What are the 2 main functions of the MAC sublayer?

Huawei uses machine translation combined with human proofreading to translate this document to different languages in order to help you better understand the content of this document. Note: Even the most advanced machine translation cannot match the quality of professional translators. Huawei shall not bear any responsibility for translation accuracy and it is recommended that you refer to the English document (a link for which has been provided).

The MAC sub-layer has the following functions:

• Provides access to physical links.

  The MAC sub-layer is associated with the physical layer. That is, different MAC sub-layers provide access to different physical layers.

  Ethernet has two types of MAC sub-layers:

  • Half-duplex MAC: provides access to the physical layer in half-duplex mode.

  • Full-duplex MAC: provides access to the physical layer in full-duplex mode.

  The two types of MAC sub-layers are integrated in a network interface card. After the network interface card is initialized, auto-negotiation is performed to choose an operation mode, and then a MAC sub-layer is chosen according to the operation mode.

• Identifies stations at the data link layer.

  The MAC sub-layer reserves a unique MAC address for each station.

  The MAC sub-layer uses a MAC address to uniquely identify a station.

  MAC addresses are managed by Institute of Electrical and Electronics Engineers (IEEE) and allocated in blocks. An organization, generally a device manufacturer, obtains a unique address block from IEEE. The address block is called an Organizationally Unique Identifier (OUI). Using the OUI, the organization can allocate MAC addresses to 16777216 devices.

  A MAC address has 48 bits, which are generally expressed in 12-digit dotted hexadecimal notation. For example, the 48-bit MAC address 000000001110000011111100001110011000000000110100 is represented by 00e0.fc39.8034.

  The first 6 digits in dotted hexadecimal notation stand for the OUI, and the last 6 digits are allocated by the vendor. For example, in 00e0.fc39.8034, 00e0.fc is the OUI allocated by IEEE to Huawei, and 39.8034 is the address number allocated by Huawei.

  The second bit of a MAC address indicates whether the address is globally unique or locally unique. Ethernet uses globally unique MAC addresses.

  MAC addresses are divided into the following types:

  • Physical MAC address

    A physical MAC address is burned into hardware (such as a network interface card) and uniquely identifies a terminal on the Ethernet.

  • Broadcast MAC address

    A broadcast MAC address indicates all the terminals on a network.

    The 48 bits of a broadcast MAC address are all 1s, such as ffff.ffff.ffff.

  • Multicast MAC address

    A multicast MAC address indicates a group of terminals on a network.

    The eighth bit of a multicast MAC address is 1, such as 000000011011101100111010101110101011111010101000.

• Transmits data over the data link layer. After receiving data from the LLC sub-layer, the MAC sub-layer adds the MAC address and control information to the data, and then transmits the data to the physical link. In the process, the MAC sub-layer provides other functions such as the check function.

  Data is transmitted at the data link layer as follows:

  1. The upper layer delivers data to the MAC sub-layer.

  2. The MAC sub-layer stores the data in the buffer.

  3. The MAC sub-layer adds the destination MAC address and source MAC address to the data, calculates the length of the data frame, and forms an Ethernet frame.

  4. The Ethernet frame is sent to the peer according to the destination MAC address.

  5. The peer compares the destination MAC address with entries in the MAC address table.

     • If a matching entry is found, the frame is accepted.

     • If no matching entry is found, the frame is discarded.

  The preceding describes frame transmission in unicast mode. After an upper-layer application is added to a multicast group, the data link layer generates a multicast MAC address according to the application, and then adds the multicast MAC address to the MAC address table. The MAC sub-layer receives frames with the multicast MAC address and transmits the frames to the upper layer.

• Format of an Ethernet_II frame

  Figure 1-4 Format of an Ethernet_II frame
  
  

  Table 1-5 describes the fields in an Ethernet_II frame.

  Table 1-5 Fields in an Ethernet_II frame

  Field	Description
  DMAC	It indicates the destination MAC address. DMAC specifies the receiver of the frame.
  SMAC	It indicates the source MAC address. SMAC specifies the station that sends the frame.
  Type	The 2-byte Type field identifies the upper layer protocol of the Data field. The receiver can know the meaning of the Data field according to the Type field. Ethernet allows multiple protocols to coexist on a LAN. The hexadecimal values in the Type field of an Ethernet_II frame stand for different protocols. Frames with the Type field value 0800 are IP frames. Frames with the Type field value 0806 are Address Resolution Protocol (ARP) frames. Frames with the Type field value 8035 are Reverse Address Resolution Protocol (RARP) frames. Frames with the Type field value 8137 are Internetwork Packet Exchange (IPx) and Sequenced Packet Exchange (SPx) frames.
  Data	The minimum length of the Data field is 46 bytes, which ensures that the frame is at least 64 bytes in length. The 46-byte Data field is required even if only 1-byte information needs to be transmitted. If the payload of the Data field is less than 46 bytes, the Data field must be padded to 46 bytes. The maximum length of the Data field is 1500 bytes.
  CRC	The Cyclic Redundancy Check (CRC) field provides an error detection mechanism. Each sending device calculates a CRC code containing the DMAC, SMAC, Type, and Data fields. Then the CRC code is filled into the 4-byte CRC field.

  The fields of a Ethernet_II frame are described as follows:

  • DMAC

    It indicates the destination MAC address. DMAC specifies the receiver of the frame.

  • SMAC

    It indicates the source MAC address. SMAC specifies the station that sends the frame.

  • Type

    The 2-byte Type field identifies the upper layer protocol of the Data field. The receiver can know the meaning of the Data field according to the Type field.

    Ethernet allows multiple protocols to coexist on a LAN. The hexadecimal values in the Type field of an Ethernet_II frame stand for different protocols.

    • Frames with the Type field value 0800 are IP frames.

    • Frames with the Type field value 0806 are Address Resolution Protocol (ARP) frames.

    • Frames with the Type field value 8035 are Reverse Address Resolution Protocol (RARP) frames.

    • Frames with the Type field value 8137 are Internetwork Packet Exchange (IPx) and Sequenced Packet Exchange (SPx) frames.

  • Data

    The minimum length of the Data field is 46 bytes, which ensures that the frame is at least 64 bytes in length. The 46-byte Data field is required even if only 1-byte information needs to be transmitted.

    If the payload of the Data field is less than 46 bytes, the Data field must be padded to 46 bytes.

    The maximum length of the Data field is 1500 bytes.

  • CRC

    The Cyclic Redundancy Check (CRC) field provides an error detection mechanism.

    Each sending device calculates a CRC code containing the DMAC, SMAC, Type, and Data fields. Then the CRC code is filled into the 4-byte CRC field.

• Format of an IEEE 802.3 frame

  Figure 1-5 Format of an IEEE 802.3 frame
  
  

  As shown in Figure 1-5, the format of an IEEE 802.3 frame is similar to that of an Ethernet_II frame except that the Type field is changed to the Length field in an IEEE 802.3 frame, and the LLC field and the Sub-Network Access Protocol (SNAP) field occupy 8 bytes of the Data field.

  Table 1-6 Format of an IEEE 802.3 frame

  Field	Description
  Length	The Length field specifies the number of bytes in the Data field.
  LLC	The LLC field consists of three sub-fields: Destination Service Access Point (DSAP), Source Service Access Point (SSAP), and Control.
  SNAP	The SNAP field consists of the Org Code field and the Type field. Three bytes in the Org Code field are all 0s. The Type field functions the same as the Type field in Ethernet_II frames.

  For description about other fields, see the description of Ethernet_II frames.

  Based on the values of DSAP and SSAP, IEEE 802.3 frames can be divided into the following types:

  • If DSAP and SSAP are both 0xff, the IEEE 802.3 frame changes to a Netware-Ethernet frame that carries NetWare data.

  • If DSAP and SSAP are both 0xaa, the IEEE 802.3 frame changes to an Ethernet_SNAP frame.

    Ethernet_SNAP frames can be encapsulated with data of multiple protocols. The SNAP can be considered as an extension of the Ethernet protocol. SNAP allows vendors to define their own Ethernet transmission protocols.

    The Ethernet_SNAP standard is defined by IEEE 802.1 to guarantee interoperability between IEEE 802.3 LANs and Ethernet networks.

  • Other values of DSAP and SSAP indicate IEEE 802.3 frames.

This Document Applies to these Products

Page 2

Huawei uses machine translation combined with human proofreading to translate this document to different languages in order to help you better understand the content of this document. Note: Even the most advanced machine translation cannot match the quality of professional translators. Huawei shall not bear any responsibility for translation accuracy and it is recommended that you refer to the English document (a link for which has been provided).

The MAC sub-layer supports two types of frame: IEEE 802.3 frames and Ethernet_II frames. In an Ethernet_II frame, the Type field identifies the upper layer protocol. Therefore, only the MAC sub-layer is required on a device, and the LLC sub-layer does not need to be realized.

In an IEEE 802.3 frame, the LLC sub-layer defines useful features in addition to traditional services of the data link layer. All these features are provided by the sub-fields of DSAP, SSAP, and Control.

The following lists three types of point-to-point services:

• Connectionless service

  Currently, the Ethernet implements this service.

• Connection-oriented service

  A connection is set up before data is transmitted. The reliability of data is guaranteed during the transmission.

• Connectionless data transmission with acknowledgement

  A connection is not required before data transmission. The acknowledgement mechanism is used to improve the reliability.

The following is an example that describes the applications of SSAP and DSAP. Assume that terminals A and B use connection-oriented services. Data is transmitted in the following process:

1. A sends a frame to B to require the establishment of a connection with B.

2. If B has enough resources, it returns an acknowledgement message that contains a Service Access Point (SAP). The SAP identifies the connection required by A.

3. After receiving the acknowledgement message, A knows that B has set up a local connection with A. After creating an SAP, A sends a message containing the SAP to B. The connection is set up.

4. The LLC sub-layer of A encapsulates the data into a frame. The DSAP field is filled in with the SAP sent by B; the SSAP field is filled in with the SAP created by A. Then the LLC sub-layer sends the frame to the MAC sub-layer of A.

5. The MAC sub-layer of A adds the MAC address and the Length field into the frame, and then sends the frame to the data link layer.

6. After the frame is received at the MAC sub-layer of B, the frame is transmitted to the LLC sub-layer. The LLC sub-layer figures out the connection to which the frame belongs according to the DSAP field.

7. After checking and acknowledging the frame based on the connection type, the LLC sub-layer of B transmits the frame to the upper layer.

8. After the frame reaches its destination, A instructs B to release the connection by sending a frame. At this time, the communications end.

This Document Applies to these Products

Page 3

Huawei uses machine translation combined with human proofreading to translate this document to different languages in order to help you better understand the content of this document. Note: Even the most advanced machine translation cannot match the quality of professional translators. Huawei shall not bear any responsibility for translation accuracy and it is recommended that you refer to the English document (a link for which has been provided).

In early stage of network deployment, most local area networks (LANs) were established using Layer 2 switches, and routers completed communication between LANs. At that time, intra-LAN traffic accounted for most of network traffic and little traffic was transmitted between LANs. A few routers were enough to handle traffic transmission between LANs.

As data communication networks expand and more services emerge on the networks, increasing traffic needs to be transmitted between networks. Routers cannot adapt to this development trend because of their high costs, low forwarding performance, and small port quantities. New devices capable of high-speed Layer 3 forwarding are required. Layer 3 switches are such devices.

Routers use CPUs to complete Layer 3 forwarding, whereas Layer 3 switches use hardware to complete Layer 3 forwarding. Hardware forwarding has a much higher performance than software forwarding (CPU based forwarding). Switches cannot replace routers in all scenarios because routers provide rich interface types, good service class control, and powerful routing capabilities that Layer 3 switches cannot provide.

Layer 3 switches divide a Layer 2 network into multiple VLANs. They implement Layer 2 switching within the VLANs and Layer 3 IP connectivity between VLANs. Two hosts on different networks communicate with each other through the following process:

1. Before the source host starts communicating with the destination host, it compares its own IP address with the IP address of the destination host. If IP addresses of the two hosts have the same network ID (calculated by an AND operation between the IP addresses and masks), the hosts are located on the same network segment. In this case, the source host sends an Address Resolution Protocol (ARP) request to the destination host. After receiving an ARP reply from the destination host, the source host obtains the MAC address of the destination host and sends packets to this destination MAC address.
2. If the source and destination hosts are located on different network segments, the source host sends an ARP request to obtain the MAC address mapping the gateway IP address. After receiving an ARP reply from the gateway, the source host sends packets to the MAC address of the gateway. In these packets, the source IP address is the IP address of the source host, and destination IP address is still the IP address of the destination host.

The following is the detailed Layer 3 switching process.

As shown in Figure 1-7, the source and destination hosts connect to the same Layer 3 switch but belong to different VLANs (network segments). Both the two hosts are located on the directly connected network segments of the Layer 3 switch, so the routes to the IP addresses of the hosts are direct routes.

Figure 1-7 Layer 3 forwarding

Figure 1-7 shows the MAC addresses, IP addresses, and gateway addresses of the hosts, MAC address of the Layer 3 switch, and IP addresses of Layer 3 interfaces configured in VLANs on the Layer 3 switch. The process of a ping from PC A to PC B is as follows (the Layer 3 switch has not created any MAC address entry):

1. PC A finds that the destination IP address 10.2.1.2 (PC B) is on a different network segment than its own IP address. Therefore, PC A sends an ARP request to request for the MAC address mapping the gateway address 10.1.1.1.
2. L3 Switch receives the ARP request from PC A and finds that 10.1.1.1 is the IP address of its own Layer 3 interface. L3 switch then sends an ARP reply to PC A. The ARP reply carries the MAC address of its Layer 3 interface (MAC Switch). In addition, L3 switch adds the mapping between the IP address and MAC address of PC A (10.1.1.2 and MAC A) to its ARP table. The IP address and MAC address of PC A are carried in the ARP request sent from PC A. And L3 Switch adds the mapping between the source MAC address and VLAN ID of the packet and outbound port to its MAC table.
3. After PC A receives the ARP reply from the gateway (L3 Switch), it sends an ICMP request packet. In the ICMP request packet, the destination MAC address (DMAC) is MAC Switch; the source MAC address (SMAC) is MAC A; the source IP address (SIP) is 10.1.1.2; the destination IP address (DIP) is 10.2.1.2.
4. When L3 Switch receives the ICMP request packet, it looks up the MAC address table according to the destination MAC address and VLAN ID of the packet and finds the entry with the MAC address of its Layer 3 interface, the packet needs to be forwarded at Layer 3. Then L3 Switch looks up Layer 3 forwarding entries of the switching chip to guide Layer 3 forwarding.
5. The switching chip loops up Layer 3 forwarding entries according to the destination IP address of the packet. The entry lookup fails because no entry has been created. The switching chip then sends the packet to the CPU for software processing.
6. The CPU looks up the software routing table according to the destination IP address of the packet and finds a directly connected network segment, network segment of PC B. Then the CPU looks up its ARP table, and the lookup still fails. Therefore, L3 Switch sends an ARP request to all ports in VLAN 3 (network segment of PC B), to request the MAC address mapping IP address 10.2.1.2.
7. After PC B receives the ARP request from L3 Switch, it checks the ARP request and finds that 10.2.1.2 is its own IP address. PC B then sends an ARP reply carrying its MAC address (MAC B). Meanwhile, PC B records the mapping between the IP address and MAC address of L3 Switch (10.2.1.1 and MAC Switch) in its ARP table.
8. When L3 Switch receives the ARP reply from PC B, it records the mapping between the IP address and MAC address of PC B (10.2.1.2 and MAC B) in its ARP table. L3 Switch changes the destination MAC address in the ICMP request packet sent from PC A to MAC B and changes the source MAC address to its own MAC address (MAC Switch), and then sends the ICMP request to PC B. The Layer 3 forwarding entry containing the IP address and MAC address of PC B, outbound VLAN ID, and outbound port is also added to the Layer 3 forwarding of the switching chip. Subsequent packets sent from PC A to PC B are directly forwarded according to this hardware entry.
9. When PC B receives the ICMP request packet from L3 Switch, it sends an ICMP reply packet to PC A. The forwarding process for the ICMP reply packet is similar to that for the ICMP request packet except that the ICMP reply packet is directly forwarded to PC A by the switching chip according to the hardware entry. The reason is that L3 Switch has obtained the mapping between the IP address and MAC address of PC A and added matching Layer 3 forwarding entry to the L3 forwarding table of the switching chip.
10. Subsequent packets exchanged between PC A and PC B are forwarded following the same process: MAC address table lookup, Layer 3 forwarding table lookup, and hardware forwarding by the switching chip.

This Document Applies to these Products

Page 4

Huawei uses machine translation combined with human proofreading to translate this document to different languages in order to help you better understand the content of this document. Note: Even the most advanced machine translation cannot match the quality of professional translators. Huawei shall not bear any responsibility for translation accuracy and it is recommended that you refer to the English document (a link for which has been provided).

This chapter describes how to configure Ethernet switching.

This Document Applies to these Products

Page 5

Huawei uses machine translation combined with human proofreading to translate this document to different languages in order to help you better understand the content of this document. Note: Even the most advanced machine translation cannot match the quality of professional translators. Huawei shall not bear any responsibility for translation accuracy and it is recommended that you refer to the English document (a link for which has been provided).

In Figure 3-1, DeviceA and DeviceB are connected through three Ethernet physical links. These links bundle into a logical link, and their bandwidths are combined to form the total bandwidth of the logical link. The three physical Ethernet links provide backup for each other, improving reliability.

Both devices connected by the Eth-Trunk must use the same number of physical interfaces, interface rate, jumbo, and flow control mode.

Figure 3-1 Eth-Trunk networking

The link aggregation interface can be used as a common Ethernet interface to implement routing protocols and other services. Unlike a common Ethernet interface, the link aggregation interface needs to select one or more member interfaces to forward traffic.

Link aggregation concepts are described as follows:

• Link aggregation, link aggregation group (LAG), and link aggregation interface

  Link aggregation technology bundles a group of physical interfaces into a logical interface to increase bandwidth and improve reliability.

  An LAG binds multiple Ethernet links.

  Each LAG has one logical interface, that is, link aggregation interface or Eth-Trunk.

• Member interface and member link

  The interfaces that constitute an Eth-Trunk are member interfaces. A link corresponding to a member interface is a member link.

• Active and inactive interfaces and links

  There are two types of interfaces in a LAG: active interfaces that forward data and inactive interfaces that do not forward data.

  The link connected to an active interface is the active link, and the link connected to an inactive interface is the inactive link.

• Upper threshold for the number of active interfaces

  When the number of active interfaces reaches this threshold, the bandwidth of the Eth-Trunk will not increase even if more member links go Up. This guarantees high network reliability. When the number of active member interfaces reaches the upper threshold, additional active member interfaces go Down.

  For example, 8 fully-functioning member links bundle into an Eth-Trunk link, with each link providing a bandwidth of 1 Gbit/s. If the Eth-Trunk link only needs to provide a maximum bandwidth of 5 Gbit/s, you can set the maximum number of Up member links to 5 or larger. The remaining unselected links in Up state automatically enter the backup state, improving reliability.

• Lower threshold for the number of active interfaces

  When the number of active interfaces falls below the lower threshold, the Eth-Trunk goes Down. This guarantees the minimum available bandwidth for the Eth-Trunk.

  For example, if the Eth-Trunk is required to provide a minimum bandwidth of 2 Gbit/s and each member link's bandwidth is 1 Gbit/s, the lower threshold must be set to 2 or larger.

This Document Applies to these Products

Page 6

Huawei uses machine translation combined with human proofreading to translate this document to different languages in order to help you better understand the content of this document. Note: Even the most advanced machine translation cannot match the quality of professional translators. Huawei shall not bear any responsibility for translation accuracy and it is recommended that you refer to the English document (a link for which has been provided).

A conventional Ethernet frame is encapsulated with the Length/Type field for an upper-layer protocol following the Destination address and Source address fields, as shown in Figure 5-2.

Figure 5-2 Conventional Ethernet frame format

IEEE 802.1Q is an Ethernet networking standard for a specified Ethernet frame format. It adds a 4-byte field between the Source address and the Length/Type fields of the original frame, as shown in Figure 5-3.

Figure 5-3 802.1Q frame format

Table 5-1 describes the fields contained in a 802.1Q tag.

Table 5-1 Fields contained in an 802.1Q tag

Each frame sent by a 802.1Q-capable switch carries a VLAN ID. The following are the two types of Ethernet frames in a VLAN:

• Tagged frames: frames with 4-byte 802.1Q tags.
• Untagged frames: frames without 4-byte 802.1Q tags.

As shown in Figure 5-4, there are the following types of VLAN links:

• Access link: connects a host to a switch. Generally, a host does not know which VLAN it belongs to, and host hardware cannot distinguish frames with VLAN tags. Therefore, hosts send and receive only untagged frames.

• Trunk link: connects a switch to another switch or to a router. Data of different VLANs is transmitted along a trunk link. The two ends of a trunk link must be able to distinguish frames with VLAN tags. Therefore, only tagged frames are transmitted along trunk links.

Figure 5-4 Link types

• A host does not need to know the VLAN to which it belongs. It sends only untagged frames.
• After receiving an untagged frame from a host, a switching device determines the VLAN to which the frame belongs. The determination is based on the configured VLAN assignment method such as port information, and then the switching device processes the frame accordingly.
• If the frame needs to be forwarded to another switching device, the frame must be transparently transmitted along a trunk link. Frames transmitted along trunk links must carry VLAN tags to allow other switching devices to properly forward the frame based on the VLAN information.
• Before sending the frame to the destination host, the switching device connected to the destination host removes the VLAN tag from the frame to ensure that the host receives an untagged frame.

Generally, only tagged frames are transmitted on trunk links; only untagged frames are transmitted on access links. In this manner, switching devices on the network can properly process VLAN information and hosts are not concerned about VLAN information.

After the 802.1Q defines VLAN frames, ports can be classified into four types:

• Access port

  As shown in Figure 5-4, an access port on a switch connects to the port on a host. The access port can only connect to an access link. Only the VLAN whose ID is the same as the default VLAN ID is allowed on the access port. Ethernet frames sent from the access port are untagged frames.

• Trunk port

  As shown in Figure 5-4, a trunk port on a switch connects to another switch. It can only connect to a trunk link. Multiple tagged VLAN frames are allowed on the trunk port.

• Hybrid port

  As shown in Figure 5-5, a hybrid port on a switch can connect either to a host or to another switch. A hybrid port can connect either to an access link or to a trunk link. The hybrid port allows multiple VLAN frames and removes tags from some VLAN frames on the outbound port.

  Figure 5-5 Port types
  
  

• QinQ port

  QinQ ports are enabled with the IEEE 802.1 QinQ protocol. A QinQ port adds a tag to a single-tagged frame and supports a maximum of 4094 x 4094 VLAN tags, which meets the requirement for the VLAN quantity.

  Figure 5-6 shows the format of a QinQ frame. The outer tag is often called the public tag and carries the VLAN ID of the public network, whereas the inner tag is often called the private tag and carries the VLAN ID of the private network.

Figure 5-6 Format of a QinQ frame

For details on the QinQ protocol, see QinQ.

The default VLAN ID of an interface is called the port default VLAN ID (PVID). The meaning of the default VLAN varies according to the port type.

For details on different PVIDs and methods of processing Ethernet frames, see Frame processing based on the port type.

VLAN assignment is a basic VLAN configuration. Users in the same VLAN can communicate with each other. Table 5-2 shows the VLAN assignment methods and their usage scenarios.

Table 5-2 Differences between VLAN assignment modes

The switch supports multiple VLAN assignment modes, the priority is of MAC address-based VLAN assignment or IP subnet-based VLAN assignment, protocol-based VLAN assignment, interface-based VLAN assignment in a descending order.

• If packets match both MAC address-based VLAN assignment and IP subnet-based VLAN assignment, by default, MAC address-based VLAN assignment is preferentially adopted. Alternatively, you can run commands to change priorities of these two VLAN assignment modes to select a VLAN assignment mode.

• Interface-based VLAN assignment has the lowest priority and is the most common VLAN assignment mode.

This Document Applies to these Products

Page 7

Huawei uses machine translation combined with human proofreading to translate this document to different languages in order to help you better understand the content of this document. Note: Even the most advanced machine translation cannot match the quality of professional translators. Huawei shall not bear any responsibility for translation accuracy and it is recommended that you refer to the English document (a link for which has been provided).

MAC address flapping occurs when a MAC address is learned by two interfaces in the same VLAN and the MAC address entry learned later overrides the earlier one. Figure 2-4 shows how MAC address flapping occurs. In the MAC address entry with MAC address 0011-0022-0034 and VLAN 2, the outbound interface is changed from 10GE1/0/1 to 10GE1/0/2. MAC address flapping can cause an increase in the CPU usage on the device.

MAC address flapping does not occur frequently on a network unless a network loop occurs. If MAC address flapping frequently occurs on your network, you can quickly locate the fault and eliminate the loops according to alarms and MAC address flapping records.

Figure 2-4 MAC address flapping

MAC address flapping detection determines whether MAC address flapping occurs by checking whether outbound interfaces in MAC address entries change frequently.

After MAC address flapping detection is enabled, the device can report an alarm when MAC address flapping occurs. The alarm contains the flapping MAC address, VLAN ID, and outbound interfaces between which the MAC address flaps. A loop may exist between the outbound interfaces. You can locate the cause of the loop based on the alarm. Alternatively, the device can perform the action specified in the configuration of MAC address flapping detection to remove the loop automatically. The action can be quit-vlan (remove the interface from the VLAN) or error-down (shut down the interface).

Figure 2-5 Networking of MAC address flapping detection

As shown in Figure 2-5, a network cable is correctly connected between SwitchC to SwitchD, causing a loop between SwitchB, SwitchC, and SwitchD. When Port1 of SwitchA receives a broadcast packet, SwitchA forwards the packet to SwitchB. The packet is then sent to Port2 of SwitchA. After MAC address flapping detection is configured on SwitchA, SwitchA can detect that the source MAC address of the packet flaps from Port1 to Port2. If the MAC address flaps between Port1 and Port2 frequently, SwitchA reports an alarm about MAC address flapping to alert the network administrator.

MAC address flapping detection allows a device to detect changes in traffic transmission paths based on learned MAC addresses, but the device cannot obtain the entire network topology. It is recommended that this function be used on the interface connected to a user network where loops may occur.

MAC address flapping occurs on a network when the network has a loop or undergoes an attack.

During network planning, you can use the following methods to prevent MAC address flapping:

• Increase the MAC address learning priority of an interface: When the same MAC address is learned on interfaces of different priorities, the MAC address entry on the interface with the highest priority overrides the MAC address entries on the other interfaces.
• Prevent MAC address entries from being overridden on interfaces with the same priority: If the interface connected to a bogus network device has the same priority as the interface connected to an authorized device, the MAC address entry of the bogus device learned later does not override the original correct MAC address entry. If the authorized device is powered off, the MAC address entry of the bogus device is learned. After the authorized device is powered on again, its MAC address cannot be learned.

Figure 2-6 Networking of MAC address flapping prevention

This Document Applies to these Products

Page 8

Huawei uses machine translation combined with human proofreading to translate this document to different languages in order to help you better understand the content of this document. Note: Even the most advanced machine translation cannot match the quality of professional translators. Huawei shall not bear any responsibility for translation accuracy and it is recommended that you refer to the English document (a link for which has been provided).

VLAN is widely applied to switching networks because of its flexible control of broadcast domains and convenient deployment. On a Layer-3 switch, the interconnection between the broadcast domains is implemented using one VLAN to correspond to one Layer 3 logic interface. However, this can waste IP addresses. Figure 5-10 shows the VLAN division in the device.

Figure 5-10 Networking of a common VLAN

Table 5-4 Example of assigning server addresses on a common VLAN

As shown in Table 5-4, VLAN 2 requires 10 server addresses. The subnet 10.1.1.0/28 with the mask length as 28 bits is assigned for VLAN 2. 10.1.1.0 is the address of the subnet, and 10.1.1.15 is the directed broadcast address. These two addresses cannot serve as the host address. In addition, as the default address of the network gateway of the subnet, 10.1.1.1 cannot be used as the host address. The other 13 addresses ranging from 10.1.1.2 to 10.1.1.14 can be used by the servers. In this way, although VLAN 2 needs only 10 addresses, 13 addresses need to be assigned for it according to the division of the subnet.

VLAN 3 requires five server addresses. The subnet 10.1.1.16/29 with the mask length as 29 bits needs to be assigned for VLAN 3. VLAN 4 requires only one address. The subnet 10.1.1.24/30 with the mask length as 30 bits needs to be assigned for VLAN 4.

In above, 16 (10+5+1) addresses are needed for all the preceding VLANs. However, 28 (16+8+4) addresses are needed according to the common VLAN addressing mode even if the optimal scheme is used. Nearly half of the addresses is wasted. In addition, if VLAN 2 is accessed to three servers instead of 10 servers later, the extra addresses will not be used by other VLANs and will be wasted.

This division is inconvenient for the later network upgrade and expansion. Assume that two more servers need to be added to VLAN 4 and VLAN 4 does not want to change the assigned IP addresses, and the addresses after 10.1.1.24 has been assigned to others, a new subnet with the mask length as 29 bits and a new VLAN need to be assigned for the new customers of VLAN 4. Therefore, the customers of VLAN 4 have only three servers, but the customers are assigned to two subnets and are not in the same VLAN. As a result, this is inconvenient for network management.

In above, many IP addresses are used as the addresses of subnets, directional broadcast addresses of subnets, and default addresses of network gateways of subnets. These IP addresses cannot be used as the server addresses in the VLAN. The limit on address assignation reduces the addressing flexibility, so that many idle addresses are wasted. To solve this problem, VLAN aggregation is used.

The VLAN aggregation technology, also known as the super-VLAN, provides a mechanism that partitions the broadcast domain using multiple VLANs in a physical network so that different VLANs can belong to the same subnet. In VLAN aggregation, two concepts are involved, namely, super-VLAN and sub-VLAN.

• Super-VLAN: It is different from the common VLAN. In the super-VLAN, only Layer 3 interfaces are created and physical ports are not contained. The super-VLAN can be viewed as a logical Layer 3 concept. It is a collection of many sub-VLANs.
• Sub-VLAN: It is used to isolate broadcast domains. In the sub-VLAN, only physical ports are contained and Layer 3 VLANIF interfaces cannot be created. The Layer 3 switching with the external network is implemented through the Layer 3 interface of the super-VLAN.

A super-VLAN can contain one or more sub-VLANs retaining different broadcast domains. The sub-VLAN does not occupy an independent subnet segment. In the same super-VLAN, IP addresses of servers belong to the subnet segment of the super-VLAN, regardless of the mapping between servers and sub-VLANs.

The same Layer 3 interface is shared by sub-VLANs. Some subnet IDs, default gateway addresses of the subnets, and directed broadcast addresses of the subnets are saved and different broadcast domains can use the addresses in the same subnet segment. As a result, subnet differences are eliminated, addressing becomes flexible and idle addresses are reduced.

Table 5-4 is used to explain the implementation. Suppose that user demands are unchanged. In VLAN 2, 10 server addresses are demanded; in VLAN 3, five server addresses are demanded; in VLAN 4, one server address is demanded.

According to the implementation of VLAN aggregation, create VLAN 10 and configure VLAN 10 as a super-VLAN. Then assign a subnet address 10.1.1.0/24 with the mask length being 24 to VLAN 10; 10.1.1.0 is the subnet ID and 10.1.1.1 is the gateway address of the subnet, as shown in Figure 5-11. Address assignments of sub-VLANs (VLAN 2, VLAN 3, and VLAN 4) are shown in Table 5-5.

Figure 5-11 Networking of VLAN aggregation

Table 5-5 Example for assigning Server addresses in VLAN aggregation mode

In VLAN aggregation implementation, sub-VLANs are not divided according to the previous subnet border. Instead, their addresses are flexibly assigned in the subnet corresponding to the super-VLAN according to the required server number.

As the Table 5-5 shows that VLAN 2, VLAN 3, and VLAN 4 share a subnet (10.1.1.0/24), a default gateway address of the subnet (10.1.1.1), and a directed broadcast address of the subnet (10.1.1.255). In this manner, the subnet ID (10.1.1.16, 10.1.1.24), the default gateway of the subnet (10.1.1.17, 10.1.1.25), and the directed broadcast address of the subnet (10.1.1.15, 10.1.1.23, and 10.1.1.27) can be used as IP addresses of servers.

Totally, 16 addresses (10 + 5 + 1 = 16) are required for the three VLANs. In practice, in this subnet, a total of 16 addresses are assigned to the three VLANs (10.1.1.2 to 10.1.1.17). A total of 19 IP addresses are used, that is, the 16 server addresses together with the subnet ID (10.1.1.0), the default gateway of the subnet (10.1.1.1), and the directed broadcast address of the subnet (10.1.1.255). In the network segment, 236 addresses (255 - 19 = 236) are available, which can be used by any server in the sub-VLAN.

• Introduction

  VLAN aggregation ensures that different VLANs use the IP addresses in the same subnet segment. This, however, leads to the problem of Layer 3 forwarding between sub-VLANs.

  In common VLAN mode, the servers of different VLANs can communicate with each other based on the Layer 3 forwarding through their respective gateways. In VLAN aggregation mode, the servers in a super-VLAN use the IP addresses in the same network segment and share the same gateway address. The servers in different sub-VLANs belong to the same subnet. Therefore, they communicate with each other based on the Layer 2 forwarding, rather than the Layer 3 forwarding through a gateway. In practice, servers in different sub-VLANs are separated in Layer 2. As a result, sub-VLANs fails to communicate with each other.

  To solve the preceding problem, you can use Proxy ARP.

  For details about proxy ARP, see ARP in the IP Services.

• Layer 3 communication between different sub-VLANs

  If hosts on the same network segment of the same physical network but in different VLANs need to communicate at Layer 3, you need to enable inter-VLAN proxy ARP on the corresponding VLANIF interfaces.

  As shown in Figure 5-12, Host A and Host B on the same network segment are connected to the Switch, Host A belongs to VLAN 3, and Host B belongs to VLAN 2. Host A and Host B belong to different sub-VLANs, so they cannot communicate at Layer 2.

  Figure 5-12 Inter-VLAN proxy ARP implementation
  
  

  You can enable inter-VLAN proxy ARP on VLANIF 4 of the Switch to solve this problem.

  1. Host A sends an ARP Request packet for the MAC address of Host B.
  2. After receiving the ARP Request packet, the Switch detects that the destination IP address is not its IP address and determines that the requested MAC address is not its MAC address. The Switch then checks whether there is an ARP entry of Host B.
     • If there is an ARP entry that matches Host B and VLAN information in this entry is different from that in the receiving port, the Switch checks whether inter-VLAN proxy ARP is enabled on the corresponding VLANIF interface.

       • If inter-VLAN proxy ARP is enabled, the Switch sends the MAC address of VLANIF 4 to Host A.

         After receiving the ARP Replay packet from the Switch, Host A considers the packet as the ARP Replay packet from Host B. Host A learns the MAC address of VLANIF 4 on the Switch and uses this MAC address to send data packets to Host B.

       • If inter-VLAN proxy ARP is not enabled, the Switch discards the ARP Request packet sent by Host A.
     • If there is no ARP entry of Host B, the Switch discards the ARP Request packet sent by Host A, and checks whether inter-VLAN proxy ARP is enabled on the corresponding VLANIF interface.
       • If inter-VLAN proxy ARP is enabled, the Switch broadcasts the ARP Request packet with the IP address of Host B as the destination IP address within VLAN 2. After the Switch receives an ARP Reply packet from Host B, the Switch generates an ARP entry indicating the mapping between the IP and MAC addresses of Host B.
       • If inter-VLAN proxy ARP is not enabled, the Switch does not perform any operations.

• Layer 2 communication between a sub-VLAN and an external network

  As shown in Figure 5-13, in the Layer 2 VLAN communication based on ports, the received or sent frames are not tagged with the super-VLAN ID.

  Figure 5-13 Networking of Layer 2 communication between a sub-VLAN and an external network
  
  

  The frame that accesses Switch1 through Port1 on Server A is tagged with the ID of VLAN 2. The VLAN ID, however, is not changed to the ID of VLAN 10 on Switch1 even if VLAN 2 is the sub-VLAN of VLAN 10. After passing through Port3, which is the trunk type, this frame still carries the ID of VLAN 2.

  That is, Switch1 itself does not send the frames of VLAN 10. In addition, Switch1 discards the frames of VLAN 10 that are sent to Switch1 by other devices because Switch1 has no corresponding physical port for VLAN 10.

  A super-VLAN has no physical port. This limitation is obligatory, as shown below:

  • If you configure the super-VLAN and then the trunk interface, the frames of a super-VLAN are filtered automatically according to the VLAN range set on the trunk interface.

    As shown in Figure 5-13, no frame of the super-VLAN 10 passes through Port3 on Switch1, even though the interface allows frames from all VLANs to pass through.

  • If you finish configuring the trunk interface and allow all VLANs to pass through, you still cannot configure the super-VLAN on Switch1. The root cause is that any VLAN with physical ports cannot be configured as the super-VLAN, and the trunk interface allows only the frames tagged with VLAN IDs to pass through. Therefore, no VLAN can be configured as a super-VLAN.

  As for Switch1, the valid VLANs are just VLAN 2 and VLAN 3, and all frames are forwarded in these VLANs.

• Layer 3 communication between a sub-VLAN and an external network

  Figure 5-14 Networking of Layer 3 communication between a sub-VLAN and an external network
  
  

  As shown in Figure 5-14, Switch1 is configured with super-VLAN 4, sub-VLAN 2, sub-VLAN 3, and a common VLAN 10. Switch2 is configured with two common VLANs, namely, VLAN 10 and VLAN 20. Suppose that Switch1 is configured with the route to the network segment 10.1.3.0/24, and Switch2 is configured with the route to the network segment 10.1.1.0/24. Then Server A in sub-VLAN 2 that belongs to the super-VLAN 4 needs to access Server C in Switch2.

  1. After comparing the IP address of Server C 10.1.3.2 with its IP address, Server A finds that two IP addresses are not in the same network segment 10.1.1.0/24.
  2. Server A initiates an ARP broadcast to its gateway to request for the MAC address of the gateway.
  3. After receiving the ARP request, Switch1 identifies the correlation between the sub-VLAN and the super-VLAN, and offers an ARP response to Server A through sub-VLAN 2. The source MAC address in the ARP response packet is the MAC address of VLANIF4 for super-VLAN 4.
  4. Server A learns the MAC address of the gateway.
  5. Server A sends the packet to the gateway, with the destination MAC address as the MAC address of VLANIF4 for super-VLAN 4, and the destination IP address as 10.1.3.2.
  6. After receiving the packet, Switch1 performs the Layer 3 forwarding and sends the packet to Switch2, with the next hop address as 10.1.2.2, the outgoing interface as VLANIF10.
  7. After receiving the packet, Switch2 performs the Layer 3 forwarding and sends the packet to Server C through the directly-connected interface VLANIF20.
  8. The response packet from Server C reaches Switch1 after the Layer 3 forwarding on Switch2.
  9. After receiving the packet, Switch1 performs the Layer 3 forwarding and sends the packet to Server A through the super-VLAN.

Page 9

Huawei uses machine translation combined with human proofreading to translate this document to different languages in order to help you better understand the content of this document. Note: Even the most advanced machine translation cannot match the quality of professional translators. Huawei shall not bear any responsibility for translation accuracy and it is recommended that you refer to the English document (a link for which has been provided).

Figure 5-21 Networking diagram of VLAN aggregation application

As shown in Figure 5-21, four VLANs, namely, VLAN 21, VLAN 22, VLAN 31, and VLAN 32, are configured. If these VLANs need to communicate with each other, you should configure an IP address for each VLAN on the Switch.

Alternatively, you can enable VLAN aggregation to aggregate VLAN 21 and VLAN 22 into super VLAN 2, and VLAN 31 and VLAN 32 into super VLAN 3. Therefore, you can save IP addresses by only assigning IP addresses to the super VLANs.

After Proxy ARP is configured on Switch, the sub-VLANs in each super VLAN can communicate with each other.

This Document Applies to these Products

Page 10

Huawei uses machine translation combined with human proofreading to translate this document to different languages in order to help you better understand the content of this document. Note: Even the most advanced machine translation cannot match the quality of professional translators. Huawei shall not bear any responsibility for translation accuracy and it is recommended that you refer to the English document (a link for which has been provided).

To use a network management system to manage multiple devices, create a VLANIF interface on each device and configure a management IP address for the VLANIF interface. You can then log in to a device and manage it using its management IP address. If a user-side interface is added to the VLAN, users connected to the interface can also log in to the device. This brings security risks to the device.

After a VLAN is configured as a management VLAN (mVLAN), no access interface or dot1q-tunnel interface can be added to the VLAN. An access interface or a dot1q-tunnel interface is connected to users. The mVLAN forbids users connected to access and dot1q-tunnel interfaces to log in to the device, improving device performance.

This Document Applies to these Products

Page 11

Huawei uses machine translation combined with human proofreading to translate this document to different languages in order to help you better understand the content of this document. Note: Even the most advanced machine translation cannot match the quality of professional translators. Huawei shall not bear any responsibility for translation accuracy and it is recommended that you refer to the English document (a link for which has been provided).

VLAN mapping technology changes VLAN tags in packets to implement the mapping between different VLANs.

In some scenarios, two Layer 2 user networks in the same VLAN are connected through the backbone network. To implement Layer 2 connectivity between users and deploy Layer 2 protocols such as MSTP uniformly, the two user networks need to seamlessly interwork with each other. In this case, the backbone network needs to transmit VLAN packets from the user networks. Generally, VLAN plan on the backbone network and user network is different, so the backbone network cannot directly transmit VLAN packets from a user network.

One method is to configure a Layer 2 tunneling technology such as QinQ or VPLS to encapsulate VLAN packets into packets on the backbone network so that VLAN packets are transparently transmitted. However, this method increases extra cost because packets are encapsulated. In addition, Layer 2 tunneling technology may not support transparent transmission of packets of some protocol packets. The other method is to configure VLAN mapping. When VLAN packets from a user network enter the backbone network, an edge device on the backbone network changes the C-VLAN ID to the S-VLAN ID. After the packets are transmitted to the other side, the edge device changes the S-VLAN ID to the C-VLAN ID. This method implements seamless interworking between two user networks.

VLAN IDs in two directly connected Layer 2 networks are different because of different plans. The user needs to manage the two networks as a single Layer 2 network. For example, Layer 2 connectivity and Layer 2 protocols need to be deployed uniformly. VLAN mapping can be configured on the switch connecting the two user networks to map VLAN IDs on the two user networks. This implements Layer 2 connectivity and uniform management.

This Document Applies to these Products

Page 12

Huawei uses machine translation combined with human proofreading to translate this document to different languages in order to help you better understand the content of this document. Note: Even the most advanced machine translation cannot match the quality of professional translators. Huawei shall not bear any responsibility for translation accuracy and it is recommended that you refer to the English document (a link for which has been provided).

The Generic Attribute Registration Protocol (GARP) provides an attribute propagation mechanism. The GARP VLAN Registration Protocol (GVRP) is a GARP application used to register and deregister VLAN attribute.

GARP identifies applications based on destination MAC addresses. IEEE Std 802.1Q assigns 01-80-C2-00-00-21 to GVRP.

To create or delete VLANs on all devices on a network, a network administrator must manually create or delete the VLANs on each device. When a network is too complex for a network administrator to know the network topology in a short time or when many VLANs are configured on the network, the manual configuration workload is enormous and configuration errors will occur. GVRP can be configured on the network to implement automatic VLAN registration and deregistration in this case.

Through GVRP, VLAN attributes of one device can be propagated throughout the entire switching network. GVRP enables network devices to dynamically deliver, register, and propagate VLAN attributes, reducing workload of the network administrator and ensuring correct configuration.

This Document Applies to these Products

Page 13

Huawei uses machine translation combined with human proofreading to translate this document to different languages in order to help you better understand the content of this document. Note: Even the most advanced machine translation cannot match the quality of professional translators. Huawei shall not bear any responsibility for translation accuracy and it is recommended that you refer to the English document (a link for which has been provided).

Generally, redundant links are used on an Ethernet switching network to provide link backup and enhance network reliability. The use of redundant links, however, may produce loops, causing broadcast storms and rendering the MAC address table unstable. As a result, the communication quality deteriorates, and the communication service may even be interrupted. The Spanning Tree Protocol (STP) is introduced to solve this problem.

STP refers to STP defined in IEEE 802.1D, the Rapid Spanning Tree Protocol (RSTP) defined in IEEE 802.1w, and the Multiple Spanning Tree Protocol (MSTP) defined in IEEE 802.1s.

MSTP is compatible with RSTP and STP, and RSTP is compatible with STP. STP, RSTP, and MSTP all prevent broadcast storms and achieve redundancy. Table 10-1 compares STP, RSTP, and MSTP.

Table 10-1 Comparison between STP, RSTP, and MSTP

After a spanning tree protocol is configured on an Ethernet switching network, it calculates the network topology and implements the following functions to remove network loops:

• Loop cut-off: The potential loops on the network are cut off by blocking redundant links.
• Link redundancy: If an active path becomes faulty, a redundant link can be activated to ensure network connectivity.

In addition to the above functions, MSTP also ensures faster convergence than STP and can load balance among multiple VLANs.

This Document Applies to these Products

Page 14

Huawei uses machine translation combined with human proofreading to translate this document to different languages in order to help you better understand the content of this document. Note: Even the most advanced machine translation cannot match the quality of professional translators. Huawei shall not bear any responsibility for translation accuracy and it is recommended that you refer to the English document (a link for which has been provided).

VBST, a Huawei spanning tree protocol, constructs a spanning tree in each VLAN so that traffic from different VLANs is forwarded through different spanning trees. VBST is equivalent to STP or RSTP running in each VLAN. Spanning trees in different VLANs are independent of each other.

Currently, there are three standard spanning tree protocols: Spanning Tree Protocol (STP), Rapid Spanning Tree Protocol (RSTP), and Multiple Spanning Tree Protocol (MSTP). STP and RSTP cannot implement VLAN-based load balancing, because all the VLANs on a LAN share a spanning tree and packets in all VLANs are forwarded along this spanning tree. In addition, the blocked link does not carry any traffic, which wastes bandwidth and may cause a failure to forward packets from some VLANs. In real-world situations, MSTP is preferred because it is compatible with STP and RSTP, ensures fast convergence, and provides multiple paths to load balance traffic.

On enterprise networks, enterprise users need functions that are easy to use and maintain, whereas the configuration of MSTP multi-instance is complex and has high requirements for engineers' skills.

To address this issue, Huawei develops VBST. VBST constructs a spanning tree in each VLAN so that traffic from different VLANs is load balanced along different spanning trees. In addition, VBST is easy to configure and maintain.

VBST brings in the following benefits:

• Eliminates loops.
• Implements link multiplexing and load balancing, and therefore improves link use efficiency.
• Reduces configuration and maintenance costs.

Table 11-1 lists the comparisons between VBST and STP/RSTP/MSTP.

Table 11-1 Comparisons between VBST and STP/RSTP/MSTP

This Document Applies to these Products

Page 15

Huawei uses machine translation combined with human proofreading to translate this document to different languages in order to help you better understand the content of this document. Note: Even the most advanced machine translation cannot match the quality of professional translators. Huawei shall not bear any responsibility for translation accuracy and it is recommended that you refer to the English document (a link for which has been provided).

Multichassis Link Aggregation Group (M-LAG) implements link aggregation among multiple devices. In a dual-active system shown in Figure 4-1, one device is connected to two devices through M-LAG to achieve device-level link reliability.

Figure 4-1 M-LAG network

As an inter-device link aggregation technology, M-LAG increases link bandwidth, improves link reliability, and implements load balancing. It has the following advantages:

• High reliability

  M-LAG protects link reliability for entire devices.

• Simplified network and configuration

  M-LAG is a horizontal virtualization technology that virtualizes two dual-homed devices into one device. M-LAG prevents loops on a Layer 2 network and implements redundancy, without performing laborious spanning tree protocol configuration. M-LAG greatly simplifies the network and configuration.

• Independent upgrade

  Two devices can be upgraded independently. This prevents service interruption when either device is upgrading.

This Document Applies to these Products

Page 16

Huawei uses machine translation combined with human proofreading to translate this document to different languages in order to help you better understand the content of this document. Note: Even the most advanced machine translation cannot match the quality of professional translators. Huawei shall not bear any responsibility for translation accuracy and it is recommended that you refer to the English document (a link for which has been provided).

This Document Applies to these Products

Page 17

Huawei uses machine translation combined with human proofreading to translate this document to different languages in order to help you better understand the content of this document. Note: Even the most advanced machine translation cannot match the quality of professional translators. Huawei shall not bear any responsibility for translation accuracy and it is recommended that you refer to the English document (a link for which has been provided).

This Document Applies to these Products

Page 18

Huawei uses machine translation combined with human proofreading to translate this document to different languages in order to help you better understand the content of this document. Note: Even the most advanced machine translation cannot match the quality of professional translators. Huawei shall not bear any responsibility for translation accuracy and it is recommended that you refer to the English document (a link for which has been provided).

This Document Applies to these Products

Page 19

Huawei uses machine translation combined with human proofreading to translate this document to different languages in order to help you better understand the content of this document. Note: Even the most advanced machine translation cannot match the quality of professional translators. Huawei shall not bear any responsibility for translation accuracy and it is recommended that you refer to the English document (a link for which has been provided).

This Document Applies to these Products

Page 20

Huawei uses machine translation combined with human proofreading to translate this document to different languages in order to help you better understand the content of this document. Note: Even the most advanced machine translation cannot match the quality of professional translators. Huawei shall not bear any responsibility for translation accuracy and it is recommended that you refer to the English document (a link for which has been provided).

Virtual Spanning Tree Protocol (V-STP) is a Layer 2 topology management feature and virtualizes two STP-enabled devices into one device to perform STP calculation.

STP can detect the M-LAG master or backup status. After V-STP is enabled on the M-LAG master and backup devices and M-LAG master/backup negotiation is successful, two devices are virtualized into one device for port role calculation and fast convergence. STP needs to synchronize the bridge information and instance priority of the M-LAG master and backup devices. After M-LAG master/backup negotiation is successful, the backup device uses the bridge MAC address and instance priority that is synchronized from the master device for STP calculation and packet transmission. This ensures STP parameter calculation on the virtualized device.

V-STP can be only applicable to M-LAG networking. It can be used in multi-level M-LAG interconnection scenarios and scenarios where devices in the M-LAG function as non-root-bridges.

When configuring V-STP, ensure that the STP/RSTP timer settings on the two devices that constitute an M-LAG be the same. Otherwise, network flapping may occur.

1. Run system-view

   The system view is displayed.

2. Run stp mode { stp | rstp }

   The switch is configured to work in STP or RSTP mode.

   By default, the switch works in MSTP mode.

   V-STP does not support the MSTP mode, and supports multi-process. By default, an MSTP process works in MSTP mode. Currently, only STP and RSTP modes are supported in V-STP scenarios. The MSTP process therefore must be configured to work in STP or RSTP mode in V-STP scenarios.

3. (Optional) Run stp bridge-address mac-address

   The bridge MAC address used in spanning tree participation is configured.

   By default, the switch's MAC address is the bridge MAC address of the switch that participates in spanning tree calculation.

   To prevent STP network flapping caused by switch restart or DFS active/standby switchover and ensure revertive switching performance, you are advised to set a larger bridge MAC address for the switch in DFS backup state when the M-LAG master and backup devices have the same priority.

4. Run stp v-stp enable

   V-STP is enabled on an M-LAG device.

   By default, V-STP is disabled on an M-LAG device.

5. Run commit

   The configuration is committed.

This Document Applies to these Products

Page 21

Huawei uses machine translation combined with human proofreading to translate this document to different languages in order to help you better understand the content of this document. Note: Even the most advanced machine translation cannot match the quality of professional translators. Huawei shall not bear any responsibility for translation accuracy and it is recommended that you refer to the English document (a link for which has been provided).

This Document Applies to these Products

Page 22

Huawei uses machine translation combined with human proofreading to translate this document to different languages in order to help you better understand the content of this document. Note: Even the most advanced machine translation cannot match the quality of professional translators. Huawei shall not bear any responsibility for translation accuracy and it is recommended that you refer to the English document (a link for which has been provided).

This Document Applies to these Products

Page 23

Huawei uses machine translation combined with human proofreading to translate this document to different languages in order to help you better understand the content of this document. Note: Even the most advanced machine translation cannot match the quality of professional translators. Huawei shall not bear any responsibility for translation accuracy and it is recommended that you refer to the English document (a link for which has been provided).

ERPS works for ERPS rings. An ERPS ring consists of interconnected Layer 2 switching devices configured with the same control VLAN and data VLAN. Before configuring other ERPS functions, you must configure an ERPS ring.

1. Run system-view

   The system view is displayed.

2. Run erps ring ring-id

   An ERPS ring is created and the ERPS ring view is displayed.

3. (Optional) Run description

   The description of the device is configured. The description can contain the ERPS ring ID, which facilitates device maintenance in an ERPS ring.

   By default, the description of an ERPS ring is the ERPS ring name, for example, Ring 1.

4. Run commit

   The configuration is committed.

In an ERPS ring, the control VLAN is used only to forward RAPS PDUs but not service packets, so the security of ERPS is improved. All the devices in an ERPS ring must be configured with the same control VLAN, and different ERPS rings must use different control VLANs.

1. Run system-view

   The system view is displayed.

2. Run erps ring ring-id

   The ERPS ring view is displayed.

3. Run control-vlan vlan-id

   The control VLAN of the ERPS ring is configured.

   • The control VLAN specified by vlan-id must be a VLAN that has not been created or used.

   • If you run the control-vlan command multiple times, only the latest configuration takes effect.

   • If the ERPS ring contains ports, the control VLAN cannot be changed. To delete the configured control VLAN, run the undo erps ring command in the interface view or the undo port command in the ERPS ring view to delete ports from the ERPS ring, and run the undo control-vlan command to delete the control VLAN.

   • After a control VLAN is created, the vlan batch vlan-id1 [ to vlan-id2 ] &<1-10> command used to create common VLANs is displayed in the configuration file.

   • After a port is added to an ERPS ring configured with a control VLAN, the port is added to the control VLAN.

     • If the port is a trunk port, the port trunk allow-pass vlan vlan-id command is displayed in the record of the port that has been added to the ERPS ring in the configuration file.
     • If the port is a hybrid port, the port hybrid tagged vlan vlan-id command is displayed in the record of the port that has been added to the ERPS ring in the configuration file.

4. Run commit

   The configuration is committed.

On a Layer 2 device running ERPS, the VLAN in which RAPS PDUs and data packets are transmitted must be mapped to an ERP instance so that ERPS forwards or blocks the packets based on configured rules. If the mapping is not configured, the preceding packets may cause broadcast storms on the ring network. As a result, the network becomes unavailable.

1. Run system-view

   The system view is displayed.

2. Run erps ring ring-id

   The ERPS ring view is displayed.

3. Run protected-instance { all | { instance-id1 [ to instance-id2 ] &<1-10> } }

   An ERP instance is created for the ERPS ring.

   By default, no ERP instance is configured in an ERPS ring.

   • If you run the protected-instance command multiple times in the same ERPS ring, multiple ERP instances are configured.

   • If the ERPS ring contains ports, the ERP instance cannot be changed. To delete the configured ERP instance, run the undo erps ring command in the interface view or the undo port command in the ERPS ring view to delete ports from the ERPS ring, and run the undo protected instance command to delete the ERP instance.

4. Run commit

   The configuration is committed.

5. Run quit

   The system view is displayed.

6. Configure the mapping between an ERP instance and VLAN.

   1. Run stp region-configuration

      The Multiple Spanning Tree (MST) region view is displayed.

   2. Run instance instance-id vlan { vlan-id [ to vlan-id ] } &<1-10>

      The mapping between the ERP instance and VLAN is configured.

      By default, all VLANs in an MST region are mapped to instance 0.

      instance-id in this command must be the same as instance-id used by the protected-instance command.

      • A VLAN cannot be mapped to multiple MSTIs. If you map a VLAN that has already been mapped to an MSTI to another MSTI, the original mapping will be deleted.

      • The vlan-mapping modulo modulo command configures the mapping between MSTIs and VLANs based on the default algorithm. However, the mapping configured using this command cannot always meet the actual demand. Therefore, running this command is not recommended.

      • To configure the mapping between an ERP instance and a MUX VLAN, you are advised to configure the principal VLAN, subordinate group VLANs, and subordinate separate VLANs of the MUX VLAN in the same ERP instance. Otherwise, loops may occur.

   3. Run commit

      The configuration is committed.

After ERPS is configured, add Layer 2 ports to an ERPS ring and configure port roles so that ERPS can work properly.

You can add a Layer 2 port to an ERPS ring in either of the following ways:

• In the ERPS ring view, add a specified port to the ERPS ring and configure the port role.

• In the interface view, add the current port to the ERPS ring and configure the port role.

• A port can be added to a maximum of two ERPS rings.

• An ERPS-enabled port needs to allow packets of control VLANs and data VLANs to pass through, so the link type of the port must be configured as trunk or hybrid.

• Flush-FDB packets for updating MAC addresses cannot be separately sent, so do not configure a direct link between two upstream nodes as the RPL.

• Before changing the port role, use the shutdown command to disable the port. When the port role is changed, use the undo shutdown command to enable the port. This prevents traffic interruptions.

• The port is not a Layer 3 port. If the port is a Layer 3 port, run the portswitch command to switch the port to the Layer 2 mode.

• Spanning Tree Protocol (STP) or Smart Link is not enabled on the port.

  • If the port has STP enabled, run the stp disable command in the interface view to disable STP.
  • If the port has Smart Link enabled, run the undo port command in the Smart Link group view to disable Smart Link.

• The control-vlan command has been executed to configure a control VLAN and the protected-instance command has been executed to configure an ERP instance.

1. Run system-view

   The system view is displayed.

2. Add a Layer 2 port to an ERPS ring and configure the port role in either of the following ways.
   • In the ERPS ring view, add a specified port to the ERPS ring and configure the port role.

     1. Run interface interface-type interface-number

        The interface view is displayed.

     2. Run stp disable

        STP is disabled on the ERPS-enabled port.

     3. Run port link-type trunk

        The link type of the ERPS-enabled port is configured as trunk.

     4. Run port trunk allow-pass vlan { { vlan-id1 [ to vlan-id2 ] }&<1-10> | all }

        The VLANs allowed by the ERPS-enabled port are specified.

        After the control-vlan command is used in the ERPS ring view to configure a control VLAN and the port interface-type interface-number [ rpl owner ] command is configured, the ports in the ERPS ring allow packets of the control VLAN to pass through. Therefore, you need to specify only the IDs of data VLANs in this step.

     5. Run quit

        Return to the system view.

     6. Run erps ring ring-id

        The ERPS ring view is displayed.

     7. Run port interface-type interface-number [ rpl owner ]

        The port is added to the ERPS ring and its role is configured. If rpl owner is specified, the port is configured as an RPL owner port. If rpl owner is not specified, the port is a common port.

   • In the interface view, add the current port to the ERPS ring and configure the port role.

     1. Run interface interface-type interface-number

        The specified interface view is displayed.

     2. Run stp disable

        STP is disabled on the ERPS-enabled port.

     3. Run port link-type trunk

        The link type of the ERPS-enabled port is configured as trunk.

     4. Run port trunk allow-pass vlan { { vlan-id1 [ to vlan-id2 ] }&<1-10> | all }

        The VLANs allowed by the ERPS-enabled port are specified.

        After the control-vlan command is used in the ERPS ring view to configure a control VLAN and the port interface-type interface-number [ rpl owner ] command is configured, the ports in the ERPS ring allow packets of the control VLAN to pass through. Therefore, you need to specify only the IDs of data VLANs in this step.

     5. Run erps ring ring-id [ rpl owner ]

        The current port is added to the ERPS ring and its role is configured. If rpl owner is specified, the port is configured as an RPL owner port. If rpl owner is not specified, the port is a common port.

3. Run commit

   The configuration is committed.

After a link or node failure in an ERPS ring recovers, the device starts timers in the ERPS ring to reduce traffic interruptions. This prevents network flapping.

1. Run system-view

   The system view is displayed.

2. Run erps ring ring-id

   The ERPS ring view is displayed.

3. Configure the WTR timer, Guard timer, and Holdoff timer in the ERPS ring according to actual networking.

   • Run wtr-timer time-value

     The WTR timer is set.

     By default, the WTR timer is 5 minutes in an ERPS ring.

   • Run guard-timer time-value

     The Guard timer is set.

     By default, the Guard timer is 200 centiseconds in an ERPS ring.

   • Run holdoff-timer time-value

     The Holdoff timer is set.

     By default, the Holdoff timer is 0 deciseconds in an ERPS ring.

4. Run commit

   The configuration is committed.

On a Layer 2 network running ERPS, if another fault detection protocol (for example, CFM) is enabled, the MEL field in RAPS PDUs determines whether the RAPS PDUs can be forwarded. If the MEL value in an ERPS ring is smaller than the MEL value of the fault detection protocol, the RAPS PDUs have a lower priority and are discarded. If the MEL value in an ERPS ring is larger than the MEL value of the fault detection protocol, the RAPS PDUs can be forwarded. In addition, the MEL value can also be used for interworking with other vendors' devices in an ERPS ring. The same MEL value ensures smooth communication between devices.

1. Run system-view

   The system view is displayed.

2. Run erps ring ring-id

   The ERPS ring view is displayed.

3. Run raps-mel level-id

   The MEL value in the ERPS ring is set.

   By default, the MEL value in RAPS PDUs is 7.

4. Run commit

   The configuration is committed.

• Run the display erps [ ring ring-id ] [ verbose ] command to check the device ports added to an ERPS ring and ERPS ring configurations.
• Run the display erps interface interface-type interface-number [ ring ring-id ] command to check physical configurations of the port added to an ERPS ring.

This Document Applies to these Products

Page 24

Huawei uses machine translation combined with human proofreading to translate this document to different languages in order to help you better understand the content of this document. Note: Even the most advanced machine translation cannot match the quality of professional translators. Huawei shall not bear any responsibility for translation accuracy and it is recommended that you refer to the English document (a link for which has been provided).

When there is no faulty link on a ring network, Ethernet Ring Protection Switching (ERPS) can eliminate loops on the network. When a link fails on the ring network, ERPS can immediately restore communication between nodes on the network. ERPSv2, compatible with ERPSv1, supports multi-ring topologies, in addition to ERPSv1 functions such as single ring topologies and multi-instance.

ERPS works for ERPS rings. An ERPS ring consists of interconnected Layer 2 switching devices configured with the same control VLAN and data VLAN. Before configuring other ERPS functions, configure an ERPS ring.

1. Run system-view

   The system view is displayed.

2. Run erps ring ring-id

   An ERPS ring is created and the ERPS ring view is displayed.

   By default, an ERPS ring configured using the erps ring ring-id command is a major ring.

3. Run version v2

   ERPSv2 is specified.

   By default, ERPSv1 is used.

   Before specifying ERPSv1 for an ERPSv2-enabled device, delete all ERPS configurations that ERPSv1 does not support.

4. (Optional) Run sub-ring

   The ERPS ring is configured as a sub-ring.

   By default, an ERPS ring is a major ring. Major rings are closed, and sub-rings are open. This step is performed only when an existing ERPS ring needs to be used as a sub-ring.

   An ERPS ring that has a port cannot be configured as a sub-ring. Before configuring an ERPS ring that has a port as a sub-ring, run the undo erps ring command in the interface view or the undo port command in the ERPS ring view to delete the port from the ERPS ring. Then run the sub-ring command to configure the ERPS ring as a sub-ring.

5. (Optional) Run virtual-channel { enable | disable }

   The RAPS PDU transmission mode is specified in the sub-ring.

   By default, sub-rings use non-virtual-channels (NVCs) to transmit RAPS PDUs. The default transmission mode is recommended. This step takes effect only in a sub-ring.

   If the virtual-channel enable command is used to set the VC mode for RAPS PDU transmission in a sub-ring, it is recommended that the control VLAN of the major ring be used to transmit only the RAPS PDUs of the sub-ring. Otherwise, attacks may use bogus RAPS PDUs of the sub-ring to form loops or even fault in the major ring.

6. (Optional) Run description text

   The description is configured for the ERPS ring.

   By default, the description of an ERPS ring is the ERPS ring name, for example, Ring 1.

7. Run commit

   The configuration is committed.

In an ERPS ring, the control VLAN is used only to forward RAPS PDUs but not service packets, so the security of ERPS is improved. All the devices in an ERPS ring must be configured with the same control VLAN, and different ERPS rings must use different control VLANs.

1. Run system-view

   The system view is displayed.

2. Run erps ring ring-id

   The ERPS ring view is displayed.

3. Run control-vlan vlan-id

   The control VLAN of the ERPS ring is configured.

   • The control VLAN specified by vlan-id must be a VLAN that has not been created or used.

   • If you run the control-vlan command multiple times, only the latest configuration takes effect.

   • If the ERPS ring contains ports, the control VLAN cannot be changed. To delete the configured control VLAN, run the undo erps ring command in the interface view or the undo port command in the ERPS ring view to delete ports from the ERPS ring, and run the undo control-vlan command to delete the control VLAN.

   • After a control VLAN is created, the vlan batch vlan-id1 [ to vlan-id2 ] &<1-10> command used to create common VLANs is displayed in the configuration file.

   • After a port is added to an ERPS ring configured with a control VLAN, the port is added to the control VLAN.

     • If the port is a trunk port, the port trunk allow-pass vlan vlan-id command is displayed in the record of the port that has been added to the ERPS ring in the configuration file.
     • If the port is a hybrid port, the port hybrid tagged vlan vlan-id command is displayed in the record of the port that has been added to the ERPS ring in the configuration file.

4. Run commit

   The configuration is committed.

On a Layer 2 device running ERPS, the VLAN in which RAPS PDUs and data packets are transmitted must be mapped to an ERP instance so that ERPS forwards or blocks the packets based on configured rules. If the mapping is not configured, the preceding packets may cause broadcast storms on the ring network. As a result, the network becomes unavailable.

1. Run system-view

   The system view is displayed.

2. Run erps ring ring-id

   The ERPS ring view is displayed.

3. Run protected-instance { all | { instance-id1 [ to instance-id2 ] &<1-10> } }

   An ERP instance is created for the ERPS ring.

   By default, no ERP instance is configured in an ERPS ring.

   • If you run the protected-instance command multiple times in the same ERPS ring, multiple ERP instances are configured.

   • If the ERPS ring contains ports, the ERP instance cannot be changed. To delete the configured ERP instance, run the undo erps ring command in the interface view or the undo port command in the ERPS ring view to delete ports from the ERPS ring, and run the undo protected instance command to delete the ERP instance.

4. Run commit

   The configuration is committed.

5. Run quit

   The system view is displayed.

6. Configure the mapping between an ERP instance and VLAN.

   1. Run stp region-configuration

      The Multiple Spanning Tree (MST) region view is displayed.

   2. Run instance instance-id vlan { vlan-id [ to vlan-id ] } &<1-10>

      The mapping between the ERP instance and VLAN is configured.

      By default, all VLANs in an MST region are mapped to instance 0.

      instance-id in this command must be the same as instance-id used by the protected-instance command.

      • A VLAN cannot be mapped to multiple MSTIs. If you map a VLAN that has already been mapped to an MSTI to another MSTI, the original mapping will be deleted.

      • The vlan-mapping modulo modulo command configures the mapping between MSTIs and VLANs based on the default algorithm. However, the mapping configured using this command cannot always meet the actual demand. Therefore, running this command is not recommended.

      • To configure the mapping between an ERP instance and a MUX VLAN, you are advised to configure the principal VLAN, subordinate group VLANs, and subordinate separate VLANs of the MUX VLAN in the same ERP instance. Otherwise, loops may occur.

   3. Run commit

      The configuration is committed.

After ERPS is configured, add Layer 2 ports to an ERPS ring and configure port roles so that ERPS can work properly.

You can add a Layer 2 port to an ERPS ring in either of the following ways:

• In the ERPS ring view, add a specified port to the ERPS ring and configure the port role.

• In the interface view, add the current port to the ERPS ring and configure the port role.

• A port can be added to a maximum of two ERPS rings.

• An ERPS-enabled port needs to allow packets of control VLANs and data VLANs to pass through, so the link type of the port must be configured as trunk or hybrid.

• Flush-FDB packets for updating MAC addresses cannot be separately sent, so do not configure a direct link between two upstream nodes as the RPL.

• Before changing the port role, use the shutdown command to disable the port. When the port role is changed, use the undo shutdown command to enable the port. This prevents traffic interruptions.

• The port is not a Layer 3 port. If the port is a Layer 3 port, run the portswitch command to switch the port to the Layer 2 mode.

• Spanning Tree Protocol (STP) or Smart Link is not enabled on the port.

  • If the port has STP enabled, run the stp disable command in the interface view to disable STP.
  • If the port has Smart Link enabled, run the undo port command in the Smart Link group view to disable Smart Link.

• The control-vlan command has been executed to configure a control VLAN and the protected-instance command has been executed to configure an ERP instance.

1. Run system-view

   The system view is displayed.

2. Add a Layer 2 port to an ERPS ring and configure the port role in either of the following ways.
   • In the ERPS ring view, add a specified port to the ERPS ring and configure the port role.

     1. Run interface interface-type interface-number

        The interface view is displayed.

     2. Run stp disable

        STP is disabled on the ERPS-enabled port.

     3. Run port link-type trunk

        The link type of the ERPS-enabled port is configured as trunk.

     4. Run port trunk allow-pass vlan { { vlan-id1 [ to vlan-id2 ] }&<1-10> | all }

        The VLANs allowed by the ERPS-enabled port are specified.

        After the control-vlan command is used in the ERPS ring view to configure a control VLAN and the port interface-type interface-number [ rpl { owner | neighbour } ] command is configured, the ports in the ERPS ring allow packets of the control VLAN to pass through. Therefore, you need to specify only the IDs of data VLANs in this step.

     5. Run quit

        The system view is displayed.

     6. Run erps ring ring-id

        The ERPS ring view is displayed.

     7. Run port interface-type interface-number [ rpl { owner | neighbour } ]

        The port is added to the ERPS ring and its role is configured.

   • In the interface view, add the current port to the ERPS ring and configure the port role.

     1. Run interface interface-type interface-number

        The specified interface view is displayed.

     2. Run stp disable

        STP is disabled on the ERPS-enabled port.

     3. Run port link-type trunk

        The link type of the ERPS-enabled port is configured as trunk.

     4. Run port trunk allow-pass vlan { { vlan-id1 [ to vlan-id2 ] }&<1-10> | all }

        The VLANs allowed by the ERPS-enabled port are specified.

        After the control-vlan command is used in the ERPS ring view to configure a control VLAN and the port interface-type interface-number [ rpl { owner | neighbour } ] command is configured, the ports in the ERPS ring allow packets of the control VLAN to pass through. Therefore, you need to specify only the IDs of data VLANs in this step.

     5. Run erps ring ring-id [ rpl { owner | neighbour } ]

        The current port is added to the ERPS ring and its role is configured.

3. Run commit

   The configuration is committed.

If an upper-layer Layer 2 network is not notified of the topology change in an ERPS ring, the MAC address entries remain unchanged on the upper-layer network and therefore user traffic is interrupted. To ensure nonstop traffic transmission, configure the topology change notification function and specify the ERPS rings that will be notified of the topology change.

In addition, if an ERPS ring frequently receives topology change notifications, its nodes will have lower CPU processing capability and repeatedly update Flush-FDB packets, consuming much bandwidth. To resolve this problem, set the topology change protection interval at which topology change notifications are sent to suppress topology change notification transmission, and set the maximum number of topology change notifications that can be processed during the topology change protection interval to prevent frequent MAC address and ARP entry updates.

1. Run system-view

   The system view is displayed.

2. Run erps ring ring-id

   The ERPS ring view is displayed.

3. Run tc-notify erps ring { ring-id1 [ to ring-id2 ] } &<1-10>

   The ERPS ring is configured to notify other ERPS rings of its topology change.

   ring-id1 [ to ring-id2 ] specifies the start and end ring IDs of the ERPS rings that will be notified of the topology change. Ensure that the ERPS rings specified by ring-id1 and ring-id2 exist. If the specified rings do not exist, the topology change notification function does not take effect.

   After the ERPS rings receive the topology change notification from an ERPS ring, they send Flush-FDB messages on their separate rings to instruct their nodes to update MAC addresses so that user traffic is not interrupted.

4. (Optional) Run tc-protection interval interval-value

   The topology change protection interval at which topology change notification messages are sent is set.

5. (Optional) Run tc-protection threshold threshold-value

   The number of times ERPS parses topology change notifications and updates forwarding entries in the topology change protection interval is set.

   The topology change protection interval is the one specified by the tc-protection interval command.

6. Run commit

   The configuration is committed.

To ensure that ERPS rings function normally when a node or link fails, configure revertive/non-revertive switching, port blocking mode, and timers.

1. Run system-view

   The system view is displayed.

2. Run erps ring ring-id

   The ERPS ring view is displayed.

3. Run revertive { enable | disable }

   The protection switching mode is specified.

   By default, ERPS rings use revertive switching.

4. Run quit

   Return to the system view.

5. Perform either of the following operations to configure a port blocking mode.

   • To configure a port blocking mode for a port in the ERPS ring view, perform the following steps:

     1. Run the erps ring ring-id command to enter the ERPS ring view.

     2. Run the port interface-type interface-number protect-switch { force | manual } command to configure a port blocking mode for an ERPS port.

   • To configure a port blocking mode in the interface view, perform the following steps:

     1. Run the interface interface-type interface-number command to enter the interface view.

     2. Run the erps ring ring-id protect-switch { force | manual } command to configure a port blocking mode for the port.

        The ERPS ring specified by ring ring-id must be the one to which the port belongs.

   To delete the specified port blocking mode, run the clear command in the ERPS ring view.

6. Run quit

   Return to the system view.

7. Run commit

   The configuration is committed.

After a link or node failure in an ERPS ring recovers, the device starts timers in the ERPS ring to reduce traffic interruptions. This prevents network flapping.

1. Run system-view

   The system view is displayed.

2. Run erps ring ring-id

   The ERPS ring view is displayed.

3. Configure the WTR timer, Guard timer, and Holdoff timer in the ERPS ring according to actual networking.

   • Run wtr-timer time-value

     The WTR timer is set.

     By default, the WTR timer is 5 minutes in an ERPS ring.

   • Run guard-timer time-value

     The Guard timer is set.

     By default, the Guard timer is 200 centiseconds in an ERPS ring.

   • Run holdoff-timer time-value

     The Holdoff timer is set.

     By default, the Holdoff timer is 0 deciseconds in an ERPS ring.

4. Run commit

   The configuration is committed.

• Run the display erps [ ring ring-id ] [ verbose ] command to check the device ports added to an ERPS ring and ERPS ring configurations.
• Run the display erps interface interface-type interface-number [ ring ring-id ] command to check physical configurations of the port added to an ERPS ring.

This Document Applies to these Products

Page 25

Huawei uses machine translation combined with human proofreading to translate this document to different languages in order to help you better understand the content of this document. Note: Even the most advanced machine translation cannot match the quality of professional translators. Huawei shall not bear any responsibility for translation accuracy and it is recommended that you refer to the English document (a link for which has been provided).

There are three timers used in spanning tree calculation: Forward Delay, Hello Time, and Max Age. These timers can be configured to affect STP convergence. However, you are not advised to directly change these timers. Instead, it is recommended that you set the network diameter so that the spanning tree protocol automatically adjusts these timers in accordance with the network scale.

The following timers are used in spanning tree calculation:

• Forward Delay: specifies the delay before a state transition. After the topology of a ring network changes, it takes some time for the new configuration BPDU to spread throughout the entire network. As a result, the original blocked port may be unblocked before a new port is blocked, creating a loop on the network. The purpose of the Forward Delay timer is to prevent loops. When the topology changes, all ports will be temporarily blocked during the Forward Delay.
• Hello Time: specifies the interval at which hello packets are sent. A device sends configuration BPDUs at the specified interval to detect link failures. If the switching device does not receive any BPDUs within an interval of Hello Time x 3 x Timer Factor, the device recalculates the spanning tree.
• Max Age: determines whether a BPDU has timed out. A device determines that a received configuration BPDU times out when the Max Age expires.

Devices on a ring network must use the same values of Forward Delay, Hello Time, and Max Age.

To prevent frequent network flapping, make sure that the Hello Time, Forward Delay, and Max Age timer values conform to the following formulas:

• 2 x (Forward Delay - 1.0 second) ≥ Max Age

• Max Age ≥ 2 x (Hello Time + 1.0 second)

1. Run system-view

   The system view is displayed.

2. Set the Forward Delay, Hello Time, and Max Age timers.
3. Run commit

   The configuration is committed.

This Document Applies to these Products

Page 26

Huawei uses machine translation combined with human proofreading to translate this document to different languages in order to help you better understand the content of this document. Note: Even the most advanced machine translation cannot match the quality of professional translators. Huawei shall not bear any responsibility for translation accuracy and it is recommended that you refer to the English document (a link for which has been provided).

This Document Applies to these Products