#huawei gpon

[thunderlinkcom]

How to Deploying Network Devices (GPON Upstream)

This topic describes how to deploy network devices in the scenario with or without the NMS.

Prerequisites

Network devices and lines must be in the normal state.

The control board and the GPON service board of the OLT must be in the normal state.

Context

When the ONU adopts the GPON upstream transmission, the SN is used for authentication.

Scenario with the NMS

The procedure for deploying network devices in the scenario with the NMS is as follows: 

1, According to the user's FTTx data plan, the commissioning engineer prepares the network planning sheet and obtains the resource deployment sheet.

2, The commissioning engineer imports the resource deployment sheet through the NMS to implement the predeployment for the ONU.

3, The hardware installation engineer draws the ONUs and sends them to the destination sites, and then performs hardware installation, wiring, and power-on operations at the destination sites.

4, The hardware installation engineer checks the running status of the ONU that is installed and powered on.

There are two LEDs, namely Link and Auth, on the ONU.

If the Link LED is on, it indicates that the upstream optical path is through.

If the Auth LED is blinking, it indicates that the ONU is registering.

If the Auth LED is always on, it indicates that the ONU registers successfully.

5, After confirming that the ONU works in the normal state (the Link LED is on and the Auth LED blinks), the hardware installation engineer records the ONU SN and reports the SN to the commissioning engineer.

6, The commissioning engineer maps the ONU SN, the management IP address of the ONU, and the physical position of the ONU, and binds the IP address and the SN of the ONU through the NMS.

7, After being powered on, the ONU registers with the OLT automatically. Then, the OLT sends the management channel parameters of the ONU (management VLAN, IP address, and SNMP parameters) to the ONU and also sends the trap message to the NMS for informing the NMS that an ONU goes online.

8, The commissioning engineer receives the trap indicating that the ONU goes online reported by the OLT on the NMS.

9, After the trap indicating that the ONU goes online is received on the NMS, the ONU management channel is enabled successfully. Then, you can remotely configure services for the ONU through the NMS.

More related:

Huawei OLT

Huawei GPFD

Huawei MA5680T

[thunderlinkcom]

How to configure QinQ VLAN

This topic describes how to configure the private line service based on the QinQ feature to provide security channel for data transmission between private networks of the enterprises.

Prerequisites

The upper-layer network must work in the L2 mode, and must forward packets according to the VLAN and the MAC address.

Service Requirements

The private networks of enterprise A distributed in two places can communicate with each other in the normal state.

Networking

shows an example network for configuring the private line service.

The two branches of enterprise A are connected to the MAN through the Huawei MA5600. On the MA5600, the attribute of the upstream VLAN of user packets is configured as QinQ private line service. In this manner, services and BPDU packets from the private network of the enterprise can be transparently transmitted to the peer private network.

The configuration on MA5600_A is the same as the configuration on MA5600_B. The following uses the configuration on Huawei MA5600_A as an example to describe how to configure the private line service implemented through a QinQ VLAN.

Result

After the configuration, the two branches of enterprise A can communicate with each other, and various services between private networks are implemented.

Huawei MA5616

Huawei MA5616 Gold Line

Huawei MA5616 Silver Line

More related:

How to modify a GPON UNI Port?

How to configure Multicast Global Parameters

How to Set the Layer2 Isolation Status Parameters?

[thunderlinkcom]

How to Configure the Remote AAA (RADIUS Protocol)

The Huawei MA5600 is interconnected with the RADIUS server through the RADIUS protocol to implement authentication.

Background Information

What is RADIUS:

Principles of RADIUS:

Specification:

The configuration of the RADIUS protocol defines only the essential parameters for the information exchange between the Huawei MA5600 and the RADIUS server. To make the essential parameters take effect, the RADIUS server group needs to be referenced in a certain domain.

RADIUS is short for the remote authentication dial-in user service. It is a distributed information interaction protocol with the client/server structure. Generally, it is used to manage a large number of distributed dial-in users.

RADIUS implements the user authentication by managing a simple user database, and adjusts the user service information according to the user service type and rights.

The authentication request of users can be passed on to the RADIUS server through a network access server (NAS).

When a user tries to access another network (or some network resources) by setting up a connection to the NAS through a network, the NAS forwards the user authentication information to the RADIUS server. The RADIUS protocol specifies the means of transmitting the user information between the NAS and the RADIUS server.

The RADIUS server receives the connection requests of users sent from the NAS, authenticates the user account and password contained in the user data, and returns the required data to the NAS.

For the Huawei MA5600, the RADIUS is configured based on each RADIUS server group.

In actual networking, a RADIUS server group can be any of the following:

The following lists the attributes of a RADIUS server template:

An independent RADIUS server

A pair of primary/secondary RADIUS servers with the same configuration but different IP addresses

IP addresses of primary and secondary servers

Shared key

RADIUS server type

Contact information:

Telephone: [phone]

Email: [email protected]     [email protected]

Website: http://www.thunder-link.com/

More related:

How to configure Anti-Attack

How to modify a GPON UNI Port

How to Set the Layer2 Isolation Status Parameters

[thunderlinkcom]

How to configure Anti-Attack

Enabling anti-DoS attack and anti-ICMP/IP attack, and configuring the source route filtering and source MAC address filtering functions can prevent malicious users' attack on the system, so as to improve system security.

Background Information

The Huawei MA5600 supports the following measures to prevent malicious users' attack on the system. Choose measures according to actual requirements.

Anti-DoS attack: Indicates the defensive measures taken by the system to receive only a certain number of control packets sent from a user.

Anti-ICMP attack: Indicates the defensive measures taken by the system to drop the ICMP packets sent from the user-side device to the MA5600. This is to prevent the user-side device from pinging the VLAN interface of the Huawei MA5600.

Anti-IP attack: Indicates the defensive measures taken by the system to drop the IP packets sent from the user-side device to the MA5600.

Source route filtering: Indicates the defensive measures taken by the system to filter the IP packets that are sent by the user and carry the routing option field.

Source MAC address filtering: Indicates the defensive measures taken by the system to filter the packets that are sent by the user and carry certain source MAC addresses.

User-side ring network check: Indicates the defensive measures taken by the system to check user-side ring networks. In this manner, the system can process ring networks to prevent ring networks from affecting services.

Procedure

Configure anti-DoS attack.

Configure anti-ICMP attack.

Enable anti-IP attack.

Enable the source route filtering function.

Configure the MAC address filtering function.

Run the security anti-dos enable command to enable anti-DoS attack. After the anti-DoS attack function is enabled, the system adds the user port to the blacklist if the receive rate of the control packet of the user reaches a preset value. When anti-DoS attack is disabled, the system deletes the blacklist.

Application scenario: Two PCs (PC1 and PC2) are connected to the network through the MA5600. If a malicious user (PC1) sends a large number of protocol control packets to attack the CPU of the MA5600, the CPU usage of the MA5600 will be over high, and then the MA5600 is unable to process the services of another user (PC2). To implement anti-DoS attack, shield the attack port to protect the MA5600 from being attacked.

Run the security anti-icmpattack enable command to enable anti-ICMP attack. Anti-ICMP attack is used to prevent the user-side device from pinging the VLAN interface of the Huawei MA5600.

Application scenario: Two PCs (PC1 and PC2) are connected to the network through the MA5600. When PC2 sends a large number of ICMP packets to the VLAN interface, the services of the user (PC1) that obtains the upper-layer DHCP information through the same VLAN interface will be abnormal. To implement anti-ICMP attack, directly drop the user-side ICMP packets if the IP address of the VLAN interface on the MA5600 is its destination IP address.

Run the security anti-ipattack enable command to enable anti-IP attack. The anti-IP attack is used to prevent user-side IP packets from attacking the L3 interface of the device or to prevent illegal users from logging in to the device through telnet.

Application scenario: When a PC sends the packets with the address of VLAN x as the destination IP address to VLANIF x, it may send a large number of packets to attack the device, causing the device to fail to process normal services; when a user knows the address of VLAN x, or the user name and password for logging in to the device, it may log in to the device through telnet to randomly change the configurations of the device. To prevent the two preceding cases, the device needs to implement anti-IP attack. With this feature, the device drops the packets with the address of the device interface as the destination IP address to prevent the user from attacking the device.

Run the security source-route enable command to enable the source route filtering function. This function is used to filter the packets that carry the routing information and are reported to the L3 switch.

Application scenario: In general, routes are dynamic and application does not control route selection. The sender can add the routing information to IP packets through the source route to perform route selection. In this case, packets go along a specific route on the network according to the intention of the sender. To prevent the preceding cases, enable the source route filtering function. Then the MA5600 performs validity check on IP packets and drops the packets that match the source route options.

Run the security mac-filter command to enable the MAC address filtering function.

Application scenario: To prevent users from forging the MAC address of the network-side device, or forging certain renowned MAC addresses, set the MAC address of the network-side as the MAC address to be filtered.

Contact information:

Telephone: [phone]

Email: [email protected]     [email protected]

Website: http://www.thunder-link.com/

More related:

How to Configuring an xDSL Port

How to configure the VoD Service

How to configure Link Aggregation and Security Policy

[thunderlinkcom]

What troubleshooting skills need engineers to have

Skill Requirements

Maintenance engineers need to possess troubleshooting skills so that they can troubleshoot faults successfully.

Maintenance engineers need to master the following:

Basics of communications technologies

Networking, services, and functions of the Huawei MA5600/MA5603

Common operations for locating faults in the MA5600/MA5603, in addition to:

Use of common test tools and instruments, including:

Methods of determining and handling emergencies in the devices (these methods can be mastered through practice and before practice the relevant standards and requirements of carriers need to be known about)

How to seek help in case of a fault, including but not limited to referring to the troubleshooting documents or contacting Huawei for assistance

Computer network technologies, such as Ethernet and TCP/IP

X digital subscriber line (xDSL) access technology

Principles of the multicast service

Actual networking conditions

Hardware structure and performance specifications of the Huawei MA5600/MA5603

Functions of boards and slots for boards on the MA5600/MA5603

Working principles of services and functions of the MA5600/MA5603

Service configurations of the Huawei MA5600/MA5603

Connections between the MA5600/MA5603 and the other devices over the network

Protocols used between the MA5600/MA5603 and the other devices over the network

Which operations may completely or partially interrupt the service

Which operations may result in customer complaints

Which emergency or backup measures are available

Which operations may damage the equipment

Multimeter

Line tester

Optical power meter

Optical attenuator

Huawei MA5600

Huawei DSLAM 

More related:

GPON Board common command guide

OLT Board Status Configuration guide

How’s the Powering On the Outdoor Device of MA5600 

[thunderlinkcom]

Configuring a GPON ONT

The MA5680T   MA5683T  provides end users with services through the ONT. The MA5600T/MA5603T can manage the Huawei ONT and the ONT can work in the normal state only after the channel between the MA5600T/MA5603T and the ONT is available.

To add five ONTs in offline mode with password authentication mode (ONT passwords are 0100000001-0100000005), set the discovery mode of password authentication to always-on, and bind ONT capability profile 10, do as follows:

huawei(config)#interface gpon 0/2

huawei(config-if-gpon-0/2)#ont add 0 password-auth 0100000001 always-on profile-id 10 manage-mode omci

huawei(config-if-gpon-0/2)#ont add 0 password-auth 0100000002 always-on profile-id 10 manage-mode omci

huawei(config-if-gpon-0/2)#ont add 0 password-auth 0100000003 always-on profile-id 10 manage-mode omci

huawei(config-if-gpon-0/2)#ont add 0 password-auth 0100000004 always-on profile-id 10 manage-mode omci

huawei(config-if-gpon-0/2)#ont add 0 password-auth 0100000005 always-on profile-id 10 manage-mode omci

To add an ONT that is managed by the OLT through the OMCI protocol, confirm this ONT according to the SN 3230313185885B41 automatically reported by the system, and bind the ONT with capability profile 3 that match the ONT, do as follows:

huawei(config)#interface gpon 0/2

huawei(config-if-gpon-0/2)#port 0 ont-auto-find enable

huawei(config-if-gpon-0/2)#ont confirm 0 sn-auth 3230313185885B41 profile-id 3 manage-mode omci

To add an ONU that is managed as an independent NE and whose SN is known as 3230313185885641, bind the ONU with capability profile 4 that matches the ONU, configure the NMS parameters for the ONU, and set the management VLAN to 100, do as follows:

huawei(config)#snmp-profile add profile-id 1 v2c public private 10.10.5.53 161 huawei

huawei(config)#interface gpon 0/2

huawei(config-if-gpon-0/2)#ont add 0 2 sn-auth 3230313185885641 profile-id 4 manage-mode snmp

huawei(config-if-gpon-0/2)#ont ipconfig 0 2 static ip-address 10.20.20.20 mask 255.255.255.0 gateway 10.10.20.1 vlan 100

huawei(config-if-gpon-0/2)#ont snmp-profile 0 2 profile-id 1

huawei(config-if-gpon-0/2)#ont snmp-route 0 2 ip-address 10.10.20.190 mask 255.255.255.0 next-hop 10.10.20.100

More related: Huawei OLT MA5600T Series Equipment Upgrade Instructions Huawei OLT MA5600T Series Equipment Upgrade Instructions How To Reset Huawei OLT MA5600T Series Equipment Password MA5600T Backup Redundant of Configuration Smart Link Application of Time-range In HUAWEI MA5600 Series Equipment

[classyfoxwombat-blog-blog]

Notice on Prewarning for High Memory Usage of the MA5600T

Keywords:

N2510 performance measurement  high memory usage

[Fault Description]

Trigger conditions:

The N2510 periodically measures Huawei OLT MA5600T performance.

Symptom:

The Huawei MA5600Tis of high memory usage. The result queried by running the display mem f/s command shows that the memory usage of the active control board is much higher than that of the standby control board.

Identification method:

1. After a period of time, such as 24 hours or 48 hours, run the display mem 0/9 command to query the memory usage of the control board. It is found that the memory usage increases.

2. Compare the memory usage of the active control board with that of the standby control board to determine whether the memory usage of the active control board is high.

[Root Cause]

The N2510 periodically obtains the data of the xDSL line profile. When the N2510 obtains the data of the VDSL mode profile (vdsl2LineConfProfModeSpecTable), the MA5600T encounters a performance-related problem. As a result, the memory usage of the active control board decreases and cannot recover in time.

[Impact and Risk]

After a long period of time, the memory of the active control board is exhausted and the OLT cannot be managed by the NMS.

[Measures and Solutions]

Recovery measures:

If the memory usage of the control board is higher than 85%, run the following command to perform active/standby switchover to transfer services from the active control board to the standby board.

Huawei GPON MA5600T(config)#system switch-over

Preventive measures:

This issue will be resolved in MA5600T V800R007C00SPC310?2010-12-10? and later versions.

[Rectification Scope and Time Requirements]

None

[Notice Expiration]

This notice automatically expires in versions later than

Huawei Fixed Access Network

MA5600T V800R007C00SPC310.

[classyfoxwombat-blog-blog]

Huawei Commercially Launches the World’s First 10Gbps Broadband Service with HKT

Lately,Huawei announces its cooperation with Hong Kong Telecom(HKT), to introduce the world’s first 10Gbps Fiber-To-The-Home (FTTH) access by using Huawei XG-PON (also known as 10G-Huawei GPON) solution, which brings in high-definition video and more beautiful experience for users in Hong Kong .

Hong Kong Telecom launched 10Gbps broadband services in early 2015, while services is only provided to specific customers in the early stage, and extend to general customers in the third quarter. Hong Kong Telecom together with Huawei successfully completed the world's first commercial deployment of 10Gbps access, via covered wide range of fiber-optic telecommunications network, the 10G-GPON solution performs 10 times faster than current offering in terms of speed, be the first in the world to broadband access leading to 10Gbps access era.

High speed connection is very suitable for high-definition multimedia content such as cloud-based platform for sharing and storage. Users can upload and download numerous photos and videos like local storage, for example, it would takes only 20 seconds or so to download 25GB HD movie at the rate of 10Gbps. Users will also be able to select their preferred 4K camera viewing angle, the resolution available through the transmission will be four times sharper than conventional HD.

Currently, Huawei has already completed the 10Gbps business preparation issuance based on 10G-GPON with Hong Kong Telecom, it can be provided to specific users in the second quarter of 2015, based on a new generation of Huawei OLT platform MA5800 and its unique XG-PON gateway ONT (Optical network terminal, optical network terminal), users can experience the 10Gbps Internet download speed, 1Gbps Wi-Fi speed and 5Gbps USB3.0 speed and experience has been significantly improved at the same time.

As a global leader in the field of fixed access network, Huawei is building a future-oriented leading network for customers through SingleFAN solutions, and integrating GPON / 10G-GPON / TWDM-PON through a unified platform. Huawei’s SingleFAN solutions have been serving more than 1/3 broadband users, to provide users with ultra-bandwidth access services, enrich people's lives through communication.