Documente Academic
Documente Profesional
Documente Cultură
Product Description
Issue Date 02 2011-08-12
Copyright Huawei Technologies Co., Ltd. 2011. All rights reserved. No part of this document may be reproduced or transmitted in any form or by any means without prior written consent of Huawei Technologies Co., Ltd.
Notice
The purchased products, services and features are stipulated by the contract made between Huawei and the customer. All or part of the products, services and features described in this document may not be within the purchase scope or the usage scope. Unless otherwise specified in the contract, all statements, information, and recommendations in this document are provided "AS IS" without warranties, guarantees or representations of any kind, either express or implied. The information in this document is subject to change without notice. Every effort has been made in the preparation of this document to ensure accuracy of the contents, but all statements, information, and recommendations in this document do not constitute the warranty of any kind, express or implied.
Website: Email:
Issue 02 (2011-08-12)
Related Versions
The following table lists the product versions related to this document. Product Name HUAWEI NE40E-X1 & NE40E-X2 Universal Service Router Version V600R003C00
Intended Audience
This document is intended for: l l l l l l l Network planning engineers Hardware installation engineers Commissioning engineers Data configuration engineers On-site maintenance engineers Network monitoring engineers System maintenance engineers
Symbol Conventions
The symbols that may be found in this document are defined as follows.
Issue 02 (2011-08-12) Huawei Proprietary and Confidential Copyright Huawei Technologies Co., Ltd. ii
Symbol
Description
DANGER
Indicates a hazard with a high level of risk, which if not avoided, will result in death or serious injury. Indicates a hazard with a medium or low level of risk, which if not avoided, could result in minor or moderate injury. Indicates a potentially hazardous situation, which if not avoided, could result in equipment damage, data loss, performance degradation, or unexpected results. Indicates a tip that may help you solve a problem or save time. Provides additional information to emphasize or supplement important points of the main text.
WARNING
CAUTION
TIP
NOTE
Change History
Updates between document issues are cumulative. Therefore, the latest document issue contains all updates made in previous issues.
Issue 02 (2011-08-12)
iii
Contents
Contents
About This Document.....................................................................................................................ii 1 New Features of V600R003C00...................................................................................................1 2 Product Positioning.......................................................................................................................2
2.1 Positioning..........................................................................................................................................................3
3 Product Architecture.....................................................................................................................4
3.1 Physical Architecture..........................................................................................................................................5 3.2 Logical Architecture...........................................................................................................................................5 3.3 Software Architecture.........................................................................................................................................6 3.4 Data Forwarding Process....................................................................................................................................8
7 Service Features...........................................................................................................................18
7.1 Ethernet Features..............................................................................................................................................19 7.1.1 Layer 2 Ethernet Features........................................................................................................................19 7.1.2 Layer 3 Ethernet Features........................................................................................................................19 7.1.3 QinQ Features..........................................................................................................................................19 7.1.4 Flexible Access to VPNs.........................................................................................................................20 7.1.5 RRPP Link Features................................................................................................................................20 7.1.6 RSTP/MSTP Features..............................................................................................................................20 7.1.7 BPDU Tunneling Features.......................................................................................................................21 7.2 IP Features........................................................................................................................................................21 7.2.1 IPv4/IPv6 Dual Stack..............................................................................................................................21 7.2.2 IPv4 Features...........................................................................................................................................21 7.2.3 IPv6 Features...........................................................................................................................................22 7.2.4 IPv4/IPv6 Transition Technology...........................................................................................................22 7.3 Routing Protocol...............................................................................................................................................22 Issue 02 (2011-08-12) Huawei Proprietary and Confidential Copyright Huawei Technologies Co., Ltd. iv
Contents
7.3.1 Unicast Routing.......................................................................................................................................22 7.3.2 Multicast Routing....................................................................................................................................24 7.4 MPLS................................................................................................................................................................25 7.5 VPN Features....................................................................................................................................................29 7.5.1 Tunnel Policy...........................................................................................................................................29 7.5.2 VPN Tunnel.............................................................................................................................................29 7.5.3 MPLS L2VPN.........................................................................................................................................29 7.5.4 BGP/MPLS L3VPN................................................................................................................................31 7.6 QoS...................................................................................................................................................................32 7.7 Load Balancing.................................................................................................................................................36 7.8 Traffic Statistics................................................................................................................................................37 7.9 Security Features..............................................................................................................................................38 7.10 IP RAN Features.............................................................................................................................................43 7.11 Network Reliability........................................................................................................................................43 7.12 Clock...............................................................................................................................................................48
8 Applicable Environment............................................................................................................51
8.1 Metro Ethernet Solution...................................................................................................................................52
Issue 02 (2011-08-12)
1
New Features License IP RAN Clock
Issue 02 (2011-08-12)
2 Product Positioning
2
About This Chapter
2.1 Positioning
Product Positioning
Issue 02 (2011-08-12)
2 Product Positioning
2.1 Positioning
Huawei NE40E-X1&NE40E-X2 Universal Service Router (hereinafter referred to as the NE40E-X1&NE40E-X2) are a high-end network product used to access, converge, and transmit carrier-class Ethernet services on Fixed-Mobile Convergence (FMC) Metropolitan Area Networks (MANs). The NE40E-X1&NE40E-X2 operate on the Versatile Routing Platform (VRP) operating system developed by Huawei and adopts the hardware-based forwarding and non-blocking data switching technology. The NE40E-X1&NE40E-X2 feature carrier-class reliability, line-speed forwarding capability, perfect Quality of Service (QoS) mechanism, service processing capability, and good expansibility. The NE40E-X1&NE40E-X2 provide strong capabilities in network access, Layer 2 switching, and transmission of Ethernet over Multi-Protocol Label Switching (EoMPLS) services. The NE40E-X1&NE40E-X2 also support rich IP services and provides broadband access, triple play, IP leased line, and Virtual Private Network (VPN) services. The NE40E-X1&NE40E-X2 can also work in conjunction with the CX200/300, NE80E, NE40E, ME60, and MA5200G developed by Huawei to set up a hierarchical metro Ethernet that provides rich services for customers.
NE40E-X1
NE40E-X2
Issue 02 (2011-08-12)
3 Product Architecture
3
About This Chapter
3.1 Physical Architecture 3.2 Logical Architecture 3.3 Software Architecture 3.4 Data Forwarding Process
Product Architecture
Issue 02 (2011-08-12)
3 Product Architecture
All systems except the network management system (NMS) are located in an integrated cabinet. The power distribution system consists of power modules working in 1+1 backup mode. The following describes only the functional host system. The functional host system is composed of the system backplane, MPUs, NPUs, and PICs. The functional host system processes data. In addition, it monitors and manages the entire system, including the power distribution system, heat dissipation system, and NMS through NMS interfaces. Figure 3-1 shows the functional host system of the NE40E. Figure 3-1 Functional host system
-48 V PSU (Power Support Unit) Control Bus Monitor Bus Control Bus Monitor Bus FAN
-48 V
GE/Console/ Bits/USB
Backplane
Control Bus 2*10G NPU Monitor Bus Data Bus Control Bus 2*10G NPU Monitor Bus Data Bus
MPU (Slave)
GE/Console/ Bits/USB
Control Bus Monitor Bus Data Bus PIC 0-7 GE/FE/E1 (Physical etc Interface Card)
NOTE
3 Product Architecture
l l l
Figure 3-2 shows the logical architecture. Figure 3-2 Logical architecture
MPU MPU
Monitoring plane
Control and management plane Management unit Data plane Forwarding unit
NPUI
Forwarding unit
NPUI
Data channel
PIC * N
The data plane is responsible for high speed processing and non-blocking switching of data packets. It encapsulates or decapsulates packets, forwards IPv4/IPv6/MPLS packets, performs QoS as well as scheduling and internal high-speed switching, and collects statistics. The control and management plane completes all control and management functions for the system and is the core of the entire system. Control and management units process protocols and signals, and maintain, manage, report on, and control system status. The monitoring plane monitors the ambient environment to ensure secure and stable operation of the system. It detects voltage levels, controls system power-on and-off, monitors temperature, and controls fan modules. When a unit fails, the monitoring plane isolates the faulty unit promptly so that other parts of the system can continue to run normally.
3 Product Architecture
SNMP
RPS Master
NPU
PIC
PIC
PIC
PIC
SNMP
RPS Master
NPU
NPU
Software of the NE40E consists of the Routing Process System (RPS), power monitoring system, fan monitoring system, Forwarding Support Unit (FSU), and Express Forwarding Unit (EFU). l The RPS, which includes IPOS software, VRP software, and product-adaptation software, is the control and management module that runs on the MPU. The RPS on the active MPU and the one on the standby MPU back up each other. RPSs support IPv4/IPv6, MPLS, LDP, and routing protocols, calculate routes, establish LSPs and multicast distribution trees,
Huawei Proprietary and Confidential Copyright Huawei Technologies Co., Ltd. 7
PIC
PIC
PIC
PIC
PIC
PIC
PIC
PIC
Issue 02 (2011-08-12)
3 Product Architecture
generate unicast, multicast, and MPLS forwarding tables, and they deliver information concerning all the preceding mentioned to the LPU. l l The FSU implements the functions of the link layer and some functions of the IP protocol stack on interfaces. The EFU performs hardware-based IPv4/IPv6 forwarding, multicast forwarding, MPLS forwarding, and has a statistics functions.
PIC Datagram
Processing on the incoming interface Upstream traffic classification
Datagram
Processing on the outgoing interface Downstream traffic classification IPv4 unicast IPv4 multicast MPLS IPv6 Packet encapsulation and forwarding in the downstream
PFE
IPv4 unicast Searching the IPv4 multicast routing table to MPLS forward packets IPv6 MAC
TM
Packet fragmentation
Multicast replication
Packet reassembly
Micro cell
As shown in Figure 3-5, the Packet Forwarding Engine (PFE) adopts a Network Processor (NP) or an Application Specific Integrated Circuit (ASIC) to implement high-speed packet routing. External memory types include Static Random Access Memory (SRAM), Dynamic Random Access Memory (DRAM), and Net Search Engine (NSE). The SRAM stores forwarding entries; the DRAM stores packets; the NSE performs non-linear searching. Data forwarding processes can be divided into upstream and downstream processes based on the direction of the data flow.
Issue 02 (2011-08-12) Huawei Proprietary and Confidential Copyright Huawei Technologies Co., Ltd. 8
3 Product Architecture
Upstream process: The Physical Interface Card (PIC) encapsulates packets to frames and then sends them to the PFE. On the PFE of the inbound interface, the system decapsulates the frames and identifies the packet types. It then classifies traffic according to the QoS configurations on the inbound interface. After traffic classification, the system searches the Forwarding Information Base (FIB) for the outbound interfaces and next hops of packets to be forwarded. To forward an IPv4 unicast packet, for instance, the system searches the FIB for the outbound interface and next hop according to the destination IP address of the packet. Finally, the system sends the packets containing information about outbound interfaces and next hops to the traffic management (TM) module. Downstream process: Information about packet types that have been identified in the upstream process and about the outbound interfaces is encapsulated through the link layer protocol and the packets are stored in corresponding queues for transmission. If an IPv4 packet whose outbound interface is an Ethernet interface, the system needs to obtain the MAC address of the next hop. Outgoing traffic is then classified according to the QoS configurations on the outbound interfaces. Finally, the system encapsulates the packets with new Layer 2 headers on the outbound interfaces and sends them to the PIC.
Issue 02 (2011-08-12)
4 Technical Specifications
4
Physical Specifications
Table 4-1 Physical Specifications Item Dimensions (width x depth x height) Installation Weight (in full configuration) Typical power Heat dissipation DC input voltage Rated voltage Maximum voltage range Ambient temperat ure Long-term Short-term
Technical Specifications
NE40E-X2 442 mm x 220 mm x 222 mm (17.4 in. x 8.66 in. x 8.74 in.)(5 U (222.25 mm or 8.75 in.) height)
NE40E-X1 442 mm x 220 mm x 132 mm (17.4 in. x 8.66 in. x 5.20 in.)(3 U (133.35 mm or 5.25 in.) height)
Mounted in an N63E cabinet, a standard 19-inch cabinet, or a 23inch North American open rack 22 kg (48.51 lb) 650 W 2109 BTU/hour -48 V -38 V to -72 V 14 kg (30.87 lb) 350 W 1136 BTU/hour
-5C to 50C (23F to 122F) -20C to 60C (-4F to 140F) (Short-term refers to a period of not more than 96 consecutive hours and a total of not more than 15 days in 1 year.) Restriction on the temperature variation rate: 30C (86F)per hour -40C to 70C (-40F to 158F)
Issue 02 (2011-08-12)
10
4 Technical Specifications
NE40E-X2 5% to 85% RH, non-condensing 5% to 95% RH, non-condensing 0% to 95% RH, non-condensing
NE40E-X1
Within 3000 meters (Within 9842.40 ft) Within 5000 meters (Within 16404 ft)
System Configuration
Table 4-2 System Configuration Item SDRAM CF card USB interface Switching capacity Forwarding capacity Backplane bandwidth Interface capacity NE40E-X2 2 GB 1 GB USB2.0 Host 40 Gbit/s 60 Mpps 450 Gpbs Non-line-rate: 75.2 Gbit/s Line-rate: 40Gbit/s Number of subcard slots Number of MPU slots Number of NPU slots 8 2 2 NE40E-X1 2 GB 1 GB USB2.0 Host 20 Gbit/s 30 Mpps 285 Gpbs Non-line-rate: 52 Gbit/s Line-rate: 20Gbit/s 4 2 1
Issue 02 (2011-08-12)
11
5 FPIC
5
Table 5-1 Subcards supported by the NE40E-X2 and NE40E-X1 Interface Name 8-Port 100/1000Base-X-SFP High-speed Interface Card A (HIC, Supporting 1588v2) Description Supports synchronization Ethernet feature and multiple types of optical modules, and complies with the 1588v2 standard. l Supports the GE optical module to provide GE optical interfaces. l Supports the FE optical module to provide FE optical interfaces. l Supports the SFP electrical module to provide 100 M/1000 M auto-sensing electrical interfaces. (In this case, the synchronization Ethernet feature is not supported.) l Supports the mixed use of the preceding modules. Supports hot swapping. Remarks
FPIC
The NE40E-X2 has eight slots for subcards. Subcards are hot swappable and support automatic configuration recovery. The NE40E-X1 has four slots for subcards. Subcards are hot swappable and support automatic configuration recovery.
Subcards of this type can be inserted in the slots 5, 6, 9, and 10 on the NE40E-X2, and the slots 2, 3, 4 and 5 on the NE40E-X1.
Issue 02 (2011-08-12)
12
5 FPIC
Description Supports the synchronization Ethernet feature and multiple types of optical modules. l Supports the GE optical module to provide GE optical interfaces. l Supports the FE optical module to provide FE optical interfaces. l Supports the SFP electrical module to provide the features of 100 M/1000 M autosensing electrical interfaces. l Supports the mixed use of the preceding modules. Supports hot swapping.
Remarks Subcards of this type can be inserted in the slots 5, 6, 9, and 10 on the NE40E-X2, and the slots 2, 3, 4 and 5 on the NE40E-X1.
Supports on-site ambient monitoring, including the monitoring of burglarproof switches and smoke sensors. Supports hot swapping.
Subcards of this type can be inserted in the slots 3, 4, 5, 6, 9, 10, 11, and 12 on the NE40E-X2, and in the slots 2, 3, 4 and 5 on the NE40E-X1. Subcards of this type can be inserted in the slots 3, 4, 5, 6, 9, 10, 11, and 12 on the NE40E-X2, and in the slots 2, 3, 4 and 5 on the NE40E-X1. Subcards of this type can be inserted in the slots 3, 4, 5, 6, 9, 10, 11, and 12 on the NE40E-X2, and in the slots 2, 3, 4 and 5 on the NE40E-X1.
Supports hot swapping, the clock synchronization feature, and three protocols: Circuit Emulation Service (CES), Inverse Multiplexing for ATM (IMA), and Multilink Point-to-Point Protocol (ML-PPP).
Issue 02 (2011-08-12)
13
5 FPIC
Remarks Subcards of this type can be inserted in the slots 3, 4, 5, 6, 9, 10, 11, and 12 on the NE40E-X2, and in the slots 2, 3, 4 and 5 on the NE40E-X1. Subcards of this type can be inserted in the slots 3, 4, 5, 6, 9, 10, 11, and 12 on the NE40E-X2, and in the slots 2, 3, 4 and 5 on the NE40E-X1. Subcards of this type can be inserted in the slots 3, 4, 5, 6, 9, 10, 11, and 12 on the NE40E-X2, and in the slots 2, 3, 4 and 5 on the NE40E-X1.
Issue 02 (2011-08-12)
14
6 Link Features
6
About This Chapter
6.1 E1 Link Features 6.2 Ethernet Link Features 6.3 CPOS Link Features
Link Features
Issue 02 (2011-08-12)
15
6 Link Features
The E1 interface supports the loopback function on an interface, including local loopback and remote loopback. PPP on serial interfaces supports the following: l MP
6 Link Features
Channelization The E1 interface channalized from a CPOS interface, in compliance with SAToP, can transparently transmit unstructured TDM services through PWs on an MPLS network. The E1 interface channalized from a CPOS interface, in compliance with CESoPSN, can transparently transmit structured TDM services through PWs on an MPLS network.
ML-PPP/TDM/ATM IMA The NE40E provides CPOS interfaces at 155 Mbit/s. At the link layer, CPOS interfaces support the following protocols: ML-PPP TDM ATM IMA
Issue 02 (2011-08-12)
17
7 Service Features
7
About This Chapter
7.1 Ethernet Features 7.2 IP Features 7.3 Routing Protocol 7.4 MPLS 7.5 VPN Features 7.6 QoS 7.7 Load Balancing 7.8 Traffic Statistics 7.9 Security Features 7.10 IP RAN Features 7.11 Network Reliability 7.12 Clock
Service Features
Issue 02 (2011-08-12)
18
7 Service Features
Identification of double VLAN tags (inner VLAN tag and outer VLAN tag)
Huawei Proprietary and Confidential Copyright Huawei Technologies Co., Ltd. 19
7 Service Features
l l l l l l l
Change of the outer VLAN ID Removal of double VLAN tags and then addition of new double VLAN tags QinQ mapping for the outer VLAN tag Change of the EtherType value and 802.1p priority in the outer VLAN tag; copy of the 802.1p priority in the inner VLAN tag to the outer VLAN tag of double-tagged packets Traffic classification based on the 802.1p priorities in the outer VLAN tags of packets Rate limit on interfaces based on the 802.1p priorities in both inner and outer VLAN tags Interface-based QinQ Interface-based QinQ is applicable to the following scenarios: Access to a VPLS network to transparently transmit VLAN packets Access to an L2VPN or PWE3 to transparently transmit VLAN packets
l l l l l l
VLAN-based QinQ QinQ termination EType in the outer tag of QinQ packets used for interoperation with devices of other vendors Multicast QinQ QinQ-based VLAN swapping VLAN stacking can be applied in the following scenarios: Access to VPLS Access to VLL or PWE3
RSTP MSTP
Huawei Proprietary and Confidential Copyright Huawei Technologies Co., Ltd. 20
7 Service Features
MSTP provides BPDU protection to defend against such attacks. After the BPDU protection is enabled, the switch shuts down the edge port that receives BPDUs. At the same time, the switch informs the NMS of the situation. The edge port can be enabled by the network administrator. NE40E can restrict the sending of Layer 2 and Layer 3 protocol packets such as RSTP and DHCP through CP-CAR. This avoids influencing device performance.
7.2 IP Features
7.2.1 IPv4/IPv6 Dual Stack
The IPv4/IPv6 dual stack can be easily implemented and can smoothly interoperate with other protocols. Figure 7-1 shows the structure of the IPv4/IPv6 dual stack. Figure 7-1 IPv4/IPv6 dual stack
IPv4/IPv6 Application
TCP
UDP
IPv4
IPv6
Link Layer
IPv4/IPv6 dual stack (including dual-stack VPN) is supported on the same interface.
TCP/IP protocol suite, including ICMP, IP, TCP, UDP, socket (TCP/UDP/Raw IP), and ARP Static DNS and specified DNS server FTP server/client and TFTP client DHCP relay agent and DHCP server Suppression of DHCP flooding
Huawei Proprietary and Confidential Copyright Huawei Technologies Co., Ltd. 21
7 Service Features
Ping, tracert, and NQA NQA can detect the status of ICMP, TCP, UDP, DHCP, FTP, HTTP, and SNMP services and test the response time of the services. The system supports NQA in UDP jitter and ICMP jitter tests by sending and receiving packets on LPUs. The minimum interval at which packets are transmitted can be 10 ms. Each LPU supports up to 100 concurrent jitter tests. The entire system supports up to 1000 concurrent jitter tests.
l l l l
IP policy-based routing (PBR) and flow-based next hop to which packets are forwarded IP PBR-based load balancing Load balancing in unequal cost multiple path (UCMP) mode Configuration of secondary IP addresses for all physical and logical interfaces Each interface can be configured with a maximum of 255 secondary IP addresses with 31bit masks.
Issue 02 (2011-08-12)
7 Service Features
l l l l l l l l l l l l l
Large-capacity routing table to effectively support the operation of a MAN. Selection of the optimal route through the perfect routing policy Import of routing information of other protocols Use of routing policies in advertising and receiving routes and filtering of routes through route attributes Password authentication and MD5 authentication to improve network security Restart of protocol processes through command lines RIP-1 (classful routing protocol) and RIP-2 (classless routing protocol) Advertisement of a default route from a RIP-enabled device to its peers and setting of the metric of this route RIP-triggered updates Disabling a specified interface from sending or receiving OSPF or RIP packets Association between OSPF and BGP Association between OSPF and LDP Fast OSPF convergence, which can be implemented in the following manners: Adjusting the interval at which LSAs are sent Enabling OSPF GR Configuring BFD for OSPF
l l l
OSPF I-SPF and IS-IS I-SPF (I-SPF re-calculates only the affected routes of a shortest path tree (SPT) rather the entire SPT) OSPF PRC OSPF calculation of link costs based on the reference bandwidth Link costs can be manually configured or automatically calculated by the system based on the reference bandwidth by using the following formula: Link cost = Reference bandwidth/Interface bandwidth The integer of the calculated result is the link cost. If the calculated result is smaller than 1, the cost is 1. The link cost can be changed by changing the reference bandwidth. By default, the reference bandwidth of the NE40E is 100 Mbit/s. The value can be changed to one in the range of 1 to 2147483648 in Mbit/s by running commands.
l l l l l l l l l l
Issue 02 (2011-08-12)
Two-level IS-IS in a routing domain Association between IS-IS and LDP IS-IS GR, OSPF GR and BGP GR, which ensure high reliability with Non-Stop Forwarding (NSF) BGP indirect next hop and dynamic update peer-groups Policy-based route selection by BGP when there are multiple routes to the same destination BGP route reflector (RR), which addresses the problem of high costs of full-mesh requirement when there are many IBGP peers Sending of BGP Update packets that carry no private AS number Route dampening, which suppresses unstable routes (unstable routes are neither added to the BGP routing table nor advertised to other BGP peers) Routing protocol BGP fast convergence
Huawei Proprietary and Confidential Copyright Huawei Technologies Co., Ltd. 23
7 Service Features
The NE40E adopts a new route convergence mechanism and algorithm, which speeds up convergence of BGP routes. The features are as follows: Indirect next hop On-demand route iteration l l BGP load balancing in multi-homing networking Non-Stop Routing (NSR) The NE40E supports the following NSR modes: IS-IS NSR BGP NSR The formula for calculating the bandwidth occupies by LSAs on interfaces in the same area is as follows: Assume that there are 10000 routes, Ethernet interfaces are used, and the MTU of the Ethernet interfaces is 1500 bytes. In this case, the Ethernet frame header is of 18 bytes, and each LSA is of 44 bytes. Each LSA carries information about a route. (1500-18)/44=44. The preceding formula indicates that an Ethernet frame can carry information about 33 routes. In this case, 228 Ethernet frames are required to carry information about 10000 routes.
Issue 02 (2011-08-12)
7 Service Features
Filtering of routes based on the routing policy when the multicast routing module receives, imports, or advertises multicast routes and filtering and forwarding of multicast packets based on the routing policy when IP multicast packets are forwarded Multicast VPN The multicast domain (MD) scheme is used to implement this function. Addition and deletion of dummy entries Query of PIM neighbors and number of control messages Filtering of PIM neighbors, control of the forwarding boundary, and control of the BSR service and management boundary Filtering and suppression of PIM Register messages MSDP authentication IGMP packet rate limiting and IGMP proxy Prompt leave of IGMP and MLD group members and the use of group-policies to restrict the setup of forwarding entries Configuration of ACLs, including source address-based packet filtering, control of multicast group number, setup of multicast forwarding entries, and Switch-MDT switching, to ensure multicast security Multicast group-based, multicast source-based, multicast source/group-based, stablepreferred, and balance-preferred load splitting IGMP snooping The NE40E supports IGMP snooping on Layer 2 interfaces, Layer 3 interfaces, QinQ interfaces, STP topologies, RRPP rings, and VPLS PWs.
l l l l l l l l l
l l
Multicast flow control The NE40E discards or broadcasts unknown multicast packets in the VLAN to which the receiving interface belongs. Unknown multicast packets are packets that have no corresponding forwarding entries in the multicast forwarding table. In addition, the NE40E restricts the maximum percentage of multicast flows on Ethernet interfaces to control multicast traffic.
l l l
Multicast VLAN The NE40E supports multicast VLAN and VLAN-based 1+1 protection of multicast traffic. Multicast VPN For details, see section "7.5 VPN Features". Multicast CAC The NE40E supports multicast Call Admission Control (CAC). When multicast CAC rules are configured, the number of multicast groups and bandwidth are restricted for IGMP snooping on interfaces or the entire system.
7.4 MPLS
The NE40E supports MPLS features, and static and dynamic LSPs. Static LSPs require that the administrator configure the Label Switch Routers (LSRs) along the LSPs and set up LSPs manually. Dynamic LSPs are set up dynamically in accordance with the routing information through the Label Distribution Protocol (LDP) and RSVP-TE. The delay for MPLS packets can be controlled in the following aspects:
Issue 02 (2011-08-12) Huawei Proprietary and Confidential Copyright Huawei Technologies Co., Ltd. 25
7 Service Features
l l
In the case that there is no traffic congestion, the NE40E adopts a high-speed processor to ensure line-rate forwarding and low delay. In the case of traffic congestion, the NE40E ensures preferential forwarding and low delay for traffic with high priority through mechanisms such as QoS, HQoS, MPLS TE, and DSTE.
7 Service Features
RFC 3035 RFC 3036 RFC 3037 The NE40E supports CR-LDP and RSVP-TE and can interoperate with non-Huawei devices through CR-LDP or RSVP-TE.
MPLS TE
The MPLS TE technology combines the MPLS technology with traffic engineering. It can reserve resources by setting up LSP tunnels for a specified path in an attempt to avoid network congestion and balance network traffic. In the case of resource scarcity, MPLS TE allows the preemption of bandwidth resources of LSPs with low priorities. This meets the demands of important services or the LSPs with large bandwidth. When an LSP fails or a node is congested, MPLS TE can ensure smooth network communication through the backup path and the fast reroute (FRR) function. Through automatic re-optimization and bandwidth adjustment, MPLS TE improves the self-adaptation capability of tunnels and properly allocates network resources. The process of updating the network topology through the TEDB is as follows: When a link goes Down, the CSPF failed link timer is enabled. If the IGP route is deleted or the link is changed within the timeout period of the CSPF failed link timer, CSPF deletes the timer and then updates the TEDB. If the IGP route is not deleted or the link is not changed after the timeout period of the CSPF failed link timer expires, the link is considered Up. MPLS TE provides the following functions: l Processing of static LSPs MPLS can create and delete static LSPs, which require bandwidth but are manually configured. l Processing of Constrained Route-Label Switched Path (CR-LSP) of various types and route calculation through the CSPF algorithm
CR-LSPs are classified into the following types: l l RSVP-TE RSVP authentication complies with RFC 3097. Auto routing Auto routing works in either of the following modes: IGP shortcut: An LSP is not advertised to neighboring routers. Therefore, other routers cannot use the LSP. Forwarding adjacency: An LSP is advertised to neighboring routers. Therefore, other routers can use the LSP. l Fast reroute (FRR) The switchover through FRR is within 50 ms, which minimizes the data loss when network faults occur. l Auto FRR Auto FRR is an extension to MPLS TE FRR. You can create a bypass tunnel that meets the requirement on the LSP by configuring the attributes of the bypass tunnel, global auto FRR, and auto FRR on the interface of the primary tunnel. With the change of the primary
Issue 02 (2011-08-12) Huawei Proprietary and Confidential Copyright Huawei Technologies Co., Ltd. 27
7 Service Features
tunnel, the previous bypass tunnel is deleted automatically. Then, a new bypass tunnel that meets the requirement is set up. l Backup CR-LSP The NE40E supports the following backup modes: Hot backup A backup CR-LSP is established immediately after the primary CR-LSP is established. When the primary CR-LSP fails, MPLS TE switches traffic immediately to the backup CR-LSP. Ordinary backup A backup CR-LSP is set up when the primary CR-LSP fails. l LDP over TE In existing networks, not all devices support MPLS TE. It is possible that only the devices at the network core support TE and the devices at the network edge use LDP. The application of LDP over TE is therefore put forward. With LDP over TE, the TE tunnel is considered as a hop of the entire LDP LSP. Through forwarding adjacency, one MPLE TE tunnel can be considered as a virtual link and advertised to an IGP network. l Make-before-break Make-before-break is a technology for ensuring highly reliable CR-LSP switchover. The original path is not deleted until a new path has been created. Before a new CR-LSP is created, the original CR-LSP is not deleted. After a new CR-LSP has been created, the traffic is switched to the new CR-LSP first, and then the original CR-LSP is deleted. This ensures non-stop traffic forwarding. l DS-TE DS-TE implemented on the NE40E supports the Non-IETF mode and the IETF mode. The Non-IETF (non-standard) mode supports two CTs (CT0 and CT1), eight priorities (0-7), and two bandwidth constraint models (RDM and MAM). The CT here refers to the class type of a corresponding service flow. The priority here refers to the LSP preemption priority. The IETF (standard) mode supports eight CTs (CT0 through CT7), eight priorities (0-7), and three bandwidth constraint models (RDM, MAM, and Extended). DS-TE supports TE FRR, hot standby, protection switchover, and CT-based traffic statistics collection.
MPLS OAM
MPLS OAM functions are as follows: l MPLS OAM detection MPLS OAM sends CV/FFD and BDI packets along an LSP to be detected and its reverse LSP to detect its connectivity. l l OAM auto protocol Protection switching
Issue 02 (2011-08-12)
28
7 Service Features
VLL
The NE40E supports the following VLL functions: l Martini VLL The Martini mode supports double labels. The inner label adopts extended LDP for signaling in compliance with RFC 4096. The type of VC FEC is 128. VC encapsulation types include 0x0004 Ethernet Tagged Mode, 0x0005 Ethernet, and 0x000B IP Layer2 Transport. l Kompella VLL VC encapsulation types of Kompella VLL include Ethernet, PPP, VLAN, and IPinterworking. Kompella VLL supports the local inter-board switching of packets in 802.1Q mode. Kompella VLL supports inter-AS VPN. l
Issue 02 (2011-08-12)
CCC VLL
Huawei Proprietary and Confidential Copyright Huawei Technologies Co., Ltd. 29
7 Service Features
CCC VLL supports the local inter-board switching of packets in 802.1Q mode l l SVC VLL VLL heterogeneous interworking VLL heterogeneous IP-interworking is used when the link types of CEs on both ends of an L2VPN link are different. In MPLS L2VPN heterogeneous IP-interworking, after receiving a frame from a CE, a PE decapsulates the link-layer packet and transmits the IP packet across an MPLS network. The IP packet is transparently transmitted to the peer PE. The peer PE re-encapsulates IP packet according to its link layer protocol and transmits the packet to the connected CE. The link-layer control packet sent by the CE is processed by the PE and is not transmitted through the MPLS network. All non-IP packets such as MPLS and IPX packets are discarded. l Transparent transmission of certain types of link layer protocol packets Interfaces can be configured to transparently transmit certain types of link layer protocol packets, such as BPDUs, STP packets, LLDP packets, UDLD packets, CDP packets, and HGMP packets. l Inter-AS VLL SVC VLL, Martini VLL, and Kompella VLL can implement inter-AS L2VPN Option A (VRF-to-VRF). Option B requires the switching of both inner and outer labels on the ASBR, and is therefore not suitable for the VLL. Option C is the best solution. l VLL over TE ECMP
VPLS
In a VPLS network, PEs can be all connected to each other and enabled with split horizon to prevent Layer 2 loops. The implementations of VPLS control plane through BGP and LDP are called Kompella VPLS and Martini VPLS respectively. l Kompella VPLS Kompella VPLS has good scalability. With Kompella VPLS, BGP is adopted for signaling, and VPN targets are configured to implement automatic discovery of VPLS members. Therefore, the addition or deletion of PEs requires few additional operations. l Martini VPLS Martini VPLS has poor scalability. With Martini VPLS, LDP is adopted for signaling, and the peers of a PE need to be manually specified. PEs in a VPLS network are all connected to each other. Therefore, adding a new PE requires configurations on all the other associated PEs to be modified.A pseudo wire (PW) is actually a point-to-point link. This means that using LDP to create, maintain, and delete the PW is more effective. The NE40E supports the following VPLS functions: l l l l l
Issue 02 (2011-08-12)
Access to the VPLS network in QinQ mode HVPLS IGMP snooping for VPLS One MAC address space for each VSI VPLS learns MAC addresses in the following modes:
Huawei Proprietary and Confidential Copyright Huawei Technologies Co., Ltd. 30
7 Service Features
Unqualified mode: In this mode, a VSI can contain multiple VLANs sharing a MAC address space and a broadcast domain. When learning MAC addresses, VPLS also needs to learn VLAN IDs. Qualified mode: In this mode, a VSI has only one VLAN, which has an independent MAC address space and a broadcast domain. When learning MAC addresses, VPLS does not need to learn VLAN IDs. l l l l l l VPLS/HVPLS equal-cost load balancing Fast switching of multicast traffic mVPLS STP over PW STP over VPLS Transparent transmission of certain types of link layer protocol packets Interfaces can be configured to transparently transmit certain types of link layer protocol packets, such as BPDUs, STP packets, LLDP packets, UDLD packets, CDP packets, and HGMP packets. l Ethernet loop detection
PWE3
The NE40E supports the following PWE3 functions: l Virtual Circuit Connectivity Verification PING (VCCV-PING) The NE40E supports the manual LDP PW connectivity detection on the UPE, including the connectivity of static PWs, dynamic PWs, single-hop PWs, and multi-hop PWs. l PW template The NE40E supports the binding between a PW and a PW template, and the reset of PWs. The NE40E supports heterogeneous interworking. Currently, the NE40E supports the transparent transmission of the following packets through PWE3: ATM AAL5 SDU VCC transport, Ethernet, ATM n-to-one VCC cell transport, IP Layer 2 transport, and ATM one-to-one VCC cell mode. l l PW redundancy The NE40E supports the circuit emulation service (CES) by using Pseudo-Wire Emulation Edge to Edge (PWE3). The CES is classified into the Structure-aware TDM Circuit Emulation Service over Packet Switched Network (CESoPSN) and Structure-Agnostic TDM over Packet (SAToP) service.
Access of a CE to an L3VPN through Layer 3 interfaces such as Ethernet, and VLANIF interfaces Static routes, BGP, RIP, OSPF, or IS-IS running between a CE and a PE Carrier's carrier
Huawei Proprietary and Confidential Copyright Huawei Technologies Co., Ltd. 31
7 Service Features
Inter-AS VPN The NE40E supports the following inter-AS VPN solutions described in RFC 2547bis: VPN instance to VPN instance, also called Inter-Provider Backbones Option A In Option A, sub-interfaces connecting the Autonomous System Boundary Routers (ASBRs) manage VPN routes. EBGP redistribution of labeled VPN-IPv4 routes, also called Inter-Provider Backbones Option B In Option B, ASBRs advertise labeled VPN-IPv4 routes to each other through MPEBGP. Multihop EBGP redistribution of labeled VPN-IPv4 routes, also called Inter-Provider Backbones Option C In Option C, PEs advertise labeled VPN-IPv4 routes to each other through Multihop MP-EBGP.
l l
Multicast VPN IPv6 VPN The NE40E supports the following IPv6 VPN networking solutions: Intranet VPN Extranet VPN Hub&Spoke Inter-AS or multi-AS backbones VPN Carriers' carrier
l l l
7.6 QoS
On the NE40E, you can collect traffic statistics on the packets on which QoS is performed and view the statistics result through corresponding display commands. The NE40E supports the following QoS functions:
Diff-Serv Model
Multiple service flows can be aggregated into a Behavior Aggregate (BA) and then processed based on the same Per-Hop Behavior (PHB). This simplifies the processing and storage of services. On the Diff-Serv core network, packet-specific QoS is provided. Therefore, signaling processing is not required.
7 Service Features
l l
Traffic Policing
CAR is mainly used for rate limit. In the implementation of CAR, a token bucket is used to measure the data flows that pass through the interfaces on a router so that only the packets assigned with tokens can go through the router in the specified time period. In this manner, the rates of both incoming and outgoing traffic are controlled. In addition, the rate of certain types of data flows can be controlled based on the information such as the IP address, port number, and priority. Rate limit is not performed on the data flows that do not meet the specified conditions, and such data flows are forwarded at the original interface rate. CAR is mainly implemented at the edge of a network to ensure that core devices on the network process data properly. The NE40E supports CAR for both incoming and outgoing traffic.
Queue Scheduling
The NE40E supports FIFO, PQ, and WFQ for queue scheduling on interfaces. The NE40E maps packets of different priorities to different queues and adopts Round Robin (RR) on each interface for queue scheduling. Priority Queues (PQs) are classified into four types: top PQs, middle PQs, normal PQs, and bottom PQs. They are ordered in descending order of priorities. When packets leave queues, PQ allows the packets in the top PQ to go first. Packets in the top PQ are sent as long as there are packets in this PQ. The NE40E sends packets in the middle PQ only when all packets in the top PQ are sent. Similarly, the NE40E sends packets in the normal PQ only when all packets in the middle PQ are sent; the NE40E sends packets in the bottom PQ only when all packets in the normal PQ are sent. As a result, the packets in the PQ of a higher priority are always sent preferentially, which ensures that packets of key services are processed preferentially when the network is congested. Packets of common services are processed when the network is idle. In this manner, the quality of key services is guaranteed, and the network resources are fully utilized. Weight Fair Queuing (hereinafter referred to as WFQ) is a complex queuing process, which ensures that the services with the same priority are fairly treated and the services with different priorities are weighted. The number of WFQ queues can be pre-set and is allowed to range from 16 to 4096. WFQ weights services based on their requirements for the bandwidth and delay. The weights are determined by the IP precedence in the IP packet headers. With WFQ, the NE40E implements dynamic traffic classification based on quintuples or ToS values. The packets with the same quintuple (source IP address, destination IP address, source port number, destination port number, and protocol number) or ToS value belong to the same flow. Packets in one flow
Issue 02 (2011-08-12) Huawei Proprietary and Confidential Copyright Huawei Technologies Co., Ltd. 33
7 Service Features
are placed in one queue through the Hash algorithm. When flows enter queues, WFQ automatically places different flows into different queues based on the Hash algorithm. When flows leave queues, WFQ allocates bandwidths to flows on the outbound interface based on different IP precedence of the flows. The smaller the precedence value of a flow, the smaller the bandwidth of the flow. In this manner, services of the same precedence are treated fairly; services of different precedence are treated based on their weights.
Congestion Avoidance
Congestion avoidance is a traffic control mechanism used to avoid network overload by adjusting network traffic. With this mechanism, the NE40E can monitor the usage of network resources (such as queues and buffers in the memory) and discard packets when the network congestion intensifies. Random Early Detection (RED) or Weighted Random Early Detection (WRED) algorithms are frequently used in congestion avoidance. The RED algorithm sets the upper and lower limits for each queue and specifies the following rules: l l l When the length of a queue is below the lower limit, no packet is discarded. When the length of a queue exceeds the upper limit, all the incoming packets are discarded. When the length of a queue is between the lower and upper limits, the incoming packets are discarded randomly. A random number is set for each received packet, and the random number is compared with the drop probability of the current queue. The packet is discarded when the random number is larger than the drop probability. The longer the queue, the higher the drop probability. The drop probability, however, has an upper limit.
Unlike RED, the random number in WRED is based on the IP precedence of IP packets. WRED keeps a lower drop probability for the packets that have a higher IP precedence. RED and WRED employ the random packet drop policy to avoid global TCP synchronization. The NE40E adopts WRED to implement congestion avoidance. The NE40E supports congestion avoidance in both inbound and outbound directions of an interface. The WRED template is applied in the outbound direction; the default scheduling policy in the system is applied in the inbound direction. In addition, WRED can be applied to the Multicast Tunnel interface (MTI) that is bound to the distributed multicast VPN on the NE40E. The NE40E supports congestion avoidance based on services. The NE40E reserves on each interface eight service queues, that is, BE, AF1, AF2, AF3, AF4, EF, CS6, and CS7. The NE40E colors packets with red, yellow, and green to identify the priorities of packets and discard certain packets.
HQoS
The NE40E supports the following HQoS functions: l l l Provides five levels of scheduling modes to ensure diverse services. Sets parameters such as the maximum queue length, WRED, low delay, SP/WRR, CBS, PBS, and statistics function for each queue. Sets parameters such as the CIR, PIR, number of queues, and algorithm for scheduling queues for each user.
Huawei Proprietary and Confidential Copyright Huawei Technologies Co., Ltd. 34
Issue 02 (2011-08-12)
7 Service Features
l l l
Provides the traffic statistics function. Users can learn the bandwidth usage of services and properly distribute the bandwidth by analyzing traffic. Supports HQoS in the VPLS, L3VPN, VLL, and TE scenarios. Supports interface-based, VLAN-based, user-based, and service-based HQoS.
QPPB
QPPB is the abbreviation of QoS Policy Propagation Through the Border Gateway Protocol. The receiver of BGP routes performs the following operations: l l l Sets QoS parameters such as IP precedence and traffic behavior for a BGP route based on the attributes of the route. Classifies traffic according to QoS parameters and sets the QoS policy for the classified traffic. Forwards packets according to the locally configured QoS policies to propagate QoS policies through BGP.
The receiver of BGP routes can set QoS parameters (IP precedence and associated traffic behavior) based on the following attributes: l l l l l ACL AS path list in routing information Community attribute list in routing information Metrics in routing information IP prefix list
7 Service Features
Mapping the 802.1p value in the inner VLAN tag to the 802.1p value in the outer VLAN tag. The 802.1p values in multiple inner VLAN tags of different packets can be mapped to the 802.1p value in one outer VLAN tag; whereas the 802.1p value in one inner VLAN tag cannot be mapped to the 802.1p values in multiple outer VLAN tags of different packets.
MPLS HQoS
MPLS QoS is a complete L2VPN/L3VPN QoS solution. It resorts to various QoS techniques to meet the diversified and delicate QoS demands of VPN users. MPLS QoS provides relative QoS on the MPLS Diff-Serv network and end-to-end QoS on the MPLE TE network. In actual applications, the following QoS policies are supported. l l l l l QPPB applied to an L3VPN MPLS Diff-Serv applied to an L2VPN/L3VPN MPLS TE applied to an L2VPN/L3VPN MPLS DS-TE applied to an L2VPN/L3VPN VPN-based QoS applied to the network side of an L2VPN/L3VPN
7 Service Features
fully considers the link bandwidth. In this manner, the case that links with low bandwidth are overloaded whereas links with high bandwidth are idle does not exist. The NE40E can balance traffic between physical interfaces or between physical interfaces and logical interfaces. In addition, the NE40E can detect the changes of logical interface bandwidth due to manual configuration of new member links or the status changes of member links. When the bandwidth of a logical interface changes, traffic is automatically load-balanced based on the new bandwidth proportion.
7 Service Features
l l l
Statistics on the number of forwarding packets, bytes, and discarded packets of a user queue which includes eight flow queues of different priorities Statistics on the number of forwarded packets, bytes, and discarded packets of a user group queue Statistics on the number of forwarded packets, bytes, and discarded packets of eight queues of different priorities on an interface
AAA
Huawei Proprietary and Confidential Copyright Huawei Technologies Co., Ltd. 38
7 Service Features
l l l
Plain text authentication and MD5 encrypted text authentication supported by routing protocols that include RIPv2, OSPF, IS-IS, and BGP MD5 encrypted text authentication supported by LDP and RSVP SNMPv3 encryption and authentication
URPF
The NE40E supports URPF for IPv4/IPv6 traffic.
MAC entries in a MAC address table are classified into three types: l Dynamic entries Dynamic entries are learnt by interfaces and stored in hardware of LPUs. Dynamic entries age. Dynamic entries will be lost in the case of the system reset, LPU hot swap, or LPU reset. l Static entries Static entries are configured by users and delivered to LPUs. Static entries do not age. After static entries are configured and saved, they are not lost in the case of the system reset, LPU hot swap, or LPU reset. l Blackhole entries Blackhole entries are used to filter out the data frames that contain specific destination MAC addresses. Blackhole entries are configured by users and delivered to LPUs. Blackhole entries do not age. After blackhole entries are configured and saved, they will not be lost in the case of the system reset, LPU hot swap, or LPU reset.
7 Service Features
Manages user traffic. Boards that are not LPUI-41s or LPUF-100s manage only the traffic of VSI and VLAN users.
In this manner, the network bandwidth is reasonably used and the network security is guaranteed.
IGMP Snooping
The NE40E supports IGMP snooping on Layer 2 interfaces, Layer 3 interfaces, QinQ interfaces, STP topologies, RRPP rings, and VPLS PWs.
DHCP Snooping
DHCP snooping is mainly used to prevent DHCP Denial of Service (DoS) attacks, bogus DHCP server attacks, ARP middleman attacks, and IP/MAC spoofing attacks when DHCP is enabled on the NE40E. The working mode of DHCP snooping varies with the attack type, as shown in Table 7-1. Table 7-1 Attack types and DHCP snooping working modes Attack Type DHCP exhaustion attack Bogus DHCP server attack Middleman attack and IP/MAC spoofing attack DoS attack by changing the value of the Client Hardware Address (CHADDR) field DHCP Snooping Anti-Attack Working Mode MAC address limit Trusted/untrusted DHCP snooping binding table Check on the CHADDR field in DHCP packets
7 Service Features
Uniform configuration of CAR parameters The NE40E provides the following methods of configuring CAR parameters: Same CAR parameters configured on different LPUs Same configuration interface for users Configuration of protocol-specific CAR parameters, making the user interface more friendly
Smallest packet compensation The NE40E can efficiently defend the network against the attacks of small packets with the smallest packet compensation function. After receiving packets, the system checks the lengths of packets before sending them to the CPU. If the packet length is smaller than the preset minimum packet length, the system calculates the sending rate with the pre-set minimum length. If the packet length is greater than the pre-set minimum packet length, the system calculates the sending rate with the actual packet length.
l l l l
Association between the application layer and lower layers Local URPF Management and service plane protection Defense against TCP/IP packet attacks The NE40E provides defense measures against attacks by sending the following types of packets on TCP/IP networks: Malformed packets Null IGMP packets, packets with invalid TCP flag bits, LAND attack packets, IP packets whose payloads are null, and smurf attack packets. Fragmented packets Packets with a huge number of fragments or packets that have a large offset value, repetitive fragmented packets, tear Drop, syndrop, nesta, fawx, bonk, NewTear, Rose, ping of death, and Jolt attacks TCP SYN UDP flood
Attack source tracing When the NE40E is attacked, it obtains and stores suspicious packets, and then displays the packets in a certain form through command lines or offline tools. This helps locate the attack source easily. When attacks occur, the system automatically removes the data encapsulated at upper layers of the transmission layer and then caches the packets in memory. When there are a certain number of packets in the cache, for example, 20000 packets on each LPU, the earliest cached packets are overridden when more packets are cached.
GTSM
On the current network, attackers forge valid packets to attack routers, which overloads the routers and consumes limited resources such as the CPU on the MPU. For example, an attacker forges BGP protocol packets and continuously sends them to a router. After the LPU of the router receives the packets, it finds that the packets are destined to itself and then sends the packets directly to the BGP processing module on the MPU without checking the validity of the packets. As a result, the system is abnormally busy processing these forged valid packets and the CPU usage is high.
Issue 02 (2011-08-12) Huawei Proprietary and Confidential Copyright Huawei Technologies Co., Ltd. 41
7 Service Features
To guard against the preceding attacks, the NE40E provides the Generalized TTL Security Mechanism (GTSM). The GTSM protects services above the IP layer by checking whether the TTL value in the IP header is within a specified range. In actual applications, the GTSM is mainly used to protect the TCP/IP-based control plane such as the routing protocol against attacks of the CPU-utilization type such as CPU overload. The NE40E supports BGP GTSM, OSPF GTSM, and LDP GTSM.
Local Mirroring
In local mirroring, an LPU can be configured with a physical observing port, multiple logical observing ports, and multiple mirrored ports. Local mirroring can be inter-LPU mirroring, which means that the observing port and mirrored port reside on different LPUs.
Remote Mirroring
The NE40E provides MPLS LSPs, MPLS TE tunnels for remote mirroring. In remote mirroring, an LPU can be configured with multiple observing ports and mirrored ports. In remote mirroring, mirroring packets can be intercepted.
SSHv2
The NE40E supports the STelnet client and server and the SFTP client and server. Both support SSH 1.5 and SSH 2.0.
Issue 02 (2011-08-12) Huawei Proprietary and Confidential Copyright Huawei Technologies Co., Ltd. 42
7 Service Features
Y.1731
Y.1731 supports the following functions: l l l Single-ended frame loss statistics collection, two-ended frame loss statistics collection, one-way frame delay, two-way frame delay and one-way jitter VLL Alarm Indication Signal (AIS) and VPLS AIS Multicast MAC ping
MPLS-TP OAM
MPLS-TP OAM supports the following functions: l l l l l l Basic connectivity detection LoopBack (LB) Remote Defect Indication (RDI) Single-ended frame loss statistics collection and two-ended frame loss statistics collection One-way frame delay and two-way frame delay APS 1:1
NSR OSPF NSR LDP NSR RSVP-TE NSR PIM NSR PPP
Huawei Proprietary and Confidential Copyright Huawei Technologies Co., Ltd. 43
7 Service Features
l l l l l l l l
NSR ARP NSR LACP NSR for L2VPN NSR for L3VPN ISIS/ISIS6 NSR BGP/BGP4+ NSR Multicast (PIM/MSDP) NSR NSR for IPv6
APS
The NE40E supports the following Automatic Protection Switching (APS) functions: l l l l l l l l 1+1 unidirectional modeand 1:1 bidirectional mode Manual switching of APS groups Forcible switching of APS groups Locking of traffic on the working link of an APS group Interface-based APS Intra-LPU or inter-LPU APS Inter-device APS, that is, Enhanced APS (E-APS) Addition of the working and protect interfaces of an APS group to a trunk so that all services are configured on the trunk
FRR
The NE40E provides multiple fast reroute (FRR) features. You can deploy FRR as required to improve network reliability. l IP FRR FRR switching can be complete in 50 ms. In this manner, the data loss caused by network failures is minimized to a great extend. FRR supported by the NE40E enables the system to monitor and save the status of LPUs and interfaces in real time and to check the status of interfaces during packet forwarding. When faults occur on an interface, the system can rapidly switch the traffic to another preset route, thus reducing time between failures and the packet loss ratio. l l LDP FRR LDP FRR switching can be complete in 50 ms. TE FRR TE FRR is an MPLS TE technology used to protect local networks. Only the interfaces with a transmission rate of over 100 Mbit/s support TE FRR. TE FRR switching can be complete within 50 ms. It can minimize data loss when network failures occur. TE FRR protects traffic only temporarily. When the protected LSP becomes normal or a new LSP is established, traffic is switched back to the original protected LSP or the newly established LSP. When a link or a node on the LSP fails, traffic is switched to the protection link and the ingress node of the LSP attempts to establish a new LSP, if an LSP is configured with TE FRR.
Issue 02 (2011-08-12) Huawei Proprietary and Confidential Copyright Huawei Technologies Co., Ltd. 44
7 Service Features
With different protected objects, TE FRR is classified into the following types: Link protection Node protection l Auto FRR Auto FRR is an extension of MPLS TE FRR. It automatically creates a bypass tunnel that meets the requirements for the LSP through the configuration of the attributes of the bypass tunnel, global auto FRR attributes, and interface-based auto FRR attributes on the interface of the primary tunnel. When the primary tunnel changes to another path, the previous bypass tunnel is automatically deleted. Then, a bypass tunnel that meets the requirements is set up. l l VLL FRR VLL FRR switching can be complete in 50 ms. VPN FRR VPN FRR switching can be complete in 50 ms.
l l
7 Service Features
Inter-LPU bundling is implemented by high-performance hardware engines, thus ensuring load balancing of packets among different links. The Hash algorithm based on the combination of the source and destination IP addresses load-balances traffic evenly on links. Seamless switchover is implemented in the case of a link failure so that services are forwarded without interruption. Through extended protocols, the NE40E backs up key service interfaces. In this manner, core routers can monitor and back up the running status of interfaces when they carry LAN, MAN, or WAN services. Therefore, the routing table is not affected when the status of the backup interface needs to be changed and services recover rapidly.
7 Service Features
VRRP
VRRP dynamically associates the virtual router with a physical router that carries services. When the physical router fails, another router is elected to take over services. Failover is transparent to users and thus the internal network and the external network can communicate without interruption. The NE40E supports the following VRRP functions: l l l l mVRRP VGMP E-VRRP VRRP For IPv6
GR
Graceful Restart (GR) is a key technology in implementing HA. It is designed based on NSF. GR switchover and subsequent restart can be performed by the administrator or triggered by faults. GR neither deletes the routing information from the routing table or the FIB nor resets the board during the switchover when faults occur. This prevents the service interruption of the entire system. The NE40E supports system-level GR and protocol-level GR. Protocol-based GR includes: l l l l l l l l l BGP GR OSPF GR IS-IS GR MPLS LDP GR Martini VLL GR Martini VPLS GR L3VPN GR RSVP GR PIM GR
BFD
BFD is a detection mechanism used uniformly in an entire network. It is used to rapidly detect and monitor the connectivity of links or IP routes in a network. BFD sends detection packets at both ends of a bidirectional link to check the link status in both directions. The defect detection is implemented at the millisecond level. The NE40E supports single-hop BFD and multi-hop BFD. BFD of the NE40E supports the following applications. l BFD for VRRP The system uses BFD to detect and monitor the connectivity of links or IP routes in a network. The rapid VRRP switchover is thus triggered. l BFD for FRR BFD for LDP FRR LDP FRR switchover is triggered after BFD detects faults on protected interfaces.
Issue 02 (2011-08-12) Huawei Proprietary and Confidential Copyright Huawei Technologies Co., Ltd. 47
7 Service Features
BFD for IP FRR and BFD for VPN FRR IP FRR and VPN FRR are triggered after BFD detects faults and reports fault information to the upper layer applications. l l BFD for static routes BFD for IS-IS The NE40E supports detection on the IS-IS adjacency by using the BFD session that is configured statically. BFD detects the fault of the link between the adjacent IS-IS nodes and rapidly reports the fault to IS-IS. Thus fast convergence of IS-IS routes is performed. l BFD for OSPF/BGP The NE40E supports OSPF and BGP in dynamically setting up and deleting the BFD session. l BFD for PIM BFD detection on IP-Trunks and Eth-Trunks On the NE40E, BFD can detect a trunk and the member links of the trunk independently. That is, it can detect the connectivity of the trunk and that of an important member link of the trunk. l BFD for LSP BFD for LSP performs fast fault detection of the LSP, the TE tunnel, and the PW. In this manner, BFD for LSP implements fast switchover of MPLS services such as VPN FRR, TE FRR, and VLL FRR. l l l l l l l BFD for Dot1q sub-interface BFD for mVSI Multi-hop BFD BFD For IPv6 BFD for OSPFv3, BFD for ISISv6, BFD for BGP4+, and BFDv6 for default IPv6 BFD for VPLS PW BFD for VPLS/VLL PW VPLS over LDP FRR/FW unicast
7.12 Clock
The NE40E supports the following clock features: l l l Ethernet clock synchronization The Ethernet interfaces of the NE40E provide Ethernet clock synchronization so that the clock quality and stratum of the network can be guaranteed. 1588v2 The 1588v2 feature: Supports the input and output of the externally synchronized time. Supports 10M/100M/1000M/10G Ethernet interfaces and auto sensing of 10M/100M/ 1000M Ethernet interfaces. Supports Eth-Trunk. Supports OC, BC, E2ETC, P2PTC, E2ETCOC, P2PTCOC and TCandBC.
Issue 02 (2011-08-12) Huawei Proprietary and Confidential Copyright Huawei Technologies Co., Ltd. 48
7 Service Features
Allows the NE40E to function as a GrandMaster. Supports slave-only when functioning as an OC. Supports the dynamic BMC algorithm. Supports two delay measurement methods: Delay and PDelay Supports one-step mode and two-step mode in which 1588v2 packets that are used by 1588v2 devices to perform time synchronization are timestamped.. Supports multicast MAC encapsulation (the VLAN and 802.1p priority are configurable). Supports multicast UDP encapsulation (the source IP address, VLAN, and DSCP priority are configurable). Supports unicast MAC encapsulation (the destination MAC, VLAN, and 802.1p priority are configurable). Supports the performance monitoring function on Passive ports of a 1588v2 device. Supports unicast UDP encapsulation (the source IP address, destination IP address, destination MAC, VLAN, and DSCP priority are configurable). Uses the clock recovered through the Precision Time Protocol (PTP) as the clock source and supports the algorithm for dynamic clock source selection (based on the priority and clock stratum). Implements clock recovery that complies with G.813. Implements frequency recovery that meets the requirements of the SDH equipment clock (SEC) in G.823. l 1588 ACR Supports frequency synchronization only. Supports the change of selected clock sources. Supports unicast UDP encapsulation (and the DSCP field). Complies with Recommendation G.8261 in terms of service modeling and networking and performs clock recovery with accuracy that is prescribed by G.823. Supports 1588v2 header overlapping without affecting forwarding capabilities. Supports switchover between master and slave MPUs/SRUs without affecting services. Supports hot swapping of LPUs and sub-cards. l Network Time Protocol (NTP) clock The NE40E supports the following working modes of NTPv4: Server/client mode Peer mode Broadcast mode Multicast mode The NE40E supports two NTP security mechanisms: Access authority The NE40E provides four levels of access control. After receiving an NTP access request packet, the NE40E matches it from the lowest access control level to the highest access control level. The first successfully matched access control level takes effect. The matching order is as follows:
Issue 02 (2011-08-12) Huawei Proprietary and Confidential Copyright Huawei Technologies Co., Ltd. 49
7 Service Features
peer: indicates the minimum access control. The remote end can send a time request and a control query to the local end. The local clock can also be synchronized with the clock of the remote server. server: indicates that the remote end can send a time request and a control query to the local end. The local clock, however, is not synchronized with the clock of the remote server. synchronization: indicates that the remote end can only send a time request to the local end. query: indicates the maximum access control. The remote end can only send a control query to the local end. l Authentication When configuring NTP authentication, note the following rules: The NTP authentication must be configured on both the client and the server; otherwise, the authentication does not take effect. If NTP authentication is enabled, keys must be configured and declared reliable. The server and the client must be configured with the same key. l Internal clock The NE40E provides an internal clock and can extract clock information from LPUs. The clock precision reaches 4.6 ppm, that is, 0.00002s.
Issue 02 (2011-08-12)
50
8 Applicable Environment
8
About This Chapter
8.1 Metro Ethernet Solution
Applicable Environment
Issue 02 (2011-08-12)
51
8 Applicable Environment
Access
Edge
Core
Application
I n t e rnet
BRAS DSLAM CMTS Aggregafion Node VoD ES Distribution node AccSwitch PE P/PE P/PE P/PE
Internet
SoftX
VoD CS
The convergence layer device accesses and forwards the services through the IP or MPLS technologies. Personal services are accessed to the convergence node through the DSLAM, and corporate services are converged at Layer 2 through a switch or are directly accessed to the convergence node. l DSLAM: is short for the Digital Subscriber Line Access Multiplexer that accesses the personal services through the permanent virtual circuit (PVC). The DLSAM adds the VLAN or QinQ tag based on the types of users and services, and is generally connected to the aggregation node. Switch: refers to the access switch that converges the Layer 2 corporate services to the aggregation node. Aggregation node: refers to the aggregation node connected to the distributed service node (PE). The aggregation node distinguishes the VLAN or QinQ user services, forwards Layer 3 services or VPN services, or transparently transmits services to the BRAS or the centralized PE through the IP or MPLS technologies. Distribution node: refers to the distribution node that converges the services in the metro Ethernet. The distribution node terminates the IP or MPLS technologies and transparently transmits the services to the BRAS or the centralized PE. BRAS: refers to a device that processes PPPoE login services of individual users. PE: refers to the centralized service node, which can also serve as the distribution node. PE accesses the services that should be converged and processed, such as centralized L3VPN services.
Huawei Proprietary and Confidential Copyright Huawei Technologies Co., Ltd. 52
l l
l l
Issue 02 (2011-08-12)
8 Applicable Environment
P/PE: refers to the core forwarding node or the edge node on the backbone network. P or PE rapidly forwards the services or accesses the services to the backbone network.
The NE40E is applicable to the aggregation node and the distribution node to guarantee the access of individual services and corporate services.
8 Applicable Environment
IEEE 1588 synchronizes frequency through Ethernet clock synchronization or through WAN interfaces. Figure 8-2 1588v2 clock solution
GPS GPS
BC 1588v2 GE BC
POS 1588v2 GE BC
BC
FE 1588v2
E1
E1
FE 1588v2
Issue 02 (2011-08-12)
54
9
About This Chapter
9.4 HGMP
9.1 System Configuration Modes 9.2 System Management and Maintenance 9.3 Device Running Status Monitoring
9.5 System Service and Status Tracking 9.6 System Test and Diagnosis 9.7 NQA 9.8 In-Service Debugging 9.9 Upgrade Features 9.10 License 9.11 Other Operation and Maintenance Features
Issue 02 (2011-08-12)
55
As a command input interface, the console interface can send command lines to the control plane. As a debugging interface, the console interface can receive debugging information from the control plane and data plane, and deliver debugging commands and control commands. The NMS configuration supports the configuration through the SNMP-based NMS.
l l l l
l l l l l
Log information
Huawei Proprietary and Confidential Copyright Huawei Technologies Co., Ltd. 56
l l
Information is classified into eight severity levels. The lower the level, the higher the severity. The following table shows the detailed information. Lev el 0 Seve rity Emer gency Alert Critic al Description A fatal exception occurs on the device. The system is unable to function properly and must be restarted. For example, the device is restarted due to program exceptions or memory usage errors are detected. A serious exception occurs on the device, which requires immediate actions. For example, the memory usage of the device reaches the upper threshold. A critical exception occurs on the device, which needs to be handled and analyzed. For example, the memory usage exceeds the alarm threshold; the temperature exceeds the alarm threshold; and Bidirectional Forwarding Detection (BFD) detects that a device is unreachable or detects error messages generated by the local device. Improper operation is performed or abnormal process occurs on the device, which does not affect subsequent services but requires attention and cause analysis. For example, users enter incorrect commands or passwords; error protocol packets are received by other devices. An abnormality that may cause the device to malfunction occurs on the device, which requires attention. For example, a routing process is disabled by the user; BFD detects packet loss; and error protocol packets are detected. A key operation is performed to keep the device running normally. For example, the user runs the shutdown command on the interface, a neighbor is discovered, and the protocol state machine changes status. A routine operation is performed. For example, the user runs a display command. A routine operation is performed, which requires no action.
1 2
Error
The information center supports 10 channels, of which channels 0 through 5 each have a default channel name. By default, the six channels correspond to six directions in which information is output. The log information on the CF card is output to log files through Channel 9 by default. This means that a total of seven default output directions are supported. When multiple log hosts are configured, you can configure log information to be output to different log hosts through one channel or multiple channels. For example, you can configure some log information to be output to a log host through Channel 2 (loghost), and some log information to a log host through Channel 6. In addition, you can change the name of Channel 6 to implement the desired channel management.
Issue 02 (2011-08-12)
57
The NE40E stores all alarms in a log file, and provides the CF card to store the log file. How long the alarms can be stored depends on the number of the alarms. Generally, the alarms can be stored for months.
9.4 HGMP
The NE40E supports the Huawei Group Management Protocol (HGMP). HGMP is a cluster management protocol developed by Huawei. HGMP is used to group Layer 2 devices that are connected to the NE40E into a unified management domain, that is, a cluster. HGMP supports automatic collection of network topologies and provides integrated maintenance and management channels. In this manner, a cluster uses only one IP address for external communications, simplifying device management and saving IP addresses.
When voice services on the network deteriorate, or mosaics appear in some videos, the NE40E may have sent or received incorrect packets or have lost packets. You can capture packets to locate the problems. The packet capture function can be used to capture the packets sent to the CPU, and the packets forwarded in the inbound or outbound direction. Compared with the port mirroring function, the packet capture function is easier and faster to configure.
9.7 NQA
The NE40E supports Network Quality Analysis (NQA).NQA measures the performance of different protocols running on the network. In that case, carriers can collect the operation index of networks in real time, such as: l l l l l l Total delay of the HTTP Delay in TCP connection Delay in DNS resolution File transmission speed Delay in FTP connection DNS resolution error ratio Taking control of these indexes, carriers can provide network services of different levels and charge differently. NQA is also an effective tool for diagnosing and locating a network fault.
NQA supports the following functions: l l l l l l l l l l l PWE3 tracert Multicast ping Multicast tracert CE-ping (ping the host from a VPLS PW) VPLS MAC ping and VPLS MAC trace VPLS MAC purge and VPLS MAC populate LSP ping, LSP tracerout, and MPLS jitter Verification of DNS functions through DISMAN-NSLOOKUP-MIB NMS management over all NQA functions through NQA-MIB Transmission of consecutive 3000 simulated voice packets in one test Minimum transmission intervals at 10 ms
Issue 02 (2011-08-12)
59
9.10 License
With the variation of the NE40E software functions and higher ratio of software cost occupying the overall cost, the current service mode cannot satisfy the development requirements of customers and carriers. l l Common users need to reduce the purchase cost. Upgrade and expansion users need to effectively control the capacity and functions.
To satisfy the requirements of different users, the NE40E needs to implement the flexible authorization to service modules. For the authorization control of service modules, the NE40E provides the License authorization management platform through the Global Trotter License (GTL). Through the License authorization mode: l l Common users can purchase service modules as required and reduce the purchase cost. Upgrade and expansion users can expand the capacity, and support and maintain the functions by applying for a new License.
Provides hierarchical commands to prevent unauthorized users from logging in to a device. Users can type in a question mark "?" to obtain online help. Provides detailed debugging information to diagnose network faults.
Huawei Proprietary and Confidential Copyright Huawei Technologies Co., Ltd. 60
l l
Provides DosKey-like functions to run a history command. Provides command line descriptors for partial match of keywords not conflicting with keywords of other command lines. For example, you can enter "disp" for the display command.
Issue 02 (2011-08-12)
61
10 NMS
10
SNMP
The NE40E supports SNMPv1, SNMPv2c, and SNMPv3. l l l SNMPv1 SNMPv2c
NMS
The NE40E supports device operation and management by the network management station through SNMP.
SNMPv1 supports community name-based and MIB view-based access control. SNMPv2c supports community name-based and MIB view-based access control. SNMPv3 SNMPv3 inherits the basic functions of SNMPv2c, defines a management frame, and introduces a User-based Security Model (USM) to provide a more secure access control mechanism for users. SNMPv3 supports user groups, user group-based access control, user-based access control, and authentication and encryption mechanisms.
NMS
The NE40E adopts Huawei iManager U2000 network management system. It supports SNMPv1/v2c/v3 and the client/server architecture. The network management system can run independently on many operation systems, such as Windows NT/2000/XP, UNIX (Sun, HP, and IBM). The NE40E also provides a multi-lingual graphical user interface.
LLDP
The Link Layer Discovery Protocol (LLDP) is a Layer 2 protocol defined in IEEE 802.1ab. LLDP specifies that the status information is stored on all interfaces and the device can send its status to the neighbor stations. The interfaces can also send information about changes in the status to the neighbor stations as required. The neighbor stations then store the received information in the standard SNMP MIB. The NMS can search for Layer 2 information in the MIB. As specified in the IEEE 802.1ab standard, the NMS can also discover unreasonable Layer 2 configurations based on information provided by LLDP. When LLDP runs on the devices, the NMS can obtain Layer 2 information about all the devices to which it connects and detailed network topology information. This is helpful to the rapid
Issue 02 (2011-08-12) Huawei Proprietary and Confidential Copyright Huawei Technologies Co., Ltd. 62
10 NMS
expansion of the network and acquirement of detailed network topologies and changes. LLDP also helps discover unreasonable configurations on networks and reports the configurations to the NMS. This removes incorrect configurations in time.
Issue 02 (2011-08-12)
63
A
A AAA AAL5 AC ACL AF ANSI AP ARP ASBR ASIC ATM AUX
Authentication, Authorization and Accounting ATM Adaptation Layer 5 Access Controller Access Control List Assured Forwarding American National Standard Institute Access Point Address Resolution Protocol Autonomous System Boundary Router Application Specific Integrated Circuit Asynchronous Transfer Mode Auxiliary (port)
C CAR CBR CE
Issue 02 (2011-08-12)
Challenge Handshake Authentication Protocol Class of Service Center Processing Unit Constrained Route - Label Distribution Protocol
D DAA DC DHCP DNS DS Destination Address Accounting Direct Current Dynamic Host Configuration Protocol Domain Name Server Differentiated Services
E EACL EF EMC Enhanced Access Control List Expedited Forwarding EElectroMagnetic Compatibility
F FCC FE FEC FIB FIFO FR FTP Fast Channel Change Fast Ethernet Forwarding Equivalence Class Forward Information Base First In First Out Frame Relay File Transfer Protocol
G GE GRE GTS Gigabit Ethernet Generic Routing Encapsulation Generic Traffic Shaping
Issue 02 (2011-08-12)
65
HA HDLC HTTP
High availablity High level Data Link Control Hyper Text Transport Protocol
I iVSE ICMP IDC IEEE IETF IGMP IGP IP IPoA IPTN IPTV IPv4 IPv6 IPX IS-IS ISP ITU Integrated Value-added Service Engine Internet Control Message Protocol Internet Data Center Institute of Electrical and Electronics Engineers Internet Engineering Task Force Internet Group Management Protocol Interior Gateway Protocol Internet Protocol IP Over ATM IP Telephony Network Internet Protocol Television IP version 4 IP version 6 Internet Packet Exchange Intermedia System-Intermedia System; Interim inter-switch Signaling Protocol International Telecommunication Union - Telecommunication Standardization Sector
Local Area Network Liquid Crystal Display Link Control Protocol Label Distribution Protocol Label switching Edge Router Line Processing Unit Label Switched Path Label Switch Router
Huawei Proprietary and Confidential Copyright Huawei Technologies Co., Ltd. 66
M MAC MBGP MD5 MIB MP MPLS MSDP MSTP MTBF MTTR MTU Media Access Control Multiprotocol Border Gateway Protocol Message Digest 5 Management Information Base Multilink PPP Multi-protocol Label Switch; Multicast Source Discovery Protocol Multiple Spanning Tree Protocol Mean Time Between Failures Mean Time To Repair Maximum Transmission Unit
N NLS NP NTP NVRAM Network Layer Signaling Network Processor Network Time Protocol Non-Volatile Random Access Memory
P PAP PE PFE PIC PIM-DM PIM-SM POP POS Password Authentication Protocol Provider Edge Packet Forwarding Engine Parallel Interference Cancellation Protocol Independent Multicast-Dense Mode Protocol Independent Multicast-Sparse Mode Point Of Presence Packet Over SDH/SONET
Issue 02 (2011-08-12)
67
PPP PQ PT PVC
R RADIUS RAM RED RFC RH RIP RMON ROM RP RPR RSVP RSVP-TE Remote Authentication Dial in User Service Random-Access Memory Random Early Detection Requirement for Comments Relative Humidity Routing Information Protocol Remote Monitoring Read Only Memory Rendezvous Point Resilient Packet Ring Resource Reservation Protocol RSVP-Traffic Engineering
S SAP SCSR SDH SDRAM SFU SLA SNAP SNMP Service Advertising Protocol Self-Contained Standing Routing Synchronous Digital Hierarchy Synchronous Dynamic Random Access Memory Switch Fabric Unit Service Level Agreement SubNet Attachment Point Simple Network Management Protocol
Issue 02 (2011-08-12)
68
Synchronous Optical Network Strict Priority SDH Physical Interface Secure Shell SDH Transport Module -16 Switching Virtual Connection
T TCP TE TFTP TM ToS TP Transfer Control Protocol Traffic Engineering Trivial File Transfer Protocol Traffic Manager Type of Service Topology and Protection packet
U UBR UDP UNI UTP Unspecified Bit Rate User Datagram Protocol User Network Interface Unshielded Twisted Pair
V VBR-NRT VBR-RT VC VCI VDC VLAN VLL VPI VPLS VPN Non-Real Time Variable Bit Rate Real Time Variable Bit Rate Virtual Circuit Virtual Channel Identifier Variable Dispersion Compensator Virtual Local Area Network Virtual Leased Line Virtual Path Identifier Virtual Private LAN Service Virtual Private Network
Issue 02 (2011-08-12)
69
VRP VRRP
W WAN WFQ WRED WRR Wide Area Network Weighted Fair Queuing Weighted Random Early Detection Weighted Round Robin
Issue 02 (2011-08-12)
70