure 12 Network diagram

Configuration procedure

# Create Layer 3 aggregate interface Route-Aggregation 1, and set the link aggregation mode to dynamic.

<Device> system-view

[Device] interface route-aggregation 1

[Device-Route-Aggregation1] link-aggregation mode dynamic

# Configure an IP address and subnet mask for Layer 3 aggregate interface Route-Aggregation 1.

[Device-Route-Aggregation1] ip address 192.168.1.1 24

# Configure Layer 3 aggregate interface Route-Aggregation 1 as an edge aggregate interface.

[Device-Route-Aggregation1] lacp edge-port

[Device-Route-Aggregation1] quit

# Assign Layer 3 Ethernet interfaces GigabitEthernet 1/0/1 and GigabitEthernet 1/0/2 to aggregation group 1.

[Device] interface gigabitethernet 1/0/1

[Device-GigabitEthernet1/0/1] port link-aggregation group 1

[Device-GigabitEthernet1/0/1] quit

[Device] interface gigabitethernet 1/0/2

[Device-GigabitEthernet1/0/2] port link-aggregation group 1

[Device-GigabitEthernet1/0/2] quit

Verifying the configuration

# Display detailed information about all aggregation groups on the device when the server is not configured with dynamic link aggregation.

[Device] display link-aggregation verbose

Loadsharing Type: Shar -- Loadsharing, NonS -- Non-Loadsharing

Port Status: S -- Selected, U -- Unselected, I -- Individual

Flags: A -- LACP_Activity, B -- LACP_Timeout, C -- Aggregation,

D -- Synchronization, E -- Collecting, F -- Distributing,

G -- Defaulted, H -- Expired

Aggregate Interface: Route-Aggregation1

Aggregation Mode: Dynamic

Loadsharing Type: Shar

System ID: 0x8000, 000f-e267-6c6a

Local:

Port Status Priority Oper-Key Flag

--------------------------------------------------------------------------------

GE1/0/1 I 32768 1 {AG}

GE1/0/2 I 32768 1 {AG}

Remote:

Actor Partner Priority Oper-Key SystemID Flag

--------------------------------------------------------------------------------

GE1/0/1 0 32768 0 0x8000, 0000-0000-0000 {DEF}

GE1/0/2 0 32768 0 0x8000, 0000-0000-0000 {DEF}

Configuring port isolation

The port isolation feature isolates Layer 2 traffic for data privacy and security without using VLANs.

Ports in an isolation group cannot communicate with each other. However, they can communicate with ports outside the isolation group.

Feature and hardware compatibility

The port isolation feature is not supported on Layer 2 Ethernet ports of the following Ethernet switching modules:

· SIC-4FSW.

· SIC-4FSW-PoE.

Assigning a port to the isolation group

The device supports only one isolation group that is automatically created as isolation group 1. You cannot remove the isolation group or create other isolation groups on the device. The number of ports assigned to the isolation group is not limited.

To assign a port to the isolation group:

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Enter interface view.	· Enter Layer 2 Ethernet interface view: interface interface-type interface-number · Enter Layer 2 aggregate interface view: interface bridge-aggregation interface-number	· The configuration in Layer 2 Ethernet interface view applies only to the interface. · The configuration in Layer 2 aggregate interface view applies to the Layer 2 aggregate interface and its aggregation member ports. If the device fails to apply the configuration to the aggregate interface, it does not assign any aggregation member port to the isolation group. If the failure occurs on an aggregation member port, the device skips the port and continues to assign other aggregation member ports to the isolation group.
3. Assign the port to the isolation group.	port-isolate enable	By default, the port is not in the isolation group.

Displaying and maintaining port isolation

Execute display commands in any view.

Task	Command
Display port isolation group information.	display port-isolate group

Port isolation configuration example

Network requirements

As shown in Figure 13:

· LAN users Host A, Host B, and Host C are connected to GigabitEthernet 1/0/1, GigabitEthernet 1/0/2, and GigabitEthernet 1/0/3 on the device, respectively.

· The device connects to the Internet through GigabitEthernet 1/0/4.

Configure the device to provide Internet access for all the hosts, and isolate them from one another.

Figure 13 Network diagram

Configuration procedure

# Assign ports GigabitEthernet1/0/1, GigabitEthernet1/0/2, and GigabitEthernet1/0/3 to the isolation group.

<Device> system-view

[Device] interface gigabitethernet 1/0/1

[Device-GigabitEthernet1/0/1] port-isolate enable

[Device-GigabitEthernet1/0/1] quit

[Device] interface gigabitethernet 1/0/2

[Device-GigabitEthernet1/0/2] port-isolate enable

[Device-GigabitEthernet1/0/2] quit

[Device] interface gigabitethernet 1/0/3

[Device-GigabitEthernet1/0/3] port-isolate enable

[Device-GigabitEthernet1/0/3] quit

Verifying the configuration

# Display information about the isolation group.

[Device] display port-isolate group

Port isolation group information:

Group ID: 1

Group members:

GigabitEthernet1/0/1 GigabitEthernet1/0/2 GigabitEthernet1/0/3

The output shows that ports GigabitEthernet 1/0/1, GigabitEthernet 1/0/2, and GigabitEthernet 1/0/3 are assigned to the isolation group. As a result, Host A, Host B, and Host C are isolated from one another at Layer 2.

Configuring VLANs

Overview

Ethernet is a family of shared-media LAN technologies based on the CSMA/CD mechanism. An Ethernet LAN is both a collision domain and a broadcast domain. Because the medium is shared, collisions and broadcasts are common in an Ethernet LAN. Typically, bridges and Layer 2 switches can reduce collisions in an Ethernet LAN. To confine broadcasts, a Layer 2 switch must use the Virtual Local Area Network (VLAN) technology.

VLANs enable a Layer 2 switch to break a LAN down into smaller broadcast domains, as shown in Figure 14.

Figure 14 A VLAN diagram

A VLAN is logically divided on an organizational basis rather than on a physical basis. For example, you can assign all workstations and servers used by a particular workgroup to the same VLAN, regardless of their physical locations. Hosts in the same VLAN can directly communicate with one another. You need a router or a Layer 3 switch for hosts in different VLANs to communicate with one another.

All these VLAN features reduce bandwidth waste, improve LAN security, and enable flexible virtual group creation.

VLAN frame encapsulation

To identify Ethernet frames from different VLANs, IEEE 802.1Q inserts a four-byte VLAN tag between the destination and source MAC address (DA&SA) field and the Type field.

Figure 15 VLAN tag placement and format

A VLAN tag includes the following fields:

· TPID—16-bit tag protocol identifier that indicates whether a frame is VLAN-tagged. By default, the TPID value 0x8100 identifies a VLAN-tagged frame. A device vendor can set the TPID to a different value. For compatibility with a neighbor device, set the TPID value on the device to be the same as the neighbor device.

· Priority—3-bit long, identifies the 802.1p priority of the frame. For more information, see ACL and QoS Configuration Guide.

· CFI—1-bit long canonical format indicator that indicates whether the MAC addresses are encapsulated in the standard format when packets are transmitted across different media. Available values include:

? 0 (default)—The MAC addresses are encapsulated in the standard format.

? 1—The MAC addresses are encapsulated in a non-standard format.

This field is always set to 0 for Ethernet.

· VLAN ID—12-bit long, identifies the VLAN to which the frame belongs. The VLAN ID range is 0 to 4095. VLAN IDs 0 and 4095 are reserved, and VLAN IDs 1 to 4094 are user configurable.

The way a network device handles an incoming frame depends on whether the frame has a VLAN tag and the value of the VLAN tag (if any). For more information, see "Introduction."

Ethernet supports encapsulation formats Ethernet II, 802.3/802.2 LLC, 802.3/802.2 SNAP, and 802.3 raw. The Ethernet II encapsulation format is used here. For information about the VLAN tag fields in other frame encapsulation formats, see related protocols and standards.

For a frame that has multiple VLAN tags, the device handles it according to its outermost VLAN tag and transmits its inner VLAN tags as the payload.

Protocols and standards

IEEE 802.1Q, IEEE Standard for Local and Metropolitan Area Networks: Virtual Bridged Local Area Networks

Feature and hardware compatibility

This feature is supported only on the following ports:

· Layer 2 Ethernet ports on Ethernet switching modules.

· Fixed Layer 2 Ethernet ports of the following routers:

? MSR810/810-W/810-W-DB/810-LM/810-W-LM/810-10-PoE/810-LM-HK/810-W-LM-HK/810-LMS/810-LUS.

? MSR2600-6-X1/2600-10-X1.

? MSR3600-28/3600-51.

? MSR3600-28-SI/3600-51-SI.

? MSR810-LM-GL/810-W-LM-GL/830-6EI-GL/830-10EI-GL/830-6HI-GL/830-10HI-GL/2600-6-X1-GL/3600-28-SI-GL.

Configuring basic VLAN settings

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. (Optional.) Create a VLAN and enter its view, or create a list of VLANs.	vlan { vlan-id1 [ to vlan-id2 ] \| all }	By default, only the system default VLAN (VLAN 1) exists.
3. Enter VLAN view.	vlan vlan-id	To configure a VLAN after you create a list of VLANs, you must perform this step.
4. Set a name for the VLAN.	name text	By default, the name of a VLAN is VLAN vlan-id. The vlan-id argument specifies the VLAN ID in a four-digit format. If the VLAN ID has fewer than four digits, leading zeros are added. For example, the name of VLAN 100 is VLAN 0100.
5. Set the description for the VLAN.	description text	By default, the description of a VLAN is VLAN vlan-id. The vlan-id argument specifies the VLAN ID in a four-digit format. If the VLAN ID has fewer than four digits, leading zeros are added. For example, the default description of VLAN 100 is VLAN 0100.

NOTE:

· As the system default VLAN, VLAN 1 cannot be created or deleted.

· Before you delete a dynamic VLAN or a VLAN locked by an application, you must first remove the configuration from the VLAN.

Configuring VLAN interfaces

Hosts of different VLANs use VLAN interfaces to communicate at Layer 3. VLAN interfaces are virtual interfaces that do not exist as physical entities on devices. For each VLAN, you can create one VLAN interface and assign an IP address to it. The VLAN interface acts as the gateway of the VLAN to forward packets destined for another IP subnet at Layer 3.

Before you create a VLAN interface for a VLAN, create the VLAN first.

To configure basic settings of a VLAN interface:

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Create a VLAN interface and enter its view.	interface vlan-interface interface-number	If the VLAN interface already exists, you enter its view directly. By default, no VLAN interfaces exist.
3. Assign an IP address to the VLAN interface.	ip address ip-address { mask \| mask-length } [ sub ]	By default, no IP address is assigned to a VLAN interface.
4. Set the description for the VLAN interface.	description text	The default setting is the VLAN interface name. For example, Vlan-interface1 Interface.
5. (Optional.) Specify the primary traffic processing slot for the VLAN interface.	· Distributed devices in standalone mode/centralized devices in IRF mode: service slot slot-number · Distributed devices in IRF mode: service chassis chassis-number slot slot-number	By default, no primary traffic processing slot is specified for the VLAN interface.
6. (Optional.) Specify the backup traffic processing slot for the VLAN interface.	· Distributed devices in standalone mode/centralized devices in IRF mode: service standby slot slot-number · Distributed devices in IRF mode: service standby chassis chassis-number slot slot-number	By default, no backup traffic processing slot is specified for the VLAN interface.
7. Set the MTU for the VLAN interface.	mtu size	The default setting is 1500 bytes.
8. Set the expected bandwidth for the interface.	bandwidth bandwidth-value	By default, the expected bandwidth (in kbps) is the interface baud rate divided by 1000.
9. (Optional.) Restore the default settings for the VLAN interface.	default	N/A
10. (Optional.) Bring up the VLAN interface.	undo shutdown	N/A

Configuring port-based VLANs

Introduction

Port-based VLANs group VLAN members by port. A port forwards packets from a VLAN only after it is assigned to the VLAN.

Port link type

You can set the link type of a port to access, trunk, or hybrid. The port link type determines whether the port can be assigned to multiple VLANs. The link types use the following VLAN tag handling methods:

· Access—An access port can forward packets only from one VLAN and send these packets untagged. An access port is typically used in the following conditions:

? Connecting to a terminal device that does not support VLAN packets.

? In scenarios that do not distinguish VLANs.

· Trunk—A trunk port can forward packets from multiple VLANs. Except packets from the port VLAN ID (PVID), packets sent out of a trunk port are VLAN-tagged. Ports connecting network devices are typically configured as trunk ports.

· Hybrid—A hybrid port can forward packets from multiple VLANs. The tagging status of the packets forwarded by a hybrid port depends on the port configuration.

PVID

The PVID identifies the default VLAN of a port. Untagged packets received on a port are considered as the packets from the port PVID.

When you set the PVID for a port, follow these restrictions and guidelines:

· An access port can join only one VLAN. The VLAN to which the access port belongs is the PVID of the port.

· A trunk or hybrid port supports multiple VLANs and the PVID configuration.

· When you use the undo vlan command to delete the PVID of a port, either of the following events occurs depending on the port link type:

? For an access port, the PVID of the port changes to VLAN 1.

? For a hybrid or trunk port, the PVID setting of the port does not change.

You can use a nonexistent VLAN as the PVID for a hybrid or trunk port, but not for an access port.

· As a best practice, set the same PVID for a local port and its peer.

· To prevent a port from dropping untagged packets or PVID-tagged packets, assign the port to its PVID.

How ports of different link types handle frames

Actions	Access	Trunk	Hybrid
In the inbound direction for an untagged frame	Tags the frame with the PVID tag.	· If the PVID is permitted on the port, tags the frame with the PVID tag. · If not, drops the frame.
In the inbound direction for a tagged frame	· Receives the frame if its VLAN ID is the same as the PVID. · Drops the frame if its VLAN ID is different from the PVID.	· Receives the frame if its VLAN is permitted on the port. · Drops the frame if its VLAN is not permitted on the port.
In the outbound direction	Removes the VLAN tag and sends the frame.	· Removes the tag and sends the frame if the frame carries the PVID tag and the port belongs to the PVID. · Sends the frame without removing the tag if its VLAN is carried on the port but is different from the PVID.		Sends the frame if its VLAN is permitted on the port. The tagging status of the frame depends on the port hybrid vlan command configuration.

Assigning an access port to a VLAN

You can assign an access port to a VLAN in VLAN view or interface view.

Make sure the VLAN has been created.

Assign one or multiple access ports to a VLAN in VLAN view

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Enter VLAN view.	vlan vlan-id	N/A
3. Assign one or multiple access ports to the VLAN.	port interface-list	By default, all ports belong to VLAN 1.

Assign an access port to a VLAN in interface view

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Enter interface view.	· Enter Layer 2 Ethernet interface view: interface interface-type interface-number · Enter Layer 2 aggregate interface view: interface bridge-aggregation interface-number	N/A
3. Set the port link type to access.	port link-type access	By default, all ports are access ports.
4. (Optional.) Assign the access port to a VLAN.	port access vlan vlan-id	By default, all access ports belong to VLAN 1.

Assigning a trunk port to a VLAN

A trunk port supports multiple VLANs. You can assign it to a VLAN in interface view.

When you assign a trunk port to a VLAN, follow these restrictions and guidelines:

· To change the link type of a port from trunk to hybrid, set the link type to access first.

· To enable a trunk port to transmit packets from its PVID, you must assign the trunk port to the PVID by using the port trunk permit vlan command.

To assign a trunk port to one or multiple VLANs:

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Enter interface view.	· Enter Layer 2 Ethernet interface view: interface interface-type interface-number · Enter Layer 2 aggregate interface view: interface bridge-aggregation interface-number	N/A
3. Set the port link type to trunk.	port link-type trunk	By default, all ports are access ports.
4. Assign the trunk port to the specified VLANs.	port trunk permit vlan { vlan-id-list \| all }	By default, a trunk port permits only VLAN 1.
5. (Optional.) Set the PVID for the trunk port.	port trunk pvid vlan vlan-id	The default setting is VLAN 1.

Assigning a hybrid port to a VLAN

A hybrid port supports multiple VLANs. You can assign it to the specified VLANs in interface view. Make sure the VLANs have been created.

When you assign a hybrid port to a VLAN, follow these restrictions and guidelines:

· To change the link type of a port from trunk to hybrid, set the link type to access first.

· To enable a hybrid port to transmit packets from its PVID, you must assign the hybrid port to the PVID by using the port hybrid vlan command.

To assign a hybrid port to one or multiple VLANs:

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Enter interface view.	· Enter Layer 2 Ethernet interface view: interface interface-type interface-number · Enter Layer 2 aggregate interface view: interface bridge-aggregation interface-number	N/A
3. Set the port link type to hybrid.	port link-type hybrid	By default, all ports are access ports.
4. Assign the hybrid port to the specified VLANs.	port hybrid vlan vlan-id-list { tagged \| untagged }	By default, the hybrid port is an untagged member of the VLAN to which the port belongs when its link type is access.
5. (Optional.) Set the PVID for the hybrid port.	port hybrid pvid vlan vlan-id	By default, the PVID of a hybrid port is the ID of the VLAN to which the port belongs when its link type is access.

Configuring a VLAN group

A VLAN group includes a set of VLANs.

On an authentication server, a VLAN group name represents a group of authorization VLANs. When an 802.1X user passes authentication, the authentication server assigns a VLAN group name to the device. The device then uses the received VLAN group name to match the locally configured VLAN group names. If a match is found, the device selects a VLAN from the group and assigns the VLAN to the user. For more information about 802.1X authentication, see Security Configuration Guide.

To configure a VLAN group:

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Create a VLAN group and enter its view.	vlan-group group-name	By default, no VLAN groups exist.
3. Add VLANs to the VLAN group.	vlan-list vlan-id-list	By default, no VLANs exist in a VLAN group. You can add multiple VLAN lists to a VLAN group.

Displaying and maintaining VLAN s

Execute display commands in any view and reset commands in user view.

Task	Command
Display VLAN interface information.	display interface vlan-interface [ interface-number ] [ brief [ description \| down ] ]
Display VLAN information.	display vlan [ vlan-id1 [ to vlan-id2 ] \| all \| dynamic \| reserved \| static ]
Display brief VLAN information.	display vlan brief
Display VLAN group information.	display vlan-group [ group-name ]
Display hybrid ports or trunk ports on the device.	display port { hybrid \| trunk }
Clear statistics on a port.	reset counters interface vlan-interface [ interface-number ]

VLAN configuration example

Network requirements

As shown in Figure 16:

· Host A and Host C belong to Department A. VLAN 100 is assigned to Department A.

· Host B and Host D belong to Department B. VLAN 200 is assigned to Department B.

Configure port-based VLANs so that only hosts in the same department can communicate with each other.

Figure 16 Network diagram

Configuration procedure

1. Configure Device A:

# Create VLAN 100, and assign GigabitEthernet 1/0/1 to VLAN 100.

<DeviceA> system-view

[DeviceA] vlan 100

[DeviceA-vlan100] port gigabitethernet 1/0/1

[DeviceA-vlan100] quit

# Create VLAN 200, and assign GigabitEthernet 1/0/2 to VLAN 200.

[DeviceA] vlan 200

[DeviceA-vlan200] port gigabitethernet 1/0/2

[DeviceA-vlan200] quit

# Configure GigabitEthernet 1/0/3 as a trunk port, and assign the port to VLANs 100 and 200.

[DeviceA] interface gigabitethernet 1/0/3

[DeviceA-GigabitEthernet1/0/3] port link-type trunk

[DeviceA-GigabitEthernet1/0/3] port trunk permit vlan 100 200

Please wait... Done.

2. Configure Device B in the same way Device A is configured. (Details not shown.)

3. Configure hosts:

a. Configure Host A and Host C to be on the same IP subnet. For example, 192.168.100.0/24.

b. Configure Host B and Host D to be on the same IP subnet. For example, 192.168.200.0/24.

Verifying the configuration

# Verify that Host A and Host C can ping each other, but they both fail to ping Host B and Host D. (Details not shown.)

# Verify that Host B and Host D can ping each other, but they both fail to ping Host A and Host C. (Details not shown.)

# Verify that VLANs 100 and 200 are correctly configured on Device A.

[DeviceA-GigabitEthernet1/0/3] display vlan 100

VLAN ID: 100

VLAN type: Static

Route interface: Not configured

Description: VLAN 0100

Name: VLAN 0100

Tagged ports:

GigabitEthernet1/0/3

Untagged ports:

GigabitEthernet1/0/1

[DeviceA-GigabitEthernet1/0/3] display vlan 200

VLAN ID: 200

VLAN type: Static

Route interface: Not configured

Description: VLAN 0200

Name: VLAN 0200

Tagged ports:

GigabitEthernet1/0/3

Untagged ports:

GigabitEthernet1/0/2

Configuring super VLANs

Overview

Hosts in a VLAN typically use IP addresses in the same subnet. For Layer 3 interoperability with other VLANs, you can create a VLAN interface for the VLAN and assign an IP address to it. This requires a large number of IP addresses.

The super VLAN feature was introduced to save IP addresses. A super VLAN is associated with multiple sub-VLANs. These sub-VLANs use the VLAN interface of the super VLAN (also known as a super VLAN interface) as the gateway for Layer 3 communication.

You can create a VLAN interface for a super VLAN and assign an IP address to it. However, you cannot create a VLAN interface for a sub-VLAN. You can assign a physical port to a sub-VLAN, but you cannot assign a physical port to a super VLAN. Sub-VLANs are isolated at Layer 2.

To enable Layer 3 communication between sub-VLANs, perform the following tasks:

1. Create a super VLAN and the VLAN interface for the super VLAN.

2. Enable local proxy ARP or ND on the super VLAN interface as follows:

? In an IPv4 network, enable local proxy ARP on the super VLAN interface. The super VLAN can then process ARP requests and replies sent from the sub-VLANs.

? In an IPv6 network, enable local proxy ND on the super VLAN interface. The super VLAN can then process the NS and NA messages sent from the sub-VLANs.

Feature and hardware compatibility

This feature is supported only on the following ports:

· Layer 2 Ethernet ports on Ethernet switching modules.

· Fixed Layer 2 Ethernet ports of the following routers:

? MSR810/810-W/810-W-DB/810-LM/810-W-LM/810-10-PoE/810-LM-HK/810-W-LM-HK.

? MSR2600-6-X1/2600-10-X1.

? MSR3600-28/3600-51.

? MSR3600-28-SI/3600-51-SI.

? MSR810-LM-GL/810-W-LM-GL/830-6EI-GL/830-10EI-GL/830-6HI-GL/830-10HI-GL/2600-6-X1-GL/3600-28-SI-GL.

Super VLAN configuration task list

Tasks at a glance
(Required.) Creating a sub-VLAN
(Required.) Configuring a super VLAN
(Required.) Configuring a super VLAN interface

Creating a sub-VLAN

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Create a sub-VLAN.	vlan vlan-id	By default, only the system default VLAN (VLAN 1) exists.

Configuring a super VLAN

When you configure a super VLAN, follow these restrictions and guidelines:

· Do not configure a VLAN as both a super VLAN and a guest VLAN, Auth-Fail VLAN, or critical VLAN. For more information about guest VLANs, Auth-Fail VLANs, and critical VLANs, see Security Configuration Guide.

· Do not configure a VLAN as both a super VLAN and a sub-VLAN.

· Layer 2 multicast configuration for super VLANs does not take effect because they do not have physical ports.

To configure a super VLAN:

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Enter VLAN view.	vlan vlan-id	N/A
3. Configure the VLAN as a super VLAN.	supervlan	By default, a VLAN is not a super VLAN.
4. Associate the super VLAN with the sub-VLANs.	subvlan vlan-id-list	By default, a super VLAN is not associated with any sub-VLANs. Make sure the sub-VLANs already exist before associating them with a super VLAN.

Configuring a super VLAN interface

As a best practice, do not configure VRRP for a super VLAN interface because the configuration affects network performance. For more information about VRRP, see High Availability Configuration Guide.

To configure a VLAN interface for a super VLAN:

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Create a VLAN interface and enter its view.	interface vlan-interface interface-number	The value for the interface-number argument must be the super VLAN ID.
3. Configure an IP address for the super VLAN interface.	· Configure an IPv4 address: ip address ip-address { mask-length \| mask } [ sub ] · Configure an IPv6 address: ipv6 address { ipv6-address prefix-length \| ipv6-address/prefix-length }	By default, no IP address is configured for a VLAN interface.
4. Configure Layer 3 communication between sub-VLANs.	· Enable local proxy ARP for devices that run IPv4 protocols: local-proxy-arp enable · Enable local proxy ND for devices that run IPv6 protocols: local-proxy-nd enable	By default: · Sub-VLANs cannot communicate with each other at Layer 3. · Local proxy ARP or ND is disabled. For more information about local proxy ARP and ND, see Layer 3—IP Services Configuration Guide. For more information about local-proxy-arp enable and local-proxy-nd enable commands, see Layer 3—IP Services Command Reference.

Displaying and maintaining super VLANs

Execute display commands in any view.

Task	Command
Display information about super VLANs and their associated sub-VLANs.	display supervlan [ supervlan-id ]

Super VLAN configuration example

Network requirements

As shown in Figure 17:

· GigabitEthernet 1/0/1 and GigabitEthernet 1/0/2 are in VLAN 2.

· GigabitEthernet 1/0/3 and GigabitEthernet 1/0/4 are in VLAN 3.

· GigabitEthernet 1/0/5 and GigabitEthernet 1/0/6 are in VLAN 5.

To save IP addresses and enable sub-VLANs to be isolated at Layer 2 but interoperable at Layer 3, perform the following tasks:

· Create a super VLAN and assign an IP address to its VLAN interface.

· Associate the super VLAN with VLANs 2, 3, and 5.

Figure 17 Network diagram

Configuration procedure

# Create VLAN 10.

<DeviceA> system-view

[DeviceA] vlan 10

[DeviceA-vlan10] quit

# Create VLAN-interface 10, and assign the IP address 10.1.1.1/24 to it.

[DeviceA] interface vlan-interface 10

[DeviceA-Vlan-interface10] ip address 10.1.1.1 255.255.255.0

# Enable local proxy ARP.

[DeviceA-Vlan-interface10] local-proxy-arp enable

[DeviceA-Vlan-interface10] quit

# Create VLAN 2, and assign GigabitEthernet 1/0/1 and GigabitEthernet 1/0/2 to the VLAN.

[DeviceA] vlan 2

[DeviceA-vlan2] port gigabitethernet 1/0/1 gigabitethernet 1/0/2

[DeviceA-vlan2] quit

# Create VLAN 3, and assign GigabitEthernet 1/0/3 and GigabitEthernet 1/0/4 to the VLAN.

[DeviceA] vlan 3

[DeviceA-vlan3] port gigabitethernet 1/0/3 gigabitethernet 1/0/4

[DeviceA-vlan3] quit

# Create VLAN 5, and assign GigabitEthernet 1/0/5 and GigabitEthernet 1/0/6 to the VLAN.

[DeviceA] vlan 5

[DeviceA-vlan5] port gigabitethernet 1/0/5 gigabitethernet 1/0/6

[DeviceA-vlan5] quit

# Configure VLAN 10 as a super VLAN, and associate sub-VLANs 2, 3, and 5 with the super VLAN.

[DeviceA] vlan 10

[DeviceA-vlan10] supervlan

[DeviceA-vlan10] subvlan 2 3 5

[DeviceA-vlan10] quit

[DeviceA] quit

Verifying the configuration

# Display information about super VLAN 10 and its associated sub-VLANs.

<DeviceA> display supervlan

Super VLAN ID: 10

Sub-VLAN ID: 2-3 5

VLAN ID: 10

VLAN type: Static

It is a super VLAN.

Route interface: Configured

IPv4 address: 10.1.1.1

IPv4 subnet mask: 255.255.255.0

Description: VLAN 0010

Name: VLAN 0010

Tagged ports: None

Untagged ports: None

VLAN ID: 2

VLAN type: Static

It is a sub VLAN.

Route interface: Configured

IPv4 address: 10.1.1.1

IPv4 subnet mask: 255.255.255.0

Description: VLAN 0002

Name: VLAN 0002

Tagged ports: None

Untagged ports:

GigabitEthernet1/0/1 GigabitEthernet1/0/2

VLAN ID: 3

VLAN type: Static

It is a sub VLAN.

Route interface: Configured

IPv4 address: 10.1.1.1

IPv4 subnet mask: 255.255.255.0

Description: VLAN 0003

Name: VLAN 0003

Tagged ports: None

Untagged ports:

GigabitEthernet1/0/3 GigabitEthernet1/0/4

VLAN ID: 5

VLAN type: Static

It is a sub VLAN.

Route interface: Configured

IPv4 address: 10.1.1.1

IPv4 subnet mask: 255.255.255.0

Description: VLAN 0005

Name: VLAN 0005

Tagged ports: None

Untagged ports:

GigabitEthernet1/0/5 GigabitEthernet1/0/6

Configuring voice VLANs

Overview

A voice VLAN is used for transmitting voice traffic. The device can configure QoS parameters for voice packets to ensure higher transmission priority of the voice packets.

Common voice devices include IP phones and integrated access devices (IADs). This chapter uses IP phones as an example.

For an IP phone to access a device, the device must perform the following operations:

1. Identify the IP phone in the network and obtain the MAC address of the IP phone.

2. Advertise the voice VLAN information to the IP phone.

After receiving the voice VLAN information, the IP phone performs automatic configuration. Voice packets sent from the IP phone can then be transmitted within the voice VLAN.

Feature and hardware compatibility

This feature is supported only on the following ports:

· Layer 2 Ethernet ports on the following modules:

? HMIM-8GSW.

? HMIM-8GSWF.

? HMIM-24GSW.

? HMIM-24GSW-PoE.

? SIC-4GSW.

? SIC-4GSW-PoE.

· Fixed Layer 2 Ethernet ports on the following routers:

? MSR810/810-W/810-W-DB/810-LM/810-W-LM/810-10-PoE/810-LM-HK/810-W-LM-HK.

? MSR2600-6-X1/2600-10-X1.

? MSR3600-28/3600-51.

? MSR3600-28-SI/3600-51-SI.

? MSR810-LM-GL/810-W-LM-GL/830-6EI-GL/830-10EI-GL/830-6HI-GL/830-10HI-GL/2600-6-X1-GL/3600-28-SI-GL.

Methods of identifying IP phones

Devices can use the OUI addresses or LLDP to identify IP phones.

Identifying IP phones through OUI addresses

A device identifies voice packets based on their source MAC addresses. A packet whose source MAC address complies with an Organizationally Unique Identifier (OUI) address of the device is regarded as a voice packet.

You can use system default OUI addresses (see Table 6) or configure OUI addresses for the device. You can manually remove or add the system default OUI addresses.

Table 6 Default OUI addresses

Number	OUI address	Vendor
1	0001-E300-0000		Siemens phone
2	0003-6B00-0000		Cisco phone
3	0004-0D00-0000		Avaya phone
4	000F-E200-0000		H3C Aolynk phone
5	0060-B900-0000		Philips/NEC phone
6	00D0-1E00-0000		Pingtel phone
7	00E0-7500-0000		Polycom phone
8	00E0-BB00-0000		3Com phone

Typically, an OUI address refers to the first 24 bits of a MAC address (in binary notation) and is a globally unique identifier that IEEE assigns to a vendor. However, OUI addresses in this chapter are addresses that the system uses to identify voice packets. They are the logical AND results of the mac-address and oui-mask arguments in the voice-vlan mac-address command.

Automatically identifying IP phones through LLDP

If IP phones support LLDP, configure LLDP for automatic IP phone discovery on the device. The device can then automatically discover the peer through LLDP, and exchange LLDP TLVs with the peer.

If the LLDP System Capabilities TLV received on a port indicates that the peer can act as a telephone, the device performs the following operations:

1. Sends an LLDP TLV with the voice VLAN configuration to the peer.

2. Assigns the receiving port to the voice VLAN.

3. Increases the transmission priority of the voice packets sent from the IP phone.

4. Adds the MAC address of the IP phone to the MAC address table to ensure that the IP phone can pass authentication.

Use LLDP instead of the OUI list to identify IP phones if the network has more IP phone categories than the maximum number of OUI addresses supported on the device. LLDP has higher priority than the OUI list.

For more information about LLDP, see "Configuring LLDP."

Advertising the voice VLAN information to IP phones

The device can use one of the following methods to advertise the voice VLAN information to an IP phone:

· Advertise the voice VLAN ID to the IP phone if LLDP is configured for the voice VLAN.

· Advertise the authorization VLAN to the IP phone if the IP phone is used with access authentication.

· Advertise the voice VLAN that is configured on the port to the IP phone.

Figure 18 shows the workflow of advertising the voice VLAN information to IP phones.

Figure 18 Workflow of advertising the voice VLAN information to IP phones

IP phone access methods

Connecting the host and the IP phone in series

As shown in Figure 19, the host is connected to the IP phone, and the IP phone is connected to the device. In this scenario, the following requirements must be met:

· The host and the IP phone use different VLANs.

· The IP phone is able to send out VLAN-tagged packets, so that the device can differentiate traffic from the host and the IP phone.

· The port connecting to the IP phone forwards packets from the voice VLAN and the PVID.

Figure 19 Connecting the host and IP phone in series

Connecting the IP phone to the device

As shown in Figure 20, IP phones are connected to the device without the presence of the host. Use this connection method when IP phones sends out untagged voice packets. In this scenario, you must configure the voice VLAN as the PVID of the access port of the IP phone, and configure the port to forward the packets from the PVID.

Figure 20 Connecting the IP phone to the device

Voice VLAN assignment modes

A port can be assigned to a voice VLAN automatically or manually.

Automatic mode

Use automatic mode when PCs and IP phones are connected in series to access the network through the device, as shown in Figure 19. Ports on the device transmit both voice traffic and data traffic.

When an IP phone is powered on, it sends out protocol packets. After receiving these protocol packets, the device uses the source MAC address of the protocol packets to match its OUI addresses. If the match succeeds, the device performs the following operations:

· Assigns the receiving port of the protocol packets to the voice VLAN.

· Issues ACL rules to set the packet precedence.

· Starts the voice VLAN aging timer.

If no voice packet is received from the port before the aging timer expires, the device will remove the port from the voice VLAN. The aging timer is also configurable.

When the IP phone reboots, the port is reassigned to the voice VLAN to ensure the correct operation of the existing voice connections. The reassignment occurs automatically without being triggered by voice traffic as long as the voice VLAN operates correctly.

Manual mode

Use manual mode when only IP phones access the network through the device, as shown in Figure 20. In this mode, ports are assigned to a voice VLAN that transmits voice traffic exclusively. No data traffic affects the voice traffic transmission.

You must manually assign the port that connects to the IP phone to a voice VLAN. The device uses the source MAC address of the received voice packets to match its OUI addresses. If the match succeeds, the device issues ACL rules to set the packet precedence.

To remove the port from the voice VLAN, you must manually remove it.

Cooperation of voice VLAN assignment modes and IP phones

Some IP phones send out VLAN-tagged packets, and others send out only untagged packets. For correct packet processing, ports of different link types must meet specific configuration requirements in different voice VLAN assignment modes.

Access ports do not transmit tagged packets.

Table 7 Configuration requirements for trunk and hybrid ports to support tagged voice traffic

Port link type	Voice VLAN assignment mode	Configuration requirements
Trunk	Automatic	The PVID of the port cannot be the voice VLAN.
Trunk	Manual	The PVID of the port cannot be the voice VLAN. The port must forward packets from the voice VLAN.
Hybrid	Automatic	The PVID of the port cannot be the voice VLAN.
Hybrid	Manual	The PVID of the port cannot be the voice VLAN. The port must forward packets from the voice VLAN with VLAN tags.

When IP phones send out untagged packets, you must set the voice VLAN assignment mode to manual.

Table 8 Configuration requirements for ports in manual mode to support untagged voice traffic

Port link type	Configuration requirements
Access	The voice VLAN must be the PVID of the port.
Trunk	The voice VLAN must be the PVID of the port. The port must forward packets from the voice VLAN.
Hybrid	The voice VLAN must be the PVID of the port. The port must forward packets from the voice VLAN without VLAN tags.

If an IP phone sends out tagged voice traffic, and its access port is configured with 802.1X authentication, guest VLAN, Auth-Fail VLAN, or critical VLAN, VLAN IDs must be different for the following VLANs:

· Voice VLAN.

· PVID of the access port.

· 802.1X guest, Auth-Fail, or critical VLAN.

If an IP phone sends out untagged voice traffic, the PVID of the access port must be the voice VLAN. In this scenario, 802.1X authentication is not supported.

Security mode and normal mode of voice VLANs

Depending on the filtering mechanisms to incoming packets, a voice VLAN-enabled port can operate in one of the following modes:

· Normal mode—The port receives voice-VLAN-tagged packets and forwards them in the voice VLAN without examining their MAC addresses. If the PVID of the port is the voice VLAN and the port operates in manual VLAN assignment mode, the port forwards all the received untagged packets in the voice VLAN.

In this mode, voice VLANs are vulnerable to traffic attacks. Malicious users might send a large number of forged voice-VLAN-tagged or untagged packets to affect voice communication.

· Security mode—The port uses the source MAC addresses of voice packets to match the OUI addresses of the device. Packets that fail the match will be dropped.

In a safe network, you can configure the voice VLANs to operate in normal mode. This mode reduces system resource consumption in source MAC address checking.

In either mode, the device modifies the transmission priority only for voice VLAN packets whose source MAC addresses match OUI addresses of the device.

As a best practice, do not transmit both voice traffic and non-voice traffic in a voice VLAN. If you must transmit different traffic in a voice VLAN, make sure the voice VLAN security mode is disabled.

Table 9 Packet processing on a voice VLAN-enabled port in normal or security mode

Voice VLAN mode	Packet type	Packet processing
Normal	· Untagged packets · Packets with the voice VLAN tags	The port does not examine their source MAC addresses. Both voice traffic and non-voice traffic can be transmitted in the voice VLAN.
Normal	Packets with other VLAN tags	The port forwards or drops them depending on whether the port permits packets from these VLANs to pass through.
Security	· Untagged packets · Packets with the voice VLAN tags	· If the source MAC address of a packet matches an OUI address on the device, the packet is forwarded in the voice VLAN. · If the source MAC address of a packet does not match an OUI address on the device, the packet is dropped.
Security	Packets with other VLAN tags	The port forwards or drops them depending on whether the port permits packets from these VLANs to pass through.

Voice VLAN configuration task list

Tasks at a glance
(Required.) Use one of the following methods: · Configuring a port to operate in automatic voice VLAN assignment mode · Configuring a port to operate in manual voice VLAN assignment mode
(Optional.) Enabling LLDP for automatic IP phone discovery
(Optional.) Configuring LLDP to advertise a voice VLAN

Configuring a port to operate in automatic voice VLAN assignment mode

Configuration restrictions and guidelines

When you configure a port to operate in automatic voice VLAN assignment mode, follow these restrictions and guidelines:

· As a best practice, do not use this mode with MSTP. In MSTP mode, if a port is blocked in the MSTI of the target voice VLAN, the port drops the received packets instead of delivering them to the CPU. As a result, the port will not be dynamically assigned to the voice VLAN.

· As a best practice, do not use this mode with PVST. In PVST mode, if the target voice VLAN is not permitted on a port, the port is placed in blocked state. The port drops the received packets instead of delivering them to the CPU. As a result, the port will not be dynamically assigned to the voice VLAN.

Configuration procedure

To configure a port to operate in automatic voice VLAN assignment mode:

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. (Optional.) Set the voice VLAN aging timer.	voice-vlan aging minutes	By default, the aging timer of a voice VLAN is 1440 minutes. The voice VLAN aging timer takes effect only on ports in automatic voice VLAN assignment mode.
3. (Optional.) Enable the voice VLAN security mode.	voice-vlan security enable	By default, the voice VLAN security mode is enabled.
4. (Optional.) Add an OUI address for voice packet identification.	voice-vlan mac-address oui mask oui-mask [ description text ]	By default, system default OUI addresses exist. For more information, see Table 6.
5. Enter Layer 2 Ethernet interface view.	interface interface-type interface-number	N/A
6. Configure the link type of the port.	· port link-type trunk · port link-type hybrid	N/A
7. Configure the port to operate in automatic voice VLAN assignment mode.	voice-vlan mode auto	By default, the automatic voice VLAN assignment mode is enabled.
8. Enable the voice VLAN feature on the port.	voice-vlan vlan-id enable	By default, the voice VLAN feature is disabled. Before you execute this command, make sure the specified VLAN already exists.

Configuring a port to operate in manual voice VLAN assignment mode

Configuration restrictions and guidelines

When you configure a port to operate in manual voice VLAN assignment mode, follow these restrictions and guidelines:

· You can configure different voice VLANs for different ports on the same device. Make sure the following requirements are met:

? One port can be configured with only one voice VLAN.

? Voice VLANs must be existing static VLANs.

· Do not enable voice VLAN on the member ports of a link aggregation group. For more information about link aggregation, see "Configuring Ethernet link aggregation."

· To make a voice VLAN take effect on a port operating in manual mode, you must manually assign the port to the voice VLAN.

Configuration procedure

To configure a port to operate in manual voice VLAN assignment mode:

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. (Optional.) Enable the voice VLAN security mode.	voice-vlan security enable	By default, the voice VLAN security mode is enabled.
3. (Optional.) Add an OUI address for voice packet identification.	voice-vlan mac-address oui mask oui-mask [ description text ]	By default, system default OUI addresses exist. For more information, see Table 6.
4. Enter Layer 2 Ethernet interface view.	interface interface-type interface-number	N/A
5. Configure the port to operate in manual voice VLAN assignment mode.	undo voice-vlan mode auto	By default, a port operates in automatic voice VLAN assignment mode.
6. Assign the access, trunk, or hybrid port to the voice VLAN.	· For the access port, see "Assigning an access port to a VLAN." · For the trunk port, see "Assigning a trunk port to a VLAN." · For the hybrid port, see "Assigning a hybrid port to a VLAN."	After you assign an access port to the voice VLAN, the voice VLAN becomes the PVID of the port.
7. (Optional.) Configure the voice VLAN as the PVID of the trunk or hybrid port.	· For the trunk port, see "Assigning a trunk port to a VLAN." · For the hybrid port, see "Assigning a hybrid port to a VLAN."	This step is required for untagged incoming voice traffic and prohibited for tagged incoming voice traffic.
8. Enable the voice VLAN feature on the port.	voice-vlan vlan-id enable	By default, the voice VLAN feature is disabled. Before you execute this command, make sure the specified VLAN already exists.

Enabling LLDP for automatic IP phone discovery

Configuration restrictions and guidelines

When you enable LLDP for automatic IP phone discovery, following these restrictions and guidelines:

· Before you enable this feature, enable LLDP both globally and on access ports.

· Use this feature only with the automatic voice VLAN assignment mode.

· The maximum of IP phones that can be connected to each port of the device depends on the device model.

Configuration procedure

To enable LLDP for automatic IP phone discovery:

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Enable LLDP for automatic IP phone discovery.	voice-vlan track lldp	By default, this feature is disabled.

Configuring LLDP to advertise a voice VLAN

For IP phones that support LLDP, the device advertises the voice VLAN information to the IP phones through the LLDP-MED TLVs.

Before you configure this feature, enable LLDP both globally and on access ports.

To configure LLDP to advertise a voice VLAN:

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Enter Layer 2 Ethernet interface view.	interface interface-type interface-number	N/A
3. Configure an advertised voice VLAN ID.	lldp tlv-enable med-tlv network-policy vlan-id	By default, no advertised voice VLAN ID is configured. For more information about the command, see Layer 2—LAN Switching Command Reference.
4. (Optional.) Display the voice VLAN advertised by LLDP.	display lldp local-information	For more information about the command, see Layer 2—LAN Switching Command Reference.

Displaying and maintaining voice VLANs

Execute display commands in any view.

Task	Command
Display the voice VLAN state.	display voice-vlan state
Display OUI addresses on a device.	display voice-vlan mac-address

Voice VLAN configuration examples

Automatic voice VLAN assignment mode configuration example

Network requirements

As shown in Figure 21, Device A transmits traffic from IP phones and hosts.

For correct voice traffic transmission, perform the following tasks on Device A:

· Configure voice VLANs 2 and 3 to transmit voice packets from IP phone A and IP phone B, respectively.

· Configure GigabitEthernet 1/0/1 and GigabitEthernet 1/0/2 to operate in automatic voice VLAN assignment mode.

· Add MAC addresses of IP phones A and B to the device for voice packet identification. The mask of the two MAC addresses is FFFF-FF00-0000.

· Set an aging timer for voice VLANs.

Figure 21 Network diagram

Configuration procedure

1. Configure voice VLANs:

# Create VLANs 2 and 3.

<DeviceA> system-view

[DeviceA] vlan 2 to 3

# Set the voice VLAN aging timer to 30 minutes.

[DeviceA] voice-vlan aging 30

# Enable security mode for voice VLANs.

[DeviceA] voice-vlan security enable

# Add MAC addresses of IP phones A and B to the device with the mask FFFF-FF00-0000.

[DeviceA] voice-vlan mac-address 0011-1100-0001 mask ffff-ff00-0000 description IP phone A

[DeviceA] voice-vlan mac-address 0011-2200-0001 mask ffff-ff00-0000 description IP phone B

2. Configure GigabitEthernet 1/0/1:

# Configure GigabitEthernet 1/0/1 as a hybrid port.

[DeviceA] interface gigabitethernet 1/0/1

[DeviceA-GigabitEthernet1/0/1] port link-type hybrid

# Configure GigabitEthernet 1/0/1 to operate in automatic voice VLAN assignment mode.

[DeviceA-GigabitEthernet1/0/1] voice-vlan mode auto

# Enable voice VLAN on GigabitEthernet 1/0/1 and configure VLAN 2 as the voice VLAN for it.

[DeviceA-GigabitEthernet1/0/1] voice-vlan 2 enable

[DeviceA-GigabitEthernet1/0/1] quit

3. Configure GigabitEthernet 1/0/2:

# Configure GigabitEthernet 1/0/2 as a hybrid port.

[DeviceA] interface gigabitethernet 1/0/2

[DeviceA-GigabitEthernet1/0/2] port link-type hybrid

# Configure GigabitEthernet 1/0/2 to operate in automatic voice VLAN assignment mode.

[DeviceA-GigabitEthernet1/0/2] voice-vlan mode auto

# Enable voice VLAN on GigabitEthernet 1/0/2 and configure VLAN 3 as the voice VLAN for it.

[DeviceA-GigabitEthernet1/0/2] voice-vlan 3 enable

[DeviceA-GigabitEthernet1/0/2] quit

Verifying the configuration

# Display the OUI addresses and their masks and descriptions.

[DeviceA] display voice-vlan mac-address

OUI Address Mask Description

0001-e300-0000 ffff-ff00-0000 Siemens phone

0003-6b00-0000 ffff-ff00-0000 Cisco phone

0004-0d00-0000 ffff-ff00-0000 Avaya phone

000f-e200-0000 ffff-ff00-0000 H3C Aolynk phone

0011-1100-0000 ffff-ff00-0000 IP phone A

0011-2200-0000 ffff-ff00-0000 IP phone B

0060-b900-0000 ffff-ff00-0000 Philips/NEC phone

00d0-1e00-0000 ffff-ff00-0000 Pingtel phone

00e0-7500-0000 ffff-ff00-0000 Polycom phone

00e0-bb00-0000 ffff-ff00-0000 3Com phone

# Display the voice VLAN state.

[DeviceA] display voice-vlan state

Current voice VLANs: 2

Voice VLAN security mode: Security

Voice VLAN aging time: 30 minutes

Voice VLAN enabled ports and their modes:

Port VLAN Mode CoS DSCP

GE1/0/1 2 AUTO 6 46

GE1/0/2 3 AUTO 6 46

Manual voice VLAN assignment mode configuration example

Network requirements

As shown in Figure 22, IP phone A send untagged voice traffic.

To enable GigabitEthernet 1/0/1 to transmit only voice packets, perform the following tasks on Device A:

· Create VLAN 2. This VLAN will be used as a voice VLAN.

· Configure GigabitEthernet 1/0/1 to operate in manual voice VLAN assignment mode and add it to VLAN 2.

· Add the OUI address of IP phone A to the OUI list of Device A.

Figure 22 Network diagram

Configuration procedure

# Enable security mode for voice VLANs.

<DeviceA> system-view

[DeviceA] voice-vlan security enable

# Add a MAC address 0011-2200-0001 with the mask FFFF-FF00-0000.

[DeviceA] voice-vlan mac-address 0011-2200-0001 mask ffff-ff00-0000 description test

# Create VLAN 2.

[DeviceA] vlan 2

[DeviceA-vlan2] quit

# Configure GigabitEthernet 1/0/1 to operate in manual voice VLAN assignment mode.

[DeviceA] interface gigabitethernet 1/0/1

[DeviceA-GigabitEthernet1/0/1] undo voice-vlan mode auto

# Configure GigabitEthernet 1/0/1 as a hybrid port.

[DeviceA-GigabitEthernet1/0/1] port link-type hybrid

# Set the PVID of GigabitEthernet 1/0/1 to VLAN 2.

[DeviceA-GigabitEthernet1/0/1] port hybrid pvid vlan 2

# Assign GigabitEthernet 1/0/1 to VLAN 2 as an untagged VLAN member.

[DeviceA-GigabitEthernet1/0/1] port hybrid vlan 2 untagged

# Enable voice VLAN and configure VLAN 2 as the voice VLAN on GigabitEthernet 1/0/1.

[DeviceA-GigabitEthernet1/0/1] voice-vlan 2 enable

[DeviceA-GigabitEthernet1/0/1] quit

Verifying the configuration

# Display the OUI addresses and their masks and descriptions.

[DeviceA] display voice-vlan mac-address

OUI Address Mask Description

0001-e300-0000 ffff-ff00-0000 Siemens phone

0003-6b00-0000 ffff-ff00-0000 Cisco phone

0004-0d00-0000 ffff-ff00-0000 Avaya phone

000f-e200-0000 ffff-ff00-0000 H3C Aolynk phone

0011-2200-0000 ffff-ff00-0000 test

0060-b900-0000 ffff-ff00-0000 Philips/NEC phone

00d0-1e00-0000 ffff-ff00-0000 Pingtel phone

00e0-7500-0000 ffff-ff00-0000 Polycom phone

00e0-bb00-0000 ffff-ff00-0000 3Com phone

# Display the voice VLAN state.

[DeviceA] display voice-vlan state

Current voice VLANs: 1

Voice VLAN security mode: Security

Voice VLAN aging time: 1440 minutes

Voice VLAN enabled ports and their modes:

Port VLAN Mode CoS DSCP

GE1/0/1 2 MANUAL 6 46

Configuring QinQ

This document uses the following terms:

· CVLAN—Customer network VLANs, also called inner VLANs, refer to VLANs that a customer uses on the private network.

· SVLAN—Service provider network VLANs, also called outer VLANs, refer to VLANs that a service provider uses to transmit VLAN tagged traffic for customers.

Overview

802.1Q-in-802.1Q (QinQ) adds an 802.1Q tag to 802.1Q tagged customer traffic. It enables a service provider to extend Layer 2 connections across an Ethernet network between customer sites.

QinQ provides the following benefits:

· Enables a service provider to use a single SVLAN to convey multiple CVLANs for a customer.

· Enables customers to plan CVLANs without conflicting with SVLANs.

· Enables customers to keep their VLAN assignment schemes unchanged when the service provider changes its VLAN assignment scheme.

· Allows different customers to use overlapping CVLAN IDs. Devices in the service provider network make forwarding decisions based on SVLAN IDs instead of CVLAN IDs.

How QinQ works

As shown in Figure 23, a QinQ frame transmitted over the service provider network carries the following tags:

· CVLAN tag—Identifies the VLAN to which the frame belongs when it is transmitted in the customer network.

· SVLAN tag—Identifies the VLAN to which the QinQ frame belongs when it is transmitted in the service provider network. The service provider allocates the SVLAN tag to the customer.

The devices in the service provider network forward a tagged frame according to its SVLAN tag only. The CVLAN tag is transmitted as part of the frame's payload.

Figure 23 Single-tagged Ethernet frame header and double-tagged Ethernet frame header

As shown in Figure 24, customer A has remote sites CE 1 and CE 4. Customer B has remote sites CE 2 and CE 3. The CVLANs of the two customers overlap. The service provider assigns SVLANs 3 and 4 to customers A and B, respectively.

When a tagged Ethernet frame from CE 1 arrives at PE 1, the PE tags the frame with SVLAN 3. The double-tagged Ethernet frame travels over the service provider network until it arrives at PE 2. PE 2 removes the SVLAN tag of the frame, and then sends the frame to CE 4.

Figure 24 Typical QinQ application scenario

QinQ implementations

QinQ is enabled on a per-port basis. The link type of a QinQ-enabled port can be access, hybrid, or trunk. The QinQ tagging behaviors are the same across these types of ports.

A QinQ-enabled port tags all incoming frames (tagged or untagged) with the PVID tag.

· If an incoming frame already has one tag, it becomes a double-tagged frame.

· If the frame does not have any 802.1Q tags, it becomes a frame tagged with the PVID.

QinQ provides the most basic VLAN manipulation method to tag all incoming frames (tagged or untagged) with the PVID tag. To set the 802.1p priority in SVLAN tags, use the priority marking action as described in "Setting the 802.1p priority in SVLAN tags."

Protocols and standards

· IEEE 802.1Q, IEEE Standard for Local and Metropolitan Area Networks-Virtual Bridged Local Area Networks

· IEEE 802.1ad, IEEE Standard for Local and Metropolitan Area Networks-Virtual Bridged Local Area Networks-Amendment 4: Provider Bridges

Feature and hardware compatibility

This feature is supported only on the following ports:

· Layer 2 Ethernet ports on the following modules:

? HMIM-8GSW.

? HMIM-8GSWF.

? HMIM-24GSW.

? HMIM-24GSW-PoE.

· Fixed Layer 2 Ethernet ports on MSR3600-28 and MSR3600-51 routers.

Configuration restrictions and guidelines

The inner 802.1Q tag of QinQ frames is treated as part of the payload. As a best practice to ensure correct transmission of QinQ frames, set the MTU to a minimum of 1504 bytes for each port on the forwarding path. This value is the sum of the default Ethernet interface MTU (1500 bytes) and the length (4 bytes) of a VLAN tag.

Enabling QinQ

Enable QinQ on customer-side ports of PEs. A QinQ-enabled port tags an incoming frame with its PVID.

To enable QinQ:

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Enter Layer 2 Ethernet interface view.	interface interface-type interface-number	N/A
3. Enable QinQ.	qinq enable	By default, QinQ is disabled.

Configuring the TPID for VLAN tags

TPID identifies a frame as an 802.1Q tagged frame. The TPID value varies by vendor. On an H3C device, the TPID in the 802.1Q tag added on a QinQ-enabled port is 0x8100 by default, in compliance with IEEE 802.1Q. In a multi-vendor network, make sure the TPID setting is the same between directly connected devices so 802.1Q tagged frames can be identified correctly.

TPID settings include CVLAN TPID and SVLAN TPID.

A QinQ-enabled port uses the CVLAN TPID to match incoming tagged frames. An incoming frame is handled as untagged if its TPID is different from the CVLAN TPID.

SVLAN TPIDs are configurable on a per-port basis. A service provider-side port uses the SVLAN TPID to replace the TPID in outgoing frames' SVLAN tags and match incoming tagged frames. An incoming frame is handled as untagged if the TPID in its outer VLAN tag is different from the SVLAN TPID.

For example, a PE device is connected to a customer device that uses the TPID 0x8200 and to a provider device that uses the TPID 0x9100. For correct packet processing, you must set the CVLAN TPID and SVLAN TPID to 0x8200 and 0x9100 on the PE, respectively.

The TPID field is at the same position as the EtherType field in an untagged Ethernet frame. To ensure correct packet type identification, do not set the TPID value to any of the values listed in Table 10.

Table 10 Reserved EtherType values

Protocol type	Value
ARP	0x0806
PUP	0x0200
RARP	0x8035
IP	0x0800
IPv6	0x86DD
PPPoE	0x8863/0x8864
MPLS	0x8847/0x8848
IPX/SPX	0x8137
IS-IS	0x8000
LACP	0x8809
LLDP	0x88CC
802.1X	0x888E
802.1ag	0x8902
Cluster	0x88A7
Reserved	0xFFFD/0xFFFE/0xFFFF

Configuring the CVLAN TPID value

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Set the CVLAN TPID.	qinq ethernet-type customer-tag hex-value	The default setting is 0x8100.

Configuring the SVLAN TPID value

The TPID value in SVLAN tags is typically configured on the service provider-side ports of PEs.

To configure the SVLAN TPID value:

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Enter Layer 2 Ethernet interface view.	interface interface-type interface-number	N/A
3. Set the SVLAN TPID.	qinq ethernet-type service-tag hex-value	The default setting is 0x8100.

Setting the 802.1p priority in SVLAN tags

By default, the 802.1p priority in the SVLAN tag added by a QinQ-enabled port depends on the priority trust mode on the port.

· If the 802.1p priority in frames is trusted, the device copies the 802.1p priority in the CVLAN tag to the SVLAN tag.

· If port priority is trusted, the port priority (0 by default) is used as the 802.1p priority in the SVLAN tag.

To set the 802.1p priority in SVLAN tags:

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Create a traffic class and enter its view.	traffic classifier classifier-name [ operator { and \| or } ]	By default, no traffic classes exist.
3. Configure CVLAN match criteria.	· Match CVLAN IDs: if-match customer-vlan-id vlan-id-list · Match 802.1p priority: if-match customer-dot1p dot1p-value&<1-8>	N/A
4. Return to system view.	quit	N/A
5. Create a traffic behavior and enter its view.	traffic behavior behavior-name	By default, no traffic behaviors exist.
6. Configure a priority marking action for SVLAN tags.	· Replace the priority in the SVLAN tags of matching frames with the configured priority: remark dot1p dot1p-value · Copy the 802.1p priority in the CVLAN tag to the SVLAN tag: remark dot1p customer-dot1p-trust	N/A
7. Return to system view.	quit	N/A
8. Create a QoS policy and enter its view.	qos policy policy-name	By default, no QoS policies exist.
9. Specify the traffic behavior for the traffic class in the QoS policy.	classifier classifier-name behavior behavior-name	N/A
10. Return to system view.	quit	N/A
11. Enter Layer 2 Ethernet interface view.	interface interface-type interface-number	N/A
12. Apply the QoS policy to the inbound direction of the port.	qos apply policy policy-name inbound	N/A

For more information about QoS policies, see ACL and QoS Configuration Guide.

Displaying and maintaining QinQ

Execute display commands in any view.

Task	Command
Display QinQ-enabled ports.	display qinq [ interface interface-type interface-number ]

QinQ configuration example

Network requirements

As shown in Figure 25:

· The service provider assigns VLAN 100 to Company A's VLANs 10 through 70.

· The service provider assigns VLAN 200 to Company B's VLANs 30 through 90.

· The devices between PE 1 and PE 2 in the service provider network use a TPID value of 0x8200.

Configure QinQ on PE 1 and PE 2 to transmit traffic in VLANs 100 and 200 for Company A and Company B, respectively.

For the QinQ frames to be identified correctly, set the SVLAN TPID to 0x8200 on the service provider-side ports of PE 1 and PE 2.

Figure 25 Network diagram

Configuration procedure

1. Configure PE 1:

# Configure GigabitEthernet 1/0/1 as a trunk port, and assign it to VLAN 100 and VLANs 10 through 70.

<PE1> system-view

[PE1] interface gigabitethernet 1/0/1

[PE1-GigabitEthernet1/0/1] port link-type trunk

[PE1-GigabitEthernet1/0/1] port trunk permit vlan 100 10 to 70

# Set the PVID of GigabitEthernet 1/0/1 to VLAN 100.

[PE1-GigabitEthernet1/0/1] port trunk pvid vlan 100

# Enable QinQ on GigabitEthernet 1/0/1.

[PE1-GigabitEthernet1/0/1] qinq enable

[PE1-GigabitEthernet1/0/1] quit

# Configure GigabitEthernet 1/0/2 as a trunk port, and assign it to VLANs 100 and 200.

[PE1] interface gigabitethernet 1/0/2

[PE1-GigabitEthernet1/0/2] port link-type trunk

[PE1-GigabitEthernet1/0/2] port trunk permit vlan 100 200

# Set the TPID value in the SVLAN tags to 0x8200 on GigabitEthernet 1/0/2.

[PE1-GigabitEthernet1/0/2] qinq ethernet-type service-tag 8200

[PE1-GigabitEthernet1/0/2] quit

# Configure GigabitEthernet 1/0/3 as a trunk port, and assign it to VLAN 200 and VLANs 30 through 90.

[PE1] interface gigabitethernet 1/0/3

[PE1-GigabitEthernet1/0/3] port link-type trunk

[PE1-GigabitEthernet1/0/3] port trunk permit vlan 200 30 to 90

# Set the PVID of GigabitEthernet 1/0/3 to VLAN 200.

[PE1-GigabitEthernet1/0/3] port trunk pvid vlan 200

# Enable QinQ on GigabitEthernet 1/0/3.

[PE1-GigabitEthernet1/0/3] qinq enable

[PE1-GigabitEthernet1/0/3] quit

2. Configure PE 2:

# Configure GigabitEthernet 1/0/1 as a trunk port, and assign it to VLAN 200 and VLANs 30 through 90.

<PE2> system-view

[PE2] interface gigabitethernet 1/0/1

[PE2-GigabitEthernet1/0/1] port link-type trunk

[PE2-GigabitEthernet1/0/1] port trunk permit vlan 200 30 to 90

# Set the PVID of GigabitEthernet 1/0/1 to VLAN 200.

[PE2-GigabitEthernet1/0/1] port trunk pvid vlan 200

# Enable QinQ on GigabitEthernet 1/0/1.

[PE2-GigabitEthernet1/0/1] qinq enable

[PE2-GigabitEthernet1/0/1] quit

# Configure GigabitEthernet 1/0/2 as a trunk port, and assign it to VLANs 100 and 200.

[PE2] interface gigabitethernet 1/0/2

[PE2-GigabitEthernet1/0/2] port link-type trunk

[PE2-GigabitEthernet1/0/2] port trunk permit vlan 100 200

# Set the TPID value in the SVLAN tags to 0x8200 on GigabitEthernet 1/0/2.

[PE2-GigabitEthernet1/0/2] qinq ethernet-type service-tag 8200

[PE2-GigabitEthernet1/0/2] quit

# Configure GigabitEthernet 1/0/3 as a trunk port, and assign it to VLAN 100 and VLANs 10 through 70.

[PE2] interface gigabitethernet 1/0/3

[PE2-GigabitEthernet1/0/3] port link-type trunk

[PE2-GigabitEthernet1/0/3] port trunk permit vlan 100 10 to 70

# Set the PVID of GigabitEthernet 1/0/3 to VLAN 100.

[PE2-GigabitEthernet1/0/3] port trunk pvid vlan 100

# Enable QinQ on GigabitEthernet 1/0/3.

[PE2-GigabitEthernet1/0/3] qinq enable

[PE2-GigabitEthernet1/0/3] quit

3. Configure the devices between PE 1 and PE 2:

# Set the MTU to a minimum of 1504 bytes for each port on the path of QinQ frames. (Details not shown.)

# Configure all ports on the forwarding path to allow frames from VLANs 100 and 200 to pass through without removing the VLAN tag. (Details not shown.)

Configuring loop detection

Overview

Incorrect network connections or configurations can create Layer 2 loops, which results in repeated transmission of broadcasts, multicasts, or unknown unicasts. The repeated transmissions can waste network resources and can paralyze networks. The loop detection mechanism immediately generates a log when a loop occurs so that you are promptly notified to adjust network connections and configurations. You can configure loop detection to shut down the looped port. Logs are maintained in the information center. For more information, see Network Management and Monitoring Configuration Guide.

Loop detection mechanism

The device detects loops by sending detection frames and then checking whether these frames return to any port on the device. If they do, the device considers that the port is on a looped link.

Loop detection usually works within a VLAN. If a detection frame is returned with a different VLAN tag than it was sent out with, an inter-VLAN loop has occurred. To remove the loop, examine the QinQ or VLAN mapping configuration for incorrect settings. For more information about QinQ and VLAN mapping, see "Configuring QinQ" and "Configuring VLAN mapping."

Figure 26 Ethernet frame header for loop detection

The Ethernet frame header for loop detection contains the following fields:

· DMAC—Destination MAC address of the frame, which is the multicast MAC address 010F-E200-0007. When a loop detection-enabled device receives a frame with this destination MAC address, it performs the following operations:

? Sends the frame to the CPU.

? Floods the frame in the VLAN from which the frame was originally received.

· SMAC—Source MAC address of the frame, which is the bridge MAC address of the sending device.

· TPID—Type of the VLAN tag, with the value of 0x8100.

· TCI—Information of the VLAN tag, including the priority and VLAN ID.

· Type—Protocol type, with the value of 0x8918.

Figure 27 Inner frame header for loop detection

The inner frame header for loop detection contains the following fields:

· Code—Protocol sub-type, which is 0x0001, indicating the loop detection protocol.

· Version—Protocol version, which is always 0x0000.

· Length—Length of the frame. The value includes the inner header, but excludes the Ethernet header.

· Reserved—This field is reserved.

Frames for loop detection are encapsulated as TLV triplets.

Table 11 TLVs supported by loop detection

TLV	Description	Remarks
End of PDU	End of a PDU.	Optional.
Device ID	Bridge MAC address of the sending device.	Required.
Port ID	ID of the PDU sending port.	Optional.
Port Name	Name of the PDU sending port.	Optional.
System Name	Device name.	Optional.
Chassis ID	Chassis ID of the sending port.	Optional.
Slot ID	Slot ID of the sending port.	Optional.
Sub Slot ID	Sub-slot ID of the sending port.	Optional.

Loop detection interval

Loop detection is a continuous process as the network changes. Loop detection frames are sent at the loop detection interval to determine whether loops occur on ports and whether loops are removed.

Loop protection actions

When the device detects a loop on a port, it generates a log but performs no action on the port by default. You can configure the device to take one of the following actions:

· Block—Disables the port from learning MAC addresses and blocks the port.

· No-learning—Disables the port from learning MAC addresses.

· Shutdown—Shuts down the port to disable it from receiving and sending any frames.

Port status auto recovery

When the device configured with the block or no-learning loop action detects a loop on a port, it performs the action and waits three loop detection intervals. If the device does not receive a loop detection frame within three loop detection intervals, it performs the following operations:

· Automatically sets the port to the forwarding state.

· Notifies the user of the event.

When the device configured with the shutdown action detects a loop on a port, the following events occur:

1. The device automatically shuts down the port.

2. The device automatically sets the port to the forwarding state after the detection timer set by using the shutdown-interval command expires. For more information about the shutdown-interval command, see Fundamentals Command Reference.

3. The device shuts down the port again if a loop is still detected on the port when the detection timer expires.

This process is repeated until the loop is removed.

NOTE:

Incorrect recovery can occur when loop detection frames are discarded to reduce the load. To avoid this, use the shutdown action, or manually remove the loop.

Feature and hardware compatibility

This feature is supported only on the following ports:

· Layer 2 Ethernet ports on Ethernet switching modules.

· Fixed Layer 2 Ethernet ports of the following routers:

? MSR810/810-W/810-W-DB/810-LM/810-W-LM/810-10-PoE/810-LM-HK/810-W-LM-HK.

? MSR2600-6-X1/2600-10-X1.

? MSR3600-28/3600-51.

? MSR3600-28-SI/3600-51-SI.

? MSR810-LM-GL/810-W-LM-GL/830-6EI-GL/830-10EI-GL/830-6HI-GL/830-10HI-GL/2600-6-X1-GL/3600-28-SI-GL.

Loop detection configuration task list

Tasks at a glance
(Required.) Enabling loop detection
(Optional.) Setting the loop protection action
(Optional.) Setting the loop detection interval

Enabling loop detection

The loop protection action on a port can be triggered even if loop detection is disabled on the port when the following requirements are met:

· Loop detection is enabled globally or on any other port on the device.

· The port receives a loop detection frame of any VLAN.

Enabling loop detection globally

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Globally enable loop detection.	loopback-detection global enable vlan { vlan-id--list \| all }	Disabled by default.

Enabling loop detection on a port

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Enter Layer 2 Ethernet interface view or Layer 2 aggregate interface view.	interface interface-type interface-number	N/A
3. Enable loop detection on the port.	loopback-detection enable vlan { vlan-id--list \| all }	Disabled by default.

Setting the loop protection action

You can set the loop protection action globally or on a per-port basis. The global setting applies to all ports. The per-port setting applies to the individual ports. The per-port setting takes precedence over the global setting.

Setting the global loop protection action

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Set the global loop protection action.	loopback-detection global action shutdown	By default, the device generates a log but performs no action on the port on which a loop is detected.

Setting the loop protection action on a Layer 2 Ethernet interface

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Enter Layer 2 Ethernet interface view.	interface interface-type interface-number	N/A
3. Set the loop protection action on the interface.	loopback-detection action { block \| no-learning \| shutdown }	By default, the device generates a log but performs no action on the port on which a loop is detected.

Setting the loop protection action on a Layer 2 aggregate interface

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Enter Layer 2 aggregate interface view.	interface interface-type interface-number	N/A
3. Set the loop protection action on the interface.	loopback-detection action shutdown	By default, the device generates a log but performs no action on the port on which a loop is detected.

Setting the loop detection interval

With loop detection enabled, the device sends loop detection frames at the loopback detection interval. A shorter interval offers more sensitive detection but consumes more resources. Consider the system performance and loop detection speed when you set the loop detection interval.

To set the loop detection interval:

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Set the loop detection interval.	loopback-detection interval-time interval	The default setting is 30 seconds.

Displaying and maintaining loop detection

Execute display commands in any view.

Task	Command
Display the loop detection configuration and status.	display loopback-detection

Loop detection configuration example

Network requirements

As shown in Figure 28, configure loop detection on Device A to meet the following requirements:

· Device A generates a log as a notification.

· Device A automatically shuts down the port on which a loop is detected.

Figure 28 Network diagram

Configuration procedure

1. Configure Device A:

# Create VLAN 100, and globally enable loop detection for the VLAN.

<DeviceA> system-view

[DeviceA] vlan 100

[DeviceA-vlan100] quit

[DeviceA] loopback-detection global enable vlan 100

# Configure GigabitEthernet 1/0/1 and GigabitEthernet 1/0/2 as trunk ports, and assign them to VLAN 100.

[DeviceA] interface GigabitEthernet 1/0/1

[DeviceA-GigabitEthernet1/0/1] port link-type trunk

[DeviceA-GigabitEthernet1/0/1] port trunk permit vlan 100

[DeviceA-GigabitEthernet1/0/1] quit

[DeviceA] interface gigabitethernet 1/0/2

[DeviceA-GigabitEthernet1/0/2] port link-type trunk

[DeviceA-GigabitEthernet1/0/2] port trunk permit vlan 100

[DeviceA-GigabitEthernet1/0/2] quit

# Set the global loop protection action to shutdown.

[DeviceA] loopback-detection global action shutdown

# Set the loop detection interval to 35 seconds.

[DeviceA] loopback-detection interval-time 35

2. Configure Device B:

# Create VLAN 100.

<DeviceB> system-view

[DeviceB] vlan 100

[DeviceB–vlan100] quit

# Configure GigabitEthernet 1/0/1 and GigabitEthernet 1/0/2 as trunk ports, and assign them to VLAN 100.

[DeviceB] interface GigabitEthernet 1/0/1

[DeviceB-GigabitEthernet1/0/1] port link-type trunk

[DeviceB-GigabitEthernet1/0/1] port trunk permit vlan 100

[DeviceB-GigabitEthernet1/0/1] quit

[DeviceB] interface gigabitethernet 1/0/2

[DeviceB-GigabitEthernet1/0/2] port link-type trunk

[DeviceB-GigabitEthernet1/0/2] port trunk permit vlan 100

[DeviceB-GigabitEthernet1/0/2] quit

3. Configure Device C:

# Create VLAN 100.

<DeviceC> system-view

[DeviceC] vlan 100

[DeviceC–vlan100] quit

# Configure GigabitEthernet 1/0/1 and GigabitEthernet 1/0/2 as trunk ports, and assign them to VLAN 100.

[DeviceC] interface GigabitEthernet 1/0/1

[DeviceC-GigabitEthernet1/0/1] port link-type trunk

[DeviceC-GigabitEthernet1/0/1] port trunk permit vlan 100

[DeviceC-GigabitEthernet1/0/1] quit

[DeviceC] interface gigabitethernet 1/0/2

[DeviceC-GigabitEthernet1/0/2] port link-type trunk

[DeviceC-GigabitEthernet1/0/2] port trunk permit vlan 100

[DeviceC-GigabitEthernet1/0/2] quit

Verifying the configuration

# View the system logs on devices, for example, Device A.

[DeviceA]

%Feb 24 15:04:29:663 2013 DeviceA LPDT/4/LPDT LOOPED: Loopback exists on GigabitEthernet1/0/1.

%Feb 24 15:04:29:667 2013 DeviceA LPDT/4/LPDT LOOPED: Loopback exists on GigabitEthernet1/0/2.

%Feb 24 15:04:44:243 2013 DeviceA LPDT/5/LPDT RECOVERED: Loopback on GigabitEthernet1/0/1 recovered.

%Feb 24 15:04:44:248 2013 DeviceA LPDT/5/LPDT RECOVERED: Loopback on GigabitEthernet1/0/2 recovered.

The output shows the following information:

· Device A detected loops on ports GigabitEthernet 1/0/1 and GigabitEthernet 1/0/2 within a loop detection interval.

· Loops on ports GigabitEthernet 1/0/1 and GigabitEthernet 1/0/2 were removed.

# Use the display loopback-detection command to display the loop detection configuration and status on devices, for example, Device A.

[DeviceA] display loopback-detection

Loop detection is enabled.

Loop detection interval is 35 second(s).

No loopback is detected.

The output shows that the device has removed the loops from GigabitEthernet 1/0/1 and GigabitEthernet 1/0/2 according to the shutdown action.

# Display the status of GigabitEthernet 1/0/1 on devices, for example, Device A.

[DeviceA] display interface gigabitethernet 1/0/1

GigabitEthernet1/0/1 current state: DOWN (Loop detection down)

...

The output shows that GigabitEthernet 1/0/1 is already shut down by the loop detection module.

# Display the status of GigabitEthernet 1/0/2 on devices, for example, Device A.

[DeviceA] display interface gigabitethernet 1/0/2

GigabitEthernet1/0/2 current state: DOWN (Loop detection down)

...

The output shows that GigabitEthernet 1/0/2 is already shut down by the loop detection module.

Configuring spanning tree protocols

Spanning tree protocols eliminate loops in a physical link-redundant network by selectively blocking redundant links and putting them in a standby state.

The recent versions of STP include the Rapid Spanning Tree Protocol (RSTP), the Per-VLAN Spanning Tree (PVST), and the Multiple Spanning Tree Protocol (MSTP).

STP

STP was developed based on the 802.1d standard of IEEE to eliminate loops at the data link layer in a LAN. Networks often have redundant links as backups in case of failures, but loops are a very serious problem. Devices running STP detect loops in the network by exchanging information with one another. They eliminate loops by selectively blocking certain ports to prune the loop structure into a loop-free tree structure. This avoids proliferation and infinite cycling of packets that would occur in a loop network.

In a narrow sense, STP refers to IEEE 802.1d STP. In a broad sense, STP refers to the IEEE 802.1d STP and various enhanced spanning tree protocols derived from that protocol.

STP protocol frames

STP uses bridge protocol data units (BPDUs), also known as configuration messages, as its protocol frames. This chapter uses BPDUs to represent all types of spanning tree protocol frames.

STP-enabled devices exchange BPDUs to establish a spanning tree. BPDUs contain sufficient information for the devices to complete spanning tree calculation.

STP uses two types of BPDUs, configuration BPDUs and topology change notification (TCN) BPDUs.

Configuration BPDUs

Devices exchange configuration BPDUs to elect the root bridge and determine port roles. Figure 29 shows the configuration BPDU format.

Figure 29 Configuration BPDU format

The payload of a configuration BPDU includes the following fields:

· Protocol ID—Fixed at 0x0000, which represents IEEE 802.1d.

· Protocol version ID—Spanning tree protocol version ID. The protocol version ID for STP is 0x00.

· BPDU type—Type of the BPDU. The value is 0x00 for a configuration BPDU.

· Flags—An 8-bit field indicates the purpose of the BPDU. The lowest bit is the Topology Change (TC) flag. The highest bit is the Topology Change Acknowledge (TCA) flag. All other bits are reserved.

· Root ID—Root bridge ID formed by the priority and MAC address of the root bridge.

· Root path cost—Cost of the path to the root bridge.

· Bridge ID—Designated bridge ID formed by the priority and MAC address of the designated bridge.

· Port ID—Designated port ID formed by the priority and global port number of the designated port.

· Message age—Age of the configuration BPDU while it propagates in the network.

· Max age—Maximum age of the configuration BPDU stored on the switch.

· Hello time—Configuration BPDU transmission interval.

· Forward delay—Delay for STP bridges to transit port state.

Devices use the root bridge ID, root path cost, designated bridge ID, designated port ID, message age, max age, hello time, and forward delay for spanning tree calculation.

TCN BPDUs

Devices use TCN BPDUs to announce changes in the network topology. Figure 30 shows the TCN BPDU format.

Figure 30 TCN BPDU format

The payload of a TCN BPDU includes the following fields:

· Protocol ID—Fixed at 0x0000, which represents IEEE 802.1d.

· Protocol version ID—Spanning tree protocol version ID. The protocol version ID for STP is 0x00.

· BPDU type—Type of the BPDU. The value is 0x80 for a TCN BPDU.

A non-root bridge sends TCN BPDUs when one of the following events occurs on the bridge:

· A port transits to the forwarding state, and the bridge has a minimum of one designated port.

· A port transits from the forwarding or learning state to the blocking state.

The non-root bridge uses TCN BPDUs to notify the root bridge once the network topology changes. The root bridge then sets the TC flag in its configuration BPDU and propagates it to other bridges.

Basic concepts in STP

Root bridge

A tree network must have a root bridge. The entire network contains only one root bridge, and all the other bridges in the network are called leaf nodes. The root bridge is not permanent, but can change with changes of the network topology.

Upon initialization of a network, each device generates and periodically sends configuration BPDUs, with itself as the root bridge. After network convergence, only the root bridge generates and periodically sends configuration BPDUs. The other devices only forward the BPDUs.

Root port

On a non-root bridge, the port nearest to the root bridge is the root port. The root port communicates with the root bridge. Each non-root bridge has only one root port. The root bridge has no root port.

Designated bridge and designated port

Classification	Designated bridge	Designated port
For a device	Device directly connected to the local device and responsible for forwarding BPDUs to the local device.	Port through which the designated bridge forwards BPDUs to this device.
For a LAN	Device responsible for forwarding BPDUs to this LAN segment.	Port through which the designated bridge forwards BPDUs to this LAN segment.

As shown in Figure 31, Device B and Device C are directly connected to a LAN.

If Device A forwards BPDUs to Device B through port A1, the designated bridge and designated port are as follows:

· The designated bridge for Device B is Device A.

· The designated port for Device B is port A1 on Device A.

If Device B forwards BPDUs to the LAN, the designated bridge and designated port are as follows:

· The designated bridge for the LAN is Device B.

· The designated port for the LAN is port B2 on Device B.

Figure 31 Designated bridges and designated ports

Port states

Table 12 lists the port states in STP.

Table 12 STP port states

State	Receives/sends BPDUs	Learns MAC addresses	Forwards user data
Disabled	No	No	No
Listening	Yes	No	No
Learning	Yes	Yes	No
Forwarding	Yes	Yes	Yes
Blocking	Receive	No	No

Path cost

Path cost is a reference value used for link selection in STP. To prune the network into a loop-free tree, STP calculates path costs to select the most robust links and block redundant links that are less robust.

Calculation process of the STP algorithm

The spanning tree calculation process described in the following sections is an example of a simplified process.

Calculation process

The STP algorithm uses the following calculation process:

1. Network initialization.

Upon initialization of a device, each port generates a BPDU with the following contents:

? The port as the designated port.

? The device as the root bridge.

? 0 as the root path cost.

? The device ID as the designated bridge ID.

2. Root bridge selection.

Initially, each STP-enabled device on the network assumes itself to be the root bridge, with its own device ID as the root bridge ID. By exchanging configuration BPDUs, the devices compare their root bridge IDs to elect the device with the smallest root bridge ID as the root bridge.

3. Root port and designated ports selection on the non-root bridges.

Step	Description
1	A non-root-bridge device regards the port on which it received the optimum configuration BPDU as the root port. Table 13 describes how the optimum configuration BPDU is selected.
2	Based on the configuration BPDU and the path cost of the root port, the device calculates a designated port configuration BPDU for each of the other ports. · The root bridge ID is replaced with that of the configuration BPDU of the root port. · The root path cost is replaced with that of the configuration BPDU of the root port plus the path cost of the root port. · The designated bridge ID is replaced with the ID of this device. · The designated port ID is replaced with the ID of this port.
3	The device compares the calculated configuration BPDU with the configuration BPDU on the port whose port role will be determined. Then, the device acts depending on the result of the comparison: · If the calculated configuration BPDU is superior, the device performs the following operations: ? Considers this port as the designated port. ? Replaces the configuration BPDU on the port with the calculated configuration BPDU. ? Periodically sends the calculated configuration BPDU. · If the configuration BPDU on the port is superior, the device blocks this port without updating its configuration BPDU. The blocked port can receive BPDUs, but cannot send BPDUs or forward data traffic.

When the network topology is stable, only the root port and designated ports forward user traffic. Other ports are all in the blocking state to receive BPDUs but not to forward BPDUs or user traffic.

Table 13 Selecting the optimum configuration BPDU

Step

Actions

Upon receiving a configuration BPDU on a port, the device compares the priority of the received configuration BPDU with that of the configuration BPDU generated by the port.

· If the former priority is lower, the device discards the received configuration BPDU and keeps the configuration BPDU the port generated.

· If the former priority is higher, the device replaces the content of the configuration BPDU generated by the port with the content of the received configuration BPDU.

The device compares the configuration BPDUs of all the ports and chooses the optimum configuration BPDU.

The following are the principles of configuration BPDU comparison:

a. The configuration BPDU with the lowest root bridge ID has the highest priority.

b. If configuration BPDUs have the same root bridge ID, their root path costs are compared. For example, the root path cost in a configuration BPDU plus the path cost of a receiving port is S. The configuration BPDU with the smallest S value has the highest priority.

c. If all configuration BPDUs have the same root bridge ID and S value, the following attributes are compared in sequence:

- Designated bridge IDs.

- Designated port IDs.

- IDs of the receiving ports.

The configuration BPDU that contains a smaller designated bridge ID, designated port ID, or receiving port ID is selected.

A tree-shape topology forms when the root bridge, root ports, and designated ports are selected.

Example of STP calculation

Figure 32 provides an example showing how the STP algorithm works.

Figure 32 The STP algorithm

As shown in Figure 32, the priority values of Device A, Device B, and Device C are 0, 1, and 2, respectively. The path costs of links among the three devices are 5, 10, and 4.

1. Device state initialization.

In Table 14, each configuration BPDU contains the following fields: root bridge ID, root path cost, designated bridge ID, and designated port ID.

Table 14 Initial state of each device

Device	Port name	Configuration BPDU on the port
Device A	Port A1	{0, 0, 0, Port A1}
Device A	Port A2	{0, 0, 0, Port A2}
Device B	Port B1	{1, 0, 1, Port B1}
Device B	Port B2	{1, 0, 1, Port B2}
Device C	Port C1	{2, 0, 2, Port C1}
Device C	Port C2	{2, 0, 2, Port C2}

2. Configuration BPDUs comparison on each device.

In Table 15, each configuration BPDU contains the following fields: root bridge ID, root path cost, designated bridge ID, and designated port ID.

Table 15 Comparison process and result on each device

Device

Comparison process

Configuration BPDU on ports after comparison

Device A

Port A1 performs the following operations:

3. Receives the configuration BPDU of Port B1 {1, 0, 1, Port B1}.

4. Determines that its existing configuration BPDU {0, 0, 0, Port A1} is superior to the received configuration BPDU.

5. Discards the received one.

Port A2 performs the following operations:

6. Receives the configuration BPDU of Port C1 {2, 0, 2, Port C1}.

7. Determines that its existing configuration BPDU {0, 0, 0, Port A2} is superior to the received configuration BPDU.

8. Discards the received one.

Device A determines that it is both the root bridge and designated bridge in the configuration BPDUs of all its ports. It considers itself as the root bridge. It does not change the configuration BPDU of any port and starts to periodically send configuration BPDUs.

· Port A1: {0, 0, 0, Port A1}

· Port A2: {0, 0, 0, Port A2}

Device B

Port B1 performs the following operations:

9. Receives the configuration BPDU of Port A1 {0, 0, 0, Port A1}.

10. Determines that the received configuration BPDU is superior to its existing configuration BPDU {1, 0, 1, Port B1}.

11. Updates its configuration BPDU.

Port B2 performs the following operations:

12. Receives the configuration BPDU of Port C2 {2, 0, 2, Port C2}.

13. Determines that its existing configuration BPDU {1, 0, 1, Port B2} is superior to the received configuration BPDU.

14. Discards the received BPDU.

· Port B1: {0, 0, 0, Port A1}

· Port B2: {1, 0, 1, Port B2}

Device B performs the following operations:

15. Compares the configuration BPDUs of all its ports.

16. Decides that the configuration BPDU of Port B1 is the optimum.

17. Selects Port B1 as the root port with the configuration BPDU unchanged.

Based on the configuration BPDU and path cost of the root port, Device B calculates a designated port configuration BPDU for Port B2 {0, 5, 1, Port B2}. Device B compares it with the existing configuration BPDU of Port B2 {1, 0, 1, Port B2}. Device B determines that the calculated one is superior, and determines that Port B2 is the designated port. It replaces the configuration BPDU on Port B2 with the calculated one, and periodically sends the calculated configuration BPDU.

· Root port (Port B1): {0, 0, 0, Port A1}

· Designated port (Port B2): {0, 5, 1, Port B2}

Device C

Port C1 performs the following operations:

18. Receives the configuration BPDU of Port A2 {0, 0, 0, Port A2}.

19. Determines that the received configuration BPDU is superior to its existing configuration BPDU {2, 0, 2, Port C1}.

20. Updates its configuration BPDU.

Port C2 performs the following operations:

21. Receives the original configuration BPDU of Port B2 {1, 0, 1, Port B2}.

22. Determines that the received configuration BPDU is superior to the existing configuration BPDU {2, 0, 2, Port C2}.

23. Updates its configuration BPDU.

· Port C1: {0, 0, 0, Port A2}

· Port C2: {1, 0, 1, Port B2}

Device C performs the following operations:

24. Compares the configuration BPDUs of all its ports.

25. Decides that the configuration BPDU of Port C1 is the optimum.

26. Selects Port C1 as the root port with the configuration BPDU unchanged.

Based on the configuration BPDU and path cost of the root port, Device C calculates the configuration BPDU of Port C2 {0, 10, 2, Port C2}. Device C compares it with the existing configuration BPDU of Port C2 {1, 0, 1, Port B2}. Device C determines that the calculated configuration BPDU is superior to the existing one, selects Port C2 as the designated port, and replaces the configuration BPDU of Port C2 with the calculated one.

· Root port (Port C1): {0, 0, 0, Port A2}

· Designated port (Port C2): {0, 10, 2, Port C2}

Port C2 performs the following operations:

27. Receives the updated configuration BPDU of Port B2 {0, 5, 1, Port B2}.

28. Determines that the received configuration BPDU is superior to its existing configuration BPDU {0, 10, 2, Port C2}.

29. Updates its configuration BPDU.

Port C1 performs the following operations:

30. Receives a periodic configuration BPDU {0, 0, 0, Port A2} from Port A2.

31. Determines that it is the same as the existing configuration BPDU.

32. Discards the received BPDU.

· Port C1: {0, 0, 0, Port A2}

· Port C2: {0, 5, 1, Port B2}

Device C determines that the root path cost of Port C1 is larger than that of Port C2. The root path cost of Port C1 is 10, root path cost of the received configuration BPDU (0) plus path cost of Port C1 (10). The root path cost of Port C2 is 9, root path cost of the received configuration BPDU (5) plus path cost of Port C2 (4). Device C determines that the configuration BPDU of Port C2 is the optimum, and selects Port C2 as the root port with the configuration BPDU unchanged.

Based on the configuration BPDU and path cost of the root port, Device C performs the following operations:

33. Calculates a designated port configuration BPDU for Port C1 {0, 9, 2, Port C1}.

34. Compares it with the existing configuration BPDU of Port C1 {0, 0, 0, Port A2}.

35. Determines that the existing configuration BPDU is superior to the calculated one and blocks Port C1 with the configuration BPDU unchanged.

Port C1 does not forward data until a new event triggers a spanning tree calculation process: for example, the link between Device B and Device C is down.

· Blocked port (Port C1): {0, 0, 0, Port A2}

· Root port (Port C2): {0, 5, 1, Port B2}

After the comparison processes described in Table 15, a spanning tree with Device A as the root bridge is established, as shown in Figure 33.

Figure 33 The final calculated spanning tree

The configuration BPDU forwarding mechanism of STP

The configuration BPDUs of STP are forwarded according to these guidelines:

· Upon network initiation, every device regards itself as the root bridge and generates configuration BPDUs with itself as the root. Then it sends the configuration BPDUs at a regular hello interval.

· If the root port receives a configuration BPDU superior to the configuration BPDU of the port, the device performs the following operations:

? Increases the message age carried in the configuration BPDU.

? Starts a timer to time the configuration BPDU.

? Sends this configuration BPDU through the designated port.

· If a designated port receives a configuration BPDU with a lower priority than its configuration BPDU, the port immediately responds with its configuration BPDU.

· If a path fails, the root port on this path no longer receives new configuration BPDUs and the old configuration BPDUs will be discarded due to timeout. The device generates a configuration BPDU with itself as the root and sends the BPDUs and TCN BPDUs. This triggers a new spanning tree calculation process to establish a new path to restore the network connectivity.

However, the newly calculated configuration BPDU cannot be propagated throughout the network immediately. As a result, the old root ports and designated ports that have not detected the topology change continue forwarding data along the old path. If the new root ports and designated ports begin to forward data as soon as they are elected, a temporary loop might occur.

STP timers

The most important timing parameters in STP calculation are forward delay, hello time, and max age.

· Forward delay

Forward delay is the delay time for port state transition. By default, the forward delay is 15 seconds.

A path failure can cause spanning tree re-calculation to adapt the spanning tree structure to the change. However, the resulting new configuration BPDU cannot propagate throughout the network immediately. If the newly elected root ports and designated ports start to forward data immediately, a temporary loop will likely occur.

The newly elected root ports or designated ports must go through the listening and learning states before they transit to the forwarding state. This requires twice the forward delay time and allows the new configuration BPDU to propagate throughout the network.

· Hello time

The device sends configuration BPDUs at the hello time interval to the neighboring devices to ensure that the paths are fault-free. By default, the hello time is 2 seconds. If the device does not receive configuration BPDUs within the timeout period, it recalculates the spanning tree. The formula for calculating the timeout period is timeout period = timeout factor × 3 × hello time.

· Max age

The device uses the max age to determine whether a stored configuration BPDU has expired and discards it if the max age is exceeded. By default, the max age is 20 seconds. In the CIST of an MSTP network, the device uses the max age timer to determine whether a configuration BPDU received by a port has expired. If it is expired, a new spanning tree calculation process starts. The max age timer does not take effect on MSTIs.

If a port does not receive any configuration BPDUs within the timeout period, the port transits to the listening state. The device will recalculate the spanning tree. It takes the port 50 seconds to transit back to the forwarding state. This period includes 20 seconds for the max age, 15 seconds for the listening state, and 15 seconds for the learning state.

To ensure a fast topology convergence, make sure the timer settings meet the following formulas:

· 2 × (forward delay – 1 second) ≥ max age

· Max age ≥ 2 × (hello time + 1 second)

RSTP

RSTP achieves rapid network convergence by allowing a newly elected root port or designated port to enter the forwarding state much faster than STP.

RSTP protocol frames

An RSTP BPDU uses the same format as an STP BPDU except that a Version1 length field is added to the payload of RSTP BPDUs. The differences between an RSTP BPDU and an STP BPDU are as follows:

· Protocol version ID—The value is 0x02 for RSTP.

· BPDU type—The value is 0x02 for RSTP BPDUs.

· Flags—All 8 bits are used.

· Version1 length—The value is 0x00, which means no version 1 protocol information is present.

RSTP does not use TCN BPDUs to advertise topology changes. RSTP floods BPDUs with the TC flag set in the network to advertise topology changes.

Basic concepts in RSTP

Port roles

In addition to root port and designated port, RSTP also uses the following port roles:

· Alternate port—Acts as the backup port for a root port. When the root port is blocked, the alternate port takes over.

· Backup port—Acts as the backup port of a designated port. When the designated port is invalid, the backup port becomes the new designated port. A loop occurs when two ports of the same spanning tree device are connected, so the device blocks one of the ports. The blocked port is the backup port.

· Edge port—Directly connects to a user host rather than a network device or network segment.

Port states

RSTP uses the discarding state to replace the disabled, blocking, and listening states in STP. Table 16 shows the differences between the port states in RSTP and STP.

Table 16 Port state differences between RSTP and STP

STP port state	RSTP port state	Sends BPDU	Learns MAC addresses	Forwards user data
Disabled	Discarding	No	No	No
Blocking	Discarding	No	No	No
Listening	Discarding	Yes	No	No
Learning	Learning	Yes	Yes	No
Forwarding	Forwarding	Yes	Yes	Yes

How RSTP works

During RSTP calculation, the following events occur:

· If a port in discarding state becomes an alternate port, it retains its state.

· If a port in discarding state is elected as the root port or designated port, it enters the learning state after the forward delay. The port learns MAC addresses, and enters the forwarding state after another forward delay.

? A newly elected RSTP root port rapidly enters the forwarding state if the following requirements are met:

- The old root port on the device has stopped forwarding data.

- The upstream designated port has started forwarding data.

? A newly elected RSTP designated port rapidly enters the forwarding state if one of the following requirements is met:

- The designated port is configured as an edge port which directly connects to a user terminal.

- The designated port connects to a point-to-point link and receives a handshake response from the directly connected device.

RSTP BPDU processing

In RSTP, a non-root bridge actively sends RSTP BPDUs at the hello time through designated ports without waiting for the root bridge to send RSTP BPDUs. This enables RSTP to quickly detect link failures. If a device fails to receive any RSTP BPDUs on a port within triple the hello time, the device considers that a link failure has occurred. After the stored configuration BPDU expires, the device floods RSTP BPDUs with the TC flag set to initiate a new RSTP calculation.

In RSTP, a port in blocking state can immediately respond to an RSTP BPDU with a lower priority than its own BPDU.

As shown in Figure 34, Device A is the root bridge. The priority of Device B is higher than the priority of Device C. GigabitEthernet 2/0/2 on Device C is blocked.

When the link between Device A and Device B fails, the following events occur:

1. Device B sends an RSTP BPDU with itself as the root bridge to Device C.

2. Device C compares the RSTP BPDU with its own BPDU.

3. Because the RSTP BPDU from Device B has a lower priority, Device C sends its own BPDU to Device B.

4. Device B considers that GigabitEthernet 2/0/2 is the root port and stops sending RSTP BPDUs to Device C.

Figure 34 BPDU processing in RSTP

PVST

In an STP- or RSTP-enabled LAN, all bridges share one spanning tree. Traffic from all VLANs is forwarded along the spanning tree, and ports cannot be blocked on a per-VLAN basis to prune loops.

PVST allows every VLAN to have its own spanning tree, which increases usage of links and bandwidth. Because each VLAN runs RSTP independently, a spanning tree only serves its VLAN.

A PVST-enabled H3C device can communicate with a third-party device that is running Rapid PVST or PVST. The PVST-enabled H3C device supports fast network convergence like RSTP when connected to PVST-enabled H3C devices or third-party devices enabled with Rapid PVST.

PVST protocol frames

As shown in Figure 35, a PVST BPDU uses the same format as an RSTP BPDU except the following differences:

· The destination MAC address of a PVST BPDU is 01-00-0c-cc-cc-cd, which is a private MAC address.

· Each PVST BPDU carries a VLAN tag. The VLAN tag identifies the VLAN to which the PVST BPDU belongs.

· The organization code and PID fields are added to the LLC header of the PVST BPDU.

Figure 35 PVST BPDU format

A port's link type determines the type of BPDUs the port sends.

· An access port sends RSTP BPDUs.

· A trunk or hybrid port sends RSTP BPDUs in the default VLAN and sends PVST BPDUs in other VLANs.

Basic concepts in PVST

PVST uses the same port roles and port states as RSTP for fast convergence. For more information, see "Basic concepts in RSTP."

How PVST works

PVST implements per-VLAN spanning tree calculation by mapping each VLAN to an MSTI. In PVST, each VLAN runs RSTP independently to maintain its own spanning tree without affecting the spanning trees of other VLANs. In this way, loops in each VLAN are eliminated and traffic of different VLANs is load shared over links. PVST uses RSTP BPDUs in the default VLAN and PVST BPDUs in other VLANs for spanning tree calculation.

MSTP

MSTP overcomes the following STP, RSTP, and PVST limitations:

· STP limitations—STP does not support rapid state transition of ports. A newly elected port must wait twice the forward delay time before it transits to the forwarding state.

· RSTP limitations—Although RSTP enables faster network convergence than STP, RSTP fails to provide load balancing among VLANs. As with STP, all RSTP bridges in a LAN share one spanning tree and forward frames from all VLANs along this spanning tree.

· PVST limitations—Because each VLAN has its spanning tree, the amount of PVST BPDUs is proportional to the number of VLANs on a trunk or hybrid port. When the trunk or hybrid port permits too many VLANs, both resources and calculations for maintaining the VLAN spanning trees increase dramatically. If a status change occurs on the trunk or hybrid port that permits multiple VLANs, the device CPU will be overburdened with recalculating the affected spanning trees. As a result, network performance is degraded.

MSTP features

Developed based on IEEE 802.1s, MSTP overcomes the limitations of STP, RSTP, and PVST. In addition to supporting rapid network convergence, it allows data flows of different VLANs to be forwarded along separate paths. This provides a better load sharing mechanism for redundant links.

MSTP provides the following features:

· MSTP divides a switched network into multiple regions, each of which contains multiple spanning trees that are independent of one another.

· MSTP supports mapping VLANs to spanning tree instances by means of a VLAN-to-instance mapping table. MSTP can reduce communication overheads and resource usage by mapping multiple VLANs to one instance.

· MSTP prunes a loop network into a loop-free tree, which avoids proliferation and endless cycling of frames in a loop network. In addition, it supports load balancing of VLAN data by providing multiple redundant paths for data forwarding.

· MSTP is compatible with STP and RSTP, and partially compatible with PVST.

MSTP protocol frames

Figure 36 shows the format of an MSTP BPDU.

Figure 36 MSTP BPDU format

The first 13 fields of an MSTP BPDU are the same as an RSTP BPDU. The other six fields are unique to MSTP.

· Protocol version ID—The value is 0x03 for MSTP.

· BPDU type—The value is 0x02 for RSTP/MSTP BPDUs.

· Root ID—ID of the common root bridge.

· Root path cost—CIST external path cost.

· Bridge ID—ID of the regional root for the IST or an MSTI.

· Port ID—ID of the designated port in the CIST.

· Version3 length—Length of the MSTP-specific fields. Devices use this field for verification upon receiving an MSTP BPDU.

· MST configuration ID—Includes the format selector, configuration name, revision level, and configuration digest. The value for format selector is fixed at 0x00. The other parameters are used to identify the MST region for the originating bridge.

· CIST IRPC—Internal root path cost (IRPC) from the originating bridge to the root of the MST region.

· CIST bridge ID—ID of the bridge that sends the MSTP BPDU.

· CIST remaining ID—Remaining hop count. This field limits the scale of the MST region. The regional root sends a BPDU with the remaining hop count set to the maximum value. Each device that receives the BPDU decrements the hop count by one. When the hop count reaches zero, the BPDU is discarded. Devices beyond the maximum hops of the MST region cannot participate in spanning tree calculation. The default remaining hop count is 20.

· MSTI configuration messages—Contains MSTI configuration messages. Each MSTI configuration message is 16 bytes. This field can contain 0 to 64 MSTI configuration messages. The number of the MSTI configuration messages is determined by the number of MSTIs in the MST region.

Basic concepts in MSTP

Figure 37 shows a switched network that contains four MST regions, each MST region containing four MSTP devices. Figure 38 shows the networking topology of MST region 3.

Figure 37 Basic concepts in MSTP

Figure 38 Network diagram and topology of MST region 3

MST region

A multiple spanning tree region (MST region) consists of multiple devices in a switched network and the network segments among them. All these devices have the following characteristics:

· A spanning tree protocol enabled

· Same region name

· Same VLAN-to-instance mapping configuration

· Same MSTP revision level

· Physically linked together

Multiple MST regions can exist in a switched network. You can assign multiple devices to the same MST region, as shown in Figure 37.

· The switched network contains four MST regions, MST region 1 through MST region 4.

· All devices in each MST region have the same MST region configuration.

MSTI

MSTP can generate multiple independent spanning trees in an MST region, and each spanning tree is mapped to the specific VLANs. Each spanning tree is referred to as a multiple spanning tree instance (MSTI).

In Figure 38, MST region 3 contains three MSTIs, MSTI 1, MSTI 2, and MSTI 0.

VLAN-to-instance mapping table

As an attribute of an MST region, the VLAN-to-instance mapping table describes the mapping relationships between VLANs and MSTIs.

In Figure 38, the VLAN-to-instance mapping table of MST region 3 is as follows:

· VLAN 1 to MSTI 1.

· VLAN 2 and VLAN 3 to MSTI 2.

· Other VLANs to MSTI 0.

MSTP achieves load balancing by means of the VLAN-to-instance mapping table.

CST

The common spanning tree (CST) is a single spanning tree that connects all MST regions in a switched network. If you regard each MST region as a device, the CST is a spanning tree calculated by these devices through STP or RSTP.

The blue lines in Figure 37 represent the CST.

IST

An internal spanning tree (IST) is a spanning tree that runs in an MST region. It is also called MSTI 0, a special MSTI to which all VLANs are mapped by default.

In Figure 37, MSTI 0 is the IST in MST region 3.

CIST

The common and internal spanning tree (CIST) is a single spanning tree that connects all devices in a switched network. It consists of the ISTs in all MST regions and the CST.

In Figure 37, the ISTs (MSTI 0) in all MST regions plus the inter-region CST constitute the CIST of the entire network.

Regional root

The root bridge of the IST or an MSTI within an MST region is the regional root of the IST or MSTI. Based on the topology, different spanning trees in an MST region might have different regional roots, as shown in MST region 3 in Figure 38.

· The regional root of MSTI 1 is Device B.

· The regional root of MSTI 2 is Device C.

· The regional root of MSTI 0 (also known as the IST) is Device A.

Common root bridge

The common root bridge is the root bridge of the CIST.

In Figure 37, the common root bridge is a device in MST region 1.

Port roles

A port can play different roles in different MSTIs. As shown in Figure 39, an MST region contains Device A, Device B, Device C, and Device D. Port A1 and port A2 of Device A connect to the common root bridge. Port B2 and Port B3 of Device B form a loop. Port C3 and Port C4 of Device C connect to other MST regions. Port D3 of Device D directly connects to a host.

Figure 39 Port roles

MSTP calculation involves the following port roles:

· Root port—Forwards data for a non-root bridge to the root bridge. The root bridge does not have any root port.

· Designated port—Forwards data to the downstream network segment or device.

· Alternate port—Acts as the backup port for a root port or master port. When the root port or master port is blocked, the alternate port takes over.

· Edge port—Directly connects to a user host rather than a network device or network segment.

· Master port—Acts as a port on the shortest path from the local MST region to the common root bridge. The master port is not always located on the regional root. It is a root port on the IST or CIST and still a master port on the other MSTIs.

· Boundary port—Connects an MST region to another MST region or to an STP/RSTP-running device. In MSTP calculation, a boundary port's role on an MSTI is consistent with its role on the CIST. However, that is not true with master ports. A master port on MSTIs is a root port on the CIST.

Port states

In MSTP, a port can be in one of the following states:

· Forwarding—The port receives and sends BPDUs, learns MAC addresses, and forwards user traffic.

· Learning—The port receives and sends BPDUs, learns MAC addresses, but does not forward user traffic. Learning is an intermediate port state.

· Discarding—The port receives and sends BPDUs, but does not learn MAC addresses or forward user traffic.

NOTE:

When in different MSTIs, a port can be in different states.

A port state is not exclusively associated with a port role. Table 17 lists the port states that each port role supports. (A check mark [√] indicates that the port supports this state, while a dash [—] indicates that the port does not support this state.)

Table 17 Port states that different port roles support

Port role (right) Port state (below)	Root port/master port	Designated port	Alternate port	Backup port
Forwarding	√	√	—	—
Learning	√	√	—	—
Discarding	√	√	√	√

How MSTP works

MSTP divides an entire Layer 2 network into multiple MST regions, which are connected by a calculated CST. Inside an MST region, multiple spanning trees, called MSTIs, are calculated. Among these MSTIs, MSTI 0 is the IST.

Like STP, MSTP uses configuration BPDUs to calculate spanning trees. An important difference is that an MSTP BPDU carries the MSTP configuration of the bridge from which the BPDU is sent.

CIST calculation

During the CIST calculation, the following process takes place:

· The device with the highest priority is elected as the root bridge of the CIST.

· MSTP generates an IST within each MST region through calculation.

· MSTP regards each MST region as a single device and generates a CST among these MST regions through calculation.

The CST and ISTs constitute the CIST of the entire network.

MSTI calculation

Within an MST region, MSTP generates different MSTIs for different VLANs based on the VLAN-to-instance mappings. For each spanning tree, MSTP performs a separate calculation process similar to spanning tree calculation in STP. For more information, see "Calculation process of the STP algorithm."

In MSTP, a VLAN frame is forwarded along the following paths:

· Within an MST region, the frame is forwarded along the corresponding MSTI.

· Between two MST regions, the frame is forwarded along the CST.

MSTP implementation on devices

MSTP is compatible with STP and RSTP. Devices that are running MSTP and that are used for spanning tree calculation can identify STP and RSTP protocol frames.

In addition to basic MSTP features, the following features are provided for ease of management:

· Root bridge hold

· Root bridge backup

· Root guard

· BPDU guard

· Loop guard

· TC-BPDU guard

· Port role restriction

· TC-BPDU transmission restriction

· Support for hot swapping of interface cards and active/standby changeover.

Rapid transition mechanism

In STP, a port must wait twice the forward delay (30 seconds by default) before it transits from the blocking state to the forwarding state. The forward delay is related to the hello time and network diameter. If the forward delay is too short, loops might occur. This affects the stability of the network.

RSTP, PVST, and MSTP all use the rapid transition mechanism to speed up port state transition for edge ports, root ports, and designated ports. The rapid transition mechanism for designated ports is also known as the proposal/agreement (P/A)_transition.

Edge port rapid transition

As shown in Figure 40, Port C3 is an edge port connected to a host. When a network topology change occurs, the port can immediately transit from the blocking state to the forwarding state because no loop will be caused.

Because a device cannot determine whether a port is directly connected to a terminal, you must manually configure the port as an edge port.

Figure 40 Edge port rapid transition

Root port rapid transition

When a root port is blocked, the bridge will elect the alternate port with the highest priority as the new root port. If the new root port's peer is in the forwarding state, the new root port immediately transits to the forwarding state.

As shown in Figure 41, Port C2 on Device C is a root port and Port C1 is an alternate port. When Port C2 transits to the blocking state, Port C1 is elected as the root port and immediately transits to the forwarding state.

Figure 41 Root port rapid transition

P/A transition

The P/A transition enables a designated port to rapidly transit to the forwarding state after a handshake with its peer. The P/A transition applies only to point-to-point links.

· P/A transition for RSTP and PVST.

In RSTP or PVST, the ports on a new link or recovered link are designated ports in blocking state. When one of the designated ports transits to the discarding or learning state, it sets the proposal flag in its BPDU. Its peer bridge receives the BPDU and determines whether the receiving port is the root port. If it is the root port, the bridge blocks the other ports except edge ports. The bridge then replies an agreement BPDU to the designated port. The designated port immediately transits to the forwarding state upon receiving the agreement BPDU. If the designated port does not receive the agreement BPDU, it waits for twice the forward delay to transit to the forwarding state.

As shown in Figure 42, the P/A transition operates as follows:

a. Device A sends a proposal BPDU to Device B through GigabitEthernet 2/0/1.

b. Device B receives the proposal BPDU on GigabitEthernet 2/0/2. GigabitEthernet 2/0/2 is elected as the root port.

c. Device B blocks its designated port GigabitEthernet 2/0/1 and alternate port GigabitEthernet 2/0/3 to eliminate loops.

d. The root port GigabitEthernet 2/0/2 transits to the forwarding state and sends an agreement BPDU to Device A.

e. The designated port GigabitEthernet 2/0/1 on Device A immediately transits to the forwarding state after receiving the agreement BPDU.

Figure 42 P/A transition for RSTP and PVST

· P/A transition for MSTP.

In MSTP, an upstream bridge sets both the proposal and agreement flags in its BPDU. If a downstream bridge receives the BPDU and its receiving port is elected as the root port, the bridge blocks all the other ports except edge ports. The downstream bridge then replies an agreement BPDU to the upstream bridge. The upstream port immediately transits to the forwarding state upon receiving the agreement BPDU. If the upstream port does not receive the agreement BPDU, it waits for twice the forward delay to transit to the forwarding state.

As shown in Figure 43, the P/A transition operates as follows:

a. Device A sets the proposal and agreement flags in its BPDU and sends it to Device B through GigabitEthernet 2/0/1.

b. Device B receives the BPDU. GigabitEthernet 2/0/2 of Device B is elected as the root port.

c. Device B then blocks all its ports except the edge ports.

d. The root port GigabitEthernet 2/0/2 of Device B transits to the forwarding state and sends an agreement BPDU to Device A.

e. GigabitEthernet 2/0/1 of Device A immediately transits to the forwarding state upon receiving the agreement BPDU.

Figure 43 P/A transition for MSTP

Compatibility information

Feature and hardware compatibility

This feature is supported only on the following ports:

· Fixed Layer 2 Ethernet ports on Ethernet switching modules.

· Layer 2 Ethernet ports on the following modules:

? MSR810/810-W/810-W-DB/810-LM/810-W-LM/810-10-PoE/810-LM-HK/810-W-LM-HK.

? MSR2600-6-X1/2600-10-X1.

? MSR3600-28/3600-51.

? MSR3600-28-SI/3600-51-SI.

? MSR810-LM-GL/810-W-LM-GL/830-6EI-GL/830-10EI-GL/830-6HI-GL/830-10HI-GL/2600-6-X1-GL/3600-28-SI-GL.

Command and hardware compatibility

Commands and descriptions for centralized devices apply to the following routers:

· MSR810/810-W/810-W-DB/810-LM/810-W-LM/810-10-PoE/810-LM-HK/810-W-LM-HK/810-LMS/810-LUS.

· MSR2600-6-X1/2600-10-X1.

· MSR 2630.

· MSR3600-28/3600-51.

· MSR3600-28-SI/3600-51-SI.

· MSR3610-X1/3610-X1-DP/3610-X1-DC/3610-X1-DP-DC.

· MSR 3610/3620/3620-DP/3640/3660.

· MSR810-LM-GL/810-W-LM-GL/830-6EI-GL/830-10EI-GL/830-6HI-GL/830-10HI-GL/2600-6-X1-GL/3600-28-SI-GL.

Commands and descriptions for distributed devices apply to the following routers:

· MSR5620.

· MSR 5660.

· MSR 5680.

Protocols and standards

MSTP is documented in the following protocols and standards:

· IEEE 802.1d, Media Access Control (MAC) Bridges

· IEEE 802.1w, Part 3: Media Access Control (MAC) Bridges—Amendment 2: Rapid Reconfiguration

· IEEE 802.1s, Virtual Bridged Local Area Networks—Amendment 3: Multiple Spanning Trees

· IEEE 802.1Q-REV/D1.3, Media Access Control (MAC) Bridges and Virtual Bridged Local Area Networks —Clause 13: Spanning tree Protocols

Spanning tree configuration task lists

Before configuring a spanning tree, complete the following tasks:

· Determine the spanning tree protocol to be used (STP, RSTP, PVST, or MSTP).

· Plan the device roles (the root bridge or leaf node).

When you configure spanning tree protocols, follow these restrictions and guidelines:

· Configurations made in system view take effect globally. Configurations made in Ethernet interface view or WLAN mesh interface view take effect only on the interface. Configurations made in Layer 2 aggregate interface view take effect only on the aggregate interface. Configurations made on an aggregation member port can take effect only after the port is removed from the aggregation group.

· After you enable a spanning tree protocol on a Layer 2 aggregate interface, the system performs spanning tree calculation on the Layer 2 aggregate interface. It does not perform spanning tree calculation on the aggregation member ports. The spanning tree protocol enable state and forwarding state of each selected member port is consistent with those of the corresponding Layer 2 aggregate interface.

· The member ports of an aggregation group do not participate in spanning tree calculation. However, the ports still reserve their spanning tree configurations for participating in spanning tree calculation after leaving the aggregation group.

STP configuration task list

Tasks at a glance
Configuring the root bridge: · (Required.) Setting the spanning tree mode · (Optional.) Configuring the root bridge or a secondary root bridge · (Optional.) Configuring the device priority · (Optional.) Configuring the network diameter of a switched network · (Optional.) Setting spanning tree timers · (Optional.) Setting the timeout factor · (Optional.) Configuring the BPDU transmission rate · (Optional.) Enabling outputting port state transition information · (Required.) Enabling the spanning tree feature
Configuring the leaf nodes: · (Required.) Setting the spanning tree mode · (Optional.) Configuring the device priority · (Optional.) Setting the timeout factor · (Optional.) Configuring the BPDU transmission rate · (Optional.) Configuring path costs of ports · (Optional.) Configuring the port priority · (Optional.) Enabling outputting port state transition information · (Required.) Enabling the spanning tree feature
(Optional.) Configuring TC Snooping
(Optional.) Configuring protection features
(Optional.) Enabling SNMP notifications for new-root election and topology change events

RSTP configuration task list

Tasks at a glance
Configuring the root bridge: · (Required.) Setting the spanning tree mode · (Optional.) Configuring the root bridge or a secondary root bridge · (Optional.) Configuring the device priority · (Optional.) Configuring the network diameter of a switched network · (Optional.) Setting spanning tree timers · (Optional.) Setting the timeout factor · (Optional.) Configuring the BPDU transmission rate · (Optional.) Configuring edge ports · (Optional.) Configuring the port link type · (Optional.) Enabling outputting port state transition information · (Required.) Enabling the spanning tree feature
Configuring the leaf nodes: · (Required.) Setting the spanning tree mode · (Optional.) Configuring the device priority · (Optional.) Setting the timeout factor · (Optional.) Configuring the BPDU transmission rate · (Optional.) Configuring edge ports · (Optional.) Configuring path costs of ports · (Optional.) Configuring the port priority · (Optional.) Configuring the port link type · (Optional.) Enabling outputting port state transition information · (Required.) Enabling the spanning tree feature
(Optional.) Performing mCheck
(Optional.) Configuring TC Snooping
(Optional.) Configuring protection features
(Optional.) Enabling SNMP notifications for new-root election and topology change events

PVST configuration task list

Tasks at a glance
Configuring the root bridge: · (Required.) Setting the spanning tree mode · (Optional.) Configuring the root bridge or a secondary root bridge · (Optional.) Configuring the device priority · (Optional.) Configuring the network diameter of a switched network · (Optional.) Setting spanning tree timers · (Optional.) Setting the timeout factor · (Optional.) Configuring the BPDU transmission rate · (Optional.) Configuring edge ports · (Optional.) Configuring the port link type · (Optional.) Enabling outputting port state transition information · (Required.) Enabling the spanning tree feature
Configuring the leaf nodes: · (Required.) Setting the spanning tree mode · (Optional.) Configuring the device priority · (Optional.) Setting the timeout factor · (Optional.) Configuring the BPDU transmission rate · (Optional.) Configuring edge ports · (Optional.) Configuring path costs of ports · (Optional.) Configuring the port priority · (Optional.) Configuring the port link type · (Optional.) Enabling outputting port state transition information · (Required.) Enabling the spanning tree feature
(Optional.) Performing mCheck
(Optional.) Disabling inconsistent PVID protection
(Optional.) Configuring protection features
(Optional.) Enabling SNMP notifications for new-root election and topology change events

MSTP configuration task list

Tasks at a glance
Configuring the root bridge: · (Required.) Setting the spanning tree mode · (Required.) Configuring an MST region · (Optional.) Configuring the root bridge or a secondary root bridge · (Optional.) Configuring the device priority · (Optional.) Configuring the maximum hops of an MST region · (Optional.) Configuring the network diameter of a switched network · (Optional.) Setting spanning tree timers · (Optional.) Setting the timeout factor · (Optional.) Configuring the BPDU transmission rate · (Optional.) Configuring edge ports · (Optional.) Configuring the port link type · (Optional.) Configuring the mode a port uses to recognize and send MSTP frames · (Optional.) Enabling outputting port state transition information · (Required.) Enabling the spanning tree feature
Configuring the leaf nodes: · (Required.) Setting the spanning tree mode · (Required.) Configuring an MST region · (Optional.) Configuring the device priority · (Optional.) Setting the timeout factor · (Optional.) Configuring the BPDU transmission rate · (Optional.) Configuring edge ports · (Optional.) Configuring path costs of ports · (Optional.) Configuring the port priority · (Optional.) Configuring the port link type · (Optional.) Configuring the mode a port uses to recognize and send MSTP frames · (Optional.) Enabling outputting port state transition information · (Required.) Enabling the spanning tree feature
(Optional.) Performing mCheck
(Optional.) Configuring Digest Snooping
(Optional.) Configuring No Agreement Check
(Optional.) Configuring TC Snooping
(Optional.) Configuring protection features
(Optional.) Enabling SNMP notifications for new-root election and topology change events

Setting the spanning tree mode

The spanning tree modes include:

· STP mode—All ports of the device send STP BPDUs. Select this mode when the peer device of a port supports only STP.

· RSTP mode—All ports of the device send RSTP BPDUs. A port in this mode automatically transits to the STP mode when it receives STP BPDUs from the peer device. A port in this mode does not transit to the MSTP mode when it receives MSTP BPDUs from the peer device.

· PVST mode—All ports of the device send PVST BPDUs. Each VLAN maintains a spanning tree. In a network, the amount of spanning trees maintained by all devices equals the number of PVST-enabled VLANs multiplied by the number of PVST-enabled ports. If the amount of spanning trees exceeds the capacity of the network, device CPUs will be overloaded. Packet forwarding is interrupted, and the network becomes unstable.

· MSTP mode—All ports of the device send MSTP BPDUs. A port in this mode automatically transits to the STP mode when receiving STP BPDUs from the peer device. A port in this mode does not transit to the RSTP mode when receiving RSTP BPDUs from the peer device.

The MSTP mode is compatible with the RSTP mode, and the RSTP mode is compatible with the STP mode.

Compatibility of the PVST mode depends on the link type of a port.

· On an access port, the PVST mode is compatible with other spanning tree modes in all VLANs.

· On a trunk port or hybrid port, the PVST mode is compatible with other spanning tree modes only in the default VLAN.

To set the spanning tree mode:

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Set the spanning tree mode.	stp mode { mstp \| pvst \| rstp \| stp }	The default setting is the MSTP mode.

Configuring an MST region

Spanning tree devices belong to the same MST region if they are both connected through a physical link and configured with the following details:

· Format selector (0 by default, not configurable).

· MST region name.

· MST region revision level.

· VLAN-to-instance mapping entries in the MST region.

The configuration of MST region-related parameters (especially the VLAN-to-instance mapping table) might cause MSTP to begin a new spanning tree calculation. To reduce the possibility of topology instability, the MST region configuration takes effect only after you activate it by doing one of the following:

· Use the active region-configuration command.

· Enable a spanning tree protocol by using the stp global enable command if the spanning tree protocol is disabled.

In STP, RSTP, or PVST mode, MST region configurations do not take effect.

To configure an MST region:

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Enter MST region view.	stp region-configuration	N/A
3. Configure the MST region name.	region-name name	The default setting is the MAC address.
4. Configure the VLAN-to-instance mapping table.	· instance instance-id vlan vlan-id-list · vlan-mapping modulo modulo	Use one of the commands. By default, all VLANs in an MST region are mapped to the CIST (or MSTI 0).
5. Configure the MSTP revision level of the MST region.	revision-level level	The default setting is 0.
6. (Optional.) Display the MST region configurations that are not activated yet.	check region-configuration	N/A
7. Manually activate MST region configuration.	active region-configuration	N/A

Configuring the root bridge or a secondary root bridge

You can have the spanning tree protocol determine the root bridge of a spanning tree through calculation. You can also specify a device as the root bridge or as a secondary root bridge.

A device has independent roles in different spanning trees. It can act as the root bridge in one spanning tree and as a secondary root bridge in another. However, one device cannot be the root bridge and a secondary root bridge in the same spanning tree.

A spanning tree can have only one root bridge. If multiple devices can be selected as the root bridge in a spanning tree, the device with the lowest MAC address is selected.

When the root bridge of an instance fails or is shut down and no new root bridge is specified, the following events occur:

· If you specify only one secondary root bridge, it becomes the root bridge.

· If you specify multiple secondary root bridges for the instance, the secondary root bridge with the lowest MAC address is given priority.

· If you do not specify a secondary root bridge, a new root bridge is calculated.

You can specify one root bridge for each spanning tree, regardless of the device priority settings. Once you specify a device as the root bridge or a secondary root bridge, you cannot change its priority.

You can configure a device as the root bridge by setting the device priority to 0. For the device priority configuration, see "Configuring the device priority."

Configuring the current device as the root bridge of a specific spanning tree

Step

Command

Remarks

1. Enter system view.

system-view

N/A

2. Configure the current device as the root bridge.

· In STP/RSTP mode:
stp root primary

· In PVST mode:
stp vlan vlan-id-list root primary

· In MSTP mode:
stp [ instance instance-list ] root primary

By default, a device does not function as the root bridge.

Configuring the current device as a secondary root bridge of a specific spanning tree

Step

Command

Remarks

1. Enter system view.

system-view

N/A

2. Configure the current device as a secondary root bridge.

· In STP/RSTP mode:
stp root secondary

· In PVST mode:
stp vlan vlan-id-list root secondary

· In MSTP mode:
stp [ instance instance-list ] root secondary

By default, a device does not function as a secondary root bridge.

Configuring the device priority

Device priority is a factor in calculating the spanning tree. The priority of a device determines whether the device can be elected as the root bridge of a spanning tree. A lower value indicates a higher priority. You can set the priority of a device to a low value to specify the device as the root bridge of the spanning tree. A spanning tree device can have different priorities in different spanning trees.

During root bridge selection, if all devices in a spanning tree have the same priority, the one with the lowest MAC address is selected. You cannot change the priority of a device after it is configured as the root bridge or as a secondary root bridge.

To configure the priority of a device in a specified MSTI:

Step

Command

Remarks

1. Enter system view.

system-view

N/A

2. Configure the priority of the current device.

· In STP/RSTP mode:
stp priority priority

· In PVST mode:
stp vlan vlan-id-list priority priority

· In MSTP mode:
stp [ instance instance-list ] priority priority

The default setting is 32768.

Configuring the maximum hops of an MST region

Restrict the region size by setting the maximum hops of an MST region. The hop limit configured on the regional root bridge is used as the hop limit for the MST region.

Configuration BPDUs sent by the regional root bridge always have a hop count set to the maximum value. When a device receives this configuration BPDU, it decrements the hop count by one, and uses the new hop count in the BPDUs that it propagates. When the hop count of a BPDU reaches zero, it is discarded by the device that received it. Devices beyond the reach of the maximum hops can no longer participate in spanning tree calculations, so the size of the MST region is limited.

Make this configuration only on the root bridge. All other devices in the MST region use the maximum hop value set for the root bridge.

You can configure the maximum hops of an MST region based on the STP network size. As a best practice, set the maximum hops to a value that is greater than the maximum hops of each edge device to the root bridge.

To configure the maximum number of hops of an MST region:

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Configure the maximum hops of the MST region.	stp max-hops hops	The default setting is 20.

Configuring the network diameter of a switched network

Any two terminal devices in a switched network can reach each other through a specific path, and there are a series of devices on the path. The switched network diameter is the maximum number of devices on the path for an edge device to reach another one in the switched network through the root bridge. The network diameter indicates the network size. The bigger the diameter, the larger the network size.

Based on the network diameter you configured, the system automatically sets an optimal hello time, forward delay, and max age for the device.

In STP, RSTP, or MSTP mode, each MST region is considered a device. The configured network diameter takes effect only on the CIST (or the common root bridge) but not on other MSTIs.

In PVST mode, the configured network diameter takes effect only on the root bridges of the specified VLANs.

To configure the network diameter of a switched network:

Step

Command

Remarks

1. Enter system view.

system-view

N/A

2. Configure the network diameter of the switched network.

· In STP/RSTP/MSTP mode:
stp bridge-diameter diameter

· In PVST mode:
stp vlan vlan-id-list bridge-diameter diameter

The default setting is 7.

Setting spanning tree timers

The following timers are used for spanning tree calculation:

· Forward delay—Delay time for port state transition. To prevent temporary loops on a network, the spanning tree feature sets an intermediate port state (the learning state) before it transits from the discarding state to the forwarding state. The feature also requires that the port transit its state after a forward delay timer. This ensures that the state transition of the local port stays synchronized with the peer.

· Hello time—Interval at which the device sends configuration BPDUs to detect link failures. If the device does not receive configuration BPDUs within the timeout period, it recalculates the spanning tree. The formula for calculating the timeout period is timeout period = timeout factor × 3 × hello time.

· Max age—In the CIST of an MSTP network, the device uses the max age timer to determine whether a configuration BPDU received by a port has expired. If it is expired, a new spanning tree calculation process starts. The max age timer does not take effect on MSTIs.

To ensure a fast topology convergence, make sure the timer settings meet the following formulas:

· 2 × (forward delay – 1 second) ≥ max age

· Max age ≥ 2 × (hello time + 1 second)

Do not manually set the spanning tree timers. As a best practice, specify the network diameter and letting spanning tree protocols automatically calculate the timers based on the network diameter. If the network diameter uses the default value, the timers also use their default values.

Set the timers only on the root bridge. The timer settings on the root bridge apply to all devices on the entire switched network.

Configuration restrictions and guidelines

When you set spanning tree timers, follow these restrictions and guidelines:

· The length of the forward delay is related to the network diameter of the switched network. The larger the network diameter is, the longer the forward delay time should be. As a best practice, use the automatically calculated value because inappropriate forward delay setting might cause temporary redundant paths or increase the network convergence time.

· An appropriate hello time setting enables the device to promptly detect link failures on the network without using excessive network resources. If the hello time is too long, the device mistakes packet loss for a link failure and triggers a new spanning tree calculation process. If the hello time is too short, the device frequently sends the same configuration BPDUs, which wastes device and network resources. As a best practice, use the automatically calculated value.

· If the max age timer is too short, the device frequently begins spanning tree calculations and might mistake network congestion as a link failure. If the max age timer is too long, the device might fail to promptly detect link failures and quickly launch spanning tree calculations, reducing the auto-sensing capability of the network. As a best practice, use the automatically calculated value.

Configuration procedure

To set the spanning tree timers:

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Set the forward delay timer.	· In STP/RSTP/MSTP mode: stp timer forward-delay time · In PVST mode: stp vlan vlan-id-list timer forward-delay time	The default setting is 15 seconds.
3. Set the hello timer.	· In STP/RSTP/MSTP mode: stp timer hello time · In PVST mode: stp vlan vlan-id-list timer hello time	The default setting is 2 seconds.
4. Set the max age timer.	· In STP/RSTP/MSTP mode: stp timer max-age time · In PVST mode: stp vlan vlan-id-list timer max-age time	The default setting is 20 seconds.

Setting the timeout factor

The timeout factor is a parameter used to decide the timeout period. The formula for calculating the timeout period is: timeout period = timeout factor × 3 × hello time.

In a stable network, each non-root-bridge device forwards configuration BPDUs to the downstream devices at the hello time interval to detect link failures. If a device does not receive a BPDU from the upstream device within nine times the hello time, it assumes that the upstream device has failed. Then, it starts a new spanning tree calculation process.

A device might fail to receive a BPDU from the upstream device because the upstream device is busy. If a spanning tree calculation occurs, the calculation can fail and also waste network resources. On a stable network, you can prevent undesired spanning tree calculations by setting the timeout factor to 5, 6, or 7.

To set the timeout factor:

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Set the timeout factor of the device.	stp timer-factor factor	The default setting is 3.

Configuring the BPDU transmission rate

The maximum number of BPDUs a port can send within each hello time equals the BPDU transmission rate plus the hello timer value. Configure an appropriate BPDU transmission rate based on the physical status of the port and the network structure.

The higher the BPDU transmission rate, the more BPDUs are sent within each hello time, and the more system resources are used. By setting an appropriate BPDU transmission rate, you can limit the rate at which the port sends BPDUs. Setting an appropriate rate also prevents spanning tree protocols from using excessive network resources when the network topology changes. As a best practice, use the default setting.

To configure the BPDU transmission rate:

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Enter Layer 2 Ethernet interface or Layer 2 aggregate interface view.	interface interface-type interface-number	N/A
3. Configure the BPDU transmission rate of the ports.	stp transmit-limit limit	The default setting is 10.

Configuring edge ports

If a port directly connects to a user terminal rather than another device or a shared LAN segment, this port is regarded as an edge port. When network topology change occurs, an edge port will not cause a temporary loop. Because a device does not determine whether a port is directly connected to a terminal, you must manually configure the port as an edge port. After that, the port can rapidly transit from the blocking state to the forwarding state.

Configuration restrictions and guidelines

When you configure edge ports, follow these restrictions and guidelines:

· If BPDU guard is disabled, a port set as an edge port becomes a non-edge port again if it receives a BPDU from another port. To restore the edge port, re-enable it.

· If a port directly connects to a user terminal, configure it as an edge port and enable BPDU guard for it. This enables the port to quickly transit to the forwarding state when ensuring network security.

· On a port, the loop guard feature and the edge port setting are mutually exclusive.

Configuration procedure

To configure a port as an edge port:

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Enter Layer 2 Ethernet interface or Layer 2 aggregate interface view.	interface interface-type interface-number	N/A
3. Configure the current ports as edge ports.	stp edged-port	By default, all ports are non-edge ports.

Configuring path costs of ports

Path cost is a parameter related to the link speed of a port. On a spanning tree device, a port can have different path costs in different MSTIs. Setting appropriate path costs allows VLAN traffic flows to be forwarded along different physical links, achieving VLAN-based load balancing.

You can have the device automatically calculate the default path cost, or you can configure the path cost for ports.

Specifying a standard for the device to use when it calculates the default path cost

CAUTION:

If you change the standard that the device uses to calculate the default path costs, you restore the path costs to the default.

You can specify a standard for the device to use in automatic calculation for the default path cost. The device supports the following standards:

· dot1d-1998—The device calculates the default path cost for ports based on IEEE 802.1d-1998.

· dot1t—The device calculates the default path cost for ports based on IEEE 802.1t.

· legacy—The device calculates the default path cost for ports based on a private standard.

When you specify a standard for the device to use when it calculates the default path cost, follow these guidelines:

· When it calculates the path cost for an aggregate interface, IEEE 802.1t takes into account the number of Selected ports in its aggregation group. However, IEEE 802.1d-1998 does not take into account the number of Selected ports. The calculation formula of IEEE 802.1t is: Path cost = 200,000,000/link speed (in 100 kbps). The link speed is the sum of the link speed values of the Selected ports in the aggregation group.

· IEEE 802.1d-1998 or the private standard always assigns the smallest possible value to a single port or aggregate interface with a speed exceeding 10 Gbps. The forwarding path selected based on this criterion might not be the best one. To solve this problem, perform one of the following tasks:

? Use dot1t as the standard for default path cost calculation.

? Manually set the path cost for the port (see "Configuring path costs of ports").

To specify a standard for the device to use when it calculates the default path cost:

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Specify a standard for the device to use when it calculates the default path costs of its ports.	stp pathcost-standard { dot1d-1998 \| dot1t \| legacy }	By default, the device uses legacy to calculate the default path costs of its ports.

Table 18 Mappings between the link speed and the path cost

Link speed	Port type	Path cost
Link speed	Port type	IEEE 802.1d-1998	IEEE 802.1t	Private standard
0	N/A	65535	200000000	200000
10 Mbps	Single port	100	2000000	2000
	Aggregate interface containing two Selected ports		1000000	1800
	Aggregate interface containing three Selected ports		666666	1600
	Aggregate interface containing four Selected ports		500000	1400
100 Mbps	Single port	19	200000	200
	Aggregate interface containing two Selected ports		100000	180
	Aggregate interface containing three Selected ports		66666	160
	Aggregate interface containing four Selected ports		50000	140
1000 Mbps	Single port	4	20000	20
	Aggregate interface containing two Selected ports		10000	18
	Aggregate interface containing three Selected ports		6666	16
	Aggregate interface containing four Selected ports		5000	14
10 Gbps	Single port	2	2000	2
	Aggregate interface containing two Selected ports		1000	1
	Aggregate interface containing three Selected ports		666	1
	Aggregate interface containing four Selected ports		500	1
20 Gbps	Single port	1	1000	1
	Aggregate interface containing two Selected ports		500	1
	Aggregate interface containing three Selected ports		333	1
	Aggregate interface containing four Selected ports		250	1
40 Gbps	Single port	1	500	1
	Aggregate interface containing two Selected ports		250	1
	Aggregate interface containing three Selected ports		166	1
	Aggregate interface containing four Selected ports		125	1
100 Gbps	Single port	1	200	1
	Aggregate interface containing two Selected ports		100	1
	Aggregate interface containing three Selected ports		66	1
	Aggregate interface containing four Selected ports		50	1

Configuring path costs of ports

When the path cost of a port changes, the system recalculates the role of the port and initiates a state transition.

To configure the path cost of a port:

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Enter Layer 2 Ethernet interface or Layer 2 aggregate interface view.	interface interface-type interface-number	N/A
3. Configure the path cost of the ports.	· In STP/RSTP mode: stp cost cost-value · In PVST mode: stp vlan vlan-id-list cost cost-value · In MSTP mode: stp [ instance instance-list ] cost cost-value	By default, the system automatically calculates the path cost of each port.

Configuration example

# In MSTP mode, perform the following tasks:

· Configure the device to calculate the default path costs of its ports by using IEEE 802.1d-1998.

· Set the path cost of GigabitEthernet 2/0/3 to 200 on MSTI 2.

<Sysname> system-view

[Sysname] stp pathcost-standard dot1d-1998

Cost of every port will be reset and automatically re-calculated after you change the current pathcost standard. Continue?[Y/N]:y

Cost of every port has been re-calculated.

[Sysname] interface gigabitethernet 2/0/3

[Sysname-GigabitEthernet2/0/3] stp instance 2 cost 200

# In PVST mode, perform the following tasks:

· Configure the device to calculate the default path costs of its ports by using IEEE 802.1d-1998.

· Set the path cost of GigabitEthernet 2/0/3 to 2000 on VLAN 20 through VLAN 30.

<Sysname> system-view

[Sysname] stp pathcost-standard dot1d-1998

Cost of every port will be reset and automatically re-calculated after you change the current pathcost standard. Continue?[Y/N]:y

Cost of every port has been re-calculated

[Sysname] interface gigabitethernet 2/0/3

[Sysname-GigabitEthernet2/0/3] stp vlan 20 to 30 cost 2000

Configuring the port priority

The priority of a port is a factor that determines whether the port can be elected as the root port of a device. If all other conditions are the same, the port with the highest priority is elected as the root port.

On a spanning tree device, a port can have different priorities and play different roles in different spanning trees. As a result, data of different VLANs can be propagated along different physical paths, implementing per-VLAN load balancing. You can set port priority values based on the actual networking requirements.

When the priority of a port changes, the system recalculates the port role and initiates a state transition.

To configure the priority of a port:

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Enter Layer 2 Ethernet interface or Layer 2 aggregate interface view.	interface interface-type interface-number	N/A
3. Configure the port priority.	· In STP/RSTP mode: stp port priority priority · In PVST mode: stp vlan vlan-id-list port priority priority · In MSTP mode: stp [ instance instance-list ] port priority priority	The default setting is 128 for all ports.

Configuring the port link type

A point-to-point link directly connects two devices. If two root ports or designated ports are connected over a point-to-point link, they can rapidly transit to the forwarding state after a proposal-agreement handshake process.

Configuration restrictions and guidelines

When you configure the port link type, follow these restrictions and guidelines:

· You can configure the link type as point-to-point for a Layer 2 aggregate interface or a port that operates in full duplex mode. As a best practice, use the default setting and letting the device automatically detect the port link type.

· In PVST or MSTP mode, the stp point-to-point force-false or stp point-to-point force-true command configured on a port takes effect on all VLANs or all MSTIs.

· Before you set the link type of a port to point-to-point, make sure the port is connected to a point-to-point link. Otherwise, a temporary loop might occur.

Configuration procedure

To configure the link type of a port:

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Enter Layer 2 Ethernet interface or Layer 2 aggregate interface view.	interface interface-type interface-number	N/A
3. Configure the port link type.	stp point-to-point { auto \| force-false \| force-true }	By default, the link type is auto where the port automatically detects the link type.

Configuring the mode a port uses to recognize and send MSTP frames

A port can receive and send MSTP frames in the following formats:

· dot1s—802.1s-compliant standard format

· legacy—Compatible format

By default, the frame format recognition mode of a port is auto. The port automatically distinguishes the two MSTP frame formats, and determines the format of frames that it will send based on the recognized format.

You can configure the MSTP frame format on a port. Then, the port sends only MSTP frames of the configured format to communicate with devices that send frames of the same format.

By default, a port in auto mode sends 802.1s MSTP frames. When the port receives an MSTP frame of a legacy format, the port starts to send frames only of the legacy format. This prevents the port from frequently changing the format of sent frames. To configure the port to send 802.1s MSTP frames, shut down and then bring up the port.

When the number of existing MSTIs exceeds 48, the port can send only 802.1s MSTP frames.

To configure the MSTP frame format to be supported on a port:

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Enter Layer 2 Ethernet interface or Layer 2 aggregate interface view.	interface interface-type interface-number	N/A
3. Configure the mode that the port uses to recognize/send MSTP frames.	stp compliance { auto \| dot1s \| legacy }	The default setting is auto.

Enabling outputting port state transition information

In a large-scale spanning tree network, you can enable devices to output the port state transition information. Then, you can monitor the port states in real time.

To enable outputting port state transition information:

Step

Command

Remarks

1. Enter system view.

system-view

N/A

2. Enable outputting port state transition information.

· In STP/RSTP mode:
stp port-log instance 0

· In PVST mode:
stp port-log vlan vlan-id-list

· In MSTP mode:
stp port-log { all | instance instance-list }

By default, this feature is enabled.

Enabling the spanning tree feature

You must enable the spanning tree feature for the device before any other spanning tree related configurations can take effect. In STP, RSTP, or MSTP mode, make sure the spanning tree feature is enabled globally and on the desired ports. In PVST mode, make sure the spanning tree feature is enabled globally, in the desired VLANs, and on the desired ports.

To exclude specific ports from spanning tree calculation and save CPU resources, disable the spanning tree feature for these ports with the undo stp enable command. Make sure no loops occur in the network after you disable the spanning tree feature on these ports.

Enabling the spanning tree feature in STP/RSTP/MSTP mode

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Enable the spanning tree feature.	stp global enable	By default, the spanning tree feature is globally disabled.
3. Enter Layer 2 Ethernet interface or Layer 2 aggregate interface view.	interface interface-type interface-number	N/A
4. (Optional.) Enable the spanning tree feature for the port.	stp enable	By default, the spanning tree feature is enabled on all ports.

Enabling the spanning tree feature in PVST mode

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Enable the spanning tree feature.	stp global enable	By default, the spanning tree feature is globally disabled.
3. Enable the spanning tree feature in VLANs.	stp vlan vlan-id-list enable	By default, the spanning tree feature is enabled in VLANs.
4. Enter Layer 2 Ethernet interface or Layer 2 aggregate interface view.	interface interface-type interface-number	N/A
5. Enable the spanning tree feature on the port.	stp enable	By default, the spanning tree feature is enabled on all ports.

Performing mCheck

The mCheck feature enables user intervention in the port status transition process.

When a port on an MSTP, RSTP, or PVST device connects to an STP device and receives STP BPDUs, the port automatically transits to the STP mode. However, the port cannot automatically transit back to the original mode when the following conditions exist:

· The peer STP device is shut down or removed.

· The port cannot detect the change.

To forcibly transit the port to operate in the original mode, you can perform an mCheck operation.

For example, Device A, Device B, and Device C are connected in sequence. Device A runs STP, Device B does not run any spanning tree protocol, and Device C runs RSTP, PVST, or MSTP. In this case, when Device C receives an STP BPDU transparently transmitted by Device B, the receiving port transits to the STP mode. If you configure Device B to run RSTP, PVST, or MSTP with Device C, you must perform mCheck operations on the ports interconnecting Device B and Device C.

Configuration restrictions and guidelines

The mCheck operation takes effect on devices operating in MSTP, PVST, or RSTP mode.

Performing mCheck globally

Step	Command
1. Enter system view.	system-view
2. Perform mCheck.	stp global mcheck

Performing mCheck in interface view

Step	Command
1. Enter system view.	system-view
2. Enter Layer 2 Ethernet interface or Layer 2 aggregate interface view.	interface interface-type interface-number
3. Perform mCheck.	stp mcheck

Disabling inconsistent PVID protection

In PVST, if two connected ports use different PVIDs, PVST calculation errors might occur. By default, inconsistent PVID protection is enabled to avoid PVST calculation errors. If PVID inconsistency is detected on a port, the system blocks the port.

If different PVIDs are required on two connected ports, disable inconsistent PVID protection on the devices that host the ports. To avoid PVST calculation errors, make sure the following requirements are met:

· Make sure the VLANs on one device do not use the same ID as the PVID of its peer port (except the default VLAN) on another device.

· If the local port or its peer is a hybrid port, do not configure the local and peer ports as untagged members of the same VLAN.

· Disable inconsistent PVID protection on both the local device and the peer device.

This feature takes effect only when the device is operating in PVST mode.

To disable the inconsistent PVID protection feature:

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Disable the inconsistent PVID protection feature.	stp ignore-pvid-inconsistency	By default, the inconsistent PVID protection feature is enabled.

Configuring Digest Snooping

CAUTION:

Use caution with global Digest Snooping in the following situations:

· When you modify the VLAN-to-instance mappings.

· When you restore the default MST region configuration.

If the local device has different VLAN-to-instance mappings than its neighboring devices, loops or traffic interruption will occur.

As defined in IEEE 802.1s, connected devices are in the same region only when they have the same MST region-related configurations, including:

· Region name.

· Revision level.

· VLAN-to-instance mappings.

A spanning tree device identifies devices in the same MST region by determining the configuration ID in BPDUs. The configuration ID includes the region name, revision level, and configuration digest. It is 16-byte long and is the result calculated through the HMAC-MD5 algorithm based on VLAN-to-instance mappings.

Because spanning tree implementations vary by vendor, the configuration digests calculated through private keys are different. The devices of different vendors in the same MST region cannot communicate with each other.

To enable communication between an H3C device and a third-party device in the same MST region, enable Digest Snooping on the H3C device port connecting them.

Configuration restrictions and guidelines

When you configure Digest Snooping, follow these restrictions and guidelines:

· Before you enable Digest Snooping, make sure associated devices of different vendors are connected and run spanning tree protocols.

· With Digest Snooping enabled, in-the-same-region verification does not require comparison of configuration digest. The VLAN-to-instance mappings must be the same on associated ports.

· To make Digest Snooping take effect, you must enable Digest Snooping both globally and on associated ports. As a best practice, enable Digest Snooping on all associated ports first and then enable it globally. This will make the configuration take effect on all configured ports and reduce impact on the network.

· To prevent loops, do not enable Digest Snooping on MST region edge ports.

· As a best practice, enable Digest Snooping first and then the spanning tree feature. To avoid traffic interruption, do not configure Digest Snooping when the network is already working well.

Configuration procedure

Use this feature on when your H3C device is connected to a third-party device that uses its private key to calculate the configuration digest.

To configure Digest Snooping:

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Enter Layer 2 Ethernet interface or Layer 2 aggregate interface view.	interface interface-type interface-number	N/A
3. Enable Digest Snooping on the interface.	stp config-digest-snooping	By default, Digest Snooping is disabled on ports.
4. Return to system view.	quit	N/A
5. Enable Digest Snooping globally.	stp global config-digest-snooping	By default, Digest Snooping is disabled globally.

Digest Snooping configuration example

Network requirements

As shown in Figure 44, Device A and Device B connect to Device C, which is a third-party device. All these devices are in the same region.

Enable Digest Snooping on the ports of Device A and Device B that connect to Device C, so that the three devices can communicate with one another.

Figure 44 Network diagram

Configuration procedure

# Enable Digest Snooping on GigabitEthernet 2/0/1 of Device A and enable global Digest Snooping on Device A.

<DeviceA> system-view

[DeviceA] interface gigabitethernet 2/0/1

[DeviceA-GigabitEthernet2/0/1] stp config-digest-snooping

[DeviceA-GigabitEthernet2/0/1] quit

[DeviceA] stp global config-digest-snooping

# Enable Digest Snooping on GigabitEthernet 2/0/1 of Device B and enable global Digest Snooping on Device B.

<DeviceB> system-view

[DeviceB] interface gigabitethernet 2/0/1

[DeviceB-GigabitEthernet2/0/1] stp config-digest-snooping

[DeviceB-GigabitEthernet2/0/1] quit

[DeviceB] stp global config-digest-snooping

Configuring No Agreement Check

In RSTP and MSTP, the following types of messages are used for rapid state transition on designated ports:

· Proposal—Sent by designated ports to request rapid transition

· Agreement—Used to acknowledge rapid transition requests

Both RSTP and MSTP devices can perform rapid transition on a designated port only when the port receives an agreement packet from the downstream device. RSTP and MSTP devices have the following differences:

· For MSTP, the root port of the downstream device sends an agreement packet only after it receives an agreement packet from the upstream device.

· For RSTP, the downstream device sends an agreement packet whether or not an agreement packet from the upstream device is received.

Figure 45 Rapid state transition of an MSTP designated port

Figure 46 Rapid state transition of an RSTP designated port

If the upstream device is a third-party device, the rapid state transition implementation might be limited as follows:

· The upstream device uses a rapid transition mechanism similar to that of RSTP.

· The downstream device runs MSTP and does not operate in RSTP mode.

In this case, the following occurs:

1. The root port on the downstream device receives no agreement from the upstream device.

2. It sends no agreement to the upstream device.

As a result, the designated port of the upstream device can transit to the forwarding state only after a period twice the forward delay.

To enable the designated port of the upstream device to transit its state rapidly, enable No Agreement Check on the downstream device's port.

Configuration prerequisites

Before you configure the No Agreement Check feature, complete the following tasks:

· Connect a device to a third-party upstream device that supports spanning tree protocols through a point-to-point link.

· Configure the same region name, revision level, and VLAN-to-instance mappings on the two devices.

Configuration procedure

Enable the No Agreement Check feature on the root port.

To configure No Agreement Check:

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Enter Layer 2 Ethernet interface or Layer 2 aggregate interface view.	interface interface-type interface-number	N/A
3. Enable No Agreement Check.	stp no-agreement-check	By default, No Agreement Check is disabled.

No Agreement Check configuration example

Network requirements

As shown in Figure 47, Device A connects to a third-party device that has a different spanning tree implementation. Both devices are in the same region.

The third-party device (Device B) is the regional root bridge, and Device A is the downstream device.

Figure 47 Network diagram

Configuration procedure

# Enable No Agreement Check on GigabitEthernet 2/0/1 of Device A.

<DeviceA> system-view

[DeviceA] interface gigabitethernet 2/0/1

[DeviceA-GigabitEthernet2/0/1] stp no-agreement-check

Configuring TC Snooping

As shown in Figure 48, an IRF fabric connects to two user networks through double links.

· Device A and Device B form the IRF fabric.

· The spanning tree feature is disabled on Device A and Device B and enabled on all devices in user network 1 and user network 2.

· The IRF fabric transparently transmits BPDUs for both user networks and is not involved in the calculation of spanning trees.

When the network topology changes, it takes time for the IRF fabric to update its MAC address table and ARP table. During this period, traffic in the network might be interrupted.

Figure 48 TC Snooping application scenario

image14.emf

To avoid traffic interruption, you can enable TC Snooping on the IRF fabric. After receiving a TC-BPDU through a port, the IRF fabric updates MAC address table and ARP table entries associated with the port's VLAN. In this way, TC Snooping prevents topology change from interrupting traffic forwarding in the network. For more information about the MAC address table and the ARP table, see "Configuring the MAC address table" and Layer 3—IP Services Configuration Guide.

Configuration restrictions and guidelines

When you configure TC Snooping, follow these restrictions and guidelines:

· TC Snooping and the spanning tree feature are mutually exclusive. You must globally disable the spanning tree feature before enabling TC Snooping.

· The priority of BPDU tunneling is higher than that of TC Snooping. When BPDU tunneling is enabled on a port, the TC Snooping feature does not take effect on the port.

· TC Snooping does not support the PVST mode.

Configuration procedure

To enable TC Snooping:

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Globally disable the spanning tree feature.	undo stp global enable	By default, the spanning tree feature is globally disabled.
3. Enable TC Snooping.	stp tc-snooping	By default, TC Snooping is disabled.

Configuring protection features

A spanning tree device supports the following protection features:

· BPDU guard

· Root guard

· Loop guard

· Port role restriction

· TC-BPDU transmission restriction

· TC-BPDU guard

· PVST BPDU guard

Enabling BPDU guard

For access layer devices, the access ports can directly connect to the user terminals (such as PCs) or file servers. The access ports are configured as edge ports to allow rapid transition. When these ports receive configuration BPDUs, the system automatically sets the ports as non-edge ports and starts a new spanning tree calculation process. This causes a change of network topology. Under normal conditions, these ports should not receive configuration BPDUs. However, if someone uses configuration BPDUs maliciously to attack the devices, the network will become unstable.

The spanning tree protocol provides the BPDU guard feature to protect the system against such attacks. When edge ports receive configuration BPDUs on a device with BPDU guard enabled, the device performs the following operations:

· Shuts down these ports.

· Notifies the NMS that these ports have been shut down by the spanning tree protocol.

The device reactivates the shutdown ports after a detection interval set by using the shutdown-interval command. For more information about this command, see Fundamentals Configuration Guide.

BPDU guard does not take effect on loopback-testing-enabled ports. For more information about loopback testing, see Interface Configuration Guide.

Configure BPDU guard on a device with edge ports configured.

To enable BPDU guard:

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Enable the BPDU guard feature for the device.	stp bpdu-protection	By default, BPDU guard is disabled.

Enabling root guard

The root bridge and secondary root bridge of a spanning tree should be located in the same MST region. Especially for the CIST, the root bridge and secondary root bridge are put in a high-bandwidth core region during network design. However, due to possible configuration errors or malicious attacks in the network, the legal root bridge might receive a configuration BPDU with a higher priority. Another device supersedes the current legal root bridge, causing an undesired change of the network topology. The traffic that should go over high-speed links is switched to low-speed links, resulting in network congestion.

To prevent this situation, MSTP provides the root guard feature. If root guard is enabled on a port of a root bridge, this port plays the role of designated port on all MSTIs. After this port receives a configuration BPDU with a higher priority from an MSTI, it performs the following operations:

· Immediately sets that port to the listening state in the MSTI.

· Does not forward the received configuration BPDU.

This is equivalent to disconnecting the link connected to this port in the MSTI. If the port receives no BPDUs with a higher priority within twice the forwarding delay, it reverts to its original state.

On a port, the loop guard feature and the root guard feature are mutually exclusive.

Configure root guard on a designated port.

To enable root guard:

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Enter Layer 2 Ethernet interface or Layer 2 aggregate interface view.	interface interface-type interface-number	N/A
3. Enable the root guard feature.	stp root-protection	By default, root guard is disabled.

Enabling loop guard

By continuing to receive BPDUs from the upstream device, a device can maintain the state of the root port and blocked ports. However, link congestion or unidirectional link failures might cause these ports to fail to receive BPDUs from the upstream devices. In this situation, the device reselects the following port roles:

· Those ports in forwarding state that failed to receive upstream BPDUs become designated ports.

· The blocked ports transit to the forwarding state.

As a result, loops occur in the switched network. The loop guard feature can suppress the occurrence of such loops.

The initial state of a loop guard-enabled port is discarding in every MSTI. When the port receives BPDUs, it transits its state. Otherwise, it stays in the discarding state to prevent temporary loops.

Do not enable loop guard on a port that connects user terminals. Otherwise, the port stays in the discarding state in all MSTIs because it cannot receive BPDUs.

On a port, the loop guard feature is mutually exclusive with the root guard feature or the edge port setting.

Configure loop guard on the root port and alternate ports of a device.

To enable loop guard:

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Enter Layer 2 Ethernet interface or Layer 2 aggregate interface view.	interface interface-type interface-number	N/A
3. Enable the loop guard feature for the ports.	stp loop-protection	By default, loop guard is disabled.

Configuring port role restriction

CAUTION:

Use this feature with caution, because enabling port role restriction on a port might affect the connectivity of the spanning tree topology.

The bridge ID change of a device in the user access network might cause a change to the spanning tree topology in the core network. To avoid this problem, you can enable port role restriction on a port. With this feature enabled, when the port receives a superior BPDU, it becomes an alternate port rather than a root port.

Make this configuration on the port that connects to the user access network.

To configure port role restriction:

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Enter Layer 2 Ethernet interface or Layer 2 aggregate interface view.	interface interface-type interface-number	N/A
3. Enable port role restriction.	stp role-restriction	By default, port role restriction is disabled.

Configuring TC-BPDU transmission restriction

CAUTION:

Enabling TC-BPDU transmission restriction on a port might cause the previous forwarding address table to fail to be updated when the topology changes.

The topology change to the user access network might cause the forwarding address changes to the core network. When the user access network topology is unstable, the user access network might affect the core network. To avoid this problem, you can enable TC-BPDU transmission restriction on a port. With this feature enabled, when the port receives a TC-BPDU, it does not forward the TC-BPDU to other ports.

Make this configuration on the port that connects to the user access network.

To configure TC-BPDU transmission restriction:

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Enter Layer 2 Ethernet interface or Layer 2 aggregate interface view.	interface interface-type interface-number	N/A
3. Enable TC-BPDU transmission restriction.	stp tc-restriction	By default, TC-BPDU transmission restriction is disabled.

Enabling TC-BPDU guard

When a device receives topology change (TC) BPDUs (the BPDUs that notify devices of topology changes), it flushes its forwarding address entries. If someone uses TC-BPDUs to attack the device, the device will receive a large number of TC-BPDUs within a short time. Then, the device is busy with forwarding address entry flushing. This affects network stability.

TC-BPDU guard allows you to set the maximum number of immediate forwarding address entry flushes performed within 10 seconds after the device receives the first TC-BPDU. For TC-BPDUs received in excess of the limit, the device performs a forwarding address entry flush when the time period expires. This prevents frequent flushing of forwarding address entries. As a best practice, enable TC-BPDU guard.

To enable TC-BPDU guard:

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Enable the TC-BPDU guard feature.	stp tc-protection	By default, TC-BPDU guard is enabled. As a best practice, do not disable this feature.
3. (Optional.) Configure the maximum number of forwarding address entry flushes that the device can perform every 10 seconds.	stp tc-protection threshold number	The default setting is 6.

Enabling PVST BPDU guard

An MSTP-enabled device forwards PVST BPDUs as data traffic because it cannot recognize PVST BPDUs. If a PVST-enabled device in another independent network receives the PVST BPDUs, a PVST calculation error might occur. To avoid PVST calculation errors, enable PVST BPDU guard on the MSTP-enabled device. The device shuts down a port if the port receives PVST BPDUs.

To enable PVST BPDU guard:

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Enable PVST BPDU guard.	stp pvst-bpdu-protection	By default, PVST BPDU guard is disabled.

Enabling SNMP notifications for new-root election and topology change events

This task enables the device to generate logs and report new-root election events or spanning tree topology changes to SNMP. For the event notifications to be sent correctly, you must also configure SNMP on the device. For more information about SNMP configuration, see the network management and monitoring configuration guide for the device.

When you use the snmp-agent trap enable stp [ new-root | tc ] command, follow these guidelines:

· The new root keyword applies only to STP, MSTP, and RSTP modes.

· The tc keyword applies only to PVST mode.

· In STP, MSTP, or RSTP mode, the snmp-agent trap enable stp command enables SNMP notifications for new-root election events.

· In PVST mode, the snmp-agent trap enable stp enables SNMP notifications for spanning tree topology changes.

To enable SNMP notifications for new-root election events:

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Enable SNMP notifications for new-root election events.	In STP, MSTP, or RSTP mode, execute either of the following commands: · snmp-agent trap enable stp new root · snmp-agent trap enable stp	The default settings are as follows: · SNMP notifications are disabled for new-root election events. · In MSTP mode, SNMP notifications are enabled in MSTI 0 and disabled in other MSTIs for spanning tree topology changes. · In PVST mode, SNMP notifications are disabled for spanning tree topology changes in all VLANs.
3. Enable SNMP notifications for spanning tree topology changes.	In PVST mode, execute either of the following commands: · snmp-agent trap enable stp tc · snmp-agent trap enable stp

Displaying and maintaining the spanning tree

Execute display commands in any view and reset command in user view.

Task	Command
Display information about ports blocked by spanning tree protection features.	display stp abnormal-port
Display BPDU statistics on ports.	display stp bpdu-statistics [ interface interface-type interface-number [ instance instance-list ] ]
Display information about ports shut down by spanning tree protection features.	display stp down-port
Display the port role calculation history for the specified MSTI or all MSTIs (centralized devices in standalone mode).	display stp [ instance instance-list \| vlan vlan-id-list ] history
Display the port role calculation history for the specified MSTI or all MSTIs (distributed devices in standalone mode/centralized devices in IRF mode).	display stp [ instance instance-list \| vlan vlan-id-list ] history [ slot slot-number ]
Display the port role calculation history for the specified MSTI or all MSTIs (distributed devices in IRF mode).	display stp [ instance instance-list \| vlan vlan-id-list ] history [ chassis chassis-number slot slot-number ]
Display the incoming and outgoing TC/TCN BPDU statistics by all ports in the specified MSTI or all MSTIs (centralized devices in standalone mode).	display stp [ instance instance-list \| vlan vlan-id-list ] tc
Display the incoming and outgoing TC/TCN BPDU statistics by all ports in the specified MSTI or all MSTIs (distributed devices in standalone mode/centralized devices in IRF mode).	display stp [ instance instance-list \| vlan vlan-id-list ] tc [ slot slot-number ]
Display the incoming and outgoing TC/TCN BPDU statistics by all ports in the specified MSTI or all MSTIs (distributed devices in IRF mode).	display stp [ instance instance-list \| vlan vlan-id-list ] tc [ chassis chassis-number slot slot-number ]
Display the spanning tree status and statistics (centralized devices in standalone mode).	display stp [ instance instance-list \| vlan vlan-id-list ] [ interface interface-list ] [ brief ]
Display the spanning tree status and statistics (distributed devices in standalone mode/centralized devices in IRF mode).	display stp [ instance instance-list \| vlan vlan-id-list ] [ interface interface-list \| slot slot-number ] [ brief ]
Display the spanning tree status and statistics (distributed devices in IRF mode).	display stp [ instance instance-list \| vlan vlan-id-list ] [ interface interface-list \| chassis chassis-number slot slot-number ] [ brief ]
Display the MST region configuration information that has taken effect.	display stp region-configuration
Display the root bridge information of all MSTIs.	display stp root
Clear the spanning tree statistics.	reset stp [ interface interface-list ]

Spanning tree configuration example

MSTP configuration example

Network requirements

As shown in Figure 49, all devices on the network are in the same MST region. Device A and Device B work at the distribution layer. Device C and Device D work at the access layer.

Configure MSTP so that frames of different VLANs are forwarded along different spanning trees.

· VLAN 10 frames are forwarded along MSTI 1.

· VLAN 30 frames are forwarded along MSTI 3.

· VLAN 40 frames are forwarded along MSTI 4.

· VLAN 20 frames are forwarded along MSTI 0.

VLAN 10 and VLAN 30 are terminated on the distribution layer devices, and VLAN 40 is terminated on the access layer devices. The root bridges of MSTI 1 and MSTI 3 are Device A and Device B, respectively, and the root bridge of MSTI 4 is Device C.

Figure 49 Network diagram

Configuration procedure

1. Configure VLANs and VLAN member ports. (Details not shown.)

? Create VLAN 10, VLAN 20, and VLAN 30 on both Device A and Device B.

? Create VLAN 10, VLAN 20, and VLAN 40 on Device C.

? Create VLAN 20, VLAN 30, and VLAN 40 on Device D.

? Configure the ports on these devices as trunk ports and assign them to related VLANs.

2. Configure Device A:

# Enter MST region view, and configure the MST region name as example.

<DeviceA> system-view

[DeviceA] stp region-configuration

[DeviceA-mst-region] region-name example

# Map VLAN 10, VLAN 30, and VLAN 40 to MSTI 1, MSTI 3, and MSTI 4, respectively.

[DeviceA-mst-region] instance 1 vlan 10

[DeviceA-mst-region] instance 3 vlan 30

[DeviceA-mst-region] instance 4 vlan 40

# Configure the revision level of the MST region as 0.

[DeviceA-mst-region] revision-level 0

# Activate MST region configuration.

[DeviceA-mst-region] active region-configuration

[DeviceA-mst-region] quit

# Configure the current device as the root bridge of MSTI 1.

[DeviceA] stp instance 1 root primary

# Enable the spanning tree feature globally.

[DeviceA] stp global enable

3. Configure Device B:

# Enter MST region view, and configure the MST region name as example.

<DeviceB> system-view

[DeviceB] stp region-configuration

[DeviceB-mst-region] region-name example

# Map VLAN 10, VLAN 30, and VLAN 40 to MSTI 1, MSTI 3, and MSTI 4, respectively.

[DeviceB-mst-region] instance 1 vlan 10

[DeviceB-mst-region] instance 3 vlan 30

[DeviceB-mst-region] instance 4 vlan 40

# Configure the revision level of the MST region as 0.

[DeviceB-mst-region] revision-level 0

# Activate MST region configuration.

[DeviceB-mst-region] active region-configuration

[DeviceB-mst-region] quit

# Configure the current device as the root bridge of MSTI 3.

[DeviceB] stp instance 3 root primary

# Enable the spanning tree feature globally.

[DeviceB] stp global enable

4. Configure Device C:

# Enter MST region view, and configure the MST region name as example.

<DeviceC> system-view

[DeviceC] stp region-configuration

[DeviceC-mst-region] region-name example

# Map VLAN 10, VLAN 30, and VLAN 40 to MSTI 1, MSTI 3, and MSTI 4, respectively.

[DeviceC-mst-region] instance 1 vlan 10

[DeviceC-mst-region] instance 3 vlan 30

[DeviceC-mst-region] instance 4 vlan 40

# Configure the revision level of the MST region as 0.

[DeviceC-mst-region] revision-level 0

# Activate MST region configuration.

[DeviceC-mst-region] active region-configuration

[DeviceC-mst-region] quit

# Configure the current device as the root bridge of MSTI 4.

[DeviceC] stp instance 4 root primary

# Enable the spanning tree feature globally.

[DeviceC] stp global enable

5. Configure Device D:

# Enter MST region view, and configure the MST region name as example.

<DeviceD> system-view

[DeviceD] stp region-configuration

[DeviceD-mst-region] region-name example

# Map VLAN 10, VLAN 30, and VLAN 40 to MSTI 1, MSTI 3, and MSTI 4, respectively.

[DeviceD-mst-region] instance 1 vlan 10

[DeviceD-mst-region] instance 3 vlan 30

[DeviceD-mst-region] instance 4 vlan 40

# Configure the revision level of the MST region as 0.

[DeviceD-mst-region] revision-level 0

# Activate MST region configuration.

[DeviceD-mst-region] active region-configuration

[DeviceD-mst-region] quit

# Enable the spanning tree feature globally.

[DeviceD] stp global enable

Verifying the configuration

In this example, Device B has the lowest root bridge ID. As a result, Device B is elected as the root bridge in MSTI 0.

When the network is stable, you can use the display stp brief command to display brief spanning tree information on each device.

# Display brief spanning tree information on Device A.

[DeviceA] display stp brief

MST ID Port Role STP State Protection

0 GigabitEthernet2/0/1 ALTE DISCARDING NONE

0 GigabitEthernet2/0/2 DESI FORWARDING NONE

0 GigabitEthernet2/0/3 ROOT FORWARDING NONE

1 GigabitEthernet2/0/1 DESI FORWARDING NONE

1 GigabitEthernet2/0/3 DESI FORWARDING NONE

3 GigabitEthernet2/0/2 DESI FORWARDING NONE

3 GigabitEthernet2/0/3 ROOT FORWARDING NONE

# Display brief spanning tree information on Device B.

[DeviceB] display stp brief

MST ID Port Role STP State Protection

0 GigabitEthernet2/0/1 DESI FORWARDING NONE

0 GigabitEthernet2/0/2 DESI FORWARDING NONE

0 GigabitEthernet2/0/3 DESI FORWARDING NONE

1 GigabitEthernet2/0/2 DESI FORWARDING NONE

1 GigabitEthernet2/0/3 ROOT FORWARDING NONE

3 GigabitEthernet2/0/1 DESI FORWARDING NONE

3 GigabitEthernet2/0/3 DESI FORWARDING NONE

# Display brief spanning tree information on Device C.

[DeviceC] display stp brief

MST ID Port Role STP State Protection

0 GigabitEthernet2/0/1 DESI FORWARDING NONE

0 GigabitEthernet2/0/2 ROOT FORWARDING NONE

0 GigabitEthernet2/0/3 DESI FORWARDING NONE

1 GigabitEthernet2/0/1 ROOT FORWARDING NONE

1 GigabitEthernet2/0/2 ALTE DISCARDING NONE

4 GigabitEthernet2/0/3 DESI FORWARDING NONE

# Display brief spanning tree information on Device D.

[DeviceD] display stp brief

MST ID Port Role STP State Protection

0 GigabitEthernet2/0/1 ROOT FORWARDING NONE

0 GigabitEthernet2/0/2 ALTE DISCARDING NONE

0 GigabitEthernet2/0/3 ALTE DISCARDING NONE

3 GigabitEthernet2/0/1 ROOT FORWARDING NONE

3 GigabitEthernet2/0/2 ALTE DISCARDING NONE

4 GigabitEthernet2/0/3 ROOT FORWARDING NONE

Based on the output, you can draw each MSTI mapped to each VLAN, as shown in Figure 50.

Figure 50 MSTIs mapped to different VLANs

PVST configuration example

Network requirements

As shown in Figure 51, Device A and Device B work at the distribution layer, and Device C and Device D work at the access layer.

Configure PVST to meet the following requirements:

· Frames of a VLAN are forwarded along the spanning trees of the VLAN.

· VLAN 10, VLAN 20, and VLAN 30 are terminated on the distribution layer devices, and VLAN 40 is terminated on the access layer devices.

· The root bridge of VLAN 10 and VLAN 20 is Device A.

· The root bridge of VLAN 30 is Device B.

· The root bridge of VLAN 40 is Device C.

Figure 51 Network diagram

Configuration procedure

1. Configure VLANs and VLAN member ports. (Details not shown.)

? Create VLAN 10, VLAN 20, and VLAN 30 on both Device A and Device B.

? Create VLAN 10, VLAN 20, and VLAN 40 on Device C.

? Create VLAN 20, VLAN 30, and VLAN 40 on Device D.

? Configure the ports on these devices as trunk ports and assign them to related VLANs.

2. Configure Device A:

# Set the spanning tree mode to PVST.

<DeviceA> system-view

[DeviceA] stp mode pvst

# Configure the device as the root bridge of VLAN 10 and VLAN 20.

[DeviceA] stp vlan 10 20 root primary

# Enable the spanning tree feature globally and in VLAN 10, VLAN 20, and VLAN 30.

[DeviceA] stp global enable

[DeviceA] stp vlan 10 20 30 enable

3. Configure Device B:

# Set the spanning tree mode to PVST.

<DeviceB> system-view

[DeviceB] stp mode pvst

# Configure the device as the root bridge of VLAN 30.

[DeviceB] stp vlan 30 root primary

# Enable the spanning tree feature globally and in VLAN 10, VLAN 20, and VLAN 30.

[DeviceB] stp global enable

[DeviceB] stp vlan 10 20 30 enable

4. Configure Device C:

# Set the spanning tree mode to PVST.

<DeviceC> system-view

[DeviceC] stp mode pvst

# Configure the device as the root bridge of VLAN 40.

[DeviceC] stp vlan 40 root primary

# Enable the spanning tree feature globally and in VLAN 10, VLAN 20, and VLAN 40.

[DeviceC] stp global enable

[DeviceC] stp vlan 10 20 40 enable

5. Configure Device D:

# Set the spanning tree mode to PVST.

<DeviceD> system-view

[DeviceD] stp mode pvst

# Enable the spanning tree feature globally and in VLAN 20, VLAN 30, and VLAN 40.

[DeviceD] stp global enable

[DeviceD] stp vlan 20 30 40 enable

Verifying the configuration

When the network is stable, you can use the display stp brief command to display brief spanning tree information on each device.

# Display brief spanning tree information on Device A.

[DeviceA] display stp brief

VLAN ID Port Role STP State Protection

10 GigabitEthernet2/0/1 DESI FORWARDING NONE

10 GigabitEthernet2/0/3 DESI FORWARDING NONE

20 GigabitEthernet2/0/1 DESI FORWARDING NONE

20 GigabitEthernet2/0/2 DESI FORWARDING NONE

20 GigabitEthernet2/0/3 DESI FORWARDING NONE

30 GigabitEthernet2/0/2 DESI FORWARDING NONE

30 GigabitEthernet2/0/3 ROOT FORWARDING NONE

# Display brief spanning tree information on Device B.

[DeviceB] display stp brief

VLAN ID Port Role STP State Protection

10 GigabitEthernet2/0/2 DESI FORWARDING NONE

10 GigabitEthernet2/0/3 ROOT FORWARDING NONE

20 GigabitEthernet2/0/1 DESI FORWARDING NONE

20 GigabitEthernet2/0/2 DESI FORWARDING NONE

20 GigabitEthernet2/0/3 ROOT FORWARDING NONE

30 GigabitEthernet2/0/1 DESI FORWARDING NONE

30 GigabitEthernet2/0/3 DESI FORWARDING NONE

# Display brief spanning tree information on Device C.

[DeviceC] display stp brief

VLAN ID Port Role STP State Protection

10 GigabitEthernet2/0/1 ROOT FORWARDING NONE

10 GigabitEthernet2/0/2 ALTE DISCARDING NONE

20 GigabitEthernet2/0/1 ROOT FORWARDING NONE

20 GigabitEthernet2/0/2 ALTE DISCARDING NONE

20 GigabitEthernet2/0/3 DESI FORWARDING NONE

40 GigabitEthernet2/0/3 DESI FORWARDING NONE

# Display brief spanning tree information on Device D.

[DeviceD] display stp brief

VLAN ID Port Role STP State Protection

20 GigabitEthernet2/0/1 ALTE DISCARDING NONE

20 GigabitEthernet2/0/2 ROOT FORWARDING NONE

20 GigabitEthernet2/0/3 ALTE DISCARDING NONE

30 GigabitEthernet2/0/1 ROOT FORWARDING NONE

30 GigabitEthernet2/0/2 ALTE DISCARDING NONE

40 GigabitEthernet2/0/3 ROOT FORWARDING NONE

Based on the output, you can draw a topology for each VLAN spanning tree, as shown in Figure 52.

Figure 52 VLAN spanning tree topologies

Configuring LLDP

In an L2TP network, LLDP frames can be transparently forwarded from the LAC client to the LNS, but the LNS does not process the LLDP frames. For more information about L2TP, see Layer 2—WAN Access Configuration Guide.

In an L2VPN network, LLDP frames can be transparently forwarded and the CE devices at the two ends of an L2VPN tunnel can establish neighbor relationships. For more information about L2VPN , see MPLS Configuration Guide.

Overview

In a heterogeneous network, a standard configuration exchange platform ensures that different types of network devices from different vendors can discover one another and exchange configuration.

The Link Layer Discovery Protocol (LLDP) is specified in IEEE 802.1AB. The protocol operates on the data link layer to exchange device information between directly connected devices. With LLDP, a device sends local device information as TLV (type, length, and value) triplets in LLDP Data Units (LLDPDUs) to the directly connected devices. Local device information includes its system capabilities, management IP address, device ID, port ID, and so on. The device stores the device information in LLDPDUs from the LLDP neighbors in a standard MIB. For more information about MIBs, see Network Management and Monitoring Configuration Guide. LLDP enables a network management system to quickly detect and identify Layer 2 network topology changes.

Basic concepts

LLDP agent

An LLDP agent is a mapping of an entity where LLDP runs. Multiple LLDP agents can run on the same interface.

LLDP agents are divided into the following types:

· Nearest bridge agent .

· Nearest customer bridge agent.

· Nearest non-TPMR bridge agent.

A Two-port MAC Relay (TPMR) is a type of bridge that has only two externally-accessible bridge ports. It supports a subset of the features of a MAC bridge. A TPMR is transparent to all frame-based media-independent protocols except for the following protocols:

· Protocols destined to it.

· Protocols destined to reserved MAC addresses that the relay feature of the TPMR is configured not to forward.

LLDP exchanges packets between neighbor agents and creates and maintains neighbor information for them. Figure 53 shows the neighbor relationships for these LLDP agents. LLDP has two bridge modes: customer bridge (CB) and service bridge (SB).

Figure 53 LLDP neighbor relationships

LLDP frame formats

LLDP sends device information in LLDP frames. LLDP frames are encapsulated in Ethernet II or Subnetwork Access Protocol (SNAP) frames.

· LLDP frame encapsulated in Ethernet II

Figure 54 Ethernet II-encapsulated LLDP frame

Table 19 Fields in an Ethernet II-encapsulated LLDP frame

Field	Description
Destination MAC address	MAC address to which the LLDP frame is advertised. LLDP specifies different multicast MAC addresses as destination MAC addresses for LLDP frames destined for agents of different types. This helps distinguish between LLDP frames sent and received by different agent types on the same interface. The destination MAC address is fixed to one of the following multicast MAC addresses: · 0x0180-C200-000E for LLDP frames destined for nearest bridge agents. · 0x0180-C200-0000 for LLDP frames destined for nearest customer bridge agents. · 0x0180-C200-0003 for LLDP frames destined for nearest non-TPMR bridge agents.
Source MAC address	MAC address of the sending port.
Type	Ethernet type for the upper-layer protocol. This field is 0x88CC for LLDP.
Data	LLDPDU.
FCS	Frame check sequence, a 32-bit CRC value used to determine the validity of the received Ethernet frame.

· LLDP frame encapsulated in SNAP

Figure 55 SNAP-encapsulated LLDP frame

Table 20 Fields in a SNAP-encapsulated LLDP frame

Field	Description
Destination MAC address	MAC address to which the LLDP frame is advertised. It is the same as that for Ethernet II-encapsulated LLDP frames.
Source MAC address	MAC address of the sending port.
Type	SNAP type for the upper-layer protocol. This field is 0xAAAA-0300-0000-88CC for LLDP.
Data	LLDPDU.
FCS	Frame check sequence, a 32-bit CRC value used to determine the validity of the received Ethernet frame.

LLDPDUs

LLDP uses LLDPDUs to exchange information. An LLDPDU comprises multiple TLVs. Each TLV carries a type of device information, as shown in Figure 56.

Figure 56 LLDPDU encapsulation format

An LLDPDU can carry up to 32 types of TLVs. Mandatory TLVs include Chassis ID TLV, Port ID TLV, and Time to Live TLV. Other TLVs are optional.

TLVs

A TLV is an information element that contains the type, length, and value fields.

LLDPDU TLVs include the following categories:

· Basic management TLVs

· Organizationally (IEEE 802.1 and IEEE 802.3) specific TLVs

· LLDP-MED (media endpoint discovery) TLVs

Basic management TLVs are essential to device management.

Organizationally specific TLVs and LLDP-MED TLVs are used for enhanced device management. They are defined by standardization or other organizations and are optional for LLDPDUs.

· Basic management TLVs

Table 21 lists the basic management TLV types. Some of them are mandatory for LLDPDUs.

Table 21 Basic management TLVs

Type	Description	Remarks
Chassis ID	Specifies the bridge MAC address of the sending device.	Mandatory.
Port ID	Specifies the ID of the sending port: · If the LLDPDU carries LLDP-MED TLVs, the port ID TLV carries the MAC address of the sending port. · Otherwise, the port ID TLV carries the port name.
Time to Live	Specifies the life of the transmitted information on the receiving device.
End of LLDPDU	Marks the end of the TLV sequence in the LLDPDU.	Optional.
Port Description	Specifies the description for the sending port.
System Name	Specifies the assigned name of the sending device.
System Description	Specifies the description for the sending device.
System Capabilities	Identifies the primary features of the sending device and the enabled primary features.
Management Address	Specifies the following elements: · The management address of the local device. · The interface number and object identifier (OID) associated with the address.

· IEEE 802.1 organizationally specific TLVs

Table 22 IEEE 802.1 organizationally specific TLVs

Type	Description
Port VLAN ID (PVID)	Specifies the port VLAN identifier.
Port And Protocol VLAN ID (PPVID)	Indicates whether the device supports protocol VLANs and, if so, what VLAN IDs these protocols will be associated with.
VLAN Name	Specifies the textual name of any VLAN to which the port belongs.
Protocol Identity	Indicates protocols supported on the port.
Link Aggregation	Indicates whether the port supports link aggregation, and if yes, whether link aggregation is enabled.
Management VID	Management VLAN ID.
VID Usage Digest	VLAN ID usage digest.
ETS Configuration	Enhanced Transmission Selection configuration.
ETS Recommendation	ETS recommendation.
PFC	Priority-based Flow Control.
APP	Application protocol.
QCN	Quantized Congestion Notification.

NOTE:

· H3C devices support only receiving protocol identity TLVs and VID usage digest TLVs.

· Layer 3 Ethernet ports support only link aggregation TLVs.

· IEEE 802.3 organizationally specific TLVs

Table 23 IEEE 802.3 organizationally specific TLVs

Type	Description
MAC/PHY Configuration/Status	Contains the bit-rate and duplex capabilities of the port, support for autonegotiation, enabling status of autonegotiation, and the current rate and duplex mode.
Power Via MDI	Contains the power supply capabilities of the port: · Port class (PSE or PD). · Power supply mode. · Whether PSE power supply is supported. · Whether PSE power supply is enabled. · Whether pair selection can be controlled. · Power supply type. · Power source. · Power priority. · PD requested power. · PSE allocated power.
Maximum Frame Size	Indicates the supported maximum frame size.
Power Stateful Control	Indicates the power state control configured on the sending port, including the following: · Power supply mode of the PSE/PD. · PSE/PD priority. · PSE/PD power.
Energy-Efficient Ethernet	Indicates Energy Efficient Ethernet (EEE).

NOTE:

The Power Stateful Control TLV is defined in IEEE P802.3at D1.0 and is not supported in later versions. H3C devices send this type of TLVs only after receiving them.

· LLDP-MED TLVs

LLDP-MED TLVs provide multiple advanced applications for voice over IP (VoIP), such as basic configuration, network policy configuration, and address and directory management. LLDP-MED TLVs provide a cost-effective and easy-to-use solution for deploying voice devices in Ethernet. LLDP-MED TLVs are shown in Table 24.

Table 24 LLDP-MED TLVs

Type	Description
LLDP-MED Capabilities	Allows a network device to advertise the LLDP-MED TLVs that it supports.
Network Policy	Allows a network device or terminal device to advertise the VLAN ID of a port, the VLAN type, and the Layer 2 and Layer 3 priorities for specific applications.
Extended Power-via-MDI	Allows a network device or terminal device to advertise power supply capability. This TLV is an extension of the Power Via MDI TLV.
Hardware Revision	Allows a terminal device to advertise its hardware version.
Firmware Revision	Allows a terminal device to advertise its firmware version.
Software Revision	Allows a terminal device to advertise its software version.
Serial Number	Allows a terminal device to advertise its serial number.
Manufacturer Name	Allows a terminal device to advertise its vendor name.
Model Name	Allows a terminal device to advertise its model name.
Asset ID	Allows a terminal device to advertise its asset ID. The typical case is that the user specifies the asset ID for the endpoint to facilitate directory management and asset tracking.
Location Identification	Allows a network device to advertise the appropriate location identifier information for a terminal device to use in the context of location-based applications.

NOTE:

· If the MAC/PHY configuration/status TLV is not advertisable, none of the LLDP-MED TLVs will be advertised even if they are advertisable.

· If the LLDP-MED capabilities TLV is not advertisable, the other LLDP-MED TLVs will not be advertised even if they are advertisable.

Management address

The network management system uses the management address of a device to identify and manage the device for topology maintenance and network management. The management address is encapsulated in the management address TLV.

Working mechanism

LLDP operating modes

An LLDP agent can operate in one of the following modes:

· TxRx mode—An LLDP agent in this mode can send and receive LLDP frames.

· Tx mode—An LLDP agent in this mode can only send LLDP frames.

· Rx mode—An LLDP agent in this mode can only receive LLDP frames.

· Disable mode—An LLDP agent in this mode cannot send or receive LLDP frames.

Each time the LLDP operating mode of an LLDP agent changes, its LLDP protocol state machine reinitializes. A configurable reinitialization delay prevents frequent initializations caused by frequent changes to the operating mode. If you configure the reinitialization delay, an LLDP agent must wait the specified amount of time to initialize LLDP after the LLDP operating mode changes.

Transmitting LLDP frames

An LLDP agent operating in TxRx mode or Tx mode sends LLDP frames to its directly connected devices both periodically and when the local configuration changes. To prevent LLDP frames from overwhelming the network during times of frequent changes to local device information, LLDP uses the token bucket mechanism to rate limit LLDP frames. For more information about the token bucket mechanism, see ACL and QoS Configuration Guide.

LLDP automatically enables the fast LLDP frame transmission mechanism in either of the following cases:

· A new LLDP frame is received and carries device information new to the local device.

· The LLDP operating mode of the LLDP agent changes from Disable or Rx to TxRx or Tx.

The fast LLDP frame transmission mechanism successively sends the specified number of LLDP frames at a configurable fast LLDP frame transmission interval. The mechanism helps LLDP neighbors discover the local device as soon as possible. Then, the normal LLDP frame transmission interval resumes.

Receiving LLDP frames

An LLDP agent operating in TxRx mode or Rx mode confirms the validity of TLVs carried in every received LLDP frame. If the TLVs are valid, the LLDP agent saves the information and starts an aging timer. The initial value of the aging timer is equal to the TTL value in the Time To Live TLV carried in the LLDP frame. When the LLDP agent receives a new LLDP frame, the aging timer restarts. When the aging timer decreases to zero, all saved information ages out.

Protocols and standards

· IEEE 802.1AB-2005, Station and Media Access Control Connectivity Discovery

· IEEE 802.1AB-2009, Station and Media Access Control Connectivity Discovery

· ANSI/TIA-1057, Link Layer Discovery Protocol for Media Endpoint Devices

· DCB Capability Exchange Protocol Specification Rev 1.00

· DCB Capability Exchange Protocol Base Specification Rev 1.01

· IEEE Std 802.1Qaz-2011, Media Access Control (MAC) Bridges and Virtual Bridged Local Area Networks-Amendment 18: Enhanced Transmission Selection for Bandwidth Sharing Between Traffic Classes

Command and hardware compatibility

IPv6-related parameters are not supported on the following routers:

· MSR810/810-W/810-W-DB/810-LM/810-W-LM/810-10-PoE/810-LM-HK/810-W-LM-HK/810-LMS/810-LUS.

· MSR3600-28-SI/3600-51-SI.

LLDP configuration task list

Tasks at a glance
Performing basic LLDP configurations: · (Required.) Enabling LLDP · (Optional.) Setting the LLDP bridge mode · (Optional.) Setting the LLDP operating mode · (Optional.) Setting the LLDP reinitialization delay · (Optional.) Enabling LLDP polling · (Optional.) Configuring the advertisable TLVs · (Optional.) Configuring the management address and its encoding format · (Optional.) Setting other LLDP parameters · (Optional.) Setting an encapsulation format for LLDP frames · (Optional.) Disabling LLDP PVID inconsistency check
(Optional.) Configuring CDP compatibility
(Optional.) Configuring LLDP trapping and LLDP-MED trapping
(Optional.) Setting the source MAC address of LLDP frames to the MAC address of the subinterface associated with the specified VLAN
(Optional.) Enabling the device to generate ARP or ND entries for received management address LLDP TLVs

Performing basic LLDP configurations

Enabling LLDP

To make LLDP take effect on specific ports, you must enable LLDP both globally and on these ports.

To use LLDP together with OpenFlow, you must enable LLDP globally on OpenFlow devices. As a best practice to prevent LLDP from affecting topology discovery of OpenFlow controllers, disable LLDP on ports of OpenFlow instances. For more information about OpenFlow, see OpenFlow Configuration Guide.

To enable LLDP:

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Enable LLDP globally.	lldp global enable	N/A
3. Enter Layer 2/Layer 3 Ethernet interface view, management Ethernet interface view, Layer 2/Layer 3 aggregate interface view, synchronous/asynchronous serial interface view, standard POS interface view, or POS channel interface view.	interface interface-type interface-number	N/A
4. Enable LLDP.	lldp enable	By default, LLDP is enabled on a port.

Setting the LLDP bridge mode

The following LLDP bridge modes are available:

· Customer bridge mode—LLDP supports nearest bridge agents, nearest non-TPMR bridge agents, and nearest customer bridge agents. LLDP processes the LLDP frames with destination MAC addresses for these agents and transparently transmits the LLDP frames with other destination MAC addresses in the VLAN.

· Service bridge mode—LLDP supports nearest bridge agents and nearest non-TPMR bridge agents. LLDP processes the LLDP frames with destination MAC addresses for these agents and transparently transmits the LLDP frames with other destination MAC addresses in the VLAN.

To set the LLDP bridge mode:

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Set the LLDP bridge mode to service bridge.	lldp mode service-bridge	By default, LLDP operates in customer bridge mode.

Setting the LLDP operating mode

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Enter Layer 2/Layer 3 Ethernet interface view, management Ethernet interface view, Layer 2/Layer 3 aggregate interface view, synchronous/asynchronous serial interface view, standard POS interface view, or POS channel interface view.	interface interface-type interface-number	N/A
3. Set the LLDP operating mode.	· In Layer 2/Layer 3 Ethernet interface view or management Ethernet interface view: lldp [ agent { nearest-customer \| nearest-nontpmr } ] admin-status { disable \| rx \| tx \| txrx } · In Layer 2/Layer 3 aggregate interface view: lldp agent { nearest-customer \| nearest-nontpmr } admin-status { disable \| rx \| tx \| txrx } · In synchronous/asynchronous serial interface view, standard POS interface view, or POS channel interface view: lldp admin-status { disable \| rx \| tx \| txrx }	By default: · The nearest bridge agent operates in txrx mode. · The nearest customer bridge agent and nearest non-TPMR bridge agent operate in disable mode. In Ethernet interface view, if you do not specify an agent type, the command sets the operating mode for nearest bridge agents. In aggregate interface view, you can set the operating mode only for nearest customer bridge agents and nearest non-TPMR bridge agents. In synchronous/asynchronous serial interface view, standard POS interface view, or POS channel interface view, you can set the operating mode only for nearest bridge agents.

Setting the LLDP reinitialization delay

When the LLDP operating mode changes on a port, the port initializes the protocol state machines after an LLDP reinitialization delay. By adjusting the delay, you can avoid frequent initializations caused by frequent changes to the LLDP operating mode on a port.

To set the LLDP reinitialization delay for ports:

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Set the LLDP reinitialization delay.	lldp timer reinit-delay delay	The default setting is 2 seconds.

Enabling LLDP polling

With LLDP polling enabled, a device periodically searches for local configuration changes. When the device detects a configuration change, it sends LLDP frames to inform neighboring devices of the change.

To enable LLDP polling:

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Enter Layer 2/Layer 3 Ethernet interface view, management Ethernet interface view, Layer 2/Layer 3 aggregate interface view, synchronous/asynchronous serial interface view, standard POS interface view, or POS channel interface view.	interface interface-type interface-number	N/A
3. Enable LLDP polling and set the polling interval.	· In Layer 2/Layer 3 Ethernet interface view or management Ethernet interface view: lldp [ agent { nearest-customer \| nearest-nontpmr } ] check-change-interval interval · In Layer 2/Layer 3 aggregate interface view: lldp agent { nearest-customer \| nearest-nontpmr } check-change-interval interval · In synchronous/asynchronous serial interface view, standard POS interface view, or POS channel interface view: lldp check-change-interval interval	By default, LLDP polling is disabled.

Configuring the advertisable TLVs

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Enter Layer 2/Layer 3 Ethernet interface view, management Ethernet interface view, Layer 2/Layer 3 aggregate interface view, synchronous/asynchronous serial interface view, standard POS interface view, or POS channel interface view.	interface interface-type interface-number	N/A
3. Configure the advertisable TLVs (in Layer 2 Ethernet interface view).	· lldp tlv-enable { basic-tlv { all \| port-description \| system-capability \| system-description \| system-name \| management-address-tlv [ ipv6 ] [ ip-address ] } \| dot1-tlv { all \| port-vlan-id \| link-aggregation \| protocol-vlan-id [ vlan-id ] \| vlan-name [ vlan-id ] \| management-vid [ mvlan-id ] } \| dot3-tlv { all \| mac-physic \| max-frame-size \| power } \| med-tlv { all \| capability \| inventory \| network-policy [ vlan-id ] \| power-over-ethernet \| location-id { civic-address device-type country-code { ca-type ca-value }&<1-10> \| elin-address tel-number } } } · lldp agent nearest-nontpmr tlv-enable { basic-tlv { all \| port-description \| system-capability \| system-description \| system-name \| management-address-tlv [ ipv6 ] [ ip-address ] } \| dot1-tlv { all \| port-vlan-id \| link-aggregation } } · lldp agent nearest-customer tlv-enable { basic-tlv { all \| port-description \| system-capability \| system-description \| system-name \| management-address-tlv [ ipv6 ] [ ip-address ] } \| dot1-tlv { all \| port-vlan-id \| link-aggregation } }	By default: · Nearest bridge agents can advertise all LLDP TLVs except the location identification, port and protocol VLAN ID, VLAN name, and management VLAN ID TLVs. · Nearest customer bridge agents can advertise basic TLVs and IEEE 802.1 organizationally specific TLVs.
4. Configure the advertisable TLVs (in Layer 3 Ethernet interface view).	· lldp tlv-enable { basic-tlv { all \| port-description \| system-capability \| system-description \| system-name \| management-address-tlv [ ipv6 ] [ ip-address \| interface loopback interface-number ] } \| dot1-tlv { all \| link-aggregation } \| dot3-tlv { all \| mac-physic \| max-frame-size \| power } \| med-tlv { all \| link-aggregation \| capability \| inventory \| power-over-ethernet \| location-id { civic-address device-type country-code { ca-type ca-value }&<1-10> \| elin-address tel-number } } } · lldp agent { nearest-nontpmr \| nearest-customer } tlv-enable { basic-tlv { all \| port-description \| system-capability \| system-description \| system-name \| management-address-tlv [ ipv6 ] [ ip-address ] } \| dot1-tlv { all \| link-aggregation } }	By default: · Nearest bridge agents can advertise all types of LLDP TLVs (only link aggregation TLV is supported in 802.1 organizationally specific TLVs) except network policy TLVs. · Nearest non-TPMR bridge agents do not advertise TLVs. · Nearest customer bridge agents can advertise basic TLVs and IEEE 802.1 organizationally specific TLVs (only link aggregation TLV is supported).
5. Configure the advertisable TLVs (in management Ethernet interface view).	· lldp tlv-enable { basic-tlv { all \| port-description \| system-capability \| system-description \| system-name \| management-address-tlv [ ipv6 ] [ ip-address ] } \| dot1-tlv { all \| link-aggregation } \| dot3-tlv { all \| mac-physic \| max-frame-size \| power } \| med-tlv { all \| capability \| inventory \| power-over-ethernet \| location-id { civic-address device-type country-code { ca-type ca-value }&<1-10> \| elin-address tel-number } } } · lldp agent { nearest-nontpmr \| nearest-customer } tlv-enable { basic-tlv { all \| port-description \| system-capability \| system-description \| system-name \| management-address-tlv [ ipv6 ] [ ip-address ] } \| dot1-tlv { all \| link-aggregation } }	By default: · Nearest bridge agents can advertise all types of LLDP TLVs (only link aggregation TLV is supported in 802.1 organizationally specific TLVs) except network policy TLVs. · Nearest non-TPMR bridge agents do not advertise TLVs. · Nearest customer bridge agents can advertise basic TLVs and IEEE 802.1 organizationally specific TLVs (only link aggregation TLV is supported).
6. Configure the advertisable TLVs (in Layer 2 aggregate interface view).	· lldp agent nearest-nontpmr tlv-enable { basic-tlv { all \| management-address-tlv [ ipv6 ] [ ip-address ] \| port-description \| system-capability \| system-description \| system-name } \| dot1-tlv { all \| port-vlan-id } } · lldp agent nearest-customer tlv-enable { basic-tlv { all \| management-address-tlv [ ipv6 ] [ ip-address ] \| port-description \| system-capability \| system-description \| system-name } \| dot1-tlv { all \| port-vlan-id } } · lldp tlv-enable dot1-tlv { protocol-vlan-id [ vlan-id ] \| vlan-name [ vlan-id ] \| management-vid [ mvlan-id ] }	By default, nearest customer bridge agents can advertise basic TLVs and IEEE 802.1 organizationally specific TLVs (only port and protocol VLAN ID, VLAN name, and management VLAN ID TLVs are supported). Nearest bridge agents are not supported on Layer 2 aggregate interfaces.
7. Configure the advertisable TLVs (in Layer 3 aggregate interface view).	lldp agent { nearest-nontpmr \| nearest-customer } tlv-enable basic-tlv { all \| management-address-tlv [ ipv6 ] [ ip-address ] \| port-description \| system-capability \| system-description \| system-name }	By default: · Nearest non-TPMR bridge agents do not advertise TLVs. · Nearest customer bridge agents can advertise only basic TLVs. Nearest bridge agents are not supported on Layer 3 aggregate interfaces.
8. Configure the advertisable TLVs (in synchronous/asynchronous serial interface view, standard POS interface view, or POS channel interface view).	lldp tlv-enable { basic-tlv { all \| port-description \| system-capability \| system-description \| system-name \| management-address-tlv [ ipv6 ] [ ip-address ] } }	By default, nearest bridge agents can advertise all types of LLDP TLVs. Nearest customer bridge agents and nearest non-TPMR bridge agents are not supported.

Configuring the management address and its encoding format

LLDP encodes management addresses in numeric or string format in management address TLVs.

If a neighbor encodes its management address in string format, set the encoding format of the management address to string on the connecting port. This guarantees normal communication with the neighbor.

To configure a management address to be advertised and its encoding format on a port:

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Enter Layer 2/Layer 3 Ethernet interface view, management Ethernet interface view, Layer 2/Layer 3 aggregate interface view, synchronous/asynchronous serial interface view, standard POS interface view, or POS channel interface view.	interface interface-type interface-number	N/A
3. Allow LLDP to advertise the management address in LLDP frames and configure the advertised management address.	· In Layer 2/Layer 3 Ethernet interface view or management Ethernet interface view: lldp [ agent { nearest-customer \| nearest-nontpmr } ] tlv-enable basic-tlv management-address-tlv [ ipv6 ] [ ip-address ] · In Layer 2/Layer 3 aggregate interface view: lldp agent { nearest-customer \| nearest-nontpmr } tlv-enable basic-tlv management-address-tlv [ ipv6 ] [ ip-address ] · In synchronous/asynchronous serial interface view, standard POS interface view, or POS channel interface view: lldp tlv-enable basic-tlv management-address-tlv [ ipv6 ] [ ip-address ]	By default: · Nearest bridge agents and nearest customer bridge agents can advertise the management address in LLDP frames. · Nearest non-TPMR bridge agents cannot advertise the management address in LLDP frames.
4. Set the encoding format of the management address to string.	· In Layer 2/Layer 3 Ethernet interface view or management Ethernet interface view: lldp [ agent { nearest-customer \| nearest-nontpmr } ] management-address-format string · In Layer 2/Layer 3 aggregate interface view: lldp agent { nearest-customer \| nearest-nontpmr } management-address-format string · In synchronous/asynchronous serial interface view, standard POS interface view, or POS channel interface view: lldp management-address-format string	By default, the encoding format of the management address is numeric.

Setting other LLDP parameters

The Time to Live TLV carried in an LLDPDU determines how long the device information carried in the LLDPDU can be saved on a recipient device.

By setting the TTL multiplier, you can configure the TTL of locally sent LLDPDUs. The TTL is expressed by using the following formula:

TTL = Min (65535, (TTL multiplier × LLDP frame transmission interval + 1))

As the expression shows, the TTL can be up to 65535 seconds. TTLs greater than 65535 will be rounded down to 65535 seconds.

To set LLDP parameters:

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Set the TTL multiplier.	lldp hold-multiplier value	The default setting is 4.
3. Set the LLDP frame transmission interval.	lldp timer tx-interval interval	The default setting is 30 seconds.
4. Set the token bucket size for sending LLDP frames.	lldp max-credit credit-value	The default setting is 5.
5. Set the number of LLDP frames sent each time fast LLDP frame transmission is triggered.	lldp fast-count count	The default setting is 4.
6. Set the fast LLDP frame transmission interval.	lldp timer fast-interval interval	The default setting is 1 second.

Setting an encapsulation format for LLDP frames

LLDP frames can be encapsulated in the following formats:

· Ethernet II—With Ethernet II encapsulation configured, an LLDP port sends LLDP frames in Ethernet II frames.

· SNAP—With SNAP encapsulation configured, an LLDP port sends LLDP frames in SNAP frames.

Earlier versions of LLDP require the same encapsulation format on both ends to process LLDP frames. To successfully communicate with a neighboring device running an earlier version of LLDP, the local device must be set with the same encapsulation format.

To set the encapsulation format for LLDP frames to SNAP:

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Enter Layer 2/Layer 3 Ethernet interface view, management Ethernet interface view, Layer 2/Layer 3 aggregate interface view, synchronous/asynchronous serial interface view, standard POS interface view, or POS channel interface view.	interface interface-type interface-number	N/A
3. Set the encapsulation format for LLDP frames to SNAP.	· In Layer 2/Layer 3 Ethernet interface view or management Ethernet interface view: lldp [ agent { nearest-customer \| nearest-nontpmr } ] encapsulation snap · In Layer 2/Layer 3 aggregate interface view: lldp agent { nearest-customer \| nearest-nontpmr } encapsulation snap · In synchronous/asynchronous serial interface view, standard POS interface view, or POS channel interface view: lldp encapsulation snap	By default, Ethernet II encapsulation format applies.

Disabling LLDP PVID inconsistency check

By default, when the system receives an LLDP packet, it compares the PVID value contained in packet with the PVID configured on the receiving interface. If the two PVIDs do not match, a log message will be printed to notify the user.

You can disable PVID inconsistency check if different PVIDs are required on a link.

To disable LLDP PVID inconsistency check:

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Disable LLDP PVID inconsistency check.	lldp ignore-pvid-inconsistency	By default, LLDP PVID inconsistency check is enabled.

Configuring CDP compatibility

To make your device work with Cisco IP phones, you must enable CDP compatibility.

If your LLDP-enabled device cannot recognize CDP packets, it does not respond to the requests of Cisco IP phones for the voice VLAN ID configured on the device. As a result, a requesting Cisco IP phone sends voice traffic without any tag to your device. Your device cannot differentiate the voice traffic from other types of traffic.

CDP compatibility enables your device to receive and recognize CDP packets from a Cisco IP phone and respond with CDP packets carrying TLVs with the configured voice VLAN. If no voice VLAN is configured for CDP packets, CDP packets carry the voice VLAN of the port or the voice VLAN assigned by the RADIUS server. The assigned voice VLAN has a higher priority. According to TLVs with the voice VLAN configuration, the IP phone automatically configures the voice VLAN. As a result, the voice traffic is confined in the configured voice VLAN and is differentiated from other types of traffic.

For more information about voice VLANs, see "Configuring voice VLANs."

Configuration prerequisites

Before you configure CDP compatibility, complete the following tasks:

· Globally enable LLDP.

· Enable LLDP on the port connecting to an IP phone.

· Configure LLDP to operate in TxRx mode on the port.

Configuration procedure

CDP-compatible LLDP operates in one of the following modes:

· TxRx—CDP packets can be transmitted and received.

· Disable—CDP packets cannot be transmitted or received.

To make CDP-compatible LLDP take effect on a port, follow these steps:

1. Enable CDP-compatible LLDP globally.

2. Configure CDP-compatible LLDP to operate in TxRx mode on the port.

The maximum TTL value that CDP allows is 255 seconds. To make CDP-compatible LLDP work correctly with Cisco IP phones, configure the LLDP frame transmission interval to be no more than 1/3 of the TTL value.

To configure LLDP to be compatible with CDP:

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Enable CDP compatibility globally.	lldp compliance cdp	By default, CDP compatibility is disabled globally.
3. Enter Layer 2/Layer 3 Ethernet interface view or management Ethernet interface view,	interface interface-type interface-number	The views where LLDP-related commands can be executed vary by device model.
4. Configure CDP-compatible LLDP to operate in TxRx mode.	lldp compliance admin-status cdp txrx	By default, CDP-compatible LLDP operates in Disable mode.
5. Set the voice VLAN ID carried in CDP packets.	cdp voice-vlan vlan-id	By default, no voice VLAN ID is configured to be carried in CDP packets.

Configuring LLDP trapping and LLDP-MED trappin g

LLDP trapping or LLDP-MED trapping notifies the network management system of events such as newly detected neighboring devices and link failures.

To prevent excessive LLDP traps from being sent when the topology is unstable, set a trap transmission interval for LLDP.

To configure LLDP trapping and LLDP-MED trapping:

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Enter Layer 2/Layer 3 Ethernet interface view, management Ethernet interface view, Layer 2/Layer 3 aggregate interface view, synchronous/asynchronous serial interface view, standard POS interface view, or POS channel interface view.	interface interface-type interface-number	N/A
3. Enable LLDP trapping.	· In Layer 2/Layer 3 Ethernet interface view or management Ethernet interface view: lldp [ agent { nearest-customer \| nearest-nontpmr } ] notification remote-change enable · In Layer 2/Layer 3 aggregate interface view: lldp agent { nearest-customer \| nearest-nontpmr } notification remote-change enable · In synchronous/asynchronous serial interface view, standard POS interface view, or POS channel interface view: lldp notification remote-change enable	By default, LLDP trapping is disabled.
4. Enable LLDP-MED trapping (in Layer 2/Layer 3 Ethernet interface view or management Ethernet interface view).	lldp notification med-topology-change enable	By default, LLDP-MED trapping is disabled.
5. Return to system view.	quit	N/A
6. (Optional.) Set the LLDP trap transmission interval.	lldp timer notification-interval interval	The default setting is 30 seconds.

Setting the source MAC address of LLDP frames to the MAC address of the subinterface associated with the specified VLAN

This feature allows you to configure the source MAC address of LLDP frames as the MAC address of the Layer 3 Ethernet subinterface associated with the specified VLAN in Dot1q termination. For more information about Dot1q termination, see "Configuring VLAN termination."

To set the source MAC address of LLDP frames to the MAC address of the Layer 3 Ethernet subinterface associated with the specified VLAN:

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Enter Layer 3 Ethernet interface view.	interface interface-type interface-number	N/A
3. Set the source MAC address of LLDP frames to the MAC address of the Layer 3 Ethernet subinterface associated with the specified VLAN.	lldp source-mac vlan vlan-id	By default, the source MAC address of LLDP frames is the MAC address of the port. vlan-id specifies the VLAN ID associated with a Layer 3 Ethernet subinterface in Dot1q termination.

Enabling the device to generate ARP or ND entries for received management address LLDP TLVs

This feature enables the device to generate an ARP or ND entry for a received LLDP frame that carries a a management address TLV. The ARP or ND entry contains the management address and the source MAC address of the frame.

You can enable the device to generate both ARP and ND entries. If the management address TLV contains an IPv4 address, the device generates an ARP entry. If the management address TLV contains an IPv6 address, the device generates an ND entry.

To enable the device to generate an ARP or ND entry for a received management address LLDP TLV:

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Enter Layer 3 Ethernet interface view.	interface interface-type interface-number	N/A
3. Enable the device to generate an ARP or ND entry for a management address LLDP TLV received on the interface.	lldp management-address { arp-learning \| nd-learning } [ vlan vlan-id ]	By default, the device does not generate an ARP or ND entry when receiving a management address LLDP TLV. Include the vlan vlan-id option to generate the ARP or ND entry for the Layer 3 Ethernet subinterface associated with the specified VLAN ID in Dot1q termination.

Displaying and maintaining LLDP

Execute display commands in any view.

Task	Command
Display local LLDP information.	display lldp local-information [ global \| interface interface-type interface-number ]
Display the information contained in the LLDP TLVs sent from neighboring devices.	display lldp neighbor-information [ [ [ interface interface-type interface-number ] [ agent { nearest-bridge \| nearest-customer \| nearest-nontpmr } ] [ verbose ] ] \| list [ system-name system-name ] ]
Display LLDP statistics.	display lldp statistics [ global \| [ interface interface-type interface-number ] [ agent { nearest-bridge \| nearest-customer \| nearest-nontpmr } ] ]
Display LLDP status of a port.	display lldp status [ interface interface-type interface-number ] [ agent { nearest-bridge \| nearest-customer \| nearest-nontpmr } ]
Display types of advertisable optional LLDP TLVs.	display lldp tlv-config [ interface interface-type interface-number ] [ agent { nearest-bridge \| nearest-customer \| nearest-nontpmr } ]

LLDP configuration examples

Basic LLDP configuration example

Network requirements

As shown in Figure 57, enable LLDP gloally on Device A and Device B to perform the following tasks:

· Monitor the link between Device A and Device B on the NMS.

· Monitor the link between Device A and the MED device on the NMS.

Figure 57 Network diagram

Configuration procedure

1. Configure Device A:

# Enable LLDP globally.

<DeviceA> system-view

[DeviceA] lldp global enable

# Enable LLDP on GigabitEthernet 2/0/1. By default, LLDP is enabled on ports.

[DeviceA] interface gigabitethernet 2/0/1

[DeviceA-GigabitEthernet2/0/1] lldp enable

# Set the LLDP operating mode to Rx on GigabitEthernet 2/0/1.

[DeviceA-GigabitEthernet2/0/1] lldp admin-status rx

[DeviceA-GigabitEthernet2/0/1] quit

# Enable LLDP on GigabitEthernet 2/0/2. By default, LLDP is enabled on ports.

[DeviceA] interface gigabitethernet2/0/2

[DeviceA-GigabitEthernet2/0/2] lldp enable

# Set the LLDP operating mode to Rx on GigabitEthernet 2/0/2.

[DeviceA-GigabitEthernet2/0/2] lldp admin-status rx

[DeviceA-GigabitEthernet2/0/2] quit

2. Configure Device B:

# Enable LLDP globally.

<DeviceB> system-view

[DeviceB] lldp global enable

# Enable LLDP on GigabitEthernet 2/0/1. By default, LLDP is enabled on ports.

[DeviceB] interface gigabitethernet 2/0/1

[DeviceB-GigabitEthernet2/0/1] lldp enable

# Set the LLDP operating mode to Tx on GigabitEthernet 2/0/1.

[DeviceB-GigabitEthernet2/0/1] lldp admin-status tx

[DeviceB-GigabitEthernet2/0/1] quit

Verifying the configuration

# Verify the following items:

· GigabitEthernet 2/0/1 of Device A connects to a MED device.

· GigabitEthernet 2/0/2 of Device A connects to a non-MED device.

· Both ports operate in Rx mode, and they can receive LLDP frames but cannot send LLDP frames.

[DeviceA] display lldp status

Global status of LLDP: Enable

Bridge mode of LLDP: customer-bridge

The current number of LLDP neighbors: 2

The current number of CDP neighbors: 0

LLDP neighbor information last changed time: 0 days, 0 hours, 4 minutes, 40 seconds

Transmit interval : 30s

Fast transmit interval : 1s

Transmit credit max : 5

Hold multiplier : 4

Reinit delay : 2s

Trap interval : 30s

Fast start times : 4

LLDP status information of port 1 [GigabitEthernet2/0/1]:

LLDP agent nearest-bridge:

Port status of LLDP : Enable

Admin status : Rx_Only

Trap flag : No

MED trap flag : No

Polling interval : 0s

Number of LLDP neighbors : 1

Number of MED neighbors : 1

Number of CDP neighbors : 0

Number of sent optional TLV : 21

Number of received unknown TLV : 0

LLDP agent nearest-customer:

Port status of LLDP : Enable

Admin status : Disable

Trap flag : No

MED trap flag : No

Polling interval : 0s

Number of LLDP neighbors : 0

Number of MED neighbors : 0

Number of CDP neighbors : 0

Number of sent optional TLV : 16

Number of received unknown TLV : 0

LLDP status information of port 2 [GigabitEthernet2/0/2]:

LLDP agent nearest-bridge:

Port status of LLDP : Enable

Admin status : Rx_Only

Trap flag : No

MED trap flag : No

Polling interval : 0s

Number of LLDP neighbors : 1

Number of MED neighbors : 0

Number of CDP neighbors : 0

Number of sent optional TLV : 21

Number of received unknown TLV : 3

LLDP agent nearest-nontpmr:

Port status of LLDP : Enable

Admin status : Disable

Trap flag : No

MED trap flag : No

Polling interval : 0s

Number of LLDP neighbors : 0

Number of MED neighbors : 0

Number of CDP neighbors : 0

Number of sent optional TLV : 1

Number of received unknown TLV : 0

LLDP agent nearest-customer:

Port status of LLDP : Enable

Admin status : Disable

Trap flag : No

MED trap flag : No

Polling interval : 0s

Number of LLDP neighbors : 0

Number of MED neighbors : 0

Number of CDP neighbors : 0

Number of sent optional TLV : 16

Number of received unknown TLV : 0

# Remove the link between Device A and Device B.

# Verify that GigabitEthernet 2/0/2 of Device A does not connect to any neighboring devices.

[DeviceA] display lldp status

Global status of LLDP: Enable

The current number of LLDP neighbors: 1

The current number of CDP neighbors: 0

LLDP neighbor information last changed time: 0 days, 0 hours, 5 minutes, 20 seconds

Transmit interval : 30s

Fast transmit interval : 1s

Transmit credit max : 5

Hold multiplier : 4

Reinit delay : 2s

Trap interval : 30s

Fast start times : 4

LLDP status information of port 1 [GigabitEthernet2/0/1]:

LLDP agent nearest-bridge:

Port status of LLDP : Enable

Admin status : Rx_Only

Trap flag : No

MED trap flag : No

Polling interval : 0s

Number of LLDP neighbors : 1

Number of MED neighbors : 1

Number of CDP neighbors : 0

Number of sent optional TLV : 0

Number of received unknown TLV : 5

LLDP agent nearest-nontpmr:

Port status of LLDP : Enable

Admin status : Disable

Trap flag : No

MED trap flag : No

Polling interval : 0s

Number of LLDP neighbors : 0

Number of MED neighbors : 0

Number of CDP neighbors : 0

Number of sent optional TLV : 1

Number of received unknown TLV : 0

LLDP status information of port 2 [GigabitEthernet2/0/2]:

LLDP agent nearest-bridge:

Port status of LLDP : Enable

Admin status : Rx_Only

Trap flag : No

MED trap flag : No

Polling interval : 0s

Number of LLDP neighbors : 0

Number of MED neighbors : 0

Number of CDP neighbors : 0

Number of sent optional TLV : 0

Number of received unknown TLV : 0

LLDP agent nearest-nontpmr:

Port status of LLDP : Enable

Admin status : Disable

Trap flag : No

MED trap flag : No

Polling interval : 0s

Number of LLDP neighbors : 0

Number of MED neighbors : 0

Number of CDP neighbors : 0

Number of sent optional TLV : 1

Number of received unknown TLV : 0

LLDP agent nearest-customer:

Port status of LLDP : Enable

Admin status : Disable

Trap flag : No

MED trap flag : No

Polling interval : 0s

Number of LLDP neighbors : 0

Number of MED neighbors : 0

Number of CDP neighbors : 0

Number of sent optional TLV : 16

Number of received unknown TLV : 0

CDP-compatible LLDP configuration example

Network requirements

As shown in Figure 58, GigabitEthernet 1/0/1 and GigabitEthernet 1/0/2 of Device A are each connected to a Cisco IP phone, which sends tagged voice traffic.

Configure voice VLAN 2 on Device A. Enable CDP compatibility of LLDP on Device A to allow the Cisco IP phones to automatically configure the voice VLAN. The voice VLAN feature performs the following operations:

· Confines the voice traffic to the voice VLAN.

· Isolates the voice traffic from other types of traffic.

Figure 58 Network diagram

Configuration procedure

1. Configure a voice VLAN on Device A:

# Create VLAN 2.

<DeviceA> system-view

[DeviceA] vlan 2

[DeviceA-vlan2] quit

# Set the link type of GigabitEthernet 1/0/1 and GigabitEthernet 1/0/2 to trunk, and enable voice VLAN on them.

[DeviceA] interface gigabitethernet 1/0/1

[DeviceA-GigabitEthernet1/0/1] port link-type trunk

[DeviceA-GigabitEthernet1/0/1] voice-vlan 2 enable

[DeviceA-GigabitEthernet1/0/1] quit

[DeviceA] interface gigabitethernet 1/0/2

[DeviceA-GigabitEthernet1/0/2] port link-type trunk

[DeviceA-GigabitEthernet1/0/2] voice-vlan 2 enable

[DeviceA-GigabitEthernet1/0/2] quit

2. Configure CDP-compatible LLDP on Device A:

# Enable LLDP globally, and enable CDP compatibility globally.

[DeviceA] lldp global enable

[DeviceA] lldp compliance cdp

# Enable LLDP on GigabitEthernet 1/0/1. By default, LLDP is enabled on ports.

[DeviceA] interface gigabitethernet 1/0/1

[DeviceA-GigabitEthernet1/0/1] lldp enable

# Configure LLDP to operate in TxRx mode on GigabitEthernet 1/0/1.

[DeviceA-GigabitEthernet1/0/1] lldp admin-status txrx

# Configure CDP-compatible LLDP to operate in TxRx mode on GigabitEthernet 1/0/1.

[DeviceA-GigabitEthernet1/0/1] lldp compliance admin-status cdp txrx

[DeviceA-GigabitEthernet1/0/1] quit

# Enable LLDP on GigabitEthernet 1/0/2. By default, LLDP is enabled on ports.

[DeviceA] interface gigabitethernet 1/0/2

[DeviceA-GigabitEthernet1/0/2] lldp enable

# Configure LLDP to operate in TxRx mode on GigabitEthernet 1/0/2.

[DeviceA-GigabitEthernet1/0/2] lldp admin-status txrx

# Configure CDP-compatible LLDP to operate in TxRx mode on GigabitEthernet 1/0/2.

[DeviceA-GigabitEthernet1/0/2] lldp compliance admin-status cdp txrx

[DeviceA-GigabitEthernet1/0/2] quit

Verifying the configuration

# Verify that Device A has completed the following operations:

· Discovering the IP phones connected to GigabitEthernet 1/0/1 and GigabitEthernet 1/0/2.

· Obtaining IP phone information.

[DeviceA] display lldp neighbor-information

CDP neighbor-information of port 1[GigabitEthernet1/0/1]:

LLDP agent nearest-bridge:

CDP neighbor index : 1

Chassis ID : SEP00141CBCDBFE

Port ID : Port 1

CDP neighbor-information of port 2[GigabitEthernet1/0/2]:

LLDP agent nearest-bridge:

CDP neighbor index : 2

Chassis ID : SEP00141CBCDBFF

Port ID : Port 1

Configuring Layer 2 forwarding

Compatibility information

Feature and hardware compatibility

This feature is supported only on the following ports:

· Layer 2 Ethernet ports on Ethernet switching modules.

· Fixed Layer 2 Ethernet ports on the following routers:

? MSR810/810-W/810-W-DB/810-LM/810-W-LM/810-10-PoE/810-LM-HK/810-W-LM-HK/810-LMS/810-LUS.

? MSR2600-6-X1/2600-10-X1.

? MSR3600-28/3600-51.

? MSR3600-28-SI/3600-51-SI.

? MSR810-LM-GL/810-W-LM-GL/830-6EI-GL/830-10EI-GL/830-6HI-GL/830-10HI-GL/2600-6-X1-GL/3600-28-SI-GL.

On Layer 2 Ethernet switching modules of MSR devices that are operating in IRF mode, Layer 2 forwarding across member devices is not supported. On SIC Layer 2 Ethernet switching modules, Layer 2 forwarding across member devices and slots is not supported.

Layer 2 forwarding across slots that reside on the same device is supported if multiple HMIM-24GSW, HMIM-24GSWP, HMIM-8GSW, or HMIM-8GSWF Layer 2 Ethernet switching modules are installed on the following devices:

· MSR3640.

· MSR3660.

· MSR 5660.

· MSR 5680.

Layer 2 forwarding across slots that reside on the same device is not supported on MSR3620-DP or MSR5620 devices that are installed with multiple HMIM-8GSW or HMIM-8GSWF Layer 2 Ethernet switching modules.

On MSR56 devices:

· Layer 2 forwarding across slots is supported if multiple HMIM Layer 2 Ethernet switching modules are installed on the same SPE-S1 module.

· Layer 2 forwarding across slots is not supported if multiple HMIM Layer 2 Ethernet switching modules are installed on the same SPE-S3 module.

Command and hardware compatibility

IPv6-related parameters are not supported on the following routers:

· MSR810/810-W/810-W-DB/810-LM/810-W-LM/810-10-PoE/810-LM-HK/810-W-LM-HK/810-LMS/810-LUS.

· MSR3600-28-SI/3600-51-SI.

Configuring normal Layer 2 forwarding

When an incoming frame's destination MAC address does not match any Layer 3 interface's MAC address, normal Layer 2 forwarding forwards the frame through a Layer 2 interface.

The device uses the destination MAC address of the frame to look for a match in the MAC address table.

· The device forwards the frame out of the outgoing interface in the matching entry if a match is found.

· The device floods the frame to all interfaces in the VLAN of the frame if no match is found.

Configuration procedure

Normal Layer 2 forwarding is enabled by default.

Displaying and maintaining normal Layer 2 forwarding

Execute display commands in any view and reset commands in user view.

Task	Command
Display Layer 2 forwarding statistics.	display mac-forwarding statistics [ interface interface-type interface-number ]
Clear Layer 2 forwarding statistics.	reset mac-forwarding statistics

Configuring fast Layer 2 forwarding

Fast Layer 2 forwarding improves packet forwarding efficiency by using a high-speed cache and flow-based technology. It identifies a flow by using the following items:

· Source IP address.

· Source port number.

· Destination IP address.

· Destination port number.

· Protocol number.

· Input interface.

· Output interface.

· VLAN ID.

Fast Layer 2 forwarding creates an entry in a high-speed cache by obtaining the forwarding information of a flow's first packet. Subsequent packets of the flow are forwarded based on the entry.

Command and hardware compatibility

Commands and descriptions for centralized devices apply to the following routers:

· MSR810/810-W/810-W-DB/810-LM/810-W-LM/810-10-PoE/810-LM-HK/810-W-LM-HK/810-LMS/810-LUS.

· MSR2600-6-X1/2600-10-X1.

· MSR 2630.

· MSR3600-28/3600-51.

· MSR3600-28-SI/3600-51-SI.

· MSR3610-X1/3610-X1-DP/3610-X1-DC/3610-X1-DP-DC.

· MSR 3610/3620/3620-DP/3640/3660.

· MSR810-LM-GL/810-W-LM-GL/830-6EI-GL/830-10EI-GL/830-6HI-GL/830-10HI-GL/2600-6-X1-GL/3600-28-SI-GL.

Commands and descriptions for distributed devices apply to the following routers:

· MSR5620.

· MSR 5660.

· MSR 5680.

IPv6-related parameters are not supported on the following routers:

· MSR810/810-W/810-W-DB/810-LM/810-W-LM/810-10-PoE/810-LM-HK/810-W-LM-HK/810-LMS/810-LUS.

· MSR3600-28-SI/3600-51-SI.

Configuration procedure

Fast Layer 2 forwarding is enabled by default.

Displaying and maintaining fast Layer 2 forwarding

Execute display commands in any view.

Task	Command
Display IPv4 fast forwarding entries (centralized device in standalone mode).	display mac-forwarding cache ip [ ip-address ]
Display IPv4 fast forwarding entries (distributed devices in standalone mode/centralized devices in IRF mode).	display mac-forwarding cache ip [ ip-address ] [ slot slot-number ]
Display IPv4 fast forwarding entries (distributed devices in IRF mode).	display mac-forwarding cache ip [ ip-address ] [ chassis chassis-number slot slot-number ]
Display IPv4 fast forwarding entries for fragments (centralized device in standalone mode).	display mac-forwarding cache ip fragment [ ip-address ]
Display IPv4 fast forwarding entries for fragments (distributed devices in standalone mode/centralized devices in IRF mode).	display mac-forwarding cache ip fragment [ ip-address ] [ slot slot-number ]
Display IPv4 fast forwarding entries for fragments (distributed devices in IRF mode).	display mac-forwarding cache ip fragment [ ip-address ] [ chassis chassis-number slot slot-number ]
Display IPv6 fast forwarding entries (centralized device in standalone mode).	display mac-forwarding cache ipv6 [ ipv6-address ]
Display IPv6 fast forwarding entries (distributed devices in standalone mode/centralized devices in IRF mode).	display mac-forwarding cache ipv6 [ ipv6-address ] [ slot slot-number ]
Display IPv6 fast forwarding entries (distributed devices in IRF mode).	display mac-forwarding cache ipv6 [ ipv6-address ] [ chassis chassis-number slot slot-number ]

Configuring VLAN termination

Overview

VLAN termination typically processes packets that include VLAN tags. A VLAN termination-enabled interface performs the following tasks when receiving a VLAN-tagged packet:

1. Assigns the packet to an interface according to its VLAN tags.

2. Removes the VLAN tags of the packet.

3. Delivers the packet to Layer 3 forwarding or other processing pipelines.

Before sending the packet, the VLAN termination-enabled interface determines whether to add new VLAN tags to the packet, based on the VLAN termination type.

VLAN termination can also process packets that do not include any VLAN tags.

This document uses the following VLAN tag concepts for a packet that has two or more layers of VLAN tags:

· Layer 1 VLAN tag—Specifies the outermost layer of VLAN tags.

· Layer 2 VLAN tag—Specifies the second outermost layer of VLAN tags.

The VLAN IDs of the packets are numbered in the same manner as the VLAN tags.

VLAN termination types

VLAN termination types	Types of packets to be terminated on the interface	Tagging status of outgoing packets on the interface
Dot1q termination	The packets must meet both of the following requirements: · The packets include one or more layers of VLAN tags. · The outermost VLAN tag matches the configured value.	Single-tagged
QinQ termination	The packets must meet both of the following requirements: · The packets include two or more layers of VLAN tags. · The outermost two layers of tags match the configured values.	Double-tagged
Untagged termination	Untagged packets	Untagged
Default termination	Packets that cannot be processed on any other subinterfaces of the same main interface	Untagged

VLAN termination application scenarios

Inter-VLAN communication

Hosts in different VLANs cannot directly communicate with each other. You can use Layer 3 routing to allow all VLANs to communicate. To restrict communication to the specified VLANs, configure VLAN termination on subinterfaces or VLAN interfaces.

As shown in Figure 59, Host A and Host B are in different VLANs. The two hosts can communicate with each other after you perform the following tasks:

1. Specify 1.1.1.1/24 and 1.1.2.1/24 as the gateway IP addresses for Host A and Host B, respectively.

2. On the device, configure VLAN termination on Layer 3 Ethernet subinterfaces GigabitEthernet 1/0/1.1 and GigabitEthernet 1/0/2.1.

Figure 59 VLAN termination for inter-VLAN communication

LAN-WAN communication

Typically, WAN protocols such as ATM, Frame Relay, and PPP do not recognize VLAN-tagged packets from LANs. Before packets are sent to a WAN, the sending port must locally record the VLAN information and remove VLAN tags from the packets. To do that, configure VLAN termination on subinterfaces or VLAN interfaces.

As shown in Figure 60, a host is located on a customer network and wants to access the WAN network through a PPPoE connection. CVLAN and SVLAN represent the VLAN on the customer network and service provider network, respectively.

To access the WAN network, a packet originating from the host is processed as follows:

1. Layer 2 Switch A adds a CVLAN tag to the packet and sends the packet.

2. Layer 2 Switch B adds an SVLAN tag to the packet on the QinQ-enabled port.

3. The packet is forwarded on the service provider network based on the SVLAN tag.

4. The PPPoE gateway removes the two layers of VLAN tags from the packet and adds new VLAN tags on the QinQ termination-enabled port.

5. The PPPoE gateway sends the packet to the WAN network through synchronous/asynchronous serial interface Serial 2/1/0.

Figure 60 VLAN termination enables LAN-WAN communication

Configuration restrictions and guidelines

When you configure VLAN termination, follow these restrictions and guidelines:

· On a portal-enabled interface, log off all portal users before you change the VLAN termination type, for example, from Dot1q termination to QinQ termination. Any portal users who remain online after the change cannot be logged off or reauthenticated. For more information about portal authentication, see Security Configuration Guide.

· A main interface cannot terminate VLAN-tagged packets. To terminate VLAN-tagged packets, you can create subinterfaces for the main interface.

· Subinterfaces (Layer 3 Ethernet subinterfaces and Layer 3 aggregate subinterfaces for example) and VLAN interfaces can terminate the following packets:

? Packets with matching Layer 1 VLAN IDs.

? Packets with matching Layer 1 and Layer 2 VLAN IDs.

A VLAN interface can terminate only the packets whose Layer 1 VLAN ID is numbered the same as the VLAN interface. For example, VLAN-interface 10 can terminate only the packets that have Layer 1 VLAN tag 10.

· After you modify the VLAN termination configuration for a Layer 3 Ethernet subinterface, Layer 3 aggregate subinterface, or Layer 3 VE subinterface, the subinterface automatically restarts. All dynamic ARP table entries for the subinterface are deleted.

· When a main interface bound to a VLAN interface receives a VLAN-tagged packet, the main interface processes the packet according to the VLAN interface configuration.

After you configure VLAN termination, the system finds an interface for a received packet in the following order:

· Subinterface configured with QinQ termination.

· Subinterface configured with loose QinQ termination.

· Subinterface configured with Dot1q termination, or subinterface that supports Dot1q termination by default.

· Subinterface configured with loose Dot1q termination.

· Subinterface configured with untagged termination.

· Subinterface configured with default termination.

· Main interface.

If a subinterface is configured with default termination, matching packets are processed by the subinterface rather than the main interface of the subinterface.

VLAN termination configuration task list

Tasks at a glance
(Required.) Perform one of the following tasks: · Configuring Dot1q termination ? Configuring ambiguous Dot1q termination ? Configuring unambiguous Dot1q termination · Configuring QinQ termination ? Configuring ambiguous QinQ termination ? Configuring unambiguous QinQ termination · Configuring untagged termination · Configuring default termination
(Optional.) Enabling a VLAN termination-enabled interface to transmit broadcasts and multicasts
(Optional.) Configuring the TPID for VLAN-tagged packets

Configuring Dot1q termination

Based on the range of outermost VLAN IDs in the VLAN-tagged packets that can be terminated by a subinterface, the following types of Dot1q termination are available:

· Ambiguous Dot1q termination—Terminates VLAN-tagged packets whose outermost VLAN IDs are in the specified range. Any other VLAN-tagged packets are not allowed to pass through this subinterface.

When the subinterface receives a packet, it removes the outermost layer of tags from the packet. When the subinterface sends a packet, it tags the packet with a VLAN ID as follows:

? For a PPPoE packet, the VLAN ID is obtained by searching the PPPoE session entries.

? For a DHCP relay packet, the VLAN ID is obtained by searching the DHCP session entries.

? For an IPv4 or MPLS packet, the VLAN ID is obtained by searching the ARP entries.

· Unambiguous Dot1q termination—Terminates only VLAN-tagged packets whose outermost VLAN ID matches the specified VLAN ID. Any other VLAN-tagged packets are not allowed to pass through this subinterface.

When the subinterface receives a packet, it removes the outermost VLAN tag of the packet.

When the subinterface sends a packet, it tags the packet with the specified VLAN ID.

Configuring ambiguous Dot1q termination

NOTE:

The views available for this feature depend on the device model. For more information, see the feature configuration command in Layer 2—LAN Switching Command Reference.

To configure ambiguous Dot1q termination:

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Enter interface view.	· Enter Layer 3 Ethernet subinterface view: interface interface-type interface-number.subnumber · Enter Layer 3 aggregate subinterface view: interface route-aggregation interface-number.subnumber · Enter Layer 3 VE subinterface view: interface virtual-ethernet interface-number.subnumber · Enter L3VE subinterface view: interface ve-l3vpn interface-number.subnumber	N/A
3. Configure ambiguous Dot1q termination.	vlan-type dot1q vid vlan-id-list [ loose ]	By default, Dot1q termination is disabled on an interface.

Configuring unambiguous Dot1q termination

NOTE:

The views available for this feature depend on the device model. For more information, see the feature configuration command in Layer 2—LAN Switching Command Reference.

To configure unambiguous Dot1q termination:

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Enter interface view.	· Enter Layer 3 Ethernet subinterface view: interface interface-type interface-number.subnumber · Enter Layer 3 aggregate subinterface view: interface route-aggregation interface-number.subnumber · Enter Layer 3 VE subinterface view: interface virtual-ethernet interface-number.subnumber · Enter L2VE subinterface view: interface ve-l2vpn interface-number.subnumber · Enter L3VE subinterface view: interface ve-l3vpn interface-number.subnumber	N/A
3. Configure unambiguous Dot1q termination.	vlan-type dot1q vid vlan-id [ loose ]	By default, Dot1q termination is disabled on an interface. The loose keyword is not supported on L2VE subinterfaces.

Configuring QinQ termination

QinQ termination allows only packets that include specific VLAN tags to pass through the subinterface or VLAN interface. The following types of QinQ termination are available:

· Ambiguous QinQ termination—Terminates QinQ packets whose outermost two layers of VLAN IDs are in the specified range.

When the subinterface or VLAN interface receives a packet, it removes the outermost two layers of VLAN tags of the packet.

When the subinterface or VLAN interface sends a packet, it tags the packet with the outermost two layers of VLAN IDs, which are determined as follows:

? For a PPPoE packet, the outermost two layers of VLAN IDs are obtained by searching the PPPoE session entries.

? For a DHCP relay packet, the outermost two layers of VLAN IDs are obtained by searching the DHCP relay entries.

? For an IPv4 or MPLS packet, the outermost two layers of VLAN IDs are obtained by searching the ARP entries.

· Unambiguous QinQ termination—Terminates QinQ packets whose outermost two layers of VLAN IDs match the specified values.

When the subinterface or VLAN interface receives a packet, it removes the two layers of VLAN tags of the packet.

When the subinterface or VLAN interface sends the packet, it tags the packet with two layers of VLAN tags as specified.

Configuring ambiguous QinQ termination

NOTE:

The views available for this feature depend on the device model. For more information, see the feature configuration commands in Layer 2—LAN Switching Command Reference.

Configuring ambiguous QinQ termination by specifying the outermost two layers of VLAN IDs

When you configure ambiguous QinQ termination by using this method, follow these restrictions and guidelines:

· If you specify the same Layer 1 VLAN ID for multiple subinterfaces under a main interface, the Layer 2 VLAN IDs specified for them must be different. However, if you specify different Layer 1 VLAN IDs for the subinterfaces, the Layer 2 VLAN IDs specified for the subinterfaces are not required to be different.

· Subinterfaces under different main interfaces can terminate VLAN-tagged packets with the same Layer 1 and Layer 2 VLAN IDs.

· When you use the vlan-type dot1q vid second-dot1q command to configure ambiguous QinQ termination multiple times, one of the following conditions occurs:

? If the most recently specified Layer 1 ID is the same as the current Layer 1 ID, the specified Layer 2 IDs in both configurations take effect.

? If the most recently specified Layer 1 ID is different from the current Layer 1 ID, you must first delete the old configuration.

To configure ambiguous QinQ termination:

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Enter interface view.	· Enter Layer 3 Ethernet subinterface view: interface interface-type interface-number.subnumber · Enter Layer 3 aggregate subinterface view: interface route-aggregation interface-number.subnumber · Enter Layer 3 VE subinterface view: interface virtual-ethernet interface-number.subnumber · Enter L3VE subinterface view: interface ve-l3vpn interface-number.subnumber	N/A
3. Configure ambiguous QinQ termination by specifying the outermost two layers of VLAN IDs.	vlan-type dot1q vid vlan-id-list second-dot1q { vlan-id-list \| any } [ loose ]	By default, QinQ termination is disabled on an interface.

Configuring ambiguous QinQ termination by specifying the Layer 2 VLAN IDs

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Enter VLAN interface view.	interface vlan-interface interface-number	N/A
3. Configure ambiguous QinQ termination by specifying the Layer 2 VLAN IDs.	second-dot1q { vlan-id-list \| any } [ loose ]	By default, QinQ termination is disabled on an interface. The Layer 1 VLAN ID of the VLAN-tagged packets that can be terminated by the VLAN interface is the VLAN interface number. This Layer 1 VLAN ID is not configurable.

NOTE:

After you enable ambiguous QinQ termination on a VLAN interface, Layer 2 Ethernet interfaces bound to the VLAN interface operate as follows:

· Process only packets that match the ambiguous QinQ termination configuration of the VLAN interface.

· Drop any other packets sent to the VLAN interface.

Configuring unambiguous QinQ termination

NOTE:

The views available for this feature depend on the device model. For more information, see the feature configuration commands in Layer 2—LAN Switching Command Reference.

Configuring unambiguous QinQ termination by specifying the outermost two layers of VLAN IDs

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Enter interface view.	· Enter Layer 3 Ethernet subinterface view: interface interface-type interface-number.subnumber · Enter Layer 3 aggregate subinterface view: interface route-aggregation interface-number.subnumber · Enter Layer 3 VE subinterface view: interface virtual-ethernet interface-number.subnumber · Enter L2VE subinterface view: interface ve-l2vpn interface-number.subnumber · Enter L3VE subinterface view: interface ve-l3vpn interface-number.subnumber	N/A
3. Configure unambiguous QinQ termination by specifying the outermost two layers of VLAN IDs.	vlan-type dot1q vid vlan-id second-dot1q vlan-id [ loose ]	By default, QinQ termination is disabled on an interface. The loose keyword is not supported on L2VE subinterfaces.

Configuring unambiguous QinQ termination by specifying the Layer 2 VLAN ID

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Enter VLAN interface view.	interface vlan-interface interface-number	N/A
3. Configure unambiguous QinQ termination by specifying the Layer 2 VLAN ID.	second-dot1q vlan-id [ loose ]	By default, QinQ termination is disabled on an interface. The Layer 1 VLAN ID of the VLAN-tagged packets that can be terminated by the VLAN interface is the VLAN interface number. This Layer 1 VLAN ID is not configurable.

NOTE:

After you enable unambiguous QinQ termination on a VLAN interface, Layer 2 Ethernet interfaces bound to the VLAN interface operate as follows:

· Process only packets that match the unambiguous QinQ termination configuration of the VLAN interface.

· Drop any other packets sent to the VLAN interface.

Configuring untagged termination

NOTE:

The views available for this feature depend on the device model. For more information, see the feature configuration command in Layer 2—LAN Switching Command Reference.

To configure untagged termination:

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Enter interface view.	· Enter Layer 3 Ethernet subinterface view: interface interface-type interface-number.subnumber · Enter Layer 3 aggregate subinterface view: interface route-aggregation interface-number.subnumber · Enter Layer 3 VE subinterface view: interface virtual-ethernet interface-number.subnumber · Enter L3VE subinterface view: interface ve-l3vpn interface-number.subnumber	N/A
3. Configure untagged termination.	vlan-type dot1q untagged	By default, untagged termination is disabled on an interface.

Configuring default termination

NOTE:

The views available for this feature depend on the device model. For more information, see the feature configuration command in Layer 2—LAN Switching Command Reference.

To configure default termination:

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Enter interface view.	· Enter Layer 3 Ethernet subinterface view: interface interface-type interface-number.subnumber · Enter Layer 3 aggregate subinterface view: interface route-aggregation interface-number.subnumber · Enter Layer 3 VE subinterface view: interface virtual-ethernet interface-number.subnumber · Enter L3VE subinterface view: interface ve-l3vpn interface-number.subnumber	N/A
3. Configure default termination.	vlan-type dot1q default	By default, default termination is disabled on an interface.

Enabling a VLAN termination-enabled interface to transmit broadcasts and multicasts

NOTE:

The views available for this feature depend on the device model. For more information, see the feature configuration commands in Layer 2—LAN Switching Command Reference.

This feature enables ambiguous Dot1q or QinQ termination-enabled interfaces to transmit broadcasts and multicasts.

As a best practice, use the vlan-termination broadcast ra command to enable an ambiguous Dot1q or QinQ termination-enabled interface to transmit RA multicast packets on an IPv6 network. This command prohibits transmission of broadcast packets and other types of multicast packets, and consumes less CPU resources than the vlan-termination broadcast enable command.

To enable a VLAN termination-enabled interface to transmit broadcasts and multicasts:

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Enter interface view.	· Enter Layer 3 Ethernet subinterface view: interface interface-type interface-number.subnumber · Enter Layer 3 aggregate subinterface view: interface route-aggregation interface-number.subnumber · Enter Layer 3 VE subinterface view: interface virtual-ethernet interface-number.subnumber · Enter L3VE subinterface view: interface ve-l3vpn interface-number.subnumber · Enter VLAN interface view interface vlan-interface interface-number	N/A
3. Enable the interface to transmit broadcasts and multicasts.	· Enable the interface to transmit broadcasts and multicasts: vlan-termination broadcast enable · Enable the interface to transmit only RA multicasts on an IPv6 network: vlan-termination broadcast ra	By default, an ambiguous Dot1q or QinQ termination-enabled interface does not transmit broadcasts and multicasts.

Configuring the TPID for VLAN-tagged packets

NOTE:

The views available for this feature depend on the device model. For more information, see the feature configuration command in Layer 2—LAN Switching Command Reference.

TPID identifies whether or not a frame contains VLAN tags. By default, the value of 0x8100 identifies an IEEE 802.1Q-tagged frame. You can set another TPID value to identify VLAN-tagged packets.

To work with VLAN termination on a subinterface, set the TPID value in the outermost VLAN tag of packets on the main interface of the subinterface. If VLAN termination is enabled on a VLAN interface, set the TPID value in the outermost VLAN tag of packets on the same VLAN interface.

The interface processes packets as untagged packets if their outermost VLAN tag is not 0x8100 or the configured value.

When sending a packet, the interface sets the TPID value in the outermost VLAN tag to the configured value. If the packet includes two or more layers of VLAN tags, the interface sets the TPID values to 0x8100 in all VLAN tags except the outermost VLAN tag.

To set the TPID value for VLAN-tagged packets:

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Enter interface view.	· Enter Layer 3 Ethernet interface view: interface interface-type interface-number · Enter Layer 3 aggregate interface view: interface route-aggregation interface-number · Enter Layer 3 VE interface view: interface virtual-ethernet interface-number · Enter L3VE interface view: interface ve-l3vpn interface-number.subnumber · Enter VLAN interface view: interface vlan-interface interface-number	· Configurations made in the following views take effect on all the subinterfaces: ? Layer 3 Ethernet interface view. ? Layer 3 aggregate interface view. ? Layer 3 VE interface view. ? L3VE interface view. · Configurations made in VLAN interface view take effect only on the VLAN interface.
3. Set the TPID value in the outermost VLAN tag of packets received and sent by the interface.	dot1q ethernet-type hex-value	The default setting is 0x8100.

VLAN termination configuration examples

Unambiguous Dot1q termination configuration example

Network requirements

As shown in Figure 61, configure unambiguous Dot1q termination on subinterfaces of the device to implement intra-VLAN and inter-VLAN communications between hosts.

Figure 61 Network diagram

Configuration procedure

IMPORTANT:

You must execute the vlan-type dot1q vid command on the device. An Ethernet subinterface can be activated and transmit packets only after it is associated with VLANs.

1. Configure Host A, Host B, Host C, and Host D:

# On Host A, specify 1.1.1.1/8 and 1.0.0.1/8 as its IP address and gateway IP address, respectively. (Details not shown.)

# On Host B, specify 2.2.2.2/8 and 2.0.0.1/8 as its IP address and gateway IP address, respectively. (Details not shown.)

# On Host C, specify 3.3.3.3/8 and 3.0.0.1/8 as its IP address and gateway IP address, respectively. (Details not shown.)

# On Host D, specify 4.4.4.4/8 and 4.0.0.1/8 as its IP address and gateway IP address, respectively. (Details not shown.)

2. Configure Layer 2 Switch A:

# Create VLAN 10.

<L2_SwitchA> system-view

[L2_SwitchA] vlan 10

# Assign GigabitEthernet 1/0/2 to VLAN 10.

[L2_SwitchA-vlan10] port gigabitethernet 1/0/2

[L2_SwitchA-vlan10] quit

# Create VLAN 20.

[L2_SwitchA] vlan 20

# Assign GigabitEthernet 1/0/3 to VLAN 20.

[L2_SwitchA-vlan20] port gigabitethernet 1/0/3

[L2_SwitchA-vlan20] quit

# Configure GigabitEthernet 1/0/1 as a trunk port, and assign the port to VLANs 10 and 20.

[L2_SwitchA] interface gigabitethernet 1/0/1

[L2_SwitchA-GigabitEthernet1/0/1] port link-type trunk

[L2_SwitchA-GigabitEthernet1/0/1] port trunk permit vlan 10 20

3. Configure Layer 2 Switch B in the same way you configure Layer 2 Switch A. (Details not shown.)

4. Configure the device:

# Create GigabitEthernet 1/0/1.10, and assign an IP address to this interface.

<Device> system-view

[Device] interface gigabitethernet 1/0/1.10

[Device-GigabitEthernet1/0/1.10] ip address 1.0.0.1 255.0.0.0

# Configure GigabitEthernet 1/0/1.10 to terminate packets tagged with VLAN 10.

[Device-GigabitEthernet1/0/1.10] vlan-type dot1q vid 10

[Device-GigabitEthernet1/0/1.10] quit

# Create GigabitEthernet 1/0/1.20, and assign an IP address to this interface.

[Device] interface gigabitethernet 1/0/1.20

[Device-GigabitEthernet1/0/1.20] ip address 2.0.0.1 255.0.0.0

# Configure GigabitEthernet 1/0/1.20 to terminate packets tagged with VLAN 20.

[Device-GigabitEthernet1/0/1.20] vlan-type dot1q vid 20

[Device-GigabitEthernet1/0/1.20] quit

# Configure GigabitEthernet 2/0/1.10, and assign an IP address to this interface.

[Device] interface gigabitethernet 2/0/1.10

[Device-GigabitEthernet2/0/1.10] ip address 3.0.0.1 255.0.0.0

# Configure GigabitEthernet 2/0/1.10 to terminate packets tagged with VLAN 10.

[Device-GigabitEthernet2/0/1.10] vlan-type dot1q vid 10

[Device-GigabitEthernet2/0/1.10] quit

# Configure GigabitEthernet 2/0/1.20, and assign an IP address to this interface.

[Device] interface gigabitethernet 2/0/1.20

[Device-GigabitEthernet2/0/1.20] ip address 4.0.0.1 255.0.0.0

# Configure GigabitEthernet 2/0/1.20 to terminate packets tagged with VLAN 20.

[Device-GigabitEthernet2/0/1.20] vlan-type dot1q vid 20

[Device-GigabitEthernet2/0/1.20] quit

Verifying the configuration

# Verify that Host A, Host B, Host C, and Host D can ping each other. (Details not shown.)

Ambiguous Dot1q termination configuration example

Network requirements

As shown in Figure 62, configure ambiguous Dot1q termination, so that hosts in different VLANs can communicate with the server group.

Figure 62 Network diagram

Configuration procedure

In this example, L2 switch B uses the factory configuration.

1. Configure Host A, Host B, and Host C:

# Assign 1.1.1.1/24, 1.1.1.2/24, and 1.1.1.3/24 to Host A, Host B, and Host C, respectively. (Details not shown.)

# Specify 1.1.1.11/24 as the gateway IP address for the hosts. (Details not shown.)

2. Configure Layer 2 Switch A:

# Create VLAN 11.

<L2_SwitchA> system-view

[L2_SwitchA] vlan 11

# Assign GigabitEthernet 1/0/1 to VLAN 11.

[L2_SwitchA-vlan11] port gigabitethernet 1/0/1

[L2_SwitchA-vlan11] quit

# Create VLAN 12.

[L2_SwitchA] vlan 12

# Assign GigabitEthernet 1/0/2 to VLAN 12.

[L2_SwitchA-vlan12] port gigabitethernet 1/0/2

[L2_SwitchA-vlan12] quit

# Create VLAN 13.

[L2_SwitchA] vlan 13

# Assign GigabitEthernet 1/0/3 to VLAN 13.

[L2_SwitchA-vlan13] port gigabitethernet 1/0/3

[L2_SwitchA-vlan13] quit

# Configure GigabitEthernet 1/0/7 as a trunk port, and assign the port to VLANs 11 through 13.

[L2_SwitchA] interface gigabitethernet 1/0/7

[L2_SwitchA-GigabitEthernet1/0/7] port link-type trunk

[L2_SwitchA-GigabitEthernet1/0/7] port trunk permit vlan 11 to 13

3. Configure the device:

# Create Ethernet subinterface GigabitEthernet 1/0/1.10, and assign an IP address to the subinterface.

<Device> system-view

[Device] interface gigabitethernet 1/0/1.10

[Device-GigabitEthernet1/0/1.10] ip address 1.1.1.11 255.255.255.0

# Enable Dot1q termination on GigabitEthernet 1/0/1.10 to terminate VLAN-tagged packets whose Layer 1 VLAN IDs are 11, 12, or 13.

[Device-GigabitEthernet1/0/1.10] vlan-type dot1q vid 11 to 13

# Enable GigabitEthernet 1/0/1.10 to transmit broadcasts and multicasts.

[Device-GigabitEthernet1/0/1.10] vlan-termination broadcast enable

[Device-GigabitEthernet1/0/1.10] quit

# Configure an IP address for GigabitEthernet 1/0/2.

[Device] interface gigabitethernet 1/0/2

[Device-GigabitEthernet1/0/2] ip address 1.1.2.11 255.255.255.0

4. Configure the server group:

# Assign each device in the server group an IP address on the network segment 1.1.2.0/24. (Details not shown.)

# Specify 1.1.2.11/24 as the gateway IP address for the server group. (Details not shown.)

Verifying the configuration

# Verify that Host A, Host B, and Host C can ping the device in the server group. (Details not shown.)

Configuration example for Dot1q termination supporting PPPoE server

Network requirements

As shown in Figure 63, the router acts as a PPPoE server. Hosts in different VLANs access the Internet through the PPPoE server.

Configure Dot1q termination so that hosts in different VLANs can access the Internet.

Figure 63 Network diagram

Configuration procedure

# Configure VLANs and Dot1q termination. For the configuration procedure, see "Ambiguous Dot1q termination configuration example." (Details not shown.)

# Configure the router as the PPPoE server. Configure PPPoE settings on GigabitEthernet 1/0/1.10 on the router. For more information about the PPPoE configuration, see Layer 2—WAN Configuration Guide. (Details not shown.)

Unambiguous QinQ termination configuration example

Network requirements

As shown in Figure 64:

· Layer 2 Switch C supports only single VLAN-tagged packets.

· On Layer 2 Switch B, GigabitEthernet 1/0/2 is enabled with QinQ to adds an SVLAN tag 100 to the packets with CVLAN ID 11.

Configure unambiguous QinQ termination so that Host A can communicate with Host B.

Figure 64 Network diagram

Configuration procedure

In this example, Layer 2 Switch C uses the factory configuration.

1. Configure Host A and Host B:

# On Host A, specify 1.1.1.1/24 and 1.1.1.11/24 as its IP address and gateway IP address, respectively. (Details not shown.)

# On Host B, specify 1.1.2.1/24 and 1.1.2.11/24 as its IP address and gateway IP address, respectively. (Details not shown.)

2. Configure Layer 2 Switch A:

# Create VLAN 11.

<L2_SwitchA> system-view

[L2_SwitchA] vlan 11

# Assign GigabitEthernet 1/0/2 to VLAN 11.

[L2_SwitchA-vlan11] port gigabitethernet 1/0/2

[L2_SwitchA-vlan11] quit

# Configure GigabitEthernet 1/0/1 as a trunk port, and assign the port to VLAN 11.

[L2_SwitchA] interface gigabitethernet 1/0/1

[L2_SwitchA-GigabitEthernet1/0/1] port link-type trunk

[L2_SwitchA-GigabitEthernet1/0/1] port trunk permit vlan 11

3. Configure Layer 2 Switch B:

# Configure GigabitEthernet 1/0/2 as a trunk port, and assign the port to VLAN 11 and VLAN 100.

<L2_SwitchB> system-view

[L2_SwitchB] interface gigabitethernet 1/0/2

[L2_SwitchB-GigabitEthernet1/0/2] port link-type trunk

[L2_SwitchB-GigabitEthernet1/0/2] port trunk permit vlan 11 100

# Set the PVID of GigabitEthernet 1/0/2 to VLAN 100.

[L2_SwitchB-GigabitEthernet1/0/2] port trunk pvid vlan 100

# Enable QinQ on GigabitEthernet 1/0/2.

[L2_SwitchB-GigabitEthernet1/0/2] qinq enable

[L2_SwitchB-GigabitEthernet1/0/2] quit

# Configure GigabitEthernet 1/0/1 as a trunk port, and assign the port to VLAN 100.

[L2_SwitchB] interface gigabitethernet 1/0/1

[L2_SwitchB-GigabitEthernet1/0/1] port link-type trunk

[L2_SwitchB-GigabitEthernet1/0/1] port trunk permit vlan 100

4. Configure the router:

# Create Ethernet subinterface GigabitEthernet 1/0/1.10, and assign an IP address to the subinterface.

<Router> system-view

[Router] interface gigabitethernet 1/0/1.10

[Router-GigabitEthernet1/0/1.10] ip address 1.1.1.11 255.255.255.0

# Enable QinQ termination on GigabitEthernet 1/0/1.10 to terminate the VLAN-tagged packets with the Layer 1 VLAN ID 100 and the Layer 2 VLAN ID 11.

[Router-GigabitEthernet1/0/1.10] vlan-type dot1q vid 100 second-dot1q 11

[Router-GigabitEthernet1/0/1.10] quit

# Assign an IP address to GigabitEthernet 1/0/2.

[Router] interface gigabitethernet 1/0/2

[Router-GigabitEthernet1/0/2] ip address 1.1.2.11 255.255.255.0

Verifying the configuration

# Verify that Host A and Host B can ping each other. (Details not shown.)

Ambiguous QinQ termination configuration example

Network requirements

As shown in Figure 65, QinQ is enabled on GigabitEthernet 1/0/2 of Layer 2 Switch B.

Configure ambiguous QinQ termination, so that hosts can communicate with the server group.

Figure 65 Network diagram

Configuration procedure

In this example, Layer 2 Switch C uses the factory configuration.

1. Configure Host A, Host B, and Host C:

# Assign IP addresses 1.1.1.1/24, 1.1.1.2/24, and 1.1.1.3/24 to Host A, Host B, and Host C, respectively. (Details not shown.)

# Specify 1.1.1.11/24 as the gateway address for the hosts. (Details not shown.)

2. Configure Layer 2 Switch A:

# Create VLAN 11.

<L2_SwitchA> system-view

[L2_SwitchA] vlan 11

# Assign GigabitEthernet 1/0/1 to VLAN 11.

[L2_SwitchA-vlan11] port gigabitethernet 1/0/1

[L2_SwitchA-vlan11] quit

# Create VLAN 12.

[L2_SwitchA] vlan 12

# Assign GigabitEthernet 1/0/2 to VLAN 12.

[L2_SwitchA-vlan12] port gigabitethernet 1/0/2

[L2_SwitchA-vlan12] quit

# Create VLAN 13.

[L2_SwitchA] vlan 13

# Assign GigabitEthernet 1/0/3 to VLAN 13.

[L2_SwitchA-vlan13] port gigabitethernet 1/0/3

[L2_SwitchA-vlan13] quit

# Configure GigabitEthernet 1/0/7 as a trunk port, and assign the port to VLANs 11 through 13.

[L2_SwitchA] interface gigabitethernet 1/0/7

[L2_SwitchA-GigabitEthernet1/0/7] port link-type trunk

[L2_SwitchA-GigabitEthernet1/0/7] port trunk permit vlan 11 to 13

3. Configure Layer 2 Switch B:

# Configure GigabitEthernet 1/0/2 as a trunk port, and assign the port to VLANs 11 through 13 and VLAN 100.

<L2_SwitchB> system-view

[L2_SwitchB] interface gigabitethernet 1/0/2

[L2_SwitchB-GigabitEthernet1/0/2] port link-type trunk

[L2_SwitchB-GigabitEthernet1/0/2] port trunk permit vlan 11 to 13 100

# Set the PVID of GigabitEthernet 1/0/2 to VLAN 100.

[L2_SwitchB-GigabitEthernet1/0/2] port trunk pvid vlan 100

# Enable QinQ on GigabitEthernet 1/0/2.

[L2_SwitchB-GigabitEthernet1/0/2] qinq enable

[L2_SwitchB-GigabitEthernet1/0/2] quit

# Configure GigabitEthernet 1/0/1 as a trunk port, and assign the port to VLAN 100.

[L2_SwitchB] interface gigabitethernet 1/0/1

[L2_SwitchB-GigabitEthernet1/0/1] port link-type trunk

[L2_SwitchB-GigabitEthernet1/0/1] port trunk permit vlan 100

4. Configure the router:

# Create Ethernet subinterface GigabitEthernet 1/0/1.10, and assign an IP address to the subinterface.

<Router> system-view

[Router] interface gigabitethernet 1/0/1.10

[Router-GigabitEthernet1/0/1.10] ip address 1.1.1.11 255.255.255.0

# Configure GigabitEthernet 1/0/1.10 to terminate VLAN-tagged packets whose Layer 1 VLAN ID is 100 and Layer 2 VLAN ID is 11, 12, or 13.

[Router-GigabitEthernet1/0/1.10] vlan-type dot1q vid 100 second-dot1q 11 to 13

# Enable GigabitEthernet 1/0/1.10 to transmit broadcasts and multicasts.

[Router-GigabitEthernet1/0/1.10] vlan-termination broadcast enable

[Router-GigabitEthernet1/0/1.10] quit

# Assign an IP address to GigabitEthernet 1/0/2.

[Router] interface gigabitethernet 1/0/2

[Router-GigabitEthernet1/0/2] ip address 1.1.2.11 255.255.255.0

5. Configure the server group:

# Assign each device in the server group an IP address on the network segment 1.1.2.0/24. (Details not shown.)

# Specify 1.1.2.11/24 as the gateway IP address for the server group. (Details not shown.)

Verifying the configuration

# Verify that Host A, Host B, and Host C can ping the server group. (Details not shown.)

Configuration example for QinQ termination supporting PPPoE server

Network requirements

As shown in Figure 66:

· QinQ is enabled on GigabitEthernet 1/0/2 of Layer 2 Switch B.

· The router acts as a PPPoE server. Hosts in different VLANs access the Internet through the PPPoE server.

Configure QinQ termination, so that the hosts can access the Internet.

Figure 66 Network diagram

Configuration procedure

# Configure VLANs and QinQ termination. For the configuration procedure, see "Ambiguous QinQ termination configuration example." (Details not shown.)

# Configure the router as the PPPoE server. Configure PPPoE settings on GigabitEthernet 1/0/1.10 on the router. For more information about PPPoE configuration, see Layer 2—WAN Configuration Guide. (Details not shown.)

Configuration example for QinQ termination supporting DHCP relay

Network requirements

As shown in Figure 67:

· Provider A and Provider B are edge devices on the service provider network.

· DHCP client A and DHCP client B are devices on the customer networks.

· Provider A is the DHCP relay agent. Provider B is the DHCP server.

· Provider A and Provider B communicate with each other through Layer 3 interfaces.

Configure QinQ termination on Provider A so that DHCP client A and DHCP client B can obtain IP settings from Provider B.

Figure 67 Network diagram

Configuration procedure

1. Configure the DHCP relay agent Provider A:

# Enable DHCP service.

<ProviderA> system-view

[ProviderA] dhcp enable

# Create a Layer 3 Ethernet subinterface GigabitEthernet 1/0/1.100.

[ProviderA] interface gigabitethernet 1/0/1.100

# Configure GigabitEthernet 1/0/1.100 to terminate packets whose Layer 1 ID is 100 and Layer 2 VLAN ID is 10 or 20.

[ProviderA-GigabitEthernet1/0/1.100] vlan-type dot1q vid 100 second-dot1q 10 20

# Enable GigabitEthernet 1/0/1.100 to transmit broadcast and multicast packets.

[ProviderA-GigabitEthernet1/0/1.100] vlan-termination broadcast enable

# Enable DHCP relay on GigabitEthernet 1/0/1.100 and specify 10.2.1.1 as the DHCP server address.

[ProviderA-GigabitEthernet1/0/1.100] dhcp select relay

[ProviderA-GigabitEthernet1/0/1.100] dhcp relay server-address 10.2.1.1

# Assign an IP address to GigabitEthernet 1/0/1.100.

[ProviderA-GigabitEthernet1/0/1.100] ip address 192.168.1.1 24

[ProviderA-GigabitEthernet1/0/1.100] quit

# Enable recording of relay entries on the relay agent.

[ProviderA] dhcp relay client-information record

# Assign an IP address to the interface Serial 2/1/0.

[ProviderA] interface serial 2/1/0

[ProviderA-Serial2/1/0] ip address 10.1.1.1 24

[ProviderA-Serial2/1/0] quit

# Configure a static route to the DHCP server.

[ProviderA] ip route-static 10.2.1.1 24 10.1.1.1

2. Configure the DHCP server Provider B:

# Assign an IP address to the DHCP server.

<ProviderB> system-view

[ProviderB] interface serial 2/1/0

[ProviderB-Serial2/1/0] ip address 10.2.1.1 24

[ProviderB-Serial2/1/0] quit

# Enable DHCP.

[ProviderB] dhcp enable

# Configure an IP address pool on the DHCP server.

[ProviderB] dhcp server ip-pool 1

[ProviderB-dhcp-pool-1] network 192.168.1.0 24

[ProviderB-dhcp-pool-1] gateway-list 192.168.1.1

[ProviderB-dhcp-pool-1] quit

# Configure a static route to GigabitEthernet 1/0/1.100.

[ProviderB] ip route-static 192.168.1.1 24 10.1.1.1

3. Configure Switch A:

# Configure the uplink port GigabitEthernet 1/0/1 as a trunk port, and assign the port to VLAN 100.

<SwitchA> system-view

[SwitchA] interface gigabitethernet 1/0/1

[SwitchA-GigabitEthernet1/0/1] port link-type trunk

[SwitchA-GigabitEthernet1/0/1] port trunk permit vlan 100

[SwitchA-GigabitEthernet1/0/1] quit

# Configure the downlink port GigabitEthernet 1/0/2 as a trunk port, and assign the port to VLANs 10 and 100.

[SwitchA] interface gigabitethernet 1/0/2

[SwitchA-GigabitEthernet1/0/2] port link-type trunk

[SwitchA-GigabitEthernet1/0/2] port trunk permit vlan 10 100

# Set the PVID of GigabitEthernet 1/0/2 to VLAN 100.

[SwitchA-GigabitEthernet1/0/2] port trunk pvid vlan 100

# Enable QinQ on GigabitEthernet1/0/2.

[SwitchA-GigabitEthernet1/0/2] qinq enable

[SwitchA-GigabitEthernet1/0/2] quit

# Configure the downlink port GigabitEthernet 1/0/3 as a trunk port, and assign the port to VLANs 20 and 100.

[SwitchA] interface gigabitethernet 1/0/3

[SwitchA-GigabitEthernet1/0/3] port link-type trunk

[SwitchA-GigabitEthernet1/0/3] port trunk permit vlan 20 100

# Set the PVID of GigabitEthernet 1/0/3 to VLAN 100.

[SwitchA-GigabitEthernet1/0/3] port trunk pvid vlan 100

# Enable QinQ on GigabitEthernet 1/0/3.

[SwitchA-GigabitEthernet1/0/3] qinq enable

[SwitchA-GigabitEthernet1/0/3] quit

# Assign GigabitEthernet 1/0/2 and GigabitEthernet 1/0/3 to VLAN 100.

[SwitchA] vlan 100

[SwitchA-vlan100] port gigabitethernet 1/0/2

[SwitchA-vlan100] port gigabitethernet 1/0/3

4. Configure Switch B:

# Create VLAN 10.

<SwitchB> system-view

[SwitchB] vlan 10

# Assign GigabitEthernet 1/0/2 to VLAN 10.

[SwitchB-vlan10] port gigabitethernet 1/0/2

[SwitchB-vlan10] quit

# Configure GigabitEthernet 1/0/1 as a trunk port, and assign the port to VLAN 10.

[SwitchB] interface gigabitethernet 1/0/1

[SwitchB-GigabitEthernet1/0/1] port link-type trunk

[SwitchB-GigabitEthernet1/0/1] port trunk permit vlan 10

5. Configure Switch C:

# Create VLAN 20.

<SwitchC> system-view

[SwitchC] vlan 20

# Assign GigabitEthernet 1/0/2 to VLAN 20.

[SwitchC-vlan20] port gigabitethernet 1/0/2

[SwitchC-vlan20] quit

# Configure GigabitEthernet 1/0/1 as a trunk port, and assign the port to VLAN 20.

[SwitchC] interface gigabitethernet 1/0/1

[SwitchC-GigabitEthernet1/0/1] port link-type trunk

[SwitchC-GigabitEthernet1/0/1] port trunk permit vlan 20

Verifying the configuration

# Verify that DHCP client A and DHCP client B can obtain IP settings from Provider B. (Details not shown.)

Index

A C D E F I L M O P Q R S V

Assigning a port to the isolation group,40

Command and hardware compatibility,149

Compatibility information,167

Compatibility information,106

Compatibility information,2

Compatibility information,14

Configuration restrictions and guidelines,172

Configuration restrictions and guidelines,72

Configuring a port to operate in automatic voice VLAN assignment mode,62

Configuring a port to operate in manual voice VLAN assignment mode,63

Configuring a super VLAN,53

Configuring a super VLAN interface,53

Configuring a VLAN group,49

Configuring an aggregate interface,19

Configuring an aggregation group,15

Configuring an MST region,111

Configuring basic VLAN settings,44

Configuring CDP compatibility,157

Configuring default termination,178

Configuring Digest Snooping,125

Configuring Dot1q termination,173

Configuring edge ports,116

Configuring fast Layer 2 forwarding,168

Configuring LLDP to advertise a voice VLAN,65

Configuring LLDP trapping and LLDP-MED trapping,158

Configuring load sharing for link aggregation groups,24

Configuring MAC address entries,3

Configuring No Agreement Check,127

Configuring normal Layer 2 forwarding,167

Configuring path costs of ports,117

Configuring port-based VLANs,46

Configuring protection features,130

Configuring QinQ termination,174

Configuring TC Snooping,129

Configuring the BPDU transmission rate,116

Configuring the device priority,113

Configuring the maximum hops of an MST region,113

Configuring the mode a port uses to recognize and send MSTP frames,122

Configuring the network diameter of a switched network,114

Configuring the port link type,121

Configuring the port priority,120

Configuring the root bridge or a secondary root bridge,112

Configuring the TPID for VLAN tags,72

Configuring the TPID for VLAN-tagged packets,179

Configuring untagged termination,177

Configuring VLAN interfaces,45

Creating a sub-VLAN,52

Disabling inconsistent PVID protection,124

Disabling MAC address learning on an interface,4

Displaying and maintaining Ethernet link aggregation,28

Displaying and maintaining LLDP,160

Displaying and maintaining loop detection,82

Displaying and maintaining port isolation,40

Displaying and maintaining QinQ,74

Displaying and maintaining super VLANs,54

Displaying and maintaining the MAC address table,5

Displaying and maintaining the spanning tree,135

Displaying and maintaining VLANs,49

Displaying and maintaining voice VLANs,65

Enabling a VLAN termination-enabled interface to transmit broadcasts and multicasts,178

Enabling link-aggregation traffic redirection,27

Enabling LLDP for automatic IP phone discovery,64

Enabling loop detection,80

Enabling outputting port state transition information,122

Enabling QinQ,72

Enabling SNMP notifications for new-root election and topology change events,134

Enabling the device to generate ARP or ND entries for received management address LLDP TLVs,160

Enabling the spanning tree feature,123

Ethernet link aggregation configuration examples,28

Ethernet link aggregation configuration task list,15

Feature and hardware compatibility,80

Feature and hardware compatibility,52

Feature and hardware compatibility,40

Feature and hardware compatibility,44

Feature and hardware compatibility,71

Feature and hardware compatibility,57

IP phone access methods,59

LLDP configuration examples,161

LLDP configuration task list,149

Loop detection configuration example,82

Loop detection configuration task list,80

MAC address table configuration example,6

MAC address table configuration task list,3

Methods of identifying IP phones,57

MSTP,98

Overview,43

Overview,52

Overview,7

Overview,170

Overview,143

Overview,1

Overview,57

Overview,78

Overview,70

Performing basic LLDP configurations,150

Performing mCheck,123

Port isolation configuration example,41

Protocols and standards,107

PVST,97

QinQ configuration example,75

RSTP,95

Security mode and normal mode of voice VLANs,61

Setting spanning tree timers,114

Setting the 802.1p priority in SVLAN tags,73

Setting the aging timer for dynamic MAC address entries,5

Setting the loop detection interval,82

Setting the loop protection action,81

Setting the source MAC address of LLDP frames to the MAC address of the subinterface associated with the specified VLAN,159

Setting the spanning tree mode,110

Setting the timeout factor,116

Spanning tree configuration example,136

Spanning tree configuration task lists,107

STP,86

Super VLAN configuration example,54

Super VLAN configuration task list,52

VLAN configuration example,50

VLAN termination configuration examples,180

VLAN termination configuration task list,172

Voice VLAN assignment modes,60

Voice VLAN configuration examples,66

Voice VLAN configuration task list,62

04-Layer 2 - LAN Switching Configuration Guide

Overview

MAC address learning

Manually configuring MAC address entries

Compatibility information

MAC address table configuration task list

Configuring MAC address entries

Disabling MAC address learning on an interface

Setting the aging timer for dynamic MAC address entries

Displaying and maintaining the MAC address table

MAC address table configuration example

Configuration types

Attribute configurations

Protocol configurations

LACP functions

LACP operating modes

LACP priorities

LACP timeout interval

Load sharing modes for link aggregation groups

Aggregation member interface restrictions

Configuration consistency requirements

Miscellaneous

Configuring a Layer 3 static aggregation group

Configuring the description of an aggregate interface

Setting the expected bandwidth for an aggregate interface

Setting the global link-aggregation load sharing mode

Setting the group-specific load sharing mode

Network requirements

Configuration procedure

Verifying the configuration

Network requirements

Configuration procedure

Verifying the configuration

Network requirements

Configuration procedure

Verifying the configuration

Network requirements

Configuration procedure

Verifying the configuration

Network requirements

Configuration procedure

Verifying the configuration

Network requirements

Configuration procedure

Verifying the configuration

Network requirements

Configuration procedure

Verifying the configuration

Configuring VLANs

Overview

Configuring port-based VLANs

Port link type

PVID

How ports of different link types handle frames

Assigning an access port to a VLAN

Assign one or multiple access ports to a VLAN in VLAN view

Assign an access port to a VLAN in interface view

Displaying and maintaining VLANs

Configuring super VLANs

Creating a sub-VLAN

Displaying and maintaining super VLANs

Displaying and maintaining VLAN s