H3C SecPath F5020 Manuel utilisateur

H3C Firewall Devices

Interface Configuration Guide (Comware V7)

Hangzhou H3C Technologies Co., Ltd.

http://www.h3c.com

Software version:

F5020/F5040 firewalls ESS9304

M9006/M9010/M9014 security

ateways

ESS9114

VFW1000 virtual firewalls ESS9204

Document version: 5W100-20150116

No part of this manual may be reproduced or transmitted in any form or by any means without prior

written consent of Hangzhou H3C Technologies Co., Ltd.

Trademarks

H3C, , H3CS, H3CIE, H3CNE, Aolynk, , H3Care, , IRF, NetPilot, Netflow,

SecEngine, SecPath, SecCenter, SecBlade, Comware, ITCMM and HUASAN are trademarks of

Hangzhou H3C Technologies Co., Ltd.

All other trademarks that may be mentioned in this manual are the property of their respective owners.

Notice

The information in this document is subject to change without notice. Every effort has been made in the

preparation of this document to ensure accuracy of the contents, but all statements, information, and

recommendations in this document do not constitute the warranty of any kind, express or implied.

Preface

The H3C firewall devices configuration guides (Comware V7) describe the software features and

configuration procedures for the Comware V7-based firewall devices in "Applicable devices." These

guides also provide configuration examples to help you apply software features to different network

scenarios.

The Interface Configuration Guide describes interface configuration. It covers the configuration for bulk

interfaces, Ethernet interfaces, loopback interfaces, null interfaces, inloopback interfaces, and Blade

interfaces.

This preface includes:

•Applicable devices

•Audience

•Conventions

•About the H3C firewall documentation set

•Obtaining documentation

•Technical support

•Documentation feedback

Applicable devices

This document applies to the following firewall devices:

Product series Model

Device t

H3C SecPath F5000 firewalls F5020/F5040 Centralized IRF devices. These

devices support IRF.

H3C SecPath M9000 multiservice

security gateways M9006/M9010/M9014

Distributed devices. These devices

support IRF. They can operate in

one of the following modes:

•Standalone mode—The device

cannot form an IRF fabric with

other devices.

•IRF mode—The device can form

an IRF fabric with other devices.

H3C SecPath virtual multiservice

security gateways VFW1000 Centralized devices. These devices

do not support IRF.

Audience

This document is intended for:

•Network planners.

•Field technical support and servicing engineers.

•Network administrators working with the firewall devices.

Conventions

This section describes the conventions used in this document.

Command conventions

Convention Descri

tion

Boldface Bold text represents commands and keywords that you enter literally as shown.

Italic Italic text represents arguments that you replace with actual values.

[ ] Square brackets enclose syntax choices (keywords or arguments) that are optional.

{ x | y | ... }

Braces enclose a set of required syntax choices separated by vertical bars, from which

you select one.

[ x | y | ... ]

Square brackets enclose a set of optional syntax choices separated by vertical bars, from

which you select one or none.

{ x | y | ... } *

Asterisk marked braces enclose a set of required syntax choices separated by vertical

bars, from which you select at least one.

[ x | y | ... ] *

Asterisk marked square brackets enclose optional syntax choices separated by vertical

bars, from which you select one choice, multiple choices, or none.

&<1-n> The argument or keyword and argument combination before the ampersand (&) sign can

be entered 1 to n times.

# A line that starts with a pound (#) sign is comments.

GUI conventions

Convention Descri

tion

Boldface Window names, button names, field names, and menu items are in Boldface. For

example, the New User window appears; click OK.

> Multi-level menus are separated by angle brackets. For example, File > Create > Folder.

Symbols

Convention Descri

tion

WARNING An alert that calls attention to important information that if not understood or followed can

result in personal injury.

CAUTION An alert that calls attention to important information that if not understood or followed can

result in data loss, data corruption, or damage to hardware or software.

IMPORTANT An alert that calls attention to essential information.

NOTE An alert that contains additional or supplementary information.

TIP An alert that provides helpful information.

Network topology icons

Represents a generic network device, such as a router, switch, or firewall.

Represents a routing-capable device, such as a router or Layer 3 switch.

Represents a generic switch, such as a Layer 2 or Layer 3 switch, or a router that supports

Layer 2 forwarding and other Layer 2 features.

Represents a security product, such as a firewall, UTM, multiservice security gateway, or

load-balancing device.

Represents a security card, such as a firewall, load balancing, NetStream, SSL VPN, IPS,

or ACG card.

Port numbering in examples

The port numbers in this document are for illustration only and might be unavailable on your device.

About the H3C firewall documentation set

The H3C firewall documentation set includes:

Cate

Documents

Pur

oses

Product description and

specifications Marketing brochures Describe product specifications and benefits.

Hardware specifications

and installation

Compliance and safety

manual

Provides regulatory information and the safety

instructions that must be followed during installation.

Quick start

Guides you through initial installation and setup

procedures to help you quickly set up and use your

device with the minimum configuration.

Installation guide Provides a complete guide to hardware installation

and hardware specifications.

Card manuals Provide the hardware specifications of cards.

H3C transceiver modules

user guide

Guides you through installing

SFP/SFP+/XFP/QSFP+/CFP/CXP transceiver

modules and CX4 cables.

Software configuration

Configuration guides Describe software features and configuration

procedures.

Command references Provide a quick reference to all available

commands.



Obtaining documentation

Access the most up-to-date H3C product documentation on the World Wide Web

at http://www.h3c.com.

Click the following links to obtain different categories of product documentation:

[Technical Documents]—Provides hardware installation, software upgrading, and software feature

configuration and maintenance documentation.

[Products & Solutions]—Provides information about products and technologies, as well as solutions.

[Software Download]—Provides the documentation released with the software version.

Technical support

servic[email protected]

http://www.h3c.com

Documentation feedback

You can e-mail your comments about product documentation to info@h3c.com.

We appreciate your comments.

Contents

Bulk configuring interfaces ·········································································································································· 1

Configuration restrictions and guidelines·······················································································································1

Configuration procedure··················································································································································2

Displaying and maintaining bulk interface configuration·····························································································2

Configuring Ethernet interfaces··································································································································· 3

Configuring common Ethernet interface settings ···········································································································3

Configuring a combo interface (single combo interface) ····················································································3

Configuring basic settings of an Ethernet interface or subinterface ···································································4

Configuring the link mode of an Ethernet interface······························································································5

Configuring jumbo frame support ··························································································································6

Configuring physical state change suppression on an Ethernet interface··························································7

Configuring dampening on an Ethernet interface ································································································8

Performing a loopback test on an Ethernet interface····························································································9

Configuring generic flow control on an Ethernet interface··············································································· 10

Setting the statistics polling interval····················································································································· 11

Enabling subinterface rate statistics collection on an Ethernet interface ························································· 12

Forcibly bringing up a fiber port ························································································································· 13

Configuring a Layer 2 Ethernet interface ···················································································································· 15

Setting speed options for autonegotiation on an Ethernet interface ································································ 15

Configuring storm suppression ···························································································································· 16

Configuring storm control on an Ethernet interface··························································································· 17

Setting the MDIX mode of an Ethernet interface ································································································ 18

Testing the cable connection of an Ethernet interface······················································································· 19

Configuring a Layer 3 Ethernet interface or subinterface·························································································· 19

Setting the MTU for an Ethernet interface or subinterface ················································································ 19

Configuring the MAC address of an Ethernet interface or subinterface ························································· 20

Displaying and maintaining an Ethernet interface or subinterface··········································································· 21

Configuring loopback, null, and inloopback interfaces··························································································22

Configuring a loopback interface ································································································································ 22

Configuring a null interface ·········································································································································· 23

Configuring an inloopback interface··························································································································· 23

Displaying and maintaining loopback, null, and inloopback interfaces ································································· 23

Configuring Blade interfaces·····································································································································24

Overview········································································································································································· 24

Feature and hardware compatibility···························································································································· 24

Displaying and maintaining a Blade interface ··········································································································· 24

Index ···········································································································································································25

Bulk configuring interfaces

You can enter interface range view to bulk configure multiple interfaces with the same feature instead of

configuring them one by one. For example, you can execute the shutdown command in interface range

view to shut down a range of interfaces.

Configuration restrictions and guidelines

When you bulk configure interfaces in interface range view, follow these restrictions and guidelines:

•In interface range view, only the commands supported by the first interface are available. The first

interface is specified with the interface range command.

•You cannot enter the view of some interfaces by using the interface interface-type

{ interface-number | interface-number.subnumber } command, for example, BRI 1/1/1:1. Do not

configure any of these interfaces as the first interface in the interface range.

•Do not assign both an aggregate interface and any of its member interfaces to an interface range.

Some commands, after being executed on both an aggregate interface and its member interfaces,

can break up the aggregation.

•No limit is set on the maximum number of interfaces in an interface range. The more interfaces in

an interface range, the longer the command execution time.

•The maximum number of interface range names is limited only by the system resources. To

guarantee bulk interface configuration performance, H3C recommends that you configure fewer

than 1000 interface range names.

•After a command is executed in interface range view, one of the following situations might occur:

{The system displays an error message and stays in interface range view. It means that the

execution fails on member interfaces in the interface range.

−If the execution fails on the first member interface in the interface range, the command is not

executed on any member interfaces.

−If the execution fails on non-first member interfaces, the command takes effect on the other

member interfaces.

{The system returns to system view. It means that:

−The command is supported in both system view and interface view.

−The execution fails on a member interface in interface range view and succeeds in system

view.

−The command is not executed on the subsequent member interfaces.

You can use the display this command to verify the configuration in interface view of each

member interface. In addition, if the configuration in system view is unnecessary, use the undo

form of the command to remove the configuration.

Configuration procedure

Ste

Command Remarks

1. Enter system view. system-view N/A

2. Enter interface range

view.

•interface range { interface-type

interface-number [ to

interface-type

interface-number ] } &<1-5>

•interface range name name

[ interface { interface-type

interface-number [ to

interface-type

interface-number ] } &<1-5> ]

By using the interface range name

command, you assign a name to an

interface range and can specify this

name rather than the interface range to

enter the interface range view.

3. (Optional.) Display

commands available for

the first interface in the

interface range.

Enter a question mark (?) at the

interface range prompt. N/A

4. Use available

commands to configure

the interfaces.

Available commands depend on the

interface. N/A

5. (Optional.) Verify the

configuration. display this N/A

Displaying and maintaining bulk interface

configuration

Execute the display command in any view.

Task Command

Display information about the interface ranges

created by using the interface range name command.

display interface range [name name ]

Configuring Ethernet interfaces

Your device supports the following types of Ethernet interfaces:

•Layer 2 Ethernet interfaces—Physical Ethernet interfaces operating at the data link layer (Layer 2)

to switch packets.

•Layer 3 Ethernet interfaces—Physical Ethernet interfaces operating at the network layer (Layer 3) to

route packets. You can assign an IP address to a Layer 3 Ethernet interface.

•Layer-configurable Ethernet interfaces—Physical Ethernet interfaces that can be configured to

operate in bridge mode as Layer 2 Ethernet interfaces or in route mode as Layer 3 Ethernet

interfaces.

•Layer 3 Ethernet subinterfaces—Logical interfaces operating at the network layer. You can assign

an IP address to a Layer 3 Ethernet subinterface. To enable a Layer 3 Ethernet interface to transport

packets for multiple VLANs, you must create Layer 3 subinterfaces on the Layer 3 Ethernet interface.

For information about how a Layer 3 Ethernet subinterface sends and receives VLAN-tagged

packets, see Layer 2—LAN Switching Configuration Guide.

Configuring common Ethernet interface settings

This section describes the settings common to Layer 3 Ethernet interfaces, and Layer 3 Ethernet

subinterfaces. For more information about the settings specific to Layer 2 Ethernet interfaces, see

"Configuring a Layer 2 Ethernet interface." For more information about the settings specific to Layer 3

Ethernet interfaces or subinterfaces, see "Configuring a Layer 3 Ethernet interface or subinterface."

Configuring a combo interface (single combo interface)

A combo interface is a logical interface that physically comprises one fiber combo port and one copper

combo port. The two ports share one forwarding channel and one interface view. As a result, they cannot

work simultaneously. When you activate one port, the other port is automatically disabled. In the

interface view, you can activate the fiber or copper combo port, and configure other port attributes such

as the interface rate and duplex mode.

Configuration prerequisites

Before you configure combo interfaces, complete the following tasks:

•Determine the combo interfaces on your device. Identify the two physical interfaces that belong to

each combo interface according to the marks on the device panel.

•Use the display interface command to determine which port (fiber or copper) of each combo

interface is active:

{If the copper port is active, the output includes "Media type is twisted pair, Port hardware type

is 1000_BASE_T."

{If the fiber port is active, the output does not include this information.

Also, you can use the display this command in the view of each combo interface to display the

combo interface configuration:

{If the fiber port is active, the combo enable fiber command exists in the output.

Autres manuels pour SecPath F5020

Ce manuel convient aux modèles suivants

Table des matières

Autres manuels H3C Pare-feu

H3C

H3C SecPath F100-C-A-W Manuel utilisateur

H3C

H3C H3C SECPATH F1000-S Manuel utilisateur

H3C

H3C SecPath F100-C Manuel utilisateur

H3C

H3C SecPath F10 0 Series Manuel utilisateur

H3C

H3C SecPath M9000-S NSQM2FWDFG0 Manuel utilisateur

H3C

H3C SecPath F100-C-EI Manuel utilisateur

H3C

H3C SecPath Series Manuel d'installation

H3C

H3C SecPath F1000-E Manuel utilisateur

H3C

H3C SecPath F5020 Manuel utilisateur

H3C

H3C SecPath F5030 Manuel utilisateur

H3C

H3C SecPath F1000-AI-X0 Manuel utilisateur

H3C

H3C SecPath F5000 Series Mode d’emploi

H3C

H3C SecPath F100-X-G3 Manuel utilisateur

H3C

H3C SecPath F5030 Manuel utilisateur

H3C

H3C SecPath T9000 IPS Series Manuel d'utilisation et d'entretien

H3C

H3C SecPath NSQM1F1KGM0 Manuel utilisateur

H3C

H3C SecPath F5030 Manuel utilisateur

H3C

H3C H3C SecPath F1800-A Manuel utilisateur

H3C

H3C SecPath Series Instructions d'installation

H3C

H3C H3C SecPath F1800-A Manuel utilisateur

H3C

H3C F1000-AI-20 Manuel utilisateur

H3C

H3C F5000-AI160 Manuel utilisateur

H3C

H3C SecPath F5000-A5 Manuel utilisateur

H3C

H3C SecPath F50X0-D Series Manuel d'installation

Manuels Pare-feu populaires d'autres marques

Cisco

Cisco S190 Manuel utilisateur

Fortinet

Fortinet FortiGate Voice Series Manuel utilisateur

ADTRAN

ADTRAN NetVanta 2300 Manuel utilisateur

SecureLogix

SecureLogix ETM System Manuel utilisateur

NETGEAR

NETGEAR ProSafe FVX538 Manuel utilisateur

Lanner

Lanner FW-8877 Manuel utilisateur

Huawei

Huawei USG6000 Series Manuel d'installation et d'exploitation

Nexcom

Nexcom DNA 1150 Manuel utilisateur

Fortinet

Fortinet FortiGate-60 series Manuel utilisateur

Cisco

Cisco 3110 Manuel

Draytek

Draytek Vigor2860 Series Manuel utilisateur

Lanner electronics

Lanner electronics FW-7650 Series Manuel utilisateur

Swisscom

Swisscom Internet Backup Manuel utilisateur

SonicWALL

SonicWALL NSa 5700 Manuel utilisateur

DPtech

DPtech FW1000 SERIES Manuel utilisateur

FEITIAN

FEITIAN MultiPass FIDO Manuel utilisateur

EBLOCKER

EBLOCKER PRO Manuel utilisateur

GTA

GTA GB-200 Manuel utilisateur