Login
- Table of Contents
-
- 13-Security Command Reference
- 00-Preface
- 01-DAE proxy commands
- 02-Password control commands
- 03-Keychain commands
- 04-Public key management commands
- 05-PKI commands
- 06-IPsec commands
- 07-SSH commands
- 08-SSL commands
- 09-Session management commands
- 10-Object group commands
- 11-Attack detection and prevention commands
- 12-IP-based attack prevention commands
- 13-IP source guard commands
- 14-ARP attack protection commands
- 15-ND attack defense commands
- 16-uRPF commands
- 17-SAVA commands
- 18-Crypto engine commands
- 19-SMA commands
- 20-Trust level commands
- 21-Encryption card user management commands
- 22-SAVNET commands
- 23-MACsec commands
- Related Documents
-
| Title | Size | Download |
|---|---|---|
| 22-SAVNET commands | 306.99 KB |
display bgp ipv6 savnet prefix
display ipv6 savnet packet-drop statistics
ipv6 savnet log enable spoofing-packet
ipv6 savnet packet-drop enable
reset ipv6 savnet packet-drop statistics
SAVNET commands
address-family ipv6 savnet
Use address-family ipv6 savnet to create the BGP IPv6 SAVNET address family and enter its view, or enter the view of the existing BGP IPv6 SAVNET address family.
Use undo address-family ipv6 savnet to delete the BGP IPv6 SAVNET address family and all its configuration.
Syntax
address-family ipv6 savnet
undo address-family ipv6 savnet
Default
The BGP IPv6 SAVNET address family does not exist.
Views
BGP instance view
Predefined user roles
network-admin
Usage guidelines
Application scenarios
The BGP IPv6 SAVENET address family is used for SAVNET networks. SAVNET devices can generate SAVNET entries by exchanging BGP IPv6 SAVNET routes that carry the protocol information.
Restrictions and guidelines
The configuration in BGP IPv6 SAVNET address family view takes effect only on routes and peers in the BGP IPv6 SAVNET address family.
Examples
# Create the BGP IPv6 SAVNET address family in BGP instance view and enter BGP IPv6 SAVNET address family view.
<Sysname> system-view
[Sysname] bgp 100
[Sysname-bgp-default] address-family ipv6 savnet
[Sysname-bgp-default-savnet-ipv6]
destination-probing enable
Use destination-probing enable to enable SAVNET destination prefix probing.
Use undo destination-probing enable to disable SAVNET destination prefix probing.
Syntax
destination-probing enable
undo destination-probing enable
Default
SAVNET destination prefix probing is disabled.
Views
BGP IPv6 SAVNET address family view
Predefined user roles
network-admin
Usage guidelines
Operating mechanism
When SAVNET destination prefix probing is disabled, the device only forwards but cannot generate DPP routes. With this feature enabled, the device can generate DPP routes.
Restrictions and guidelines
This command does not affect the agent DPP route feature. SAVNET devices can generate agent DPP routes even when SAVNET destination prefix probing is disabled.
Examples
# Enable SAVNET destination prefix probing.
<Sysname> system-view
[Sysname] bgp 100
[Sysname-bgp-default] address-family ipv6 savnet
[Sysname-bgp-default-savnet-ipv6] destination-probing enable
destination-probing interval
Use destination-probing interval to set the DPP route sending interval.
Use undo destination-probing interval to restore the default.
Syntax
destination-probing interval [ interval ]
undo destination-probing interval
Default
The DPP route sending interval is 3600 seconds.
Views
BGP IPv6 SAVNET address family view
Predefined user roles
network-admin
Parameters
interval: Sets an interval, in the value range of 30 to 86400 seconds.
Usage guidelines
Operating mechanism
With this command configured on a device, the device periodically sends DPP routes at the specified interval.
Restrictions and guidelines
As a best practice, configure the SAVNET entry aging time to be at least twice the DPP route sending interval configured on the route generating device. Otherwise, SAVNET entries might age out incorrectly because of long DPP route sending interval.
If a large number of DPP routes need to be sent, do not set the sending interval of DPP routes too short. A too short sending interval might overwhelm BGP IPv6 SAVNET peers with DPP routes, causing them unable to process the received DPP routes timely.
Examples
# Set the DPP route sending interval to 100 seconds.
<Sysname> system-view
[Sysname] bgp 100
[Sysname-bgp-default] address-family ipv6 savnet
[Sysname-bgp-default-savnet-ipv6] destination-probing interval 100
Make sure the SAVNET entry aging time is at least twice the DPP route sending interval configured on the DPP routes’ source device. Continue? [y/n]
Related commands
destination-probing enable
savnet-entry expire-time
display bgp ipv6 savnet dpp
Use display bgp ipv6 savnet dpp to display information about BGP IPv6 SAVNET Destination Prefix Probing (DPP) routes.
Syntax
display bgp [ instance instance-name ] ipv6 savnet dpp [ [ route-distinguisher route-distinguisher ] [ savnet-route route-length | savnet-prefix ] | statistics ]
display bgp [ instance instance-name ] ipv6 savnet dpp [ route-distinguisher route-distinguisher ] time-range min-time max-time
Views
Any view
Predefined user roles
network-admin
network-operator
Parameters
instance instance-name: Specifies a BGP instance by its name, a case-sensitive string of 1 to 31 characters. If you do not specify this option, the command displays DPP route information of the default instance.
route-distinguisher route-distinguisher: Specifies the route distinguisher of DPP routes, a string of 3 to 21 characters in the format of Router ID:0.
savnet-route route-length: Specifies a DPP route and the route length. A DPP route is a string of 1 to 512 characters. The length of a DPP route is an integer in the range of 0 to 65535, in bits.
savnet-prefix: Specifies a DPP route by a prefix in the format of savnet-route/route-length, which is a case-insensitive string of 1 to 512 characters.
statistics: Displays statistics for DPP routes.
time-range min-time max-time: Displays DPP routes that have existed for a time period in the specified time period range since the last update. The min-time and max-time arguments represent the minimum and maximum time periods, respectively, and are in <0-10000>d<0-23>h<0-59>m<0-59>s format. The d, h, m, and s letters represent days, hours, minutes, and seconds, respectively. <0-10000>, <0-23>, <0-59>, and <0-59> represent the value ranges for d, h, m, and s, respectively. The value for the max-time argument must be greater than that for the min-time argument.
Usage guidelines
Application scenarios
DPP routes are used to transmit DPP information in the SAVNET network.
Route generation mechanism
After generating SPA routes based on the routes imported with the import-route command, a SAVNET device can generate the following types of DPP routes:
· DPP routes generated based on the forwarding destination prefixes of the non-direct entries in the IPv6 FIB—The routing protocol type of a non-direct entry is not direct. A generated DPP route contains the origin router ID, destination prefix, and router ID list. The origin router ID is the router ID configured locally on the device, and the destination prefix is the corresponding non-direct forwarding destination prefix in the IPv6 FIB table. The router ID in the router ID list is the one configured locally on the device.
· DPP routes generated based on IPv6 PBR applied on the SAVNET device—A DPP route can be generated only when IPv6 PBR is applied to the interface where the locally advertised source prefix resides. A generated DPP route contains the origin router ID, destination prefix, and router ID list. The origin router ID is the router ID configured locally on the device, and the router ID in the router ID list is the one configured locally on the device. The relationship between the destination prefix and the applied IPv6 PBR is as follows:
¡ For IPv6 PBR configured with an ACL:
- If the ACL only has permit rules for source address matching, DPP routes with the destination prefix as the unspecified address (::) are generated when the locally advertised source prefix information matches the ACL-specified source addresses. Otherwise, no DPP route is generated.
- If the ACL has permit rules for both source and destination address matching, DPP routes with the destination prefixes as the ACL-specified destination addresses are generated when the locally advertised source prefix information matches the ACL-specified source addresses. Otherwise, no DPP route is generated.
- If the ACL only has permit rules for destination address matching, DPP routes with the destination prefixes as the ACL-specified destination addresses are generated. If the any destination address is specified in a rule, a DPP route with the destination prefix as the unspecified address (::) is generated.
- If the ACL has no permit rules, no DPP route is generated.
¡ For IPv6 PBR configured with other match criteria, no DPP route is generated.
For more information about IPv6 PBR, see Layer 3—IP Routing Configuration Guide. For more information about ACLs, see ACL and QoS Configuration Guide.
Route transmission mechanism
The SAVNET device transmits the generated DPP routes based on the generation methods, if you have enabled SAVNET destination prefix probing using the destination-probing enable command:
· For DPP routes generated based on the forwarding destination prefixes of the non-direct entries in the IPv6 FIB
The device looks up the outgoing interface to the next hop for the destination prefix in the IPv6 FIB table and determines whether it has established a direct connection with a BGP IPv6 SAVNET peer through that interface. If a direct peer relationship is established, the device sends the DPP route only to that direct peer. If a direct peer relationship has not been established, the device does not send the DPP route.
· For DPP routes generated based on IPv6 PBR applied on the SAVNET device
The device determines whether it has established a direct connection with a BGP IPv6 SAVNET peer on the outgoing interface to the next hop configured by IPv6 PBR. If a direct peer relationship is established, the device sends the DPP route only to that direct peer. If a direct peer relationship has not been established, the device does not send the DPP route.
The above mechanism uses the optimal path to the destination prefix to send DPP information to the remote device so that all devices along the path can generate SAVNET entries based on the received DPP information.
After receiving a DPP route, the SAVNET neighbor device compares the origin router ID carried in the DPP route with the locally configured router ID.
· If they are the same, the device drops the DPP route.
· If they are different, the device matches the destination prefix carried in the DPP route with the local IPv6 FIB table.
¡ If an IPv6 FIB entry matching that prefix exists, the device adds its own router ID as a route attribute to the router ID list of the DPP route. The device then finds the outgoing interface to the next hop for the prefix in the FIB and determines whether it has established a direct BGP IPv6 SAVNET peer through that outgoing interface. If a direct peer relationship is established, the device forwards the DPP route only to that direct peer.
¡ If the destination prefix in the DPP route is the unspecified address (::), the device looks up each non-direct entry in the local IPv6 FIB table and generates a DPP route for each non-direct entry. The destination prefix in a generated DPP route is the destination address prefix in the corresponding non-direct entry. The device sends the generated DPP routes to only peers with which direct BGP IPv6 SAVNET session relationships have been established on the outgoing interfaces to the next hops in the non-direct entries.
¡ If no IPv6 FIB entry that matches the prefix exists, the device drops the DPP route.
Restrictions and guidelines
DPP routes are sent as Route-Refresh messages, so devices without Route-Refresh capabilities cannot send or receive DPP routes.
If no parameters are specified, this command displays brief information about all BGP IPv6 SAVNET DPP routes.
Examples
# Display brief information about all BGP IPv6 SAVNET DPP routes.
<Sysname> display bgp ipv6 savnet dpp
BGP local router ID is 8.5.6.7
Status codes: * - valid, > - best, d - dampened, h - history,
s - suppressed, S - stale, i - internal, e - external
a - additional-path
Origin: i - IGP, e - EGP, ? - incomplete
Total number of SAVNET routes: 3
Total number of routes from all peers: 1
Route distinguisher: 3.4.5.6:0
Total number of routes: 1
* >i Network : [2][2][1][3.4.5.6][64][101::]/120
NextHop : 0.0.0.0 LocPrf : 100
MED : 0
Path/Ogn: i
Route distinguisher: 8.5.6.7:0
Total number of routes: 2
* > Network : [2][2][1][8.5.6.7][64][10::]/120
NextHop : 0.0.0.0 LocPrf : 100
MED : 0
Path/Ogn: i
* >i Network : [2][2][1][3.3.3.3][128][1::1]/184
NextHop : 0.0.0.0 LocPrf : 100
MED : 0
Path/Ogn: i
# Display brief information about all BGP IPv6 SAVNET DPP routes whose duration since the last route update is within a specified time range.
<Sysname> display bgp ipv6 savnet dpp time-range 1d1h1m1s 7d3h1m1s
BGP local router ID is 8.5.6.7
Status codes: * - valid, > - best, d - dampened, h - history,
s - suppressed, S - stale, i - internal, e - external
a - additional-path
Origin: i - IGP, e - EGP, ? - incomplete
Total number of SAVNET routes: 2
Total number of routes from all peers: 2
Route distinguisher: 3.4.5.6:0
Total number of routes: 1
* >i Network : [2][2][1][3.4.5.6][64][101::]/120
NextHop : :: LocPrf : 100
MED : 0 Route age : 06d01h12m44s
Table 1 Command output
|
Field |
Description |
|
BGP local router ID |
Locally configured router ID of the device. |
|
Status codes |
Route status code: · * - valid—Valid route. · > - best—Optimal route · d - dampened—Dampened route. · h - history—History route. · s - suppressed—Suppressed route. · S - stale—Stale route. · i - internal—Internal route. · e - external—External route. · a - additional-path—Add-Path optimal route. |
|
Origin |
Origin of the route: · i - IGP—Originated in the local AS. · e - EGP—Learned through Exterior Gateway Protocol (EGP). · ? - incomplete—Unknown origin. The origin of routes redistributed from the IGP protocol is incomplete. |
|
Total number of SAVNET routes |
Total number of SAVNET routes for all route distinguishers. |
|
Total number of routes from all peers |
Total number of SAVNET routes received from all BGP IPv6 SAVNET peers. |
|
Route distinguisher |
Information of the DPP routes with the specified route distinguisher. |
|
Total number of routes |
Total number of DPP routes with the specified routing distinguisher. |
|
Network |
DPP route, with value [2][2][DPP route subprotocol type][origin router ID][prefix length][IPv6 prefix address]. The value for the DPP route subprotocol type through two route generation methods is fixed at 1. |
|
NextHop |
Next hop address, which is 0.0.0.0. This field is meaningless for DPP routes. |
|
LocPrf |
Local preference value. |
|
MED |
Multi-Exit Discriminator (MED) attribute value. |
|
Path/Ogn |
The AS_Path attribute of the route and the ORIGIN attribute of the route information, where: · The AS_PATH attribute records all the ASs that this route has passed through, which can avoid routing loops. This field can display a maximum of 16 AS numbers, and the omitted part is represented by ellipsis (...). The omitted part can be viewed by displaying the detailed information of the route. · The ORIGIN attribute marks how this BGP route is generated. |
|
Route age |
Time elapsed since the last update of the route, in <0-10000>d<0-23>h<0-59>m<0-59>s format. d, h, m, and s represent days, hours, minutes, and seconds, respectively. <0-10000>, <0-23>, <0-59>, and <0-59> represent the value ranges for d, h, m, and s, respectively. |
# Display detailed information for DPP route [2][2][1][192.168.56.12][128][156::1]/184.
<Sysname> display bgp ipv6 savnet dpp [2][2][1][192.168.56.12][128][156::1]/184
BGP local router ID: 8.5.6.7
Local AS number: 100
Route distinguisher: 192.168.56.12:0
Total number of routes: 1
Paths: 1 available, 1 best
BGP routing table information of [2][2][1][192.168.56.12][128][156::1]/184:
From : 100::1 (192.168.56.12)
Rely nexthop : ::1
Original nexthop: 0.0.0.0
Out interface : NULL0
Route age : 00h01m42s
OutLabel : NULL
RxPathID : 0x0
TxPathID : 0xffffffff
AS-path : (null)
Origin : igp
Attribute value : MED 0, localpref 100, pref-val 32768
State : valid, internal, best
Source type : local
IP precedence : N/A
QoS local ID : N/A
Traffic index : N/A
Route type : SAVNET DPP
Origin routerID : 192.168.56.12
Sequence num : 26
IfIndexIn : 258
In interface : Ten-GigabitEthernet3/1/1
IfIndexOut : 259
Out interface : Ten-GigabitEthernet3/1/2, advertised
LastSend : 00h00m56s
Path RID list : 192.168.56.12
Agent RID list : (null)
Table 2 Command output
|
Field |
Description |
|
BGP local router ID |
Locally configured router ID of the device. |
|
Local AS number |
Local AS number. |
|
Route distinguisher |
Information of the DPP routes with the specified route distinguisher. |
|
Total number of routes |
Total number of DPP routes with the specified routing distinguisher. |
|
Paths |
Route quantity information. · Available—Number of effective routes. · best—Number of optimal routes. |
|
BGP routing table information of [2][2][1][192.168.56.12][128][156::1]/184 |
Detailed information of DPP route [2][2][1][192.168.56.12][128][156::1]/184. |
|
From |
IP address of the BGP peer that advertised this route. |
|
Rely nexthop |
Next hop IP address after route recursion. This field has no meaning for routes in the SAVNET address family. |
|
Original nexthop |
Original next hop address of the route, with a value of ::. |
|
Route age |
Period of time since the last update of the route. |
|
OutLabel |
Outgoing label value of the route. |
|
RxPathID |
Add-Path ID value of the received route. |
|
TxPathID |
Add-Path ID value of the sent route. |
|
AS-path |
AS_PATH attribute of the route. It records all the ASs that the route passes through, which can prevent routing loops. |
|
Origin |
Origin of the route. Values include: · igp—Originated in the local AS. · egp—Learned through Exterior Gateway Protocol (EGP). · incomplete—Unknown origin. The origin of routes redistributed from the IGP protocol is incomplete. |
|
Attribute value |
BGP route attributes: · MED—MED value associated with the destination network. · localpref—Local preference value. · pref-val—Preferred value. |
|
State |
Current state of the route: · valid · Internal · External · local · best |
|
Source type |
Source type of the route. |
|
IP precedence |
IP precedence in the range of 0 to 7. N/A indicates that the route does not support this field. |
|
QoS local ID |
QoS local ID in the range of 1 to 4095. N/A indicates that the route does not support this field. |
|
Traffic index |
Traffic index value, in the range of 1 to 64. N/A indicates that the route does not support this field. |
|
Route type |
Type of the SAVNET route, which is SAVNET DPP, indicating DPP routes. |
|
Origin routerID |
Origin router ID. |
|
Sequence num |
Sequence number of the DPP route, used to distinguish between new and old DPP routes. The recipient only processes DPP routes with a higher DPP route sequence number than the ones it has already received. The exception is that the recipient will always process a DPP route with sequence number 0 to avoid the inability to receive DPP routes when the sequence number overflows and resets to 0. |
|
IfindexIn |
Index of the interface that received the DPP route. |
|
In interface |
Name of the interface that received the DPP route. |
|
IfIndexOut |
Index of the interface that sent the DPP route. |
|
Out interface |
Name of the interface that sent the DPP route, and the route sending result. |
|
LastSend |
Time elapsed since the last sending of the DPP route, in the format of xxhxxmxxs, where h represents hours, m represents minutes, and s represents seconds. |
|
Path RID list |
List of the router IDs of the devices that a non-agent DPP route passes, the closer the peer to the receiver, the higher its position in the list. |
|
Agent RID list |
List of the router IDs of the devices that an agent DPP route passes, the closer the peer to the receiver, the higher its position in the list. If the current route is not an agent DPP route, this field displays (null). |
# Display statistics about DPP routes.
<Sysname> display bgp ipv6 savnet dpp statistics
Total number of SAVNET routes: 3
Total number of routes from all peers: 3
Route distinguisher: 3.4.5.6:0
Total number of routes: 3
Table 3 Command output
|
Field |
Description |
|
Total number of SAVNET routes |
Total number of SAVNET routes for all route distinguishers. |
|
Total number of routes from all peers |
Total number of SAVNET routes received from all BGP IPv6 SAVNET peers. |
|
Route distinguisher |
Information of the DPP routes with the specified route distinguisher. |
|
Total number of routes |
Total number of DPP routes with the specified routing distinguisher. |
Related commands
import-route (Layer 3—IP Routing Command Reference)
display bgp ipv6 savnet prefix
Use display bgp ipv6 savnet prefix to display destination prefixes that can form DPP routes.
Syntax
display bgp [ instance instance-name ] ipv6 savnet prefix [ ipv6-address prefix-length ]
display bgp [ instance instance-name ] ipv6 savnet prefix time-range min-time max-time
Views
Any view
Predefined user roles
network-admin
network-operator
Parameters
instance instance-name: Specifies a BGP instance by its name, a case-sensitive string of 1 to 31 characters. If you do not specify this option, the command displays information about the default instance.
ipv6-address prefix-length: Displays brief information about the destination prefix that exactly matches the specified destination network address and prefix length. The prefix-length argument specifies a prefix length in the range of 0 to 128. If you do not specify this option, the command displays information about all destination prefixes.
time-range min-time max-time: Displays destination prefixes that have existed for a time period in the specified time period range since the last update. The min-time and max-time arguments represent the minimum and maximum time periods, respectively, and are in <0-10000>d<0-23>h<0-59>m<0-59>s format. The d, h, m, and s letters represent days, hours, minutes, and seconds, respectively. <0-10000>, <0-23>, <0-59>, and <0-59> represent the value ranges for d, h, m, and s, respectively. The value for the max-time argument must be greater than that for the min-time argument.
Usage guidelines
This command displays the destination prefix information that is imported from the IP routing table and can form DPP routes.
Examples
# Display brief information about all destination prefixes that can form DPP routes.
<Sysname> display bgp ipv6 savnet prefix
Total number of routes: 1
BGP local router ID is 8.5.6.7
Status codes: * - valid, > - best, d - dampened, h - history,
s - suppressed, S - stale, i - internal, e - external
a - additional-path
Origin: i - IGP, e - EGP, ? - incomplete
* > Network : 10:: PrefixLen : 64
# Display brief information about all destination prefixes that can form DPP routes and whose duration since the last update is within a specified time range.
<Sysname> display bgp ipv6 savnet prefix time-range 1d1h1m1s 7d3h1m1s
Total number of routes: 1
BGP local router ID is 8.5.6.7
Status codes: * - valid, > - best, d - dampened, h - history,
s - suppressed, S - stale, i - internal, e - external
a - additional-path
Origin: i - IGP, e - EGP, ? - incomplete
* > Network : 10:: PrefixLen : 64
Route age: 06d01h12m44s
Table 4 Command output
|
Field |
Description |
|
Total number of routes |
Total number of destination prefix routes. |
|
BGP local router ID |
Locally configured router ID of the device. |
|
Status codes |
Route state code. This field is meaningless for destination prefix information. |
|
Origin |
Origin of the route information. This field is meaningless for destination prefix information. |
|
Network |
Destination network address. |
|
PrefixLen |
Prefix length of the destination network address. |
|
Route age |
Time elapsed since the last update of the destination prefix, in <0-10000>d<0-23>h<0-59>m<0-59>s format. d, h, m, and s represent days, hours, minutes, and seconds, respectively. <0-10000>, <0-23>, <0-59>, and <0-59> represent the value ranges for d, h, m, and s, respectively. |
# Display detailed information for destination prefix 156::1/128.
<Sysname> display bgp ipv6 savnet prefix 156::1 128
BGP local router ID: 192.168.56.12
Local AS number: 100
Paths: 2 available, 2 best
BGP routing table information of 156::1/128:
Imported route.
Original nexthop: FE80::1092:20FF:FE78:1D16
Out interface : Ten-GigabitEthernet3/1/1
Route age : 00h51m37s
OutLabel : NULL
RxPathID : 0x0
TxPathID : 0xffffffff
AS-path : (null)
Origin : incomplete
Attribute value : MED 20, pref-val 32768
State : valid, local, best
Source type : local
IP precedence : N/A
QoS local ID : N/A
Traffic index : N/A
Route type : SAVNET PREFIX
OnSavnetPeerList: Yes
Table 5 Command output
|
Field |
Description |
|
BGP local router ID |
Locally configured router ID of the device. |
|
Local AS number |
Local AS number. |
|
Route distinguisher |
Information of the DPP routes with the specified route distinguisher. |
|
Total number of routes |
Total number of DPP routes with the specified routing distinguisher. |
|
Paths |
Route number information. · Available—Number of effective routes. · best—Number of optimal routes. |
|
BGP routing table information of 156::1/128 |
Detailed information of destination prefix 156::1/128. |
|
Imported route |
Imported route. This field is meaningless for the destination prefix. |
|
Original nexthop |
Original next hop address of the route. This field is meaningless for the destination prefix. |
|
Out interface |
Name of the interface that will send the DPP route after the DPP route is generated based on the destination prefix. |
|
Route age |
Period of time since the last update of the route. |
|
OutLabel |
Outbound label value of the route. This field is meaningless for the destination prefix. |
|
RxPathID |
Add-Path ID value of the received route. This field is meaningless for the destination prefix. |
|
TxPathID |
Add-Path ID value of the sent route. This field is meaningless for the destination prefix. |
|
AS-path |
AS_PATH attribute of the route. This field is meaningless for the destination prefix. |
|
Origin |
Origin of the route information. This field is meaningless for the destination prefix. |
|
Attribute value |
BGP route attributes. This field is meaningless for the destination prefix. |
|
State |
Current state of the route. This field is meaningless for the destination prefix. |
|
Source type |
Source type of the route. This field is meaningless for the destination prefix. |
|
IP precedence |
IP precedence of the route. This field is meaningless for the destination prefix. |
|
QoS local ID |
QoS Local ID attribute of the route. This field is meaningless for the destination prefix. |
|
Traffic index |
Traffic index value, in the range of 1 to 64. This field is meaningless for the destination prefix. |
|
Route type |
Type of the SAVNET route, which is SAVNET PREFIX, indicating a destination prefix that can form a DPP route. |
|
OnSavnetPeerList |
Whether the DPP route corresponding to this prefix can be advertised to neighbors. · Yes. · No. |
display bgp ipv6 savnet sav
Use display bgp ipv6 savnet sav to display the SAVNET entries generated by the SAVNET module upon BGP notifications.
Syntax
display bgp [ instance instance-name ] ipv6 savnet sav
Views
Any view
Predefined user roles
network-admin
network-operator
Parameters
instance instance-name: Specifies a BGP instance by its name, a case-sensitive string of 1 to 31 characters. If you do not specify this option, the command displays information about the default instance.
Examples
# Display all SAVNET entries generated by BGP notification to the SAVNET module.
<Sysname> display bgp ipv6 savnet sav
Total number of routes: 1
BGP local router ID is 192.168.1.136
Status codes: * - valid, > - best, d - dampened, h - history
s - suppressed, S - stale, i - internal, e - external
a – additional-path
Origin: i - IGP, e - EGP, ? - incomplete
* >e Network : 10:: PrefixLen : 64
In-Intf : Ten-GigabitEthernet3/1/1
Table 6 Command output
|
Field |
Description |
|
Total number of routes |
Number of SAVNET entries. |
|
BGP local router ID |
Locally configured router ID of the device. |
|
Status codes |
Route state code. This field is meaningless for SAVNET entry information. |
|
Origin |
Origin of the route information. This field is meaningless for SAVNET entry information. |
|
Network |
Destination network address of the SAVNET entry. |
|
PrefixLen |
Prefix length of the destination network address of the SAVNET entry. |
|
In-Intf |
Name of the incoming interface of the SAVNET entry. |
display bgp ipv6 savnet spa
Use display bgp ipv6 savnet spa to display BGP IPv6 SAVNET Source Prefix Advertising (SPA) routing information.
Syntax
display bgp [ instance instance-name ] ipv6 savnet spa [ peer ipv6-address { advertised-routes | received-routes } [ { savnet-route route-length | savnet-prefix } [ verbose ] | statistics ] | route-distinguisher route-distinguisher [ savnet-route route-length | savnet-prefix ] | { savnet-route route-length | savnet-prefix } [ advertise-info ] | statistics ]
display bgp [ instance instance-name ] ipv6 savnet spa [ route-distinguisher route-distinguisher ] time-range min-time max-time
Views
Any view
Predefined user roles
network-admin
network-operator
Parameters
instance instance-name: Specifies a BGP instance by its name, a case-sensitive string of 1 to 31 characters. If you do not specify this option, the command displays information about the default instance.
peer ipv6-address: Displays the SPA route information advertised to or received from the specified peer. The ipv6-address argument represents the IPv6 address of a peer.
advertised-routes: Displays SPA route information advertised to the specified peer.
received-routes: Displays SPA route information received from the specified peer.
verbose: Displays detailed SAP route information. If you do not specify this keyword, the command displays brief information.
statistics: Displays statistics for SPA routes.
route-distinguisher route-distinguisher: Displays SPA routing information for the specified route distinguisher. The route-distinguisher argument represents the route distinguisher value, a string of 3 to 21 characters in the format of Router ID:0.
savnet-route route-length: Displays the advertisement information for the specified SPA route. The savnet-route argument represents the SPA route, a string of 1 to 512 characters. The route-length argument represents the length of the SPA route, in the range of 0 to 65535, in bits.
savnet-prefix: Displays advertisement information for the specified SPA route. savnet-prefix represents the SPA route in the format of savnet-route/route-length, which is a case-insensitive string of 1 to 512 characters.
advertise-info: Displays advertisement information of SPA routes.
time-range min-time max-time: Displays SPA routes that have existed for a time period in the specified time period range since the last update. The min-time and max-time arguments represent the minimum and maximum time periods, respectively, and are in <0-10000>d<0-23>h<0-59>m<0-59>s format. The d, h, m, and s letters represent days, hours, minutes, and seconds, respectively. <0-10000>, <0-23>, <0-59>, and <0-59> represent the value ranges for d, h, m, and s, respectively. The value for the max-time argument must be greater than that for the min-time argument.
Usage guidelines
Application scenarios
SPA routes are used to deliver the source prefixes that constitute the SAVNET entries in the SAVNET network.
Operating mechanism
An SPA route contains source prefix and origin router ID information. This type of route is generated by executing the import-route command in BGP IPv6 SAVNET address family view. The prefix in a generated route is a prefix imported by the import-route command, and the origin router ID in a generated route is the router ID configured locally on the device. The source prefixes and the origin router ID do not change during the route propagation process.
For a generated SPA route to be advertised to the BGP IPv6 SAVNET peer, you must configure the outgoing interface of the corresponding IP route of the SPA route as a user network interface (UNI) using the ipv6 sava protocol port-type command.
After SPA routes are generated, they will be advertised to all BGP IPv6 SAVNET peers. The SPA route recipients configured with the route reflection feature will reflect the routes.
After receiving an SPA route through the BGP IPv6 SAVNET session, the device compares the router ID in the SPA route with the locally configured router ID.
· If they are the same, the device discards the route.
· If they are different, the device saves the association between the source prefix information and the router ID in the SPA route to the local neighbor information table, and reflects the SPA route to other BGP IPv6 SAVNET peers.
Restrictions and guidelines
If you do not specify any parameters, this command displays brief information about all SPA routes.
Examples
# Display brief information about all BGP IPv6 SAVNET SPA routes.
<Sysname> display bgp ipv6 savnet spa
BGP local router ID is 3.4.5.6
Status codes: * - valid, > - best, d - dampened, h - history,
s - suppressed, S - stale, i - internal, e - external
a - additional-path
Origin: i - IGP, e - EGP, ? - incomplete
Total number of SAVNET routes: 2
Total number of routes from all peers: 2
Route distinguisher: 3.4.5.6:0
Total number of routes: 2
* > Network : [1][1][3.4.5.6][64][10::]/120
NextHop : :: LocPrf : 100
MIIG-Tag: 1 MIIG-Type : 1
MED : 0
Path/Ogn: i
* > Network : [1][1][3.4.5.6][64][100::]/120
NextHop : :: LocPrf : 100
MIIG-Tag: 0 MIIG-Type : 0
MED : 0
Path/Ogn: i
# Display brief information about all BGP IPv6 SAVNET SPA routes whose duration since the last route update are within a specified time range.
<Sysname> display bgp ipv6 savnet spa time-range 1d1h1m1s 7d3h1m1s
BGP local router ID is 3.4.5.6
Status codes: * - valid, > - best, d - dampened, h - history,
s - suppressed, S - stale, i - internal, e - external
a - additional-path
Origin: i - IGP, e - EGP, ? - incomplete
Total number of SAVNET routes: 1
Total number of routes from all peers: 1
Route distinguisher: 3.4.5.6:0
Total number of routes: 1
* > Network : [1][1][3.4.5.6][64][10::]/120
NextHop : :: LocPrf : 100
MIIG-Tag: 0 MIIG-Type : 0
MED : 0 Route age : 06d01h12m44s
Table 7 Command output
|
Field |
Description |
|
BGP local router ID |
Locally configured router ID of the device. |
|
Status codes |
Route status code: · * - valid—Valid route. · > - best—Optimal route · d - dampened—Dampened route. · h - history—History route. · s - suppressed—Suppressed route. · S - stale—Stale route. · i - internal—Internal route. · e - external—External route. · a - additional-path—Add-Path optimal route. |
|
Origin |
Origin of the route. Values include: · i - IGP—Originated in the local AS.. · e - EGP—Learned through Exterior Gateway Protocol (EGP). · ? - incomplete—Unknown origin. The origin of routes redistributed from the IGP protocol is incomplete. |
|
Total number of SAVNET routes |
Total number of SAVNET routes for all route distinguishers. |
|
Total number of routes from all peers |
Total number of SAVNET routes received from all BGP IPv6 SAVNET peers. |
|
Route distinguisher |
Information of the SPA routes with the specified route distinguisher. |
|
Total number of routes |
Total number of SPA routes with the specified route distinguisher. |
|
Network |
SPA route. The value is [1][1][origin router ID][prefix length][IPv6 prefix address]. |
|
NextHop |
Next hop IPv6 address. The value is ::. This field is meaningless for SPA routes. |
|
LocPrf |
Local preference value. |
|
MIIG-Tag |
Access tag value carried in the route. This field displays 0 if no access tag is configured. |
|
MIIG-Type |
Access tag type carried in the route. Options include: · 1—Single-homed. · 2—Complete multi-homed. This field displays 0 if no access tag is configured. |
|
MED |
Multi-Exit Discriminator (MED) attribute value. |
|
Path/Ogn |
The AS_Path attribute of the route and the ORIGIN attribute of the route information, where: · AS_PATH records all the ASs that this route has passed through, which can avoid routing loops. This field can display a maximum of 16 AS numbers, and the omitted part is represented by ellipsis (...). The omitted part can be viewed by displaying the detailed information of the route. · The ORIGIN attribute marks how this BGP route is generated. |
|
Route age |
Time elapsed since the last update of the route, in <0-10000>d<0-23>h<0-59>m<0-59>s format. d, h, m, and s represent days, hours, minutes, and seconds, respectively. <0-10000>, <0-23>, <0-59>, and <0-59> represent the value ranges for d, h, m, and s, respectively. |
# Display detailed information about SPA route [1][1][192.168.56.12][64][10::]/120.
<Sysname> display bgp ipv6 savnet spa [1][1][192.168.56.12][64][10::]/120
BGP local router ID: 8.5.6.7
Local AS number: 100
Route distinguisher: 192.168.56.12:0
Total number of routes: 1
Paths: 1 available, 1 best
BGP routing table information of [1][1][192.168.56.12][64][10::]/120:
RR-client route.
From : 100::1 (192.168.56.12)
Rely nexthop : ::
Original nexthop: ::
Route age : 15h00m59s
OutLabel : NULL
RxPathID : 0x0
TxPathID : 0x0
AS-path : (null)
Origin : incomplete
Attribute value : MED 0, localpref 100, pref-val 32768
State : valid, local, best
Source type : local
Originator : 3.3.3.3
Cluster list : 2.2.2.2
IP precedence : N/A
QoS local ID : N/A
Traffic index : N/A
Route type : SAVNET SPA
Origin routerID : 192.168.56.12
MIIG-Tag : 77
MIIG-Type : 1
MIIG-Flags : 0x1
Table 8 Command output
|
Field |
Description |
|
BGP local router ID |
Locally configured router ID of the device. |
|
Local AS number |
Local AS number. |
|
Route distinguisher |
Information of the SPA routes with the specified route distinguisher. |
|
Total number of routes |
Total number of SPA routes with the specified route distinguisher. |
|
Paths |
Route number information. · Available—Number of effective routes. · best—Number of optimal routes. |
|
BGP routing table information of [1][1][192.168.56.12][64][10::]/120 |
Detailed information of SPA route [1][1][192.168.56.12][64][10::]/120. |
|
RR-client route |
Route reflected from the route reflector. |
|
From |
IP address of the BGP peer that advertised this route. |
|
Rely nexthop |
Next hop IP address after route recursion. This field has no meaning for routes in the SAVNET address family. |
|
Original nexthop |
Original next hop address of the route, with a value of ::. |
|
Route age |
Period of time since the last update of the route. |
|
OutLabel |
Outgoing label value of the route. |
|
RxPathID |
Add-Path ID value of the received route. |
|
TxPathID |
Add-Path ID value of the sent route. |
|
AS-path |
AS_PATH attribute of the route. It records all the ASs that the route passes through, which can prevent routing loops. |
|
Origin |
Origin of the route. Values include: · igp—Originated in the local AS. · egp—Learned through Exterior Gateway Protocol (EGP). · incomplete—Unknown origin. The origin of routes redistributed from the IGP protocol is incomplete. |
|
Attribute value |
BGP route attribute information, including: · MED—MED value associated with the destination network. · localpref—Local preference value. · pref-val—Prefered value. |
|
State |
Current state of the route: · valid · Internal · External · local · best |
|
H3C is short for New H3C in English, and I am the H3C AI Assistant. |
Source type of the route. |
|
Originator |
Peer that generated this route. |
|
Cluster list |
The cluster ID list attribute of the route. |
|
IP precedence |
IP precedence in the range of 0 to 7. N/A indicates that the route does not support this field. |
|
QoS local ID |
QoS local ID in the range of 1 to 4095. N/A indicates that the route does not support this field. |
|
Traffic index |
Traffic index value, in the range of 1 to 64. N/A indicates that the route does not support this field. |
|
Route type |
Type of the SAVNET route, which is SAVNET SPA, indicating SPA route. |
|
Origin routerID |
Router ID of the origin SAVNET device that sent the route. |
|
MIIG-Tag |
Access tag value carried in the route. This field displays 0 if no access tag is configured. |
|
MIIG-Type |
Access tag type carried in the route. Options include: · 1—Single-homed. · 2—Complete multi-homed. This field displays 0 if no access tag is configured. |
|
MIIG-Flags |
Access attribute tag. Options include: · 0x1—The route prefix can be used as a source prefix. · 0x2—The route prefix can be used as a destination prefix. · 0x3—The route prefix can be used as both a source and a destination prefix. This field displays 0 if no access tag is configured. |
# Display the advertisement information of SPA route [1][1][3.4.5.6][64][10::]/120.
<Sysname> display bgp ipv6 savnet spa [1][1][3.4.5.6][64][10::]/120 advertise-info
BGP local router ID: 3.4.5.6
Local AS number: 100
Route distinguisher: 3.4.5.6:0
Total number of routes: 1
Paths: 1 best
BGP routing table information of [1][1][3.4.5.6][64][10::]/120(TxPathID:0):
Advertised to peers (1 in total):
100::2
Table 9 Command output
|
Field |
Description |
|
BGP local router ID |
Locally configured router ID of the device. |
|
Local AS number |
Local AS number. |
|
Route distinguisher |
Information of the SPA routes with the specified route distinguisher. |
|
Total number of routes |
Total number of SPA routes with the specified routing distinguisher. |
|
Paths |
Number of optimal routes. |
|
BGP routing table information of [1][1][3.4.5.6][64][10::]/120(TxPathID:0) |
SPA route advertisement information. |
|
Advertised to peers (1 in total) |
Peers to which the route has been sent and total number of the peers. |
# Display statistics about the SPA routes advertised to peer 1::1.
<Sysname> display bgp ipv6 savnet spa peer 1::1 advertised-routes statistics
Advertised routes total: 1
# Display statistics about the SPA routes received from peer 1::1.
<Sysname> display bgp ipv6 savnet spa peer 1::1 received-routes statistics
Received routes total: 1
Table 10 Command output
|
Field |
Description |
|
Advertised routes total |
Total number of SPA routes advertised to the peer. |
|
Received routes total |
Total number of SPA routes received from the peer. |
# Display statistics about SPA routes.
<Sysname> display bgp ipv6 savnet spa statistics
Total number of SAVNET routes: 2
Total number of routes from all peers: 2
Route distinguisher: 3.4.5.6:0
Total number of routes: 2
Table 11 Command output
|
Field |
Description |
|
Total number of SAVNET routes |
Total number of SAVNET routes for all route distinguishers. |
|
Total number of routes from all peers |
Total number of SAVNET routes received from all BGP IPv6 SAVNET peers. |
|
Route distinguisher |
Information of the SPA routes with the specified route distinguisher. |
|
Total number of routes |
Total number of SPA routes with the specified routing distinguisher. |
Related commands
import-route (Layer 3—IP Routing Command Reference)
display ipv6 savnet entry
Use display ipv6 savnet entry to display SAVNET entry information.
Syntax
In standalone mode:
display ipv6 savnet entry [ [ interface interface-type interface-number ] [ slot slot-number ] | vpn-instance vpn-instance-name ]
In IRF mode:
display ipv6 savnet entry [ [ interface interface-type interface-number ] [ chassis chassis-number slot slot-number ] | vpn-instance vpn-instance-name ]
Views
Any view
Predefined user roles
network-admin
network-operator
Parameters
interface interface-type interface-number: Specifies an interface by its type and number. If you do not specify this option, the command displays SAVNET entries for all interfaces.
vpn-instance vpn-instance-name: Specifies the MPLS L3VPN instance to which the interface belongs. The vpn-instance-name argument represents the VPN instance name, a case-sensitive string of 1 to 31 characters. If you do not specify this option, the public network is specified.
slot slot-number: Specifies a card by its slot number. If you do not specify a card, this command displays SAVNET entries on the active MPU. (In standalone mode.)
chassis chassis-number slot slot-number: Specifies a card on an IRF member device. The chassis-number argument represents the member ID of the IRF member device. The slot-number argument represents the slot number of the card. If you do not specify a card, this command displays SAVNET entries on the global active MPU. (In IRF mode.)
Examples
# Display SAVNET entry information for all interfaces in the public network.
<Sysname> display ipv6 savnet entry
IPv6 savnet entry count: 4
Destination/Prefix length Type Interface VPN instance
2::9/128 BGP XGE3/1/1 --
11:12::/64 Static XGE3/1/2 --
2002::/64 Static XGE3/1/2 --
2003::2/128 Static XGE3/1/3 --
Table 12 Command output
|
Field |
Description |
|
IPv6 savnet entry count |
Number of SAVNET entries. |
|
Destination/Prefix length |
IPv6 source prefix/prefix length. |
|
Type |
SAVNET entry type, including: · BGP—Entries dynamically generated via BGP. · Static—Entries manually deployed by using the ipv6 savnet entry command. |
|
Interface |
Interface name. |
|
VPN instance |
Name of the VPN Instance to which the SAVNET entry belongs. If the SAVNET entry belongs to the public network, this field displays two hyphens (--). |
display ipv6 savnet packet-drop statistics
Use display ipv6 savnet packet-drop statistics to display SAVNET packet drop statistics.
Syntax
display ipv6 savnet packet-drop statistics [ interface interface-type interface-number ]
Views
Any view
Predefined user roles
network-admin
network-operator
Parameters
interface interface-type interface-number: Specifies an interface by its type and number. If you do not specify this option, the command displays statistics about SAVNET-dropped packets on all interfaces.
Examples
# Display SAVNET packet drop statistics.
<Sysname> display ipv6 savnet packet-drop statistics
Ten-GigabitEthernet3/1/1:
Packets:0 Bytes: 0
Ten-GigabitEthernet3/1/2:
Packets:10 Bytes: 1500
Table 13 Command output
|
Field |
Description |
|
Packets |
Number of packets dropped by SAVNET. |
|
Bytes |
Number of bytes dropped by SAVNET. |
Related commands
reset ipv6 savnet packet-drop statistics
ipv6 savnet entry
Use ipv6 savnet entry to manually deploy SAVNET entries.
Use undo ipv6 savnet entry to delete manually deployed SAVNET entries.
Syntax
ipv6 savnet entry prefix ipv6-address prefix-length
undo ipv6 savnet entry prefix ipv6-address prefix-length
Default
No manually deployed SAVNET entries exist.
Views
Interface view
Predefined user roles
network-admin
Parameters
prefix ipv6-address prefix-length: Specifies the prefix address and prefix length for the SAVNET entry or the first SAVNET entry. The value range for the prefix-length argument is 1 to 128.
Usage guidelines
Before manually deploying SAVNET entries on an interface, you must first configure the SAVNET access tag for the interface.
Examples
# Manually deploy SAVNET entries.
<Sysname> system-view
[Sysname] interface ten-gigabitethernet 3/1/1
[Sysname-Ten-GigabitEthernet3/1/1] ipv6 savnet entry prefix 1:1::1:1 10
ipv6 savnet log enable spoofing-packet
Use ipv6 savnet log enable spoofing-packet to enable SAVNET logging.
Use undo ipv6 savnet log enable spoofing-packet to disable SAVNET logging.
Syntax
ipv6 savnet log enable spoofing-packet [ interval interval | number number ] *
undo ipv6 savnet log enable spoofing-packet
Default
SAVNET logging is disabled.
Views
System view
Predefined user roles
network-admin
Parameters
interval interval: Specifies the interval for outputting SAVNET log messages. The value range of the interval is 0 and 5 to 3600, in seconds. The default value is 60. When the interval value is 0, it means that the device will output a log message immediately when a spoofed packet is detected by SAVNET.
number number: Specifies the maximum number of log messages that can be output in each output interval. The value range is 1 to 128, and the default value is 128.
Usage guidelines
Operating mechanism
The SAVNET logging feature facilitates troubleshooting. When SAVNET detects a spoofed packet, the device will generate a log message (referred to as SAVNET log message). The generated log messages are sent to the information center, which specifies the log message output rules and destinations. For more information about the information center, see Network Management and Monitoring Configuration Guide.
Recommended configuration
When the device outputs a large amount of SAVNET detection log messages, it will reduce device performance and affect log viewing and troubleshooting. You can perform the following tasks as needed:
· Disable SAVNET logging.
· Increase the SAVNET log output interval to reduce the output frequency.
· Decrease the number of log messages that can be output in each interval. The exceeding log messages will not be displayed.
Restrictions and guidelines
(In standalone mode.) (In IRF mode.) A card can output a maximum of 128 SAVNET log messages each time.
Examples
# Enable logging for SAVNET detection of spoofed packets.
<Sysname> system-view
[Sysname] ipv6 savnet log enable spoofing-packet interval 10 number 20
Related commands
ipv6 savnet port-type
ipv6 savnet miig-tag
Use ipv6 savnet miig-tag to configure an SAVNET access tag for an interface.
Use undo ipv6 savnet miig-tag to delete the SAVNET access tag configured on an interface.
Syntax
ipv6 savnet miig-tag tag-value { single-homed | complete-multi-homed }
undo ipv6 savnet miig-tag tag-value { single-homed | complete-multi-homed }
Default
No SAVNET access tag is configured on an interface.
Views
Interface view
Predefined user roles
network-admin
Parameters
tag-value: Specifies a tag value, an integer in the range of 1 to 4294967295.
{ single-homed | complete-multi-homed }: Specifies an access type. The single-homed keyword indicates single-homed, and the complete-multi-homed keyword indicates complete multi-homed.
Usage guidelines
Application scenarios
By default, a SAVNET device generate SAVNET entries only when it receives DPP routes. Because generation of DPP routes requires existence of non-direct entries or PBR in the FIB, DPP routes are often only generated on backbone network devices deployed with SAVNET. As shown in Figure 1, CE devices connected to the PE devices at the edge of the backbone network cannot generate DPP routes. Thus, the PE devices cannot generate SAVNET entries containing interfaces connected to the access subnets.
Figure 1 SAVNET access scenarios
A mechanism has been developed to configure SAVNET devices to generate SAVNET entries using only SPA routes, helping PE devices in the access scenarios filter source address spoofed packets. This mechanism supports both single-homed and multi-homed access scenarios.
Operating mechanism
In an access scenario, after you configure an access tag for the user-side interface on a PE, the tag information can be carried in the SPA route. Based on the carried access tag information, the PE device can generate a SAVNET entry. The specific operating mechanism is as follows:
1. After you execute the ipv6 savnet miig-tag command on the user-side interface of the PE, this interface is configured with an access tag, including the access tag value and access type information.
2. When you execute the import-route command to import a route for obtaining source prefix information and generating an SPA route, the generated SPA route carries the access tag information (including tag value and access type) if all of the following conditions are met:
¡ You have specified the route-policy route-policy-name option in the import-route command.
¡ You have configured the apply tag command for the route policy specified by the route-policy route-policy-name option.
The tag value is that specified by the apply tag command and the access type is that specified by the ipv6 savnet miig-tag command.
3. When the PE device generates or receives the SPA route carrying the access tag information, it checks whether an interface with access tag information matching that carried in the SPA route exists locally:
¡ If an interface exists, the device generates a SAVNET entry with the source prefix as that carried in the SPA route and the incoming interface as this interface.
¡ If no interface exists, the device does not generate a SAVNET entry.
4. When the device receives an updated SPA route, the SAVNET entry generated based on the SPA route will be updated.
Restrictions and guidelines
If you have configured the same access tag value for different interfaces, you must also configure the same access type for the interfaces.
Before configuring the access tag information for an interface, you must first specify the SAVNET interface type of that interface. Before using the ipv6 savnet port-type command to restore the SAVNET interface type setting of an interface, delete the access tag information configured for that interface.
If an SPA route carrying tag information is generated, it can be advertised directly. You do not need to configure the outgoing interface of the corresponding IP route as a UNI.
Examples
# Configure an SAVNET access tag with tag value 100 and access type complete multi-homed for interface Ten-GigabitEthernet 3/1/1.
<Sysname> system-view
[Sysname] interface ten-gigabitethernet 3/1/1
[Sysname-Ten-GigabitEthernet3/1/1] ipv6 savnet miig-tag 100 complete-multi-homed
Related commands
apply tag (Layer 3—IP Routing Command Reference)
import-route (Layer 3—IP Routing Command Reference)
ipv6 savnet packet-drop enable
Use ipv6 savnet packet-drop enable to enable dropping of SAVNET-detected spoofed packets.
Use undo ipv6 savnet packet-drop enable to disable dropping of SAVNET-detected spoofed packets.
Syntax
ipv6 savnet packet-drop enable
undo ipv6 savnet packet-drop enable
Default
Dropping of SAVNET-detected spoofed packets is enabled.
Views
System view
Predefined user roles
network-admin
Usage guidelines
Application scenarios
SAVNET entries are generated based on routes in the BGP IPv6 SAVNET address family view. When a large number of BGP routes exist on a SAVNET device, the device takes a long time to complete creation of all SAVNET entries. Before SAVNET entry creation completes, some valid IPv6 packets might be incorrectly dropped because the corresponding SAVNET entries have not been generated.
To resolve this issue, you can use the undo ipv6 savnet packet-drop enable command to disable dropping of SAVNET-detected spoofed packets during the SAVNET entry generation period. Thus, the SAVNET device will not drop packets that have no matching SAVNET entries, reducing incorrect dropping of valid packets. When all SAVNET entries are created, you can use the ipv6 savnet packet-drop enable command to enable dropping of SAVNET-detected spoofed packets.
Examples
# Disable dropping of SAVNET-detected spoofed packets.
<Sysname> system-view
[Sysname] undo ipv6 savnet packet-drop enable
ipv6 savnet port-type
Use ipv6 savnet port-type to specify the SAVNET interface type.
Use undo ipv6 savnet port-type to restore the default.
Syntax
ipv6 savnet port-type { nni | uni }
undo ipv6 savnet port-type
Default
No SAVNET interface type is configured.
Views
Interface view
Predefined user roles
network-admin
Parameters
nni: Specifies the network-to-network interface (NNI) type.
uni: Specifies the user network interface (UNI) type.
Usage guidelines
After SAVNET entries are generated on the SAVNET devices through the BGP SPA and DPP routing protocols, the interfaces connected between the SAVNET neighbors need to be configured as NNI interfaces in order for the SAVNET entries to take effect.
SPA routes are used to deliver the source prefixes that constitute the SAVNET entries in the SAVNET network, including the source prefixes and the origin router ID information. This type of route is generated by executing the import-route command in BGP IPv6 SAVNET address family view. The prefixes in the generated routes are the ones imported by the import-route command, and the origin router ID of a generated route is the router ID locally configured for the device. If the outgoing interface of an import route is the UNI interface specified by this command, the SPA route generated based on the import route can be advertised to the BGP IPv6 SAVNET peer.
After the SAVNET interface type is configured on an interface, do not enable the SAVA feature on the interface. For more information about SAVA configuration, see Security Configuration Guide.
This feature is supported on only Layer 3 Ethernet interfaces, Layer 3 Ethernet subinterfaces, Layer 3 aggregate interfaces, Layer 3 aggregate subinterfaces, VLAN interfaces, and FlexE interfaces.
Examples
# Configure the SAVNET interface type of interface Ten-GigabitEthernet 3/1/1 as NNI.
<Sysname> system-view
[Sysname] interface ten-gigabitethernet 3/1/1
[Sysname-Ten-GigabitEthernet3/1/1] ipv6 savnet port-type nni
Related commands
display ipv6 savnet entry
reset ipv6 savnet packet-drop statistics
Use reset ipv6 savnet packet-drop statistics to clear SAVNET packet drop statistics.
Syntax
reset ipv6 savnet packet-drop statistics [ interface interface-type interface-number ]
Views
User view
Predefined user roles
network-admin
Parameters
interface interface-type interface-number: Specifies an interface by its type and number. If you do not specify this option, the command clears statistics about SAVNET-dropped packets on all interfaces.
Examples
# Clear the SAVNET packet drop statistics on all interfaces.
<Sysname> reset ipv6 savnet packet-drop statistics
Related commands
display ipv6 savnet packet-drop statistics
savnet-entry expire-time
Use savnet-entry expire-time to set the SAVNET entry aging time.
Use undo savnet-entry expire-time to restore the default.
Syntax
savnet-entry expire-time time
undo savnet-entry expire-time
Default
The SAVNET entry aging time is 7200 seconds.
Views
BGP IPv6 SAVNET address family view
Predefined user roles
network-admin
Parameters
time: Sets a SAVNET entry aging time, in the value range of 60 to 172800 seconds.
Usage guidelines
Operating mechanism
To avoid traffic forwarding issues caused by retention of outdated SAVNET entries after the network topology changes, you can configure this command. SAVNET entries generated through BGP use the specified aging time and are maintained or updated through continuous reception of DPP routes. Entries that are not maintained or updated because no DPP routes are received before the aging timer expires will age out.
Restrictions and guidelines
As a best practice, configure the SAVNET entry aging time to be at least twice the DPP route sending interval configured on the route generating device. Otherwise, SAVNET entries might age out incorrectly because of long DPP route sending interval.
Examples
# Set the SAVNET entry aging time to 100 seconds.
<Sysname> system-view
[Sysname] bgp 100
[Sysname-bgp-default] address-family ipv6 savnet
[Sysname-bgp-default-savnet-ipv6] savnet-entry expire-time 100
Make sure the SAVNET entry aging time is at least twice the DPP route sending interval configured on the DPP routes’ source device. Continue? [y/n]
