#s5700

[hongtelecom-blog]

Port Numbering Conventions of Huawei S2700 S5700 S6700 Switches

Port Numbering Conventions of Huawei S2700 S5700 S6700 Switches

Huawei Campus Switch includes S1700, S2300, S2700, S3300, S3700, S5300, S5700, S600-E, S6300, S6700, S7700, S7900, S9300, S9300X, S9700, S12700 Series. In this article, HongTelecom will introduce the Port Numbering Conventions of Huawei S2700 S5700 S6700 Switches.

Port Numbering Conventions

Physical ports are numbered in the following way:

A single switch uses slot ID/subcard ID/port sequence…

View On WordPress

[hongtelecom-blog]

Huawei S5700 Product Characteristics

Huawei S5700 Product Characteristics

Huawei Campus Switch includes S1700, S2300, S2700, S3300, S3700, S5300, S5700, S600-E, S6300, S6700, S7700, S7900, S9300, S9300X, S9700, S12700 Series. In this article, HongTelecom will introduce the Huawei S5700 Product Characteristics.

management more agilely

The S5720-HI and S5730-HI use the Packet Conservation Algorithm for Internet (iPCA) technology that changes the traditional method of…

View On WordPress

[hongtelecom-blog]

Huawei S5700 Product Characteristics

Huawei S5700 Product Characteristics

Huawei Campus Switch includes S1700, S2300, S2700, S3300, S3700, S5300, S5700, S600-E, S6300, S6700, S7700, S7900, S9300, S9300X, S9700, S12700 Series. In this article, HongTelecom will introduce the Huawei S5700 Product Characteristics.

management more agilely

The S5720-HI and S5730-HI use the Packet Conservation Algorithm for Internet (iPCA) technology that changes the traditional method of…

View On WordPress

[thunderlinkcom]

Application of the S5700 on a Large-scale Enterprise Campus Network

This section describes the application of the S5700 on a large-scale enterprise campus network.

As shown in Figure 1, the Huawei S5700 is deployed at the access layer of a campus network to provide high performance, multi-service, and highly reliable enterprise network.

Figure 1

Position of the S5700 on a Large-scale enterprise campus network.

The S5700 provides various terminal security management features, and supports functions such as PoE, voice VLAN, and QoS. The S5700 can be used for desktop access and provides GE access.

The S5700 provides various security features including ARP security, IP security, IP source guard, and user access control policies such as NAC and ACLs, to control access of user terminals.

The S5700 provides Easy-Operation and USB-based deployment, which facilitates deployment and management.

[thunderlinkcom]

FW1 configuration file

S1720&S2700&S3700&S5700&S6700&S7700&S9700 Series Switches

# interface Eth-Trunk1 alias Eth-Trunk1 ip address 10.1.1.1 255.255.255.0 # interface Eth-Trunk4 alias Eth-Trunk4 ip address 10.10.2.2 255.255.255.0 vrrp vrid 1 virtual-ip 10.10.2.5 master # interface Eth-Trunk5 alias Eth-Trunk5 ip address 10.10.3.2 255.255.255.0 vrrp vrid 2 virtual-ip 10.10.3.5 master # interface GigabitEthernet0/0/0 alias GE0/MGMT ip address 192.168.0.1 255.255.255.0 dhcp select interface dhcp server gateway-list 192.168.0.1 # interface GigabitEthernet1/0/0 undo enable snmp trap updown physic-status eth-trunk 4 # interface GigabitEthernet1/0/1 undo enable snmp trap updown physic-status eth-trunk 4 # interface GigabitEthernet1/1/0 undo enable snmp trap updown physic-status eth-trunk 5 # interface GigabitEthernet1/1/1 undo enable snmp trap updown physic-status eth-trunk 5 # interface GigabitEthernet2/0/0 undo enable snmp trap updown physic-status eth-trunk 1 # interface GigabitEthernet2/0/1 undo enable snmp trap updown physic-status eth-trunk 1 # firewall zone local set priority 100 # firewall zone trust set priority 85 add interface Eth-Trunk5 add interface GigabitEthernet0/0/0 # firewall zone untrust set priority 5 add interface Eth-Trunk4 # firewall zone dmz set priority 50 add interface Eth-Trunk1 # ip route-static 0.0.0.0 0.0.0.0 10.10.2.1 ip route-static 10.10.100.0 255.255.255.0 10.10.3.1 ip route-static 10.10.200.0 255.255.255.0 10.10.3.1 # sysname FW1 # hrp enable hrp interface Eth-Trunk1 remote 10.1.1.2 # firewall packet-filter default permit interzone local trust direction inbound firewall packet-filter default permit interzone local trust direction outbound firewall packet-filter default permit interzone local untrust direction outbound firewall packet-filter default permit interzone local dmz direction inbound firewall packet-filter default permit interzone local dmz direction outbound # return

[thunderlinkcom]

The important factors which Layer fourth switches have

Layer fourth switches are widely used in daily life, what are the differences between the fourth layer switch and the second, the three layer switch, and the fourth layer switch than the previous switch advantage in where? The followingdetails.

As mentioned above, the second layer switching equipment is dependent on the MAC addresses and the 802.1Q protocol of VLAN tag information to complete the link layer exchange process, the third layer switching / routing device is the IP address information to the network path selection to complete the transfer process, the fourth layer switching equipment is used in the transport layer data packet information in Baotou to help the information exchange and transmission processing.

That is to say, the specific content description of the fourth layer switch for the exchange of information, is essentially a contained in each IP package of allagreements or process, such as used in the Web transport HTTP for file transfer, FTP, used for terminal communication Telnet, the SSL protocol for secure communications.

So, in a IP network, fourth layers of the widespread use of the exchange agreement, actually is TCP (for connection based on dialogue, such as FTP)and UDP (with no connection to the communication, such as SNMP or SMTPbased on the two protocol). As the Baotou TCP and UDP packet includes not only “the domain port”, it also points out the packets being transmitted is what type of network data.

The use of this related to application specific information (port), can be completed with a large amount of network data and information transmission and exchange related to quality service, the most worthy of note is the following five important application technology, because they are the maintechnology widely used fourth layer switch(such as S5700, S7700).

The packet filter / safety control: in most routers, with fourth layers of information to define filter rule has become the default standard, so there are many routers are used as the packet filter firewall, the firewall can be configured in not only allow or prohibit connecting IP subnets.

Can also control the specified TCP/UDP port communication. And based on the traditional software router is not the same, the main difference in the third layer fourth layer exchange exchange difference, is to filter this ability is realized in the high-speed dedicated chip ASIC, thereby enabling the securitycontrol mechanism can all quickly, greatly improves the packet filtering rate.

Service quality: in the hierarchy of network system, the fourth layers of the TCP/UDP information, often used to build the application level communicationpriority. If there is no fourth layer switching concept, service quality and service level will inevitably subject to the second layer and the third layer provides information, such as MAC address, port, IP subnet or VLAN.

Obviously, in the information communication, hampered due to lack of fourth layers of information, priority emergency applications will be impossible, rapidtransmission which can prevent emergency applications on the network. The fourth layer switch allows the destination address, destination port number(application service) based on the combination of priority, high level of serviceand emergency applications can access network.

The server load balancing: balancing traffic load support provided in multiple servers similar service content between fourth layers of information is crucial.Therefore, the fourth layer switch in the core network system, responsible forthe server load balancing is a very important application.

Load balancing modes supported by the fourth layer switch server, is attached to a load balancing service IP address, consisting of a set by different physical servers, to provide the same service, and define it as a separate virtual server.

This virtual server is a single IP address logical server, user data streamsimply point to the virtual IP address of the server, instead of the real physical server IP address for communication. Only through the exchange performsnetwork address translation (NAT), are not registered IP address of the serverto obtain the ability to access. Another benefit of this virtual server is theserver, hide the actual IP address, can effectively prevent unauthorized access.

The virtual server is based on Application Service (fourth TCP/UDP port number) defined, thus, independent server can be members of virtual server.While the use of fourth layer dialogue marks information, layer fourth switchescan use many load balancing method, converting the communication traffic in the virtual server group, including OSPF, RIP and VRRP protocols and line speed switching and load balancing is consistent.

The fourth layer switch can also be used to be called TRL (Transaction RateLimiting) function provided by the complex mechanism, according to the flow characteristic to curb or reject different types of application services. You can use CRL (Connections Rate Limiting) function, the network administrator to specify the connections are allowed in a given time period, guarantee QoS. or with the aid of SYN-Guard function, to ensure that legitimate connectionsatisfies the TCP protocol can query the network service.

The host: standby link provides redundant connection host standbyconnection port equipment, thus effectively protect the system in the switch failure, this service allows to define the main switch, the virtual server definition, they have the same configuration parameters.

Because the fourth layer switch to share the same MAC address, backupswitch receives and the main unit are the same data. Communication contentwhich makes backup switches to monitor the main switch service. The main switch continued to inform the backup switch fourth

[thunderlinkcom]

Configuration Files

S1720&S2700&S3700&S5700&S6700&S7700&S9700 Series Switches

Core switch configuration file # sysname CORE # vlan batch 100 # interface Vlanif100 ip address 10.10.100.4 255.255.255.0 # interface Eth-Trunk3 port link-type trunk port trunk allow-pass vlan 100 mode lacp # interface Eth-Trunk4 port link-type trunk port trunk allow-pass vlan 100 mode lacp # interface GigabitEthernet0/0/3 eth-trunk 3 # interface GigabitEthernet0/0/4 eth-trunk 4 # interface GigabitEthernet1/0/3 eth-trunk 3 # interface GigabitEthernet1/0/4 eth-trunk 4 # ospf 1 router-id 10.3.3.3 area 0.0.0.0 network 10.10.100.0 0.0.0.255 network 10.10.10.0 0.0.0.255 network 10.10.20.0 0.0.0.255 network 10.10.30.0 0.0.0.255 # ip route-static 0.0.0.0 0.0.0.0 10.10.100.1 # return Issue 06 (2016-03-16) Huawei Proprietary and Confidential Copyright © Huawei Technologies Co., Ltd. 21 l RouterA configuration file # sysname RouterA # acl number 3000 rule 5 deny ip source 10.10.10.0 0.0.0.255 destination 10.10.200.0 0.0.0.255 rule 10 deny ip source 10.10.20.0 0.0.0.255 destination 10.10.200.0 0.0.0.255 rule 15 permit ip source 10.10.10.0 0.0.0.255 acl number 3001 rule 5 permit ip source 10.10.10.0 0.0.0.255 destination 10.10.200.0 0.0.0.255 rule 10 permit ip source 10.10.20.0 0.0.0.255 destination 10.10.200.0 0.0.0.255 # ipsec proposal tran1 esp authentication-algorithm sha2-256 esp encryption-algorithm aes-128 # ike proposal 5 encryption-algorithm aes-cbc-128 # ike peer vpn v1 pre-shared-key cipher "@J*U2S*(7F,YWX*NZ55OA!! ike-proposal 5 dpd type periodic dpd idle-time 10 remote-address 203.10.1.2 # ipsec policy ipsec_vpn 10 isakmp security acl 3001 ike-peer vpn proposal tran1 # interface Eth-Trunk1 undo portswitch mode lacp-static # interface Eth-Trunk1.100 dot1q termination vid 100 ip address 10.10.100.2 255.255.255.0 vrrp vrid 1 virtual-ip 10.10.100.1 vrrp vrid 1 priority 120 vrrp vrid 1 track interface GigabitEthernet1/0/0 reduced 40 arp broadcast enable # interface GigabitEthernet1/0/0 ip address 202.10.1.2 255.255.255.0 ipsec policy ipsec_vpn nat server protocol tcp global 202.10.100.3 www inside 10.10.30.2 8080 nat outbound 3000 # interface GigabitEthernet2/0/0 eth-trunk 1 # interface GigabitEthernet2/0/1 eth-trunk 1 # ospf 1 router-id 10.1.1.1 area 0.0.0.0 network 10.10.100.0 0.0.0.255 # ip route-static 0.0.0.0 0.0.0.0 202.10.1.1 # return l RouterB configuration file # sysname RouterB Issue 06 (2016-03-16) Huawei Proprietary and Confidential Copyright © Huawei Technologies Co., Ltd. 22 # acl number 3000 rule 5 deny ip source 10.10.10.0 0.0.0.255 destination 10.10.200.0 0.0.0.255 rule 10 deny ip source 10.10.20.0 0.0.0.255 destination 10.10.200.0 0.0.0.255 rule 15 permit ip source 10.10.10.0 0.0.0.255 acl number 3001 rule 5 permit ip source 10.10.10.0 0.0.0.255 destination 10.10.200.0 0.0.0.255 rule 10 permit ip source 10.10.20.0 0.0.0.255 destination 10.10.200.0 0.0.0.255 # ipsec proposal tran1 esp authentication-algorithm sha2-256 esp encryption-algorithm aes-128 # ike proposal 5 encryption-algorithm aes-cbc-128 # ike peer vpn v1 pre-shared-key cipher "@J*U2S*(7F,YWX*NZ55OA!! ike-proposal 5 dpd type periodic dpd idle-time 10 remote-address 203.10.1.2 # ipsec policy ipsec_vpn 10 isakmp security acl 3001 ike-peer vpn proposal tran1 # interface Eth-Trunk1 undo portswitch mode lacp-static # interface Eth-Trunk1.100 dot1q termination vid 100 ip address 10.10.100.3 255.255.255.0 vrrp vrid 1 virtual-ip 10.10.100.1 arp broadcast enable # interface GigabitEthernet1/0/0 ip address 202.10.2.2 255.255.255.0 ipsec policy ipsec_vpn nat server protocol tcp global 202.10.100.3 www inside 10.10.30.2 8080 nat outbound 3000 # interface GigabitEthernet2/0/0 eth-trunk 1 # interface GigabitEthernet2/0/1 eth-trunk 1 # ospf 1 router-id 10.2.2.2 area 0.0.0.0 network 10.10.100.0 0.0.0.255 # ip route-static 0.0.0.0 0.0.0.0 202.10.2.1 # return l Configuration file of the branch egress router RouterC # sysname RouterC # acl number 3000 rule 5 deny ip source 10.10.200.0 0.0.0.255 destination 10.10.10.0 0.0.0.255 rule 10 deny ip source 10.10.200.0 0.0.0.255 destination 10.10.20.0 0.0.0.255 rule 15 permit ip source 10.10.200.0 0.0.0.255 Issue 06 (2016-03-16) Huawei Proprietary and Confidential Copyright © Huawei Technologies Co., Ltd. 23 acl number 3001 rule 5 permit ip source 10.10.200.0 0.0.0.255 destination 10.10.10.0 0.0.0.255 rule 10 permit ip source 10.10.200.0 0.0.0.255 destination 10.10.20.0 0.0.0.255 # ipsec proposal tran1 esp authentication-algorithm sha2-256 esp encryption-algorithm aes-128 # ike proposal 5 encryption-algorithm aes-cbc-128 # ike peer vpnr1 v1 pre-shared-key cipher "@J*U2S*(7F,YWX*NZ55OA!! ike-proposal 5 dpd type periodic dpd idle-time 10 remote-address 202.10.1.2 # ike peer vpnr2 v1 pre-shared-key cipher "@J*U2S*(7F,YWX*NZ55OA!! ike-proposal 5 dpd type periodic dpd idle-time 10 remote-address 202.10.2.2 # ipsec policy ipsec_vpn 10 isakmp security acl 3001 ike-peer vpnr1 proposal tran1 # ipsec policy ipsec_vpn 20 isakmp security acl 3001 ike-peer vpnr2 proposal tran1 # interface GigabitEthernet1/0/0 ip address 203.10.1.2 255.255.255.0 ipsec policy ipsec_vpn nat outbound 3000 # ip route-static 0.0.0.0 0.0.0.0 203.10.1.1 # return l Configuration file of the headquarters carrier router RouterD # sysname RouterD # interface GigabitEthernet1/0/0 ip address 202.10.1.1 255.255.255.0 # interface GigabitEthernet2/0/0 ip address 202.10.2.1 255.255.255.0 # ip route-static 202.10.100.0 255.255.255.0 202.10.1.2 preference 40 ip route-static 202.10.100.0 255.255.255.0 202.10.2.2 # return l Configuration file of the branch carrier router RouterE # sysname RouterE # interface GigabitEthernet1/0/0 ip address 203.10.1.1 255.255.255.0 # return

[thunderlinkcom]

What Web-based Management Features Does S3700 V100R007 Support?

What Web-based Management Features Does S1700 V100R007 Support?

Among all S1700 models of V100R007C00, only the S1700-28FR-2T2P-AC, S1700-28GFR-4P-AC, S1700-52FR-2T2P-AC, and S1700-52GFR-4P-AC support web management.

S1700 V100R007 is available in web-managed and web-unmanaged models. Table 1 lists the web-based management features supported by S1700 web-managed switches in V100R007.

Table 1

Web-based management features supported by S3700 web-managed switches in V100R007

Menu

Submenu

Description

Device Summary

Device Summary

Displays a switch's front panel, device information, and running status.

System Management

Reset Factory

Restores the factory settings.

Reboot

Restarts a switch with the specified software version and configuration file.

Software Upgrade

Upgrades a switch's firmware version using HTTP or FTP.

File System Management

Uploads, downloads, or deletes files in a switch's flash memory.

System Configuration

Sets the system name and connection timeout period for a switch.

SNTP

SNTP Server Configuration: sets SNTP server parameters.

Time Configuration: manually sets the system time.

IP Management

Views and configures the management VLAN and management IPv4/IPv6 address for a switch.

ARP

Configures ARP.

IPv6 Neighbor

Configures static IPv6 neighbor relationships, views dynamic neighbor relationships, and views/configures route advertisement information.

Interface Management

Ethernet Interface

Basic Attributes: displays connection status of each Ethernet interface, and configures basic attributes of one or more Ethernet interfaces.

Statistics on Interface: displays traffic statistics on each Ethernet interface.

Eth-Trunk

Priority: configures the system priority.

Load Balancing Mode: specifies the mode in which traffic is load balanced.

Trunk: views and configures a trunk.

Trunk Member: views information about trunk member interfaces.

Service Management

VLAN

Creates, deletes and edits VLANs, displays member interfaces by VLAN, and edits member interfaces by interface/interface range.

MAC VLAN

Creates and deletes MAC VLANs, displays MAC VLAN lists by VLAN/MAC address, and enables/disables MAC VLAN by interface/interface range.

Voice VLAN

Configures a voice VLAN.

MAC

MAC Address List: views or deletes dynamic MAC address entries.

MAC Aging Time: sets the aging time of dynamic MAC address entries.

Static MAC Address: creates or deletes static MAC address entries.

Blackhole MAC Address: creates or deletes blackhole MAC address entries.

MAC Address Filter: enables or disables MAC address filtering on a specified interface.

Flapping MAC Address: displays information about MAC address flapping.

STP

Configures STP parameters in the system and on specified interfaces.

IGMP Snooping

Configures global IGMP snooping parameters, VLAN-based IGMP snooping parameters, router interface learning, multicast group policies, static groups, multicast groups, queriers, router interfaces, and views the multicast forwarding table.

ACL

Effective Period

Specifies the period in which an ACL rule is effective.

ACL Profile

Creates ACL rules.

ACL Application

Applies an ACL rule to a specified interface or VLAN.

HTTP ACL

Applies an ACL rule to HTTP packets received by a switch.

QoS

QoS Interface

Configures the trust mode and default CoS value for a specified interface.

CoS Mapping

Maps CoS values to service levels.

DSCP Mapping

Maps DSCP values to service levels.

IP Precedence Mapping

Maps IP precedence values to service levels.

Service Level Mapping

Maps service levels to queues.

QoS Scheduler

Configures the QoS scheduling algorithm and weight for WRR scheduling.

SRED

Configures Simple Random Early Detection (SRED).

Traffic Management

Creates traffic classifiers to control traffic.

Traffic Shaping

Sets the maximum rate of outgoing traffic on an interface.

IP Routing

IPv4 Route

Adds and views static IPv4 routes.

IPv6 Route

Adds and views static IPv6 routes.

Security

User Management

Configures user accounts.

802.1x

Configures 802.1x authentication.

Guest VLAN

Configures a guest VLAN.

Storm Suppression

Configures storm suppression.

Port Security

Controls access on specified interfaces.

MAC-based Access Control

Configures MAC address authentication.

Attack Prevent

Configures attack defense functions.

DHCP Snooping

Configures DHCP snooping.

IPSG

Configures IP source guard.

DAI

Configures dynamic ARP inspection (DAI).

MAC Attack

Configures defense against packets with forged MAC addresses and MAC address spoofing attacks.

Port Isolation

Configures port isolation.

AAA

Configures authentication and accounting functions.

RADIUS

Configures RADIUS server parameters.

SSL Settings

Configures SSL parameters.

Network

SNMP

Configures SNMP parameters.

RMON

Configures RMON parameters.

LLDP

Configures LLDP parameters.

LLDP-MED

Configures LLDP-MED parameters.

Device Management

Device Management

Views device hardware information. Huawei checks every device before delivery to ensure that the device is running the correct version and functioning properly.

Device Diagnostics

Interface Loopback Test: performs loopback diagnosis on specified interfaces.

VCT Cable Diagnostics: performs VCT diagnosis on specified interfaces to locate cable faults.

DDM

Views parameters on optical interfaces.

Information Center

Manages system logs.

Power Saving Management

Enables or disables the power-saving mode and EEE function.

Interface Mirror

Specifies the source and destination interfaces of mirrored packets and displays mirroring configuration.

Tools

Ping Test: performs ping tests to check network connectivity.

Tracert: performs tracert tests to collect routing information.

One Key Information: clicks the button to download all configurations, logs, and error information.

Save Running-config

Save Running-config

Saves modified parameter settings.