Non-default vSystems do not support some of the Layer 2 forwarding commands. For information about vSystem support for a command, see the usage guidelines on that command. For information about vSystem, see Virtual Technologies Configuration Guide.

Normal Layer 2 forwarding commands

display mac-forwarding statistics

Use display mac-forwarding statistics to display Layer 2 forwarding statistics.

Syntax

display mac-forwarding statistics [ interface interface-type interface-number ]

Views

Any view

Predefined user roles

network-admin

network-operator

context-admin

context-operator

vsys-admin

vsys-operator

Parameters

interface interface-type interface-number: Specifies an interface by its type and number. If you do not specify this option, the command displays Layer 2 forwarding statistics on all interfaces.

Examples

# Display Layer 2 forwarding statistics on all interfaces.

<Sysname> display mac-forwarding statistics

Input:

Sum: 888 Unknown Unicast: 0

Broadcast: 0 Multicast: 0

Filtered: 0 STP discarded: 0

Service dropped: 0 Source dropped: 0

Unknown dropped: 0 Learning dropped: 0

Blackhole dropped: 0 Suppress dropped: 0

Source MAC dropped:0

Deliver:

Sum: 111 L2 protocol: 11

Local MAC address: 100

Output:

Sum: 666 Filtered: 0

Blackhole dropped: 0 STP discarded: 0

Service dropped: 0 Dest MAC dropped: 0

# Display Layer 2 forwarding statistics on GigabitEthernet 1/0/1.

<Sysname> display mac-forwarding statistics interface gigabitethernet 1/0/1

GigabitEthernet1/0/1:

Input frames: 100 Output frames:100

Filtered: 0

Table 1 Command output

Field	Description
Input	Inbound Ethernet frame statistics. · Sum—Total number of received Ethernet frames. · Filtered—Number of Ethernet frames filtered out by 802.1Q VLAN inbound filtering rules. · STP discarded—Number of inbound Ethernet frames dropped on the ports blocked by STP. · Service dropped—Number of Ethernet frames dropped by inbound service features. · Source dropped—Number of Ethernet frames dropped because their source MAC addresses are all-zeros, multicast, or broadcast MAC addresses. · Unknown dropped—Number of Ethernet frames dropped because the device is disabled from forwarding frames with unknown source MAC addresses. · Learning dropped—Number of Ethernet frames dropped because the device is disabled from forwarding unknown frames after the number of learned MAC addresses reaches the upper limit. · Suppress dropped—Number of Ethernet frames dropped by storm suppression. · Broadcast—Number of received broadcast Ethernet frames. · Multicast—Number of received multicast Ethernet frames. · Unknown unicast—Number of received unknown unicast Ethernet frames. · Blackhole dropped—Number of Ethernet frames dropped because they are sourced from blackhole MAC addresses. · Source MAC dropped—Number of Ethernet frames dropped by features based on the source MAC addresses.
Deliver	Statistics of Ethernet frames delivered to the CPU. · Sum—Total number of Ethernet frames delivered to the CPU. · L2 protocol—Number of Layer 2 protocol Ethernet frames delivered to the CPU. · Local MAC address—Number of Ethernet frames that use the MAC addresses of local Layer 3 VLAN interfaces as the destination MAC addresses.
Output	Outbound Ethernet frame statistics. · Sum—Total number of sent Ethernet frames. · Filtered—Number of Ethernet frames filtered out by 802.1Q VLAN outbound filtering rules. · Blackhole dropped—Number of Ethernet frames dropped because they are destined for blackhole MAC addresses. · STP discarded—Number of outbound Ethernet frames dropped on the ports blocked by STP. · Service dropped—Number of Ethernet frames dropped by outbound service features. · Dest MAC dropped—Number of Ethernet frames dropped by features based on the destination MAC addresses.
GigabitEthernet1/0/1	Layer 2 forwarding statistics on GigabitEthernet 1/0/1: · Input frames—Number of Ethernet frames received on the interface. · Output frames—Number of Ethernet frames sent out of the interface. · Filtered—Number of Ethernet frames filtered out because they are from other VLANs.

reset mac-forwarding statistics

Use reset mac-forwarding statistics to clear Layer 2 forwarding statistics.

Syntax

reset mac-forwarding statistics

Views

User view

Predefined user roles

network-admin

network-operator

context-admin

context-operator

vsys-admin

vsys-operator

Examples

# Clear Layer 2 forwarding statistics.

<Sysname> reset mac-forwarding statistics

Fast Layer 2 forwarding commands

display mac-forwarding cache ip

Use display mac-forwarding cache ip to display IPv4 fast forwarding entries.

Syntax

In standalone mode:

display mac-forwarding cache ip [ ip-address ] [ slot slot-number [ cpu cpu-number ] ]

In IRF mode:

display mac-forwarding cache ip [ ip-address ] [ chassis chassis-number slot slot-number [ cpu cpu-number ] ]

Views

Any view

Predefined user roles

network-admin

network-operator

context-admin

context-operator

vsys-admin

vsys-operator

Parameters

ip-address: Specifies an IPv4 address. If you do not specify an IPv4 address, this command displays all IPv4 fast forwarding entries.

slot slot-number: Specifies a card by its slot number. If you do not specify a card, this command displays IPv4 fast forwarding entries for all cards. (In standalone mode.)

chassis chassis-number slot slot-number: Specifies a card on an IRF member device. The chassis-number argument represents the member ID of the IRF member device. The slot-number argument represents the slot number of the card. If you do not specify a card, this command displays IPv4 fast forwarding entries for all cards. (In IRF mode.)

cpu cpu-number: Specifies a CPU by its number. This option is available only if multiple CPUs are available on the specified slot.

Examples

# Display all IPv4 fast forwarding entries.

<Sysname> display mac-forwarding cache ip

Total number of mac-forwarding entries: 2

SIP SPort DIP DPort Pro Input_If Output_If VLAN

1.1.1.2 99 1.1.1.1 2048 1 GE1/0/1 GE1/0/2 2

1.1.1.1 98 1.1.1.2 2012 1 GE1/0/2 GE1/0/1 2

Table 2 Command output

Field	Description
Total number of mac-forwarding entries	Total number of IPv4 fast forwarding entries.
SIP	Source IPv4 address.
SPort	Source port number.
DIP	Destination IPv4 address.
DPort	Destination port number.
Pro	Protocol number.
Input_If	Input interface type and number. If no input interface is involved in fast forwarding, this field displays N/A. If no input interface is available, this field displays a hyphen (-).
Output_If	Output interface type and number. If no output interface is involved in fast forwarding, this field displays N/A. If no output interface is available, this field displays a hyphen (-).
VLAN	VLAN ID.

display mac-forwarding cache ip fragment

Use display mac-forwarding cache ip fragment to display IPv4 fast forwarding entries for fragments.

Syntax

In standalone mode:

display mac-forwarding cache ip fragment [ ip-address ] [ slot slot-number [ cpu cpu-number ] ]

In IRF mode:

display mac-forwarding cache ip fragment [ ip-address ] [ chassis chassis-number slot slot-number [ cpu cpu-number ] ]

Views

Any view

Predefined user roles

network-admin

network-operator

context-admin

context-operator

vsys-admin

vsys-operator

Parameters

ip-address: Specifies an IPv4 address. If you do not specify an IPv4 address, this command displays IPv4 fast forwarding entries for all fragments.

slot slot-number: Specifies a card by its slot number. If you do not specify a card, this command displays IPv4 fast forwarding entries for fragments on all cards. (In standalone mode.)

cpu cpu-number: Specifies a CPU by its number. This option is available only if multiple CPUs are available on the specified slot.

Examples

# Display IPv4 fast forwarding entries for all fragments.

<Sysname> display mac-forwarding cache ip fragment

Total number of fragment mac-forwarding entries: 2

SIP SPort DIP DPort Pro Input_If ID VLAN

1.1.1.1 117 1.1.1.2 0 1 GE1/0/1 2828 1

1.1.1.2 110 1.1.1.1 67 17 GE1/0/2 2322 1

Table 3 Command output

Field	Description
Total number of fragment mac-forwarding entries	Total number of IPv4 fast forwarding entries for fragments.
SIP	Source IPv4 address.
SPort	Source port number.
DIP	Destination IPv4 address.
DPort	Destination port number.
Pro	Protocol number.
Input_If	Input interface type and number. If no input interface is involved in fast forwarding, this field displays N/A. If no input interface is available, this field displays a hyphen (-).
ID	Fragment ID.
VLAN	VLAN ID.

display mac-forwarding cache ipv6

Use display mac-forwarding cache ipv6 to display IPv6 fast forwarding entries.

Syntax

In standalone mode:

display mac-forwarding cache ipv6 [ ipv6-address ] [ slot slot-number [ cpu cpu-number ] ]

In IRF mode:

display mac-forwarding cache ipv6 [ ipv6-address ] [ chassis chassis-number slot slot-number [ cpu cpu-number ] ]

Views

Any view

Predefined user roles

network-admin

network-operator

context-admin

context-operator

vsys-admin

vsys-operator

Parameters

ipv6-address: Specifies an IPv6 address. If you do not specify an IPv6 address, this command displays all IPv6 fast forwarding entries.

slot slot-number: Specifies a card by its slot number. If you do not specify a card, this command displays IPv6 fast forwarding entries for all cards. (In standalone mode.)

chassis chassis-number slot slot-number: Specifies a card on an IRF member device. The chassis-number argument represents the member ID of the IRF member device. The slot-number argument represents the slot number of the card. If you do not specify a card, this command displays IPv6 fast forwarding entries for all cards. (In IRF mode.)

cpu cpu-number: Specifies a CPU by its number. This option is available only if multiple CPUs are available on the specified slot.

Examples

# Display all IPv6 fast forwarding entries.

<Sysname> display mac-forwarding cache ipv6

Total number of IPv6 mac-forwarding items: 1

Src IP: 2002::1 Src port: 129

Dst IP: 2001::1 Dst port: 65535

VLAN ID: 2

Protocol: 2

Input interface: GE1/0/2

Output interface: GE1/0/1

Table 4 Command output

Field	Description
Total number of IPv6 mac-forwarding items	Total number of IPv6 fast forwarding entries.
Src IP	Source IPv6 address.
Src port	Source port number.
Dst IP	Destination IPv6 address.
Dst Port	Destination port number.
Protocol	Protocol number.
Input interface	Input interface type and number. If no input interface is involved in fast forwarding, this field displays N/A. If no input interface is available, this field displays a hyphen (-).
Output interface	Output interface type and number. If no output interface is involved in fast forwarding, this field displays N/A. If no output interface is available, this field displays a hyphen (-).

‌

mac fast-forwarding check-vlan-id

Use mac fast-forwarding check-vlan-id to enable VLAN ID check for fast Layer 2 forwarding.

Use undo mac fast-forwarding check-vlan-id to disable VLAN ID check for fast Layer 2 forwarding.

Syntax

mac fast-forwarding check-vlan-id

undo mac fast-forwarding check-vlan-id

Default

VLAN ID check is enabled for fast Layer 2 forwarding.

Views

System view

Predefined user roles

network-admin

context-admin

Usage guidelines

Non-default vSystems do not support this command.

This feature allows the device to check whether the VLAN ID of a flow matches that of any fast forwarding entry. If no match is found, the flow does not match any fast forwarding entry.

The VLAN ID of a packet helps the device to determine the TCP session to which the packet belongs. On a hot backup system formed by two firewalls, you must disable VLAN ID check if the traffic incoming interfaces on the primary and secondary devices belong to different VLANs. If you enable VLAN ID check, traffic cannot match session entries correctly when asymmetric-path traffic exists.

Examples

# Enable VLAN ID check for fast Layer 2 forwarding.

<Sysname> system-view

[Sysname] mac fast-forwarding check-vlan-id

Bridge forwarding commands

add interface

Use add interface to add an interface to a reflect-type, forward-type, or blackhole-type bridge instance.

Use undo add interface to remove an interface from a reflect-type, forward-type, or blackhole-type bridge instance.

Syntax

add interface interface-type interface-number

undo add interface interface-type interface-number

Default

No interfaces exist in a reflect-type, forward-type, or blackhole-type bridge instance.

Views

Reflect-type bridge view

Forward-type bridge view

Blackhole-type bridge view

Predefined user roles

network-admin

context-admin

Parameters

interface-type interface-number: Specifies an interface by its type and number.

Usage guidelines

Non-default vSystems do not support this command.

You can add only Layer 2 physical interfaces, Layer 3 physical interfaces, or Layer 2 aggregate interfaces to reflect-type, forward-type, or blackhole-type bridge instances.

Only one interface can be added to a reflect-type or blackhole-type bridge instance.

Only two interfaces can be added to a manually created forward-type bridge instance. The two interfaces must be the same type.

Each interface can be added to only one bridge instance.

This command is not available for a forward-type bridge instance that is automatically created upon insertion of a hardware bypass subcard. An automatically created forward-type bridge instance uses the pair of interfaces on the bypass subcard by default and you cannot edit the interfaces in the instance.

If you execute this command multiple times in reflect-type or blackhole-type bridge view, the most recent configuration takes effect.

If you execute this command multiple times in forward-type bridge view, the most recent two configurations take effect.

If an interface has subinterfaces, you cannot add the interface to a bridge instance. If you create subinterfaces on an interface in a bridge instance, you cannot remove the interface from the bridge instance.

Examples

# Add GigabitEthernet 1/0/1 to reflect-type bridge instance 1.

<Sysname> system-view

[Sysname] bridge 1 reflect

[Sysname-bridge1-reflect] add interface gigabitethernet 1/0/1

bridge

Use bridge to create a specific type of bridge instance and enter its view, or enter the view of an existing bridge instance.

Use undo bridge to delete bridge instances.

Syntax

bridge bridge-index [ blackhole | forward | reflect ]

undo bridge { bridge-index | all }

Default

No bridge instances exist.

Views

System view

Predefined user roles

network-admin

context-admin

Parameters

bridge-index: Specifies a bridge instance index. The value range for a manually created bridge instance is 1 to 128. For an automatically created forward-type bridge instance, the system will assign an index in the range of 32768 to 1082400.

blackhole: Specifies a blackhole-type bridge instance.

forward: Specifies a forward-type bridge instance.

reflect: Specifies a reflect-type bridge instance.

all: Deletes all bridge instances.

Usage guidelines

Non-default vSystems do not support this command.

Use this command to create a bridge instance. You can create reflect-type, forward-type, and blackhole-type bridge instances for inline forwarding.

When you create a bridge instance, you must specify its type. You can specify only one type for a bridge instance.

The device will automatically create a forward-type bridge instance upon insertion of a hardware bypass subcard. The automatically created forward-type bridge instance uses the pair of interfaces on the bypass subcard by default. You cannot edit the interfaces in the bridge instance or delete the bridge instance.

Examples

# Create blackhole-type bridge instance 1 and enter its view.

<Sysname> system-view

[Sysname] bridge 1 blackhole

[Sysname-bridge1-blackhole]

# Create forward-type bridge instance 2 and enter its view.

<Sysname> system-view

[Sysname] bridge 2 forward

[Sysname-bridge2-forward]

# Create reflect-type bridge instance 4 and enter its view.

<Sysname> system-view

[Sysname] bridge 4 reflect

[Sysname-bridge4-reflect]

bridge tunnel-encapsulation skip

Use bridge tunnel-encapsulation skip to configure the device to ignore the tunnel encapsulation when forwarding tunneled packets in inline mode.

Use undo bridge tunnel-encapsulation skip to restore the default.

Syntax

bridge tunnel-encapsulation skip

undo bridge tunnel-encapsulation skip

Default

In inline forwarding mode, tunneled packets are forwarded based on information in the tunnel encapsulation.

Views

System view

Predefined user roles

network-admin

context-admin

Usage guidelines

Non-default vSystems do not support this command.

This command takes effect only for inline forwarding.

In inline forwarding mode, tunneled packets are forwarded based on information in the tunnel encapsulation by default.

Use this command to enable the device to ignore the tunnel encapsulation and forward tunneled packets based on the original packet header information.

Examples

# Configure the device to ignore the tunnel encapsulation when forwarding tunneled packets in inline mode.

<Sysname> system-view

[Sysname] bridge tunnel-encapsulation skip

bypass enable

Use bypass enable to enable security service bypass.

Use undo bypass enable to disable security service bypass.

Syntax

bypass enable

undo bypass enable

Default

Security service bypass is disabled.

Views

Reflect-type bridge view

Forward-type bridge view

Blockhole-type bridge view

Predefined user roles

network-admin

context-admin

Usage guidelines

Non-default vSystems do not support this command.

This feature enables the device to bypass the security service and to directly process received packets according to the configured bridge forwarding mode.

If you configure the bypass enable command multiple times, the most recent configuration takes effect.

Examples

# Enable internal security service bypass.

<Sysname> system-view

[Sysname] bridge 1 forward

[Sysname-bridge-1-forward] bypass enable

Fast bridge forwarding commands

bridge fast-forwarding check-vlan-id

Use bridge fast-forwarding check-vlan-id to enable VLAN ID check for fast bridge forwarding.

Use undo bridge fast-forwarding check-vlan-id to disable VLAN ID check for fast bridge forwarding.

Syntax

bridge fast-forwarding check-vlan-id

undo bridge fast-forwarding check-vlan-id

Default

VLAN ID check is enabled for fast bridge forwarding.

Views

System view

Predefined user roles

network-admin

context-admin

Usage guidelines

Non-default vSystems do not support this command.

This feature allows the device to check whether the VLAN ID of a flow matches that of any fast forwarding entry. If no match is found, the flow does not match any fast forwarding entry.

On a hot backup system formed by two firewalls, inter-VLAN fast bridge forwarding enables a packet to match the same session after being transmitted between the primary and secondary devices. Because the device does not check VLAN IDs for inter-VLAN fast bridge forwarding. That is, this command does not take effect on inter-VLAN fast bridge forwarding.

Examples

# Enable VLAN ID check for fast bridge forwarding.

<Sysname> system-view

[Sysname] bridge fast-forwarding check-vlan-id

display bridge cache ip

Use display bridge cache ip to display IPv4 fast bridge forwarding entries.

Syntax

In standalone mode:

display bridge cache ip inline [ ip-address ] [ slot slot-number [ cpu cpu-number ] ]

In IRF mode:

display bridge cache ip inline [ ip-address ] [ chassis chassis-number slot slot-number [ cpu cpu-number ] ]

Views

Any view

Predefined user roles

network-admin

network-operator

context-admin

context-operator

Parameters

inline: Displays IPv4 inline forwarding entries.

ip-address: Specifies an IPv4 address. If you do not specify an IPv4 address, this command displays all IPv4 fast bridge forwarding entries.

slot slot-number: Specifies a card by its slot number. If you do not specify a card, this command displays IPv4 fast bridge forwarding entries for all cards. (In standalone mode.)

cpu cpu-number: Specifies a CPU by its number. This option is available only if multiple CPUs are available on the specified slot.

Usage guidelines

Non-default vSystems do not support this command.

Examples

# Display IPv4 inline fast bridge forwarding entries.

<Sysname> display bridge cache ip inline

Total number of bridge-forwarding entries: 2

SIP SPort DIP DPort Pro InVLAN OutVLAN Output_If

1.1.1.3 470 1.1.1.2 0 1 3 2 GE1/0/1

1.1.1.2 470 1.1.1.3 2048 1 2 3 GE1/0/2

Table 5 Command output

Field	Description
Total number of bridge-forwarding entries	Total number of IPv4 fast bridge forwarding entries.
SIP	Source IPv4 address.
SPort	Source port number.
DIP	Destination IPv4 address.
DPort	Destination port number.
Pro	Protocol number.
InVLAN	Input VLAN.
OutVLAN	Output VLAN.
Output_If	Output interface.

display bridge cache ip fragment

Use display bridge cache ip fragment to display IPv4 fast bridge forwarding entries for fragments.

Syntax

In standalone mode:

display bridge cache ip fragment inline [ ip-address ] [ slot slot-number [ cpu cpu-number ] ]

In IRF mode:

display bridge cache ip fragment inline [ ip-address ] [ chassis chassis-number slot slot-number [ cpu cpu-number ] ]

Views

Any view

Predefined user roles

network-admin

network-operator

context-admin

context-operator

Parameters

inline: Displays IPv4 inline forwarding entries for fragments.

ip-address: Specifies an IPv4 address. If you do not specify an IPv4 address, this command displays IPv4 fast bridge forwarding entries for all fragments.

slot slot-number: Specifies a card by its slot number. If you do not specify a card, this command displays IPv4 fast bridge forwarding entries for fragments on all cards. (In standalone mode.)

cpu cpu-number: Specifies a CPU by its number. This option is available only if multiple CPUs are available on the specified slot.

Usage guidelines

Non-default vSystems do not support this command.

Examples

# Display IPv4 inline fast bridge forwarding entries for fragments.

<Sysname> display bridge cache ip fragment inline

Total number of fragment bridge-forwarding entries: 2

SIP SPort DIP DPort Pro InVLAN ID

2.1.1.2 2320 2.1.1.1 2048 1 2 7298

2.1.1.1 2048 2.1.1.2 2320 1 3 6826

Table 6 Command output

Field	Description
Total number of fragment bridge-forwarding entries	Total number of IPv4 fast bridge forwarding entries for fragments.
SIP	Source IPv4 address.
SPort	Source port number.
DIP	Destination IPv4 address.
DPort	Destination port number.
Pro	Protocol number.
InVLAN	Input VLAN.
ID	Fragment ID.

display bridge cache ipv6

Use display bridge cache ipv6 to display IPv6 fast bridge forwarding entries.

Syntax

In standalone mode:

display bridge cache ipv6 inline [ ipv6-address ] [ slot slot-number [ cpu cpu-number ] ]

In IRF mode:

display bridge cache ipv6 inline [ ipv6-address ] [ chassis chassis-number slot slot-number [ cpu cpu-number ] ]

Views

Any view

Predefined user roles

network-admin

network-operator

context-admin

context-operator

Parameters

inline: Displays IPv6 inline forwarding entries.

ipv6-address: Specifies an IPv6 address. If you do not specify an IPv6 address, this command displays all IPv6 fast bridge forwarding entries.

slot slot-number: Specifies a card by its slot number. If you do not specify a card, this command displays IPv6 fast bridge forwarding entries for all cards. (In standalone mode.)

chassis chassis-number slot slot-number: Specifies a card on an IRF member device. The chassis-number argument represents the member ID of the IRF member device. The slot-number argument represents the slot number of the card. If you do not specify a card, this command displays IPv6 fast bridge forwarding entries for all cards. (In IRF mode.)

cpu cpu-number: Specifies a CPU by its number. This option is available only if multiple CPUs are available on the specified slot.

Usage guidelines

Non-default vSystems do not support this command.

Examples

# Display IPv6 inline fast bridge forwarding entries.

<Sysname> display bridge cache ipv6 inline

Total number of IPv6 bridge-forwarding items: 1

Src IP: 10::12 Src Port: 427

Dst IP: 10::11 Dst Port: 32768

InVLAN: 2 OutVLAN: 3

Protocol: 58

Context ID: 257

Bridge ID: 10

Output interface: GE1/0/1

Table 7 Command output

Field	Description
Total number of IPv6 bridge-forwarding items	Total number of IPv6 fast bridge forwarding entries.
Src IP	Source IPv6 address.
Src port	Source port number.
Dst IP	Destination IPv6 address.
Dst Port	Destination port number.
InVLAN	Input VLAN.
OutVLAN	Output VLAN.
Protocol	Protocol number.
Context ID	Context ID.
Output interface	Output interface type and number. If no output interface is involved in fast forwarding, this field displays N/A. If no output interface is available, this field displays a hyphen (-).

10-Layer 2—LAN Switching Command Reference

Layer 2 forwarding commands

Intelligent Terminal Products

Product Support Services

Technical Service Solutions

Resource Center

Policy

Online Help

Become a Partner

Partner Policy & Program

Global Learning

Partner Sales Resources

Service Business

News & Events

Contact Us