S12500 IRF模式下NSM的典型配置案例

S12500 IRF模式下NSM的典型配置案例

一、    业务需求

1、对端口的出入流量进行框内、跨框NSM；

2、覆盖：IPv4单播、IPv4组播、IPv6单播、IPv6组播、MPLS；

二、    组网图：

三、    配置步骤：

S12500上正常配置业务；

由于涉及跨框镜像，S12500 NSM内联口需要允许VLAN 1通过；

NSM板进行Netstream相关配置；

流镜像方式将125业务口报文镜像到框内、框间NSM内联口处理；

1、S12500基本配置

## IPv4单播相关配置

[S12500]interface LoopBack 0

[S12500-LoopBack0]ip address 1.1.1.1 32

[S12500-LoopBack0]quit

[S12500]inter vlan 15

[S12500-Vlan-interface15]ip address 15.1.1.1 24

[S12500]inter vlan 30

[S12500-Vlan-interface30]ip address 30.1.1.1 24

[S12500-Vlan-interface30]quit

## IPv4组播相关配置

[S12500]multicast routing-enable

[S12500]pim

[S12500-pim]c-bsr LoopBack0

[S12500-pim]c-rp LoopBack0

[S12500-pim]inter vlan 30

[S12500-Vlan-interface30]pim sm

[S12500-Vlan-interface30]inter vlan 15

[S12500-Vlan-interface15]igmp enable

[S12500-Vlan-interface15]quit

## IPv6单播相关配置

[S12500]interface LoopBack 0

[S12500-LoopBack0]ipv6 address 2000::1.1.1.1 128

[S12500-LoopBack0]quit

[S12500]ipv6

[S12500]inter vlan 15

[S12500-Vlan-interface15]ipv6 address 2000::f.1.1.1 112

[S12500]inter vlan 30

[S12500-Vlan-interface30]ipv6 address 2000::1e.1.1.1 112

[S12500-Vlan-interface30]quit

## IPv6组播相关配置

[S12500]multicast ipv6 routing-enable

[S12500]pim ipv6

[S12500-pim6]c-rp 2000::1:1:1:1

[S12500-pim6]c-bsr 2000::1:1:1:1

[S12500-pim]inter vlan 30

[S12500-Vlan-interface30]pim ipv6 sm

[S12500-Vlan-interface30]inter vlan 15

[S12500-Vlan-interface15]mld enable

[S12500-Vlan-interface15]quit

## MPLS相关配置

[S12500]mpls lsr-id 1.1.1.1

[S12500]mpls

[S12500]inter vlan 30

[S12500-Vlan-interface30]mpls

[S12500-Vlan-interface30]inter vlan 15

[S12500-Vlan-interface15]mpls

[S12500-Vlan-interface15]quit

[S12500]static-lsp transit in->out incoming-interface Vlan-interface15 in-label 115 nexthop 30.1.1.2 out-label 130

[S12500]static-lsp transit out->in incoming-interface Vlan-interface30 in-label 130 nexthop 15.1.1.2 out-label 115   

2、OAA相关配置

## 使能acsei server

[S12500]acsei server enable

## 配置NSM内联口允许vlan 1通过（跨框镜像的限制），不允许其它vlan通过，避免报文二层广播到前插板

[S12500]inter te 2/2/0/1

[S12500-Ten-GigabitEthernet2/2/0/1]port link-mode bridge

[S12500-Ten-GigabitEthernet2/2/0/1]port link-type trunk

[S12500-Ten-GigabitEthernet2/2/0/1]quit

3、Netstream流分类方式配置

IPv4流分类配置

## 配置acl，匹配ipv4单播、组播流

[S12500]acl number 3101

[S12500-acl-adv-3101]rule 0 permit ip source 15.1.1.2 0.0.0.255 destination 30.1.1.2 0.0.0.255

[S12500-acl-adv-3101]acl number 3201

[S12500-acl-adv-3201]rule 0 permit ip source 30.1.1.2 0.0.0.255 destination 15.1.1.2 0.0.0.255

[S12500-acl-adv-3201]acl number 3301

[S12500-acl-adv-3301]rule 0 permit ip source 30.1.1.2 0.0.0.255 destination 225.0.0.1 0.0.0.255

[S12500-acl-adv-3301]quit

## 配置流分类

[S12500]traffic classifier nsm-to-internet-ipv4-uni

[S12500-classifier-nsm-to-internet-ipv4-uni]if-match acl 3101

[S12500-classifier-nsm-to-internet-ipv4-uni]traffic classifier nsm-from-internet-ipv4-uni

[S12500-classifier-nsm-from-internet-ipv4-uni]if-match acl 3201

[S12500-classifier-nsm-from-internet-ipv4-uni]traffic classifier nsm-from-internet-ipv4-mul

[S12500-classifier-nsm-from-internet-ipv4-mul]if-match acl 3301

[S12500-classifier-nsm-from-internet-ipv4-mul]quit

IPv6流分类方式配置

## 配置acl

[S12500]acl ipv6 number 3101

[S12500-acl6-adv-3101]rule 0 permit ipv6 source 2000::F:1:1:0 112 destination 2000::1E:1:1:0 112

[S12500-acl6-adv-3101]acl ipv6 number 3201

[S12500-acl6-adv-3201]rule 0 permit ipv6 source 2000::1E:1:1:0 112 destination 2000::F:1:1:0 112

[S12500-acl6-adv-3201]acl ipv6 number 3301

[S12500-acl6-adv-3301]rule 0 permit ipv6 source 2000::1E:1:1:0 112 destination FF1E::1 112

[S12500-acl6-adv-3301]quit

## 配置流分类

[S12500]traffic classifier nsm-to-internet-ipv6-uni

[S12500-classifier-nsm-to-internte-ipv6-uni]if-match acl ipv6 3101

[S12500-classifier-nsm-to-internet-ipv6-uni]traffic classifier nsm-from-internet-ipv6-uni

[S12500-classifier-nsm-from-internet-ipv6-uni]if-match acl ipv6 3201

[S12500-classifier-nsm-from-internet-ipv6-uni]traffic classifier nsm-from-internet-ipv6-mul

[S12500-classifier-nsm-from-internet-ipv6-mul]if-match acl ipv6 3301

[S12500-classifier-nsm-from-internet-ipv6-mul]quit

MPLS流分类方式配置

## 配置流分类

[S12500]traffic classifier nsm-to-internet-mpls

[S12500-classifier-nsm-to-internet-mpls]if-match mpls-label 115

[S12500-classifier-nsm-to-internet-mpls]traffic classifier cl nsm-from-internet-mpls

[S12500-classifier-nsm-from-internet-mpls]if-match mpls-label 130

[S12500-classifier-nsm-from-internet-mpls]quit

流动作配置

## 配置流动作

[S12500]traffic behavior mir-to-nsm-irf

[S12500-behavior-mir-to-nsm-irf]mirror-to interface Ten-GigabitEthernet2/2/0/1

[S12500-behavior-mir-to-nsm-irf]quit

流镜像策略配置

## 配置qos策略

[S12500]qos policy nsm-to-internet

[S12500-qospolicy-nsm-to-internet]classifier nsm-to-internet-ipv4-uni behavior mir-to-nsm-irf

[S12500-qospolicy-nsm-to-internet]classifier nsm-to-internet-ipv6-uni behavior mir-to-nsm-irf

[S12500-qospolicy-nsm-to-internet]classifier nsm-to-internet-mpls behavior mir-to-nsm-irf

[S12500-qospolicy-nsm-to-internet]qos policy nsm-from-internet

[S12500-qospolicy-nsm-from-internet]classifier nsm-from-internet-ipv4-uni behavior mir-to-nsm-irf

[S12500-qospolicy-nsm-from-internet]classifier nsm-from-internet-ipv4-mul behavior mir-to-nsm-irf

[S12500-qospolicy-nsm-from-internet]classifier nsm-from-internet-ipv6-uni behavior mir-to-nsm-irf

[S12500-qospolicy-nsm-from-internet]classifier nsm-from-internet-ipv6-mul behavior mir-to-nsm-irf

[S12500-qospolicy-nsm-from-internet]classifier nsm-from-internet-mpls behavior mir-to-nsm-irf

[S12500-qospolicy-nsm-from-internet]quit

## 端口上应用qos策略

[S12500]inter g1/4/0/1

[S12500-GigabitEthernet1/4/0/1]qos apply policy nsm-to-internet inbound

[S12500-GigabitEthernet1/4/0/1]inter g2/4/0/2

[S12500-GigabitEthernet2/4/0/2]qos apply policy nsm-to-internet inbound

[S12500-GigabitEthernet2/4/0/2]inter te1/3/0/1

[S12500-Ten-GigabitEthernet1/3/0/1]qos apply policy nsm-from-internet inbound

[S12500-Ten-GigabitEthernet2/4/0/2]inter te2/3/0/2

[S12500-Ten-GigabitEthernet2/3/0/2]qos apply policy nsm-from-internet inbound

[S12500-Ten-GigabitEthernet2/3/0/2]quit

4、NSM单板配置

配置管理口地址

## 配置系统名称

[H3C]sysname NSM

## 使能telnet server

[NSM]telnet server enable                          

## 配置管理口ip地址

[NSM]interface GigabitEthernet 0/1

[NSM-GigabitEthernet0/1]ip address 192.168.0.16 24    

[NSM-GigabitEthernet0/1]quit

## 使能telnet口登录权限

[NSM]user-interface vty 0 4                     

[NSM-ui-vty0-4]authentication-mode  none

[NSM-ui-vty0-4]user privilege level 3

[NSM-ui-vty0-4]quit

配置INLINE转发组

## 配置黑洞类型INLINE 转发组1

[NSM]inline-interfaces 1 blackhole

配置与设备互连的内联口使能acsei client

## 内联口配置

[NSM]inter te 0/0

[NSM-Ten-GigabitEthernet0/0]port link-mode bridge

[NSM-Ten-GigabitEthernet0/0]port link-type trunk

[NSM-Ten-GigabitEthernet0/0]acsei-client enable

[NSM-Ten-GigabitEthernet0/0]port inline-interfaces 1

[NSM-Ten-GigabitEthernet0/0]quit

## 此时，125上可以看到NSM单板的信息

[S12500]disp acsei client info

 Total Client Number: 1

 Client ID: 1

 Client Description: SecBlade NS

 Hardware: A.0

 System Software: COMWAREV500R002B81D001

 Application Software: V300R001B08D031

 CPU: RMI XLR732 1000MHz

 PCB Version: A.0

 CPLD Version: 1.0

 Bootrom Version: Basic BootRom Version:1.28,Extend BootRom Version:1.19

 CF card: 247M Bytes Compact Flash Storage Device

 Memory: 2048M Bytes DDR2 SDRAM Memory

 Harddisk:

[S12500]         

业务配置

配置与设备互连的内联口

## 内联口配置，使能IPv4、IPv6 netstream

[NSM]inter te 0/0

[NSM-Ten-GigabitEthernet0/0]port trunk permit vlan all

[NSM-Ten-GigabitEthernet0/0]ip netstream inbound

[NSM-Ten-GigabitEthernet0/0]ipv6 netstream inbound

[NSM-Ten-GigabitEthernet0/0]quit

配置NSM主机

## 配置NSM IPv4主机、时间

[NSM]ip netstream timeout active 1

[NSM]ip netstream timeout inactive 10

[NSM]ip netstream export host 192.168.100.2 30014 

## 配置NSM IPv6主机、时间

[NSM]ipv6 netstream timeout active 1

[NSM]ipv6 netstream timeout inactive 10

[NSM]ipv6 netstream export host 192.168.100.2 30014 

## 配置NSM统计MPLS

[NSM]ip netstream mpls

[NSM]ip netstream export version 9

## 配置连接NSM主机的端口地址

[NSM]inter g0/2

[NSM-GigabitEthernet0/2]port link-mode route

[NSM-GigabitEthernet0/2]ip address 192.168.100.1 255.255.255.0

[NSM-GigabitEthernet0/2]quit

## 配置SNMP

[NSM]snmp-agent

[NSM]snmp-agent community read public

[NSM]snmp-agent community write private

[NSM]snmp-agent sys-info version all

四、    配置关键点：

1、S12500堆叠时，不支持ACFP动态引流，只能用MQC方式引流；

2、S12500堆叠时，MQC跨框时只能重定向到OAA插卡的内联口；

3、S12500堆叠口最好是10GE端口；