• 全部
  • 经验案例
  • 典型配置
  • 技术公告
  • FAQ
  • 全部
  • 全部
产品线
搜索
取消
案例类型
发布者
是否解决
是否官方
时间
高级搜索

S12500 IRF模式下NSM的典型配置案例

2012-08-21发表
  • 0关注
  • 2收藏,769浏览
张辛 四段
粉丝:0人 关注:0人

S12500 IRF模式下NSM的典型配置案例

一、    业务需求

1、对端口的出入流量进行框内、跨框NSM

2、覆盖:IPv4单播、IPv4组播、IPv6单播、IPv6组播、MPLS

二、    组网图:

三、    配置步骤:

S12500上正常配置业务;

由于涉及跨框镜像,S12500 NSM内联口需要允许VLAN 1通过;

NSM板进行Netstream相关配置;

流镜像方式将125业务口报文镜像到框内、框间NSM内联口处理;

1S12500基本配置

## IPv4单播相关配置

[S12500]interface LoopBack 0

[S12500-LoopBack0]ip address 1.1.1.1 32

[S12500-LoopBack0]quit

[S12500]inter vlan 15

[S12500-Vlan-interface15]ip address 15.1.1.1 24

[S12500]inter vlan 30

[S12500-Vlan-interface30]ip address 30.1.1.1 24

[S12500-Vlan-interface30]quit

## IPv4组播相关配置

[S12500]multicast routing-enable

[S12500]pim

[S12500-pim]c-bsr LoopBack0

[S12500-pim]c-rp LoopBack0

[S12500-pim]inter vlan 30

[S12500-Vlan-interface30]pim sm

[S12500-Vlan-interface30]inter vlan 15

[S12500-Vlan-interface15]igmp enable

[S12500-Vlan-interface15]quit

## IPv6单播相关配置

[S12500]interface LoopBack 0

[S12500-LoopBack0]ipv6 address 2000::1.1.1.1 128

[S12500-LoopBack0]quit

[S12500]ipv6

[S12500]inter vlan 15

[S12500-Vlan-interface15]ipv6 address 2000::f.1.1.1 112

[S12500]inter vlan 30

[S12500-Vlan-interface30]ipv6 address 2000::1e.1.1.1 112

[S12500-Vlan-interface30]quit

## IPv6组播相关配置

[S12500]multicast ipv6 routing-enable

[S12500]pim ipv6

[S12500-pim6]c-rp 2000::1:1:1:1

[S12500-pim6]c-bsr 2000::1:1:1:1

[S12500-pim]inter vlan 30

[S12500-Vlan-interface30]pim ipv6 sm

[S12500-Vlan-interface30]inter vlan 15

[S12500-Vlan-interface15]mld enable

[S12500-Vlan-interface15]quit

## MPLS相关配置

[S12500]mpls lsr-id 1.1.1.1

[S12500]mpls

[S12500]inter vlan 30

[S12500-Vlan-interface30]mpls

[S12500-Vlan-interface30]inter vlan 15

[S12500-Vlan-interface15]mpls

[S12500-Vlan-interface15]quit

[S12500]static-lsp transit in->out incoming-interface Vlan-interface15 in-label 115 nexthop 30.1.1.2 out-label 130

[S12500]static-lsp transit out->in incoming-interface Vlan-interface30 in-label 130 nexthop 15.1.1.2 out-label 115   

2OAA相关配置

## 使能acsei server

[S12500]acsei server enable

## 配置NSM内联口允许vlan 1通过(跨框镜像的限制),不允许其它vlan通过,避免报文二层广播到前插板

[S12500]inter te 2/2/0/1

[S12500-Ten-GigabitEthernet2/2/0/1]port link-mode bridge

[S12500-Ten-GigabitEthernet2/2/0/1]port link-type trunk

[S12500-Ten-GigabitEthernet2/2/0/1]quit

3Netstream流分类方式配置

IPv4流分类配置

## 配置acl,匹配ipv4单播、组播流

[S12500]acl number 3101

[S12500-acl-adv-3101]rule 0 permit ip source 15.1.1.2 0.0.0.255 destination 30.1.1.2 0.0.0.255

[S12500-acl-adv-3101]acl number 3201

[S12500-acl-adv-3201]rule 0 permit ip source 30.1.1.2 0.0.0.255 destination 15.1.1.2 0.0.0.255

[S12500-acl-adv-3201]acl number 3301

[S12500-acl-adv-3301]rule 0 permit ip source 30.1.1.2 0.0.0.255 destination 225.0.0.1 0.0.0.255

[S12500-acl-adv-3301]quit

## 配置流分类

[S12500]traffic classifier nsm-to-internet-ipv4-uni

[S12500-classifier-nsm-to-internet-ipv4-uni]if-match acl 3101

[S12500-classifier-nsm-to-internet-ipv4-uni]traffic classifier nsm-from-internet-ipv4-uni

[S12500-classifier-nsm-from-internet-ipv4-uni]if-match acl 3201

[S12500-classifier-nsm-from-internet-ipv4-uni]traffic classifier nsm-from-internet-ipv4-mul

[S12500-classifier-nsm-from-internet-ipv4-mul]if-match acl 3301

[S12500-classifier-nsm-from-internet-ipv4-mul]quit

IPv6流分类方式配置

## 配置acl

[S12500]acl ipv6 number 3101

[S12500-acl6-adv-3101]rule 0 permit ipv6 source 2000::F:1:1:0 112 destination 2000::1E:1:1:0 112

[S12500-acl6-adv-3101]acl ipv6 number 3201

[S12500-acl6-adv-3201]rule 0 permit ipv6 source 2000::1E:1:1:0 112 destination 2000::F:1:1:0 112

[S12500-acl6-adv-3201]acl ipv6 number 3301

[S12500-acl6-adv-3301]rule 0 permit ipv6 source 2000::1E:1:1:0 112 destination FF1E::1 112

[S12500-acl6-adv-3301]quit

## 配置流分类

[S12500]traffic classifier nsm-to-internet-ipv6-uni

[S12500-classifier-nsm-to-internte-ipv6-uni]if-match acl ipv6 3101

[S12500-classifier-nsm-to-internet-ipv6-uni]traffic classifier nsm-from-internet-ipv6-uni

[S12500-classifier-nsm-from-internet-ipv6-uni]if-match acl ipv6 3201

[S12500-classifier-nsm-from-internet-ipv6-uni]traffic classifier nsm-from-internet-ipv6-mul

[S12500-classifier-nsm-from-internet-ipv6-mul]if-match acl ipv6 3301

[S12500-classifier-nsm-from-internet-ipv6-mul]quit

MPLS流分类方式配置

## 配置流分类

[S12500]traffic classifier nsm-to-internet-mpls

[S12500-classifier-nsm-to-internet-mpls]if-match mpls-label 115

[S12500-classifier-nsm-to-internet-mpls]traffic classifier cl nsm-from-internet-mpls

[S12500-classifier-nsm-from-internet-mpls]if-match mpls-label 130

[S12500-classifier-nsm-from-internet-mpls]quit

流动作配置

## 配置流动作

[S12500]traffic behavior mir-to-nsm-irf

[S12500-behavior-mir-to-nsm-irf]mirror-to interface Ten-GigabitEthernet2/2/0/1

[S12500-behavior-mir-to-nsm-irf]quit

流镜像策略配置

## 配置qos策略

[S12500]qos policy nsm-to-internet

[S12500-qospolicy-nsm-to-internet]classifier nsm-to-internet-ipv4-uni behavior mir-to-nsm-irf

[S12500-qospolicy-nsm-to-internet]classifier nsm-to-internet-ipv6-uni behavior mir-to-nsm-irf

[S12500-qospolicy-nsm-to-internet]classifier nsm-to-internet-mpls behavior mir-to-nsm-irf

[S12500-qospolicy-nsm-to-internet]qos policy nsm-from-internet

[S12500-qospolicy-nsm-from-internet]classifier nsm-from-internet-ipv4-uni behavior mir-to-nsm-irf

[S12500-qospolicy-nsm-from-internet]classifier nsm-from-internet-ipv4-mul behavior mir-to-nsm-irf

[S12500-qospolicy-nsm-from-internet]classifier nsm-from-internet-ipv6-uni behavior mir-to-nsm-irf

[S12500-qospolicy-nsm-from-internet]classifier nsm-from-internet-ipv6-mul behavior mir-to-nsm-irf

[S12500-qospolicy-nsm-from-internet]classifier nsm-from-internet-mpls behavior mir-to-nsm-irf

[S12500-qospolicy-nsm-from-internet]quit

## 端口上应用qos策略

[S12500]inter g1/4/0/1

[S12500-GigabitEthernet1/4/0/1]qos apply policy nsm-to-internet inbound

[S12500-GigabitEthernet1/4/0/1]inter g2/4/0/2

[S12500-GigabitEthernet2/4/0/2]qos apply policy nsm-to-internet inbound

[S12500-GigabitEthernet2/4/0/2]inter te1/3/0/1

[S12500-Ten-GigabitEthernet1/3/0/1]qos apply policy nsm-from-internet inbound

[S12500-Ten-GigabitEthernet2/4/0/2]inter te2/3/0/2

[S12500-Ten-GigabitEthernet2/3/0/2]qos apply policy nsm-from-internet inbound

[S12500-Ten-GigabitEthernet2/3/0/2]quit

4NSM单板配置

配置管理口地址

## 配置系统名称

[H3C]sysname NSM

## 使能telnet server

[NSM]telnet server enable                          

## 配置管理口ip地址

[NSM]interface GigabitEthernet 0/1

[NSM-GigabitEthernet0/1]ip address 192.168.0.16 24    

[NSM-GigabitEthernet0/1]quit

## 使能telnet口登录权限

[NSM]user-interface vty 0 4                     

[NSM-ui-vty0-4]authentication-mode  none

[NSM-ui-vty0-4]user privilege level 3

[NSM-ui-vty0-4]quit

配置INLINE转发组

## 配置黑洞类型INLINE 转发组1

[NSM]inline-interfaces 1 blackhole

配置与设备互连的内联口使能acsei client

## 内联口配置

[NSM]inter te 0/0

[NSM-Ten-GigabitEthernet0/0]port link-mode bridge

[NSM-Ten-GigabitEthernet0/0]port link-type trunk

[NSM-Ten-GigabitEthernet0/0]acsei-client enable

[NSM-Ten-GigabitEthernet0/0]port inline-interfaces 1

[NSM-Ten-GigabitEthernet0/0]quit

## 此时,125上可以看到NSM单板的信息

[S12500]disp acsei client info

 Total Client Number: 1

 Client ID: 1

 Client Description: SecBlade NS

 Hardware: A.0

 System Software: COMWAREV500R002B81D001

 Application Software: V300R001B08D031

 CPU: RMI XLR732 1000MHz

 PCB Version: A.0

 CPLD Version: 1.0

 Bootrom Version: Basic BootRom Version:1.28,Extend BootRom Version:1.19

 CF card: 247M Bytes Compact Flash Storage Device

 Memory: 2048M Bytes DDR2 SDRAM Memory

 Harddisk:

[S12500]         

业务配置

配置与设备互连的内联口

## 内联口配置,使能IPv4IPv6 netstream

[NSM]inter te 0/0

[NSM-Ten-GigabitEthernet0/0]port trunk permit vlan all

[NSM-Ten-GigabitEthernet0/0]ip netstream inbound

[NSM-Ten-GigabitEthernet0/0]ipv6 netstream inbound

[NSM-Ten-GigabitEthernet0/0]quit

配置NSM主机

## 配置NSM IPv4主机、时间

[NSM]ip netstream timeout active 1

[NSM]ip netstream timeout inactive 10

[NSM]ip netstream export host 192.168.100.2 30014 

## 配置NSM IPv6主机、时间

[NSM]ipv6 netstream timeout active 1

[NSM]ipv6 netstream timeout inactive 10

[NSM]ipv6 netstream export host 192.168.100.2 30014 

## 配置NSM统计MPLS

[NSM]ip netstream mpls

[NSM]ip netstream export version 9

## 配置连接NSM主机的端口地址

[NSM]inter g0/2

[NSM-GigabitEthernet0/2]port link-mode route

[NSM-GigabitEthernet0/2]ip address 192.168.100.1 255.255.255.0

[NSM-GigabitEthernet0/2]quit

## 配置SNMP

[NSM]snmp-agent

[NSM]snmp-agent community read public

[NSM]snmp-agent community write private

[NSM]snmp-agent sys-info version all

四、    配置关键点:

1S12500堆叠时,不支持ACFP动态引流,只能用MQC方式引流;

2S12500堆叠时,MQC跨框时只能重定向到OAA插卡的内联口;

3S12500堆叠口最好是10GE端口;

 


0 个评论

该案例暂时没有网友评论

编辑评论

举报

×

侵犯我的权益 >
对根叔知了社区有害的内容 >
辱骂、歧视、挑衅等(不友善)

侵犯我的权益

×

泄露了我的隐私 >
侵犯了我企业的权益 >
抄袭了我的内容 >
诽谤我 >
辱骂、歧视、挑衅等(不友善)
骚扰我

泄露了我的隐私

×

您好,当您发现根叔知了上有泄漏您隐私的内容时,您可以向根叔知了进行举报。 请您把以下内容通过邮件发送到zhiliao@h3c.com 邮箱,我们会尽快处理。
  • 1. 您认为哪些内容泄露了您的隐私?(请在邮件中列出您举报的内容、链接地址,并给出简短的说明)
  • 2. 您是谁?(身份证明材料,可以是身份证或护照等证件)

侵犯了我企业的权益

×

您好,当您发现根叔知了上有关于您企业的造谣与诽谤、商业侵权等内容时,您可以向根叔知了进行举报。 请您把以下内容通过邮件发送到 zhiliao@h3c.com 邮箱,我们会在审核后尽快给您答复。
  • 1. 您举报的内容是什么?(请在邮件中列出您举报的内容和链接地址)
  • 2. 您是谁?(身份证明材料,可以是身份证或护照等证件)
  • 3. 是哪家企业?(营业执照,单位登记证明等证件)
  • 4. 您与该企业的关系是?(您是企业法人或被授权人,需提供企业委托授权书)
我们认为知名企业应该坦然接受公众讨论,对于答案中不准确的部分,我们欢迎您以正式或非正式身份在根叔知了上进行澄清。

抄袭了我的内容

×

原文链接或出处

诽谤我

×

您好,当您发现根叔知了上有诽谤您的内容时,您可以向根叔知了进行举报。 请您把以下内容通过邮件发送到zhiliao@h3c.com 邮箱,我们会尽快处理。
  • 1. 您举报的内容以及侵犯了您什么权益?(请在邮件中列出您举报的内容、链接地址,并给出简短的说明)
  • 2. 您是谁?(身份证明材料,可以是身份证或护照等证件)
我们认为知名企业应该坦然接受公众讨论,对于答案中不准确的部分,我们欢迎您以正式或非正式身份在根叔知了上进行澄清。

对根叔知了社区有害的内容

×

垃圾广告信息
色情、暴力、血腥等违反法律法规的内容
政治敏感
不规范转载 >
辱骂、歧视、挑衅等(不友善)
骚扰我
诱导投票

不规范转载

×

举报说明

提出建议

    +
<

亲~登录后才可以操作哦!

确定

你的邮箱还未认证,请认证邮箱或绑定手机后进行当前操作