01-Fundamentals Configuration Guide

HomeSupportConfigure & DeployConfiguration GuidesH3C SecPath F1000[F5000] Firewalls Series Configuration Guides(V7)(R9900)-6W10001-Fundamentals Configuration Guide
06-Automatic configuration
Title Size Download
06-Automatic configuration 210.35 KB

Using automatic configuration

About automatic configuration

With the automatic configuration feature, the device can automatically obtain a set of configuration settings at startup. This feature simplifies network configuration and maintenance.

Automatic configuration can be implemented by using the implementation methods in Table 1.

Table 1 Automatic configuration implementation methods

Implementation method

Configuration file location

Application scenarios

Server-based automatic configuration

File server

A number of geographically distributed devices need to be configured.

URL-based automatic configuration

Saved on the device before the device is shipped

Devices are geographically distributed.

USB-based automatic configuration

USB disk

·     On a small network, the devices reside near to each other, and no host can be used as a file server.

·     On a large network, only a few devices require automatic configuration or configuration update.

 

Using server-based automatic configuration

About server-based automatic configuration

With server-based automatic configuration, a device without a configuration file can run the DHCP client to obtain a configuration file from a file server at startup.

 

You can deploy server-based automatic configuration on both IPv4 and IPv6 networks by using the same method. This chapter describes the tasks for deploying server-based automatic configuration on an IPv4 network.

Typical server-based automatic configuration network

As shown in Figure 1, server-based automatic configuration requires the following servers:

·     DHCP server—Allocates an IP address to the device that performs server-based automatic configuration and notifies the device of the method to obtain the configuration file or script file for automatic configuration.

·     File server—TFTP or HTTP server. The file server stores the configuration file or script file for automatic configuration.

·     (Optional.) DNS server—Obtains the configuration file name or the IP address of the file server for the device.

Figure 1 Server-based automatic configuration network diagram

 

Host name file

A host name file stores mappings between host IP addresses and host names. To configure a host name file:

1.     Create a host name file. The file name must be network.cfg.

2.     Add each mapping entry in the ip host host-name ip-address format on a separate line. For example:

ip host host1 101.101.101.101

ip host host2 101.101.101.102

ip host client1 101.101.101.103

ip host client2 101.101.101.104

 

IMPORTANT

IMPORTANT:

The host name for a device must be the same as the name of the configuration file configured for the device. For example, the name of the configuration file for the device at 101.101.101.101 is host1.cfg.

Selecting the interface used for automatic configuration

The device identifies the status of the management Ethernet interface at Layer 2. If the management Ethernet interface is up, the device uses that interface.

Operating mechanism

The process for server-based automatic configuration for a device is as follows:

1.     The device selects the interface used to obtain the configuration file or script file for automatic configuration and sends an IP request message to the DHCP server. For more information about the interface selection order, see "Selecting the interface used for automatic configuration."

2.     After the DHCP server receives the IP request message, it sends a reply message to the device. If the device does not receive any reply message within the timeout period of the request message, it selects the next interface according to the interface selection order and sends the IP request message again.

3.     The device parses the reply message.

¡     Obtains the IP address included in the reply message and uses it as the IP address for the selected interface to connect to the DHCP server. If the interface already has an IP address assigned, the device replaces the original IP address with the one included in the reply message. Once the automatic configuration process is complete, the device restores the original IP address to the interface.

¡     Obtains the protocol information (HTTP or TFTP), configuration file name information, and file server address included in the reply message.

4.     If no configuration file name is obtained or the obtained configuration file name does not meet the requirements, the device uses file network.cfg on the file server. If file network.cfg does not exist, the device uses file device.cfg on the file server. If file device.cfg does not exist, the device fails to obtain the configuration file or script file. In this case, the process returns to step 1.

5.     The device resolves the domain name of the file server. If the file server address included in the reply message is a domain name rather than an IP address, the device uses the DNS server to resolve the domain name to an IP address.

6.     The device downloads the configuration file or script file used for automatic configuration from the file server based on the obtained protocol, file server address, and configuration file name.

7.     The device deploys the configuration in the configuration file or executes the script file.

8.     The device automatically deletes the configuration file or script file.

Server-based automatic configuration tasks at a glance

To configure server-based automatic configuration, perform the following tasks:

1.     Prepare the files for automatic configuration:

¡     Preparing configuration files

¡     Preparing script files

2.     Configuring the file server

3.     Configuring the DHCP server

4.     (Optional.) Configuring the DNS server

5.     (Optional.) Configuring the gateway

6.     Starting and completing automatic configuration

7.     (Optional.) Stopping automatic configuration

Preparing configuration files

Configuration file types

The device supports the configuration file types listed in Table 2.

Table 2 Configuration file types

Configuration file type

Application objects

File name requirements

Supported file server types

Dedicated configuration file

Devices that require different settings

File name.cfg

For simple file name identification, use configuration file names that do not contain spaces.

·     TFTP server

·     HTTP server

Common configuration file

Devices that share all or some settings

File name.cfg

For simple file name identification, use configuration file names that do not contain spaces.

·     TFTP server

·     HTTP server

Default configuration file

All devices.

The file contains only common configurations that devices use to start up.

device.cfg

TFTP server

 

Identifying requirements for and preparing configuration files

1.     Identify the requirements of the devices for configuration files.

2.     For devices that require different configurations, prepare a configuration file for each of them and save the files to the file server.

3.     For devices that share all or some configurations, save the common configurations to a .cfg file on the file server.

4.     If a TFTP file server is used, you can save the common configurations that devices use to start up to the device.cfg file on the server. The file is assigned to a device only when the device does not have any other configuration file to use.

Preparing a host name file on the file server

If the DHCP server does not assign configuration file names, you can configure a host name file on the file server. The host name file contains the host name-IP address mappings of the devices to be automatically configured. As the host name for a device is the same as the name of the configuration file configured for the device, the device can obtain the configuration file configured for it.

Preparing script files

About this task

Script files can be used for automatic software upgrade and automatic configuration.

The device supports Python scripts (.py files) and Tcl scripts (.tcl files). For more information about Python and Tcl scripts, see "Using Python" and "Using Tcl."

The device supports dedicated script files and common dedicated script files. It does not support using a default script file. For information about dedicated script files and common dedicated script files, see Configuration file types.

When script files are used, you cannot use a host name file to provide the host name-IP address mappings for devices.

Restrictions and guidelines

To use a Tcl script, make sure all commands in the script are supported and correctly configured. Any error in a command causes the automatic configuration process to quit.

When you use a Python script to automatically configure a device, make sure the script file does not contain command line errors (such as spelling mistakes, incorrect views, and unsupported commands for the device). If the script file contains command line errors, the current round of automatic configuration will fail and the device will proceed to the next round of automatic configuration.

Procedure

·     For devices that share all or some configurations, create a script file that contains the common configurations.

·     For the other devices, create a separate script file for each of them.

Configuring the file server

For devices to obtain configuration information from an HTTP or TFTP server, start HTTP or TFTP service on the file server, respectively.

Configuring the DHCP server

About this task

The DHCP server assigns the following items to devices that need to be automatically configured:

·     IP addresses.

·     Paths of the configuration or script files.

Restrictions and guidelines

When you configure the DHCP server, follow these guidelines:

·     For devices for which you have prepared different configuration files, perform the following tasks for each of the devices on the DHCP server:

¡     Create a DHCP address pool.

¡     Configure a static address binding.

¡     Specify a configuration file or script file.

Because an address pool can use only one configuration file, you can specify only one static address binding for an address pool.

·     For devices for which you have prepared the same configuration file, use either of the following methods:

¡     Method 1:

-     Create a DHCP address pool for the devices.

-     Configure a static address binding for each of the devices in the address pool.

-     Specify the configuration file for the devices.

¡     Method 2:

-     Create a DHCP address pool for the devices.

-     Specify the subnet for dynamic allocation.

-     Specify the TFTP server.

-     Specify the configuration file for the devices.

·     If all devices on a subnet share the same configuration file or script file, perform the following tasks on the DHCP server:

¡     Configure dynamic address allocation.

¡     Specify the configuration file or script file for the devices.

The configuration file can contain only the common settings for the devices. You can provide a method for the device administrators to change the configurations after their devices start up.

Configuring the DHCP server when an HTTP file server is used

1.     Enter system view.

system-view

2.     Enable DHCP.

dhcp enable

By default, DHCP is disabled.

3.     Create a DHCP address pool and enter its view.

dhcp server ip-pool pool-name

4.     Configure the address pool.

Choose the options to configure as needed:

¡     Specify the primary subnet for the address pool.

network network-address [ mask-length | mask mask ]

By default, no primary subnet is specified.

¡     Configure a static binding.

static-bind ip-address ip-address [ mask-length | mask mask ] { client-identifier client-identifier | hardware-address hardware-address [ ethernet | token-ring ] }

By default, no static binding is configured.

You can configure multiple static bindings. However, one IP address can be bound to only one client. To change the binding for a DHCP client, you must remove the binding and reconfigure a binding.

5.     Specify the URL of the configuration or script file.

bootfile-name url

By default, no configuration or script file URL is specified.

Configuring the DHCP server when a TFTP file server is used

1.     Enter system view.

system-view

2.     Enable DHCP.

dhcp enable

By default, DHCP is disabled.

3.     Create a DHCP address pool and enter its view.

dhcp server ip-pool pool-name

4.     Configure the address pool.

Choose the options to configure as needed:

¡     Specify the primary subnet for the address pool.

network network-address [ mask-length | mask mask ]

By default, no primary subnet is specified.

¡     Configure a static binding.

static-bind ip-address ip-address [ mask-length | mask mask ] { client-identifier client-identifier | hardware-address hardware-address [ ethernet | token-ring ] }

By default, no static binding is configured.

You can configure multiple static bindings. However, one IP address can be bound to only one client. To change the binding for a DHCP client, you must remove the binding and reconfigure a binding.

5.     Specify a TFTP server.

Choose one option as needed:

¡     Specify the IP address of the TFTP server.

tftp-server ip-address ip-address

By default, no TFTP server IP address is specified.

¡     Specify the name of the TFTP server.

tftp-server domain-name domain-name

By default, no TFTP server name is specified.

If you specify a TFTP server by its name, a DNS server is required on the network.

6.     Specify the name of the configuration or script file.

bootfile-name bootfile-name

By default, no configuration or script file name is specified.

Configuring the DNS server

A DNS server is required in the following situations:

·     Obtaining the names of configuration files for automatic configuration when the TFTP server does not have a host name file—In this situation, the devices that perform server-based automatic configuration use the DNS server to resolve their IP addresses to their host names. Then, each device can use its host name to obtain the configuration file that has the same name as its host name from the TFTP server.

·     Obtaining the IP address of a file server—If the devices obtain the domain name of the file server from DHCP reply messages, they can use the domain name to obtain the IP address of the file server through the DNS server.

For more information about DNS servers, see DNS configuration in Layer 3—IP Services Configuration Guide.

Configuring the gateway

If the devices to be automatically configured and the servers for automatic configuration reside in different network segments, you must perform the following tasks:

·     Deploy a gateway and make sure the devices can communicate with the servers.

·     Configure the DHCP relay agent feature on the gateway.

·     Configure the UDP helper feature on the gateway.

This task is required if devices send requests to a TFTP server by using broadcast packets. A device uses broadcast packets to send requests to a TFTP server in the following situations:

¡     The DHCP reply does not contain the IP address or domain name of the TFTP server.

¡     The IP address or domain name of the TFTP server is invalid.

The UDP helper transforms a broadcast packet into a unicast packet and forwards the unicast packet to the file server.

Starting and completing automatic configuration

1.     Power on the devices to be automatically configured.

2.     The devices enter the automatic configuration process. After a device obtains a configuration file and executes the file successfully, the automatic configuration process ends.

3.     Save the running configuration.

save

As a best practice, save the running configuration on each device after the configuration file is executed successfully on the device.

For more information about the save command, see configuration file management commands in Fundamentals Command Reference.

Stopping automatic configuration

If a device cannot obtain a configuration file for automatic configuration, the current automatic configuration attempt fails, and the device continues attempting automatic configuration. You can wait until the device automatically ends the automatic configuration process after it has made the maximum number of attempts. Alternatively, you can manually stop the automatic configuration process by using shortcut keys Ctrl+C or Ctrl+D based on the prompt information. After the automatic configuration process fails and ends, the device starts up with initial settings.

Using URL-based automatic configuration

About URL-based automatic configuration

URL-based automatic configuration uses a customizable configuration file saved on the device by default to implement basic device configuration after the device starts up. The configuration file contains the basic network configuration command lines. This feature requires you to construct a URL to indicate the values for the parameters in the command lines. The URL can be in either of the following forms:

·     Plaintext form—The user directly configures the plaintext URL. Parameters in the URL are configured and transmitted in plaintext form.

·     Encrypted form—The administrator generates the encrypted URL and an authentication password for the URL by using the controller. Within the validity of the URL, a user can enter the authentication password as prompted to use the URL to perform URL-based automatic configuration.

Restrictions: Hardware compatibility with URL-based automatic configuration

Series

Models

URL-based automatic configuration compatibility

F5000 series

F5000-AI-160-G, F5000-AI-130-G, F5000-AI-120-G, F5000-AI-110-G, F5000-AI-55-G, F5000-AI-15-G, F5000-CN160-G, F5000-E-G, F5000-AI160, F5000-CN160, F5000-CN-G55, F5080, F5030

Yes

F1000 series

F1000-AI-90, F1000-AI-25, F1000-AI-90-G, F1000-AI-80-G, F1000-AI-75-G, F1000-AI-65-G, F1000-AI-55-G

Yes

F1000-AK9130

No

How URL-based automatic configuration works

The basic device configuration defines how the device connects to the network. By default, the following connection modes are available: PPPoE mode, static IP address mode, and DHCP mode. The customizable configuration file contains the command lines for the connection modes. The required URL varies by connection mode.

PPPoE mode

Table 3 lists the parameters required or optional in the URL in PPPoE mode. The following is the format of the URL in PPPoE mode:

http://Device IP address/urlcfg?sys_name=Device name&link_mode=Link mode&dialer_if=Dialer interface name&ntp_server=NTP server (optional)&link_if=WAN interface&ac_host=Server IP address&ac_port=Server port&ac_password=Server password&pap_user=PPPoE PAP authentication password&pap_password=PPPoE PAP authentication password&chap_user=PPPoE CHAP authentication username&chap_password=PPPoE CHAP authentication password

Table 3 Parameters required for PPPoE mode

Item

Parameter

Value type

Value range

Corresponding command

Required

Device address

Device IP address

IP address

N/A

N/A

Yes

Device name

sys_name

String

1 to 64

sysname sysname

Yes

Server address

ac_host

IP address

N/A

cloud-management server domain ip-address

Yes

Server port

ac_port

Integer

1 to 65535

cloud-management server port port-number

Yes

Server password

ac_password

String

1 to 63

cloud-management server password simple password

Yes

NTP server

ntp_server

IP address

N/A

ntp-service unicast-server ip-address

No

WAN interface

link_if

Interface type and number

N/A

interface interface-type interface-number

Yes

PPPoE connection mode

link_mode

String

PPPoE

N/A

Yes

PPPoE dialer interface

dialer_if

String

N/A

interface dialer number

Yes

PPPoE PAP authentication username

pap_user

String

1 to 80

ppp pap local-user user-name password simple password

Yes

PPPoE PAP authentication password

pap_password

String

1 to 255

ppp pap local-user user-name password simple password

Yes

PPPoE CHAP authentication username

chap_user

String

1 to 80

ppp chap user user-name

Yes

PPPoE CHAP authentication password

chap_password

String

1 to 255

ppp chap password simple password

Yes

 

Static IP address mode

Table 4 lists the parameters required or optional in static IP address mode. The following is the format of the URL in static IP address mode:

http://Device IP address/urlcfg?sys_name=Device name&link_mode=Link mode&ntp_server=NTP server (optional)&dest_ip=Destination IP address&dest_mask=Destination IP mask&next_hop=IP address of the next hop&link_if=WAN interface&static_ip=Static IP address&static_mask=Static IP mask&ac_host=Server address&ac_port=Server port&ac_password=Server password

Table 4 Parameters required for static IP address mode

Item

Parameter

Value type

Value range

Corresponding command

Required

Device address

Device IP address

IP address

N/A

N/A

Yes

Device name

sys_name

String

1 to 64

sysname sysname

Yes

Server address

ac_host

IP address

N/A

cloud-management server domain ip-address

Yes

Server port

ac_port

Integer

1 to 65535

cloud-management server port port-number

Yes

Server password

ac_password

String

1 to 63

cloud-management server password simple password

Yes

NTP server

ntp_server

IP address

N/A

ntp-service unicast-server ip-address

No

Destination IP address

dest_ip

IP address

N/A

ip route-static dest-address mask next-hop-address

Yes

Destination IP mask

dest_mask

IP mask

N/A

ip route-static dest-address mask next-hop-address

Yes

IP address of the next hop

next_hop

IP address

N/A

ip route-static dest-address mask next-hop-address

Yes

WAN interface

link_if

Interface type and number

N/A

interface interface-type interface-number

Yes

Static IP address connection mode

link_mode

String

STATIC

N/A

Yes

Static IP address

static_ip

IP address

N/A

ip address ip-address mask

Yes

Static IP mask

static_mask

IP mask

N/A

ip address ip-address mask

Yes

Static default gateway

gateway

IP address

N/A

ip route-static 0.0.0.0 0.0.0.0 next-hop-address

Yes

 

DHCP mode

Table 5 lists the parameters required or optional in DHCP mode. The following is the format of the URL in DHCP mode:

http://Device IP address/urlcfg?sys_name=Device name&link_mode=Link mode&ntp_server=NTP server (optional)&link_if=WAN interface&ac_host=Server address&ac_port=Server port&ac_password=Server password

Table 5 Parameters required for DHCP mode

Item

Parameter

Value type

Value range

Corresponding command

Required

Device address

Device IP address

IP address

N/A

N/A

Yes

Device name

sys_name

String

1 to 64

sysname sysname

Yes

Server address

ac_host

IP address

N/A

cloud-management server domain ip-address

Yes

Server port

ac_port

Integer

1 to 65535

cloud-management server port port-number

Yes

Server password

ac_password

String

1 to 63

cloud-management server password simple password

Yes

NTP server

ntp_server

IP address

N/A

ntp-service unicast-server ip-address

No

WAN interface

link_if

Interface type and number

N/A

interface interface-type interface-number

Yes

DHCP connection mode

link_mode

String

DHCP

N/A

Yes

 

Procedure

1.     Power on the device.

2.     Enable URL-based automatic configuration.

a.     Enter system view.

system-view

b.     Enable URL-based automatic configuration.

autodeploy url enable

By default, URL-based automatic configuration is enabled the state.

c.     Save the current configuration.

save

If URL-based automatic configuration is disabled on a device, you must execute this command, save the configuration, and reboot the device to make this feature take effect.

3.     On the configuration terminal, launch a Web browser and enter the default IP address of the device in the address bar. Then, enter the default username and password as prompted to log in to the device.

You can change the default IP address, username, and password on the device. The IP address and username are the device address and device name required in the URL.

4.     Construct a URL as describe in "How URL-based automatic configuration works."

5.     Enter the URL in the address bar and enter the username and password as prompted.

The device will use the parameters and values in the URL and the customizable configuration file to reconstruct a configuration file, and then execute the file to complete automatic configuration.

Configuration file

IMPORTANT

IMPORTANT:

The contents of the configuration file might vary by device model.

 

PPPoE mode section

{link_mode = PPPoE}

#

 system-view

#

 sysname [sys_name]

#

 dialer-group 1 rule ip permit

#

interface Dialer1

 1:ppp chap password simple [chap_password]

 1:ppp chap user [chap_user]

 ppp ipcp dns admit-any

 ppp ipcp dns request

 1:ppp pap local-user [pap_user] password simple [pap_password]

 dialer bundle enable

 dialer-group 1

 dialer timer idle 0

 dialer timer autodial 5

 ip address ppp-negotiate

 tcp mss 1024

 nat outbound

#

 quit

#

interface [link_if]

 port link-mode route

 pppoe-client dial-bundle-number 1

#

 quit

#

 1:ntp-service unicast-server [ntp_server]

#

 cloud-management server domain [ac_host]

 cloud-management server port [ac_port]

 cloud-management server password simple [ac_password]

#

 ip route-static 0.0.0.0 0 Dialer1

#

Static IP address mode section

{link_mode = STATIC}

#

 system-view

#

 sysname [sys_name]

#

interface [link_if]

 port link-mode route

 ip address [static_ip] [static_mask]

 nat outbound

#

 qu

#

 1:ntp-service unicast-server [ntp_server]

#

 cloud-management server domain [ac_host]

 cloud-management server port [ac_port]

 cloud-management server password simple [ac_password]

#

 ip route-static 0.0.0.0 0.0.0.0 [gateway]

#

DHCP mode section

{link_mode = DHCP}

#

 system-view

#

 sysname [sys_name]

#

interface [link_if]

 port link-mode route

 ip address dhcp-alloc

 nat outbound

#

 qu

#

 1:ntp-service unicast-server [ntp_server]

#

 cloud-management server domain [ac_host]

 cloud-management server port [ac_port]

 cloud-management server password simple [ac_password]

#

Using USB-based automatic configuration

About USB-based automatic configuration

USB-based automatic configuration enables the device to obtain a configuration file from a connected USB disk at startup. The configuration file can be in either of the following forms:

·     Plaintext form—The configuration file is saved in plaintext form.

·     Encrypted form—The configuration file is generated by the administrator in encrypted form by using the controller. When being transmitted to a USB disk, the configuration data in the file is transmitted in encrypted form. When being used to perform automatic configuration, the configuration data is automatically decrypted by the device.

After obtaining a configuration file, the device compares the file with its main startup configuration file. If the two files have the same settings, the device loads its main startup configuration file. If the two files have different settings, the device performs the following operations:

1.     Identifies whether its main startup configuration file is using the same name as the obtained configuration file.

¡     If yes, the device renames its main startup configuration file by adding _bak to the base name of the file, and copies the obtained configuration file.

¡     If not, the system uses the obtained configuration file to overwrite its main startup configuration file.

2.     Loads the obtained configuration file.

¡     If all commands in the obtained configuration file are successfully loaded, the device sets the obtained configuration file as the main startup configuration file.

¡     If a command in the obtained configuration file fails, the device removes all loaded settings

and searches for a local configuration file.

-     If a configuration file is found, the device loads the configuration file.

-     If no configuration file is found, the device finishes the automatic configuration process without loading any configurations.

Preparing the USB disk for automatic configuration

1.     Prepare a USB disk that has only one partition.

2.     Display the serial number of the device.

display device manuinfo

For more information about this command, see Fundamentals Command Reference.

3.     Create a configuration file named Device serial number.cfg or autodeploy.cfg, and save the file to the root directory of the file system on the USB disk.

If a configuration file named Device serial number.cfg coexists with configuration file autodeploy.cfg, configuration file Device serial number.cfg is used.

Configuring and using USB-based automatic configuration

1.     Enable USB-based automatic configuration on the device:

a.     Enter system view.

system-view

b.     Enable USB-based automatic configuration.

autodeploy udisk enable

By default, USB-based automatic configuration is enabled.

For the enabling configuration to take effect if USB-based automatic configuration has been disabled, you must save the configuration and reboot the device.

c.     Save the running configuration.

save

2.     Insert the USB disk into interface USB1, namely, usba0:, on the active MPU. USB-based automatic configuration is supported only by a single MPU. After USB-based automatic configuration ends, the standby MPU will automatically synchronize its configuration with the active MPU at startup.

3.     Manually reboot the device and observe the LEDs of the device.

If the device finds no configuration files to load at startup, it performs the following operations:

a.     Copies the configuration file on the USB disk.

b.     Specifies the file as the startup configuration file.

c.     Reboots to load the configuration file.

-     If the SYS LED flashes green quickly for 5 seconds, the automatic configuration succeeded. Proceed to step 5.

-     If the SYS LED flashes yellow quickly for 10 seconds, the automatic configuration failed. Display the log file named Fully qualified configuration file name.log in the USB disk root directory to locate and resolve the problem.

For more information about the LEDs, see the installation guide.

4.     If the automatic configuration succeeded, use the display current-configuration command to verify that the configuration file has been loaded correctly.

5.     Remove the USB disk.

 

 

  • Cloud & AI
  • InterConnect
  • Intelligent Computing
  • Intelligent Storage
  • Security
  • SMB Products
  • Intelligent Terminal Products
  • Product Support Services
  • Technical Service Solutions
All Services
  • Resource Center
  • Policy
  • Online Help
  • Technical Blogs
All Support
  • Become A Partner
  • Partner Policy & Program
  • Global Learning
  • Partner Sales Resources
  • Partner Business Management
  • Service Business
All Partners
  • Profile
  • News & Events
  • Online Exhibition Center
  • Contact Us
All About Us