HP 5500 Ei 5500 Si Switch Series Configuration Guide
Have a look at the manual HP 5500 Ei 5500 Si Switch Series Configuration Guide online for free. It’s possible to download the document as PDF or print. UserManuals.tech offer 1114 HP manuals and user’s guides for free. Share the user manual or guide on Facebook, Twitter or Google+.
292 • To implement area-based IPsec protection, you need to configure the same IPsec policy on the routers in the target area. • To implement interface-based IPsec protection, you need to configure the same IPsec policy on the interfaces between two neighboring routers. • To implement virtual link-based IPsec protection, yo u n e e d t o c o n fig u re t h e s a m e I Ps e c p o l ic y o n t h e two routers connected over the virtual link. If an interface and its area each have an IPsec poli cy configured, the interface uses its own IPsec policy. If a virtual link and area 0 each have an IPsec policy configured, the virtual link uses its own IPsec policy. Configuration prerequisites Before you apply an IPsec policy for OSPFv3, complete following tasks. • Create an IPsec proposal. • Create an IPsec policy. For more information about IPsec policy configuration, see Security Configuration Guide. Configuration guidelines An IPsec policy used for OSPFv3 can only be in manual mode. For more information, see Security Configuration Guide. Configuration procedure To apply an IPsec policy in an area: Step Command Remarks 1. Enter system view. system-view N/A 2. Enter OSPFv3 view. ospfv3 [ process-id ] N/A 3. Enter OSPF area view. area area-id N/A 4. Apply an IPsec policy in the area. enable ipsec-policy policy-name Not configured by default. To apply an IPsec policy on an interface: Step Command Remarks 1. Enter system view. system-view N/A 2. Enter interface view. interface interface-type interface-number N/A 3. Apply an IPsec policy on the interface. ospfv3 ipsec-policy policy-name [ instance instance-id ] Not configured by default To apply an IPsec policy on a virtual link: Step Command Remarks 1. Enter system view. system-view N/A 2. Enter OSPFv3 view. ospfv3 [ process-id ] N/A 3. Enter OSPF area view. area area-id N/A
293 Step Command Remarks 4. Apply an IPsec policy on a virtual link. vlink-peer router-id [ hello seconds | retransmit seconds | trans-delay seconds | dead seconds | instance instance-id | ipsec-policy policy-name ] * Not configured by default. Displaying and maintaining OSPFv3 Task Command Remarks Display OSPFv3 process brief information. display ospfv3 [ process-id ] [ | { begin | exclude | include } regular-expression ] Available in any view Display OSPFv3 interface information. display ospfv3 interface [ interface-type interface-number | statistic ] [ | { begin | exclude | include } regular-expression ] Available in any view Display OSPFv3 LSDB information. display ospfv3 [ process-id ] lsdb [ [ external | inter-prefix | inter-router | intra-prefix | link | network | router | grace ] [ link-state-id ] [ originate-router router-id ] | total ] [ | { begin | exclude | include } regular-expression ] Available in any view Display OSPFv3 LSDB statistics. display ospfv3 lsdb statistic [ | { begin | exclude | include } regular-expression ] Available in any view Display OSPFv3 neighbor information. display ospfv3 [ process-id ] [ area area-id ] peer [ [ interface-type interface-number ] [ verbose ] | peer-router-id ] [ | { begin | exclude | include } regular-expression ] Available in any view Display OSPFv3 neighbor statistics. display ospfv3 peer statistic [ | { begin | exclude | include } regular-expression ] Available in any view Display OSPFv3 routing table information. display ospfv3 [ process-id ] routing [ ipv6-address prefix-length | ipv6-address/prefix-length | abr-routes | asbr-routes | all | statistics ] [ | { begin | exclude | include } regular-expression ] Available in any view Display OSPFv3 area topology information. display ospfv3 [ process-id ] topology [ area area-id ] [ | { begin | exclude | include } regular-expression ] Available in any view Display OSPFv3 virtual link information. display ospfv3 [ process-id ] vlink [ | { begin | exclude | include } regular-expression ] Available in any view Display OSPFv3 next hop information. display ospfv3 [ process-id ] next-hop [ | { begin | exclude | include } regular-expression ] Available in any view Display OSPFv3 link state request list information. display ospfv3 [ process-id ] request-list [ { external | inter-prefix | inter-router | intra-prefix | link | network | router | grace } [ link-state-id ] [ originate-router ip-address ] | statistics ] [ | { begin | exclude | include } regular-expression ] Available in any view Display OSPFv3 link state retransmission list information. display ospfv3 [ process-id ] retrans-list [ { external | inter-prefix | inter-router | intra-prefix | link | network | router | grace } [ link-state-id ] [ originate-router ip-address ] | statistics ] [ | { begin | exclude | include } regular-expression ] Available in any view
294 Task Command Remarks Display OSPFv3 statistics. display ospfv3 statistic [ | { begin | exclude | include } regular-expression ] Available in any view Display the GR status of the specified OSPFv3 process. display ospfv3 [ process-id ] graceful-restart status [ | { begin | exclude | include } regular-expression ] Available in any view OSPFv3 configuration examples Configuring OSPFv3 areas Network requirements In Figure 107 , all s witches run OSPFv3. The AS is split into three areas, in which, Switch B and Switch C act as ABRs to forward routing information between areas. Configure Area 2 as a stub area in order to reduce LSAs in the area without affecting route reachability. Figure 107 Network diagram Configuration procedure 1. Configure IPv6 addresses for inte rfaces. (Details not shown.) 2. Configure OSPFv3 basic functions: # Configure Switch A. system-view [SwitchA] ipv6 [SwitchA] ospfv3 [SwitchA-ospfv3-1] router-id 1.1.1.1 [SwitchA-ospfv3-1] quit [SwitchA] interface vlan-interface 300 [SwitchA-Vlan-interface300] ospfv3 1 area 1 [SwitchA-Vlan-interface300] quit [SwitchA] interface vlan-interface 200 [SwitchA-Vlan-interface200] ospfv3 1 area 1 [SwitchA-Vlan-interface200] quit # Configure Switch B. system-view
295 [SwitchB] ipv6 [SwitchB] ospfv3 [SwitchB-ospf-1] router-id 2.2.2.2 [SwitchB-ospf-1] quit [SwitchB] interface vlan-interface 100 [SwitchB-Vlan-interface100] ospfv3 1 area 0 [SwitchB-Vlan-interface100] quit [SwitchB] interface vlan-interface 200 [SwitchB-Vlan-interface200] ospfv3 1 area 1 [SwitchB-Vlan-interface200] quit # Configure Switch C. system-view [SwitchC] ipv6 [SwitchC] ospfv3 [SwitchC-ospfv3-1] router-id 3.3.3.3 [SwitchC-ospfv3-1] quit [SwitchC] interface vlan-interface 100 [SwitchC-Vlan-interface100] ospfv3 1 area 0 [SwitchC-Vlan-interface100] quit [SwitchC] interface vlan-interface 400 [SwitchC-Vlan-interface400] ospfv3 1 area 2 [SwitchC-Vlan-interface400] quit # Configure Switch D. system-view [SwitchD] ipv6 [SwitchD] ospfv3 [SwitchD-ospfv3-1] router-id 4.4.4.4 [SwitchD-ospfv3-1] quit [SwitchD] interface Vlan-interface 400 [SwitchD-Vlan-interface400] ospfv3 1 area 2 [SwitchD-Vlan-interface400] quit # Display OSPFv3 neighbor information on Switch B. [SwitchB] display ospfv3 peer OSPFv3 Area ID 0.0.0.0 (Process 1) ---------------------------------------------------------------------- \ Neighbor ID Pri State Dead Time Interface Instance \ ID 3.3.3.3 1 Full/DR 00:00:39 Vlan100 0 OSPFv3 Area ID 0.0.0.1 (Process 1) ---------------------------------------------------------------------- \ Neighbor ID Pri State Dead Time Interface Instance \ ID 1.1.1.1 1 Full/Backup 00:00:38 Vlan200 0 # Display OSPFv3 neighbor information on Switch C. [SwitchC] display ospfv3 peer OSPFv3 Area ID 0.0.0.0 (Process 1) ---------------------------------------------------------------------- \ Neighbor ID Pri State Dead Time Interface Instance \ ID
296 2.2.2.2 1 Full/Backup 00:00:39 Vlan100 0 OSPFv3 Area ID 0.0.0.2 (Process 1) ---------------------------------------------------------------------- \ Neighbor ID Pri State Dead Time Interface Instance \ ID 4.4.4.4 1 Full/DR 00:00:38 Vlan400 0 # Display OSPFv3 routing table information on Switch D. [SwitchD] display ospfv3 routing E1 - Type 1 external route, IA - Inter area route, I - Intra area\ route E2 - Type 2 external route, * - Selected route OSPFv3 Router with ID (4.4.4.4) (Process 1) ------------------------------------------------------------------------\ *Destination: 2001::/64 Type : IA Cost : 2 NextHop : FE80::F40D:0:93D0:1 Interface: Vlan4\ 00 *Destination: 2001:1::/64 Type : IA Cost : 3 NextHop : FE80::F40D:0:93D0:1 Interface: Vlan4\ 00 *Destination: 2001:2::/64 Type : I Cost : 1 NextHop : directly-connected Interface: Vlan4\ 00 *Destination: 2001:3::/64 Type : IA Cost : 4 NextHop : FE80::F40D:0:93D0:1 Interface: Vlan4\ 00 3. Configure Area 2 as a stub area: # Configure Switch D [SwitchD] ospfv3 [SwitchD-ospfv3-1] area 2 [SwitchD-ospfv3-1-area-0.0.0.2] stub # Configure Switch C, and specify the cost of th e default route sent to the stub area as 10. [SwitchC] ospfv3 [SwitchC-ospfv3-1] area 2 [SwitchC-ospfv3-1-area-0.0.0.2] stub [SwitchC-ospfv3-1-area-0.0.0.2] default-cost 10 # Display OSPFv3 routing table information on Swit ch D. A default route is added, and its cost is the cost of a direct route plus the configured cost. [SwitchD] display ospfv3 routing E1 - Type 1 external route, IA - Inter area route, I - Intra area\ route E2 - Type 2 external route, * - Selected route OSPFv3 Router with ID (4.4.4.4) (Process 1) -----------------------------------------------------------------------\ -
297 *Destination: ::/0 Type : IA Cost : 11 NextHop : FE80::F40D:0:93D0:1 Interface: Vlan4\ 00 *Destination: 2001::/64 Type : IA Cost : 2 NextHop : FE80::F40D:0:93D0:1 Interface: Vlan4\ 00 *Destination: 2001:1::/64 Type : IA Cost : 3 NextHop : FE80::F40D:0:93D0:1 Interface: Vlan4\ 00 *Destination: 2001:2::/64 Type : I Cost : 1 NextHop : directly-connected Interface: Vlan4\ 00 *Destination: 2001:3::/64 Type : IA Cost : 4 NextHop : FE80::F40D:0:93D0:1 Interface: Vlan4\ 00 4. Configure Area 2 as a totally stub area: # Configure Area 2 as a totally stub area on Switch C. [SwitchC-ospfv3-1-area-0.0.0.2] stub no-summary # Display OSPFv3 routing table information on Swit ch D. Route entries are reduced. All non-direct routes are removed except the default route. [SwitchD] display ospfv3 routing E1 - Type 1 external route, IA - Inter area route, I - Intra area\ route E2 - Type 2 external route, * - Selected route OSPFv3 Router with ID (4.4.4.4) (Process 1) -----------------------------------------------------------------------\ - *Destination: ::/0 Type : IA Cost : 11 NextHop : FE80::F40D:0:93D0:1 Interface: Vlan4\ 00 *Destination: 2001:2::/64 Type : I Cost : 1 NextHop : directly-connected Interface: Vlan4\ 00 Configuring OSPFv3 DR election Network requirements As shown in Figure 108: • T he priority of Switch A is 100, the highest priority on the network, so it will be the DR. • The priority of Switch C is 2, the second highest priority on the network, so it will be the BDR. • The priority of Switch B is 0, so it cannot become the DR. • Router D has the default priority 1.
298 Figure 108 Network diagram Configuration procedure 1. Configure IPv6 addresses for inte rfaces. (Details not shown.) 2. Configure OSPFv3 basic functions: # Configure Switch A. system-view [SwitchA] ipv6 [SwitchA] ospfv3 [SwitchA-ospfv3-1] router-id 1.1.1.1 [SwitchA-ospfv3-1] quit [SwitchA] interface vlan-interface 100 [SwitchA-Vlan-interface100] ospfv3 1 area 0 [SwitchA-Vlan-interface100] quit # Configure Switch B. system-view [SwitchB] ipv6 [SwitchB] ospfv3 [SwitchB-ospfv3-1] router-id 2.2.2.2 [SwitchB-ospfv3-1] quit [SwitchB] interface vlan-interface 200 [SwitchB-Vlan-interface200] ospfv3 1 area 0 [SwitchB-Vlan-interface200] quit # Configure Switch C. system-view [SwitchC] ipv6 [SwitchC] ospfv3 [SwitchC-ospfv3-1] router-id 3.3.3.3 [SwitchC-ospfv3-1] quit [SwitchC] interface vlan-interface 100 [SwitchC-Vlan-interface100] ospfv3 1 area 0 [SwitchC-Vlan-interface100] quit # Configure Switch D. system-view [SwitchD] ipv6
299 [SwitchD] ospfv3 [SwitchD-ospfv3-1] router-id 4.4.4.4 [SwitchD-ospfv3-1] quit [SwitchD] interface vlan-interface 200 [SwitchD-Vlan-interface200] ospfv3 1 area 0 [SwitchD-Vlan-interface200] quit # Display neighbor information on Switch A. The switches have the same default DR priority 1. Then, Switch D (the switch with the highest Router ID) is elected as the DR, and Switch C is the BDR. [SwitchA] display ospfv3 peer OSPFv3 Area ID 0.0.0.0 (Process 1) ---------------------------------------------------------------------- \ Neighbor ID Pri State Dead Time Interface Instan\ ce ID 2.2.2.2 1 2-Way/DROther 00:00:36 Vlan200 0 3.3.3.3 1 Full/Backup 00:00:35 Vlan100 0 4.4.4.4 1 Full/DR 00:00:33 Vlan200 0 # Display neighbor information on Switch D. The neighbor states are all full. [SwitchD] display ospfv3 peer OSPFv3 Area ID 0.0.0.0 (Process 1) ---------------------------------------------------------------------- \ Neighbor ID Pri State Dead Time Interface Instan\ ce ID 1.1.1.1 1 Full/DROther 00:00:30 Vlan100 0 2.2.2.2 1 Full/DROther 00:00:37 Vlan200 0 3.3.3.3 1 Full/Backup 00:00:31 Vlan100 0 3. Configure DR priorities for interfaces: # Configure the DR priority of VLAN-interface 100 as 100 on Switch A. [SwitchA] interface Vlan-interface 100 [SwitchA-Vlan-interface100] ospfv3 dr-priority 100 [SwitchA-Vlan-interface100] quit # Configure the DR priority of VLAN-interface 200 as 0 on Switch B. [SwitchB] interface vlan-interface 200 [SwitchB-Vlan-interface200] ospfv3 dr-priority 0 [SwitchB-Vlan-interface200] quit # Configure the DR priority of VLAN-interface 100 of Switch C as 2. [SwitchC] interface Vlan-interface 100 [SwitchC-Vlan-interface100] ospfv3 dr-priority 2 [SwitchC-Vlan-interface100] quit # Display neighbor information on Switch A. DR priorities have been updated, but the DR and BDR are not changed. [SwitchA] display ospfv3 peer OSPFv3 Area ID 0.0.0.0 (Process 1) ---------------------------------------------------------------------- \ Neighbor ID Pri State Dead Time Interface Instan\ ce ID 2.2.2.2 0 2-Way/DROther 00:00:38 Vlan200 0 3.3.3.3 2 Full/Backup 00:00:32 Vlan100 0 4.4.4.4 1 Full/DR 00:00:36 Vlan200 0 # Display neighbor information on Switch D. Switch D is still the DR. [SwitchD] display ospfv3 peer
300 OSPFv3 Area ID 0.0.0.0 (Process 1) ---------------------------------------------------------------------- \ Neighbor ID Pri State Dead Time Interface Instan\ ce ID 1.1.1.1 100 Full/DROther 00:00:33 Vlan100 0 2.2.2.2 0 Full/DROther 00:00:36 Vlan200 0 3.3.3.3 2 Full/Backup 00:00:40 Vlan100 0 4. Restart DR and BDR election: # Use the shutdown and undo shutdown commands on interfaces to restart DR and BDR election. (Details not shown.) # Display neighbor information on Switch A. Switch C becomes the BDR. [SwitchA] display ospfv3 peer OSPFv3 Area ID 0.0.0.0 (Process 1) ---------------------------------------------------------------------- \ Neighbor ID Pri State Dead Time Interface Instan\ ce ID 2.2.2.2 0 Full/DROther 00:00:31 Vlan200 0 3.3.3.3 2 Full/Backup 00:00:39 Vlan100 0 4.4.4.4 1 Full/DROther 00:00:37 Vlan200 0 # Display neighbor information on Switch D. Switch A becomes the DR. [SwitchD] display ospfv3 peer OSPFv3 Area ID 0.0.0.0 (Process 1) ---------------------------------------------------------------------- \ Neighbor ID Pri State Dead Time Interface Instan\ ce ID 1.1.1.1 100 Full/DR 00:00:34 Vlan100 0 2.2.2.2 0 2-Way/DROther 00:00:34 Vlan200 0 3.3.3.3 2 Full/Backup 00:00:32 Vlan100 0 Configuring OSPFv3 route redistribution Network requirements As shown in Figure 109: • S witch A, Switch B, and Switch C are in Area 2. • OSPFv3 process 1 and OSPFv3 process 2 are enabled on Switch B. Switch B communicates with Switch A and Switch C through OSPFv3 process 1 and OSPFv3 process 2. Configure OSPFv3 process 2 to redistribute direct routes and the routes from OSPFv3 process 1 on Switch B and set the default metric for redistributed routes to 3. Then, Switch C can learn the routes destined for 1::0/64 and 2::0/64, and Switch A ca nnot learn the routes destined for 3::0/64 or 4::0/64.
301 Figure 109 Network diagram Configuration procedure 1. Configure IPv6 addresses for inte rfaces. (Details not shown.) 2. Configure OSPFv3 basic functions: # Enable OSPFv3 process 1 on Switch A. system-view [SwitchA] ipv6 [SwitchA] ospfv3 1 [SwitchA-ospfv3-1] router-id 1.1.1.1 [SwitchA-ospfv3-1] quit [SwitchA] interface vlan-interface 100 [SwitchA-Vlan-interface100] ospfv3 1 area 2 [SwitchA-Vlan-interface100] quit [SwitchA] interface vlan-interface 200 [SwitchA-Vlan-interface200] ospfv3 1 area 2 [SwitchA-Vlan-interface200] quit # Enable OSPFv3 process 1 and OSPFv3 process 2 on Switch B. system-view [SwitchB] ipv6 [SwitchB] ospfv3 1 [SwitchB-ospfv3-1] router-id 2.2.2.2 [SwitchB-ospfv3-1] quit [SwitchB] interface vlan-interface 100 [SwitchB-Vlan-interface100] ospfv3 1 area 2 [SwitchB-Vlan-interface100] quit [SwitchB] ospfv3 2 [SwitchB-ospfv3-2] router-id 3.3.3.3 [SwitchB-ospfv3-2] quit [SwitchB] interface vlan-interface 300 [SwitchB-Vlan-interface300] ospfv3 2 area 2 [SwitchB-Vlan-interface300] quit # Enable OSPFv3 process 2 on Switch C. system-view [SwitchC] ipv6 [SwitchC] ospfv3 2 [SwitchC-ospfv3-2] router-id 4.4.4.4 [SwitchC-ospfv3-2] quit