Contents

Microsegmentation commands· 1

display microsegment 1

member 1

microsegment 2

microsegment enable· 3

 

Microsegmentation commands

Only the S9825 switch series supports this feature.

display microsegment

Use display microsegment to display the configuration and status of microsegments.

Syntax

display microsegment [ microsegment-id | name microsegment-name ]

Views

Any view

Predefined user roles

network-admin

network-operator

Parameters

microsegment-id: Specifies a microsegment by its ID in the range of 1 to 65535.

name microsegment-name: Specifies a microsegment by its name, a case-insensitive string of 1 to 32 characters.

Usage guidelines

If you do not specify any parameters, this command displays summary information and status information about all microsegments.

Examples

# Display the configuration of microsegment 1.

<Sysname> display microsegment 1

Microsegment ID    : 1

Microsegment name  : micseg1

  IPv4 member:

    192.168.56.0/24

  IPv6 member:

    10:10::/64

# Display summary information and status information about all microsegments.

<Sysname> display microsegment

Microsegment status   : Enabled

Total microsegments   : 2

Microsegment list     :

  Microsegment ID  Members  Microsegment name

  12345            3        abc

  32789            5        xyz

member

Use member to add a member to a microsegment.

Use undo member to remove a member from a microsegment.

Syntax

member { ipv4 ipv4-address { mask | mask-length } | ipv6 ipv6-address prefix-length } [ vpn-instance vpn-instance-name ]

undo member { ipv4 ipv4-address { mask | mask-length } | ipv6 ipv6-address prefix-length } [ vpn-instance vpn-instance-name ]

Default

A microsegment does not contain members.

Views

Microsegment view

Predefined user roles

network-admin

Parameters

ipv4 ipv4-address { mask | mask-length }: Specifies a range of IPv4 addresses. The mask argument specifies a subnet mask. The mask-length argument specifies a subnet mask length in the range of 0 to 32. The endpoints that use the IPv4 addresses are added to the microsegment.

ipv6 ipv6-address prefix-length: Specifies a range of IPv6 addresses. The prefix-length argument specifies a prefix length in the range of 0 to 128. The endpoints that use the IPv6 addresses are added to the microsegment.

vpn-instance vpn-instance-name: Specifies an MPLS L3VPN instance by its name, a case-sensitive string of 1 to 31 characters. If you do not specify a VPN instance, this command adds IP addresses in the public network to the microsegment.

 

Usage guidelines

A member can belong to multiple microsegments.

You can execute this command multiple times to add multiple IP addresses or IP address ranges to a microsegment.

Examples

# Add IPv4 address 192.168.56.3 to microsegment 1 as a member.

<Sysname> system-view

[Sysname] microsegment 1

[Sysname-microsegment-1]  member ipv4 192.168.56.3 32

Related commands

display microsegment

microsegment

microsegment

Use microsegment to create a microsegment and enter its view, or enter the view of an existing microsegment.

Use undo microsegment to delete a microsegment.

Syntax

microsegment microsegment-id [ name microsegment-name ]

undo microsegment microsegment-id

Default

No microsegments exist.

Views

System view

Predefined user roles

network-admin

Parameters

microsegment-id: Specifies a microsegment ID in the range of 1 to 65535.

name microsegment-name: Specifies a microsegment name, a case-insensitive string of 1 to 32 characters. The microsegment name must be globally unique. If you do not specify a microsegment name, this command creates the microsegment without a name.

 

Usage guidelines

To modify the name of an existing microsegment, you must delete the microsegment and then re-create it with a new name.

Examples

# Create microsegment 1 with name micseg1 and enter its view.

<Sysname> system-view

[Sysname] microsegment 1 name micseg1

[Sysname-microsegment-1]

Related commands

member

microsegment enable

Use microsegment enable to enable microsegmentation.

Use undo microsegment enable to disable microsegmentation.

Syntax

microsegment enable

undo microsegment enable

Default

Microsegmentation is disabled.

Views

System view

Predefined user roles

network-admin

Usage guidelines

After you enable microsegmentation, member IP addresses and microsegment IDs are sent to the FIB. When you disable microsegmentation, the information is deleted from the FIB. The device forwards or drops an incoming packet according to the microsegment IDs of its source and destination IP addresses and the ACL and GBP configurations.

In an EVPN network, the synchronized microsegment settings directly take effect on the remote end and are not subject to this command.

 

Examples

# Enable microsegmentation.

<Sysname> system-view

[Sysname] microsegment enable

Related commands

display microsegment

member

microsegment