Commissioning and Configuration Guide(V800R006C02_03,GPON)

SmartAX MA5600T Optical Access Equipment

V800R006C02

Commissioning and Configuration Guide

Issue 03

Date 2010-01-28

Huawei Proprietary and ConfidentialCopyright © Huawei Technologies Co., Ltd.

Huawei Technologies Co., Ltd. provides customers with comprehensive technical support and service. For anyassistance, please contact our local office or company headquarters.

Huawei Technologies Co., Ltd.Address: Huawei Industrial Base

Bantian, LonggangShenzhen 518129People's Republic of China

Website: http://www.huawei.com

Email: [email protected]

Copyright © Huawei Technologies Co., Ltd. 2010. All rights reserved.No part of this document may be reproduced or transmitted in any form or by any means without prior writtenconsent of Huawei Technologies Co., Ltd. Trademarks and Permissions

and other Huawei trademarks are the property of Huawei Technologies Co., Ltd.All other trademarks and trade names mentioned in this document are the property of their respective holders. NoticeThe purchased products, services and features are stipulated by the contract made between Huawei and thecustomer. All or part of the products, services and features described in this document may not be within thepurchase scope or the usage scope. Unless otherwise specified in the contract, all statements, information,and recommendations in this document are provided "AS IS" without warranties, guarantees or representationsof any kind, either express or implied.

The information in this document is subject to change without notice. Every effort has been made in thepreparation of this document to ensure accuracy of the contents, but all statements, information, andrecommendations in this document do not constitute the warranty of any kind, express or implied.

Huawei Proprietary and ConfidentialCopyright © Huawei Technologies Co., Ltd.

http://www.huawei.com

mailto:[email protected]

Contents

About This Document.....................................................................................................................1

1 Commissioning...........................................................................................................................1-11.1 Commissioning Introduction...........................................................................................................................1-2

1.1.1 Commissioning Definition.....................................................................................................................1-21.1.2 Commissioning Procedure.....................................................................................................................1-2

1.2 Commissioning Preparations...........................................................................................................................1-31.2.1 Checking Hardware................................................................................................................................1-31.2.2 Preparing Software.................................................................................................................................1-41.2.3 Preparing Tools......................................................................................................................................1-51.2.4 Planning Data.........................................................................................................................................1-6

1.3 Stand-Alone Commissioning..........................................................................................................................1-71.3.1 Checking the Settings of DIP Switches..................................................................................................1-81.3.1.1 Checking the Settings of DIP Switches on the ESC Board.................................................................1-91.3.1.2 Checking the Settings of DIP Switches on the Fan Monitoring Board.............................................1-121.3.2 Powering On the Indoor Device...........................................................................................................1-171.3.3 Commissioning the Power Supply System..........................................................................................1-181.3.3.1 Checking the Power Supply of the DC PDU....................................................................................1-181.3.3.2 Checking the Power Supply of the Power Board..............................................................................1-181.3.4 Configuring the Maintenance Terminal...............................................................................................1-191.3.4.1 Starting the Maintenance Terminal...................................................................................................1-191.3.4.2 Configuring the IP Address of the Maintenance Terminal...............................................................1-201.3.5 Logging In to the System.....................................................................................................................1-221.3.5.1 Login Through the Local Serial Port.................................................................................................1-231.3.5.2 Login Through Telnet (Outband Management)................................................................................1-281.3.5.3 Login Through Telnet (Inband Management)...................................................................................1-321.3.5.4 Login Through SSH (Outband Management)...................................................................................1-361.3.5.5 Login Through SSH (Inband Management)......................................................................................1-481.3.6 Checking the Software Version............................................................................................................1-591.3.7 Loading the Script................................................................................................................................1-591.3.8 Configuring a Board.............................................................................................................................1-601.3.8.1 Adding a Board Offline.....................................................................................................................1-601.3.8.2 Confirming a Board...........................................................................................................................1-611.3.8.3 Checking the Board Status................................................................................................................1-62

SmartAX MA5600TCommissioning and Configuration Guide Contents

Issue 03 (2010-01-28) Huawei Proprietary and ConfidentialCopyright © Huawei Technologies Co., Ltd.

i

1.3.9 Checking the Status of the Upstream Port...........................................................................................1-631.3.10 Checking the Status of the Service Port.............................................................................................1-631.3.11 Testing the Optical Power of an Optical Port....................................................................................1-641.3.11.1 Testing the Mean Launched Power of a One-Fiber Bi-Directional Optical Port............................1-641.3.11.2 Testing the Mean Launched Power of a Two-Fiber Bi-Directional Optical Port...........................1-681.3.11.3 Testing the Actual Input Power of a One-Fiber Bi-Directional Optical Port..................................1-711.3.11.4 Testing the Actual Input Power of a Two-Fiber Bi-Directional Optical Port.................................1-761.3.12 Changing the System Name...............................................................................................................1-801.3.13 Configuring a System User................................................................................................................1-801.3.13.1 Adding a System User.....................................................................................................................1-801.3.13.2 Modifying the System User Attributes............................................................................................1-821.3.14 Configuring the System Time............................................................................................................1-851.3.15 Commissioning the EMU...................................................................................................................1-861.3.15.1 Commissioning the EMU_ESC......................................................................................................1-861.3.15.2 Commissioning the EMU_FAN......................................................................................................1-891.3.16 Checking the Configuration of the Auto-Save Function....................................................................1-911.3.17 Saving the Data..................................................................................................................................1-931.3.18 Backing Up System Files...................................................................................................................1-94

1.4 Interconnection Commissioning...................................................................................................................1-951.4.1 Commissioning the Interconnection with the NMS.............................................................................1-951.4.1.1 Commissioning Outband Network Management (SNMP V1&V2).................................................1-961.4.1.2 Commissioning Outband Management (SNMP V3)......................................................................1-1031.4.1.3 Commissioning Inband Management (SNMP V1&V2).................................................................1-1081.4.1.4 Commissioning Inband Network Management (SNMP V3)..........................................................1-1151.4.2 Commissioning the Interconnection with the BRAS.........................................................................1-1211.4.3 Commissioning the Interconnection with the Router.........................................................................1-1221.4.4 Commissioning the Management Channel Between the OLT and the GPON MDU(Distributed-Mode).....................................................................................................................................................................1-1241.4.5 Commissioning the Management Channel Between the OLT and the GPON ONT(Distributed-Mode).....................................................................................................................................................................1-1281.4.6 Commissioning the Management Channel Between the OLT and the GPON MDU(Profile-mode).....................................................................................................................................................................1-1321.4.7 Commissioning the Management Channel Between the OLT and the GPON ONT(Profile-mode). 1-136

1.5 Maintenance and Management Commissioning.........................................................................................1-1401.5.1 Checking the System Switchover.......................................................................................................1-1401.5.2 Checking Alarms and Events.............................................................................................................1-1421.5.2.1 Verifying the Alarm and Event Function........................................................................................1-1421.5.2.2 Querying Alarms and Events..........................................................................................................1-1431.5.3 Checking the Log...............................................................................................................................1-146

1.6 Supplementary Information.........................................................................................................................1-1471.6.1 Script Making.....................................................................................................................................1-1471.6.2 Configuring the File Transfer Mode..................................................................................................1-1491.6.2.1 Configuring the FTP Transfer Mode...............................................................................................1-149

ContentsSmartAX MA5600T


ii Huawei Proprietary and ConfidentialCopyright © Huawei Technologies Co., Ltd.

Issue 03 (2010-01-28)

1.6.2.2 Configuring the SFTP Transfer Mode............................................................................................1-1501.6.2.3 Configuring the Xmodem Transfer Mode.......................................................................................1-1521.6.2.4 Configuring the TFTP Transfer Mode............................................................................................1-1531.6.3 Software Package Settings.................................................................................................................1-1561.6.3.1 Default settings of the DBA profile................................................................................................1-1571.6.3.2 Default settings of the GPON ONT capability set profile...............................................................1-1591.6.3.3 Default settings of the GPON ONT line profile..............................................................................1-1621.6.3.4 Default settings of the GPON ONT service profile........................................................................1-1621.6.3.5 Default settings of the GPON ONT alarm profile...........................................................................1-1631.6.3.6 Default settings of the environment monitoring units.....................................................................1-164

2 Basic Configurations.................................................................................................................2-12.1 Configuring the License Function...................................................................................................................2-32.2 Configuring Alarms.........................................................................................................................................2-42.3 Configuring the System Clock........................................................................................................................2-62.4 Configuring the Network Time.......................................................................................................................2-7

2.4.1 (Optional) Configuring NTP Authentication.........................................................................................2-92.4.2 Configuring the NTP Broadcast Mode.................................................................................................2-102.4.3 Configuring the NTP Multicast Mode.................................................................................................2-122.4.4 Configuring the NTP Client/Server Mode...........................................................................................2-152.4.5 Configuring the NTP Peer Mode.........................................................................................................2-16

2.5 Adding Port Description................................................................................................................................2-182.6 Configuring the Auto-save Function.............................................................................................................2-192.7 Configuring the Attributes of an Upstream Ethernet Port.............................................................................2-212.8 Configuring the ANCP..................................................................................................................................2-242.9 Configuring DHCP........................................................................................................................................2-26

2.9.1 Configuring the Standard DHCP Mode...............................................................................................2-272.9.2 Configuring the DHCP Option60 Mode..............................................................................................2-302.9.3 Configuring the DHCP MAC Address Segment Mode.......................................................................2-32

2.10 Configuring a VLAN..................................................................................................................................2-352.11 Configuring System Security......................................................................................................................2-41

2.11.1 Configuring Firewall..........................................................................................................................2-422.11.2 Configuring the System Against Malicious Attacks..........................................................................2-442.11.3 Configuring the System Against Login of Unauthorized Users........................................................2-46

2.12 Configuring the User Security.....................................................................................................................2-482.12.1 Configuring Anti-Theft and Roaming of User Account Through PITP............................................2-502.12.2 Configuring Anti-Theft and Roaming of User Accounts Through DHCP........................................2-532.12.3 Configuring Prevention of Access of Unauthorized Users................................................................2-552.12.4 Configuring the User Against Malicious Attacks..............................................................................2-56

2.13 Configuring AAA........................................................................................................................................2-582.13.1 Configuring the Local AAA...............................................................................................................2-602.13.2 Configuring the Remote AAA (RADIUS Protocol)..........................................................................2-622.13.3 Configuring the Remote AAA (HWTACACS Protocol)...................................................................2-65



iii

2.13.4 Configuration Example of the RADIUS Authentication and Accounting.........................................2-692.13.5 Configuration Example of the HWTACACS Authentication (802.1X access user).........................2-722.13.6 Configuration Example of the HWTACACS Authentication (Management User)...........................2-76

2.14 Configuring the ACL..................................................................................................................................2-782.14.1 Configuring a Basic ACL...................................................................................................................2-802.14.2 Configuring an Advanced ACL.........................................................................................................2-812.14.3 Configuring a Link Layer ACL..........................................................................................................2-822.14.4 Configuring a User-defined ACL.......................................................................................................2-83

2.15 Configuring QoS.........................................................................................................................................2-862.15.1 Configuring Traffic Management......................................................................................................2-872.15.1.1 Configuring Traffic Management Based on Service Port...............................................................2-882.15.1.2 Configuring Traffic Management Based on Port+CoS...................................................................2-902.15.1.3 Configuring Rate Limitation on an Ethernet Port...........................................................................2-912.15.1.4 Configuring Traffic Suppression.....................................................................................................2-922.15.2 Configuring the Queue Scheduling....................................................................................................2-942.15.2.1 Configuring the Queue Scheduling Mode.......................................................................................2-942.15.2.2 Configuring the Mapping Between the Queue and the 802.1p Priority..........................................2-962.15.2.3 Configuring the Queue Depth.........................................................................................................2-972.15.3 Configuring Early Drop.....................................................................................................................2-982.15.4 Configuring Traffic Management Based on ACL Rules....................................................................2-992.15.4.1 Controlling the Traffic Matching an ACL Rule............................................................................2-1002.15.4.2 Adding a Priority Tag to the Traffic Matching an ACL Rule.......................................................2-1012.15.4.3 Enabling the Statistics Collection of the Traffic Matching an ACL Rule.....................................2-1022.15.4.4 Enabling the Mirroring of the Traffic Matching an ACL Rule.....................................................2-1022.15.4.5 Enabling the Redirection of the Traffic Matching an ACL Rule..................................................2-103

2.16 Configuring GPON Profiles......................................................................................................................2-1042.16.1 Configuring a DBA Profile..............................................................................................................2-1042.16.2 Configuring the GPON ONT Profile (Distributed Mode)...............................................................2-1052.16.2.1 Configuring a GPON ONT Capacity Profile................................................................................2-1062.16.2.2 Configuring a GPON ONT Alarm Profile....................................................................................2-1072.16.3 Configuring the GPON ONT Profile (Profile Mode).......................................................................2-1092.16.3.1 Configuring a GPON ONT Line Profile.......................................................................................2-1102.16.3.2 Configuring a GPON ONT Service Profile...................................................................................2-1122.16.3.3 Configuring a GPON ONT Alarm Profile....................................................................................2-115

3 Protocol Configuration..............................................................................................................3-13.1 Configuring ARP Proxy..................................................................................................................................3-23.2 Configuring the BFD.......................................................................................................................................3-5

3.2.1 Configuration Example of the BFD Link Detection (Static Route).......................................................3-53.2.2 Configuration Example of the BFD Link Detection (Dynamic Route)................................................. 3-8

3.3 Configuring the Route...................................................................................................................................3-103.3.1 Configuration Example of the Routing Policy.....................................................................................3-113.3.2 Configuration Example of the Static Route.........................................................................................3-13



iv Huawei Proprietary and ConfidentialCopyright © Huawei Technologies Co., Ltd.

Issue 03 (2010-01-28)

3.3.3 Configuration Example of RIP.............................................................................................................3-153.3.4 Configuration Example of OSPF.........................................................................................................3-183.3.5 Configuration Example of IS-IS..........................................................................................................3-213.3.6 Configuration Example of BGP...........................................................................................................3-24

3.4 Configuration Example of a VRF Instance...................................................................................................3-283.5 Configuring the MSTP..................................................................................................................................3-323.6 Configuring Ethernet OAM..........................................................................................................................3-35

3.6.1 Configuration Example of Ethernet CFM OAM..................................................................................3-353.6.2 Configuration Example of Ethernet EFM OAM..................................................................................3-38

4 Configuring the GPON Internet Access Service (Distributed Mode).............................4-14.1 Configuring a VLAN......................................................................................................................................4-54.2 Configuring an Upstream Port......................................................................................................................4-104.3 Configuring a GPON ONT...........................................................................................................................4-114.4 Configuring a GPON Port.............................................................................................................................4-134.5 Creating a GPON Service Port......................................................................................................................4-14

5 Configuring the GPON Internet Access Service (Profile Mode)......................................5-15.1 Configuring a VLAN......................................................................................................................................5-55.2 Configuring an Upstream Port......................................................................................................................5-105.3 Configuring a GPON ONT...........................................................................................................................5-115.4 Configuring a GPON Port.............................................................................................................................5-135.5 Creating a GPON Service Port......................................................................................................................5-15

6 Configuring the Multicast Service (xPON)...........................................................................6-16.1 Configuring Multicast Global Parameters.......................................................................................................6-56.2 Configuring the Multicast VLAN and the Multicast Program........................................................................6-76.3 Configuring the Multicast GPON ONT........................................................................................................6-116.4 Configuring a Multicast User........................................................................................................................6-136.5 (Optional) Configuring the Multicast Bandwidth.........................................................................................6-156.6 (Optional) Configuring Multicast Preview...................................................................................................6-176.7 (Optional) Configuring Program Prejoin......................................................................................................6-196.8 (Optional) Configuring the Multicast Logging Function..............................................................................6-20

7 Configuring Redundancy Backup..........................................................................................7-17.1 Configuring the Uplink Redundancy Backup.................................................................................................7-27.2 Configuring the GPON Port Redundancy Backup..........................................................................................7-4

8 Configuring the NE Subtending Through the FE or GE Port...........................................8-1

9 FTTx Solution Configuration..................................................................................................9-19.1 Configuration Example of the FTTx Service (GPON Access).......................................................................9-2

9.1.1 FTTx Network........................................................................................................................................9-29.1.2 FTTx Data Plan (GPON Access)...........................................................................................................9-49.1.3 Configuring the FTTH Service............................................................................................................9-129.1.3.1 Configuring the FTTH Internet Access Service................................................................................9-13



v

9.1.3.2 Configuration Example of the FTTH VoIP Service (H.248-based)..................................................9-189.1.3.3 Configuration Example of the FTTH VoIP Service (SIP-based)......................................................9-269.1.3.4 Configuring the FTTH IPTV Service................................................................................................9-329.1.4 Configuring the FTTB and FTTC Access Services.............................................................................9-379.1.4.1 Configuring the FTTB and FTTC Internet Access Services (LAN Access).....................................9-399.1.4.2 Configuring the FTTB and FTTC Internet Access Services (ADSL2+ Access)..............................9-449.1.4.3 Configuring the FTTB and FTTC Internet Access Services (VDSL2 Access)................................9-519.1.4.4 Configuring the FTTB and FTTC VoIP Services (Based on the H.248 Protocol)...........................9-589.1.4.5 Configuring the FTTB and FTTC VoIP Services (Based on the SIP Protocol)...............................9-659.1.4.6 Configuring the FTTB and FTTC IPTV Services.............................................................................9-719.1.5 Configuring the FTTO (OLT+OT928G) Service.................................................................................9-789.1.5.1 Configuring the TDM PBX Access Service.....................................................................................9-799.1.5.2 Configuring the Enterprise Ethernet Private Service........................................................................9-809.1.6 Configuring the FTTM (OLT+OT928G) Service................................................................................9-859.1.6.1 Configuring the Native TDM Mobile Bearer Service (Based on the SDH Network)......................9-869.1.6.2 Configuring the Ethernet Mobile Bearer Service..............................................................................9-929.1.7 Configuring the FTTM (OLT+ATN930) Service................................................................................9-979.1.7.1 Configuring the TDM PWE3 Mobile Bearer Service Between the CBU and the OLT...................9-979.1.7.2 Configuring the TDM PWE3 Mobile Bearer Service on the CBU (MPLS-based)........................9-1089.1.7.3 Configuring the TDM PWE3 Mobile Bearer Service on the CBU (IP-based)...............................9-1199.1.7.4 Configuring the ETH PWE3 Mobile Bearer Service on the CBU..................................................9-130

9.2 Configuring the P2P Optical Fiber Access Service....................................................................................9-1409.2.1 Configuring the FTTH P2P Optical Fiber Access Service (Single-Port for Single Service).............9-1409.2.2 Configuring the FTTH P2P Optical Fiber Access Service (Single-Port for Multiple Services)........9-142

10 FAQ...........................................................................................................................................10-110.1 How to Query the MAC Addresses of the Online Users and the Ports That Provide the Access for the Usersin the MA5600T..................................................................................................................................................10-310.2 How to Determine Whether the Users Configured on the MA5600T Can Get Online in the Normal State byRunning the Commands......................................................................................................................................10-310.3 What Are the Prerequisites for the Link and Protocol Status of the L3 Interface of the MA5600T to Be Up.............................................................................................................................................................................10-310.4 How to Shield the Alarms of the User Port Activation/Deactivation.........................................................10-410.5 What Are the Frequently Asked Questions (FAQs) About the System Security of the MA5600T............10-410.6 How to Change the Management IP Address and VLAN Remotely..........................................................10-510.7 How to Change the Management VLAN....................................................................................................10-610.8 How to Change the Management IP address..............................................................................................10-610.9 How to Handle the System Prompt "too many users" When a User Telnets to the Device .......................10-710.10 How to Change the Rate of the User Port in a PON System....................................................................10-810.11 What Are the Differences Between Firewall and Packet-Filter in Activating an ACL............................10-810.12 How to Realize the Communication Between Users on the Same Board.................................................10-910.13 What Are Key Aspects and Major Steps for the Active/Standby Switchover........................................10-1010.14 How to Query the Multicast Bandwidth Parameters of the MA5600T...................................................10-1010.15 How to Select the Matched Hardware for Expanding the Bandwidth of the Upstream Port..................10-11



vi Huawei Proprietary and ConfidentialCopyright © Huawei Technologies Co., Ltd.

Issue 03 (2010-01-28)

10.16 How to Back Up Data.............................................................................................................................10-1110.17 How to Confirm an Upgraded Board......................................................................................................10-1210.18 How to Configure the Data of an Upgraded Board.................................................................................10-12



vii

Figures

Figure 1-1 Commissioning procedure..................................................................................................................1-2Figure 1-2 Layout of the DIP switches (in default settings) on the H801ESCA board....................................... 1-9Figure 1-3 Removing the ESC board.................................................................................................................1-11Figure 1-4 Inserting the ESC board....................................................................................................................1-12Figure 1-5 Layout of the DIP switches (in default settings) of the ESTI fan tray.............................................1-13Figure 1-6 Layout of the DIP switches (in default settings) of the 19-inch fan tray..........................................1-13Figure 1-7 Removing/Inserting the fan tray.......................................................................................................1-17Figure 1-8 Configure the local area connection properties................................................................................1-21Figure 1-9 Configure the IP address and the subnet mask.................................................................................1-22Figure 1-10 Logging in to the MA5600T through the local serial port..............................................................1-23Figure 1-11 Flowchart for logging in to the system through the local serial port..............................................1-24Figure 1-12 Example network for outband management through telnet in a LAN............................................1-29Figure 1-13 Network example for outband management through telnet in a WAN..........................................1-29Figure 1-14 Flowchart for logging in to the MA5600T through telnet (outband management)........................1-31Figure 1-15 Running the telnet application........................................................................................................1-32Figure 1-16 Example network for inband management through telnet in a LAN..............................................1-33Figure 1-17 Example network for inband management through telnet in a WAN............................................1-33Figure 1-18 Flowchart for logging in to the MA5600T through telnet (inband management)..........................1-35Figure 1-19 Running the telnet application........................................................................................................1-36Figure 1-20 Example network for outband management through SSH in a LAN.............................................1-37Figure 1-21 Example network for outband management through SSH in a WAN............................................1-38Figure 1-22 Flowchart for logging in to the MA5600T through SSH (Outband Management)........................1-40Figure 1-23 Interface of the key generator.........................................................................................................1-42Figure 1-24 Interface of the key generator.........................................................................................................1-43Figure 1-25 Save the public key and the private key.........................................................................................1-44Figure 1-26 Interface of converting the client public key to the RSA public key..............................................1-45Figure 1-27 Interface of the SSH client software...............................................................................................1-46Figure 1-28 Interface for logging in to the system through the SSH client software.........................................1-47Figure 1-29 Interface for logging in to the system through the SSH client software.........................................1-47Figure 1-30 Example network for inband management through SSH in a LAN...............................................1-48Figure 1-31 Example network for inband management through SSH in a WAN..............................................1-49Figure 1-32 Flowchart for logging in to the MA5600T through SSH (Inband Management)...........................1-51Figure 1-33 Interface of the key generator.........................................................................................................1-54

SmartAX MA5600TCommissioning and Configuration Guide Figures


ix

Figure 1-34 Interface of the key generator.........................................................................................................1-55Figure 1-35 Save the public key and the private key.........................................................................................1-55Figure 1-36 Interface of converting the client public key to the RSA public key..............................................1-56Figure 1-37 Interface of the SSH client software...............................................................................................1-57Figure 1-38 Interface for logging in to the system through the SSH client software.........................................1-58Figure 1-39 Interface for logging in to the system through the SSH client software.........................................1-58Figure 1-40 Testing the mean launched power of the one-fiber bi-directional optical port on the OLT side. . .1-65Figure 1-41 Testing the mean launched power of the one-fiber bi-directional optical port on the ONT side...1-66Figure 1-42 Testing the mean launched power of the two-fiber bi-directional optical port..............................1-69Figure 1-43 Testing the actual input power of the one-fiber bi-directional optical port on the OLT side.........1-72Figure 1-44 Testing the actual input power of the one-fiber bi-directional optical port on the ONT side........1-73Figure 1-45 Testing the actual input power of the two-fiber bi-directional optical port....................................1-77Figure 1-46 Example network for the outband network management...............................................................1-97Figure 1-47 Flowchart for commissioning the outband network management on the device...........................1-97Figure 1-48 Set the SNMP parameters.............................................................................................................1-100Figure 1-49 Set the SNMP parameters.............................................................................................................1-100Figure 1-50 Add device....................................................................................................................................1-101Figure 1-51 Add device....................................................................................................................................1-102Figure 1-52 Example network for the outband network management.............................................................1-104Figure 1-53 Flowchart for commissioning the outband network management on the device.........................1-104Figure 1-54 Set the SNMP parameters.............................................................................................................1-106Figure 1-55 Set the passwords..........................................................................................................................1-107Figure 1-56 Add device....................................................................................................................................1-107Figure 1-57 Example network for the inband network management...............................................................1-109Figure 1-58 Flowchart for commissioning the inband network management..................................................1-109Figure 1-59 Set the SNMP parameters.............................................................................................................1-112Figure 1-60 Set the SNMP parameters.............................................................................................................1-112Figure 1-61 Add device....................................................................................................................................1-113Figure 1-62 Add device....................................................................................................................................1-114Figure 1-63 Example network for the inband network management...............................................................1-116Figure 1-64 Flowchart for commissioning the inband network management..................................................1-116Figure 1-65 Set the SNMP parameters.............................................................................................................1-119Figure 1-66 Set the passwords..........................................................................................................................1-119Figure 1-67 Add device....................................................................................................................................1-120Figure 1-68 Example network for commissioning the interconnection with the BRAS..................................1-121Figure 1-69 Example network for commissioning the interconnection with the router...................................1-123Figure 1-70 Example network for commissioning the management channel between the OLT and the GPON MDU...........................................................................................................................................................................1-125Figure 1-71 Flowchart for commissioning the management channel between the OLT and the GPON MDU...........................................................................................................................................................................1-126Figure 1-72 Example network for commissioning the management channel between the OLT and the GPON ONT...........................................................................................................................................................................1-129

FiguresSmartAX MA5600T


x Huawei Proprietary and ConfidentialCopyright © Huawei Technologies Co., Ltd.

Issue 03 (2010-01-28)

Figure 1-73 Flowchart for commissioning the management channel between the OLT and the GPON ONT...........................................................................................................................................................................1-130Figure 1-74 Example network for commissioning the management channel between the OLT and the GPON MDU...........................................................................................................................................................................1-133Figure 1-75 Flowchart for commissioning the management channel between the OLT and the GPON MDU...........................................................................................................................................................................1-134Figure 1-76 Example network for commissioning the management channel between the OLT and the GPON ONT...........................................................................................................................................................................1-137Figure 1-77 Flowchart for commissioning the management channel between the OLT and the GPON ONT...........................................................................................................................................................................1-138Figure 1-78 TFTP main interface.....................................................................................................................1-155Figure 1-79 Setting TFTP parameters..............................................................................................................1-156Figure 2-1 NTP broadcast mode........................................................................................................................2-10Figure 2-2 NTP multicast mode.........................................................................................................................2-13Figure 2-3 NTP client/server mode....................................................................................................................2-15Figure 2-4 NTP peer mode.................................................................................................................................2-17Figure 2-5 Flowchart for configuring the auto-save function............................................................................2-20Figure 2-6 Example network of the AAA application.......................................................................................2-59Figure 2-7 Example network of the RADIUS Authentication and Accounting application..............................2-70Figure 2-8 Example network of the HWTACACS authentication.....................................................................2-73Figure 2-9 Example network of the HWTACACS authentication.....................................................................2-76Figure 2-10 First 64 bytes of a data frame.........................................................................................................2-84Figure 2-11 QinQ packet format........................................................................................................................2-86Figure 3-1 Example network of the ARP proxy...................................................................................................3-2Figure 3-2 Flowchart for configuring the ARP proxy..........................................................................................3-3Figure 3-3 Example network of the BFD link detection......................................................................................3-6Figure 3-4 Example network of the BFD link detection......................................................................................3-8Figure 3-5 Example network for configuring the routing policy.......................................................................3-11Figure 3-6 Example network for configuring the static route............................................................................3-13Figure 3-7 Example network for configuring RIP.............................................................................................3-15Figure 3-8 Example network for configuring OSPF..........................................................................................3-18Figure 3-9 Example network for configuring IS-IS...........................................................................................3-22Figure 3-10 Example network for configuring the BGP....................................................................................3-24Figure 3-11 Example network for configuring the VRF instance......................................................................3-29Figure 3-12 Example network for configuring Ethernet CFM OAM................................................................3-36Figure 3-13 Example network of Ethernet EFM OAM.....................................................................................3-38Figure 6-1 Scheme of configuring the multicast service under GPON................................................................6-3Figure 9-1 Example network of full access services in the FTTx scenario..........................................................9-3Figure 9-2 Example network of the FTTH service............................................................................................9-12Figure 9-3 ONT parameters...............................................................................................................................9-17Figure 9-4 Querying the ONT status..................................................................................................................9-18Figure 9-5 WAN interface configuration...........................................................................................................9-23Figure 9-6 ONT VAS Profile.............................................................................................................................9-24Figure 9-7 MGC configure.................................................................................................................................9-25

SmartAX MA5600TCommissioning and Configuration Guide Figures


xi

Figure 9-8 WAN port parameters.......................................................................................................................9-30Figure 9-9 VoIP parameters...............................................................................................................................9-31Figure 9-10 Port bind.........................................................................................................................................9-31Figure 9-11 Port status.......................................................................................................................................9-32Figure 9-12 Example network of the multiple service in FTTB and FTTC service..........................................9-38Figure 9-13 Example network of the TDM PBX access service........................................................................9-79Figure 9-14 Example network of the enterprise Ethernet private service..........................................................9-80Figure 9-15 Example network of the native TDM mobile bearer service..........................................................9-87Figure 9-16 Example network of the Ethernet mobile bearer service................................................................9-92Figure 9-17 Example network of the TDM PWE3 mobile bearer service between the CBU and the OLT......9-98Figure 9-18 Example network of the TDM PWE3 mobile bearer service on the CBU (MPLS-based)..........9-109Figure 9-19 Example network of the TDM PWE3 mobile bearer service on the CBU (MPLS-based)..........9-120Figure 9-20 Example network of the ETH PWE3 mobile bearer service on the CBU (MPLS-based)...........9-130Figure 9-21 Example network of the optical fiber access service in the single-port for single service mode...........................................................................................................................................................................9-141Figure 9-22 Example network of the optical fiber access service in the single-port for multiple services mode...........................................................................................................................................................................9-143

FiguresSmartAX MA5600T


xii Huawei Proprietary and ConfidentialCopyright © Huawei Technologies Co., Ltd.

Issue 03 (2010-01-28)

Tables

Table 1-1 Hardware checklist...............................................................................................................................1-4Table 1-2 Software checklist................................................................................................................................1-5Table 1-3 Tool checklist.......................................................................................................................................1-5Table 1-4 Data checklist.......................................................................................................................................1-6Table 1-5 Settings of the DIP switches................................................................................................................1-9Table 1-6 Mapping between S5-1 to S5-4 and sensor ports...............................................................................1-10Table 1-7 Mapping between S6-1 to S6-5 and sub-node IDs.............................................................................1-10Table 1-8 Settings of SW2..................................................................................................................................1-13Table 1-9 Settings of SW2-1 to SW2-3..............................................................................................................1-14Table 1-10 Settings of SW2-5 and SW2-6.........................................................................................................1-15Table 1-11 Settings of SW2-7 and SW2-8.........................................................................................................1-15Table 1-12 Data plan for the outband management through Telnet in a LAN...................................................1-30Table 1-13 Data plan for the outband management through Telnet in a WAN.................................................1-30Table 1-14 Data plan for the inband management through Telnet in a LAN.....................................................1-34Table 1-15 Data plan for the inband management through Telnet in a WAN...................................................1-34Table 1-16 Data plan for the outband management through SSH in a LAN......................................................1-38Table 1-17 Data plan for the outband management through SSH in a WAN....................................................1-39Table 1-18 Data plan for the inband management through SSH in a LAN........................................................1-49Table 1-19 Data plan for the inband management through SSH in a WAN......................................................1-50Table 1-20 Specifications of the GPON port (Class B+)...................................................................................1-67Table 1-21 Specifications of the GPON port (Class C+)...................................................................................1-67Table 1-22 Specifications of the GPON port (Class B+)...................................................................................1-74Table 1-23 Specifications of the GPON port (Class C+)...................................................................................1-75Table 1-24 User attributes..................................................................................................................................1-81Table 1-25 Modifying the user attributes...........................................................................................................1-83Table 1-26 Default configuration of the H801ESC board..................................................................................1-87Table 1-27 Default configuration of the FAN....................................................................................................1-90Table 1-28 Default configuration of the auto-save function..............................................................................1-92Table 1-29 Operations for verifying the alarm and event function..................................................................1-143Table 1-30 Commands for querying history alarms.........................................................................................1-144Table 1-31 Commands for querying history events.........................................................................................1-144Table 1-32 Script data plan...............................................................................................................................1-148Table 1-33 DBA profile....................................................................................................................................1-157

SmartAX MA5600TCommissioning and Configuration Guide Tables


xiii

Table 1-34 GPON ONT capability set profile..................................................................................................1-159Table 1-35 GPON ONT line profile.................................................................................................................1-162Table 1-36 GPON ONT service profile............................................................................................................1-162Table 1-37 GPON ONT alarm profile..............................................................................................................1-163Table 1-38 Default settings of the H801ESC board.........................................................................................1-165Table 1-39 Default settings of the FAN...........................................................................................................1-166Table 2-1 Default configuration for NTP.............................................................................................................2-8Table 2-2 Default settings of the attributes of an Ethernet port......................................................................... 2-22Table 2-3 VLAN application and planning........................................................................................................2-36Table 2-4 Default parameter settings of VLAN.................................................................................................2-36Table 2-5 VLAN types and application scenarios..............................................................................................2-37Table 2-6 VLAN attributes and application scenarios....................................................................................... 2-38Table 2-7 Default settings of system security.................................................................................................... 2-41Table 2-8 Default settings of the user security mechanism................................................................................2-49Table 2-9 Default settings related to PITP......................................................................................................... 2-50Table 2-10 Default settings related to DHCP option 82.....................................................................................2-54Table 2-11 Differences between HWTACACS and RADIUS...........................................................................2-60Table 2-12 ACL types........................................................................................................................................ 2-78Table 2-13 Description of letters and their offset values....................................................................................2-84Table 2-14 Traffic parameters defined in the IP traffic profiles.........................................................................2-88Table 2-15 Mapping between the queue weights and the actual queues............................................................2-95Table 2-16 Mapping between the queue and the 802.1p priority.......................................................................2-96Table 2-17 Queue depth allocation.....................................................................................................................2-97Table 2-18 Default settings of the DBA profiles..............................................................................................2-104Table 2-19 Default settings of the GPON ONT line profile.............................................................................2-110Table 2-20 Default settings of the GPON ONT service profile.......................................................................2-113Table 3-1 Data plan for configuring the ARP proxy............................................................................................3-2Table 3-2 Data plan for configuring the BFD link detection...............................................................................3-6Table 3-3 Data plan for configuring the BFD link detection...............................................................................3-9Table 3-4 Data plan for configuring RIP............................................................................................................3-15Table 3-5 Data plan for configuring OSPF........................................................................................................ 3-19Table 3-6 Data plan for configuring IS-IS..........................................................................................................3-22Table 3-7 Data plan for configuring the BGP.................................................................................................... 3-25Table 3-8 Data plan for configuring a VRF instance......................................................................................... 3-29Table 3-9 Data plan for configuring Ethernet CFM OAM.................................................................................3-36Table 3-10 Data plan for configuring Ethernet EFM OAM...............................................................................3-39Table 4-1 Data plan for the GPON Internet access service..................................................................................4-2Table 4-2 VLAN application and planning..........................................................................................................4-5Table 4-3 Default parameter settings of VLAN...................................................................................................4-6Table 4-4 VLAN types and application scenarios................................................................................................4-6Table 4-5 VLAN attributes and application scenarios.........................................................................................4-8Table 4-6 Default settings of the GPON ONT...................................................................................................4-11

TablesSmartAX MA5600T


xiv Huawei Proprietary and ConfidentialCopyright © Huawei Technologies Co., Ltd.

Issue 03 (2010-01-28)

Table 4-7 Default settings of the GPON port.....................................................................................................4-13Table 4-8 Default settings of a service port........................................................................................................4-15Table 5-1 Data plan for the GPON Internet access service..................................................................................5-2Table 5-2 VLAN application and planning..........................................................................................................5-5Table 5-3 Default parameter settings of VLAN...................................................................................................5-6Table 5-4 VLAN types and application scenarios................................................................................................5-6Table 5-5 VLAN attributes and application scenarios.........................................................................................5-8Table 5-6 Default settings of the GPON ONT...................................................................................................5-12Table 5-7 Default settings of the GPON port.....................................................................................................5-14Table 5-8 Default settings of a service port........................................................................................................5-15Table 6-1 Data items planned for the multicast service.......................................................................................6-2Table 6-2 Default configuration of the multicast service.....................................................................................6-3Table 6-3 Default settings of the multicast global parameters.............................................................................6-5Table 6-4 Default settings of the multicast VLAN attributes...............................................................................6-7Table 6-5 Multicast mode mapping between the GPON boards on the MA5600T and certain MDUs.............6-11Table 6-6 Default settings of the multicast user attributes.................................................................................6-14Table 6-7 Default settings of the CAC parameters.............................................................................................6-16Table 6-8 Default settings of the multicast preview parameters........................................................................6-17Table 6-9 Default settings of the prejoin parameters..........................................................................................6-19Table 6-10 Default settings of the multicast logging parameters.......................................................................6-21Table 9-1 Data plan for the FTTx GPON access..................................................................................................9-4Table 9-2 Data plan............................................................................................................................................9-13Table 9-3 ONT parameters.................................................................................................................................9-17Table 9-4 Data plan............................................................................................................................................9-19Table 9-5 Data plan............................................................................................................................................9-26Table 9-6 Data plan............................................................................................................................................9-33Table 9-7 Data plan for configuring the enterprise Ethernet private service-OLT side.....................................9-81Table 9-8 Data plan for configuring the enterprise Ethernet private service-OT928G side..............................9-81Table 9-9 Data plan for configuring the native TDM mobile bearer service-OLT side.....................................9-87Table 9-10 Data plan for configuring the native TDM mobile bearer service-OT928G side............................9-88Table 9-11 Data plan for configuring the Ethernet mobile bearer service.........................................................9-92Table 9-12 Data plan for configuring the TDM PWE3 mobile bearer service-OLT side..................................9-98Table 9-13 Data plan for configuring the TDM PWE3 mobile bearer service-ATN930 side...........................9-99Table 9-14 Data plan for configuring the TDM PWE3 mobile bearer service-OLT side................................9-109Table 9-15 Data plan for configuring the TDM PWE3 mobile bearer service-ATN930 side.........................9-110Table 9-16 Data plan for configuring the TDM PWE3 mobile bearer service-PTN side................................9-111Table 9-17 Data plan for configuring the TDM PWE3 mobile bearer service-OLT side................................9-121Table 9-18 Data plan for configuring the TDM PWE3 mobile bearer service-ATN930 side.........................9-121Table 9-19 Data plan for configuring the TDM PWE3 mobile bearer service-PTN side................................9-122Table 9-20 Data plan for configuring the ETH PWE3 mobile bearer service-OLT side.................................9-131Table 9-21 Data plan for configuring the ETH PWE3 mobile bearer service-ATN930 side...........................9-131Table 9-22 Data plan for configuring the ETH PWE3 mobile bearer service-PTN side.................................9-132

SmartAX MA5600TCommissioning and Configuration Guide Tables


xv

Table 9-23 Data plan for configuring the VLANs...........................................................................................9-143

TablesSmartAX MA5600T


xvi Huawei Proprietary and ConfidentialCopyright © Huawei Technologies Co., Ltd.

Issue 03 (2010-01-28)

About This Document

Intended AudienceThis document describes the commissioning of the basic functions provided by the device interms of hardware, software, interconnection, and maintenance and management to ensure thatthe device runs in a stable and reliable state. This document describes the configurationprocedures of various services supported by the MA5600T in terms of configuration methodand configuration example.

This document helps to learn the commissioning flows, commissioning methods, andconfiguration procedures of various services of the MA5600T.

This document is intended for:

l Installation and commissioning engineers

l System maintenance engineers

l Data configuration engineers

Symbol ConventionsThe following symbols may be found in this document. They are defined as follows:

Symbol Description

Indicates a hazard with a high level of risk which, if notavoided, will result in death or serious injury.

Indicates a hazard with a medium or low level of riskwhich, if not avoided, could result in minor or moderateinjury.

Indicates a potentially hazardous situation that, if notavoided, could cause equipment damage, data loss, andperformance degradation, or unexpected results.

Indicates a tip that may help you solve a problem or saveyour time.

SmartAX MA5600TCommissioning and Configuration Guide About This Document


1

Symbol Description

Provides additional information to emphasize orsupplement important points of the main text.

Command Conventions

Convention Description

Boldface The keywords of a command line are in boldface.

Italic Command arguments are in italics.

[ ] Items (keywords or arguments) in square brackets [ ] areoptional.

{ x | y | ... } Alternative items are grouped in braces and separated byvertical bars. One is selected.

[ x | y | ... ] Optional alternative items are grouped in square bracketsand separated by vertical bars. One or none is selected.

{ x | y | ... } * Alternative items are grouped in braces and separated byvertical bars. A minimum of one or a maximum of all canbe selected.

GUI Conventions

Convention Description

Boldface Buttons, menus, parameters, tabs, window, and dialogtitles are in boldface. For example, click OK.

> Multi-level menus are in boldface and separated by the “>”signs. For example, choose File > Create > Folder.

Updates in Issue 03 (2010-01-28)This release has updated the following sections:l Added "FTTx Solution Configuration".

l Optimized the whole document.

Updates in Issue 02 (2009-06-25)

This release has updated the following sections:l Section "Configuring the L2 ACL" of the chapter "Configuring the ACL".

Updates in Issue 03 (2010-01-28)SmartAX MA5600T


2 Huawei Proprietary and ConfidentialCopyright © Huawei Technologies Co., Ltd.

Issue 03 (2010-01-28)

l Modified:– 1.3.11.2 Testing the Mean Launched Power of a Two-Fiber Bi-Directional Optical

Port– 1.6.1 Script Making

Issue 01 (2009-03-28)This is the first release.

SmartAX MA5600TCommissioning and Configuration Guide Updates in Issue 03 (2010-01-28)


3

1 Commissioning

About This Chapter

This document describes the commissioning of the basic functions provided by the device interms of hardware, software, interconnection, and maintenance and management to ensure thatthe device runs in a stable and reliable state.

1.1 Commissioning IntroductionThe topic describes the commissioning definition and procedure.

1.2 Commissioning PreparationsThis topic describes the hardware, software, and tool preparations for the commissioning.

1.3 Stand-Alone CommissioningAfter the hardware installation, a stand-alone MA5600T should be commissioned to ensure thatthe stand-alone MA5600T works in the normal state.

1.4 Interconnection CommissioningThe MA5600T provides multiple interfaces for interconnection. This topic describes theinterconnection commissioning of the MA5600T.

1.5 Maintenance and Management CommissioningTo ensure the stability of the MA5600T, you need to verify the maintainability and reliabilityof the device after completing the stand-alone commissioning and interconnectioncommissioning.

1.6 Supplementary InformationThis topic provides the commissioning supplementary information, including script making,transmission mode setting, and default software settings.

SmartAX MA5600TCommissioning and Configuration Guide 1 Commissioning


1-1

1.1 Commissioning IntroductionThe topic describes the commissioning definition and procedure.

1.1.1 Commissioning DefinitionCommissioning refers to the stand-alone commissioning, the interconnection commissioning,and the maintenance and management commissioning after the hardware installation. Thisensures that the device works in the normal state according to the design specifications.

1.1.2 Commissioning ProcedureThis topic describes the procedure for commissioning the device.

1.1.1 Commissioning DefinitionCommissioning refers to the stand-alone commissioning, the interconnection commissioning,and the maintenance and management commissioning after the hardware installation. Thisensures that the device works in the normal state according to the design specifications.

1.1.2 Commissioning ProcedureThis topic describes the procedure for commissioning the device.

Flowchart

Perform the commissioning according to the flowchart.

Figure 1-1 shows the commissioning procedure.

Figure 1-1 Commissioning procedure

1 CommissioningSmartAX MA5600T


1-2 Huawei Proprietary and ConfidentialCopyright © Huawei Technologies Co., Ltd.

Issue 03 (2010-01-28)

Commissioning ItemThe commissioning items in the commissioning procedure are described as follows:

Commissioning Preparations

This topic describes the hardware, software, and tool preparations for the commissioning.

Stand-Alone Commissioning

After the hardware installation, a stand-alone MA5600T should be commissioned to ensure thatthe stand-alone MA5600T works in the normal state.

Interconnection Commissioning

The MA5600T provides multiple interfaces for interconnection. This topic describes theinterconnection commissioning of the MA5600T.

Maintenance and Management Commissioning

To ensure the stability of the MA5600T, you need to verify the maintainability and reliabilityof the device after completing the stand-alone commissioning and interconnectioncommissioning.

1.2 Commissioning PreparationsThis topic describes the hardware, software, and tool preparations for the commissioning.

1.2.1 Checking HardwareThis topic describes how to prepare the hardware required before the commissioning. Thisfacilitates the subsequent commissioning.

1.2.2 Preparing SoftwareThis topic describes how to prepare the software required before the commissioning. Thisfacilitates the subsequent commissioning.

1.2.3 Preparing ToolsThis topic describes how to prepare the tools required before the commissioning. This facilitatesthe subsequent commissioning.

1.2.4 Planning DataThis topic describes the information to be collected about the hardware configuration,networking, and data plan before the commissioning based on the engineering document. Thisfacilitates the data configuration.

1.2.1 Checking HardwareThis topic describes how to prepare the hardware required before the commissioning. Thisfacilitates the subsequent commissioning.

Table 1-1 lists the hardware to be checked before the commissioning.



1-3

Table 1-1 Hardware checklist

SN Item Description

1 Power supplyand grounding

Ensure that the power cable and the grounding meet the followingrequirements:l The power cable and the ground cable are connected properly

and are in good contact.l The labels of the power cable, ground cable, and power

distribution switch are correct, legible and complete.l The connectors of the external ground cables and protection

ground cables of the cabinet are connected properly, withoutany damage.

l The power supply for the device is in the normal state.

2 Cables andconnectors

Check the local maintenance serial port cable, network cable,optical fiber, subscriber cable, and connectors, and ensure thatthey meet the following requirements:l The connectors are tight and firm.

l The cable jacket is intact.

l Cable labels are legible.

l Cables are bundled properly.

3 Upper-layerdevice

Ensure that the upper-layer device meets the followingrequirements:l The position of the interconnection port of the upper-layer

device is correct.l The upper-layer device works in the normal state and can be

used for the commissioning.

4 Board(daughterboard)

The board (daughter board) selected should meet therequirements for the external ports.NOTE

Different boards (daughter boards) provide different external ports. Fordetails about the boards and their external ports on the MA5600T, seeBoard Overview of the MA5600T Hardware Description.

1.2.2 Preparing SoftwareThis topic describes how to prepare the software required before the commissioning. Thisfacilitates the subsequent commissioning.

Table 1-2 shows the software checklist before the commissioning.




Issue 03 (2010-01-28)

Table 1-2 Software checklist

SN Item Description

1 Softwarepackage

Ensure that files in the software package for the commissioningare complete and the software version is correct.

2 Softwarecommissioningtools

Ensure that all the commissioning tools are available. Thecommon commissioning tools are as follows:l HyperTerminal (provided by the Windows OS): used for

logging in to the MA5600T through the CLI.l TFTP, SFTP, and FTP tools: used for loading software.

They can be downloaded from http://support.huawei.com.l Client software key generator Puttygen.exe, client software

key convertor sshkey.exe and SSH client softwareputty.exe: used for logging in to the MA5600T through theSSH.

1.2.3 Preparing ToolsThis topic describes how to prepare the tools required before the commissioning. This facilitatesthe subsequent commissioning.

Table 1-3 lists the tools to be prepared for the commissioning.

Table 1-3 Tool checklist

SN Item Description Remarks

1 Cables One RS-232 serial port cable (One endwith an RJ-45 connector used toconnect to the board and the other endwith a DB-9 or DB-25 femaleconnector used to connect to themaintenance terminal)

Used to connect themaintenance terminal to theMA5600T for maintenancethrough the serial port.

One crossover cable Used to connect themaintenance terminal to theMA5600T for maintenancethrough telnet.

Some optical fibers and patch cordswith different connectors

Used for the upstreamtransmission and opticalpower test.

2 Maintenanceterminal

One maintenance terminal configuredwith a HyperTerminal application,such as a laptop

Used to log in to theMA5600T to commission theMA5600T.



1-5

SN Item Description Remarks

3 Auxiliarydeviceand meter

One optical power meter Used to test the meanlaunched power and the inputoptical power of an opticalport.

One optical attenuator Used to attenuate the inputoptical signal. It is used toprotect the optical port frombeing damaged by intenseoptical signals during thedevice commissioning.

One multimeter Used to measure the voltage,resistance and currentintensity during the powercommissioning.

One optical multiplexer/demultiplexer Used to test the input opticalpower of a single-fiber bi-directional optical port. It is ameter with the multiplexingand demultiplexing functions.

One data network performanceanalyzer

Used to test the input opticalpower. It is used to transmitdata to simulate thenetworking environment.

1.2.4 Planning DataThis topic describes the information to be collected about the hardware configuration,networking, and data plan before the commissioning based on the engineering document. Thisfacilitates the data configuration.

Table 1-4 lists the data collected for the commissioning.

Table 1-4 Data checklist

SN Item Description

1 Hardwareconfiguration

This includes but is not limited to the following:l Types and slot distribution of the control board and

service boardsl Types and physical positions of the upstream ports

and the service ports




Issue 03 (2010-01-28)

SN Item Description

2 Networking and dataplan

This includes but is not limited to the following:l Networking mode

l IP address assignment

l VLAN planning

NOTE

l A commissioning script can be made based on the actual networking and the data plan. For how tomake a script, see 1.6.1 Script Making.

l For details about the default settings of the main software on the MA5600T, see 1.6.3 SoftwarePackage Settings.

1.3 Stand-Alone CommissioningAfter the hardware installation, a stand-alone MA5600T should be commissioned to ensure thatthe stand-alone MA5600T works in the normal state.

1. 1.3.1 Checking the Settings of DIP SwitchesThis topic describes how to check the settings of the DIP switches on the environmentmonitoring board (ESC board) and the fan monitoring board. This ensures the consistencybetween the DIP switch settings and the application of the DIP switch settings.

2. 1.3.2 Powering On the Indoor DeviceThis topic describes how to power on the indoor device to ensure that all the boards can benormally powered on.

3. 1.3.3 Commissioning the Power Supply SystemThis topic describes how to commission the power supply to ensure the reliable and stablepower supply provided for the device.

4. 1.3.4 Configuring the Maintenance TerminalDuring the commissioning, you need to maintain the device through the maintenanceterminal. This topic describes how to start the maintenance terminal and configure the IPaddress of the maintenance terminal to meet the commissioning requirements.

5. 1.3.5 Logging In to the SystemYou must log in to the MA5600T before commissioning the MA5600T through themaintenance terminal. The following describes three login modes, namely, local serial portmode, telnet mode, and SSH mode.

6. 1.3.6 Checking the Software VersionThis topic describes how to verify that current software version meets the deploymentrequirement.

7. 1.3.7 Loading the ScriptYou can run the commands in the script in batches by loading the script instead of runningthe commands one by one. This shortens the commissioning duration and improves thecommissioning efficiency. If the script is not used, skip this operation, and follow thecommissioning procedure to perform the subsequent operations.

8. 1.3.8 Configuring a Board



1-7

Specific services require specific boards. To use a board, you need to first confirm theautomatically discovered board or add the board offline.

9. 1.3.9 Checking the Status of the Upstream PortThis topic describes how to check whether the upstream port is in the normal state.

10. 1.3.10 Checking the Status of the Service PortThis topic describes how to check whether the service port is in the normal state.

11. 1.3.11 Testing the Optical Power of an Optical PortThis topic describes how to check whether the optical signal transmit and receive modulesare normal by testing the mean launched power and the actual input power.

12. 1.3.12 Changing the System NameThis topic describes how to customize the useful system name to differentiateMA5600Ts. This facilitates the management of the MA5600T.

13. 1.3.13 Configuring a System UserFor logging in to, configuring, and managing the MA5600T, system users of differentattributes need to be added. This topic describes how to add a system user and modify theuser attributes.

14. 1.3.14 Configuring the System TimeThis topic describes how to Configure the system time, time zone, time stamp, and start/end time of the daylight saving time (DST) of the MA5600T to ensure that they areconsistent with those in the actual condition.

15. 1.3.15 Commissioning the EMUThe MA5600T monitors various environment parameters (including the temperature,humidity, and voltage of the power supply) to ensure that the MA5600T can work stablyin a proper environment. This topic describes how to commission the environmentmonitoring unit (EMU).

16. 1.3.16 Checking the Configuration of the Auto-Save FunctionThis topic describes how to check the configuration of the auto-save function on theMA5600T, which prevents data loss in case of unexpected restart.

17. 1.3.17 Saving the DataThis topic describes how to save the data in the flash memory to prevent data loss in caseof unexpected restart.

18. 1.3.18 Backing Up System FilesWhen the first deployment or upgrade is complete, you need to back up the database fileand the configuration file so that the system can be easily recovered in case of a fault.

1.3.1 Checking the Settings of DIP SwitchesThis topic describes how to check the settings of the DIP switches on the environment monitoringboard (ESC board) and the fan monitoring board. This ensures the consistency between the DIPswitch settings and the application of the DIP switch settings.

1.3.1.1 Checking the Settings of DIP Switches on the ESC BoardThis topic describes how to check the settings of DIP switches on the ESC board. This ensuresthe consistency between the settings of DIP switches and the application of DIP switches.

1.3.1.2 Checking the Settings of DIP Switches on the Fan Monitoring BoardThis topic describes how to check the settings of DIP switches on the fan monitoring board. Thisensures the consistency between the settings of DIP switches and the application of DIP switches.




Issue 03 (2010-01-28)

1.3.1.1 Checking the Settings of DIP Switches on the ESC BoardThis topic describes how to check the settings of DIP switches on the ESC board. This ensuresthe consistency between the settings of DIP switches and the application of DIP switches.

PrerequisiteThe device must be powered off.

Description of DIP SwitchesThe H801ESCA board resides in the I-type PDU and provides two sets of DIP switches, namely,S5 and S6. Figure 1-2 shows the layout of the DIP switches on the H801ESCA board.

Figure 1-2 Layout of the DIP switches (in default settings) on the H801ESCA board

Table 1-5 describes the settings of the DIP switches (S5 and S6).

Table 1-5 Settings of the DIP switches

DIPSwitch

DefaultSetting

Description

S5-1 ON Used to set the external sensor of JTA1-JTA4 as the voltage type orthe current type.l ON: The external sensors are of the current type.l OFF: The external sensors are of the voltage type.

S5-2

S5-3

S5-4

S6-1 OFF Used to set the sub-node ID corresponding to the system configurationto ensure that the communication is in the normal state.l ON: The mapping address bit is 0.l OFF: The mapping address bit is 1.By default, the address value is 15.

S6-2 OFF

S6-3 OFF

S6-4 OFF

S6-5 ON

S6-6 ON Reserved

S6-7



1-9

DIPSwitch

DefaultSetting

Description

S6-8 ON Used to set the baud rate of the communication between theH801ESCA board and the control board.l ON: The baud rate is 19200 bit/s.

l OFF: The baud rate is 9600 bit/s.

Table 1-6 describes the mapping between S5-1 to S5-4 and sensor ports.

Table 1-6 Mapping between S5-1 to S5-4 and sensor ports

DIP Switch OFF ON

S5-1 The external sensor of JTA1 is of thevoltage type.

The external sensor of JTA1is of the current type.







S6-1 to S6-5 are used to set the sub-node IDs of the ESC board. Table 1-7 lists the mappingbetween S6-1 to S6-5 and sub-node IDs.

Table 1-7 Mapping between S6-1 to S6-5 and sub-node IDs

DIP Switch Setting (5, 4, 3, 2,1)

AddressValue

DIP Switch Setting (5, 4, 3, 2, 1) AddressValue

00000 0 10000 16

00001 1 10001 17

00010 2 10010 18

00011 3 10011 19

00100 4 10100 20

00101 5 10101 21

00110 6 10110 22

00111 7 10111 23




Issue 03 (2010-01-28)

DIP Switch Setting (5, 4, 3, 2,1)

AddressValue

DIP Switch Setting (5, 4, 3, 2, 1) AddressValue

01000 8 11000 24

01001 9 11001 25

01010 10 11010 26

01011 11 11011 27

01100 12 11100 28

01101 13 11101 29

01110 14 11110 30

01111 15(defaultsetting)

11111 31

NOTE

When S6-1 to S6-5 are used to set the sub-node ID, make sure that the DIP switch settings are consistentwith the data configuration. Because sub-node ID 30 is occupied by the ESC board of other versions (suchas H303ESC and H304ESC), the sub-node ID of the H801ESCA board cannot be set to 30 so as to ensurethe compatibility with the ESC board of other versions. Therefore, the address value cannot be set to 30either. In addition, the sub-node ID cannot be the same as that of the fan monitoring board of the fan tray.

ProcedureStep 1 Remove the cable connector if the ESC board is connected to an environment monitoring cable.

Step 2 Loosen the screws on the ESC board anticlockwise by using the Phillips screwdriver, as shownin (1) of Figure 1-3.

Figure 1-3 Removing the ESC board



1-11

Step 3 Hold the ejector lever of the front panel and remove the ESC board from the PDU, as shown in(2)of Figure 1-3.

Step 4 Check whether settings of DIP switches on the ESC board are consistent with the application.If the settings are inconsistent with the application, set the DIP switches again according to"Description of DIP Switches".

Step 5 Insert the ESC board into the PDU, as shown in (1) of Figure 1-4.

Figure 1-4 Inserting the ESC board

Step 6 Fasten the screws on the ESC board clockwise by using the Phillips screwdriver, as shown in(2)of Figure 1-4.

Step 7 Reconnect the environment monitoring cable to the ESC board.

----End

ResultThe settings of DIP switches on the ESC board are consistent with the application.

1.3.1.2 Checking the Settings of DIP Switches on the Fan Monitoring Board

This topic describes how to check the settings of DIP switches on the fan monitoring board. Thisensures the consistency between the settings of DIP switches and the application of DIP switches.

Prerequisite

The device must be powered off.




Issue 03 (2010-01-28)

Description of DIP SwitchesThe ESTI fan tray uses the FCBB fan monitoring board, and the 19-inch fan tray uses the FCBCfan monitoring board.

The fan monitoring board provides a set of DIP switches named SW2. Figure 1-5 and Figure1-6 show the layout of the DIP switches of the ESTI and the 19-inch fan trays respectively.

Figure 1-5 Layout of the DIP switches (in default settings) of the ESTI fan tray

Figure 1-6 Layout of the DIP switches (in default settings) of the 19-inch fan tray

Table 1-8 lists the settings of SW2.

Table 1-8 Settings of SW2

DIPSwitch

Default Settingin the ESTI FanTray

Default Settingin the 19-InchFan Tray

Description

SW2-1 OFF OFF Used to set the sub-node addresscorresponding to the systemconfiguration to ensure that thecommunication is in the normalstate.l ON: The mapping address bit is

0.l OFF: The mapping address bit is

1.By default, the address value is 1.

SW2-2 ON ON

SW2-3 ON ON



1-13

DIPSwitch

Default Settingin the ESTI FanTray

Default Settingin the 19-InchFan Tray

Description

SW2-4 ON ON Used to set the baud rate of thecommunication between the fan trayand the control board.l ON: The baud rate is 19200 bit/s.

l OFF: The baud rate is 9600 bit/s.

SW2-5 ON OFF Used to set the quantity of the fans.

SW2-6 OFF ON

SW2-7 ON ON Used to set the fan speed adjustmentmode.

SW2-8 OFF OFF

Table 1-9, Table 1-10, and Table 1-11 list the settings of each DIP switch of SW2.

Table 1-9 Settings of SW2-1 to SW2-3

SW2-3 SW2-2 SW2-1 Address Value Description

ON ON ON 0 The settingsmust be thesame as thedataconfiguration.

ON ON OFF 1 (defaultsetting)

ON OFF ON 2

ON OFF OFF 3

OFF ON ON 4

OFF ON OFF 5

OFF OFF ON 6

OFF OFF OFF 7

NOTE

When SW2-1, SW2-2, and SW2-3 are used to set the sub-node address, make sure that the DIP switchsettings are consistent with the data configuration. The sub-node address value, however, cannot be thesame as that of the environment monitoring board.




Issue 03 (2010-01-28)

Table 1-10 Settings of SW2-5 and SW2-6

SW2-6 SW2-5 Quantity of Fans Remarks

ON ON 6 -

ON OFF 8 The 19-inch fantray needs to beconfigured witheight fans.Therefore, onlythis setting can beadopted.

OFF ON 4 The ESTI fan trayneeds to beconfigured withfour fans.Therefore, onlythis setting can beadopted.

OFF OFF 10 -

Table 1-11 Settings of SW2-7 and SW2-8

SW2-8 SW2-7 SpeedAdjustmentMode

Speed Adjustment Policy Remarks

ON ON Measure thetemperature atthe air intakevent (reserved)

Policy 1l If the temperature is lower than 25°C,

the fans rotate at 50% of the full speed.l If the temperature is higher than 35°C,

the fans rotate at full speed.l If the temperature ranges from 25°C to

35°C, the fans rotate at 50% to 100% ofthe full speed.

-

ON OFF Measure thetemperature atthe air exhaustvent



the fans rotate at the full speed.l If the temperature ranges from 55°C to


-



1-15

SW2-8 SW2-7 SpeedAdjustmentMode

Speed Adjustment Policy Remarks

OFF ON Measure thetemperature atthe air intakevent



the fans rotate at full speed.l If the temperature ranges from 30°C to


TheESTIand the19-inchfan trayssupportonlypolicy 3.Therefore, onlythissettingcan beadopted.

OFF OFF Stop fanrotating andmeasure thetemperature atthe air intakevent


the fans stop rotating.l If the temperature ranges from 15°C to

45°C, the fans rotate at 50% of the fullspeed.

l If the temperature is higher than 65°C,the fans rotate at full speed.

l If the temperature ranges from 45°C to65°C, the fans rotate at 50% to 100% ofthe full speed.

-

Procedure

Step 1 Loosen the screws on the front panel of the fan tray anticlockwise by using the Phillipsscrewdriver, as shown in (1) of Figure 1-7.




Issue 03 (2010-01-28)

Figure 1-7 Removing/Inserting the fan tray

Step 2 Hold the ejector lever of the fan tray and remove the fan tray from the service shelf, as shownin (2)of Figure 1-7.

Step 3 Check whether the settings of DIP switches on the fan monitoring board are consistent with theapplication. If settings of DIP switches on the fan monitoring board are not consistent with theapplication, set the DIP switches again according to "Description of DIP Switches".

Step 4 Insert the fan tray into the slot, as shown in (3) of Figure 1-7.

Step 5 Use the Phillips screwdriver to fasten the panel screws clockwise on the fan tray, as shown in(4) of the Figure 1-7.

----End

ResultThe settings of DIP switches on the fan monitoring board are consistent with the application.

1.3.2 Powering On the Indoor DeviceThis topic describes how to power on the indoor device to ensure that all the boards can benormally powered on.

PrerequisiteThe after-installation check and the power-on check must be performed on the device.



1-17

Procedure

Step 1 Connect the input power supply of the DC PDU.

Step 2 Turn on the output control switch of the DC PDU.

----End

ResultThe device can be normally powered on, and the RUN LED on the boards are on for 1s and offfor 1s repeatedly.

1.3.3 Commissioning the Power Supply SystemThis topic describes how to commission the power supply to ensure the reliable and stable powersupply provided for the device.

1.3.3.1 Checking the Power Supply of the DC PDUThis topic describes how to verify that either of the two independent power supplies can supplypower to the cabinet.

1.3.3.2 Checking the Power Supply of the Power BoardThis topic describes how to check the redundancy backup function of the power boards.

1.3.3.1 Checking the Power Supply of the DC PDUThis topic describes how to verify that either of the two independent power supplies can supplypower to the cabinet.

PrerequisiteThe two independent power supplies of the DC power distribution unit (PDU) supply power tothe cabinet concurrently.

Procedure

Step 1 Disconnect the first power supply, and check the power supply of the cabinet.

Step 2 Restore the first power supply to power the cabinet.

Step 3 Disconnect the second power supply, and check the power supply of the cabinet.

Step 4 Restore the second power supply to power the cabinet.

----End

ResultAfter either of the two independent power supplies is disconnected, the power supply of thecabinet is in the normal state, and the power supply of the boards is not affected, that is, the RUNLED on the board is on for 1s and off for 1s repeatedly.

1.3.3.2 Checking the Power Supply of the Power BoardThis topic describes how to check the redundancy backup function of the power boards.




Issue 03 (2010-01-28)

Prerequisite

The two power boards configured must work in the normal state.

Context

In the normal state, the two power boards work in the load balancing mode and provide powerfor all the service boards in the shelf. When one power board is faulty, the other power boardprovides power for all the service boards in the shelf.

When checking the power supply of the power board, pay attention to the following points:l Wear an ESD wrist strap during the operation.

l Turn off the -48 V input switch on the PDU that corresponds to the power board beforereplacing the board. In addition, when the board is powered on, do not remove or insert thepower connector.

l If one power board is faulty, replace the board in time to prevent the shelf from workingfor a long time when only one power board supplies power.

Procedure

Step 1 Turn off the switch on the PDU that corresponds to one power board, and check the power supplyfor the service board.

Step 2 Turn on the switch again.

Step 3 Repeat steps 1 and 2 to check the other power board.

----End

ResultThe boards in the shelf work in the normal state after the switch on the PDU that correspondsto either power board is turned off, that is, the RUN LED on the board is on for 1s and off for1s repeatedly.

1.3.4 Configuring the Maintenance TerminalDuring the commissioning, you need to maintain the device through the maintenance terminal.This topic describes how to start the maintenance terminal and configure the IP address of themaintenance terminal to meet the commissioning requirements.

1.3.4.1 Starting the Maintenance TerminalThis topic describes how to start the maintenance terminal to prepare for the subsequentcommissioning.

1.3.4.2 Configuring the IP Address of the Maintenance TerminalThis topic describes how to configure the IP address of the maintenance terminal to ensure thatyou can log in to the MA5600T in the telnet or SSH mode through the maintenance terminal.

1.3.4.1 Starting the Maintenance Terminal

This topic describes how to start the maintenance terminal to prepare for the subsequentcommissioning.



1-19

ContextA maintenance terminal is usually a laptop embedded with a HyperTerminal application.

Procedure

Step 1 Power on the maintenance terminal. The Windows OS starts automatically, and the Log In dialogbox is displayed.

Step 2 (Optional) If the user name and the password are required, input the user name and the passwordof the administrator in the Log In dialog box.

Step 3 Click OK to enter the Windows OS.

----End

ResultThe maintenance terminal runs in the normal state.

1.3.4.2 Configuring the IP Address of the Maintenance TerminalThis topic describes how to configure the IP address of the maintenance terminal to ensure thatyou can log in to the MA5600T in the telnet or SSH mode through the maintenance terminal.

PrerequisitesThe maintenance terminal must be started.

Procedure

Step 1 Right-click My Network Places and choose Properties. The Network Connections windowis displayed.

Step 2 In the Network Connections window, right-click Local Area Connection, and chooseProperties. The Local Area Connection Properties dialog box is displayed.

Step 3 Click the General tab, and then select Internet Protocol (TCP/IP) in Components checkedare used by this connection, as shown in the following figure.




Issue 03 (2010-01-28)

Figure 1-8 Configure the local area connection properties

Step 4 Click Properties to display the Internet Protocol (TCP/IP) Properties dialog box.

Step 5 Click General, and then select Use the following IP address: to configure the IP address andthe subnet mask, as shown in the following figure.



1-21

Figure 1-9 Configure the IP address and the subnet mask

NOTE

The IP address of the maintenance terminal and the IP address of the maintenance Ethernet port of thedevice must be in the same network segment.

Step 6 Click OK to return to the Local Area Connection Properties dialog box.

Step 7 Click OK.

----End

ResultThe IP address of the maintenance terminal and the IP address of the maintenance Ethernet portof the device are in the same network segment.

NOTEBy default, the IP address of the maintenance network port (ETH port on the control board) is 10.11.104.2,and the subnet mask is 255.255.255.0.

1.3.5 Logging In to the SystemYou must log in to the MA5600T before commissioning the MA5600T through the maintenanceterminal. The following describes three login modes, namely, local serial port mode, telnet mode,and SSH mode.




Issue 03 (2010-01-28)

1.3.5.1 Login Through the Local Serial PortWhen you need to maintain and manage the MA5600T locally, you can log in to the systemthrough the local serial port.

1.3.5.2 Login Through Telnet (Outband Management)This topic describes how to log in to the MA5600T through the local maintenance Ethernet port(outband management port) in the telnet mode to maintain and manage the MA5600T.

1.3.5.3 Login Through Telnet (Inband Management)This topic describes how to log in to the MA5600T through the upstream port (inbandmanagement port) in the telnet mode to maintain and manage the MA5600T.

1.3.5.4 Login Through SSH (Outband Management)This topic describes how to log in to the MA5600T through the local maintenance Ethernet port(outband management port) in the SSH mode to maintain and manage the MA5600T. The SSHprovides authentication, encryption, and authorization to ensure the network communicationsecurity. When a user logs in to the MA5600T remotely over an insecure network, SSH providessecurity guarantee and powerful authentication to protect the MA5600T against attacks such asIP address spoofing and interception of plain text password.

1.3.5.5 Login Through SSH (Inband Management)This topic describes how to log in to the MA5600T through the upstream port (inbandmanagement port) in the SSH mode to maintain and manage the MA5600T. The secure shell(SSH) provides authentication, encryption, and authorization to ensure the networkcommunication security. When a user logs in to the MA5600T remotely over an insecurenetwork, SSH provides security guarantee and powerful authentication to protect theMA5600T against attacks such as IP address spoofing and interception of plain text password.

1.3.5.1 Login Through the Local Serial PortWhen you need to maintain and manage the MA5600T locally, you can log in to the systemthrough the local serial port.

Prerequisitel A maintenance terminal (generally a laptop configured with a HyperTerminal application)

must be available.l An RS-232 serial port cable (one end with an RJ-45 connector and the other end with a

DB-9 or DB-25 female connector) must be available.

NetworkingFigure 1-10 shows the networking for logging in to the MA5600T through the local serial port.

Figure 1-10 Logging in to the MA5600T through the local serial port



1-23

FlowchartFigure 1-11 shows the flowchart for logging in to the system through the local serial port.

Figure 1-11 Flowchart for logging in to the system through the local serial port

Procedure

Step 1 Connect the serial port cable.Use an RS-232 serial port cable to connect a serial port of the PC to the CON port of the SCUcontrol board, as shown in Figure 1-10.

Step 2 Set the HyperTerminal communication parameters.1. Set up a connection.

Click Start. Choose All Programs > Accessories > Communications > HyperTerminal to display the Connection Description dialog box. Input the connection name,and click OK, as shown in the following figure.




Issue 03 (2010-01-28)

2. Set the serial port.

Select the serial port that is connected to the MA5600T. You can select COM1 orCOM2 (here, use COM2 as an example), and click OK, as shown in the following figure.

3. Set the HyperTerminal communication parameters. For details, see the following figure.



1-25

NOTE

l The baud rate of the HyperTerminal must be the same as the baud rate of the serial port on theMA5600T. By default, the baud rate of the serial port is 9600 bit/s.

l If illegible characters are displayed on the HyperTerminal interface after you log in to the system,it is generally because the baud rate of the HyperTerminal is different from the baud rate of theMA5600T. In this case, set the consistent baud rate for the HyperTerminal to log in to the system.The system supports the baud rates of 9600 bit/s, 19200 bit/s, 38400 bit/s, 57600 bit/s, and 115200bit/s.

4. Click OK to display the HyperTerminal interface.

Step 3 (Optional) Set the properties of the HyperTerminal.1. Set the emulation type of the HyperTerminal.

Choose File > Properties on the HyperTerminal interface. In the dialog box that isdisplayed, click the Settings tab, and set Emulation to VT100 or Auto Detect, as shownin the following figure. It is Auto Detect by default.




Issue 03 (2010-01-28)

2. Set the line delay and the character delay of the ASCII code.

Click ASCII Setup. In the dialog box that is displayed, set line delay to 200 and Characterdelay to 200, and then click OK, as shown in the following figure. By default, Linedelay is 0, and Character delay is 0.



1-27

NOTE

When you paste a text to the HyperTerminal, the character delay controls the character transmit speed,and the line delay controls the interval of transmitting every line. If a delay is very short, loss ofcharacters occurs. When the pasted text is displayed abnormally, modify the delay.

----End

ResultOn the Hyper Terminal interface, press Enter, and the system prompts you to input the username. Input the user name and the password for user registration (by default, the super user nameis root and the password is admin), and wait until the CLI prompt character is displayed.

If the login fails, click and then click on the operation interface. If the login still fails,return to step 1 to check the parameter settings and the physical connections, and then try again.

1.3.5.2 Login Through Telnet (Outband Management)This topic describes how to log in to the MA5600T through the local maintenance Ethernet port(outband management port) in the telnet mode to maintain and manage the MA5600T.

PrerequisiteYou must be logged in to the MA5600T through the local serial port. For details about how tolog in to the MA5600T through the local serial port, see 1.3.5.1 Login Through the Local SerialPort.

NOTEIn the following operations, the configuration of the MA5600T must be performed through the local serialport.

NetworkingFigure 1-12 shows an example network for outband management through telnet in a LAN, andFigure 1-13 shows an example network for outband management through telnet in a WAN.




Issue 03 (2010-01-28)

Figure 1-12 Example network for outband management through telnet in a LAN

NOTEThe MA5600T uses a straight through cable to connect to the switch or a crossover cable to connect to therouter, and the IP address of the maintenance Ethernet port of the MA5600T is in the same network segmentas the IP address of the maintenance terminal. Alternatively, the Ethernet port of the maintenance terminalcan be directly connected to the maintenance Ethernet port of the MA5600T to manage the MA5600T inthe outband management mode. In such a condition, a crossover cable must be used.

Figure 1-13 Network example for outband management through telnet in a WAN

Data PlanTable 1-12 and Table 1-13 provide the data plan for the outband management through telnet ina LAN and in a WAN respectively.



1-29

Table 1-12 Data plan for the outband management through Telnet in a LAN

Item Data

Maintenance network port of the MA5600T IP address: 10.50.1.10/24NOTE

By default, the IP address of the maintenancenetwork port (ETH port on the control board) is10.11.104.2, and the subnet mask is255.255.255.0.

Maintenance terminal IP address: 10.50.1.20/24 (in the same subnetas the IP address of the maintenance Ethernetport)

Table 1-13 Data plan for the outband management through Telnet in a WAN

Item Data

Maintenance network port of the MA5600T IP address: 10.50.1.10/24NOTE


Maintenance terminal IP address: 10.10.1.10/24

Router port connecting to the MA5600T IP address: 10.50.1.1/24

FlowchartFigure 1-14 shows the flowchart for logging in to the MA5600T through telnet (outbandmanagement).




Issue 03 (2010-01-28)

Figure 1-14 Flowchart for logging in to the MA5600T through telnet (outband management)

Procedure

Step 1 Set up the network environment.

l If you log in to the MA5600T in the LAN outband management mode through telnet, setup a network environment according to Figure 1-12.

l If you log in to the MA5600T in the MAN outband management mode through telnet, setup a network environment according to Figure 1-13.

Step 2 Configure the IP address of the maintenance Ethernet port.In the MEth mode, run the ip address command to configure the IP address of the maintenanceEthernet port.huawei(config)#interface meth 0huawei(config-if-meth0)#ip address 10.50.1.10 24

Step 3 Add a route for the outband management.

l If the network environment is set up as shown in Figure 1-12, you need not add a route.

l If the network environment is set up as shown in Figure 1-13, run the ip route-staticcommand to add a route from the maintenance Ethernet port of the MA5600T to themaintenance terminal.huawei(config-if-meth0)#quithuawei(config)#ip route-static 10.10.1.0 24 10.50.1.1

Step 4 Run the telnet application.



1-31

On the maintenance terminal, choose Start > Run. On the Run window, input "telnet10.50.1.10" in the Open field as shown in Figure 1-15 (considering the Windows OS as anexample), and click OK. Then, the telnet dialog box is displayed.

Figure 1-15 Running the telnet application

Step 5 Log in to the system.

NOTE

The route from the maintenance terminal to the router is already available.

In the telnet dialog box, input the user name and the password. By default, the user name isroot, and the password is admin. When the login is successful, the system displays the followinginformation:

>>User name:root >>User password:admin //The password is not displayed on the maintenance terminal. Huawei Integrated Access Software. Copyright(C) Huawei Technologies Co., Ltd. 2002-2009. All rights reserved.

----End

ResultAfter logging in to the system, you can maintain and manage the MA5600T.

1.3.5.3 Login Through Telnet (Inband Management)

This topic describes how to log in to the MA5600T through the upstream port (inbandmanagement port) in the telnet mode to maintain and manage the MA5600T.

PrerequisiteYou must be logged in to the MA5600T through the local serial port. For details about how tolog in to the MA5600T through the local serial port, see 1.3.5.1 Login Through the Local SerialPort.

NOTEIn the following operations, the configuration of the MA5600T must be performed through the local serialport.




Issue 03 (2010-01-28)

Networking

Figure 1-16 shows an example network for inband management through telnet in a LAN, andFigure 1-17 shows an example network for inband management through telnet in a WAN.

Figure 1-16 Example network for inband management through telnet in a LAN

Figure 1-17 Example network for inband management through telnet in a WAN

Data Plan

Table 1-14 and Table 1-15 provide the data plan for the inband management through telnet ina LAN and in a WAN respectively.



1-33

Table 1-14 Data plan for the inband management through Telnet in a LAN

Item Data

Upstream port of the MA5600T l VLAN ID: 30

l Port: 0/19/0

l IP address: 10.50.1.10/24


Table 1-15 Data plan for the inband management through Telnet in a WAN

Item Data


l Port: 0/19/0

l IP address: 10.50.1.10/24



FlowchartFigure 1-18 shows the flowchart for logging in to the MA5600T through telnet (inbandmanagement).




Issue 03 (2010-01-28)

Figure 1-18 Flowchart for logging in to the MA5600T through telnet (inband management)

Procedure

Step 1 Set up the network environment.

l If you log in to the MA5600T in the LAN inband management mode through telnet, set upa network environment according to Figure 1-16.

l If you log in to the MA5600T in the WAN inband management mode through telnet, setup a network environment according to Figure 1-17.

Step 2 Configure the IP address of the VLAN L3 interface.1. Run the vlan command to create a management VLAN.

huawei(config)#vlan 30 standard

2. Run the port vlan command to add an upstream port to the VLAN.huawei(config)#port vlan 30 0/19 0

3. In the VLANIF mode, run the ip address command to configure the IP address of theVLAN L3 interface.huawei(config)#interface vlanif 30huawei(config-if-vlanif30)#ip address 10.50.1.10 24

NOTEIf the packet transmitted from the upstream port is untagged, run the native-vlan command to configurethe native VLAN of the upstream port to be the same as the VLAN of the upstream port.

Step 3 Add a route for the inband management.

l If the network environment is set up as shown in Figure 1-16, you need not add a route.



1-35

l If the network environment is set up as shown in Figure 1-17, run the ip route-staticcommand to add a route from the maintenance Ethernet port of the MA5600T to themaintenance terminal.huawei(config-if-meth0)#quithuawei(config)#ip route-static 10.10.1.0 24 10.50.1.1

Step 4 Run the telnet application.

On the maintenance terminal, choose Start > Run. On the Run window, input "telnet10.50.1.10" in the Open field as shown in Figure 1-19 (considering the Windows OS as anexample), and click OK. Then, the telnet dialog box is displayed.

Figure 1-19 Running the telnet application


In the telnet dialog box, input the user name and the password. By default, the user name isroot, and the password is admin. When the login is successful, the system displays the followinginformation:

>>User name:root >>User password:admin //The password is not displayed on the maintenance terminal. Huawei Integrated Access Software. Copyright(C) Huawei Technologies Co., Ltd. 2002-2009. All rights reserved.

----End


1.3.5.4 Login Through SSH (Outband Management)

This topic describes how to log in to the MA5600T through the local maintenance Ethernet port(outband management port) in the SSH mode to maintain and manage the MA5600T. The SSHprovides authentication, encryption, and authorization to ensure the network communicationsecurity. When a user logs in to the MA5600T remotely over an insecure network, SSH providessecurity guarantee and powerful authentication to protect the MA5600T against attacks such asIP address spoofing and interception of plain text password.




Issue 03 (2010-01-28)

Prerequisitel You must be logged in to the MA5600T through the local serial port. For details about how

to log in to the MA5600T through the local serial port, see 1.3.5.1 Login Through theLocal Serial Port.

NOTEIn the following operations, the configuration of the MA5600T must be performed through the localserial port.

l The tools used for commissioning in the case of login to the MA5600T through SSH mustbe available, include: Client software key generator Puttygen.exe, client software keyconvertor sshkey.exe and SSH client software putty.exe.

NetworkingFigure 1-20 shows an example network for outband management through SSH in a LAN, andFigure 1-21 shows an example network for outband management through SSH in a WAN.

Figure 1-20 Example network for outband management through SSH in a LAN

NOTEThe MA5600T uses a straight through cable to connect to the switch or a crossover cable to connect to therouter, and the IP address of the maintenance Ethernet port of the MA5600T is in the same network segmentas the IP address of the maintenance terminal. Alternatively, the Ethernet port of the maintenance terminalcan be directly connected to the maintenance Ethernet port of the MA5600T to manage the MA5600T inthe outband management mode. In such a condition, a crossover cable must be used.



1-37

Figure 1-21 Example network for outband management through SSH in a WAN

Data PlanTable 1-16 and Table 1-17 provide the data plan for the outband management through SSH ina LAN and in a WAN respectively.

Table 1-16 Data plan for the outband management through SSH in a LAN

Item Data

Maintenance network port of the MA5600T l IP address: 10.50.1.10/24

l User authentication mode: RSA public keyauthentication

l RSA key name: keyNOTE


New user l User name/Password: huawei/test01

l Authority: Operator

l Permitted reenter number: 4





Issue 03 (2010-01-28)

Table 1-17 Data plan for the outband management through SSH in a WAN

Item Data

Maintenance network port of the MA5600T l IP address: 10.50.1.10/24


l RSA key name: keyNOTE







FlowchartFigure 1-22 shows the flowchart for logging in to the MA5600T through SSH.



1-39

Figure 1-22 Flowchart for logging in to the MA5600T through SSH (Outband Management)




Issue 03 (2010-01-28)

Procedure

Step 1 Set up the network environment.l If you log in to the MA5600T in the LAN outband management mode through SSH, set up

a network environment according to Figure 1-20.l If you log in to the MA5600T in the WAN outband management mode through SSH, set

up a network environment according to Figure 1-21.

Step 2 Configure the IP address of the maintenance Ethernet port.In the MEth mode, run the ip address command to configure the IP address of the maintenanceEthernet port.huawei(config)#interface meth 0huawei(config-if-meth0)#ip address 10.50.1.10 24

Step 3 Add a route for the outband management.l If the network environment is set up as shown in Figure 1-20, you need not add a route.l If the network environment is set up as shown in Figure 1-21, run the ip route-static

command to add a route from the maintenance Ethernet port of the MA5600T to themaintenance terminal.huawei(config-if-meth0)#quithuawei(config)#ip route-static 10.10.1.0 24 10.50.1.1

Step 4 Create a user.Run the terminal user name command to create a user.huawei(config)#terminal user name User Name(length<6,15>):huawei User Password(length<6,15>):test01 //The password is not displayed on the maintenance terminal. Confirm Password(length<6,15>):test01 //The password is not displayed on the maintenance terminal. User profile name(<=15 chars)[root]: User's Level: 1. Common User 2. Operator:2 Permitted Reenter Number(0--4):4 User's Appended Info(<=30 chars): Adding user succeeds Repeat this operation? (y/n)[n]:n

Step 5 Create the local RSA key pair.

Run the rsa local-key-pair create command to create the local RSA key pair.

CAUTIONThe prerequisite for the login through SSH is that the local RSA key pair must be configuredand generated. Therefore, before performing other SSH configurations, make sure that the localRSA key pair is generated.

huawei(config)#rsa local-key-pair createThe key name will be: HostThe range of public key size is (512 ~ 2048).NOTES: If the key modulus is greater than 512, It will take a few minutes.Input the bits in the modulus[default = 512]:Generating keys.....++++++++++++....................++++++++++++



1-41

...............................++++++++

...........++++++++

Step 6 Set the SSH user authentication mode.

Run the ssh user huawei authentication-type rsa command to choose the authentication modeof the SSH user.

There are four authentication modes for SSH users, as shown in the following. In this topic,authentication mode rsa is considered as an example.

l password: authentication based on a password.

l rsa: authentication based on an RSA public key.

l all: authentication based on a password or an RSA public key. The user can log in to thedevice either by the password or the RSA public key.

l password-publickey: authentication based on a password and a public key. The user can login to the device only after both the password and the RSA public key authentication.

huawei(config)#ssh user huawei authentication-type{ all<K>|password-publickey<K>|password<K>|rsa<K> }:rsa

Command: ssh user huawei authentication-type rsa%Authentication type setted, and will be in effect next time.

Step 7 Generate the RSA public key.

1. Run the key generator.

Run the client software key generator Puttygen.exe. Figure 1-23 shows the interface of thekey generator.

Figure 1-23 Interface of the key generator




Issue 03 (2010-01-28)

2. Generate the client key.

Select SSH-2 RSA as the key type under Parameters, click Generate, and move the cursoraccording to the prompt on the interface to generate the client key, as shown in Figure1-24.


Click Save public key and Save private key to save the public key and the private keyrespectively after they are generated, as shown in Figure 1-25.



1-43

Figure 1-25 Save the public key and the private key

3. Generate the RSA public key.

Open sshkey.exe, click Browse, and choose the public key file saved in the preceding step.Then, click Convert to change the client public key to the RSA public key, as shown inFigure 1-26.




Issue 03 (2010-01-28)

Figure 1-26 Interface of converting the client public key to the RSA public key

Step 8 Generate the public key for the SSH user.

Create RSA public key. Copy the RSA public key to the server in the config-rsa-key-codecommand line mode.

huawei(config)#rsa peer-public-key keyEnter "RSA public key" view, return system view with "peer-public-key end".NOTE: The number of the bits of public key must be between 769 and 2048.

huawei(config-rsa-public-key)#public-key-code beginEnter "RSA key code" view, return last view with "public-key-code end".

huawei(config-rsa-key-code)#30818702 81810098 933744B6 7C864EC7 A86A84CC 198BAC15

huawei(config-rsa-key-code)#D32834F7 365CFD17 E7FE4041 3266E416 710D13ED 22BD4D59

huawei(config-rsa-key-code)#DF0C3E46 A995CC61 DC4CB179 F6888B8C 3F8A3085 51EDB5C7

huawei(config-rsa-key-code)#5DEBDBE1 3AB4A256 0D0B9AA8 9A419D85 35C0E562 AE0BBFAB

huawei(config-rsa-key-code)#515299F9 D2803E84 3AE36C20 949367EA 0697EB20 2594A774

huawei(config-rsa-key-code)#9A0EFF04 26928874 FF9124C4 D28F0702 0125

huawei(config-rsa-key-code)#public-key-code end



1-45

huawei(config-rsa-public-key)#peer-public-key end

Step 9 Assign the public key to the SSH user.

Run the ssh user assign rsa-key command to assign the RSA public key to the SSH user.

huawei(config)#ssh user huawei assign rsa-key key

Step 10 Log in to the system.1. Run the client software.

Run the SSH client software putty.exe, choose SSH > Auth from the navigation tree, andassign a file for the RSA private key, as shown in Figure 1-27. Click Browse to displaythe window for selecting the file. In the window, select the file for the private key, and clickOK.

Figure 1-27 Interface of the SSH client software

2. Log in to the system.

Choose Session from the navigation tree, and then input the IP address of the MA5600Tin the Host Name (or IP address) field, as shown in Figure 1-28. Then, click Open to login to the system.




Issue 03 (2010-01-28)

Figure 1-28 Interface for logging in to the system through the SSH client software

The user authentication mode is set to the RSA authentication mode, and the systemtherefore displays the prompt, as shown in Figure 1-29. Input the user name to log in tothe system (here, the user name is huawei).




1-47

----End


1.3.5.5 Login Through SSH (Inband Management)This topic describes how to log in to the MA5600T through the upstream port (inbandmanagement port) in the SSH mode to maintain and manage the MA5600T. The secure shell(SSH) provides authentication, encryption, and authorization to ensure the networkcommunication security. When a user logs in to the MA5600T remotely over an insecurenetwork, SSH provides security guarantee and powerful authentication to protect theMA5600T against attacks such as IP address spoofing and interception of plain text password.

Prerequisitel You must be logged in to the MA5600T through the local serial port. For details about how

to log in to the MA5600T through the local serial port, see 1.3.5.1 Login Through theLocal Serial Port.

NOTEIn the following operations, the configuration of the MA5600T must be performed through the localserial port.

l The tools used for commissioning in the case of login to the MA5600T through SSH mustbe available, include: Client software key generator Puttygen.exe, client software keyconvertor sshkey.exe and SSH client software putty.exe.

NetworkingFigure 1-30 shows an example network for inband management through SSH in a LAN, andFigure 1-31 shows an example network for inband management through SSH in a WAN.

Figure 1-30 Example network for inband management through SSH in a LAN




Issue 03 (2010-01-28)

Figure 1-31 Example network for inband management through SSH in a WAN

Data PlanTable 1-18 and Table 1-19 provide the data plan for the inband management through SSH in aLAN and in a WAN respectively.

Table 1-18 Data plan for the inband management through SSH in a LAN

Item Data


l Port: 0/9 0

l IP address: 10.50.1.10/24


l RSA key name: key







1-49

Table 1-19 Data plan for the inband management through SSH in a WAN

Item Data


l Port: 0/9 0

l IP address: 10.50.1.10/24


l RSA key name: key






FlowchartFigure 1-32 shows the flowchart for logging in to the MA5600T through SSH.




Issue 03 (2010-01-28)

Figure 1-32 Flowchart for logging in to the MA5600T through SSH (Inband Management)



1-51

ProcedureStep 1 Set up the network environment.

l If you log in to the MA5600T in the LAN inband management mode through SSH, set upa network environment according to Figure 1-30.

l If you log in to the MA5600T in the WAN inband management mode through SSH, set upa network environment according to Figure 1-31.

Step 2 Configure the IP address of the VLAN L3 interface.1. Run the vlan command to create a management VLAN.

huawei(config)#vlan 30 standard2. Run the port vlan command to add an upstream port to the VLAN.

huawei(config)#port vlan 30 0/9 03. In the VLANIF mode, run the ip address command to configure the IP address of the

VLAN L3 interface.huawei(config)#interface vlanif 30huawei(config-if-vlanif30)#ip address 10.50.1.10 24


Step 3 Add a route for the inband management.l If the network environment is set up as shown in Figure 1-30, you need not add a route.l If the network environment is set up as shown in Figure 1-31, run the ip route-static

command to add a route from the maintenance Ethernet port of the MA5600T to themaintenance terminal.huawei(config-if-meth0)#quithuawei(config)#ip route-static 10.10.1.0 24 10.50.1.1

Step 4 Create a user.Run the terminal user name command to create a user.huawei(config)#terminal user name User Name(length<6,15>):huawei User Password(length<6,15>):test01 //The password is not displayed on the maintenance terminal. Confirm Password(length<6,15>):test01 //The password is not displayed on the maintenance terminal. User profile name(<=15 chars)[root]: User's Level: 1. Common User 2. Operator:2 Permitted Reenter Number(0--4):4 User's Appended Info(<=30 chars): Adding user succeeds Repeat this operation? (y/n)[n]:n

Step 5 Create the local RSA key pair.

Run the rsa local-key-pair create command to create the local RSA key pair.

CAUTIONThe prerequisite for the login through SSH is that the local RSA key pair must be configuredand generated. Therefore, before performing other SSH configurations, make sure that the localRSA key pair is generated.




Issue 03 (2010-01-28)

huawei(config)#rsa local-key-pair createThe key name will be: HostThe range of public key size is (512 ~ 2048).NOTES: If the key modulus is greater than 512, It will take a few minutes.Input the bits in the modulus[default = 512]:Generating keys.....++++++++++++....................++++++++++++...............................++++++++...........++++++++

Step 6 Set the SSH user authentication mode.

Run the ssh user huawei authentication-type rsa command to choose the authentication modeof the SSH user.

There are four authentication modes for SSH users, as shown in the following. In this topic,authentication mode rsa is considered as an example.l password: authentication based on a password.

l rsa: authentication based on an RSA public key.

l all: authentication based on a password or an RSA public key. The user can log in to thedevice either by the password or the RSA public key.

l password-publickey: authentication based on a password and a public key. The user can login to the device only after both the password and the RSA public key authentication.

huawei(config)#ssh user huawei authentication-type{ all<K>|password-publickey<K>|password<K>|rsa<K> }:rsa

Command: ssh user huawei authentication-type rsa%Authentication type setted, and will be in effect next time.

Step 7 Generate the RSA public key.1. Run the key generator.

Run the client software key generator Puttygen.exe. Figure 1-33 shows the interface of thekey generator.



1-53


2. Generate the client key.

Select SSH-2 RSA as the key type under Parameters, click Generate, and move the cursoraccording to the prompt on the interface to generate the client key, as shown in Figure1-34.




Issue 03 (2010-01-28)


Click Save public key and Save private key to save the public key and the private keyrespectively after they are generated, as shown in Figure 1-35.

Figure 1-35 Save the public key and the private key



1-55

3. Generate the RSA public key.

Open sshkey.exe, click Browse, and choose the public key file saved in the preceding step.Then, click Convert to change the client public key to the RSA public key, as shown inFigure 1-36.

Figure 1-36 Interface of converting the client public key to the RSA public key

Step 8 Generate the public key for the SSH user.

Create RSA public key. Copy the RSA public key to the server in the config-rsa-key-codecommand line mode.huawei(config)#rsa peer-public-key keyEnter "RSA public key" view, return system view with "peer-public-key end".NOTE: The number of the bits of public key must be between 769 and 2048.

huawei(config-rsa-public-key)#public-key-code beginEnter "RSA key code" view, return last view with "public-key-code end".

huawei(config-rsa-key-code)#30818702 81810098 933744B6 7C864EC7 A86A84CC 198BAC15

huawei(config-rsa-key-code)#D32834F7 365CFD17 E7FE4041 3266E416 710D13ED 22BD4D59

huawei(config-rsa-key-code)#DF0C3E46 A995CC61 DC4CB179 F6888B8C 3F8A3085 51EDB5C7




Issue 03 (2010-01-28)

huawei(config-rsa-key-code)#5DEBDBE1 3AB4A256 0D0B9AA8 9A419D85 35C0E562 AE0BBFAB

huawei(config-rsa-key-code)#515299F9 D2803E84 3AE36C20 949367EA 0697EB20 2594A774

huawei(config-rsa-key-code)#9A0EFF04 26928874 FF9124C4 D28F0702 0125

huawei(config-rsa-key-code)#public-key-code end

huawei(config-rsa-public-key)#peer-public-key end

Step 9 Assign the public key to the SSH user.

Run the ssh user assign rsa-key command to assign the RSA public key to the SSH user.

huawei(config)#ssh user huawei assign rsa-key key


1. Run the client software.

Run the SSH client software putty.exe, choose SSH > Auth from the navigation tree, andassign a file for the RSA private key, as shown in Figure 1-37. Click Browse to displaythe window for selecting the file. In the window, select the file for the private key, and clickOK.

Figure 1-37 Interface of the SSH client software

2. Log in to the system.

Choose Session from the navigation tree, and then input the IP address of the MA5600Tin the Host Name (or IP address) field, as shown in Figure 1-38. Then, click Open to login to the system.



1-57


The user authentication mode is set to the RSA authentication mode, and the systemtherefore displays the prompt, as shown in Figure 1-39. Input the user name to log in tothe system (here, the user name is huawei).





Issue 03 (2010-01-28)

----End


1.3.6 Checking the Software VersionThis topic describes how to verify that current software version meets the deploymentrequirement.

ProcedureStep 1 Run the display language command to check whether the version of the host software meets

the deployment requirement.

Step 2 Run the display version command to check whether the version of the board software meetsthe deployment requirement.

----End

Resultl The version of the host software and the version of the board software meet the deployment

requirement.l If the version of the host software and the version of the board software do not meet the

deployment requirement, contact the Huawei Customer Service Center. For the contactinformation, see How to Obtain Technical Support from Huawei. Upgrade the host softwareif necessary.

ExampleTo query the host software version and the board software version that are running in the system,do as follows:huawei>display language Local: Description: CHINESE SIMPLIFIED (DEFAULT LANGUAGE) Version: MA5600V800R006C02

General: Description: ENGLISH (DEFAULT LANGUAGE) Version: MA5600V800R006C02

huawei>display version{ <cr>|backplane<K>|frameid/slotid<S><Length 1-15> }:

Command: display version

VERSION : MA5600V800R006C02 PRODUCT MA5600T Uptime is 3 day(s), 23 hour(s), 47 minute(s), 33 second(s)

1.3.7 Loading the ScriptYou can run the commands in the script in batches by loading the script instead of running thecommands one by one. This shortens the commissioning duration and improves the



1-59

commissioning efficiency. If the script is not used, skip this operation, and follow thecommissioning procedure to perform the subsequent operations.

Prerequisitel The hardware must be installed and checked.

l The script file must be ready. For details about how to make a script, see 1.6.1 ScriptMaking.

l The operator must be in the privilege mode.

Procedure

Step 1 Open the script file and copy all the commands to the CLI.

----End

ResultThe commands in the script can be executed automatically and successfully.

1.3.8 Configuring a BoardSpecific services require specific boards. To use a board, you need to first confirm theautomatically discovered board or add the board offline.

1.3.8.1 Adding a Board OfflineThis topic describes how to add a board to an idle slot that is consistent with the board actuallyplanned beforehand to ensure that the board runs immediately the board is installed in the slot.

1.3.8.2 Confirming a BoardThis topic describes how to confirm a board after the board installed in an idle slot isautomatically discovered. This ensures that the auto-discovered board runs in the normal state.

1.3.8.3 Checking the Board StatusThis topic describes how to check whether the board works in the normal state.

1.3.8.1 Adding a Board Offline

This topic describes how to add a board to an idle slot that is consistent with the board actuallyplanned beforehand to ensure that the board runs immediately the board is installed in the slot.

PrerequisiteThe slot to which a board is added must be idle.

Contextl The boards other than the control board can be added offline.

l After a board is added offline, the board status is displayed as Failed. The board statusbecomes normal only when a board of the same type as the board added offline is installedin the slot. If a board of a different type is installed, the board resets repeatedly due to theboard type mismatch.




Issue 03 (2010-01-28)

ProcedureStep 1 Run the board add command to add a board offline.

NOTE

l The shelf ID and the slot ID of the board added offline must be the same as the actual position.Otherwise, when the board is installed, the board status cannot be changed to normal.

l The type of the board added offline must be the same as the type of the board installed. Otherwise,when the board is installed, the board status cannot be changed to normal.

Step 2 Run the display board frameid [ /slotid ] command to query the type of the added board.

----End

ResultThe type of the added board is the same as the board type that is planned. When a board isinstalled in the slot in which the board is added, the board status is displayed as Normal.

ExampleTo add a service board GPBD offline in slot 0/2, do as follows:huawei(config)#board add 0/2 h802gpbd 0 frame 2 slot board added successfully

huawei(config)#display board 0/2

--------------------------------------- Board Name : H802GPBD Board Status : Failed ---------------------------------------

------------------------------------------------------------- Port Port min-distance max-distance Optical-module type (km) (km) status ------------------------------------------------------------- 0 GPON 0 20 - 1 GPON 0 20 - 2 GPON 0 20 - 3 GPON 0 20 - 4 GPON 0 20 - 5 GPON 0 20 - 6 GPON 0 20 - 7 GPON 0 20 - ------------------------------------------------------------- In port 0, the total of ONTs are: 0 In port 1, the total of ONTs are: 0 In port 2, the total of ONTs are: 0 In port 3, the total of ONTs are: 0 In port 4, the total of ONTs are: 0 In port 5, the total of ONTs are: 0 In port 6, the total of ONTs are: 0 In port 7, the total of ONTs are: 0

1.3.8.2 Confirming a BoardThis topic describes how to confirm a board after the board installed in an idle slot isautomatically discovered. This ensures that the auto-discovered board runs in the normal state.

PrerequisiteA board must be installed in an idle slot or all the boards in the shelf must be installed. Afterthat, the system automatically identifies the board type, and the board status is Auto_find.



1-61

Procedure

Step 1 Run the board confirm command to confirm an Auto_find board.

NOTE

l To confirm only one board, run the board confirm frameid/slotid command.

l To confirm all the boards in a shelf, run the board confirm frameid command.

Step 2 Run the display board frameid [ /slotid ] command to query the board status.

----End

ResultThe board status is displayed as Normal.

ExampleTo confirm the service board in slot 0/2, do as follows:huawei(config)#board confirm 0/2 0 frame 2 slot board confirms successfully

huawei(config)#display board 0/2

--------------------------------------- Board Name : H802GPBD Board Status : Normal ---------------------------------------

------------------------------------------------------------- Port Port min-distance max-distance Optical-module type (km) (km) status ------------------------------------------------------------- 0 GPON 0 20 Offline 1 GPON 0 20 Offline 2 GPON 0 20 Offline 3 GPON 0 20 Offline 4 GPON 0 20 Offline 5 GPON 0 20 Offline 6 GPON 0 20 Offline 7 GPON 0 20 Offline -------------------------------------------------------------

1.3.8.3 Checking the Board StatusThis topic describes how to check whether the board works in the normal state.

Procedure

Step 1 Run the display board frameid command to query the status of all the boards.

----End

ResultAll the boards work in the normal state. That is, all of the board status is displayed as Normal.

ExampleTo query the information about all the boards of shelf 0, do as follows:




Issue 03 (2010-01-28)

huawei(config)#display board 0 ------------------------------------------------------------------------- SlotID BoardName Status SubType0 SubType1 Online/Offline ------------------------------------------------------------------------- 0 1 2 3 4 H802GPBD Normal 5 6 H802GPBD Normal 7 8 9 H801SCUL Active_normal FLBA 10 11 12 H802GPBD Normal 13 14 H802GPBD Normal 15 16 17 H802GPBD Normal 18 19 H801GICG Normal 20 21 22 -------------------------------------------------------------------------

1.3.9 Checking the Status of the Upstream PortThis topic describes how to check whether the upstream port is in the normal state.

Procedure

Step 1 Run the interface giu command to enter the GIU mode.

Step 2 Run the display port state all command to check whether the upstream port is in the normalstate.

----End

ResultThe upstream port is in the normal state. That is, the upstream port is in the active state and thelink is in the online state. If the optical port is adopted for upstream transmission, OpticStatus is displayed as normal.

1.3.10 Checking the Status of the Service PortThis topic describes how to check whether the service port is in the normal state.

PrerequisiteNOTEThe MA5600T provides various service ports. The following only describes how to check the status of aGPON port.

Procedure

Step 1 Run the interface gpon command to enter the GPON mode.



1-63

Step 2 Run the display port state command to check whether the service port is in the normal state.

----End

ResultAll the service ports are in the normal state. That is, Status is displayed as Activated, and Laserstate is displayed as On.

1.3.11 Testing the Optical Power of an Optical PortThis topic describes how to check whether the optical signal transmit and receive modules arenormal by testing the mean launched power and the actual input power.

1.3.11.1 Testing the Mean Launched Power of a One-Fiber Bi-Directional Optical PortThis topic describes how to check whether the optical signal transmitter is normal when a one-fiber bi-directional optical port needs commissioning or when the optical port has error bits orits services are interrupted.

1.3.11.2 Testing the Mean Launched Power of a Two-Fiber Bi-Directional Optical PortWhen a two-fiber bi-directional optical port needs commissioning, or when the optical port haserror bits or its services are interrupted, the mean launched power of the port can be tested fordetermining whether the optical signal transmitter is normal.

1.3.11.3 Testing the Actual Input Power of a One-Fiber Bi-Directional Optical PortWhen a one-fiber bi-directional optical port needs commissioning, or when the optical port haserror bits or its services are interrupted, the actual input power (including the minimumsensitivity and minimum overload point) of the port can be tested for determining whether theoptical signal receiver is normal.

1.3.11.4 Testing the Actual Input Power of a Two-Fiber Bi-Directional Optical PortWhen a two-fiber bi-directional optical port needs commissioning, or when the optical port haserror bits or its services are interrupted, the actual input power (including the minimumsensitivity and minimum overload point) of the port can be tested for determining whether theoptical signal receiver is normal.

1.3.11.1 Testing the Mean Launched Power of a One-Fiber Bi-Directional OpticalPort

This topic describes how to check whether the optical signal transmitter is normal when a one-fiber bi-directional optical port needs commissioning or when the optical port has error bits orits services are interrupted.

Impact on System

When a one-fiber bi-directional optical port is under the mean launched power test, the opticalport cannot carry any service.

Tools, Meters, and Materialsl Optical power meter

l Patch cords with different connectors (selected according to the actual requirements)




Issue 03 (2010-01-28)

Precautions

DANGERTake precautions for personal safety. Do not look at the laser transmit port or the optical fiberconnector on the optical interface board without wearing protective glasses.

l Use the “dBm unit” of the optical power meter for the test.

l The optical fiber connector and the optical transceiver on the front panel of the opticalinterface board must be clean and properly connected.

l Use a patch cord as short as possible for the test. The length is generally within 1 m. It isrecommended that a new patch cord be used.

l Do not bend the optical fiber. Otherwise, the test result may be inaccurate.

Procedure

Step 1 Test the mean launched power of the one-fiber bi-directional optical port on the OLT side.

1. Remove the optical fiber from the port to be tested. Connect one end of the patch cord tothe port to be tested, and the other end to the optical power meter, as shown in Figure1-40.

Figure 1-40 Testing the mean launched power of the one-fiber bi-directional optical porton the OLT side

NOTEThe ports of the optical power meter may be of different specifications. Therefore, select a patch cordwith matched connectors.

2. Set the test wavelength of the optical power meter to be the same as the operatingwavelength of the port to be tested.

3. Observe the reading of the optical power meter. When the reading becomes stable, recordthe optical power value. The optical power at this point is the actual mean launched powerof the port.



1-65

4. Repeat steps b and c several times (more than three times as recommended), and measureand record the maximum and minimum values of the mean launched power. Check whetherthe tested mean launched power meets technical requirements.

NOTEYou can run the display port state command to query the mean launched power of the port. Whenthe bandwidth is high, the tested value is more accurate and stable. When the bandwidth is low, thetested value is not accurate and is not recommended for use.

Step 2 Test the mean launched power of the one-fiber bi-directional optical port on the ONT side.1. Set the ONT in the burst mode to work in the continuous mode through the OMCI channel.2. Disconnect the ONT from the ODN. Then, connect one end of the patch cord to the port

to be tested, and the other end to the optical power meter, as shown in Figure 1-41.

Figure 1-41 Testing the mean launched power of the one-fiber bi-directional optical porton the ONT side

NOTEThe ports of the optical power meter may be of different specifications. Therefore, select a patch cordwith matched connectors.

3. Set the test wavelength of the optical power meter to be the same as the operatingwavelength of the port to be tested.

4. Observe the reading of the optical power meter. When the reading becomes stable, recordthe optical power value. The optical power at this point is the actual mean launched powerof the port.

5. Repeat steps b and c several times (more than three times as recommended), and measureand record the maximum and minimum values of the mean launched power. Check whetherthe tested mean launched power meets technical requirements.

NOTEYou can run the display ont optical-info command to query the mean launched power of the port.When the bandwidth is high, the tested value is more accurate and stable. When the bandwidth islow, the tested value is not accurate and is not recommended for use.

----End

Resultl The tested mean launched power complies with the technical specifications of the optical

port. For technical specifications of an optical port, see "Performance specifications".l If the tested mean launched power does not comply with the technical specifications of the

optical port, contact the local Huawei technical support engineers to replace the opticaltransceiver. Then perform the test again.

Performance specificationsGPON Port




Issue 03 (2010-01-28)

Table 1-20 Specifications of the GPON port (Class B+)

Parameter Specification

Transmission rate Transmit (Tx): 2.488 Gbit/sReceive (Rx): 1.244 Gbit/s

Port type SC/PC

Maximum transmission distance 20 km

Cable type Single-mode optical fiber

Standard compliance ITU-T G.984.2 CLASS B+

Central wavelength Transmit (Tx): 1490 nmReceive (Rx): 1310 nm

Transmit optical power 1.5 dBm to 5.0 dBm

Extinction ratio 10 dB

Maximum receive sensitivity -28 dBm

Overload optical power -8 dBm

Table 1-21 Specifications of the GPON port (Class C+)



Port type SC/PC



Standard compliance ITU-T G.984.2 CLASS C+






P2P FE Port



1-67


Transmission rate 100 Mbit/s

Port type LC/PC


Cable type Optical fiber


Transmit optical power -15 dBm to -8 dBm

Extinction ratio 8.5 dB (min.)


Standard compliance ITU-T G.957

1.3.11.2 Testing the Mean Launched Power of a Two-Fiber Bi-Directional OpticalPort

When a two-fiber bi-directional optical port needs commissioning, or when the optical port haserror bits or its services are interrupted, the mean launched power of the port can be tested fordetermining whether the optical signal transmitter is normal.

Impact on System

When a two-fiber bi-directional optical port is under the mean launched power test, the opticalport cannot carry any service.

Tools, Meters, and Materialsl Optical power meter


Precautions


l Use the dBm unit of the optical power meter for the test.





Issue 03 (2010-01-28)



Procedure

Step 1 Connect one end of the patch cord to the Tx end of the port to be tested, and the other end to theoptical power meter, as shown in Figure 1-42.

Figure 1-42 Testing the mean launched power of the two-fiber bi-directional optical port

NOTEThe ports of the optical power meter may be of different specifications. Therefore, select a patch cord withmatched connectors.

Step 2 Set the test wavelength of the optical power meter to be the same as the operating wavelengthof the port to be tested.

Step 3 Observe the reading of the optical power meter. When the reading becomes stable, record theoptical power value. The optical power at this point is the actual mean launched power of theport.

Step 4 Repeat steps 2 and 3 several times (more than three times as recommended), and measure andrecord the maximum and minimum values of the mean launched power. Check whether thetested mean launched power meets technical requirements.

NOTEYou can run the display port ddm-info command to query the mean launched power of the port. Whenthe bandwidth is high, the tested value is more accurate and stable. When the bandwidth is low, the testedvalue is not accurate and is not recommended for use.

----End



1-69

Resultl The tested mean launched power complies with the technical specifications of the optical

port. For technical specifications of an optical port, see "Performance specifications".

l If the tested mean launched power does not comply with the technical specifications of theoptical port, contact the local Huawei technical support engineers to replace the opticaltransceiver. Then perform the test again.

Performance specifications

100Base-Fx Port


Transmission rate Full-duplex 100 Mbit/s

Port type LC/PC


Port mode Multi-mode Single-mode

Maximum transmissiondistance

2 km 15 km

Central wavelength 1310 nm 1310 nm

Transmit optical power -19 dBm to -14 dBm -15 dBm to -8 dBm

Extinction ratio 8 dB 8.2 dB

Maximum receive sensitivity -30 dBm -28 dBm

Standard compliance IEEE 802.3u

1000Base-Sx Port


Transmission rate 1.25 Gbit/s

Port type LC/PC


Maximum transmission distance 500 m over a 50 μm/125 μm multi-modeoptical fiber

Standard compliance IEEE 802.3z

Central wavelength 850 nm

Transmit optical power -9.5 dBm to 0 dBm

Extinction ratio 9.0 dB




Issue 03 (2010-01-28)



1000Base-Lx Port



Port type LC/PC

Optical fiber used and maximum transmissiondistance

10 km over a 9 μm/125 μm single-modeoptical fiber



Transmit optical power -9.0 dBm to -3.0 dBm



1.3.11.3 Testing the Actual Input Power of a One-Fiber Bi-Directional Optical PortWhen a one-fiber bi-directional optical port needs commissioning, or when the optical port haserror bits or its services are interrupted, the actual input power (including the minimumsensitivity and minimum overload point) of the port can be tested for determining whether theoptical signal receiver is normal.

Impact on SystemWhen a one-fiber bi-directional optical port is under the actual input power test, the optical portcannot carry any service.

Tools, Meters, and Materialsl Burst optical power meter

l Optical attenuator

l Multiplexer/Demultiplexer

l Data network performance analyzer




1-71

Precautions



l The optical power meter used for the test must be the burst optical power meter.




Procedure

Step 1 Test the actual input power (including the minimum sensitivity and minimum overload point)of the one-fiber bi-directional optical port on the OLT side.

1. Connect the devices according to Figure 1-43.

Figure 1-43 Testing the actual input power of the one-fiber bi-directional optical port onthe OLT side

2. Configure a data link on the device.

3. Set the test wavelength of the burst optical power meter to be the same as the operatingwavelength of the port to be tested.




Issue 03 (2010-01-28)

NOTEFor example, in the case of the GPON access, the operating wavelength should be set to 1310 nm.

4. Use the data network performance analyzer to transmit packets to the OLT.

5. Increase the optical attenuation value gradually. When a small number of packets are lost,decrease the optical attenuation value gradually. Stop adjusting the optical attenuation whenno packets are lost in a short period. Adjust the optical attenuation gently and slowly.

6. Read and record the input optical power (the actual minimum sensitivity) from the burstoptical power meter.

7. Decrease the optical attenuation value gradually. When a small number of packets are lost,increase the optical attenuation value gradually. Stop adjusting the optical attenuation whenno packets are lost in a short period. Adjust the optical attenuation gently and slowly.

8. Read and record the input optical power (the actual minimum overload point) from theburst optical power meter.

9. Repeat steps e–h (more than three times are recommended) and check whether the testedvalues meet the technical requirements.

NOTEThe actual input power (tested value, that is, the actual minimum sensitivity and the actual minimumoverload point) of the tested port should comply with the following: minimum sensitivity + 3 dB ≤actual input power ≤ minimum overload point – 5 dB.

Step 2 Test the actual input power (including the minimum sensitivity and minimum overload point)of the one-fiber bi-directional optical port on the ONT side.

1. Connect the devices according to Figure 1-44.

Figure 1-44 Testing the actual input power of the one-fiber bi-directional optical port onthe ONT side

2. Configure a data link on the device.

3. Set the test wavelength of the burst optical power meter to be the same as the operatingwavelength of the port to be tested.



1-73

NOTEFor example, in the case of the GPON access, the operating wavelength should be set to 1490 nm.

4. Use the data network performance analyzer to transmit packets to the OLT.5. Increase the optical attenuation value gradually. When a small number of packets are lost,

decrease the optical attenuation value gradually. Stop adjusting the optical attenuation whenno packets are lost in a short period. Adjust the optical attenuation gently and slowly.

6. Read and record the input optical power (the actual minimum sensitivity) from the burstoptical power meter.

7. Decrease the optical attenuation value gradually. When a small number of packets are lost,increase the optical attenuation value gradually. Stop adjusting the optical attenuation untilno packets are lost in a short period. Adjust the optical attenuation gently and slowly.

8. Read and record the input optical power (the actual minimum overload point) from theburst optical power meter.

9. Repeat steps e–h (more than three times are recommended) and check whether the testedvalue meets the technical requirements.

NOTEThe actual input power of the tested port should comply with the following: minimum sensitivity +3 dB ≤ actual input power ≤ minimum overload point – 5 dB.

----End

Resultl The tested actual input power complies with the technical specifications of the optical port.

For technical specifications of an optical port, see "Performance specifications".l If the tested actual input power does not comply with the technical specifications of the


Performance specificationsGPON Port

Table 1-22 Specifications of the GPON port (Class B+)



Port type SC/PC



Standard compliance ITU-T G.984.2 CLASS B+






Issue 03 (2010-01-28)




Table 1-23 Specifications of the GPON port (Class C+)



Port type SC/PC



Standard compliance ITU-T G.984.2 CLASS C+






P2P FE Port


Transmission rate 100 Mbit/s

Port type LC/PC




Transmit optical power -15 dBm to -8 dBm

Extinction ratio 8.5 dB (min.)




1-75

Standard compliance ITU-T G.957

Test metersl Burst optical power meter: It can test the upstream and downstream optical power

concurrently. During the test, the normal connection line need not be disconnected. Inexternal tests, this type of optical power meter is usually used. The burst optical powermeter usually tests the optical power at the ingress of optical signals and displays the resulton the panel. In fact, the power of optical signals attenuates when the signals enter and exitthe optical power meter, which affects the test result. In actual external tests, however, thisfactor can be ignored.

l Optical attenuator: It is a meter through which the attenuation of an optical line can bemanually adjusted at the precision of 0.05 dB. During the test, if the tested values are foundto fluctuate obviously, check the optical attenuator immediately. As shown by testexperience, after an optical attenuator is used for a long time, the tested values mayfluctuate, to a maximum range from -0.7 dB to +0.7 dB. With such a tolerance, a maximumof 1.4 dB tolerance may be caused to the test result.

l Multiplexer/Demultiplexer: It is a meter with the multiplexing and demultiplexingfunctions. To aid understanding, these two functions are displayed by two meter icons ina networking diagram.

1.3.11.4 Testing the Actual Input Power of a Two-Fiber Bi-Directional Optical PortWhen a two-fiber bi-directional optical port needs commissioning, or when the optical port haserror bits or its services are interrupted, the actual input power (including the minimumsensitivity and minimum overload point) of the port can be tested for determining whether theoptical signal receiver is normal.

Impact on SystemWhen a two-fiber bi-directional optical port is under the actual input power test, the optical portcannot carry any service.

Tools, Meters, and Materialsl Burst optical power meter

l Optical attenuator

l Data network performance analyzer


Precautions





Issue 03 (2010-01-28)


l The optical power meter used for the test must be the burst optical power meter.




ProcedureStep 1 Connect the devices according to Figure 1-45.

Figure 1-45 Testing the actual input power of the two-fiber bi-directional optical port

Step 2 Configure a data link on the device.

Step 3 Set the test wavelength of the burst optical power meter to be the same as the operatingwavelength of the port to be tested.

Step 4 Use the data network performance analyzer to transmit packets to the OLT.

Step 5 Increase the optical attenuation value gradually. When a small number of packets are lost,decrease the optical attenuation value gradually. Stop adjusting the optical attenuation when nopackets are lost in a short period. Adjust the optical attenuation gently and slowly.

Step 6 Read and record the input optical power (the actual minimum sensitivity) from the burst opticalpower meter.

Step 7 Decrease the optical attenuation value gradually. When a small number of packets are lost,increase the optical attenuation value gradually. Stop adjusting the optical attenuation when nopackets are lost in a short period. Adjust the optical attenuation gently and slowly.

Step 8 Read and record the input optical power (the actual minimum overload point) from the burstoptical power meter.

Step 9 Repeat steps 5–8 (more than three times are recommended) and check whether the tested inputoptical power meets the technical requirements.



1-77

NOTE

l You can run the display port ddm-info command to query the actual input power of the port. Whenthe bandwidth is high, the tested value is more accurate and stable. When the bandwidth is low, thetested value is not accurate and is not recommended for use.

l The actual input power (tested value, that is, the actual minimum sensitivity and the actual minimumoverload point) of the tested port should comply with the following: minimum sensitivity + 3 dB ≤actual input power ≤ minimum overload point – 5 dB.

----End

Resultl The tested actual input power complies with the technical specifications of the optical port.

For technical specifications of an optical port, see "Performance specifications".l If the tested actual input power does not comply with the technical specifications of the


Performance specifications

100Base-Fx Port


Transmission rate Full-duplex 100 Mbit/s

Port type LC/PC


Port mode Multi-mode Single-mode

Maximum transmissiondistance

2 km 15 km

Central wavelength 1310 nm 1310 nm

Transmit optical power -19 dBm to -14 dBm -15 dBm to -8 dBm

Extinction ratio 8 dB 8.2 dB

Maximum receive sensitivity -30 dBm -28 dBm

Standard compliance IEEE 802.3u

1000Base-Sx Port



Port type LC/PC





Issue 03 (2010-01-28)


Maximum transmission distance 500 m over a 50 μm/125 μm multi-modeoptical fiber



Transmit optical power -9.5 dBm to 0 dBm



1000Base-Lx Port



Port type LC/PC

Optical fiber used and maximum transmissiondistance

10 km over a 9 μm/125 μm single-modeoptical fiber



Transmit optical power -9.0 dBm to -3.0 dBm



Test metersl Burst optical power meter: It can test the upstream and downstream optical power

concurrently. During the test, the normal connection line need not be disconnected. Inexternal tests, this type of optical power meter is usually used. The burst optical powermeter usually tests the optical power at the ingress of optical signals and displays the resulton the panel. In fact, the power of optical signals attenuates when the signals enter and exitthe optical power meter, which affects the test result. In actual external tests, however, thisfactor can be ignored.

l Optical attenuator: It is a meter through which the attenuation of an optical line can bemanually adjusted at the precision of 0.05 dB. During the test, if the tested values are foundto fluctuate obviously, check the optical attenuator immediately. As shown by testexperience, after an optical attenuator is used for a long time, the tested values mayfluctuate, to a maximum range from -0.7 dB to 0.7 dB. With such a tolerance, a maximumof 1.4 dB tolerance may be caused to the test result.



1-79

l Multiplexer/Demultiplexer: It is a meter with the multiplexing and demultiplexingfunctions. To aid understanding, these two functions are displayed by two meter icons ina networking diagram.

1.3.12 Changing the System NameThis topic describes how to customize the useful system name to differentiate MA5600Ts. Thisfacilitates the management of the MA5600T.

Contextl By default, the device name is MA5600T.

l The system name takes effect immediately after change.

l After the system name is changed, the CLI prompt character changes to the new nameaccordingly.

ProcedureStep 1 Run the sysname command to set the system name.

----End

ResultThe CLI prompt character changes to the system name that is set after the command is executedsuccessfully.

ExampleTo name the first MA5600T at Shenzhen office in China shenzhen_MA5600T_A, do as follows:huawei(config)#sysname shenzhen_MA5600T_Ashenzhen_MA5600T_A(config)#

1.3.13 Configuring a System UserFor logging in to, configuring, and managing the MA5600T, system users of different attributesneed to be added. This topic describes how to add a system user and modify the user attributes.

1.3.13.1 Adding a System UserThis topic describes how to add system users of different attributes for logging in to, configuring,and managing the MA5600T. This facilitates the management of the MA5600T.

1.3.13.2 Modifying the System User AttributesThis topic describes how to modify the attributes of a system user, including the password, userprofile, authority, permitted reenter number, and appended information in the case that the userattributes are not consistent with the current data plan.

1.3.13.1 Adding a System UserThis topic describes how to add system users of different attributes for logging in to, configuring,and managing the MA5600T. This facilitates the management of the MA5600T.

PrerequisiteYou must have the administrator authority or higher authority.




Issue 03 (2010-01-28)

Contextl The super user and the administrator have the authority to add a user at a lower level, that

is:

– The super user can add an administrator, an operator, or a common user.

– The administrator can add only an operator or a common user.

l The user name must be unique, and cannot be all or online.

l The super user and the administrator can add multiple users consecutively. Up to 127 (total128 including the root user) users can be added to the system.

l The system supports up to 10 concurrently online terminal users.

When adding a user, you must configure the user attributes, including the user account, password,profile, authority, permitted reenter number, and appended information. Table 1-24 lists the userattributes.

Table 1-24 User attributes

User Attribute Description

Account An account is also called a user name and consists of 6-15 printablecharacters. The user name is unique in the system. It cannot contain anyspace and is case insensitive.

Password A password consists of 6-15 characters. It must contain at least one digitand one letter, and is case-sensitive.

User profile The name of a user profile consists of 1-15 printable characters. A userprofile includes the validity period of the user name, validity period ofthe password, login time, and logout time.

Authority Users are classified into three levels: common user, operator, andadministrator.NOTE

According to the operation authority, users of the MA5600T are classified intofour levels: common user, operator, administrator, and super user. The user at onelevel can add only the user at a lower level. The following lists the authority ofall users.

l Common users can perform basic system operations and simple queryoperations.

l Operators can configure the device and the services.

l For the administrator and the super user, they have the following similaritiesand differences:

l Similarities:

l Perform all configurations.

l Maintain and manage the device, user account, and user authority.

l Differences:

l Only one super user exists in the system; however, multipleadministrators can coexist in the system.

l The super user can add an administrator, but an administrator has noauthority to add the super user.



1-81

User Attribute Description

Permitted reenternumber

The permitted reenter number determines whether a user name can beused to log in to the system from several terminals at the same time. Thepermitted reenter number ranges from 0 to 4, and is generally set to 1.

Appendedinformation

Appended information is a type of additional information about the user.It consists of a string of 0-30 characters. It can be the telephone numberor the address of a user.

ProcedureStep 1 Run the terminal user name command to add a user that is consistent with the actual data plan.

Step 2 Run the display terminal user command to query the user information.

----End

ResultThe queried user information is the same as the actual data plan.

ExampleWith the administrator authority, to add a common user with the account as huawei, passwordas test01, user profile as the default root user profile, user level as Common User, permittedreenter number as 3, and appended information as user, do as follows:huawei(config)#terminal user name User Name(length<6,15>):huawei User Password(length<6,15>):test01//The password is not displayed on the console. Confirm Password(length<6,15>):test01//The password is not displayed on the console. User profile name(<=15 chars)[root]: User's Level: 1. Common User 2. Operator:1 Permitted Reenter Number(0--4):3 User's Appended Info(<=30 chars):user Adding user succeeds Repeat this operation? (y/n)[n]:n

huawei(config)#display terminal user name huawei---------------------------------------------------------------------------- Name Level Status Reenter Profile Append Num Info --------------------------------------------------------------------------- huawei User Offline 3 root user ----------------------------------------------------------------------------

1.3.13.2 Modifying the System User AttributesThis topic describes how to modify the attributes of a system user, including the password, userprofile, authority, permitted reenter number, and appended information in the case that the userattributes are not consistent with the current data plan.

PrerequisiteFor details about the user authority, see "Context".




Issue 03 (2010-01-28)

Context

Table 1-25 lists the user attributes that can be modified and the related restrictions.

Table 1-25 Modifying the user attributes

User Attribute Restriction

Password l The super user and the administrator can change their own passwordsand the passwords of users at lower levels. When changing thepassword of a user at a lower level, the super user and theadministrator need not input the old password.

l The common user and the operator can change only their ownpasswords, but they must input their old passwords for this purpose.

User profile l The super user and the administrator can modify the profiles boundto them and the profiles bound to users at lower levels.

l The user name and the password must meet the specificationsdescribed in the user profile to be bound. Otherwise, the bindingoperation fails.

Authority The super user and the administrator can modify the authority of usersat lower levels. In addition, the super user and the administrator canmodify the user authority only to a level lower than them.

Permitted reenternumber

l The super user and the administrator can change the permitted reenternumber of a user at a lower level.

l The permitted reenter number of the super user cannot be changed.

Appendedinformation

l The super user and the administrator can modify their own appendedinformation and the appended information about users at lower levels.

l The common user and the operator can modify only their ownappended information.

Procedure

Step 1 Modify the system user attributes.

NOTEBefore modifying the user attributes, run the display terminal user command to query the user attributesto be modified.

l Run the terminal user password command to change the password of a user.

The password of a user consists of 6-15 characters, in which at least one digit and one lettermust be contained. The password is case sensitive.

l Run the terminal user user-profile command to modify the profile bound to a user.

l Run the terminal user level command to modify the authority of a user.

l Run the terminal user reenter command to change the permitted reenter number of a user.

l Run the terminal user apdinfo command to modify the appended information about auser.



1-83

When the system has any problem, you can contact the user after querying the user appendedinformation. It is recommended that the user appended information be modified into theinformation that has the actual meaning, such as the contact means and the user address.

Step 2 Check the user information.Run the display terminal user command to query the user information.

----End

ResultThe queried user information is consistent with the user attributes that are modified, and loginto the MA5600T by using the original user name and password is successful.

Example

To modify the attributes of user huawei, including changing the password to test02, user profileto operator profile, user level to operator, permitted reenter number to 4, and appendedinformation to operator, do as follows:

huawei(config)#terminal user password User Name(<=15 chars):huawei New Password(length<6,15>):test02//The password is not displayed on the console. Confirm Password(length<6,15>):test02//The password is not displayed on the console. Information takes effect Repeat this operation? (y/n)[n]:n

huawei(config)#terminal user user-profile User Name(<=15 chars):huawei Permitted user-profile[root]:operator Confirm user-profile:operator Configuration will take effect when the user logs on next time. Repeat this operation? (y/n)[n]:n

huawei(config)#terminal user level User Name(<=15 chars):huawei 1. Common User 2. Operator: User's Level:2 Confirm Level:2 Information will take effect when this user logs on next time Repeat this operation? (y/n)[n]:n

huawei(config)#terminal user reenter User Name(<=15 chars):huawei Permitted Reenter Number(0--4):4 Confirm Reenter Number(0--4):4 Information will take effect when this user logs on next time Repeat this operation? (y/n)[n]:n

huawei(config)#terminal user apdinfo User Name(<=15 chars):huawei User's Appended Info(<=30 chars):operator Information takes effect Repeat this operation? (y/n)[n]:n

huawei(config)#display terminal user name huawei ---------------------------------------------------------------------------- Name Level Status Reenter Profile Append Num Info --------------------------------------------------------------------------- huawei Operator Offline 4 operator operator ----------------------------------------------------------------------------




Issue 03 (2010-01-28)

1.3.14 Configuring the System TimeThis topic describes how to Configure the system time, time zone, time stamp, and start/endtime of the daylight saving time (DST) of the MA5600T to ensure that they are consistent withthose in the actual condition.

Procedure

Step 1 Configure the system time.Run the display time command to query the current system time. If the system time is consistentwith the local standard time, you need not change it. If the system time is inconsistent with thelocal standard time, run the time command to change the system time.

Step 2 Configure the system time zone.Run the display timezone command to query the current system time zone. If the system timezone is consistent with the local standard time zone, you need not change it. If the system timezone is inconsistent with the local standard time zone, run the timezone command to change thesystem time zone.

NOTEThe system time zone include the eastern time zone and the western time zone. "GMT+" indicates theeastern time zone, that is, the local time is ahead of the Greenwich time. "GMT-" indicates the westerntime zone, that is, the local time is behind the Greenwich time.

Step 3 Configure the system time stamp.Run the display time time-stamp command to query the time stamp between the NMS and theNE, namely the displayed time format of the SNMP interface. If the system time stamp isconsistent with the actual data plan, you need not change it. If the system time stamp isinconsistent with the actual data plan, run the time time-stamp command to change the systemtime stamp.

NOTEThe time type of the SNMP interface between the NMS and the NE are categorized as UTC time and NElocal time. By default, the time type is the NE local time.

Step 4 Configure the start/end time of the DST.Run the display time dst command to query the current start/end time of the DST of the system.If the start/end time of the DST is consistent with the actual start/end time of the DST, you neednot change it. If the start/end time of the DST is inconsistent with the actual start/end time ofthe DST, run the time dst command to change the start/end time of the DST.

----End

ResultThe system time, time zone, time stamp, and start/end time of the DST are consistent with thosein the actual condition.

ExampleTo set the current time of the system to 15:18:00, September 17, 2009, do as follows:huawei#time{ date<D><yyyy-mm-dd>|dst<K>|time-stamp<K>|time<T><hh:mm:ss> }:2009-09-17{ <cr>|time<T><hh:mm:ss> }:15:18:00

Command:



1-85

time 2009-09-17 15:18:00

To set GMT+8:00 as the current time zone of the system, do as follows:huawei#timezone{ GMT<E><GMT+,GMT-> }:GMT+{ time<hh:mm><S><Length 3-5> }:8:00

Command: timezone GMT+ 8:00

To set the time stamp between the NMS and the NE to use the UTC time, do as follows:huawei#time time-stamp{ local<K>|utc<K> }:utc

Command: time time-stamp utc

To set the DST with start time of 00:00:00 in May 1, end time of 00:00:00 in Sep 30th, and adjusttime of 1:00, do as follows:huawei#time dst start{ start-date<MM-DD><S><Length 3-5>|start-month<1,12> }:5-1{ end<K>|start-time<T><hh:mm:ss> }:00:00:00{ end<K> }:end{ end-date<MM-DD><S><Length 3-5> }:9-30{ <cr>|adjust<K>|end-time<T><hh:mm:ss> }:00:00:00{ <cr>|adjust<K> }:adjust{ time<hh:mm><S><Length 3-5> }:1:00

Command: time dst start 5-1 00:00:00 end 9-30 00:00:00 adjust 1:00

1.3.15 Commissioning the EMUThe MA5600T monitors various environment parameters (including the temperature, humidity,and voltage of the power supply) to ensure that the MA5600T can work stably in a properenvironment. This topic describes how to commission the environment monitoring unit (EMU).

1.3.15.1 Commissioning the EMU_ESCThis topic describes how to commission the H801ESC board to ensure that it monitors theenvironmental conditions of the device according to the actual conditions.

1.3.15.2 Commissioning the EMU_FANThis topic describes how to commission the FAN to ensure that it monitors the environmentalconditions of the fans of the device according to the actual conditions.

1.3.15.1 Commissioning the EMU_ESC

This topic describes how to commission the H801ESC board to ensure that it monitors theenvironmental conditions of the device according to the actual conditions.

Context

ESC stands for the environment and power monitoring board. The H801ESC board monitorsenvironment parameters such as temperature, humidity, smoke, water, fire, voltage, and powersupply through various sensors.

When commissioning the H801ESC board, pay attention to the following points:




Issue 03 (2010-01-28)

l The EMU sub-nodes are numbered from 0 to 31.

l When the system is configured with multiple EMUs simultaneously, make sure that thesub-nodes do not conflict with each other.

Table 1-26 lists the default configuration of the H801ESC board.

Table 1-26 Default configuration of the H801ESC board

Parameter Default Value

Sub-node 15

Analog parameters ESC analog parameter IDs:l 0: allocated to the temperature sensor by default (unable to be

changed by the user).l 1-4: allocated to the voltage sensor by default.

– 1 indicates -48 V input of channel 0.




l 5-8: user-defined analog parameters allocated to other extendedanalog sensors, such as the humidity sensor.

Upper and lower alarm thresholdsl Temperature: 5°C to 55°C

l Humidity: 0% RH to 80% RH

Digital parameters ESC digital parameter IDsl Allocated by default (unable to be changed by the user)

– 0: MDF

– 1: door status sensor 0

– 9: water

– 10-13: lightning arresters 0-3

– 14-15: switches 11 and 12




– 22: external sensor power

l User-defined IDs– 2-8: allocated to other extended digital sensors.



1-87


Definition of user-defined alarm indexes1: AC voltage; 2: AC switch; 3: battery voltage; 4: battery fuse; 5: loadfuse; 6: rectifier unit; 7: secondary power supply; 8: door status of thecabinet; 9: door status of the equipment room; 10: window; 11: theft;12: MDF; 13: fan; 14: fire; 15: smoke; 16: water; 17: diesel; 18:abnormal smell 19: air conditioner; 20: lightning arrester; 21: user-defined alarms of digital parameters

Procedure

Step 1 Set the DIP switch of the sub-node for the H801ESC board. By default, the sub-node ID is 15.

NOTE

The H801ESC board communicates with the MA5600T in the master node and sub-node mode. Therefore,the DIP switch of the sub-node for the H801ESC board must be consistent with that for the MA5600T. Fordetails about how to configure the DIP switches of the H801ESC board, see the Description of DIP Switchesin 1.3.1.1 Checking the Settings of DIP Switches on the ESC Board.

Step 2 Insert the H801ESC board into the corresponding slot of the PDU, and make sure that theMA5600T and the H801ESC board are connected through the RS-485 serial port cable.

NOTEWhen the device is delivered, the H801ESC board is correctly connected to the shelf. The connection neednot be changed for the device commissioning. The COM2 of the H801ESC board is connected to the ESCof the MA5600T. In this case, the H801ESC collects and reports the environment information to the controlboard.

Step 3 Run the emu add command to add an H801ESC board. By default, the sub-node ID is 31.

Step 4 Run the interface emu command to enter the H801ESC mode.

Step 5 Run the esc analog command to configure the ESC analog parameters. By default, the upperand lower alarm thresholds of the temperature are 55°C and 5°C respectively; the upper andlower alarm thresholds of the humidity are 80% RH and 0% RH respectively.

Step 6 Run the esc digital command to set the ESC digital parameters.

Step 7 Run the save command to save the data.

----End

Resultl In step 2, you can confirm that the RUN ALM LED on the H801ESC board is orange and

blinks repeatedly once in every 300 ms, which indicates that the board is registering.l After a while, the RUN ALM LED on the H801ESC board turns orange and is on for 1s

and off for 1s repeatedly, which indicates that an alarm is generated. Certain EMUparameters have the initial configurations (namely, default alarm thresholds); therefore, ifany parameter reaches the threshold, an alarm is generated.

l After the configuration, the RUN ALM LED on the H801ESC board turns green and is onfor 1s and off for 1s repeatedly, which indicates that the H801ESC board monitors theenvironment normally.




Issue 03 (2010-01-28)

l In the H801ESC mode, run the display esc system parameter command to check whetherthe ESC information is the same as the data plan.

l Close doors of the cabinet, and query alarms. Ensure that no alarm of the monitoringparameters is generated.

ExampleAdd an H801ESC board, set the analog and digital parameters of the H801ESC board, and savethe data.

To set the ESC analog parameters (set the user-defined analog parameter ID to 5, upper alarmthreshold to 70, lower alarm threshold to -30, analog parameter name to Temperature_1 withthe unit of C) and the ESC digital parameters (set the user-defined digital parameter ID to 7, setthe door status alarm whose ID is 8, set the alarm name to Door_1 and the available level of thealarm to high level, do as follows:huawei(config)#emu add 0 H801ESC 0 15 H801ESChuawei(config)#interface emu 0huawei(config-if-h801esc-0)#esc analog 5 alarm-upper-limit 70 alarm-lower-limit-30 name Temperature_1 unit Chuawei(config-if-h801esc-0)#esc digital 7 digital-alarm 8 name Door_1 available-level high-levelhuawei(config-if-h801esc-0)#display esc system parameter

EMU ID: 0 ESC system parameter ---------------------------------------------------------------------------- AnalogID Name AlmUpper AlmLower TestUpper TestLower Unit Type 0 Temperature 55 5 127 -128 C Voltage 1 Input_-48V_0 72 38 127 -128 Volt Voltage 2 Input_-48V_1 72 38 127 -128 Volt Voltage 3 Input_-48V_2 72 38 127 -128 Volt Voltage 4 Input_-48V_3 72 38 127 -128 Volt Voltage 5 Temperature_1 70 -30 127 -128 C Voltage 6 - 127 -128 127 -128 - Voltage 7 - 127 -128 127 -128 - Voltage 8 - 127 -128 127 -128 - Voltage ---------------------------------------------------------------------------- DigitalID Name Level |DigitalID Name Level 0 Wiring 1 | 1 Door0 0 2 - 1 | 3 - 1 4 - 1 | 5 - 1 6 - 1 | 7 Door_1 1 8 - 1 | 9 Water_Alarm 1 10 Arrester 0 0 | 11 Arrester 1 0 12 Arrester 2 0 | 13 Arrester 3 0 14 SW11 0 | 15 SW12 0 16 SW21 0 | 17 SW22 0 18 SW31 0 | 19 SW32 0 20 SW41 0 | 21 SW42 0 22 Outer Sensor Power 0 ----------------------------------------------------------------------------

1.3.15.2 Commissioning the EMU_FANThis topic describes how to commission the FAN to ensure that it monitors the environmentalconditions of the fans of the device according to the actual conditions.

ContextNOTEWhen the device is delivered, the EMU_FAN is correctly connected to the shelf. The connection need notbe changed for the device commissioning. In certain cases, if the EMU needs to be configured in othershelves, reconnect the EMU. For details, see this topic.



1-89

The FAN is used to monitor the running status of the fans and to set the fan rotation speedaccording to actual conditions to ensure the normal heat dissipation of the device.

When commissioning the FAN, pay attention to the following points:l The EMU sub-nodes are numbered from 0 to 31.

l When the system is configured with multiple EMUs simultaneously, make sure that thesub-nodes do not conflict with each other.

l It is recommended that you use the auto mode as the fan speed adjustment mode.

Table 1-27 lists the default configuration of the FAN.

Table 1-27 Default configuration of the FAN


Sub-node 1

Fan speedadjustment mode

Automatic

Whether to reportthe fan alarm

Permit

Procedure

Step 1 Set the DIP switches of the sub-nodes for the FAN. By default, the sub-node ID is 1.

NOTE

The FAN communicates with the MA5600T in the master node and sub-node mode. Therefore, the DIPswitches of the sub-nodes for the FAN must be consistent with those for the MA5600T. For details abouthow to configure the DIP switches of the FAN, see the Description of DIP Switches in 1.3.1.2 Checkingthe Settings of DIP Switches on the Fan Monitoring Board.

Step 2 Insert the fan tray into the corresponding slot of the service shelf.

Step 3 Run the emu add command to add a FAN. By default, the sub-node ID is 1.

Step 4 Run the interface emu command to enter the FAN mode.

Step 5 Run the fan speed mode command to set the fan speed adjustment mode. By default, the fanspeed adjustment mode is automatic.

NOTE

When the fan speed adjustment mode is the manual mode, you can run the fan speed adjust command toset the fan speed. The speed level can be 0, 1, 2, 3, 4, or 5. Here, 5 stands for the highest level, and 0 standsfor the lowest level.

Step 6 Run the fan alarmset command to configure the fan alarm reporting function. The fan alarmsare read temperature failure alarm, fan block alarm, over temperature alarm, and power faultalarm. By default, the fan alarm reporting is permitted.


----End




Issue 03 (2010-01-28)

Resultl In the FAN mode, run the display fan system parameter command to query the parameter

configuration of the fan tray and ensure that the configuration is the same as the data plan.l In the FAN mode, run the display fan environment info command to query the running

status of the fan tray and ensure that it is the same as the data plan.l In the FAN mode, run the display fan alarm command to query the alarm information

reported by the fan tray. The status of all the fan alarms is normal.

ExampleTo add a FAN, and adopt the default settings for the speed adjustment mode and alarm function,do as follows:huawei(config)#emu add 0 FAN 0 1 FAN

huawei(config)#interface emu 0

huawei(config-if-fan-0)#display fan system parameter

EMU ID: 0 FAN configration parameter: ---------------------------------------------------------------------------- FAN timing mode: Auto timing by temperature ---------------------------------------------------------------------------- Alarm_name Permit/Forbid Read temperature fault Permit Fan block Permit Temperature high Permit Power fault Permit ----------------------------------------------------------------------------

1.3.16 Checking the Configuration of the Auto-Save FunctionThis topic describes how to check the configuration of the auto-save function on theMA5600T, which prevents data loss in case of unexpected restart.

ContextThe MA5600T supports two auto-save modes. One mode is that the data is automatically savedat certain intervals by running the autosave interval command (that is, auto-save at intervals),and the other mode is that the data is automatically saved at preset time by running the autosavetime command (that is, auto-save at preset time). These two auto-save modes conflict with eachother, and the auto-save at intervals is recommended.

Saving data frequently affects the system performance. It is recommended that you set the auto-save interval to 1440 minutes or longer.

You can run the save command to save the system data in real time regardless of whether theauto-save function is enabled.

Table 1-28 lists the default configuration of the auto-save function.



1-91

Table 1-28 Default configuration of the auto-save function


Parameters of auto-save at intervals l Switch of auto-save at intervals: off

l Auto-save interval: 1440 minutes

l Interval of changing configuration data: 30minutes

Parameters of auto-save at preset time l Switch of auto-save at preset time: off

l Auto-save time: 00:00:00

Procedure

Step 1 Run the display autosave configuration command to query the status of the auto-save function.If the auto-save function is disabled, proceed to step 2. If the auto-save function is enabled, goto step 3. By default, the auto-save function is disabled.

Step 2 Enable the function of auto-save.

l If the auto-save at intervals is selected, run the autosave interval on command to enable thefunction of auto-save at intervals.

l If the auto-save at preset time is selected, run the autosave time on command to enable thefunction of auto-save at preset time.

NOTEAuto-save at intervals and auto-save at preset time conflict with each other. Therefore, before enabling anauto-save function, you must run the autosave time off or autosave interval off command to disable theother auto-save function.

Step 3 Configure the auto-save parameters.

l If the auto-save at intervals is selected, run the autosave interval command to set the auto-save interval. By default, the auto-save interval is 1440 minutes, and the interval of savingthe changed configuration data is 30 minutes.

l If the auto-save at preset time is selected, run the autosave time command to set the auto-save time. By default, the auto-save time is 00:00:00.

Step 4 Configure the type of the file.Run the autosave type command to select the type of a file that is saved automatically. Filesthat can be automatically saved include three types: data files, configuration files, database filesand configuration files.

Step 5 Run the display autosave configuration command to check whether the configuration of theauto-save function is the same as the actual data plan.

----End

ResultThe configuration of the auto-save function is the same as the actual data plan.




Issue 03 (2010-01-28)

ExampleTo enable the function of auto-save at intervals, and set the interval to 1600 minutes, do asfollows:huawei#autosave interval on System autosave interval switch: on Autosave interval: 1440 minutes Autosave type: data

System autosave modified configuration switch: on Autosave interval: 30 minutes Autosave type: data

huawei#autosave interval{ configuration<K>|time<10,10080>|value<E><on,off> }:1600

Command: autosave interval 1600 System autosave interval switch: on Autosave interval: 1600 minutes Autosave type: data

1.3.17 Saving the DataThis topic describes how to save the data in the flash memory to prevent data loss in case ofunexpected restart.

Precautionsl During the command running, the system displays the corresponding prompt. Do not power

off or restart the system before the saving process is complete. Otherwise, the data in theflash memory may be damaged.

l Saving the data frequently affects the system performance.

ProcedureStep 1 In the privilege mode, run the save command to save the database file and the configuration file

of the current system in the flash memory.

----End

ResultWhen the data is saved successfully, the system displays the corresponding prompt.huawei(config)# 1[2009-07-30 11:34:07]:The data of 9 slot's main control board is savedcompletely

ExampleTo save the database file and the configuration file to the flash memory manually, do as follows:huawei#save{ <cr>|configuration<K>|data<K> }:

Command: save

huawei# It will take several minutes to save configuration file, please wait...



1-93

huawei# Configuration file had been saved successfully Note: The configuration file will take effect after being activated

huawei# The data is being saved, please wait a moment...

1.3.18 Backing Up System FilesWhen the first deployment or upgrade is complete, you need to back up the database file andthe configuration file so that the system can be easily recovered in case of a fault.

PrerequisiteIf the maintenance Ethernet port is used to back up the system file, ensure that:l The Ethernet port of the maintenance terminal must be connected to the maintenance

Ethernet port on the MA5600T through a crossover cable. In addition, the IP address of themaintenance terminal and the IP address of the maintenance Ethernet port on the devicemust be in the same subnet.

l The application program that is used for backing up the system file is installed on themaintenance terminal, such as the TFTP, SFTP, or FTP program. In this topic, the TFTPprogram is considered as an example.

Procedure

Step 1 Run the TFTP program on the maintenance terminal, and set the path for saving the backup files.By default, the backup files are saved to the installation path of the TFTP software.

NOTEThe system supports a system backup through either the serial port or the maintenance Ethernet port. Thebackup through the serial port uses the Xmodem protocol, and the backup through the maintenance Ethernetport uses the TFTP, SFTP, or FTP protocol. For details about the configuration of Xmodem/TFTP/SFTP/FTP, see 1.6.2 Configuring the File Transfer Mode.

Step 2 In the privilege mode, run the save command to save the data.

Step 3 In the privilege mode, run the backup data command to back up the database file.

Step 4 In the privilege mode, run the backup configuration command to back up the configurationfile.

----End

ResultAfter the backup is completed, you can locate the files backed up in the path that you set.

Example

To back up the database file to the TFTP server (IP address: 10.10.1.2) through TFTP, and namethe file 2009070101.txt, do as follows:huawei#backup data tftp 10.10.1.2 2009070101.txt

To back up the configuration file to the TFTP server (IP address: 10.10.1.2) through TFTP, andname the file 2009070102.txt, do as follows:huawei#backup configuration tftp 10.10.1.2 2009070102.txt




Issue 03 (2010-01-28)

1.4 Interconnection CommissioningThe MA5600T provides multiple interfaces for interconnection. This topic describes theinterconnection commissioning of the MA5600T.

1.4.1 Commissioning the Interconnection with the NMSThe MA5600T provides the function of interconnecting with the network management system,with which the administrator can maintain and manage the MA5600T through the NMS. Thistopic considers the iManager N2000 BMS Network Management System (hereinafter referredto as the N2000 BMS) as an example to describe how to perform the interconnectioncommissioning between the N2000 BMS and the MA5600T in the inband mode and the outbandmode.

1.4.2 Commissioning the Interconnection with the BRASThis topic describes how to check whether the MA5600T can normally communicate with theBRAS. Working with the BRAS, the MA5600T can implement the authentication, accounting,and authorization (AAA) service.

1.4.3 Commissioning the Interconnection with the RouterThis topic describes how to check whether the MA5600T can normally communicate with therouter and whether the MA5600T can access the upper-layer device through the router.

1.4.4 Commissioning the Management Channel Between the OLT and the GPON MDU(Distributed-Mode)This topic describes how to commission the management channel between the MA5600T andthe GPON MDU to ensure that you can log in to the GPON MDU through the MA5600T at theCO to remotely maintain and manage the GPON MDU.

1.4.5 Commissioning the Management Channel Between the OLT and the GPON ONT(Distributed-Mode)This topic describes how to commission the management channel between the MA5600T andthe GPON ONT to ensure that you can log in to the GPON ONT through the MA5600T at theCO to remotely maintain and manage the GPON ONT.

1.4.6 Commissioning the Management Channel Between the OLT and the GPON MDU(Profile-mode)This topic describes how to commission the management channel between the MA5600T andthe GPON MDU to ensure that you can log in to the GPON MDU through the MA5600T at theCO to remotely maintain and manage the GPON MDU.

1.4.7 Commissioning the Management Channel Between the OLT and the GPON ONT(Profile-mode)This topic describes how to commission the GPON OLT to ensure that the service configurationand centralized management of the GPON ONTs are performed on the GPON OLT through theONT Management and Control Interface (OMCI) protocol.

1.4.1 Commissioning the Interconnection with the NMSThe MA5600T provides the function of interconnecting with the network management system,with which the administrator can maintain and manage the MA5600T through the NMS. Thistopic considers the iManager N2000 BMS Network Management System (hereinafter referredto as the N2000 BMS) as an example to describe how to perform the interconnectioncommissioning between the N2000 BMS and the MA5600T in the inband mode and the outbandmode.



1-95

1.4.1.1 Commissioning Outband Network Management (SNMP V1&V2)This topic describes how to implement the outband network management on the MA5600Tthrough the local maintenance Ethernet port (outband network management port). This enablesthe N2000 BMS to maintain the MA5600T through this management channel. In the outbandnetwork management mode, a non-service channel is used to transmit the managementinformation. With the use of the non-service channel, the management channel is separated fromthe service channel, which is more reliable than in the inband network management mode.

1.4.1.2 Commissioning Outband Management (SNMP V3)This topic describes how to implement the outband network management on the MA5600Tthrough the local maintenance Ethernet port (outband network management port). This enablesthe N2000 BMS to maintain the MA5600T through this management channel. In the outbandnetwork management mode, a non-service channel is used to transmit the managementinformation. With the use of the non-service channel, the management channel is separated fromthe service channel, which is more reliable than in the inband network management mode.

1.4.1.3 Commissioning Inband Management (SNMP V1&V2)This topic describes how to implement the inband network management on the MA5600Tthrough the upstream port (inband network management port). This enables the N2000 BMS tomaintain the MA5600T through this management channel. In the inband network managementmode, the service channel of the device is used to transmit the management information. Thenetwork is flexible and requires no additional devices, which helps save the cost for carriers.This network, however, is difficult to maintain.

1.4.1.4 Commissioning Inband Network Management (SNMP V3)This topic describes how to implement the inband network management on the MA5600Tthrough the upstream port (inband network management port). This enables the N2000 BMS tomaintain the MA5600T through this management channel. In the inband network managementmode, the service channel of the device is used to transmit the management information. Thenetwork is flexible and requires no additional devices, which helps save the cost for carriers.This network, however, is difficult to maintain.

1.4.1.1 Commissioning Outband Network Management (SNMP V1&V2)This topic describes how to implement the outband network management on the MA5600Tthrough the local maintenance Ethernet port (outband network management port). This enablesthe N2000 BMS to maintain the MA5600T through this management channel. In the outbandnetwork management mode, a non-service channel is used to transmit the managementinformation. With the use of the non-service channel, the management channel is separated fromthe service channel, which is more reliable than in the inband network management mode.

Service RequirementsIn the network as shown in Figure 1-46, the service requirements are as follows:l The MA5600T provides the outband network management channel through the local

maintenance Ethernet port.l A static route is used between the MA5600T and the N2000 BMS.




Issue 03 (2010-01-28)

Figure 1-46 Example network for the outband network management

Figure 1-47 shows the flowchart for commissioning the outband network management on thedevice.

Figure 1-47 Flowchart for commissioning the outband network management on the device



1-97

Procedurel Commission the outband network management on the device.

1. Configure the IP address of the maintenance Ethernet port.The IP address of the local maintenance Ethernet port (outband network managementport) of the MA5600T is 10.50.1.10.

NOTEBy default, the IP address of the maintenance network port (ETH port on the control board) is10.11.104.2, and the subnet mask is 255.255.255.0.

huawei(config)#interface meth 0huawei(config-if-meth0)#ip address 10.50.1.10 255.255.255.0huawei(config-if-meth0)#quit

2. Add a route for the outband network management.Use the static route. The destination IP address is 10.10.1.0/24 (the network segmentto which the N2000 BMS belongs), and the gateway IP address is 10.50.1.1 (the IPaddress of the gateway of the MA5600T).huawei(config)#ip route-static 10.10.1.0 24 10.50.1.1

3. Set the SNMP parameters.

(1) Configure the community name and the access authority.The read community name is public, and the write community name isprivate.

NOTEThe configurations of the read community name and the write community name must bethe same as the configurations on the N2000 BMS.

huawei(config)#snmp-agent community read publichuawei(config)#snmp-agent community write private

(2) (Optional) Set the ID and the contact means of the administrator.The contact means of the administrator is HW-075528780808.huawei(config)#snmp-agent sys-info contact HW-075528780808

(3) (Optional) Set the location of the device.The location of the device is Shenzhen_China.huawei(config)#snmp-agent sys-info location Shenzhen_China

(4) Set the SNMP version.– The SNMP version is SNMP V1.

huawei(config)#snmp-agent sys-info version v1– The SNMP version is SNMP V2.

huawei(config)#snmp-agent sys-info version v2c–

NOTEThe SNMP version must be the same as the SNMP version set on the N2000 BMS.

4. Enable the function of sending traps.On the MA5600T, enable the function of sending traps to the N2000 BMS.huawei(config)#snmp-agent trap enable standard

5. Configure the IP address of the destination host for the traps.– When the SNMP V1 is used, the host name is huawei, the IP address of the host

is 10.10.1.10 (IP address of the N2000 BMS), the trap parameter name is ABC,SNMP version is V1, and the parameter security name is private (the parametersecurity name is the SNMP community name).




Issue 03 (2010-01-28)

huawei(config)#snmp-agent target-host trap-hostname huawei address 10.10.1.10 trap-paramsname ABChuawei(config)#snmp-agent target-host trap-paramsname huawei v1 securityname private

– When the SNMP V2 is used, the host name is huawei, the IP address of the hostis 10.10.1.10 (IP address of the N2000 BMS), the trap parameter name is ABC,SNMP version is V2, and the parameter security name is private (the parametersecurity name is the SNMP community name).huawei(config)#snmp-agent target-host trap-hostname huawei address 10.10.1.10 trap-paramsname ABChuawei(config)#snmp-agent target-host trap-paramsname huawei v2c securityname private

6. Set the IP address of the maintenance Ethernet port as the source IP address for sendingtraps.Set the SNMP packets to be forwarded from the maintenance Ethernet port of theMA5600T. That is, the source address of the traps is meth 0.huawei(config)#snmp-agent trap source meth 0

7. Save the data.huawei(config)#save

l Commission the outband network management on the N2000 BMS.1. Configure the gateway of the route from the N2000 BMS to network segment

10.50.1.0/24 to 10.10.1.1.– In the Solaris OS, do as follows:

Run the route add 10.50.1.0 10.10.1.1 command to add a route.Run the netstat -r command to query the information about the current routingtable.

– In the Windows OS, do as follows:Run the route add 10.50.1.0 mask 255.255.255.0 10.10.1.1 command to add aroute.Run the route print command to query the information about the current routingtable.NOTE

If the IP address of the outband network management port and the IP address of the N2000BMS are in the same network segment, you need not configure the routing information.

2. Log in to the N2000 BMS.3. Set the SNMP parameters. A default SNMP profile exists in the system. Use the default

profile in this service. If a new profile is required, do as follows:

(1) On the Welcome main interface, click to display the SystemManagement interface.

(2) Choose System > Default Access Protocol Parameters from the main menu.The Default Access Protocol Parameters interface is displayed.

(3) On the Default Access Protocol Parameters interface, click the SNMPv1Parameters (when the SNMP V1 is used) or SNMPv2 Parameters (when theSNMP V2 is used) tab, and then click Add.

(4) – When the SNMP V1 is used, Set the SNMP parameters in the lower pane, asshown in the following figure (the other parameters except Profile name usethe default settings).



1-99

Figure 1-48 Set the SNMP parameters

– When the SNMP V2 is used, Set the SNMP parameters in the lower pane, as

shown in the following figure (the other parameters except Profile name usethe default settings).


NOTE

The configurations of Get Community and Set Community are the same as theconfigurations on the MA5600T.

(5) Click OK.4. Close the Default Access Protocol Parameters interface, return to the Welcome

main interface, and then click to display the Network Maintenance interface.5. Add a device.

(1) In the topology view, right-click, and choose New > Equipment from theshortcut menu.

(2) – When the SNMP V1 is used, In the dialog box that is displayed, set therequired parameters, as shown in the following figure.IP Address is 10.50.1.10, Device Name is huawei, and SNMPParameters is SNMP V1:default.




Issue 03 (2010-01-28)

Figure 1-50 Add device

– When the SNMP V2 is used, In the dialog box that is displayed, set the

required parameters, as shown in the following figure.IP Address is 10.50.1.10, Device Name is huawei, and SNMPParameters is SNMP V2:default.



1-101


(3) Click OK. The system displays a message indicating that several seconds or some

10 minutes are required for uploading the device data. After the related data isread, the system automatically refreshes and displays the device icon.

----End

ResultYou can maintain and manage the MA5600T through the N2000 BMS.

Configuration FileThe following describes the script for commissioning the outband network management on thedevice (SNMP V1).interface meth 0ip address 10.50.1.10 255.255.255.0

quitip route-static 10.10.1.0 24 10.50.1.1

snmp-agent community read public

snmp-agent community write private

snmp-agent sys-info contact HW-075528780808snmp-agent sys-info location Shenzhen_Chinasnmp-agent sys-info version v1

snmp-agent trap enable standardsnmp-agent target-host trap-hostname huawei address 10.10.1.10 trap-paramsname ABCsnmp-agent target-host trap-paramsname huawei v1 securityname private




Issue 03 (2010-01-28)

snmp-agent trap source meth 0

save

The following describes the script for commissioning the outband network management on thedevice (SNMP V2).

interface meth 0ip address 10.50.1.10 255.255.255.0




snmp-agent sys-info contact HW-075528780808snmp-agent sys-info location Shenzhen_Chinasnmp-agent sys-info version v2c

snmp-agent trap enable standardsnmp-agent target-host trap-hostname huawei address 10.10.1.10 trap-paramsname ABCsnmp-agent target-host trap-paramsname huawei v2c securityname private


save

1.4.1.2 Commissioning Outband Management (SNMP V3)This topic describes how to implement the outband network management on the MA5600Tthrough the local maintenance Ethernet port (outband network management port). This enablesthe N2000 BMS to maintain the MA5600T through this management channel. In the outbandnetwork management mode, a non-service channel is used to transmit the managementinformation. With the use of the non-service channel, the management channel is separated fromthe service channel, which is more reliable than in the inband network management mode.

ContextIn the network as shown in Figure 1-52, the service requirements are as follows:l The MA5600T provides the outband network management channel through the local

maintenance Ethernet port.l A static route is used between the MA5600T and the N2000 BMS.

l SNMP V3 is used.



1-103

Figure 1-52 Example network for the outband network management

Figure 1-53 shows the flowchart for commissioning the outband network management on thedevice.

Figure 1-53 Flowchart for commissioning the outband network management on the device




Issue 03 (2010-01-28)

Procedurel Commission the outband network management on the device.

1. Configure the IP address of the maintenance Ethernet port.The IP address of the local maintenance Ethernet port (outband network managementport) of the MA5600T is 10.50.1.10.

NOTEBy default, the IP address of the maintenance network port (ETH port on the control board) is10.11.104.2, and the subnet mask is 255.255.255.0.

huawei(config)#interface meth 0huawei(config-if-meth0)#ip address 10.50.1.10 255.255.255.0huawei(config-if-meth0)#quit

2. Add a route for the outband network management.Use the static route. The destination IP address is 10.10.1.0/24 (the network segmentto which the N2000 BMS belongs), and the gateway IP address is 10.50.1.1 (the IPaddress of the gateway of the MA5600T).huawei(config)#ip route-static 10.10.1.0 24 10.50.1.1


(1) Configure the SNMP user, group, and view.The user name is user1, the group name is group1, the user authentication modeis MD5, the authentication password is authkey123, the user encryption modeis des56, the encryption password is prikey123, the read and write view namesare hardy, and the view includes the internet subtree.huawei(config)#snmp-agent usm-user v3 user1 group1 authentication-mode md5 authkey123 privacy-mode des56 prikey123huawei(config)#snmp-agent group v3 group1 privacy read-view hardy write-view hardyhuawei(config)#snmp-agent mib-view hardy include internet

(2) (Optional) Set the ID and contact means of the administrator.The contact means of the administrator is HW-075528780808.huawei(config)#snmp-agent sys-info contact HW-075528780808


(4) (Optional) Configure the engine ID of the SNMP entity.The engine ID of the SNMP entity is set to 0123456789.

NOTEThe context engine ID of the SNMP must be the same as that on the N2000 BMS.

huawei(config)#snmp-agent local-engineid 0123456789(5) Set the SNMP version.

The SNMP version is SNMP V3.NOTEThe SNMP version must be the same as the SNMP version set on the N2000 BMS.

huawei(config)#snmp-agent sys-info version v34. Enable the function of sending traps.

On the MA5600T, enable the function of sending traps to the N2000 BMS.huawei(config)#snmp-agent trap enable standard

5. Set the IP address of the maintenance Ethernet port as the source IP address for sendingtraps.



1-105

Set the SNMP packets to be forwarded from the maintenance Ethernet port of theMA5600T. That is, the source address of the traps is meth 0.huawei(config)#snmp-agent trap source meth 0


l Commission the outband network management on the N2000 BMS.1. Configure the gateway of the route from the N2000 BMS server to network segment



– In the Windows OS, do as follows:Run the route add 10.50.1.0 mask 255.255.255.0 10.10.1.1 command to add aroute.Run the route print command to query the information about the current routingtable.

NOTE

When the IP address of the network management port and the IP address of the N2000 BMSare in the same network segment, you need not configure the routing information.


(1) Log in to the N2000 BMS. On the Welcome main interface, click todisplay the System Management interface.

(2) Choose System > Default Access Protocol Parameters from the main menu.Then, the Default Access Protocol Parameters interface is displayed.

(3) On the Default Access Protocol Parameters interface, click the SNMPv3Parameters tab, and then click Add.

(4) Set the SNMP parameters in the lower pane, as shown in Figure 1-54.


After selecting corresponding protocols in Data Encryption and

Authentication, click next to the parameter, and set the passwords of dataencryption protocol and authentication protocol, as shown in Figure 1-55.




Issue 03 (2010-01-28)

Figure 1-55 Set the passwords

NOTE

Device User, Context Engine ID, Data Encryption and password, andAuthentication and password must be the same as those configured on the MA5600T.You can run the display snmp-agent usm-user command to query the device user, dataencryption protocol, and authentication protocol on the MA5600T and run the displaysnmp-agent local-engineid command to query the context engine ID on theMA5600T.


main interface, and then click to display the Network Maintenance interface.4. In the physical topology view, right-click, and choose New > Equipment from the

shortcut menu.5. In the dialog box that is displayed, set the required parameters, as shown in Figure

1-56.

IP address is 10.50.1.10, Device Name is huawei, SNMP Parameters is SNMPV3:default.




1-107

6. Click OK. The system prompts a message indicating that several seconds or some 10

minutes are required for uploading the device data. After the related data is read, thesystem automatically refreshes and displays the device icon.

----End


Configuration FileThe following describes the script for commissioning the outband network management on thedevice.

interface meth 0ip address 10.50.1.10 255.255.255.0

quitip route-static 10.10.1.0 24 10.50.1.1snmp-agent usm-user v3 user1 group1 authentication-mode md5 authkey123 privacy-mode des56 prikey123snmp-agent group v3 group1 privacy read-view hardy write-view hardy

snmp-agent mib-view hardy include internet


snmp-agent trap enable standard

snmp-agent target-host trap-hostname huawei address 10.10.1.10 trap-paramsname ABCsnmp-agent target-host trap-paramsname ABC v3 securityname user1 privacy


save

1.4.1.3 Commissioning Inband Management (SNMP V1&V2)This topic describes how to implement the inband network management on the MA5600Tthrough the upstream port (inband network management port). This enables the N2000 BMS tomaintain the MA5600T through this management channel. In the inband network managementmode, the service channel of the device is used to transmit the management information. Thenetwork is flexible and requires no additional devices, which helps save the cost for carriers.This network, however, is difficult to maintain.

Service RequirementsIn the network as shown in Figure 1-57, the service requirements are as follows:l The MA5600T provides the inband network management through the upstream port.

l A static route is used between the MA5600T and the N2000 BMS.




Issue 03 (2010-01-28)

Figure 1-57 Example network for the inband network management

Figure 1-58 shows the flowchart for commissioning the inband network management.

Figure 1-58 Flowchart for commissioning the inband network management



1-109

Procedurel Commission the inband network management on the device.

1. Configure the IP address of the inband network management port.The upstream port (inband network management port) is 0/19/0, the VLAN ID is 100,the VLAN type is standard VLAN, and the IP address is 10.50.1.10/24.huawei(config)#vlan 1000 standardhuawei(config)#port vlan 1000 0/19 0huawei(config)#interface vlanif 1000huawei(config-if-vlanif1000)#ip address 10.50.1.10 255.255.255.0huawei(config-if-vlanif1000)#quit

NOTEIf the packet transmitted from the upstream port is untagged, run the native-vlan command toconfigure the native VLAN of the upstream port to be the same as the VLAN of the upstreamport.

2. Add a route for the inband network management.Use the static route. The destination IP address is 10.10.1.0/24 (the network segmentto which the N2000 BMS belongs), and the gateway IP address is 10.50.1.1 (the IPaddress of the gateway of the MA5600T).huawei(config)#ip route-static 10.10.1.0 24 10.50.1.1


(1) Configure the community name and the access authority.The read community name is public, and the write community name isprivate.

NOTEThe configurations of the read community name and the write community name must bethe same as the configurations on the N2000 BMS.

huawei(config)#snmp-agent community read publichuawei(config)#snmp-agent community write private

(2) (Optional) Set the ID and the contact means of the administrator.The contact means of the administrator is HW-075528780808.huawei(config)#snmp-agent sys-info contact HW-075528780808


(4) Set the SNMP version.– The SNMP version is SNMP V1.

huawei(config)#snmp-agent sys-info version v1– The SNMP version is SNMP V2.

huawei(config)#snmp-agent sys-info version v2c–






Issue 03 (2010-01-28)

5. Configure the IP address of the destination host for the traps.– When the SNMP V1 is used, the host name is huawei, the IP address of the host

is 10.10.1.10 (IP address of the N2000 BMS), the trap parameter name is ABC,SNMP version is V1, and the parameter security name is private (the parametersecurity name is the SNMP community name).huawei(config)#snmp-agent target-host trap-hostname huawei address 10.10.1.10 trap-paramsname ABChuawei(config)#snmp-agent target-host trap-paramsname huawei v1 securityname private

– When the SNMP V2 is used, the host name is huawei, the IP address of the hostis 10.10.1.10 (IP address of the N2000 BMS), the trap parameter name is ABC,SNMP version is V2, and the parameter security name is private (the parametersecurity name is the SNMP community name).huawei(config)#snmp-agent target-host trap-hostname huawei address 10.10.1.10 trap-paramsname ABChuawei(config)#snmp-agent target-host trap-paramsname huawei v2c securityname private

6. Configure the IP address of the VLAN interface as the source address for sendingtraps.Enable the forwarding of the SNMP packets from the L3 interface of VLAN 1000 ofthe MA5600T.huawei(config)#snmp-agent trap source vlanif 1000


l Commission the inband network management on the N2000 BMS.1. Configure the gateway of the route from the N2000 BMS to network segment



– In the Windows OS, do as follows:Run the route add 10.50.1.0 mask 255.255.255.0 10.10.1.1 command to add aroute.Run the route print command to query the information about the current routingtable.

NOTE

If the IP address of the outband network management port and the IP address of the N2000BMS are in the same network segment, you need not configure the routing information.

2. Log in to the N2000 BMS.3. Set the SNMP parameters. A default SNMP profile exists in the system. Use the default

profile in this service. If a new profile is required, do as follows:

(1) On the Welcome main interface, click to display the SystemManagement interface.

(2) Choose System > Default Access Protocol Parameters from the main menu.The Default Access Protocol Parameters interface is displayed.



1-111

(3) On the Default Access Protocol Parameters interface, click the SNMPv1Parameters (when the SNMP V1 is used) or SNMPv2 Parameters (when theSNMP V2 is used) tab, and then click Add.

(4) – When the SNMP V1 is used, Set the SNMP parameters in the lower pane, asshown in the following figure (the other parameters except Profile name usethe default settings).


– When the SNMP V2 is used, Set the SNMP parameters in the lower pane, as

shown in the following figure (the other parameters except Profile name usethe default settings).


NOTE

The configurations of Get Community and Set Community are the same as theconfigurations on the MA5600T.


main interface, and then click to display the Network Maintenance interface.5. Add a device.

(1) In the topology view, right-click, and choose New > Equipment from theshortcut menu.

(2) – When the SNMP V1 is used, In the dialog box that is displayed, set therequired parameters, as shown in the following figure.IP Address is 10.50.1.10, Device Name is huawei, and SNMPParameters is SNMP V1:default.




Issue 03 (2010-01-28)


– When the SNMP V2 is used, In the dialog box that is displayed, set the

required parameters, as shown in the following figure.IP Address is 10.50.1.10, Device Name is huawei, and SNMPParameters is SNMP V2:default.



1-113


(3) Click OK. The system displays a message indicating that several seconds or some

10 minutes are required for uploading the device data. After the related data isread, the system automatically refreshes and displays the device icon.

----End


Configuration FileThe following describes the script for commissioning the inband network management on thedevice (SNMP V1).

vlan 1000 standardport vlan 1000 0/19 0interface vlanif 1000ip address 10.50.1.10 255.255.255.0









Issue 03 (2010-01-28)

snmp-agent target-host trap-hostname huawei address 10.10.1.10 trap-paramsname ABCsnmp-agent target-host trap-paramsname huawei v1 securityname private

snmp-agent trap source vlanif 1000save

The following describes the script for commissioning the inband network management on thedevice (SNMP V2).





snmp-agent sys-info contact HW-075528780808snmp-agent sys-info location Shenzhen_Chinasnmp-agent sys-info version v2c

snmp-agent trap enable standardsnmp-agent target-host trap-hostname huawei address 10.10.1.10 trap-paramsname ABCsnmp-agent target-host trap-paramsname huawei v2c securityname private


1.4.1.4 Commissioning Inband Network Management (SNMP V3)This topic describes how to implement the inband network management on the MA5600Tthrough the upstream port (inband network management port). This enables the N2000 BMS tomaintain the MA5600T through this management channel. In the inband network managementmode, the service channel of the device is used to transmit the management information. Thenetwork is flexible and requires no additional devices, which helps save the cost for carriers.This network, however, is difficult to maintain.

Service RequirementsIn the network as shown in Figure 1-63, the service requirements are as follows:l The MA5600T provides the inband network management through the upstream port.

l A static route is used between the MA5600T and the N2000 BMS.

l The SNMP V3 is used, which manages the network security and the access control. It ismore reliable than SNMP V1 and V2.



1-115

Figure 1-63 Example network for the inband network management

Figure 1-64 shows the flowchart for commissioning the inband network management.

Figure 1-64 Flowchart for commissioning the inband network management




Issue 03 (2010-01-28)

Procedurel Commission the inband network management on the device.

1. Configure the IP address of the inband network management port.The upstream port (inband network management port) is 0/19/0, the VLAN ID is 100,the VLAN type is standard VLAN, and the IP address is 10.50.1.10/24.huawei(config)#vlan 1000 standardhuawei(config)#port vlan 1000 0/19 0huawei(config)#interface vlanif 1000huawei(config-if-vlanif1000)#ip address 10.50.1.10 255.255.255.0huawei(config-if-vlanif1000)#quit

NOTEIf the packet transmitted from the upstream port is untagged, run the native-vlan command toconfigure the native VLAN of the upstream port to be the same as the VLAN of the upstreamport.

2. Add a route for the inband network management.Use the static route. The destination IP address is 10.10.1.0/24 (the network segmentto which the N2000 BMS belongs), and the gateway IP address is 10.50.1.1 (the IPaddress of the gateway of the MA5600T).huawei(config)#ip route-static 10.10.1.0 24 10.50.1.1


(1) Configure the SNMP user, group, and view.The user name is user1, the group name is group1, the user authentication modeis MD5, the authentication password is authkey123, the user encryption modeis des56, the encryption password is prikey123, the read and write view namesare hardy, and the view includes the internet subtree.huawei(config)#snmp-agent usm-user v3 user1 group1 authentication-mode md5 authkey123 privacy-mode des56 prikey123huawei(config)#snmp-agent group v3 group1 privacy read-view hardy write-view hardyhuawei(config)#snmp-agent mib-view hardy include internet

(2) (Optional) Set the ID and contact means of the administrator.The contact means of the administrator is HW-075528780808.huawei(config)#snmp-agent sys-info contact HW-075528780808


(4) (Optional) Configure the engine ID of the SNMP entity.The engine ID of the SNMP entity is set to 0123456789.

NOTEThe context engine ID of the SNMP must be the same as that on the N2000 BMS.

huawei(config)#snmp-agent local-engineid 0123456789

(5) Set the SNMP version.The SNMP version is SNMP V3.


huawei(config)#snmp-agent sys-info version v3



1-117


5. Configure the IP address of the destination host for the traps.The host name is huawei, the IP address of the host is 10.10.1.10 (IP address of theN2000 BMS), the trap parameter name is ABC, the SNMP version is V3, the parametersecurity name is user1 (when the SNMP V3 is used, the parameter security name isthe USM user name), and the traps are authenticated and encrypted.huawei(config)#snmp-agent target-host trap-hostname huawei address 10.10.1.10 trap-paramsname ABChuawei(config)#snmp-agent target-host trap-paramsname ABC v3 securityname user1 privacy

6. Configure the IP address of the VLAN interface as the source address for sendingtraps.Enable the forwarding of the SNMP packets from the L3 interface of VLAN 1000 ofthe MA5600T.huawei(config)#snmp-agent trap source vlanif 1000


l Commission the inband network management on the N2000 BMS.

1. Configure the gateway of the route from the N2000 BMS server to network segment10.50.1.0/24 to 10.10.1.1.

– In the Solaris OS, do as follows:

Run the route add 10.50.1.0 10.10.1.1 command to add a route.

Run the netstat -r command to query the information about the current routingtable.

– In the Windows OS, do as follows:

Run the route add 10.50.1.0 mask 255.255.255.0 10.10.1.1 command to add aroute.

Run the route print command to query the information about the current routingtable.

NOTE

When the IP address of the network management port and the IP address of the N2000 BMSare in the same network segment, you need not configure the routing information.


(1) Log in to the N2000 BMS. On the Welcome main interface, click todisplay the System Management interface.

(2) Choose System > Default Access Protocol Parameters from the main menu.Then, the Default Access Protocol Parameters interface is displayed.

(3) On the Default Access Protocol Parameters interface, click the SNMPv3Parameters tab, and then click Add.

(4) Set the SNMP parameters in the lower pane, as shown in Figure 1-65.




Issue 03 (2010-01-28)


After selecting corresponding protocols in Data Encryption and

Authentication, click next to the parameter, and set the passwords of dataencryption protocol and authentication protocol, as shown in Figure 1-66.

Figure 1-66 Set the passwords

NOTE

Device User, Context Engine ID, Data Encryption and password, andAuthentication and password must be the same as those configured on the MA5600T.You can run the display snmp-agent usm-user command to query the device user, dataencryption protocol, and authentication protocol on the MA5600T and run the displaysnmp-agent local-engineid command to query the context engine ID on theMA5600T.


main interface, and then click to display the Network Maintenance interface.4. In the physical topology view, right-click, and choose New > Equipment from the

shortcut menu.5. In the dialog box that is displayed, set the required parameters, as shown in Figure

1-67.

IP address is 10.50.1.10, Device Name is huawei, SNMP Parameters is SNMPV3:default.



1-119


6. Click OK. The system prompts a message indicating that several seconds or some 10

minutes are required for uploading the device data. After the related data is read, thesystem automatically refreshes and displays the device icon.

----End


Configuration FileThe following describes the script for commissioning the inband network management on thedevice.



snmp-agent usm-user v3 user1 group1 authentication-mode md5 authkey123 privacy-mode des56 prikey123snmp-agent group v3 group1 privacy read-view hardy write-view hardy

snmp-agent mib-view hardy include internet





Issue 03 (2010-01-28)


snmp-agent target-host trap-hostname huawei address 10.10.1.10 trap-paramsname ABCsnmp-agent target-host trap-paramsname ABC v3 securityname user1 privacy


1.4.2 Commissioning the Interconnection with the BRASThis topic describes how to check whether the MA5600T can normally communicate with theBRAS. Working with the BRAS, the MA5600T can implement the authentication, accounting,and authorization (AAA) service.

Service Requirements

In the network as shown in Figure 1-68, the service requirements are as follows:

l The MA5600T uses the GIU board for upstream transmission.

l A static route is configured on the MA5600T for communicating with the BRAS.

l The requirements on the BRAS are as follows:

– According to the authentication and accounting requirements for the users, you need toperform related configurations on the BRAS. For example, configure the access userdomain (including the authentication scheme, accounting scheme, and authorizationscheme that are bound to the domain) and specify the RADIUS server.

– If the BRAS is used to authenticate users, you need to configure the user name and thepassword for each user on the BRAS. If the BRAS is used to allocate IP addresses, youmust configure the corresponding IP address pool on the BRAS.

NOTEFor details about how to configure a router or the BRAS, see related configuration guides.

Figure 1-68 Example network for commissioning the interconnection with the BRAS



1-121

Procedure

Step 1 Configure a VLAN.The VLAN ID is 2, and the VLAN type is smart VLAN.huawei(config)#vlan 2 smart

Step 2 Add an upstream port to the VLAN.Upstream port 0/19/0 on the GIU board is added to VLAN 2.huawei(config)#port vlan 2 0/19 0


Step 3 Configure the IP address of the L3 interface.The L3 interface IP address is 10.50.1.10/24, and this IP address must be in the same networksegment as the gateway IP address (IP address of the router port that is connected to theMA5600T).huawei(config)#interface vlanif 2huawei(config-if-vlanif2)#ip address 10.50.1.10 255.255.255.0huawei(config-if-vlanif2)#quit

Step 4 Add a static route.The destination IP address is 10.10.1.0/24 (the network segment of the BRAS), and the next-hop IP address is gateway IP address 10.50.1.1.huawei(config)#ip route-static 10.10.1.0 24 10.50.1.1

Step 5 Save the data.huawei(config)#save

----End

ResultAfter the MA5600T is interconnected with the BRAS successfully, you can ping IP address10.10.1.1 from the MA5600T. After services are configured on the MA5600T, the authenticationand accounting functions of the BRAS can be implemented.

Configuration Filevlan 2 smartport vlan 2 0/19 0interface vlanif 2ip address 10.50.1.10 255.255.255.0


save

1.4.3 Commissioning the Interconnection with the RouterThis topic describes how to check whether the MA5600T can normally communicate with therouter and whether the MA5600T can access the upper-layer device through the router.

Service RequirementsIn the network as shown in Figure 1-69, the service requirements are as follows:




Issue 03 (2010-01-28)

l The MA5600T uses the GIU board for upstream transmission.

l By interconnecting with the router, the MA5600T can be interconnected with the upper-layer device through configuring a static route on the MA5600T.

NOTEFor details about how to configure a router, see the related configuration guide.

Figure 1-69 Example network for commissioning the interconnection with the router

Procedure

Step 1 Configure a VLAN.The VLAN ID is 2, and the VLAN type is smart VLAN.huawei(config)#vlan 2 smart



Step 3 Configure the IP address of the L3 interface.The L3 interface IP address is 10.50.1.10/24, and this IP address must be in the same networksegment as the gateway IP address (IP address of the router port that is connected to theMA5600T).huawei(config)#interface vlanif 2huawei(config-if-vlanif2)#ip address 10.50.1.10 255.255.255.0huawei(config-if-vlanif2)#quit



1-123

Step 4 Add a static route.The destination IP address is 10.10.1.0/24, and the next-hop IP address is gateway IP address10.50.1.1.huawei(config)#ip route-static 10.10.1.0 24 10.50.1.1


----End

ResultAfter the MA5600T is interconnected with the router successfully, you can ping IP address10.10.1.12 from the MA5600T.



save

1.4.4 Commissioning the Management Channel Between the OLTand the GPON MDU(Distributed-Mode)

This topic describes how to commission the management channel between the MA5600T andthe GPON MDU to ensure that you can log in to the GPON MDU through the MA5600T at theCO to remotely maintain and manage the GPON MDU.

Service RequirementsIn the network as shown in Figure 1-74, the service requirements are as follows:l A GPON port on the MA5600T is connected to 128 MDUs through an optical splitter.

NOTEThe following considers MDU 0 as an example for commissioning the management channel betweenthe OLT and the GPON MDU.

l After the management channel between the MA5600T and the GPON MDU is set up, youcan log in to the MDU through port 0/2/0 connected to the MDU to remotely maintain andmanage the MDU.

l The DBA profile is used to limit the user rate to the fixed 10 Mbit/s bandwidth.




Issue 03 (2010-01-28)

Figure 1-70 Example network for commissioning the management channel between the OLTand the GPON MDU

Figure 1-71 shows the flowchart for commissioning the management channel between the OLTand the GPON MDU.



1-125

Figure 1-71 Flowchart for commissioning the management channel between the OLT and theGPON MDU

Procedure

Step 1 Create a VLAN.The VLAN ID is 20, and the VLAN type is smart VLAN.huawei(config)#vlan 20 smart


Step 3 Configure the IP address of the L3 interface.The L3 IP address is 192.168.1.100/24.huawei(config)#interface vlanif 20huawei(config-if-vlanif20)#ip address 192.168.1.100 255.255.255.0huawei(config-if-vlanif20)#quit

Step 4 Add a DBA profile.

The DBA profile ID is 12, the DBA profile uses the default name DBA-profile_12, the bandwidthtype is type1 (fixed bandwidth), and the user rate is the fixed 10 Mbit/s bandwidth.




Issue 03 (2010-01-28)

NOTE

l The bandwidth type and the attribute of the DBA profile must be compatible with the service to becarried.

l The system supports five DBA profile types, namely, type1 (fixed bandwidth), type2 (assuredbandwidth), type3 (assured bandwidth+maximum bandwidth), type4 (maximum bandwidth), and type5(fixed bandwidth+assured bandwidth+maximum bandwidth).

l By default, the system provides DBA profiles 1 to 9, each of which provides typical values for trafficparameters. By default, T-CONT 0 is bound with DBA profile 1.

l The value of the bandwidth you input when adding the DBA profile rounds down to the nearest integermultiple of 64. For example, if the input bandwidth value is 1022 kbit/s, the actual bandwidth is 960kbit/s.

l You can run the display dba-profile command to query the information about the DBA profile.

huawei(config)#dba-profile add profile-id 12 type1 fix 10240

Step 5 Add an MDU.MDU 0 is connected to GPON port 0, the MDU authentication mode is the SN authentication,the SN is 323031314D4B2041, the management protocol is OMCI, and the default capabilityset profile 2 is bound to MDU 0.

NOTE

You can add an MDU in the following two ways: confirming an auto-discovered MDU and adding anMDU offline. Here, the method of adding an MDU offline is considered as an example.

You can also run the port ont-auto-find command to enable the function of auto-discovering an MDU,and then run the ont confirm command to confirm the auto-discovered MDU.

huawei(config)#interface gpon 0/2huawei(config-if-gpon-0/2)#ont add 0 0 sn-auth 323031314D4B2041 profile-id 2 desc huaweiont manage-mode omci

Step 6 Bind the DBA profile 12.huawei(config-if-gpon-0/2)#tcont bind-profile 0 0 1 profile-id 12

Step 7 Configure the default VLAN (native VLAN) for the MDU port. By default, the default VLANID of the MDU port is 1.huawei(config-if-gpon-0/2)#ont port native-vlan 0 0 eth 1 vlan 20

l If the packets reported from a user (such a PC) to the MDU are untagged, the packets aretagged with the default VLAN of the port on the MDU and then reported to the OLT.

l If the packets reported from a user to the MDU are tagged, you need to configure the portVLAN of the MDU to be the same as the VLAN in the user tag. The packets are not taggedwith the default VLAN of the port on the MDU but are reported to the OLT with the usertag.

Step 8 Configure the GEM Port.huawei(config-if-gpon-0/2)#gemport add 0 gemportid 150 eth

Step 9 Bind the GEM port to an ONT T-CONT.

NOTE

If the ONT does not support the priority queue scheduling, you can use the CAR mode for rate limitation whenconfiguring the binding between a GEM port and an ONT T-CONT.huawei(config-if-gpon-0/2)# ont gemport bind 0 0 150 1 priority-queue 6

Step 10 Map the GEM port to the service stream.huawei(config-if-gpon-0/2)#ont gemport mapping 0 0 150 vlan 10



1-127

Step 11 Configure the management IP address of the MDU.The management IP address is 192.168.1.200/24, and the ID of the native VLAN to which theMDU port belongs is 20.huawei(config-if-gpon-0/2)#ont ipconfig 0 0 static ip-address 192.168.1.200 mask 255.255.255.0 vlan 20huawei(config-if-gpon-0/2)#quit

Step 12 Add a service port to the VLAN.huawei(config)#service-port vlan 20 gpon 0/2/0 gemport 150 multi-service user-vlan 10


----End

ResultAfter the commissioning is complete, you can remotely maintain and manage the MDU throughtelnet 133.7.22.101(For example, run the ont deactivate command to deactivate the ONT thatis in the activated state).

Configuration File

vlan 20 smartport vlan 20 0interface vlanif 20ip address 192.168.1.100 255.255.255.0quitdba-profile add profile-id 12 type1 fix 10240interface gpon 0/2ont add 0 0 sn-auth 323031314D4B2041 profile-id 2 desc huaweiont manage-mode omciquit

tcont bind-profile 0 0 1 profile-id 12ont port native-vlan 0 0 eth 1 vlan 20gemport add 0 gemportid 150 ethont gemport bind 0 0 150 1 priority-queue 6ont gemport mapping 0 0 150 vlan 10ont ipconfig 0 0 static ip-address 192.168.1.200 mask 255.255.255.0 vlan 20quit

service-port vlan 20 gpon 0/2 gemport 150 multi-service user-vlan 10

1.4.5 Commissioning the Management Channel Between the OLTand the GPON ONT(Distributed-Mode)

This topic describes how to commission the management channel between the MA5600T andthe GPON ONT to ensure that you can log in to the GPON ONT through the MA5600T at theCO to remotely maintain and manage the GPON ONT.

Service RequirementsIn the network as shown in Figure 1-72, the service requirements are as follows:l A GPON port on the MA5600T is connected to 128 s through an optical splitter.




Issue 03 (2010-01-28)

NOTEThe following considers 0 as an example for commissioning the management channel between theOLT and the GPON .

l After the management channel between the MA5600T and the GPON is set up, you canlog in to the through port 0/2/0 connected to the to remotely maintain and manage the .


Figure 1-72 Example network for commissioning the management channel between the OLTand the GPON ONT

Figure 1-73 shows the flowchart for commissioning the management channel between the OLTand the GPON ONT.



1-129

Figure 1-73 Flowchart for commissioning the management channel between the OLT and theGPON ONT

Procedure



Step 3 Add a DBA profile.The DBA profile ID is 12, the DBA profile uses the default name DBA-profile_12, the bandwidthtype is type1 (fixed bandwidth), and the user rate is the fixed 10 Mbit/s bandwidth.




Issue 03 (2010-01-28)

NOTE






Step 4 Add an ONT.ONT 0 is connected to GPON port 0, the ONT authentication mode is the SN authentication,the SN is 323031314D4B2041, the management protocol is OMCI, and the default capabilityset profile 2 is bound to ONT 0.

NOTE

You can add an ONT in the following two ways: confirming an auto-discovered ONT and adding an ONToffline. Here, the method of adding an ONT offline is considered as an example.

You can also run the port ont-auto-find command to enable the function of auto-discovering an ONT,and then run the ont confirm command to confirm the auto-discovered ONT.

huawei(config)#interface gpon 0/2huawei(config-if-gpon-0/2)#ont add 0 0 sn-auth 323031314D4B2041 profile-id 2 desc huaweiont manage-mode omci

Step 5 Bind the DBA profile 12.huawei(config-if-gpon-0/2)#tcont bind-profile 0 0 1 profile-id 12

Step 6 Configure the default VLAN (native VLAN) for the ONT port. By default, the default VLANID of the ONT port is 1.huawei(config-if-gpon-0/2)#ont port native-vlan 0 0 eth 1 vlan 20

l If the packets reported from a user (such a PC) to the ONT are untagged, the packets aretagged with the default VLAN of the port on the ONT and then reported to the OLT.

l If the packets reported from a user to the ONT are tagged, you need to configure the portVLAN of the ONT to be the same as the VLAN in the user tag. The packets are not taggedwith the default VLAN of the port on the ONT but are reported to the OLT with the user tag.

Step 7 Configure the GEM Port.huawei(config-if-gpon-0/2)#gemport add 0 gemportid 150 eth

Step 8 Bind the GEM port to an ONT T-CONT.

NOTE

If the ONT does not support the priority queue scheduling, you can use the CAR mode for rate limitation whenconfiguring the binding between a GEM port and an ONT T-CONT.huawei(config-if-gpon-0/2)# ont gemport bind 0 0 150 1 priority-queue 6

Step 9 Map the GEM port to the service stream.huawei(config-if-gpon-0/2)#ont gemport mapping 0 0 150 vlan 10

Step 10 Add a service port to the VLAN.huawei(config)#service-port vlan 20 gpon 0/2 gemport 150 multi-service user-vlan 10



1-131


----End

ResultAfter the commissioning is complete, you can maintain and manage the ONT on theMA5600T (For example, run the ont deactivate command to deactivate the ONT that is in theactivated state).

Configuration File

vlan 20 smartport vlan 20 0/19 0dba-profile add profile-id 12 type1 fix 10240interface gpon 0/2ont add 0 0 sn-auth 323031314D4B2041 profile-id 2 desc huaweiont manage-mode omci

tcont bind-profile 0 0 1 profile-id 12ont port native-vlan 0 0 eth 1 vlan 20gemport add 0 gemportid 150 ethont gemport bind 0 0 150 1 priority-queue 6ont gemport mapping 0 0 150 vlan 10quit

service-port vlan 20 gpon 0/2 gemport 150 multi-service user-vlan 10

1.4.6 Commissioning the Management Channel Between the OLTand the GPON MDU(Profile-mode)

This topic describes how to commission the management channel between the MA5600T andthe GPON MDU to ensure that you can log in to the GPON MDU through the MA5600T at theCO to remotely maintain and manage the GPON MDU.

Service RequirementsIn the network as shown in Figure 1-74, the service requirements are as follows:l A GPON port on the MA5600T is connected to 128 MDUs through an optical splitter.

NOTEThe following considers MDU 0 as an example for commissioning the management channel betweenthe OLT and the GPON MDU.

l After the management channel between the MA5600T and the GPON MDU is set up, youcan log in to the MDU through port 0/2/0 connected to the MDU to remotely maintain andmanage the MDU.





Issue 03 (2010-01-28)

Figure 1-74 Example network for commissioning the management channel between the OLTand the GPON MDU

Figure 1-75 shows the flowchart for commissioning the management channel between the OLTand the GPON MDU.



1-133

Figure 1-75 Flowchart for commissioning the management channel between the OLT and theGPON MDU

Procedure


Step 2 Add an upstream port to the VLAN.Upstream port 0/19/0 on the GIU board is added to VLAN 20.




Issue 03 (2010-01-28)

huawei(config)#port vlan 20 0/19 0

Step 3 Configure the IP address of the L3 interface.The L3 IP address is 192.168.1.100/24.huawei(config)#interface vlanif 20huawei(config-if-vlanif20)#ip address 192.168.1.100 255.255.255.0huawei(config-if-vlanif20)#quit


NOTE

l The bandwidth type and the attribute of the DBA profile must be compatible with the service to becarried.






Step 5 Configure an MDU line profile.The MDU line profile ID is 5, T-CONT 1 is bound with DBA profile 12, GEM port 0 is boundto T-CONT 1, the service type is ETH, and the mapping mode is VLAN mapping.huawei(config)#ont-lineprofile gpon profile-id 5huawei(config-gpon-lineprofile-5)#tcont 1 dba-profile-id 12huawei(config-gpon-lineprofile-5)#gem add 0 eth tcont 1huawei(config-gpon-lineprofile-5)#gem mapping 0 0 vlan 20huawei(config-gpon-lineprofile-5)#commithuawei(config-gpon-lineprofile-5)#quit

Step 6 Add an MDU.MDU 0 is connected to GPON port 0, the MDU authentication mode is the SN authentication,the SN is 32303131B39FD641, the management protocol is SNMP, and MDU profile 5 is boundto MDU 0.

NOTE

You can add an MDU in the following two ways: confirming an auto-discovered MDU and adding anMDU offline. Here, the method of adding an MDU offline is considered as an example.

You can also run the port ont-auto-find command to enable the function of auto-discovering an MDU,and then run the ont confirm command to confirm the auto-discovered MDU.

huawei(config)#interface gpon 0/2huawei(config-if-gpon-0/2)#ont add 0 0 sn-auth 32303131B39FD641 snmp ont-lineprofile-id 5

Step 7 Configure the management IP address of the MDU.The management IP address is 192.168.1.200/24, and the ID of the native VLAN to which theMDU port belongs is 20.huawei(config-if-gpon-0/2)#ont ipconfig 0 0 static ip-address 192.168.1.200 mask 255.255.255.0 vlan 20huawei(config-if-gpon-0/2)#quit



1-135

Step 8 Add a service port to the VLAN.huawei(config)#service-port vlan 20 gpon 0/2/0 ont 0 gemport 0 multi-service user-vlan 20


----End

ResultAfter the commissioning is complete, you can remotely maintain and manage the MDU throughtelnet 133.7.22.101.


quitdba-profile add profile-id 12 type1 fix 10240

ont-lineprofile gpon profile-id 5

tcont 1 dba-profile-id 12gem add 0 eth tcont 1

gem mapping 0 0 vlan 20

commitquitinterface gpon 0/2ont add 0 0 sn-auth 32303131B39FD641 snmp ont-lineprofile-id 5

ont ipconfig 0 0 static ip-address 192.168.1.200 mask 255.255.255.0 vlan 20

quitservice-port vlan 20 gpon 0/2/0 ont 0 gemport 0 multi-service user-vlan 20

save

1.4.7 Commissioning the Management Channel Between the OLTand the GPON ONT(Profile-mode)

This topic describes how to commission the GPON OLT to ensure that the service configurationand centralized management of the GPON ONTs are performed on the GPON OLT through theONT Management and Control Interface (OMCI) protocol.

Service RequirementsIn the network as shown in Figure 1-76, the service requirements are as follows:l A GPON port on the MA5600T is connected to 128 ONTs through an optical splitter.

NOTEThe following considers ONT 0 as an example for commissioning the management channel betweenthe OLT and the GPON ONT.

l On the MA5600T, you can configure ONTs at different locations in a centralized manner.





Issue 03 (2010-01-28)

Figure 1-76 Example network for commissioning the management channel between the OLTand the GPON ONT

Figure 1-77 shows the flowchart for commissioning the management channel between the OLTand the GPON ONT.



1-137

Figure 1-77 Flowchart for commissioning the management channel between the OLT and theGPON ONT

Procedure







Issue 03 (2010-01-28)

NOTE




l You can run the display dba-profile command to query the information about the DBA profile.huawei(config)#dba-profile add profile-id 12 type1 fix 10240

Step 4 Add an ONT line profile.The ONT line profile ID is 5, T-CONT 1 is bound with DBA profile 12, GEM port 0 is boundto T-CONT 1, the service type is ETH, and the mapping mode is VLAN mapping.huawei(config)#ont-lineprofile gpon profile-id 5huawei(config-gpon-lineprofile-5)#tcont 1 dba-profile-id 12huawei(config-gpon-lineprofile-5)#gem add 0 eth tcont 1huawei(config-gpon-lineprofile-5)#gem mapping 0 0 vlan 20huawei(config-gpon-lineprofile-5)#commithuawei(config-gpon-lineprofile-5)#quit

Step 5 Add an ONT service profile.The ONT service profile ID is 10, the quantity of Ethernet ports on the ONT is 4, the quantityof POTS ports on the ONT is 2, and Ethernet ports 1-4 are added to VLAN 20.

NOTEThe port capability set in the ONT service profile must be the same as the actual ONT capability set.

huawei(config)#ont-srvprofile gpon profile-id 10huawei(config-gpon-srvprofile-10)#ont-port eth 4 pots 2huawei(config-gpon-srvprofile-10)#port vlan eth 1-4 20huawei(config-gpon-srvprofile-10)#commithuawei(config-gpon-srvprofile-10)#quit

Step 6 Add an ONT.ONT 0 is connected to GPON port 0, the ONT authentication mode is the SN authentication,the SN is 323031314D4B2041, the management protocol is OMCI, and ONT line profile 5 andONT service profile 10 are bound to ONT 0.

NOTE

You can add an ONT in the following two ways: confirming an auto-discovered ONT and adding an ONToffline. Here, the method of adding an ONT offline is considered as an example.

You can also run the port ont-auto-find command to enable the function of auto-discovering an ONT,and then run the ont confirm command to confirm the auto-discovered ONT.

huawei(config)#interface gpon 0/2huawei(config-if-gpon-0/2)#ont add 0 0 sn-auth 323031314D4B2041 omci ont-lineprofile-id 5 ont-srvprofile-id 10huawei(config-if-gpon-0/2)#quit


----End



1-139

ResultAfter the commissioning is complete, you can maintain and manage the ONT on theMA5600T (For example, run the ont deactivate command to deactivate the ONT that is in theactivated state).


quitdba-profile add profile-id 12 type1 fix 10240

ont-lineprofile gpon profile-id 5

tcont 1 dba-profile-id 12gem add 0 eth tcont 1

gem mapping 0 0 vlan 20

commitquitinterface gpon 0/2ont add 0 0 sn-auth 32303131B39FD641 snmp ont-lineprofile-id 5

ont ipconfig 0 0 static ip-address 192.168.1.200 mask 255.255.255.0 vlan 20

quitservice-port vlan 20 gpon 0/2/0 ont 0 gemport 0 multi-service user-vlan 20

save

1.5 Maintenance and Management CommissioningTo ensure the stability of the MA5600T, you need to verify the maintainability and reliabilityof the device after completing the stand-alone commissioning and interconnectioncommissioning.

1.5.1 Checking the System SwitchoverAfter the active/standby switchover is performed, the services of the active control board areswitched to the standby control board. This ensures that the services run in the normal state.

1.5.2 Checking Alarms and EventsThis topic describes how to check the alarm and event reporting function of the device.

1.5.3 Checking the LogIf a fault occurs on the device, you can locate the fault by querying the log.

1.5.1 Checking the System SwitchoverAfter the active/standby switchover is performed, the services of the active control board areswitched to the standby control board. This ensures that the services run in the normal state.

Prerequisitel An active control board and a standby control board must be configured on the device, and

the cables must be connected correctly on the boards.




Issue 03 (2010-01-28)

l The patch status of the active and standby control boards must be consistent with thehardware environment.

Precautionsl If the data of the active and standby control boards is not completely synchronized, the

system prohibits the active/standby switchover.

NOTE

Run the display data sync state command to query the data synchronization status of the active andstandby control boards.

l When the communication between the active and standby control boards fails or the standbycontrol board is faulty, the system prohibits the active/standby switchover.

l When the data is being loaded, saved, or backed up, the system prohibits the active/standbyswitchover.

Context

Classification of the active/standby switchover:

According to the status of the data synchronization, the active/standby switchover is classifiedinto the normal switchover and forced switchover.

l Normal switchover: Refers to the active/standby switchover that is performed when thedata is synchronized sufficiently. A normal switchover does not cause links to break orboards to reset.

l Forced switchover: Refers to the active/standby switchover that is performed when the datais not synchronized sufficiently.

The following data might be synchronized insufficiently:

– Configuration data.

When the configuration data is not fully synchronized, the system prohibits performingforced switchover by running the active/standby switchover command. Other forcedswitching methods, such as manually resetting the active control board or removing theactive control board, cause loss of basic data or the system to reset.

Therefore, when the configuration data is not fully synchronized, it is recommendedthat you do not perform the forced switchover. You can choose to reset the system. Inthis manner, the system can return to the normal state in a short period.

– Basic data.

When the basic data is not fully synchronized, the system prohibits performing forcedswitchover by running the active/standby switchover command. Other forced switchingmethods, such as manually resetting the active board or removing the active controlboard, neither reset the system nor affect the database, but they may cause service boardsto reset.

– Dynamic data.

When certain dynamic data is not fully synchronized, the system permits performingforced switchover by running the active/standby switchover command. After theswitchover, the on-going services continue to run in the normal state, and the originalconnections, alarms, and logs are not lost.



1-141

Procedure


Step 2 Run the system switch-over command to perform the active/standby switchover.

----End

ResultWhen the ACT LED on the original standby control board is on, log in to the system throughthis control board. It is found that the system runs in the normal state.

ExampleAfter the data is saved, perform the active/standby switchover.huawei#save{ <cr>|configuration<K>|data<K> }:

Command: save

huawei# It will take several minutes to save configuration file, please wait...

huawei# Configuration file had been saved successfully Note: The configuration file will take effect after being activated

huawei# The data is being saved, please wait a moment...huawei(config)#system switch-over Are you sure to switch over? (y/n)[n]:y

1.5.2 Checking Alarms and EventsThis topic describes how to check the alarm and event reporting function of the device.

1.5.2.1 Verifying the Alarm and Event FunctionThis topic describes how to verify the alarm and event function by triggering various alarms andevents through the related operations.

1.5.2.2 Querying Alarms and EventsThis topic describes how to query history alarms and events through the maintenance terminal.

1.5.2.1 Verifying the Alarm and Event FunctionThis topic describes how to verify the alarm and event function by triggering various alarms andevents through the related operations.

Verifying OperationTable 1-29 lists the operations for verifying the alarm and event function.




Issue 03 (2010-01-28)

Table 1-29 Operations for verifying the alarm and event function

Operation Description

Remove a service board. Check whether the corresponding alarm or event isgenerated on the maintenance terminal.

Insert the service board back into theslot.

Check whether the corresponding recovery alarm orevent is generated on the maintenance terminal.

Remove the optical fiber connected toan optical port.

Check whether the corresponding alarm or event isgenerated on the maintenance terminal.

Insert the optical fiber back into theoptical port.


Remove the optical fiber connected toan optical port when an ONT is online.

Check whether the corresponding alarm or event isgenerated on the maintenance terminal.

Insert the optical fiber back into theoptical port.


Open the cabinet door. Check whether the corresponding alarm or event isgenerated on the maintenance terminal.

Close the cabinet door. Check whether the corresponding recovery alarm orevent is generated on the maintenance terminal.

Remove the fan tray from the shelf. Check whether the corresponding alarm or event isgenerated on the maintenance terminal.

Insert the fan tray back into the shelf. Check whether the corresponding recovery alarm orevent is generated on the maintenance terminal.

Perform the active/standby switchoverof the control boards.

Log in to the system, and run the display eventhistory command to check whether the active/standby switchover event history exists.

1.5.2.2 Querying Alarms and EventsThis topic describes how to query history alarms and events through the maintenance terminal.

ContextUp to 1900 latest fault alarms and recovery alarms, and 1900 event alarms can be saved in thesystem. If the record table is full, and a new alarm or event is generated, the new alarm or eventoverwrites the oldest record in the record table. You can query the records that have beenoverwritten in the NMS database.

The CLI provides multiple ways to query history alarms and events.

Table 1-30 lists the commands for querying history alarms.



1-143

Table 1-30 Commands for querying history alarms

To… Run the Command...

Query alarms by alarmSN

display alarm history alarmsn sn [ detail | list ]

Query alarms by alarmID

display alarm history alarmid id [ detail | list | start-numbernumber]

Query alarms by alarmtype

display alarm history alarmtype type [ detail | list | start-number number]

Query alarms by alarmclass

display alarm history alarmclass class [ detail | list | start-number number]

Query alarms by alarmlevel

display alarm history alarmlevel level [ detail | list | start-number number]

Query alarms by alarmtime

display alarm history alarmtime start start-date start-time endend-date end-time [ start-number number ] [ detail | list | start-number number]

Query alarms by alarmparameter

display alarm history alarmparameter { frameid/slotid/portid |frameid/slotid | frameid | vlanif vlanif } [ detail | list ]

Query all the latestalarms

display alarm history all [ detail | list ]

Table 1-31 lists the commands for querying history events.

Table 1-31 Commands for querying history events


Query events by eventSN

display event history eventsn sn [ detail | list ]

Query events by eventID

display event history eventid id [ detail | list | start-numbernumber]

Query events by eventtype

display event history eventtype type [ detail | list | start-numbernumber]

Query events by eventclass

display event history eventclass class [ detail | list | start-number number]

Query events by eventlevel

display event history eventlevel level [ detail | list | start-number number]

Query events by eventtime

display event history eventtime start start-date start-time end end-date end-time [ start-number number ] [ detail | list | start-number number]




Issue 03 (2010-01-28)


Query events by eventparameter

display event history eventparameter { frameid/slotid/portid |frameid/slotid | frameid | vlanif vlanif } [ detail | list ]

Query all the latestevents

display event history all [ detail | list ]

Procedure

Step 1 Perform an operation (such as inserting and removing a board) to generate an alarm or event.

Step 2 Run the display alarm history command to query history alarms.

Step 3 Run the display event history command to query history events.

----End

ResultYou can query the alarm or event triggered by the operation you have performed.

ExampleTo query the history environment alarms by alarm type, do as follows:

huawei>display alarm history alarmtype{ type<E><communication,service,process,equipment,environment> }:environment{ <cr>|detail<K>|list<K>|start-number<1,1900>||<K> }:list{ <cr>||<K> }:

Command: display alarm history alarmtype environment list ------------------------------------------------------------------------ AlarmSN Date&Time Alarm Name/Para ------------------------------------------------------------------------ 777 2009-08-21 10:18:29 The system resources usage recovers from the overload state to the normal state Resource Name: CPU, Current Percent: 70 765 2009-08-21 10:17:29 The system resources usage exceeds the threshold Resource Name: CPU, Current Percent: 86 764 2009-08-21 10:17:29 The system resources usage recovers from the overload state to the normal state Resource Name: CPU, Current Percent: 86 714 2009-08-20 15:04:35 The system resources usage recovers from the overload state to the normal state Resource Name: CPU, Current Percent: 72 705 2009-08-20 15:03:35 The system resources usage exceeds the threshold Resource Name: CPU, Current Percent: 86 704 2009-08-20 15:03:35 The system resources usage recovers from the overload state to the normal state---- More ( Press 'Q' to break ) ----

To query the history events by event date, and the start date is 2009-08-24, the star time is16:00:00, the end date is 2009-08-24, and the end time is 18:00:00, do as follows:

huawei>display event history{ all<K>|eventclass<K>|eventid<K>|eventlevel<K>|eventparameter<K>|eventsn<K>|eventtime<K>|eventtype<K> }:eventtime



1-145

{ start<K> }:start{ start-date<D><yyyy-mm-dd> }:2009-08-24{ start-time<T><hh:mm:ss> }:16:00:00{ end<K> }:end{ end-date<D><yyyy-mm-dd> }:2009-08-24{ end-time<T><hh:mm:ss> }:18:00:00{ <cr>|detail<K>|list<K>|start-number<1,1900>||<K> }:list{ <cr>||<K> }:

Command: display event history eventtime start 2009-08-24 16:00:00 end 2009-08-24 18:00:00 list ------------------------------------------------------------------------ EventSN Date&Time Event Name/Para ------------------------------------------------------------------------ 35346 2009-08-24 17:59:40 Backing up files fails from the host to the maintenance terminal FrameID: 0, SlotID: 9, Position: -1, Backup type: Host data, Backup Object: Active control board, Failure cause: Failed to transfer the file 35345 2009-08-24 17:58:52 Change of Maintenance User's State User name: test01, Log mode: Telnet, IP: 10.71.42.55, State: Log on 35344 2009-08-24 17:58:47 Change of Maintenance User's State User name: test01, Log mode: Telnet, IP: 10.71.42.55, State: Log off 35343 2009-08-24 17:58:24 Backing up files starts from the host to the maintenance terminal FrameID: 0, SlotID: 9, Position: -1, Backup type: Host data, Backup Object:---- More ( Press 'Q' to break ) ----

1.5.3 Checking the LogIf a fault occurs on the device, you can locate the fault by querying the log.

Procedure

Step 1 Perform an operation (such as adding a board) through the CLI.

Step 2 In the user mode, run the display log command to query the records in the log.

----End

ResultYou can query the log record generated by the operation you have performed.

ExampleTo query the log records of all users within the period from 10:00:00 on 2009-08-24 to 18:00:00on 2009-08-24, do as follows:huawei>display log{ all<K>|cli<K>|failure<K>|index<K>|memory<K>|name<K>|snmp<K> }:all{ <cr>|start-date<D><yyyy-mm-dd> }:2009-08-24{ -<K>|<cr>|start-time<T><hh:mm:ss> }:10:00:00{ -<K>|<cr> }:-{ end-date<D><yyyy-mm-dd> }:2009-08-24{ <cr>|end-time<T><hh:mm:ss> }:18:00:00

Command: display log all 2009-08-24 10:00:00 - 2009-08-24 18:00:00 --------------------------------------------------------------------------- No. UserName Domain IP-Address




Issue 03 (2010-01-28)

65 test03 -- 10.71.42.55 Time: 2009-08-24 17:14:48 Cmd: switch language-mode --------------------------------------------------------------------------- No. UserName Domain IP-Address 64 private -- 10.78.217.35 Time: 2009-08-24 17:08:08 Cmd: Index1: hwFrameIndex: 0 Index2: hwSlotIndex: 9 hwBackupServerIpAddr: 10.78.217.35 hwBackupMode: 3 hwBackupFileName: /bmsuser/7341374.poz hwBackupContent: 68 hwBackupUserNam ... --------------------------------------------------------------------------- No. UserName Domain IP-Address 63 private -- 10.78.217.35---- More ( Press 'Q' to break ) ----

1.6 Supplementary InformationThis topic provides the commissioning supplementary information, including script making,transmission mode setting, and default software settings.

1.6.1 Script MakingBefore the commissioning, you can collect the information such as the data plan according to1.2.4 Planning Data to make a commissioning script. Then, configure the basic data of thedevice by loading the script. This ensures that the device works in the normal state, whichfacilitates the commissioning of the basic functions and services of the device.

1.6.2 Configuring the File Transfer ModeThis topic describes how to configure various file transfer modes, such as Xmodem and TFTP.

1.6.3 Software Package SettingsThis topic provides the default software package settings of the MA5600T.

1.6.1 Script MakingBefore the commissioning, you can collect the information such as the data plan according to1.2.4 Planning Data to make a commissioning script. Then, configure the basic data of thedevice by loading the script. This ensures that the device works in the normal state, whichfacilitates the commissioning of the basic functions and services of the device.

Script OverviewThe basic configuration through the script includes but is not limited to the following items:l Adding the power board

l Configuring the environment monitoring unit (including the FAN and the ESC)

l Configuring the route protocol

NOTEFor details about how to load the script, see 1.3.7 Loading the Script.



1-147

Example ScriptTable 1-32 lists the data plan of an example script. After the example script is configured, youcan log in to the MA5600T through the maintenance terminal in the management center tocommission the basic functions of the device.

Table 1-32 Script data plan

Item Data

PRTE power board Slot IDs: 0/21 and 0/22

FAN l SN: 0

l Sub-node ID: 1 (default)

l Name: FAN

l Fan speed adjustment mode: automatic

ESC l SN: 1

l Sub-node ID: 15 (default)

l Name: H801ESC

Route protocol l Upstream port: 0/19/0

l Management VLAN ID: 100; type: Standard VLAN

l IP address of the L3 interface of the management VLAN:10.50.1.10/24

l Gateway address: 10.50.1.1/24

l IP address of the target network segment: 10.10.1.10/24

The following displays the commands that need to be included in the script according to thepreceding data plan.

CAUTIONEach command in the script must end with a carriage return (CR).

enableconfigboard add 0/21 H801PRTEboard add 0/22 H801PRTEemu add 0 FAN 0 1 FANinterface emu 0fan speed mode automaticquitemu add 1 H801ESC 0 15 H801ESCvlan 100 standardport vlan 100 0/19 0interface vlanif 100ip address 10.50.1.10 24





Issue 03 (2010-01-28)

save

1.6.2 Configuring the File Transfer ModeThis topic describes how to configure various file transfer modes, such as Xmodem and TFTP.

1.6.2.1 Configuring the FTP Transfer ModeThis topic describes how to configure the FTP transfer mode for transferring (uploading ordownloading) files through the inband or outband Ethernet port of the MA5600T. After theconfiguration, the FTP server and the MA5600T can communicate to transfer files in the FTPmode.

1.6.2.2 Configuring the SFTP Transfer ModeThis topic describes how to configure the SFTP transfer mode for transferring (uploading ordownloading) files through the inband or outband Ethernet port of the MA5600T. After theconfiguration, the SFTP server and the MA5600T can communicate to transfer files in the SFTPmode.

1.6.2.3 Configuring the Xmodem Transfer ModeThis topic describes how to configure the Xmodem transfer mode for transferring (uploading ordownloading) files through the maintenance serial port of the MA5600T. After the configuration,the console and the MA5600T can communicate to transfer files in the Xmodem mode.

1.6.2.4 Configuring the TFTP Transfer ModeThis topic describes how to configure the TFTP transfer mode for transferring (uploading ordownloading) files through the inband or outband Ethernet port of the MA5600T. After theconfiguration, the TFTP server and the MA5600T can communicate to transfer files in the TFTPmode.

1.6.2.1 Configuring the FTP Transfer ModeThis topic describes how to configure the FTP transfer mode for transferring (uploading ordownloading) files through the inband or outband Ethernet port of the MA5600T. After theconfiguration, the FTP server and the MA5600T can communicate to transfer files in the FTPmode.

Prerequisitel The Ethernet port of the FTP server is directly connected to the inband or outband Ethernet

port of the MA5600T.– Connect to the inband Ethernet port (Maintenance port) through the crossover cable.

– Connect to the outband Ethernet port (Upstream port) through the direct cable.

l You have logged in to the MA5600T through Telnet from the console (maintenanceterminal), and have entered the global config mode.

Tools, Meters, and Materialsl Crossover cable

l Direct cable

Impact on SystemNone



1-149

Precautions

Make sure that the crossover cable is used to directly connect the FTP server to the MA5600T.In other cases, a straight through cable is used.

Procedure

Step 1 On the FTP server, configure the IP address of its Ethernet port.

Configure the Ethernet port IP address of the FTP server according to the IP address planningin the specific networking, and ensure that the Ethernet port of the FTP server and the inbandor outband Ethernet port of the MA5600T can ping each other.

For example, if the Ethernet port of the FTP server is directly connected to the MA5600T, theIP address of this Ethernet port and the IP address of the inband or outband Ethernet port of theMA5600T must be in the same subnet.

Step 2 On the FTP server, run the FTP application and set related parameters.

After running the FTP application, set the path for saving the file, FTP user name, and password.

Step 3 (This is step is used for setting the FTP user attributes for the manual file transfer.) On theMA5600T, run the ftp set command to set the FTP user name and password.huawei(config)#ftp set User Name(<=40 chars):huawei User Password(<=40 chars):huawei//The input is not displayed on the CLI.

NOTE

By default, the FTP user name is anonymous and the password is [email protected] in theMA5600T system.

Step 4 (Optional; this step is required when the function of database file auto-backup is used.) On theMA5600T, run the file-server auto-backup data command to configure the FTP user name,password, and port ID.huawei(config)#file-server auto-backup data primary 10.10.20.1 ftp path test user User Name(<=40 chars):huawei User Password(<=40 chars):huawei//The input is not displayed on the CLI.

----End

Referencel Any PC that runs the FTP software can serve as an FTP server.

l In the FTP file transfer mode, the user name and the password must be authenticated. Apartfrom setting the user name and password on the FTP server, you also need to set the FTPuser name and password on the FTP client (such as the MA5600T), and make sure that thesettings at both ends are the same.

1.6.2.2 Configuring the SFTP Transfer Mode

This topic describes how to configure the SFTP transfer mode for transferring (uploading ordownloading) files through the inband or outband Ethernet port of the MA5600T. After theconfiguration, the SFTP server and the MA5600T can communicate to transfer files in the SFTPmode.




Issue 03 (2010-01-28)

Prerequisitel The Ethernet port of the SFTP server is directly connected to the inband or outband Ethernet

port of the MA5600T.– Connect to the inband Ethernet port (Maintenance port) through the crossover cable.




l Direct cable

Impact on System

None

Precautions

Make sure that the crossover cable is used to directly connect the SFTP server to theMA5600T. In other cases, a straight through cable is used.

Procedure

Step 1 On the SFTP server, configure the IP address of its Ethernet port.

Configure the Ethernet port IP address of the SFTP server according to the IP address planningin the specific networking, and ensure that the Ethernet port of the SFTP server and the inbandor outband Ethernet port of the MA5600T can ping each other.

For example, if the Ethernet port of the SFTP server is directly connected to the MA5600T, theIP address of this Ethernet port and the IP address of the inband or outband Ethernet port of theMA5600T must be in the same subnet.

Step 2 On the SFTP server, run the SFTP application and set related parameters.

After running the SFTP application, set the path for saving the file, SFTP user name, password,and port ID. The port ID is 22 by default.

Step 3 (This is step is used for setting the SFTP user attributes for the manual file transfer.) On theMA5600T, run the ssh sftp set command to set the SFTP user name, password, and port ID.huawei(config)#ssh sftp set User Name(<=40 chars):huawei User Password(<=40 chars):huawei//The input is not displayed on the CLI. Listening Port(0--65535):22

Step 4 (Optional; this step is required when the function of database file auto-backup is used.) On theMA5600T, run the file-server auto-backup data command to configure the SFTP user name,password, and port ID.huawei(config)#file-server auto-backup data primary 10.10.20.1 sftp path test port 22 user User Name(<=40 chars):huawei User Password(<=40 chars):huawei//The input is not displayed on the CLI.



1-151

NOTE

The MA5600T system does not have default SFTP user name, password, or port ID.

----End

Referencel Any PC that runs the SFTP software can serve as an SFTP server.

l In the SFTP file transfer mode, the user name and the password must be authenticated.Apart from setting the user name, password, and port ID on the SFTP server, you also needto set the SFTP user name, password, and port ID on the SFTP client (such as theMA5600T), and make sure that the settings at both ends are the same.

1.6.2.3 Configuring the Xmodem Transfer ModeThis topic describes how to configure the Xmodem transfer mode for transferring (uploading ordownloading) files through the maintenance serial port of the MA5600T. After the configuration,the console and the MA5600T can communicate to transfer files in the Xmodem mode.

PrerequisiteYou have logged in to the MA5600T through its serial port from the console (maintenanceterminal), and have entered the global config mode.

Tools, Meters, and MaterialsRS-232 serial port cable (for connecting the console to the serial port of the MA5600T for thelogin)


Precautions

CAUTIONBecause the file is transferred through the serial port in the Xmodem transfer mode, the transferspeed of this mode is limited. Condition permitted, it is recommended that other file transfermodes, such as the TFTP mode, be adopted.

l The baud rate of the serial port of the MA5600T must be the same as that of the console.

l Only the active control board can use the Xmodem transfer mode.

l If you log in to the system through Telnet, you cannot use the Xmodem transfer mode.

Procedure

Step 1 Query the serial port baud rate on the MA5600T.




Issue 03 (2010-01-28)

huawei(config)#display baudrate Current active serial baudrate: 9600 bps

Step 2 (Optional; this step is required if the serial port baud rate needs to be re-configured.) On theMA5600T, run the baudrate command to configure its serial port baud rate. A higher baud ratesupports a higher file transfer speed.For example, assuming that the serial port baud rate of the console is 9600 bit/s and the currentserial port baud rate of the MA5600T is 4800 bit/s, run the following command on theMA5600T:huawei(config)#baudrate 9600

Step 3 On the console, open the HyperTerminal and configure its serial port baud rate to be the sameas that of the MA5600T.

----End

1.6.2.4 Configuring the TFTP Transfer ModeThis topic describes how to configure the TFTP transfer mode for transferring (uploading ordownloading) files through the inband or outband Ethernet port of the MA5600T. After theconfiguration, the TFTP server and the MA5600T can communicate to transfer files in the TFTPmode.

Prerequisitel The Ethernet port of the TFTP server is directly connected to the inband or outband Ethernet

port of the MA5600T.



1-153

– Connect to the inband Ethernet port (Maintenance port) through the crossover cable.




l Direct cable


PrecautionsMake sure that the crossover cable is used to directly connect the TFTP server to theMA5600T. In other cases, a straight through cable is used.

Procedure

Step 1 On the TFTP server, configure the IP address of its Ethernet port.

Configure the Ethernet port IP address of the TFTP server according to the IP address planningin the specific networking, and ensure that the Ethernet port of the TFTP server and the inbandor outband Ethernet port of the MA5600T can ping each other.

For example, if the Ethernet port of the TFTP server is directly connected to the MA5600T, theIP address of this Ethernet port and the IP address of the inband or outband Ethernet port of theMA5600T must be in the same subnet.

Step 2 On the TFTP server, run the TFTP application and set related parameters.1. After the TFTP application is run on the TFTP server, an interface as shown in Figure

1-78 is displayed. In the Server interfaces drop-down list, select the IP address that is setin step 1.




Issue 03 (2010-01-28)

Figure 1-78 TFTP main interface

2. In the interface as shown in Figure 1-78, click Settings.3. In the dialog box that is displayed, click Browse to select the path for saving the file, as

shown in Figure 1-79.



1-155

Figure 1-79 Setting TFTP parameters

----End

Referencel Any PC that runs the TFTP software can serve as a TFTP server.

l The IP address in the Server interfaces drop-down list is the IP address of the TFTP server.The TFTP application can identify the IP address automatically. If the TFTP server hasmultiple IP addresses, select the correct one.

l If the TFTP file transfer fails, check the following items:– Whether the selected IP address of the TFTP server is correct.

– Whether the TFTP server can ping the inband or outband Ethernet port of theMA5600T (run the Ping command).

– Whether the TFTP application is running on the TFTP server.

– Whether the path is correctly set in the TFTP application.

– Whether the TFTP file transfer function has been enabled through the command.

– Whether the entered name of the file to be transferred is correct.

1.6.3 Software Package SettingsThis topic provides the default software package settings of the MA5600T.




Issue 03 (2010-01-28)

1.6.3.1 Default settings of the DBA profile

1.6.3.2 Default settings of the GPON ONT capability set profile

1.6.3.3 Default settings of the GPON ONT line profile

1.6.3.4 Default settings of the GPON ONT service profile

1.6.3.5 Default settings of the GPON ONT alarm profile

1.6.3.6 Default settings of the environment monitoring units

1.6.3.1 Default settings of the DBA profile

The following table lists the default settings of the DBA profile on the MA5600T.

Table 1-33 DBA profile

ProfileIndex

Profile Name Default

1 Profile-name dba-profile_1

Profile-ID 1

type 1

Bandwidth compensation No

Fix(kbps) 5120

Assure(kbps) 0

Max(kbps) 0


Profile-ID 2

type 1


Fix(kbps) 1024

Assure(kbps) 0

Max(kbps) 0


Profile-ID 3

type 4


Fix(kbps) 0

Assure(kbps) 0



1-157

ProfileIndex


Max(kbps) 32768


Profile-ID 4

type 1


Fix(kbps) 1024000

Assure(kbps) 0

Max(kbps) 0


Profile-ID 5

type 1


Fix(kbps) 32768

Assure(kbps) 0

Max(kbps) 0


Profile-ID 6

type 1


Fix(kbps) 102400

Assure(kbps) 0

Max(kbps) 0


Profile-ID 7

type 2


Fix(kbps) 0

Assure(kbps) 32768

Max(kbps) 0




Issue 03 (2010-01-28)

ProfileIndex



Profile-ID 8

type 2


Fix(kbps) 0

Assure(kbps) 102400

Max(kbps) 0


Profile-ID 9

type 3


Fix(kbps) 0

Assure(kbps) 32768

Max(kbps) 65536

1.6.3.2 Default settings of the GPON ONT capability set profileThe following table lists the default settings of the GPON ONT capability set profile on theMA5600T.

Table 1-34 GPON ONT capability set profile

ProfileIndex

Parameter Name Default

1 Profile name ont-profile_1

Number of POTS ports 0

Number of ETH ports 1

TDM port type E1

TDM service type TDMoGem

Number of TDM ports 8

Number of MOCA ports 0

Number of CATV UNI ports 0



1-159

ProfileIndex


Mapping mode VLAN ID

The type of flow control PQ




TDM port type E1










TDM port type E1










TDM port type E1







Issue 03 (2010-01-28)

ProfileIndex



Mapping mode PORT + VLAN ID


5 Profile name ONT_PROFILE_HW_OT925



TDM port type E1







6 Profile name ONT_PROFILE_HW_HG850



TDM port type E1






The type of flow control GEMPORT CAR

7 Profile name ONT_PROFILE_HW_HG810



TDM port type E1





1-161

ProfileIndex





The type of flow control GEMPORT CAR

1.6.3.3 Default settings of the GPON ONT line profileThe following table lists the default settings of the GPON ONT line profile on the MA5600T.

Table 1-35 GPON ONT line profile


FEC upstream switch Disable

Qos mode PQ

Mapping mode VLAN

<T-CONT 0> DBA Profile-ID:1

1.6.3.4 Default settings of the GPON ONT service profileThe following table lists the default settings of the GPON ONT service profile on theMA5600T.

Table 1-36 GPON ONT service profile


Port-type POTS Port-number

0

ETH 0

TDM 0

MOCA 0

CATV 0

TDM port type E1


MAC learning function switch Enable




Issue 03 (2010-01-28)


ONT transparent functionswitch

Disable

Multicast forward mode Unconcern

Multicast forward VLAN -

Multicast mode Unconcern

Upstream IGMP packetforward mode

Unconcern

Upstream IGMP packetforward VLAN

-

1.6.3.5 Default settings of the GPON ONT alarm profileThe following table lists the default settings of the GPON ONT alarm profile on theMA5600T.

Table 1-37 GPON ONT alarm profile

ProfileIndex

ProfileName


1 alarm-profile_1

GEM port loss of packets threshold 0

GEM port misinserted packetsthreshold

0

GEM port impaired blocks threshold 0

Ethernet FCS errors threshold 0

Ethernet excessive collision countthreshold

0

Ethernet late collision count threshold 0

Too long Ethernet frames threshold 0

Ethernet buffer (Rx) overflowsthreshold

0

Ethernet buffer (Tx) overflowsthreshold

0

Ethernet single collision frame countthreshold

0

Ethernet multiple collisions framecount threshold

0

Ethernet SQE count threshold 0



1-163

ProfileIndex

ProfileName


Ethernet deferred transmission countthreshold

0

Ethernet internal MAC Tx errorsthreshold

0

Ethernet carrier sense errors threshold 0

Ethernet alignment errors threshold 0

Ethernet internal MAC Rx errorsthreshold

0

PPPOE filtered frames threshold 0

MAC bridge port discarded framesdue to delay threshold

0

MAC bridge port MTU exceededdiscard frames threshold

0

MAC bridge port received incorrectframes threshold

0

CES general error time threshold 0

CES severely time threshold 0

CES bursty time threshold 0

CES controlled slip time threshold 0

CES unavailable time threshold 0

Drop events threshold 0

Undersize packets threshold 0

Fragments threshold 0

Jabbers threshold 0

Failed signal of ONU threshold(Format:1e-x)

3

Degraded signal of ONU threshold(Format:1e-x)

4

1.6.3.6 Default settings of the environment monitoring unitsTables Table 1-38, Table 1-39 list the default settings of the environment monitoring units onthe MA5600T.




Issue 03 (2010-01-28)

Table 1-38 Default settings of the H801ESC board

Parameter Default

Sub-node 15

Analog parameters ESC analog parameter IDsl 0: allocated to the temperature sensor by default (unable to be

changed by the user).l 1-4: allocated to the voltage sensor by default.





l 5-8: user-defined analog parameters allocated to other extendedanalog sensors, such as the humidity sensor.

Upper and lower alarm thresholdsl Temperature: 5ºC to 55ºC

l Humidity: 0% RH to 80% RH

Digital parameters ESC digital parameter IDsl Allocated by default (unable to be changed by the user)

– 0: MDF

– 1: door status sensor 0

– 9: water

– 10-13: lightning arresters 0-3





– 22: external sensor power

l User-defined IDs– 2-8: allocated to other extended digital sensors.

Definition of user-defined alarm indexes1: AC voltage; 2: AC switch; 3: battery voltage; 4: battery fuse; 5: loadfuse; 6: rectifier unit; 7: secondary power supply; 8: door status of thecabinet; 9: door status of the equipment room; 10: window; 11: theft;12: MDF; 13: fan; 14: fire; 15: smoke; 16: water; 17: diesel; 18:abnormal smell 19: air conditioner; 20: lightning arrester; 21: user-defined alarms of digital parameters



1-165

Table 1-39 Default settings of the FAN

Parameter Default

Sub-node 1

Fan speedadjustment mode

Automatic

Whether to reportthe fan alarm

Permit




Issue 03 (2010-01-28)

2 Basic Configurations

About This Chapter

Basic configurations mainly include certain common configurations, public configurations, andpre-configurations in service configurations. There is no obvious logical relation between basicconfigurations. You can perform basic configurations according to actual requirements.

2.1 Configuring the License FunctionWith the license platform enabled, the license server performs license control on the functionentries and resource entries supported by the MA5600T and provides customized services forusers.

2.2 Configuring AlarmsAlarm management includes the following functions: alarm record, alarm setting, and alarmstatistics. These functions help you to maintain the device and ensure that the device worksefficiently.

2.3 Configuring the System ClockThis topic describes how to configure the system clock to restrict the clock frequency and phaseof each node on a network within the preset tolerance scope. This prevents transmissionperformance deterioration caused by poor timing at both the transmit and receive ends in thedigital transmission system.

2.4 Configuring the Network TimeConfiguring the NTP protocol to keep the time of all devices in the network synchronized, sothat the MA5600T implement various service applications based on universal time, such as thenetwork management system and the network accounting system.

2.5 Adding Port DescriptionThis topic describes how to add port description.

2.6 Configuring the Auto-save FunctionThis topic describes how to configure the auto-save function so that the system configurationdata or database files can be saved automatically.

2.7 Configuring the Attributes of an Upstream Ethernet PortThis topic describes how to configure the attributes of a specified Ethernet port so that the systemcommunicates with the upstream device in the normal state.

2.8 Configuring the ANCP

SmartAX MA5600TCommissioning and Configuration Guide 2 Basic Configurations


2-1

Access Node Control Protocol (ANCP) is used to implement the functions such as topologydiscovery, line configuration, and L2C OAM on the user ports. The MA5600T establishes anANCP session according to the GSMP communication IP address configured in the networkaccess server (NAS).

2.9 Configuring DHCPThe MA5600T can implement DHCP relay and DHCP proxy on a network. Configuring DHCPrelay is applicable to the scenario where users dynamically obtain IP addresses from the DHCPserver through DHCP. In DHCP proxy, the MA5600T proxy can implement certain functionsof the DHCP server.

2.10 Configuring a VLANConfiguring VLAN is a prerequisite for configuring a service. Hence, before configuring aservice, make sure that the VLAN configuration based on planning is complete.

2.11 Configuring System SecurityThis topic describes how to configure the network security and protection measures of the systemto protect the system from malicious attacks.

2.12 Configuring the User SecurityConfiguring the security mechanism can protect operation users and access users against useraccount theft and roaming or from the attacks from malicious users.

2.13 Configuring AAAThis topic describes how to configure the AAA on the MA5600T, including configuring theMA5600T as the local and remote AAA servers.

2.14 Configuring the ACLThis topic describes the type, rule, and configuration of the ACL on the MA5600T.

2.15 Configuring QoSThis topic describes how to configure quality of service (QoS) on the MA5600T.

2.16 Configuring GPON ProfilesConfiguring an GPON Profile is a prerequisite for configuring an GPON access service. Thistopic describes how to configure a DBA profile and an GPON ONT profile.

2 Basic ConfigurationsSmartAX MA5600T



Issue 03 (2010-01-28)

2.1 Configuring the License FunctionWith the license platform enabled, the license server performs license control on the functionentries and resource entries supported by the MA5600T and provides customized services forusers.

PrerequisiteThe license platform must be enabled.

Application ContextThe license platform provides the registration mechanism for the service modules of theMA5600T. During system initialization, the service modules need to register for the controlledresource entries or the controlled function entries. After the system starts to work, based on thecontrolled entries that are registered, the license client management module obtains theauthentication information about the license controlled entries of the MA5600T the licenseserver.

When a service module is configured through the CLI or NMS, the device checks whether theresource entries of the service module or the function entries of the service module areoverloaded.l If overload occurs, the system quits the service configuration and displays a prompt of

insufficient license resources.l If overload does not occur, the system allows the user to continue configuring and using

the service. When the service configuration is deleted, the system automatically releasesthe license resources occupied by the service configuration.

Background Informationl The MA5600Tadopts the network license solution, that is, a license server is deployed in

the network. In this case, each MA5600T is like a license client, and the licenses of all theclients are managed by the license server in a centralized manner.

l In the management scope of the license server (generally a region or a city), each producthas only one license file that is stored on the license server. The resources of the productthat are controlled by the license are defined by the license file. Because one license servercan manage multiple products, multiple license files can be stored on one license server.

PrecautionsIf you need to use the license function supported by the MA5600T, be sure to consider thedeployment of the license server in network planning.

Procedure

Step 1 Configure the interface that is for communicating with the license server.1. Run the vlan command to create a VLAN.2. Run the port vlan command to add an upstream port to the VLAN.3. (Optional) Run the native-vlancommand to configure the default VLAN of the upstream

port.



2-3

Whether the native VLAN needs to be set for the upstream port depends on whether theupper-layer device connected to the upstream port supports packets carrying a VLAN tag.The setting on the MA5600T must be the same as that on the upper-layer device.

4. Run the ip address command to configure the IP address of the VLAN L3 interface so thatthe IP packets in the VLAN are forwarded by using this IP address.

5. Run the ip route-static command to configure the static route to the license server.

Step 2 Run the license esn command to configure the ESN of the device.Each client of the license server is uniquely identified by the ESN. The ESN should be configuredif the user enables the license function. The ESN can be the NMS IP address of the device orthe IP address of the VLAN L3 interface.

Step 3 Run the license server command to configure the license server.If the user enables the license function, configure the IP address and TCP port ID of the licenseserver so that the license server can communicate with the client.

Step 4 Run the display license info command to query the communication status between the deviceand the license server.

----End

Example

To configure smart VLAN ID of the MA5600Tto 10, configure the IP address of the L3 interfaceto 10.10.10.10/24, configure the MA5600T to communicate with the license server (IP address:10.20.20.2/24) through port 0/19/0 and configure the TCP port ID to 10010, do as follows:

huawei(config)#vlan 10 smarthuawei(config)#port vlan 10 0/19/0huawei(config)#interface vlanif 10huawei(config-if-vlanif10)#ip address 10.10.10.10 24huawei(config-if-vlanif10)#quithuawei(config)#ip route-static 10.20.20.0 24 10.10.10.1huawei(config)#license esn 10.10.10.10huawei(config)#license server ipaddress 10.20.20.2 tcpport 10010

2.2 Configuring AlarmsAlarm management includes the following functions: alarm record, alarm setting, and alarmstatistics. These functions help you to maintain the device and ensure that the device worksefficiently.

Background Information

An alarm refers to the notification of the system after a fault is detected. After an alarm isgenerated, the system broadcasts the alarm to the terminals, mainly including the NMS and CLIterminals.

Alarms are classified into fault alarm and recovery alarm. After a fault alarm is generated at acertain time, the fault alarm lasts till the fault is rectified to clear the alarm.

You can modify the alarm settings according to your requirements. The settings are alarmseverity, alarm output mode through the CLI and alarm statistics switch.




Issue 03 (2010-01-28)

Procedurel Run the alarm active clear command to clear the alarms that are not recovered in the

system.– When an active alarm lasts a long time, you can run this command to clear the alarm.

– Before clearing an alarm, you can run the display alarm active command to query thecurrently active alarms.

l Run the alarm alarmlevel command to configure the alarm level.– Alarm levels are critical, major, minor, and warning.

– Parameter default indicates restoring the alarm level to the default setting.

– You can run the display alarm list command to query the alarm level.

– The system specifies the default (also recommended) alarm level for each alarm. Usethe default alarm level unless otherwise required.

l Run the alarm jitter-proof command to configure the alarm jitter-proof function and thejitter-proof period.– To prevent a fault alarm and its recovery alarm from being displayed frequently, you

can enable the alarm jitter-proof function to filter alarms in the system.– After the alarm jitter-proof function is enabled, the alarm in the system is not reported

to the NMS immediately but is reported to the NMS after an alarm jitter-proof period.– If an alarm is recovered in an alarm jitter-proof period, the alarm is not reported to the

NMS.– You can run the display alarm jitter-proof command to check whether the alarm jitter-

proof function is enabled and whether the alarm jitter-proof period is set.– By default, the alarm jitter-proof function is disabled. You can determine whether to

enable the function according to the running of the device.l Run the alarm output/undo alarm output command to set or shield the output of alarms

to the CLI terminal.– Setting the output mode of alarms does not affect the generating of alarms. The alarms

generated by the system are still recorded. You can run the display alarm historycommand to query the alarms that are shielded.

– When the new output mode of an alarm conflicts with the previous mode, the new outputmode takes effect.

– The output mode of the recovery alarm is the same as the output mode of the fault alarm.When the output mode of the fault alarm is set, the system automatically synchronizesthe output mode of its recovery alarm. The reverse is also applicable.

l Run the alarm-event statistics period command to set the alarm statistics collectionperiod.– The system collects the occurrence time of alarms and events according to the set period.

To save the statistical result, run the alarm-event statistics save command to save thestatistics to the flash memory.

– You can use the statistical result of alarms and events to locate a problem in the system.

– You can run the display alarm statistics command to query the alarm statistical record.

l Run the display alarm configuration command to query the alarm configuration accordingto the alarm ID. The alarm configuration that you can query includes the alarm ID, alarmname, alarm class, alarm type, alarm level, default alarm level, number of parameters, CLIoutput flag, conversion flag, and detailed alarm description.



2-5

l Run the display alarm statistics command to query the alarm statistical record.– When you need to know the frequency in which one alarm occurs within a time range,

and to know the working conditions of the device and analyze the fault that may exist,run this command.

– Currently, you can query the alarm statistics in the current 15 minutes, current 24 hours,last 15 minutes, and last 24 hours in the system.

----End

ExampleAssume the following configurations: The output of all alarms at level warning are shielded tothe CLI terminal, the alarm jitter-proof function is enabled, the alarm jitter-proof period is setto 15s, the level of alarms with IDs 0x0a310021 and 0x2e314021 are modified to critical, andthe statistical record of alarms at level critical is saved to the flash memory so that a problemcan be located through the alarm statistical record. To perform these configurations, do asfollows:huawei(config)#undo alarm output alarmlevel warninghuawei(config)#alarm jitter-proof onhuawei(config)#alarm jitter-proof 15huawei(config)#alarm alarmlevel 0x0a310021 criticalhuawei(config)#alarm alarmlevel 0x2e314021 criticalhuawei(config)#alarm-event statistics save

2.3 Configuring the System ClockThis topic describes how to configure the system clock to restrict the clock frequency and phaseof each node on a network within the preset tolerance scope. This prevents transmissionperformance deterioration caused by poor timing at both the transmit and receive ends in thedigital transmission system.


On a digital network comprising the MA5600T and other devices, the primary problem is clocksynchronization. To ensure that the system uses a unified time standard, you must specify theclock signals from a certain port as the system clock source.

The clock source can be an external BITS clock or a line clock from the upper-layer node. Theclock module automatically judges the types of the specified clock sources (BITS, TDM, orSDH), and sends them according to their priorities to the clock module, serving as clock sourcefor phase lock.

Procedure

Step 1 Run the clock source command to configure the system clock source.Specify the clock signals extracted from a certain port as the system clock source.l The system supports up to 10 clock sources.

l You can specify a clock source for the TDM clock and the SDH clock.

Step 2 Run the clock priority command to configure the priority of the clock source.l The system supports 10 clock source priorities. The highest priority is p0 and the lowest

priority is p9.




Issue 03 (2010-01-28)

l The system cannot judge the quality of the clock source. Therefore, you should configurethe clock source of high quality with a high priority.

l After the priority of the clock source is configured, the system selects the clock source withthe highest priority and in the normal state as the system clock source.

l When the clock source with the highest priority is faulty, the system automatically switchesto the clock source with the second highest priority.

l When the clock source with the highest priority recovers, the system switches back to thisclock source.

Step 3 Run the display clock source command to query the system clock configuration.

----End

ExampleTo obtain two clock sources from ports 0/6/0 and 0/6/2 of the TOPA board as clock source 0and clock source 2 of the system, configure clock source 2 with the highest priority, and configureclock source 0 with the second highest priority, do as follows:huawei(config)#clock source 0 0/6/0huawei(config)#clock source 2 0/6/2huawei(config)#clock priority 2/0

2.4 Configuring the Network TimeConfiguring the NTP protocol to keep the time of all devices in the network synchronized, sothat the MA5600T implement various service applications based on universal time, such as thenetwork management system and the network accounting system.


Introduction to the NTP Protocol:

l The Network Time Protocol (NTP) is an application layer protocol defined in RFC 1305,which is used to synchronize the times of the distributed time server and the client. TheRFC defines the structures, arithmetics, entities and protocols used in the implementationof NTP.

l NTP is developed from the time protocol and the ICMP timestamp message protocol, withspecial design on the aspects of accuracy and robustness.

l NTP runs over UDP with port number as 123.

l Any local system that runs NTP can be time synchronized by other clock sources, and alsoact as a clock source to synchronize other clocks. In addition, mutual synchronization canbe done through NTP packets exchanges.

NTP is applied to the following situations where all the clocks of hosts or routers in a networkneed to be consistent:

l In the network management, an analysis of log or debugging information collected fromdifferent routers needs time for reference.

l The charging system requires the clocks of all devices to be consistent.

l Completing certain functions, for example, timing restart of all the routers in a networkrequires the clocks of all the routers be consistent.



2-7

l When several systems work together on the same complicate event, they have to take thesame clock for reference to ensure correct implementation order.

l Incremental backup between the backup server and clients requires clocks on them besynchronized.

When all the devices on a network need to be synchronized, it is almost impossible for anadministrator to manually change the system clock by command line. This is because the workload is heavy and clock accuracy cannot be ensured. NTP can quickly synchronize the clocksof network devices and ensure their precision.

There are four NTP modes: server/client, peer, broadcast and multicast modes. The MA5600Tsupports all these modes.

Default ConfigurationTable 2-1 provides the default configuration for NTP.

Table 2-1 Default configuration for NTP


NTP-service authenticationfunction

Disable

NTP-service authenticationkey

None

The maximum allowednumber of sessions

100

Clock stratum 16

2.4.1 (Optional) Configuring NTP AuthenticationThis topic describes how to configure NTP authentication to improve the network security andprevent unauthorized users from modifying the clock.

2.4.2 Configuring the NTP Broadcast ModeThis topic describes how to configure the MA5600T for clock synchronization in the NTPbroadcast mode. After the configuration is completed, the server periodically broadcasts clocksynchronization packets through a specified port, and the client listens to the broadcast packetssent from the server and synchronizes the local clock according to the received broadcast packets.

2.4.3 Configuring the NTP Multicast ModeThis topic describes how to configure the MA5600T for clock synchronization in the NTPmulticast mode. After the configuration is completed, the server periodically multicasts clocksynchronization packets through a specified port, and the client listens to the multicast packetssent from the server and synchronizes the local clock according to the received multicast packets.

2.4.4 Configuring the NTP Client/Server ModeThis topic describes how to configure the MA5600T as the NTP client to synchronize with theNTP server in the network.

2.4.5 Configuring the NTP Peer ModeThis topic describes how to configure the MA5600T for clock synchronization in the NTP peermode. In the peer mode, configure only the active peer, and the passive peer need not be




Issue 03 (2010-01-28)

configured. In the peer mode, the active peer and the passive peer can synchronize with eachother. The peer with a higher clock stratum is synchronized by the peer with a lower clockstratum.

2.4.1 (Optional) Configuring NTP AuthenticationThis topic describes how to configure NTP authentication to improve the network security andprevent unauthorized users from modifying the clock.

PrerequisiteBefore configuring the NTP client/server mode, make sure that the network interface and therouting protocol of the MA5600T are configured so that the server and the client are reachableto each other at the network layer.

Background InformationIn certain networks that have strict requirements on security, enable NTP authentication whenrunning the NTP protocol. Configuring NTP authentication is classified into configuring NTPauthentication on the client and configuring NTP authentication on the server.

Precautionsl If NTP authentication is not enabled on the client, the client can synchronize with the server,

regardless of whether NTP authentication is enabled on the server.l If NTP authentication is enabled, a reliable key should be configured.

l The configuration of the server must be the same as that of the client.

l When NTP authentication is enabled on the client, the client can pass the authentication ifthe server is configured with the same key as that of the client. In this case, you need notenable NTP authentication on the server or declare that the key is reliable.

l The client synchronizes with only the server that provides the reliable key. If the keyprovided by the server is unreliable, the client does not synchronize with the server.

l The flow of configuring NTP authentication is as follows: start->enable NTPauthentication->configure the reliable NTP authentication key->declare the reliable key->end.

Procedure

Step 1 Run the ntp-service authentication enable command to enable NTP authentication.

Step 2 Run the ntp-service authentication-keyid command to set an NTP authentication key.

Step 3 Run the ntp-service reliable authentication-keyid command to declare that the key is reliable.

----End

ExampleTo enable NTP authentication, set the NTP authentication key as aNiceKey with the key number42, and then define key 42 as a reliable key, do as follows:

huawei(config)#ntp-service authentication enablehuawei(config)#ntp-service authentication-keyid 42 authentication-mode md5



2-9

aNiceKeyhuawei(config)#ntp-service reliable authentication-keyid 42

2.4.2 Configuring the NTP Broadcast ModeThis topic describes how to configure the MA5600T for clock synchronization in the NTPbroadcast mode. After the configuration is completed, the server periodically broadcasts clocksynchronization packets through a specified port, and the client listens to the broadcast packetssent from the server and synchronizes the local clock according to the received broadcast packets.

PrerequisiteBefore configuring the NTP broadcast mode, make sure that the network interface and the routingprotocol of the MA5600T are configured so that the server and the client are reachable to eachother at the network layer.


In the broadcast mode, the server periodically sends clock synchronization packets to thebroadcast address 255.255.255.255, with the mode field set to 5 (indicating the broadcast mode).The client listens to the broadcast packets sent from the server. After receiving the first broadcastpacket, the client exchanges NTP packet whose mode fields are set to 3 (client mode) and 4(server mode) with the server to estimate the network delay between the client and the server.The client then enters the broadcast client mode, continues to listen to the incoming broadcastpackets, and synchronizes the local clock according to the incoming broadcast packets, as shownin Figure 2-1.

Figure 2-1 NTP broadcast mode

Precautions

1. In the broadcast mode, you should configure both the NTP server and the NTP client.

2. The clock stratum of the synchronizing device must be lower than or equal to that of thesynchronized device. Otherwise, the clock synchronization fails.




Issue 03 (2010-01-28)

Procedurel Configure the NTP broadcast server host.

1. Run the ntp-service refclock-master command to configure the local clock as themaster NTP clock, and specify the stratum of the master NTP clock.

2. (Optional) Configure NTP authentication.In certain networks that have strict requirements on security, it is recommended thatyou enable NTP authentication when running the NTP protocol. The configuration ofthe server must be the same as that of the client.

(1) Run the ntp-service authentication enable command to enable NTPauthentication.

(2) Run the ntp-service authentication-keyid command to set an NTPauthentication key.

(3) Run the ntp-service reliable authentication-keyid command to declare that thekey is reliable.

3. Add a VLAN L3 interface.

(1) Run the vlan command to create a VLAN.(2) Run the port vlan command to add an upstream port to the VLAN so that the

user packets carrying the VLAN tag are transmitted upstream through theupstream port.

(3) In the global config mode, run the interface vlan command to create a VLANinterface, and then enter the VLAN interface mode to configure the L3 interface.

(4) Run the ip address command to configure the IP address and subnet mask of theVLAN interface so that the IP packets in the VLAN can participate in the L3forwarding.

4. Run the ntp-service broadcast-server command to configure the NTP broadcastserver mode of the host, and specify the key ID for the server to send packets to theclient.

l Configure the NTP broadcast client host.1. (Optional) Configure NTP authentication.

In certain networks that have strict requirements on security, it is recommended thatyou enable NTP authentication when running the NTP protocol. The configuration ofthe server must be the same as that of the client.










2-11


3. Run the ntp-service broadcast-client command to configure a host as the NTPbroadcast client.

----End

ExampleAssume the following configurations: MA5600T_S uses the local clock as the master NTP clockon stratum 2 and works in the NTP broadcast mode, broadcasting clock synchronization packetsperiodically through IP address 10.10.10.10/24 of the L3 interface of VLAN 2, andMA5600T_C functions as the NTP client, listening to the broadcast packets sent from the serverthrough IP address 10.10.10.20/24 of the L3 interface of VLAN 2 and synchronizing with theclock on the broadcast server. To perform these configurations, do as follows:

1. On MA5600T_S:huawei(config)#ntp-service refclock-master 2huawei(config)#vlan 2 standardhuawei(config)#port vlan 2 0/19 0huawei(config)#interface vlanif 2huawei(config-if-vlanif2)#ip address 10.10.10.10 24huawei(config-if-vlanif2)#ntp-service broadcast-serverhuawei(config-if-vlanif2)#quit

2. On MA5600T_C:huawei(config)#vlan 2 standardhuawei(config)#port vlan 2 0/19 0huawei(config)#interface vlanif 2huawei(config-if-vlanif2)#ip address 10.10.10.20 24huawei(config-if-vlanif2)#ntp-service broadcast-clienthuawei(config-if-vlanif2)#quit

2.4.3 Configuring the NTP Multicast ModeThis topic describes how to configure the MA5600T for clock synchronization in the NTPmulticast mode. After the configuration is completed, the server periodically multicasts clocksynchronization packets through a specified port, and the client listens to the multicast packetssent from the server and synchronizes the local clock according to the received multicast packets.

PrerequisiteBefore configuring the NTP multicast mode, make sure that the network interface and the routingprotocol of the MA5600T are configured so that the server and the client are reachable to eachother at the network layer.

Background InformationIn the multicast mode, the server periodically sends clock synchronization packets to themulticast address configured by the user. The default NTP multicast address 224.0.1.1 is usedif the multicast address is not configured. The mode field of clock synchronization packet is setto 5 (multicast mode). The client listens to the multicast packets sent from the server. Afterreceiving the first multicast packet, the client exchanges NTP packet whose mode fields are setto 3 (client mode) and 4 (server mode) with the server to estimate the network delay betweenthe client and the server. The client then enters the multicast client mode, continues to listen tothe incoming multicast packets, and synchronizes the local clock according to the incomingmulticast packets, as shown in Figure 2-2.




Issue 03 (2010-01-28)

Figure 2-2 NTP multicast mode

Precautions1. In the multicast mode, you should configure both the NTP server and the NTP client.2. The clock stratum of the synchronizing device must be lower than or equal to that of the

synchronized device. Otherwise, the clock synchronization fails.

Procedurel Configure the NTP multicast server host.

1. Run the ntp-service refclock-master command to configure the local clock as themaster NTP clock, and specify the stratum of the master NTP clock.

2. (Optional) Configure NTP authentication.In certain networks that have strict requirements on security, it is recommended thatyou enable NTP authentication when running the NTP protocol. The configuration ofthe server must be the same as that of the client.











2-13

4. Run the ntp-service multicast-server command to configure the NTP multicastserver mode of the host, and specify the key ID for the server to send packets to theclient.

l Configure the NTP multicast client host.1. (Optional) Configure NTP authentication.

In certain networks that have strict requirements on security, it is recommended thatyou enable NTP authentication when running the NTP protocol. The configuration ofthe server must be the same as that of the client.









3. Run the ntp-service multicast-client command to configure a host as the NTPmulticast client.

----End

ExampleAssume the following configurations: MA5600T_S uses the local clock as the master NTP clockon stratum 2 and works in the NTP multicast mode, multicasting clock synchronization packetsperiodically through IP address 10.10.10.10/24 of the L3 interface of VLAN 2, andMA5600T_C functions as the NTP client, listening to the multicast packets sent from the serverthrough IP address 10.10.10.20/24 of the L3 interface of VLAN 2 and synchronizing with theclock on the multicast server. To perform these configurations, do as follows:

1. On MA5600T_S:huawei(config)#ntp-service refclock-master 2huawei(config)#vlan 2 standardhuawei(config)#port vlan 2 0/19 0huawei(config)#interface vlanif 2huawei(config-if-vlanif2)#ip address 10.10.10.10 24huawei(config-if-vlanif2)#ntp-service multicast-serverhuawei(config-if-vlanif2)#quit

2. On MA5600T_C:huawei(config)#vlan 2 standardhuawei(config)#port vlan 2 0/19 0huawei(config)#interface vlanif 2huawei(config-if-vlanif2)#ip address 10.10.10.20 24huawei(config-if-vlanif2)#ntp-service multicast-clienthuawei(config-if-vlanif2)#quit




Issue 03 (2010-01-28)

2.4.4 Configuring the NTP Client/Server ModeThis topic describes how to configure the MA5600T as the NTP client to synchronize with theNTP server in the network.

PrerequisiteBefore configuring the NTP client/server mode, make sure that the network interface and therouting protocol of the MA5600T are configured so that the server and the client are reachableto each other at the network layer.

Background InformationIn the client/server mode, the client sends a synchronization packet to the server, with the modefield set to 3 (client mode). After receiving the packet, the server automatically enters the servermode and sends a response packet with the mode field set to 4 (server mode). After receivingthe response from the server, the client filters and selects the clock, and synchronizes with thepreferred server, as shown in Figure 2-3.

Figure 2-3 NTP client/server mode

Precautions1. In the client/server mode, you need to configure only the client, and need not configure the

server.2. The clock stratum of the synchronizing device must be lower than or equal to that of the

synchronized device. Otherwise, the clock synchronization fails.

Procedure

Step 1 Add a VLAN L3 interface.

1. Run the vlan command to create a VLAN.2. Run the port vlan command to add an upstream port to the VLAN so that the user packets

carrying the VLAN tag are transmitted upstream through the upstream port.3. In the global config mode, run the interface vlan command to create a VLAN interface,

and then enter the VLAN interface mode to configure the L3 interface.



2-15

4. Run the ip address command to configure the IP address and subnet mask of the VLANinterface so that the IP packets in the VLAN can participate in the L3 forwarding.

Step 2 Run the ntp-service unicast-server command to configure the NTP unicast server mode, andspecify the IP address of the remote server that functions as the local timer server and the interfacefor transmitting and receiving NTP packets.

NOTE

l In this command, ip-address is a unicast address, which cannot be a broadcast address, a multicast address,or the IP address of a local clock.

l After the source interface of the NTP packets is specified by source-interface, the source IP address of theNTP packets is configured as the primary IP address of the specified interface.

l A server can function as a time server to synchronize other devices only after its clock is synchronized.

l When the clock stratum of the server is higher than or equal to that of the client, the client does notsynchronize with the server.

l You can run the ntp-service unicast-server command for multiple times to configure multiple servers.Then, the client selects the best server according to clock priorities.

Step 3 (Optional) Configure the ACL rules.Filter the packets that pass through the L3 interface. Only the IP packet from the clock server isallowed to access the L3 interface. Other unauthorized packets are not allowed to access the L3interface. It is recommended to use the ACL rules for the system that has high requirements onsecurity.1. Run the acl adv-acl-numbe command to create an ACL.2. Run the rule command to classify traffic according to the source IP address, destination IP

address, type of the protocol over IP, and features or protocol of the packet, allowing orforbidding the data packets that meet related conditions to pass.

3. Run the packet-filter command to configure an ACL filtering rule for a specified port, andmake the configuration take effect.

----End

ExampleAssume the following configurations: One MA5600T functions as the NTP server (IP address:10.20.20.20/24), the other MA5600T (IP address of the L3 interface of VLAN 2: 10.10.10.10/24,gateway IP address: 10.10.10.1) functions as the NTP client, the NTP client sends the clocksynchronization request packet through the VLAN L3 interface to the NTP server, the NTPserver responds to the request packet, and ACL rules are configured to allow only IP packetsfrom the clock server to access the L3 interface. To perform these configurations, do as follows:huawei(config)#vlan 2 standardhuawei(config)#port vlan 2 0/19 0huawei(config)#interface vlanif 2huawei(config-if-vlanif2)#ip address 10.10.10.10 24huawei(config-if-vlanif2)#quithuawei(config)#ntp-service unicast-server 10.20.20.20 source-interface vlanif 2huawei(config)#acl 3010huawei(config-acl-adv-3010)#rule deny ip source any destination 10.10.10.10 0.0.0.0huawei(config-acl-adv-3010)#rule permit ip source 10.20.20.20 0.0.0.0 destination 10.10.10.10 0.0.0.0huawei(config-acl-adv-3010)#quithuawei(config)#packet-filter inbound ip-group 3010 port 0/19/0

2.4.5 Configuring the NTP Peer ModeThis topic describes how to configure the MA5600T for clock synchronization in the NTP peermode. In the peer mode, configure only the active peer, and the passive peer need not be




Issue 03 (2010-01-28)

configured. In the peer mode, the active peer and the passive peer can synchronize with eachother. The peer with a higher clock stratum is synchronized by the peer with a lower clockstratum.

PrerequisiteBefore configuring the NTP peer mode, make sure that the network interface and the routingprotocol of the MA5600T are configured so that the server and the client are reachable to eachother at the network layer.

Background InformationIn the peer mode, the active peer and the passive peer exchange NTP packets whose mode fieldsare set to 3 (client mode) and 4 (server mode). Then, the active peer sends a clock synchronizationpacket to the passive peer, with the mode field of the packet set to 1 (active peer). After receivingthe packet, the passive peer automatically works in the passive mode and sends a response packetwith the mode field set to 2 (passive peer). Through packet exchange, the peer mode is set up.The active peer and the passive peer can synchronize with each other. If both the clock of theactive peer and that of the passive peer are synchronized, the clock on a lower stratum is used,as shown in Figure 2-4.

Figure 2-4 NTP peer mode

Precautions1. In the peer mode, you need to configure the NTP mode only on the active peer.2. The peers determine clock synchronization according to the clock stratum instead of

according to whether the peer is an active peer.

Procedure

Step 1 Configure the NTP active peer.1. Run the ntp-service refclock-master command to configure the local clock as the master

NTP clock, and specify the stratum of the master NTP clock.



2-17

2. Run the ntp-service unicast-peer command to configure the NTP peer mode, and specifythe IP address of the remote server that functions as the local timer server and the interfacefor transmitting and receiving NTP packets.

NOTE

l In this command, ip-address is a unicast address, which cannot be a broadcast address, a multicastaddress, or the IP address of a reference clock.

l After the source interface of the NTP packets is specified by source-interface, the source IP addressof the NTP packets is configured as the primary IP address of the specified interface.

Step 2 Add a VLAN L3 interface.

1. Run the vlan command to create a VLAN.

2. Run the port vlan command to add an upstream port to the VLAN so that the user packetscarrying the VLAN tag are transmitted upstream through the upstream port.

3. In the global config mode, run the interface vlan command to create a VLAN interface,and then enter the VLAN interface mode to configure the L3 interface.

4. Run the ip address command to configure the IP address and subnet mask of the VLANinterface so that the IP packets in the VLAN can participate in the L3 forwarding.

----End

ExampleAssume the following configurations: One MA5600T functions as the NTP active peer (IPaddress of the L3 interface of VLAN 2: 10.10.10.10/24) and works on clock stratum 4, the otherMA5600T (IP address: 10.10.10.20/24) functions as the NTP passive peer, the active peer sendsa clock synchronization request packet through the VLAN L3 interface to the passive peer, thepassive peer responds to the request packet, and the peer with a higher clock stratum issynchronized by the peer with a lower clock stratum. To perform these configurations, do asfollows:huawei(config)#ntp-service refclock-master 4huawei(config)#ntp-service unicast-peerhuawei(config)#vlan 2 standardhuawei(config)#port vlan 2 0/19 0huawei(config)#interface vlanif 2huawei(config-if-vlanif2)#ip address 10.10.10.10 24huawei(config-if-vlanif2)#quit

2.5 Adding Port DescriptionThis topic describes how to add port description.

PrerequisiteA board must be added to the system.


After the description of a physical port on the board is added, the description facilitatesinformation query in system maintenance.




Issue 03 (2010-01-28)

Procedure

Step 1 In the global config mode, run the port desc command to add port description.Port description is a character string, used to identify a port on a board in a slot of a shelf.

Step 2 Run the display port desc command to query port description.

----End

Example

Plan the format of user port description as "community ID-building ID-floor ID/shelf ID-slotID-port ID". "Community ID-building ID-floor ID" indicates the physical location where theuser terminal is deployed, and shelf ID-slot ID-port ID" indicates the physical port on the localdevice that is connected to the user terminal. This plan can present the user terminal locationand the connection between the user terminal and the device, which facilitates query inmaintenance. Assume that the user terminal that is connected to port 0/2/0 of the MA5600T isdeployed in floor 1, building 01 of community A. To add port description according to the plan,do as follows:

huawei(config)#port desc 0/2/0 description A-01-01/0-2-0huawei(config)#display port desc 0/2/0 ------------------------------------------------------------ F/ S/ P IMA Group Port Description ------------------------------------------------------------ 0/ 2/ 0 - A-01-01/0-2-0 ------------------------------------------------------------

2.6 Configuring the Auto-save FunctionThis topic describes how to configure the auto-save function so that the system configurationdata or database files can be saved automatically.


The MA5600T supports two auto-save modes:

l Auto-save at preset interval.

l Auto-save at preset time.

Pay attention to the following points:

l Auto-save at preset time conflicts with auto-save at preset interval. You can enable onlyone of them.

l Saving data frequently affects the system. Therefore, an auto-save interval shorter than oneday is not recommended, and it is recommended that you set the interval equal to or longerthan one day.

l Before the system upgrade operation, run the autosave interval off or autosave time offcommand to disable the auto-save function to prevent upgrade failure due to the conflictbetween upgrade and auto-save operations.



2-19

CAUTIONAfter the system upgrade is completed, you must re-enable the auto-save function if theauto-save function is required.

Configuration FlowchartFigure 2-5 shows the flowchart for configuring the auto-save function.

Figure 2-5 Flowchart for configuring the auto-save function

Procedurel Configure auto-save at preset interval.

1. In the global config mode, run the autosave interval on command to enable auto-saveat preset interval.Auto-save at preset interval conflicts with auto-save at preset time. You can enableonly one of them.

2. (Optional) In the global config mode, run the autosave interval configurationcommand to set the auto-save interval for modified system data.Auto-save is performed according to the interval set by the user. The system checkswhether the system data is modified at each interval. If the system data is modified,




Issue 03 (2010-01-28)

the system saves the data. Otherwise, the system does not save the data. By default,the interval is 30 minutes.

3. (Optional) In the global config mode, run the autosave interval command to set theauto-save interval.After the setting, the system data is automatically saved at the set interval regardlessof whether the system data is modified. By default, the interval is 1440 minutes.

4. (Optional) Set the auto-save file type.In the global config mode, run the autosave type command to set the auto-save filetype. The parameters are described as follows:– data: sets the database file in the system to be automatically saved.

– configuration: sets the system configuration file in the system to be automaticallysaved.

– all: sets the database file and the configuration file in the system to be automaticallysaved.

l Configure auto-save at preset time.1. In the global mode, run the autosave time on command to enable auto-save at preset

time.Auto-save at preset time conflicts with auto-save at preset interval. You can enableonly one of them.

2. (Optional) In the global config mode, run the autosave time command to set the auto-save time.After the setting, the system data is automatically saved at the set time regardless ofwhether the system data is modified. By default, the time is 00:00:00.

3. (Optional) Set the auto-save file type.In the global config mode, run the autosave type command to set the auto-save filetype. The parameters are described as follows:– data: sets the database file in the system to be automatically saved. This parameter

is the default setting on the system.– configuration: sets the system configuration file in the system to be automatically

saved.– all: sets the database file and the configuration file in the system to be automatically

saved.

----End

ExampleTo enable auto-save at preset interval on the MA5600T, set the auto-save interval to two day(2880 minutes), and save both the database file and the configuration file, do as follows:

huawei(config)#autosave interval onhuawei(config)#autosave interval 2880huawei(config)#autosave type allhuawei(config)#save

2.7 Configuring the Attributes of an Upstream Ethernet PortThis topic describes how to configure the attributes of a specified Ethernet port so that the systemcommunicates with the upstream device in the normal state.



2-21

PrerequisiteThe Ethernet board must be configured in the system.


The MA5600T should be interconnected with the upstream device through the Ethernet port.Therefore, pay attention to the consistency of port attributes.

Default Configuration

Table 2-2 lists the default settings of the attributes of an Ethernet port.

Table 2-2 Default settings of the attributes of an Ethernet port

Parameter Default Setting (Optical Port) Default Setting (ElectricalPort)

Auto-negotiationmode of the port

Disabled Enabled

Port rate l FE optical port: 100 Mbit/s

l GE optical port: 1000 Mbit/s

l 10GE optical port: 10000 Mbit/s

NANOTE

After the auto-negotiation modeof the port is disabled, you canconfigure the port rate.

Duplex mode Full-duplex NANOTE

After the auto-negotiation modeof the port is disabled, you canconfigure the duplex mode.

Network cableadaptation mode

Not supported l FE electrical port: auto

l GE electrical port: normal

Flow control Disabled Disabled

Procedurel Configure the physical attributes of an Ethernet port.

1. (Optional) Set the auto-negotiation mode of the Ethernet port.Run the auto-neg command to set the auto-negotiation mode of the Ethernet port. Youcan enable or disable the auto-negotiation mode:– After the auto-negotiation mode is enabled, the port automatically negotiates with

the peer port for the rate and working mode of the Ethernet port.– After the auto-negotiation mode is disabled, the rate and working mode of the port

are in the forced mode (adopt default values or are set through command lines).2. (Optional) Set the rate of the Ethernet port.

Run the speed command to set the rate of the Ethernet port. After the port rate is setsuccessfully, the port works at the set rate. Pay attention to the following points:




Issue 03 (2010-01-28)

– Make sure that the rate of the Ethernet port is the same as that of the interconnectedport on the peer device. This prevents communication failure.

– The auto-negotiation mode should be disabled.

3. (Optional) Set the duplex mode of the Ethernet port.Run the duplex command to set the duplex mode of the Ethernet port. The duplexmode of an Ethernet port can be full-duplex, half-duplex, or auto negotiation. Payattention to the following points:– Make sure that the ports of two interconnected devices work in the same duplex

modes. This prevents communication failure.– The auto-negotiation mode should be disabled.

4. (Optional) Configure the network cable adaptation mode of the Ethernet port.Run the mdi command to configure the network cable adaptation mode of the Ethernetport to match the actual network cable. The network adaptation modes are as follows:– normal: Specifies the adaptation mode of the network cable as straight through

cable. In this case, the network cable connecting to the Ethernet port must be astraight-through cable.

– across: Specifies the adaptation mode of the network cable as crossover cable. Inthis case, the network cable connecting to the Ethernet port must be a crossovercable.

– auto: Specifies the adaptation mode of the network cable as auto-sensing. Thenetwork cable can be a straight through cable or crossover cable.

Pay attention to the following points:– The Ethernet optical port does not support the network cable adaptation mode.

– If the Ethernet electrical port works in forced mode (auto-negotiation modedisabled), the network cable type of the port cannot be configured to auto.

l Configure flow control on the Ethernet port.Run the flow-control command to enable flow control on the Ethernet port. When the flowof an Ethernet port is heavy, run this command to control the flow to prevent networkcongestion, which may cause the loss of data packets. Flow control should be supportedon both the local and peer devices. Pay attention to the following points:– If the peer device does not support flow control, generally, enable flow control on the

local device.– If the peer device supports flow control, generally, disable flow control on the local

device.By default, flow control is disabled.

l Mirror the Ethernet port.Run the mirror port command to mirror the Ethernet port. When the system is faulty, copythe traffic of a certain port to the other port and output the traffic for traffic observation,network fault diagnosis, and data analysis.

----End

ExampleEthernet port 0/19/0 is an electrical port. the attribute is as follows: The port rate is 1000 Mbit/s in duplex mode, with supporting flow control, not supporting auto-negotiation function. do asfollows:



2-23

huawei(config)#interface giu 0/19huawei(config-if-0/19-0/19)#auto-neg 0 disablehuawei(config-if-giu-0/19)#speed 0 1000huawei(config-if-giu-0/19)#duplex 0 fullhuawei(config-if-giu-0/19)#flow-control 0

2.8 Configuring the ANCPAccess Node Control Protocol (ANCP) is used to implement the functions such as topologydiscovery, line configuration, and L2C OAM on the user ports. The MA5600T establishes anANCP session according to the GSMP communication IP address configured in the networkaccess server (NAS).

Contextl The MA5600T and the NAS use the TCP connection to carry an ANCP session. Therefore,

before creating the ANCP session, you must create a TCP connection between theMA5600T and the NAS. The NAS functions as the server of the TCP connection, and theMA5600T functions as the client of the TCP connection.

l After the TCP connection is created successfully between the MA5600T and the NAS, anANCP session is created between the MA5600T and the NAS. After the ANCP session iscreated successfully, the MA5600T and the NAS need to use the ANCP ACK packets forheartbeat detection to maintain the ANCP session.

l The default values of the ANCP parameters are as follows:– GSMP address for an ANCP session: 0.0.0.0

– ANCP session capability set: topology-discovery, line-config, and oam

– ANCP packet sending priority: highest level 6

– GSMP TCP communication port number on the NAS side in an ANCP session: 6068

– Interval for sending packets during the initial stage of an ANCP session: 10 (unit: 0.1s)

– Interval for sending packets during the ANCP session stage: 100 (unit: 0.1s)

Procedure

Step 1 Run the ancp session command to enter the ANCP session mode. Currently, the system supportsonly two ANCP sessions.

Step 2 Run the ancp ip command to configure the GSMP communication IP address for the ANCPsession.l The IP address configured here must be the same as the GSMP communication IP address

configured on the NAS, but it should to not be the same as the default IP address, multicastIP address, or broadcast IP address.

l When an ANCP session is enabled, the GSMP communication IP address cannot beconfigured.

Step 3 (Optional) Run the ancp capability command to configure the capability set of the ANCPsession. The default value is all, that is, the three capabilities (topology discovery, lineconfiguration, and L2C OAM) are supported.l Supports topology discovery. When you select topology-discovery parameter, the DSLAM

automatically reports the line parameters to the NAS.




Issue 03 (2010-01-28)

l Supports line configuration. When you select line-config parameter, the DSLAM respondsto the line configuration that is sent by the NAS.

l Supports the OAM. When you select oam parameter, the DSLAM responds to the line testinginformation that is sent by the NAS.

l Supports the preceding three types of capability.

Step 4 (Optional) Run the ancp ancp-8021p command to set the priority for sending ANCP packets.You can set the priority according to the actual requirements and network conditions, the higherthe priority, the higher the reliability.

NOTEAfter an ANCP session is enabled, the priority for sending the ANCP packet of the ANCP session cannotbe configured.

Step 5 (Optional) Run the ancp nas-tcp-port command to set the GSMP TCP communication portnumber for the ANCP session on the NAS. By default, the GSMP TCP communication portnumber is 6068.l The GSMP TCP communication port number on the MA5600T must be the same as that on

the NAS.l Run the ancp portid start-from command to set the start port ID of the ANCP session. Make

sure that the start port ID of the ANCP session is the same as the start ID of the ports on theservice board.

Step 6 (Optional) Run the ancp init-interval command to set the interval for sending packets duringthe establishment of the ANCP session. By default, the general query interval is 125s.


Step 7 (Optional) Run the ancp keep-alive command to set the interval for sending packets during theACNP session so that the handshake messages can be sent to the peer end at the preset interval.By default, the interval is 10s.


Step 8 Run the ancp enable command to enable the ANCP function.By default, the ANCP function isdisabled.

NOTEBefore an ANCP session is enabled, related parameters can be modified. After an ANCP session is enabled,related parameters cannot be modified.

Step 9 Run the quit command to quit the ANCP mode.

Step 10 Run the display ancp session command to query the information about the ANCP session.

----End

ExampleTo configure the GSMP address for an ANCP session as 10.10.10.10, the interval for sendingpackets during the initial stage of an ANCP session to 2s, ANCP session capability set totopology-discovery, ANCP packet sending priority to 7, GSMP TCP communication portnumber on the NAS side in an ANCP session to 6000, and interval for sending packets duringthe ANCP session stage as 7s, and then enable the ANCP function, do as follows:



2-25

huawei(config)#ancp session 1huawei(config-session-1)#ancp ip 10.10.10.10huawei(config-session-1)#ancp capability topology-discoveryhuawei(config-session-1)#ancp ancp-8021p 7huawei(config-session-1)#ancp nas-tcp-port 6000huawei(config-session-1)#ancp init-interval 20huawei(config-session-1)#ancp keep-alive 70huawei(config-session-1)#ancp enablehuawei(config-session-1)#quithuawei(config)#display ancp session 1 Session config status : Enable Session running status : Before syn phase GSMP version : 3 GSMP sub version : 1 AN name : - NAS name : - NAS IP : 10.10.10.10 AN instance : - NAS instance : - Config capabilities : TopologyDiscovery Negotiate capabilities : - ANCP-8021P : 7 NAS TCP port : 6000 Start up time : - Discontinuity time : - Init interval(0.1s) : 20 Keep alive interval(0.1s) : 70 Bandwidth CAC status : Disable

2.9 Configuring DHCPThe MA5600T can implement DHCP relay and DHCP proxy on a network. Configuring DHCPrelay is applicable to the scenario where users dynamically obtain IP addresses from the DHCPserver through DHCP. In DHCP proxy, the MA5600T proxy can implement certain functionsof the DHCP server.

Background InformationThe MA5600T can work in the L2 DHCP relay mode or L3 DHCP relay mode to forward theDHCP packets exchanged between the user and the DHCP server. By default, the MA5600Tworks in the L2 DHCP relay mode. In this mode, the MA5600T transparently transmits theDHCP packets initiated by the user and configurations are not required. If the MA5600T worksin the L3 mode, the DHCP server must support DHCP relay and you must perform correspondingconfigurations on the DHCP server. The L3 DHCP relay mode can be classified into threeworking modes:l DHCP standard mode

In this mode, the MA5600T identifies the VLAN to which the user belongs and bindsdifferent VLANs to the corresponding DHCP server groups.Configure the DHCP standard mode as follows: Configure the working mode of the DHCPrelay. Configure the DHCP server group. Bind VLANs to DHCP server groups.

l DHCP option 60 modeThe MA5600T differentiates the DHCP packets transmitted from the user terminalaccording to the DHCP option 60 field in the packets, and binds different DHCP option 60domains to the corresponding DHCP server groups.Configure the DHCP option 60 mode as follows: Configure the working mode of the DHCPrelay. Configure the DHCP server group. Create DHCP option 60 field. Bind DHCP option60 domains to DHCP server groups.




Issue 03 (2010-01-28)

l MAC address segment mode

The MA5600T differentiates users according to the MAC address segment of the userterminals, and binds different MAC address segments to the corresponding DHCP servergroup.

Configure the MAC address segment mode as follows: Configure the working mode of theDHCP relay. Configure the DHCP server group. Define the MAC address segment. BindMAC address segments to DHCP server groups.

If the MA5600T works in the L3 DHCP relay mode, the MA5600T supports the DHCP proxyfunction in addition to the DHCP relay function. That is, the MA5600T functions as a proxy toimplement certain functions of the DHCP server. A DHCP proxy can implement the functionsof server ID proxy and lease-time proxy.

l The server ID proxy is a function for modifying option 54 field in DHCP packets so thatthe IP address of the DHCP server is unavailable to the client. This prevents the attacksinitiated by the DHCP client to the DHCP server.

l With the lease-time proxy, the information related to the lease-time in the DHCP packetsis modified by MA5600T so that the client can obtain a lease time. This lease time is shorterthan the lease time directly allocated by the DHCP server. This facilitates the lease-timemanagement.

NOTEThe MA5600T supports the DHCP option 82 to ensure the security of the DHCP function. For theconfiguration related to the DHCP option 82 feature, see 2.12.2 Configuring Anti-Theft and Roamingof User Accounts Through DHCP.

2.9.1 Configuring the Standard DHCP ModeThis topic is applicable to the scenario for specifying the corresponding DHCP server groupsfor different users of the VLAN (the VLAN that is used when the service ports are created).

2.9.2 Configuring the DHCP Option60 ModeThis topic is applicable to the scenario for specifying the corresponding DHCP servers fordifferent option60 domain users.

2.9.3 Configuring the DHCP MAC Address Segment ModeThis topic is applicable to the scenario for specifying the corresponding DHCP servers for usersin different MAC address segments.

2.9.1 Configuring the Standard DHCP ModeThis topic is applicable to the scenario for specifying the corresponding DHCP server groupsfor different users of the VLAN (the VLAN that is used when the service ports are created).

Prerequisite

A VLAN must be created. For details, see 2.10 Configuring a VLAN.

Procedure

Step 1 Configure the DHCP forwarding mode.

Choose one from the following two methods for configuring the DHCP forwarding mode:



2-27

l In the global config mode, run the dhcp mode layer-3 standard command to configure theDHCP relay mode to standard L3 DHCP relay mode (layer-3, standard). If keywordVLAN is selected and VLANID is entered, this configuration takes effect to only this VLAN.

l Perform the following configuration in the VLAN service profile:

1. Run the vlan service-profile command to create a VLAN service profile and enter theVLAN service profile mode.

2. Run the dhcp mode layer-3 standard command to configure the DHCP mode.3. Run the commit command to make the configuration parameters of the profile take

effect. The configuration of the VLAN service profile takes effect only after you runthis command.

4. Run the quit command to quit the VLAN service profile mode.5. Run the vlan bind service-profile command to bind the VLAN to the VLAN service

profile created in 1.1.

Step 2 Configure the DHCP server group.1. In the global config mode, run the dhcp-server command to create a DHCP server group.

l igroup-number: Indicates the number of the DHCP server group. It identifies a servergroup. You can run the display dhcp-server all-group command to query the DHCPserver groups that are already configured and select a DHCP server group number thatis not used by the system.

l ip-addr: Indicates the IP address of the DHCP server in the DHCP server group. Up tofour IP addresses can be entered.

CAUTIONThe IP address of the DHCP server configured here must be the same as the IP addressof the DHCP server in the network side.

2. (Optional) Run the dhcp server mode command to configure the working mode of theDHCP server.

The DHCP servers in the DHCP server group can work in the load balancing mode oractive/standby mode. By default, they work in the load balancing mode.

Step 3 Bind the VLAN to the DHCP server.1. In the global config mode, run the interface vlanif command to create a VLAN L3

interface.The VLAN ID must be the same as the ID of the VLAN described in the prerequisite.

2. In the VLANIF mode, run the ip address command to configure the IP address of theVLAN L3 interface.After the configuration is completed, this IP address is used as the source IP address forforwarding the IP packets in the VLAN at L3.




Issue 03 (2010-01-28)

CAUTIONl If only an L2 device exists between the MA5600T and the DHCP server, the IP address

of the VLAN L3 interface should be in the same subnet as the IP address of the DHCPserver.

l If the upper-layer device of the MA5600T is an L3 device, the IP address of the VLANL3 interface and the IP address of the DHCP server can be in different subnets; however,a route must exist between the VLAN L3 interface and the DHCP server. For details,see 3.3 Configuring the Route.

3. In the VLANIF mode, run the dhcp-server command to bind the DHCP server to theVLAN.This command requires parameter group-number, the value of which is the number of thecreated DHCP server group.

Step 4 (Optional)Configure the DHCP proxy.To hide the IP address of the DHCP server (preventing attacks to the DHCP server from theclient), or to configure the MA5600T to allocate a shorter lease time to the client (comparedwith the lease time directly allocated by the DHCP server), configure the DHCP proxy.1. Enable the DHCP proxy function. When DHCP proxy is enabled, the DHCP server ID

proxy and the lease-time proxy are enabled.

Choose one from the following two methods for enabling DHCP proxy:

l In the global config mode, run the dhcp proxy enable command to enable DHCP proxy.

l Perform the configuration in the VLAN service profile.

a. Run the vlan service-profile command to enter the VLAN service profile mode.b. Run the dhcp proxy enable command to enable DHCP proxy.c. Run the commit command to make the configuration parameters of the profile

take effect. The configuration of the VLAN service profile takes effect only afteryou run this command.

d. Run the quit command to quit the VLAN service profile mode.e. Run the vlan bind service-profile command to bind the VLAN to the VLAN

service profile created in 4.1.a.2. In the global config mode, run the dhcp proxy lease-time command to configure the global

proxy lease time.The proxy lease time configured here should be shorter than the lease time allocated by theDHCP server.

----End

ExampleAssume that server group 1 contains two DHCP servers working in active/standby mode, withthe maximum response time of 20s, the maximum count of response timeout of 10, the IP addressof the primary server 10.1.1.9 and the IP address of the secondary server 10.1.1.10. To bindserver group 1 to users in VLAN 2 (with the IP address of the L3 interface 10.1.1.101), do asfollows:

huawei(config)#dhcp mode layer-3 standard



2-29

huawei(config)#dhcp server mode backup 20 10huawei(config)#dhcp-server 1 ip 10.1.1.9 10.1.1.10huawei(config)#interface vlanif 2huawei(config-if-vlanif2)#ip address 10.1.1.101 24huawei(config-if-vlanif2)#dhcp-server 1

2.9.2 Configuring the DHCP Option60 ModeThis topic is applicable to the scenario for specifying the corresponding DHCP servers fordifferent option60 domain users.

Prerequisitel A VLAN must be created. For details, see 2.10 Configuring a VLAN.

l Before the configuration, confirm the option60 domain name of the user terminal.


When multiple services such as video multicast and IP telephone services are provisioned onthe MA5600T, the services are provided by different service providers. The service providersmay use different relay IP addresses of the same DHCP server or different DHCP servers toallocate IP addresses to users. Therefore, configure the users to apply for IP addresses from theDHCP server in the DHCP option60 mode.

In the DHCP option60 mode, the DHCP server group is selected according to the character string(namely domain name) in the option60 of DHCP packets. Here, the option60 domain name andthe DHCP server group to which the domain name is bound need to be configured beforehand.In this mode, users are actually differentiated according to the domain information in the packet,and different service types in the same VLAN can also be differentiated.

Procedure



l In the global config mode, run the dhcp mode layer-3 option60 command to configure theDHCP relay mode to L3 option60 mode (layer-3, option60). If keyword VLANis selectedand VLANID is entered, this configuration takes effect to only this VLAN.

l Perform the configuration in the VLAN service profile:


2. Run the dhcp mode layer-3 option60 command to configure the DHCP mode.3. Run the commit command to make the profile configuration take effect. The

configuration of the VLAN service profile takes effect only after execution of thiscommand.







Issue 03 (2010-01-28)






Step 3 Create a DHCP option60 domain.In the global config mode, run the dhcp domain command to create a DHCP domain, and thenenter the DHCP domain mode. The option60 domain name should be configured according tothe type of the terminal connected to the device. For the DHCP client installed with the Windows98/2000/XP/NT series of OSs, the domain name must be msft.

Step 4 Bind the DHCP option60 domain to the DHCP server group.In the option60 domain mode, run the dhcp-server command to bind the DHCP domain to theDHCP server group. After the configuration is completed, the DHCP clients belonging to theDHCP correspond to the DHCP server group.

Step 5 Configure the IP address of the gateway corresponding to the DHCP domain.1. In the global config mode, run the interface vlanif command to create a VLAN L3






3. In the VLANIF mode, run the dhcp domain gateway command to configure the IP addressof the gateway corresponding to the DHCP domain.



2-31

The IP address of the gateway must be a configured IP address of the VLAN interface.Under the same VLAN interface, different option60 domains can be configured withdifferent gateways. Therefore, different DHCP servers can be selected according to thedomain information in the packet.

Step 6 Configure the DHCP proxy.To hide the IP address of the DHCP server (preventing attacks to the DHCP server from theclient), or to configure the MA5600T to allocate a shorter lease time to the client (comparedwith the lease time directly allocated by the DHCP server), configure the DHCP proxy.1. Enable the DHCP proxy function. When DHCP proxy is enabled, the DHCP server ID




l In VLAN service profile configuration mode, to configure the VLAN forwarding policy,do as follows:

a. Run the vlan service-profile command to create a VLAN service profile and enterthe VLAN service profile mode.

b. Run the dhcp proxy enable command to enable DHCP proxy.c. Run the commit command to make the profile configuration take effect. The


d. Run the quit command to quit the VLAN service profile mode.e. Run the vlan bind service-profile command to bind the VLAN to the VLAN

service profile created in 6.1.a.2. In the global config mode, run the dhcp proxy lease-time command to configure the global

proxy lease time.The proxy lease time configured here should be shorter than the lease time allocated by theDHCP server.

----End

Example

Assume that server group 2 contains two DHCP servers working in the load balancing mode,with the IP address of the primary server 10.10.10.10 and the IP address of the secondary server10.10.10.11. To bind server group 2 to users whose option60 domain name is msft in VLAN 2(with the IP address of the L3 interface 10.1.2.1/24), do as follows:

huawei(config)#dhcp mode layer-3 Option60huawei(config)#dhcp-server 2 ip 10.10.10.10 10.10.10.11huawei(config)#dhcp domain msfthuawei(config-dhcp-domain-msft)#dhcp-server 2huawei(config)#interface vlanif 2huawei(config-if-vlanif2)#ip address 10.1.2.1 24huawei(config-if-vlanif2)#dhcp domain msft gateway 10.1.2.1

2.9.3 Configuring the DHCP MAC Address Segment ModeThis topic is applicable to the scenario for specifying the corresponding DHCP servers for usersin different MAC address segments.




Issue 03 (2010-01-28)

PrerequisiteA VLAN must be created. For details, see 2.10 Configuring a VLAN.

Background InformationIn the networking, devices of various manufacturers may exist in the network. The devices ofeach manufacturer have a fixed MAC address segment. In this case, the IP address can beobtained from the DHCP server through DHCP relay in the MAC address segment mode.

The MA5600T can select the DHCP server based on the MAC address segment. After theconfiguration is completed, clients in this MAC address segment obtain IP addresses from thecorresponding DHCP server.

Procedure



l In the global config mode, run the dhcp mode layer-3 mac-range command to configurethe DHCP relay mode to L3 MAC address segment mode (layer-3, mac-range). If keywordVLAN is selected and VLANID is entered, this configuration takes effect to only this VLAN.

l Perform the following configuration in the VLAN service profile:


2. Run the dhcp mode layer-3 mac-range command to configure the DHCP mode.3. Run the commit command to make the profile configuration take effect. The











2-33


Step 3 Define the MAC address segment.1. In the global config mode, run the dhcp mac-range to create a MAC address segment, and

then enter the MAC address segment mode.range-name indicates the name of the MAC address segment. It functions as a commentand has no other special meanings.

2. In the MAC address segment mode, run the mac-range command to configure the MACaddress range.

Step 4 Bind the DHCP server group to the MAC address segment.In the MAC address segment mode, run the dhcp-server command to bind a DHCP server groupto the MAC address segment.

Step 5 Configure the IP address of the gateway corresponding to the MAC address segment.1. In the global config mode, run the interface vlanif command to create a VLAN L3






3. In the VLANIF mode, run the dhcp mac-range gateway command to configure the IPaddress of the gateway corresponding to the DHCP domain.The IP address of the gateway must be a configured IP address of the VLAN interface.Under the same VLAN interface, different MAC address segments can be configured withdifferent gateways. Therefore, different DHCP servers can be selected according to theMAC address segment information in the packet.

Step 6 Configure the DHCP proxy.To hide the IP address of the DHCP server (preventing attacks to the DHCP server from theclient), or to configure the MA5600T to allocate a shorter lease time to the client (comparedwith the lease time directly allocated by the DHCP server), configure the DHCP proxy.1. Enable the DHCP proxy function. When DHCP proxy is enabled, the DHCP server ID






Issue 03 (2010-01-28)


l Perform the configuration in the VLAN service profile:


b. Run the dhcp proxy enable command to enable DHCP proxy.

c. Run the commit command to make the profile configuration take effect. Theconfiguration of the VLAN service profile takes effect only after execution of thiscommand.

d. Run the quit command to quit the VLAN service profile mode.

e. Run the vlan bind service-profile command to bind the VLAN to the VLANservice profile created in 6.1.a.

2. In the global config mode, run the dhcp proxy lease-time command to configure the globalproxy lease time.The proxy lease time configured here should be shorter than the lease time allocated by theDHCP server.

----End

Example

Assume that server group 2 contains two DHCP servers working in the load balancing mode,with the IP address of the primary server 10.10.10.10 and the IP address of the secondary server10.10.10.11. To bind server group 2 to certain users (whose MAC address is in the range from0000-0000-0001 to 0000-0000-0100) in VLAN 2, do as follows:

huawei(config)#dhcp mode layer-3 mac-rangehuawei(config)#dhcp-server 2 ip 10.10.10.10 10.10.10.11huawei(config)#dhcp mac-range huaweihuawei(config-mac-range-huawei)#mac-range 0000-0000-0001 to 0000-0000-0100huawei(config-mac-range-huawei)#dhcp-server 2huawei(config)#quithuawei(config)#interface vlanif 2huawei(config-if-vlanif2)#ip address 10.1.2.1 24huawei(config-if-vlanif2)#dhcp mac-range huawei gateway 10.1.2.1


Prerequisite

The VLAN to be added should not exist in the system.

Application Context

VLAN application is specific to user types. For details on the VLAN application, see Table2-3.



2-35

Table 2-3 VLAN application and planning

User Type Application Scenario VLAN Planning

l Householduser

l Commercialuser of theInternetaccessservice

N:1 scenario, that is, thescenario of upstreamtransmission through asingle VLAN, where theservices of multiplesubscribers areconverged to the sameVLAN.

VLAN type: smartVLAN attribute: commonVLAN forwarding mode: by VLAN+MAC

1:1 scenario, that is, thescenario of upstreamtransmission throughdouble VLANs, wherethe outer VLAN tagidentifies a service andthe inner VLAN tagidentifies a user. Theservice of each user isindicated by a unique S+C.

VLAN type: smartAttribute: stackingVLAN forwarding mode: by S+C

Commercialuser of thetransparenttransmissionservice

Applicable only to thetransparent transmissionservice of a commercialuser.

VLAN type: smartVLAN attribute: QinQVLAN forwarding mode: by VLAN+MAC orS+C.


Table 2-4 lists the default parameter settings of VLAN.

Table 2-4 Default parameter settings of VLAN

Parameter Default Setting Remarks

Default VLAN ofthe system

VLAN ID: 1Type: smart VLAN

You can run the defaultvlan modifycommand to modify the VLAN type butcannot delete the VLAN.

Reserved VLANof the system

VLAN ID range:4079-4093

You can run the vlan reserve command tomodify the VLAN reserved by the system.

Default attributeof a new VLAN

Common -

VLANforwarding mode

VLAN+MAC -




Issue 03 (2010-01-28)

Procedure

Step 1 Create a VLAN.

Run the vlan to create a VLAN. VLANs of different types are applicable to different scenarios.

Table 2-5 VLAN types and application scenarios

VLANType

ConfigurationCommand

VLAN Description Application Scenario

StandardVLAN

To add a standardVLAN, run the vlanvlanid standardcommand.

Standard VLAN.Ethernet ports in astandard VLAN areinterconnected with eachother but Ethernet portsin different standardVLANs are isolated fromeach other.

Only available toEthernet ports andspecifically to networkmanagement andsubtending.

SmartVLAN

To add a smart VLAN,run the vlan vlanidsmart command.

One smart VLAN maycontain multiple GPONservice ports. The serviceports in one smartVLAN, however, areisolated from each other.A service port in onesmart VLAN is alsoisolated from a serviceport in another smartVLAN. One smartVLAN provides accessfor multiple users andthus saves VLANresources.

Smart VLANs can beapplied in residentialcommunities to providexPON service access.

MUXVLAN

To add a MUX VLAN,run the vlan vlanidmux command.

One MUX VLANcontains only one GPONservice port. The trafficstreams in differentVLANs are isolated fromeach other. One-to-onemapping can be set upbetween a MUX VLANand an access user.Hence, a MUX VLANcan identify an accessuser.

MUX VLANs areapplicable to xPONservice access and candistinguish users.



2-37

VLANType



SuperVLAN

To add a super VLAN,run the vlan vlanidsuper command.

The super VLAN is basedon layer 3. One superVLAN contains multiplesub-VLANs. Through anARP proxy, the sub-VLANs in a super VLANcan be interconnected atlayer 3.

Super VLANs save IPaddresses and improvethe utilization of IPaddresses.For a super VLAN, sub-VLANs must beconfigured. You can runthe supervlan commandto add a sub-VLAN to aspecified super VLAN. Asub-VLAN must be asmart VLAN or MUXVLAN.

NOTE

l To add VLANs with consecutive IDs in batches, run the vlan vlanid to end-vlanid command.

l To add VLANs with inconsecutive IDs in batches, run the vlan vlan-list command.

Step 2 (Optional) Configure the VLAN attribute.

The default attribute for a new VLAN is "common". You can run the vlan attrib command toconfigure the attribute of the VLAN.

Configure the attribute according to VLAN planning.

Table 2-6 VLAN attributes and application scenarios

VLANAttribute


VLAN Type VLANDescription

ApplicationScenario

Common

The defaultattribute for a newVLAN is"common".

The VLAN withthis attribute canbe a standardVLAN, smartVLAN, MUXVLAN, or superVLAN.

A VLAN with thecommon attributecan function as acommon layer 2VLAN or functionfor creating a layer3 interface.

Applicable to theN:1 accessscenario.




Issue 03 (2010-01-28)

VLANAttribute



ApplicationScenario

QinQVLAN

To configure QinQas the attribute of aVLAN, run thevlan attrib vlanidq-in-q command.

The VLAN withthis attribute canonly be a smartVLAN or MUXVLAN. Theattribute of a subVLAN, theVLAN with an L3interface, and thedefault VLAN ofthe system cannotbe set to QinQVLAN.

The packets from aQinQ VLANcontain two VLANtags, that is, innerVLAN tag fromthe private networkand outer VLANtag from theMA5600T.Through the outerVLAN, an L2 VPNtunnel can be set upto transparentlytransmit theservices betweenprivate networks.

Applicable to theenterprise privateline scenario.

VLANStacking

To configurestacking as theattribute of aVLAN, run thevlan attrib vlanidstackingcommand.

The VLAN withthis attribute canonly be a smartVLAN or MUXVLAN. Theattribute of a subVLAN, theVLAN with an L3interface, and thedefault VLAN ofthe system cannotbe set to VLANStacking.

The packets from astacking VLANcontain two VLANtags, that is, innerVLAN tag andouter VLAN tagfrom theMA5600T. Theupper-layer BRASauthenticates theaccess usersaccording to thetwo VLAN tags. Inthis manner, thenumber of accessusers is increased.On the upper-layernetwork in the L2working mode, apacket can beforwarded directlyby the outer VLANtag and MACaddress mode toprovide thewholesale servicefor ISPs.

Applicable to the1:1 access scenariofor the wholesaleservice orextension ofVLAN IDs.In the case of astacking VLAN, toconfigure the innertag of the serviceport, run thestacking labelcommand.



2-39

NOTE

l To configure attributes for the VLANs with consecutive IDs in batches, run the vlan attrib vlanid to end-vlanid command.

l To configure attributes for the VLANs with inconsecutive IDs in batches, run the vlan attrib vlan-listcommand.

Step 3 (Optional) Configure VLAN description.

To configure VLAN description, run the vlan desc command. You can configure VLANdescription to facilitate maintenance. The general VLAN description includes the usage andservice information of the VLAN.

Step 4 (Optional) Configure the VLAN forwarding policy.

vlan-connect corresponds to the S+C forwarding policy, which ensures higher security bysolving the problems of insufficiency in the MAC address space, MAC address aging, and MACaddress spoofing and attacks.

You can configure the VLAN forwarding policy in either the global config mode or VLANservice profile configuration mode.

l In the global config mode, to configure the VLAN forwarding policy, run the vlanforwarding command. The default VLAN forwarding mode is VLAN+MAC in the system.

l In the VLAN service profile configuration mode, to configure the VLAN forwarding policy,do as follows:


2. Run the forwarding command to configure the VLAN forwarding policy. The defaultVLAN forwarding policy is VLAN+MAC in the system.

3. Run the commit command to validate the profile configuration. The configuration ofthe VLAN service profile takes effect only after execution of this command.



----End

ExampleAssume that a stacking VLAN with ID of 50 is to be configured for extension of the VLAN. Aservice port is added to VLAN 50. The outer VLAN tag 50 of the stacking VLAN identifies theaccess device and the inner VLAN tag 10 identifies the user with access to the device. For theVLAN, description needs to be configured for easy maintenance. To configure such a VLAN,do as follows:huawei(config)#vlan 50 smart huawei(config)#vlan attrib 50 stackinghuawei(config)#service-port vlan 50 gpon 0/2/0 gemport 128 huawei(config)#stacking label vlan 50 baselabel 10 huawei(config)#vlan desc 50 description stackingvlan/label10

Assume that a QinQ VLAN with ID of 100 is to be configured for an enterprise user to ensurehigher security and the VLAN forwarding policy is S+C. For the VLAN, description needs tobe configured for easy maintenance. To configure such a VLAN, do as follows:huawei(config)#vlan 100 smart huawei(config)#vlan attrib 100 q-in-q




Issue 03 (2010-01-28)

huawei(config)#vlan desc 100 description qinqvlan/forhuawei huawei(config)#vlan forwarding 100 vlan-connect

2.11 Configuring System SecurityThis topic describes how to configure the network security and protection measures of the systemto protect the system from malicious attacks.

Background InformationWith the system security feature, the MA5600T can be protected against the attacks from thenetwork side or user side, and thus the MA5600T can run stably in the network. System securityincludes the following items:l ACL/Packet filtering firewall

l Blacklist

l Anti-DoS attack

l Anti-ICMP/IP attack

l Source route filtering

l Source MAC address filtering

l User-side ring network detection

l Allowed/Denied address segment

Table 2-7 lists the default settings of system security.

Table 2-7 Default settings of system security

Parameter Default Setting

Firewall blacklist Disabled

Anti-DoS attack Disabled

Anti-ICMP attack Disabled

Anti-IP attack Disabled

Source route filtering Disabled

User-side ring network detection Disabled

2.11.1 Configuring FirewallConfiguring system firewall can control the packets that go through the management port of thedevice so that unauthorized operators cannot access the system through the inband or outbandchannel.

2.11.2 Configuring the System Against Malicious AttacksEnabling anti-DoS attack and anti-ICMP/IP attack, and configuring the source route filteringand source MAC address filtering functions can prevent malicious users' attack on the system,so as to improve system security.

2.11.3 Configuring the System Against Login of Unauthorized Users



2-41

Only the users of the permitted IP address segment can access the device, and the users of thedenied IP address segment cannot access the device. This prevents the users of illegal IP addresssegments from logging in to the system, thus safeguarding the system.

2.11.1 Configuring FirewallConfiguring system firewall can control the packets that go through the management port of thedevice so that unauthorized operators cannot access the system through the inband or outbandchannel.

Background InformationFirewall includes the following items:

l Blacklist: The blacklist function can be used to screen the packets sent from a specific IPaddress. A major feature of the blacklist function is that entries can be dynamically addedor deleted. When firewall detects the attack attempt of a specific IP address according tothe characteristics of packets, firewall actively adds an entry to the blacklist and then filtersthe packets from this IP address.

l ACL/Packet filtering firewall: Configure an ACL to filter data packets. To set a port toallow only one type of packets to go through, use the ACL to implement the packet filteringfunction.For example, to allow only the packets from source IP address 1.1.1.1 to go through a portin the inbound direction, do as follows:

1. Configure an ACL rule1, which allows the packets with source IP address 1.1.1.1 topass.

2. Configure an ACL rule2, which denies all packets.3. Run the firewall packet-filter command, and bind rule2 first and then rule1 to the

inbound direction.NOTE

On the MA5600T, an ACL can be activated in two modes. In two modes, the execution prioritieson the sub-rules in one ACL are different.

l Run the firewall packet-filter command to activate an ACL. This mode is mainly applied tothe NMS. For the sub-rules in one ACL, the execution priority is implemented by software. Theearlier the execution priority of the sub-rules in one ACL is configured, the higher the priority.

l Run the packet-filter command to activate an ACL. For the sub-rules in one ACL, the executionpriority is implemented by hardware. The later the execution priority of the sub-rules in oneACL is configured, the higher the priority.

CAUTIONTo ensure device security, firewall must be configured. This is to control the packets that gothrough the management port of the device.

Procedurel Configure firewall blacklist.

Two modes are supported: configuring firewall blacklist by using ACLs or by adding thesource IP addresses of untrusted packets. Choose either mode, or both.




Issue 03 (2010-01-28)

When two modes are configured, the priority of the firewall blacklist function is higherthan the priority of ACLs. That is, the system checks the firewall blacklist first, and thenmatches ACLs.

NOTE

The firewall blacklist function only takes effect to the service packets that are sent from the user side.

– Configure the firewall blacklist function by using advanced ACLs.

1. Run the acl command to create an ACL. Only advanced ACLs can be used whenthe black list function is enabled. Therefore, the range of the ACL ID is3000-3999.

2. Run the rule(adv acl) command to create an advanced ACL.3. Run the quit command to return to the global config mode.4. Run the firewall blacklist enable acl-number acl-number command to enable

the firewall blacklist function.– Configure the firewall blacklist function by adding the source IP addresses of untrusted

packets.

1. Run the firewall blacklist item command to add the source IP addresses ofuntrusted packets to the blacklist.

2. Run the firewall blacklist enable command to enable the firewall blacklistfunction.

l Configure the firewall (filtering packets based on the ACL).1. Run the acl command to create an ACL. Only basic ACLs and advanced ACLs can

be used when packet filtering by firewall is configured. Therefore, the range of theACL ID is 2000-3999.

2. Run different commands to create different types of ACLs.– Basic ACL: Run the rule(basic acl) command.

– Advanced ACL: Run the rule(adv acl) command.

3. Run the quit command to return to the global config mode.4. Run the firewall enable command to enable the firewall blacklist function. By default,

the firewall blacklist function is disabled.To filter the packets of a port based on the basic ACL, enable the firewall blacklistfunction.

5. Run the interface meth command to enter the METH mode to configure the firewallpacket filtering rules for an METH interface; run the interface vlanif command toenter the VLANIF mode configure the firewall packet filtering rules for a VLANinterface.

6. Run the firewall packet-filter command to apply firewall packet filtering rules to aninterface.

----End

ExampleTo add IP address 192.168.10.18 to the firewall blacklist with the aging time of 100 min, do asfollows:

huawei(config)#firewall blacklist item 192.168.10.18 timeout 100 huawei(config)#firewall blacklist enable



2-43

To add the IP addresses in network segment 10.10.10.0 to the firewall blacklist and bind ACL3000 to these IP addresses, do as follows:

huawei(config)#acl 3000 huawei(config-acl-adv-3000)#rule deny ip source 10.10.10.0 0.0.0.255 destination 10.10.10.20 0 huawei(config-acl-adv-3000)#quit huawei(config)#firewall blacklist enable acl-number 3000

To deny the users in network segment 172.16.25.0 to access the maintenance Ethernet port withIP address 172.16.25.28 on the device, do as follows:

huawei(config)#acl 3001huawei(config-acl-adv-3001)#rule 5 deny icmp source 172.16.25.0 0.0.0.255 destination 172.16.25.28 0 huawei(config-acl-adv-3001)#quit huawei(config)#firewall enablehuawei(config)#interface meth 0huawei(config-if-meth0)#firewall packet-filter 3001 inbound ACL applied successfully

2.11.2 Configuring the System Against Malicious AttacksEnabling anti-DoS attack and anti-ICMP/IP attack, and configuring the source route filteringand source MAC address filtering functions can prevent malicious users' attack on the system,so as to improve system security.


The MA5600T supports the following measures to prevent malicious users' attack on the system.Choose measures according to actual requirements.

l Anti-DoS attack: indicates the defensive measures taken by the system to receive only acertain number of control packets sent from a user.

l Anti-ICMP attack: indicates the defensive measures taken by the system to drop the ICMPpackets sent from the user-side device to the MA5600T. This is to prevent the user-sidedevice from pinging the VLAN interface of the MA5600T.

l Anti-IP attack: indicates the defensive measures taken by the system to drop the IP packetssent from the user-side device to the MA5600T.

l Source route filtering: indicates the defensive measures taken by the system to filter the IPpackets that are sent by the user and carry the routing option field.

l Source MAC address filtering: indicates the defensive measures taken by the system tofilter the packets that are sent by the user and carry certain source MAC addresses.

l User-side ring network check: indicates the defensive measures taken by the system tocheck user-side ring networks. In this way, the system can process ring networks to preventring networks from affecting services.

Procedurel Configure anti-DoS attack.

Run the security anti-dos enable command to enable global anti-DoS attack.

With global anti-DoS attack enabled, when the system receives attack packets from a userport, the system adds the user port to the blacklist. When global anti-DoS attack is disabled,the system deletes the blacklist.




Issue 03 (2010-01-28)

Application scenario: Two PCs (PC1 and PC2) are connected to the network through theMA5600T. If a malicious user (PC1) sends a large number of protocol control packets toattack the CPU of the MA5600T, the CPU usage of the MA5600T will be over high, andthen the MA5600T is unable to process the services of another user (PC2). To implementanti-DoS attack, shield the attack port or suppress the protocol packet sending to protectthe MA5600T from being attacked.

l Configure anti-ICMP attack.

Run the security anti-icmpattack enable command to enable anti-ICMP attack. Anti-ICMP attack is mainly used to prevent the user-side device from pinging the VLANinterface of the MA5600T.

Application scenario: Two PCs (PC1 and PC2) are connected to the network through theMA5600T. When PC2 sends a large number of ICMP packets to the VLAN interface, theservices of the user (PC1) that obtains the upper-layer DHCP information through the sameVLAN interface will be abnormal. To implement anti-ICMP attack, directly drop the user-side ICMP packets if the IP address of the VLAN interface on the MA5600T is itsdestination IP address.

l Configure anti-IP attack.

Run the security anti-ipattack enable command to enable anti-IP attack. The anti-IP attackis used to prevent user-side IP packets from attacking the L3 interface of the device or toprevent illegal users from logging in to the device through telnet.

Application scenario: When a PC sends the packets with the address of VLAN x as thedestination IP address to VLANIF x, it may send a large number of packets to attack thedevice, causing the device to fail to process normal services; when a user knows the addressof VLAN x, or the user name and password for logging in to the device, the user may login to the device through telnet to randomly change the configurations of the device. Toprevent the two preceding cases, the device needs to implement anti-IP attack. With thisfeature, the device drops the packets with the address of the device interface as thedestination IP address to prevent the user from attacking the device.

l Configure the source route filtering function.

Run the security source-route enable command to enable the source route filteringfunction. This function is mainly used to filter the packets that carry the routing informationand are reported to the L3 switch.

Application scenario: In general, routes are dynamic and application does not control routeselection. The sender can add the routing information to IP packets through the source routeto perform route selection. In this case, packets go along a specific route in the networkaccording to the intention of the sender. To prevent the preceding cases, enable the sourceroute filtering function. Then the MA5600T performs validity check on IP packets anddrops the packets that match the source route options.

l Configure the MAC address filtering function.

Run the security mac-filter command to enable the MAC address filtering function.

The MAC addresses that are dynamically learned by the host and the source MAC addressesthat are statically configured by running the security mac-filter source command sharethe four entries for source MAC addresses on the board. The entries for the staticallyconfigured MAC addresses are of a higher priority than that of the dynamically learnedMAC addresses.



2-45

Application scenario: To prevent users from forging the MAC address of the network-sidedevice, or forging certain renowned MAC addresses, set the MAC address of the network-side as the MAC address to be filtered.

l Configure the function of checking user-side ring networks.

Run the ring check enable command to enable the function of checking user-side ringnetworks. By default, the function of checking user-side ring networks is disabled.

CAUTIONTo ensure device security, it is recommended that you enable this function.

----End

ExampleTo enable the global anti-DoS attack function, enable anti-IP attack function, and the functionof checking user-side ring networks, do as follows:

huawei(config)#security anti-dos enablehuawei(config)#security anti-ipattack enable huawei(config)#ring check enable

2.11.3 Configuring the System Against Login of UnauthorizedUsers

Only the users of the permitted IP address segment can access the device, and the users of thedenied IP address segment cannot access the device. This prevents the users of illegal IP addresssegments from logging in to the system, thus safeguarding the system.

Background InformationEach firewall can be configured with up to 10 address segments.

When adding an address segment, ensure that the start address does not repeat an existing startaddress.

To delete an address segment, you only need to enter the start address of the address segment.

Procedurel Configure the permitted/denied IP address segment for the access through Telnet.

1. Run the sysman ip-access telnet command to configure the IP address segment thatis permitted to access the device through Telnet.




Issue 03 (2010-01-28)

CAUTIONTo ensure the device security, apply the minimum authorization principles. That is,configure the permitted IP address segment, and add only the necessary managementIP address segment. IP addresses other than have been specified are not permitted toaccess the device through the management port.

2. Run the sysman ip-refuse telnet command to configure the IP address segment thatis forbidden to access the device through Telnet.

NOTE

It is recommended that the permitted IP address segment and the denied IP address segment shouldnot overlap, and only the user whose IP address is in the permitted address segment and is not in thedenied address segment can access the device.

3. Run the sysman firewall telnet enable command to enable the firewall function forthe access through Telnet. By default, the firewall function of the system is disabled.

l Configure the permitted/denied IP address segment for the access through SSH.1. Run the sysman ip-access ssh command to configure the IP address segment that is

permitted to access the device through SSH.


2. Run the sysman ip-refuse ssh command to configure the IP address segment that isforbidden to access the device through SSH.

NOTE

It is suggested that the permitted IP address segment and the denied IP address segment should notoverlap, and only the user whose IP address is in the permitted address segment and is not in thedenied address segment can access the device.

3. Run the sysman firewall ssh enable command to enable the firewall function for theaccess through SSH. By default, the firewall function of the system is disabled.

l Configure the permitted/denied IP address segment for the access through SNMP (NMS).1. Run the sysman ip-access snmp command to configure the IP address segment that

is permitted to access the device through SNMP.




2-47

2. Run the sysman ip-refuse snmp command to configure the IP address segment thatis forbidden to access the device through SNMP.

NOTE

It is suggested that the permitted IP address segment and the denied IP address segment should notoverlap, and only the user whose IP address is in the permitted address segment and is not in thedenied address segment can access the device.

3. Run the sysman firewall snmp enable command to enable the firewall function forthe access through SNMP. By default, the firewall function of the system is disabled.

----End

ExampleTo enable the firewall function for the access through Telnet, and permit only the users of theIP address segment 134.140.5.1–134.140.5.254 to log in to the device through Telnet, do asfollows:

huawei(config)#sysman ip-access telnet 134.140.5.1 134.140.5.254huawei(config)#sysman firewall telnet enable

To enable the firewall function for the access through SSH, and permit only the users of the IPaddress segment 133.7.22.1–133.7.22.254 to log in to the device through SSH, do as follows:

huawei(config)#sysman ip-access ssh 133.7.22.1 133.7.22.254huawei(config)#sysman firewall ssh enable

To enable the firewall function for the access through SNMP, and permit only the users of theIP address segment 10.10.20.1–10.10.20.254 to log in to the device through SNMP, do asfollows:

huawei(config)#sysman ip-refuse snmp 10.10.20.1 10.10.20.254huawei(config)#sysman firewall snmp enable

2.12 Configuring the User SecurityConfiguring the security mechanism can protect operation users and access users against useraccount theft and roaming or from the attacks from malicious users.

Background InformationThe user security mechanism includes:

l PITP: The purpose of the PITP feature is to provide the user physical location informationfor the upper-layer authentication server. After the BRAS obtains the user physical locationinformation, the BRAS binds the information to the user account for authentication, thusprotecting the user account against theft and roaming.

l DHCP option 82: The user physical location information is added to the option 82 field inthe DHCP request sent by the user. The information is used by the upper-layerauthentication server for authenticating the user, thus protecting the user account againsttheft and roaming.

l IP address binding: The IP address of the user is bound to the corresponding service portfor authenticating the user, thus ensuring the security of the authentication.

l MAC address binding: The MAC address is bound to the service port, thus preventing theaccess of illegal users.




Issue 03 (2010-01-28)

l Anti-MAC spoofing: It is a countermeasure taken by the system to prevent a user fromattacking the system with a forged MAC address.

l Anti-IP spoofing: It is a countermeasure taken by the system to prevent a user from attackingthe system with a forged IP address.

Table 2-8 lists the default settings of the user security mechanism.

Table 2-8 Default settings of the user security mechanism


PITP Global function: disabledPort-level function: enabledVLAN-level function: enabledService-port-level function: enabled

The PITP function can be enabledonly when the functions at alllevels are enabled.

DHCP option82

Global function: disabledPort-level function: enabledVLAN-level function: enabledService-port-level function: enabled

The DHCP option 82 function canbe enabled only when the functionsat all levels are enabled.

Anti-IPspoofing

Global function: disabledService-port-level function: enabledVLAN-level function: enabled

The anti-IP spoofing function canbe enabled only when the functionsat all levels are enabled.

Anti-MACspoofing

Global function: disabledVLAN-level function: disabledService-port-level status: enabled Bydefault, up to eight MAC addressescan be bound.

The anti-MAC spoofing functioncan be enabled only when thefunctions at all levels are enabled.

2.12.1 Configuring Anti-Theft and Roaming of User Account Through PITPPolicy Information Transfer Protocol (PITP) is mainly used for the user PPPoE dialup access.It is a protocol defined for transferring policy information between the access device and theBroadband Remote Access Server (BRAS) through L2 P2P communication. PITP can be usedfor transferring the user physical port information and protecting the user account against theftand roaming.

2.12.2 Configuring Anti-Theft and Roaming of User Accounts Through DHCPDHCP improves the user authentication security by adding the user physical location informationto the option 82 field of the DHCP request packets initiated by the user, so as to prevent theftand roaming of the user account.

2.12.3 Configuring Prevention of Access of Unauthorized UsersThis topic describes how to configure the IP address/MAC address binding to ensure the securityof user authentication and prevent the access of unauthorized users.

2.12.4 Configuring the User Against Malicious AttacksThis topic describes how to configure anti-IP spoofing and anti-MAC spoofing to preventmalicious users from attacking legal users by forging the IP address and MAC address of thelegal users.



2-49

2.12.1 Configuring Anti-Theft and Roaming of User AccountThrough PITP

Policy Information Transfer Protocol (PITP) is mainly used for the user PPPoE dialup access.It is a protocol defined for transferring policy information between the access device and theBroadband Remote Access Server (BRAS) through L2 P2P communication. PITP can be usedfor transferring the user physical port information and protecting the user account against theftand roaming.

Application Context

PITP is a member of Huawei Group Management Protocol (HGMP) family. It is used forproviding the user port information for the BRAS. After the BRAS obtains the user portinformation, the BRAS binds the user account to the user port, thus protecting the user accountagainst theft and roaming. PITP has two modes, the PPPoE+ mode (also called the PITP P mode)and the VBAS mode (also called the PITP V mode).

PITP is applicable to the networking of a standalone MA5600T and the networking of subtendedMA5600Ts.

l In the networking of a standalone MA5600T: Two PCs (PC1 and PC2) are connected todifferent ports of the MA5600T for the dialup access.

l In the networking of subtended MA5600Ts: Two PCs (PC1 and PC2) are connected todifferent MA5600Ts (PC1 is connected to the MA5600T, and PC2 is connected to theMA5600T through a subtended device) for the dialup access.

The principles in the two scenarios are similar. The user dials up from PC1 by using thecorresponding user account. The BRAS binds the user account to the user's physical portinformation reported by the MA5600T. When the user of PC2 dials up by using the user accountof PC1, the BRAS discovers that the user account does not match the physical port informationand thus rejects the dialup access request of PC2.


Table 2-9 lists the default settings related to PITP.

Table 2-9 Default settings related to PITP


PITP function Global function: disabledPort-level function: enabledVLAN-level function: enabledService-port-level function: enabled

PITP sub-option 90 Disabled

User-side PPPoE packet carrying thevendor tag information

Disabled




Issue 03 (2010-01-28)

Procedure

Step 1 Configure the relay agent information option (RAIO). Before using the PITP function, you mustconfigure RAIO.

l Run the raio-mode mode pitp-pmode command to configure the RAIO mode in the PITPP mode.

l Run the raio-mode mode pitp-vmode command to configure the RAIO mode in the PITPV mode.

The PITP P mode supports all the RAIO modes; the PITP V mode currently supports only thecommon, cntel, and userdefine modes. When the auto-sensing traffic stream is configured, fillin 8191.35 as the VPI/VCI of the tag, regardless of whether the traffic stream has learned theVPI/VCI or not.

user-defined: indicates the user-defined mode. In this mode, you need to run the raio-formatcommand to configure the RAIO format. Select a corresponding keyword for configuring theRAIO format according to the PITP mode.

l In the PITP P mode, run the raio-format pitp-pmode command to configure the RAIOformat.

l In the PITP V mode, run the raio-format pitp-vmode command to configure the RAIOformat.

In the case of the user-defined RAIO format, configure the circuit ID (CID) and the remote ID(RID). If the access mode is not selected, the configured format applies to all access modes. Ifthe access mode is selected, the configured format applies to only this access mode. The CIDformat and RID format in the PITP V mode are the same:

l CID: identifies the attribute information about the device.

l RID: identifies the access information about the user.

Step 2 Configure the PITP function.

The PITP function can be enabled or disabled at four levels. The PITP function is enabled onlywhen it is enabled at all levels. The global PITP function has higher priority over the port-leveland service-port-level PITP functions.

1. Global PITP function: Run the pitp enable pmode command to enable global PITP P mode.By default, the global PITP function is disabled.

In the PITP V mode, run the pitp vmode ether-type command to set the Ethernet protocoltype to be the same as that of the BRAS. Then, run the pitp enable vmode command toenable global PITP V mode.

NOTE

The Ethernet protocol type of the PITP V mode must be configured when the PITP V mode is disabled.

2. Port-level PITP function: Run the pitp port or pitp board command to configure the port-level PITP function. By default, the port-level PITP function is enabled.

3. VLAN-level PITP function:


b. Run the pitp enable command to enable the PITP function of the VLAN. By default,the PITP function of the VLAN is enabled.



2-51

c. Run the commit command to make the profile configuration take effect. Theconfiguration of the VLAN service profile takes effect only after this command isexecuted.

d. Run the quit command to quit the VLAN service profile mode.e. Run the vlan bind service-profile command to bind the VLAN to the VLAN service

profile configured in 2.3.a.4. Service-port-level PITP function: Run the pitp service-port command to enable the

service-port-level PITP function. By default, the service-port-level PITP function isenabled.

Step 3 Configure the optional attributes of PITP.l Run the pitp permit-forwarding service-port command to set whether the service port

allows the user-side PPPoE packet carrying the vendor tag information. By default, thisfunction is disabled, that is, the user-side PPPoE packet carrying the vendor tag informationis not allowed.The system adds a tag containing the device name, shelf ID, slot ID, and port ID to the PPPoE+ upstream PADI and PADR packets to generate new packets. If this function is enabled,tagged packets are forwarded. If this function is disabled, tagged packets are discarded.When the PITP function is applied to the OLT+MxU network, pay attention to the followingpoints:

1. When the PITP function is enabled only on the OLT, the tag of the PADI packet containsonly the information about the PON port of the OLT.

2. When the PITP function is enabled only on the MxU, the tag of the PADI packet containsonly the information about the user port of the MxU.

3. If the PITP function is enabled on both the OLT and the MxU, a function (through thepitp permit-forwarding service-port command) is used to choose which tag the PADIpacket carries.– When this function is enabled, the tag of the PADI packet contains only the

information about the PON port of the OLT.– When this function is disabled, subscribers connected to the MxU fail to dial the

number. That is, the PADI packet (PITP P mode) cannot be transmitted.

The PON board of the OLT can be connected to the terminals such as the ONT and the MxU.Generally, the PITP function is enabled on the OLT in the global mode. Certain PON portsare connected to ONUs. For example, in the FTTB application, however, the MDUs areconnected to multiple subscribers. For the OLT, an MDU is one subscriber, regardless ofhow many subscribers are connected to the MDU. In this case, to differentiate subscribersconnected to the MDU, you need to enable the PITP function on the MDU.

l Run the pitp sub-option90 command to configure PITP sub-option 90. By default, PITPsub-option 90 is disabled.The PPPoE+ mode supports reporting the sub-option 90 line parameters, including theactivation bandwidth. Enable or disable PITP sub-option 90 according to actual requirements.The configuration of PITP sub-option 90 takes effect only in the PITP P mode; the PITP Vmode does not support reporting the line parameters.

----End

ExampleAssume the following configuration:




Issue 03 (2010-01-28)

l RAIO mode: user-defined mode

l CID format for the Ethernet access mode: shelf ID/slot ID/port ID:VLAN ID

l CID format for the xPON access mode: shelf ID/slot ID/port ID:ONT ID.VLAN ID

To enable the PITP P mode of service port 1 under port 0/11/0, do as follows:

huawei(config)#raio-mode user-defined pitp-pmodehuawei(config)#raio-format pitp-pmode cid eth anid eth frame/slot/port:vlanid huawei(config)#raio-format pitp-pmode cid xpon anid xpon frame/slot/port:ontid.vlanidhuawei(config)#raio-format pitp-pmode rid eth plabelhuawei(config)#raio-format pitp-pmode rid xpon plabelhuawei(config)#pitp enable pmodehuawei(config)#pitp port 0/11/0 enable huawei(config)#pitp service-port 1 enable

Assume the following configuration:l RAIO mode: user-defined mode

l CID/RID format for the Ethernet access mode: shelf ID/slot ID/port ID:VLAN ID

l CID/RID format for the xPON access mode: shelf ID/slot ID/port ID:ONT ID.VLAN ID

To set the Ethernet protocol type of VBRAS packets to be the same as that of the upper-layerBRAS, that is, 0x8500, and enable the PITP V mode of service port 0, do as follows:

huawei(config)#raio-mode user-defined pitp-vmodehuawei(config)#raio-format pitp-vmode eth anid eth frame/slot/port:vlanidhuawei(config)#raio-format pitp-vmode xpon anid xpon frame/slot/port:ontid.vlanidhuawei(config)#pitp vmode ether-type 0x8500 huawei(config)#pitp enable vmodehuawei(config)#pitp port 0/12/0 enable huawei(config)#pitp service-port 0 enable

2.12.2 Configuring Anti-Theft and Roaming of User AccountsThrough DHCP

DHCP improves the user authentication security by adding the user physical location informationto the option 82 field of the DHCP request packets initiated by the user, so as to prevent theftand roaming of the user account.

Background InformationThe option 82 field contains the circuit ID (CID), remote ID (RID), and sub-option 90 field(optional), which provides the information such as the user shelf ID, slot ID, port ID, VPI, andVCI.

The MA5600T can work in the L2 DHCP forwarding mode or L3 DHCP forwarding mode. Ineither mode, anti-theft and roaming of user accounts through DHCP option 82 can be configured,and the configurations are the same.

Table 2-10 lists the default settings related to DHCP option 82.



2-53

Table 2-10 Default settings related to DHCP option 82


Status of the DHCP option 82 function Global status: disabledPort-level status: enabledVLAN-level status: enabledService-port-level status: enabled

Status of the DHCP sub-option 7function

Disabled

Status of the DHCP sub-option 90function

Disabled

Procedure

Step 1 Configure the RAIO. The RAIO is the short form for relay agent information option. Beforeusing the DHCP function, you must configure the RAIO.

Run the raio-mode command to set the RAIO mode.

l Select dhcp-option 82 as the corresponding mode.

l In the user-defined mode, you need to run the raio-format command to configure the RAIOformat, and select dhcp-option 82 as the corresponding mode. To configure the user-definedformat, mainly configure the RID in the CID. If the access mode is not selected, theconfigured format is valid to all access modes. If the access mode is selected, the configuredformat is valid to only this access mode. For details about the RAIO format, see the raio-format command.

– CID identifies the attribute information of the device.

– RID identifies the access information of the user.

Step 2 (Optional) Set the service port to allow or prohibit the user-side DHCP packets that carry theoption 82 information.

l Run the dhcp-option82 permit-forwarding service-port command to set the service portto allow or prohibit the DHCP packets that carry the option 82 information.

The system adds the device name, shelf ID, slot ID, and port ID to the option 82 field ofDHCP packets to generate new packets. If the service port is set to allow the packets carryingthe option 82 information, tagged packets are forwarded. If the service port is set to prohibitthe packets carrying the option 82 information, tagged packets are dropped.

Step 3 Enable or disable the DHCP option 82 function.

Run the dhcp option82 command to enable the DHCP option 82 function on the port. By default,the DHCP option 82 function is disabled globally.

The DHCP option 82 function can be enabled or disabled at four levels. The DHCP option 82function takes effect only when it is enabled at all levels.

1. System level: Run the dhcp option82 command to enable the DHCP option 82 functionglobally. By default, the DHCP option 82 function is disabled globally.




Issue 03 (2010-01-28)

2. Port level: Run the dhcp option82 board or dhcp option82 port command to enable theDHCP option 82 function for a board or port. By default, the DHCP option 82 function fora board or port is enabled.

3. VLAN level:


b. Run the dhcp option82 command to enable the DHCP option 82 function. By default,the DHCP option 82 function is enabled.

c. Run the commit command to make the profile configuration take effect. Theconfiguration of the VLAN service profile takes effect only after you run thiscommand.

d. Run the quit command to quit the VLAN service profile mode.e. Run the vlan bind service-profile command to bind the VLAN service profile created

in 3.3.a to the VLAN.4. Service port level: Run the dhcp option82 service-port command to enable the DHCP

option 82 function for a service port. By default, the DHCP option 82 function for a serviceport is enabled.

Step 4 (Optional) Enable or disable the sub-option function.In the PPPoE+ mode, reporting the sub-option 90 line parameters, including reporting theactivation bandwidth, is supported. Enable or disable the sub-option function according to yourrequirements. In the DHCP option 82 mode, sub-option 81 to sub-option 91 in sub-option 9 needto be filled.1. Run the dhcp sub-option7 command to enable or disable the sub-option 7 function. By

default, the sub-option 7 function is disabled.2. Run the dhcp sub-option90 command to enable or disable the sub-option 90 function. By

default, the sub-option 90 function is disabled.

----End

ExampleTo enable the DHCP option 82 function, Assume that:l RAIO mode: user-defined model CID format for the ETH access mode: shelf ID/slot ID/sub slot ID/port ID: vlanidl CID format for the xPON access mode: shelf ID/slot ID/sub slot ID/port ID: ontid.vlanidl RID format for all access modes: label of the service portdo as follows:huawei(config)#raio-mode user-defined dhcp-option 82huawei(config)#raio-format dhcp-option 82 cid eth anid eth frame/slot/subslot/port:vlanidhuawei(config)#raio-format dhcp-option 82 cid xpon anid xpon frame/slot/subslot/port:ontid.vlanidhuawei(config)#raio-format dhcp-option 82 rid eth splabelhuawei(config)#raio-format dhcp-option 82 rid xpon splabelhuawei(config)#dhcp option 82 enable

2.12.3 Configuring Prevention of Access of Unauthorized UsersThis topic describes how to configure the IP address/MAC address binding to ensure the securityof user authentication and prevent the access of unauthorized users.



2-55

Background InformationIP address binding refers to binding an IP address to a service port. After the binding, the serviceport permits only the packet whose source IP address is the bound address to go upstream, anddiscards the packets that carry other source IP addresses.

MAC address binding refers to binding a MAC address to a service port. After the binding, onlythe user whose MAC address is the bound MAC address can access the network through theservice port. The MA5600T does not support the direct binding of a MAC address. Instead, thebinding between a service port and a MAC address is implemented through setting a static MACaddress entry of a port and setting the maximum number of learnable MAC addresses to 0.

Procedurel Bind an IP address.

Run the bind ip command to bind an IP address to a service port.

To permit only the users of certain IP addresses to access the system so that illegal userscannot access the system by using the IP addresses of legal users, configure the IP addressbinding.

l Bind a MAC address.1. Run the mac-address static command to add a static MAC address.2. Run the mac-address max-mac-count command to set the maximum number of

learnable MAC addresses to 0. By default, the maximum number of learnable MACaddresses of a port in the system is 255.

This parameter is to limit the maximum number of the MAC addresses that can belearned through one account, that is, to limit the maximum number of the PCs thatcan access the Internet through one account.

----End

ExampleTo bind IP address 10.1.1.245 to service port 2, that is, service port 2 permits only the packetwhose source IP address is 10.1.1.245, do as follows.huawei(config)#bind ip service-port 2 10.1.1.245

To bind static MAC address 1010-1010-1010 to service port 1, and set the maximum numberof learnable MAC addresses to 0, that is, service port 1 permits only the packet whose sourceMAC address is 1010-1010-1010, do as follows:huawei(config)#mac-address static service-port 1 1010-1010-1010 huawei(config)#mac-address max-mac-count service-port 1 0

2.12.4 Configuring the User Against Malicious AttacksThis topic describes how to configure anti-IP spoofing and anti-MAC spoofing to preventmalicious users from attacking legal users by forging the IP address and MAC address of thelegal users.

Background InformationAnti-IP spoofing is to dynamically trigger the IP address binding, thus preventing illegal usersfrom stealing the IP address of legal users. When anti-IP spoofing is enabled, a user port is bound




Issue 03 (2010-01-28)

to an IP address after the user goes online. Then, the user cannot go online through this port byusing other IP addresses, and any user cannot go online through other ports by using this IPaddress.

The major function of anti-MAC spoofing is to prevent illegal users from forging the MACaddress of legal users. The purpose is to ensure that the service of legal users is not affected.Anti-MAC spoofing is mainly applied to PPPoE and DHCP access users.

Procedurel Configure anti-IP spoofing.

The anti-IP spoofing function can be enabled or disabled at three levels. The anti-IPspoofing function is enabled only when it is enabled at all the three levels.

– Global function: Run the security anti-ipspoofing command to configure the globalfunction. By default, the global function is disabled.

– VLAN-level function:

1. Run the vlan service-profile command to create a VLAN service profile and enterthe VLAN service profile mode.

2. Run the security anti-ipspoofing command to configure the VLAN-levelfunction. By default, the VLAN-level function is enabled.

3. Run the commit command to make the profile configuration take effect. Theconfiguration of the VLAN service profile takes effect only after this command isexecuted.

4. Run the quit command to quit the VLAN service profile mode.

5. Run the vlan bind service-profile command to bind the VLAN to the VLANservice profile configured in 1.

– Service-port-level function: Run the security anti-ipspoofing service-port commandto configure the service-port-level function. By default, the service-port-level functionis enabled.

NOTE

When anti-IP spoofing is enabled after a user is already online, the IP address of this user is not bound bythe system. As a result, the service of this user is interrupted, this user goes offline, and the user needs togo online again. Only the user who goes online after anti-IP spoofing is enabled can have the IP addressbound.

l Configure anti-MAC spoofing.

CAUTIONTo ensure device security, it is recommended that you enable this function.

The anti-MAC spoofing function can be enabled or disabled at three levels. The anti-MACspoofing function is enabled only when it is enabled at all the three levels.

– Global function: Run the security anti-macspoofing command to configure the globalfunction. By default, the global function is disabled.

– You can configure the VLAN-level function in either of the following two modes:



2-57

– In the global config mode: Run the security anti-macspoofing vlan command toconfigure the VLAN-level function. By default, the VLAN-level function isdisabled.

– In the VLAN service profile:

1. Run the vlan service-profile command to create a VLAN service profile andenter the VLAN service profile mode.

2. Run the security anti-macspoofing command to configure the VLAN-levelfunction. By default, the VLAN-level function is disabled.

3. Run the commit command to make the profile configuration take effect. Theconfiguration of the VLAN service profile takes effect only after this commandis executed.

4. Run the quit command to quit the VLAN service profile mode.5. Run the vlan bind service-profile command to bind the VLAN to the VLAN

service profile configured in 1.– Service-port-level function: Run the security anti-macspoofing max-mac-count

command to configure the maximum number of MAC addresses that can be bound tothe service port. By default, up to eight MAC addresses can be bound.

NOTE

When anti-MAC spoofing is enabled after a user is already online, the MAC address of this user is notbound by the system. As a result, the service of this user is interrupted, this user goes offline, and the userneeds to go online again. Only the user who goes online after anti-MAC spoofing is enabled can have theMAC address bound.

----End

ExampleTo enable anti-IP spoofing for service port 1 in service VLAN 10, do as follows:

huawei(config)#security anti-ipspoofing enablehuawei(config)#vlan service-profile profile-id 2huawei(config-vlan-srvprof-2)#security anti-ipspoofing enable Info: Please use the commit command to make modifications take effecthuawei(config-vlan-srvprof-2)#commithuawei(config-vlan-srvprof-2)#quithuawei(config)#vlan bind service-profile 10 profile-id 2huawei(config)#security anti-ipspoofing service-port 1 enable

Assume that service port 2 is in VLAN 10. To enable anti-MAC spoofing for VLAN 10, and setthe maximum number of MAC addresses that can be bound to service port 2 to 7, do as follows:

huawei(config)#security anti-macspoofing enablehuawei(config)#security anti-macspoofing vlan 10 enablehuawei(config)#security anti-macspoofing max-mac-count service-port 2 7

2.13 Configuring AAAThis topic describes how to configure the AAA on the MA5600T, including configuring theMA5600T as the local and remote AAA servers.




Issue 03 (2010-01-28)

Background InformationAAA refers to authentication, authorization, and accounting. In the process that a user accessesnetwork resources, through AAA, certain rights are authorized to the user if the user passesauthentication, and the original data about the user accessing network resources is recorded.l Authentication: Checks whether a user is allowed to access network resources.

l Authorization: Determines what network resources a user can access.

l Accounting: Records the original data about the user accessing network resources.

For details, see .

Application ContextAAA is generally applied to the users that access the Internet in the PPPoA, PPPoE, 802.1x,VLAN, WLAN, ISDN, or Admin Telnet (associating the user name and the password with thedomain name) mode.

NOTE

In the existing network, 802.1x and Admin Telnet correspond to the local AAA, that is, the MA5600Tfunctions as a local AAA server; PPPoE corresponds to the remote AAA, that is, the MA5600T functionsas the client of a remote AAA server.

Figure 2-6 shows an example network of the AAA application.

Figure 2-6 Example network of the AAA application

The preceding figure shows that the AAA function can be implemented on the MA5600T in thefollowing three ways:l The MA5600T functions as a local AAA server. In this case, the local AAA needs to be

configured. The local AAA does not support accounting.l The MA5600T functions as the client of a remote AAA server, and is connected to the

HWTACACS server through the HWTACACS protocol, thus implementing the AAA.l The MA5600T functions as the client of a remote AAA server, and is connected to the

RADIUS server through the RADIUS protocol, thus implementing the AAA. The RADIUSprotocol, however, does not support authorization.

Table 2-11 lists the differences between HWTACACS and RADIUS.



2-59

Table 2-11 Differences between HWTACACS and RADIUS

HWTACACS RADIUS

Uses TCP to realize more reliable networktransmission.

Uses UDP for transmission.

Encrypts the body of HWTACACS packets,except their header.

Encrypts only the password field of theauthenticated packets.

Separated authorization and authentication. Concurrent processing of authentication andauthorization.

Applicable to security control. Applicable to accounting.

Supports authorization of the configurationcommands on the router.

Does not support the authorization of theconfiguration commands on the router.

2.13.1 Configuring the Local AAAThis topic describes how to configure the local AAA so that the user authentication can beperformed locally.

2.13.2 Configuring the Remote AAA (RADIUS Protocol)The MA5600T is interconnected with the RADIUS server through the RADIUS protocol toimplement authentication and accounting.

2.13.3 Configuring the Remote AAA (HWTACACS Protocol)The MA5600T is interconnected with the HWTACACS server through the HWTACACSprotocol to implement authentication, authorization, and accounting.

2.13.4 Configuration Example of the RADIUS Authentication and AccountingThe MA5600T is interconnected with the RADIUS server through the RADIUS protocol toimplement authentication and accounting.

2.13.5 Configuration Example of the HWTACACS Authentication (802.1X access user)The MA5600T is interconnected with the HWTACACS server through the HWTACACSprotocol to implement authentication, authorization, and accounting.

2.13.6 Configuration Example of the HWTACACS Authentication (Management User)The MA5600T allows the management user of the device to log in to the system by theHWTACACS authentication mode.

2.13.1 Configuring the Local AAAThis topic describes how to configure the local AAA so that the user authentication can beperformed locally.

Background Informationl The local AAA configuration is simple, which does not depend on the external server.

l The local AAA supports only authentication.




Issue 03 (2010-01-28)

Procedure

Step 1 Configure the AAA authentication scheme.

NOTE

l The authentication scheme specifies how all the users in an Internet service provider (ISP) domain areauthenticated. The system supports up to 16 authentication schemes.

l The system has a default authentication scheme named default. It can be modified, but cannot be deleted.

1. Run the aaa command to enter the AAA mode.2. Run the authentication-scheme command to add an authentication scheme.3. Run the authentication-mode local command to configure the authentication mode of the

authentication scheme.4. Run the quit command to return to the AAA mode.

Step 2 Create a domain.

NOTE

l A domain is a group of users of the same type.

l When the user name is in the format of userid@domain-name (for example, [email protected]),"domain name" following "@" is the domain name, and "userid" is the user name used for authentication.

l The domain name for user login cannot exceed 15 characters, and the other domain names cannot exceed20 characters.

1. In the AAA mode, run the domain command to create a domain.

Step 3 Refer the authentication scheme.

NOTE

You can refer an authentication scheme in a domain only after the authentication scheme is created.

1. In the domain mode, run the authentication-scheme command to reference theauthentication scheme.

2. Run the quit command to return to the AAA mode.

Step 4 Configure a local user.

In the AAA mode, run the local-user password command to create a local AAA user.

----End

ExampleUser1 in the isp domain adopts the local server for authentication. The authentication scheme isnewscheme, the password is a123456, do as follows:

huawei(config)#aaa huawei(config-aaa)#authentication-scheme newscheme Info: Create a new authentication scheme huawei(config-aaa-authen-newscheme)#authentication-mode localhuawei(config-aaa-authen-newscheme)#quithuawei(config-aaa)#domain isp Info: Create a new domain huawei(config-aaa-domain-isp)#authentication-scheme newschemehuawei(config-aaa-domain-isp)#quit



2-61

huawei(config-aaa)#local-user user1 password a123456

2.13.2 Configuring the Remote AAA (RADIUS Protocol)The MA5600T is interconnected with the RADIUS server through the RADIUS protocol toimplement authentication and accounting.

Background Informationl What is RADIUS:

– Radius is short for the remote authentication dial-in user service. It is a distributedinformation interaction protocol with the client-server structure. Generally, it is used tomanage a large number of distributed dial-in users.

– Radius implements the user accounting by managing a simple user database.

– The authentication and accounting requests of users can be passed on to the Radiusserver through a network access server (NAS).

l Principle of RADIUS:– When a user tries to access another network (or some network resources) by setting up

a connection to the NAS through a network, the NAS forwards the user authenticationand accounting information to the RADIUS server. The RADIUS protocol specifies themeans of transmitting the user information and accounting information between theNAS and the RADIUS server.

– The RADIUS server receives the connection requests of users sent from the NAS,authenticates the user account and password contained in the user data, and returns therequired data to the NAS.

l Specification:– For the MA5600T, the RADIUS is configured based on each RADIUS server group.

– In actual networking, a RADIUS server group can be any of the following:– An independent RADIUS server

– A pair of primary/secondary RADIUS servers with the same configuration butdifferent IP addresses

– The following lists the attributes of a RADIUS server template:– IP addresses of primary and secondary servers

– Shared key

– RADIUS server type

l The configuration of the RADIUS protocol defines only the essential parameters for theinformation exchange between the MA5600T and the RADIUS server. To make theessential parameters take effect, the RADIUS server group should be referenced in a certaindomain.

Procedurel Configure the authentication scheme.




Issue 03 (2010-01-28)

NOTE

l The authentication scheme specifies how all the users in an ISP domain are authenticated.

l The system supports up to 16 authentication schemes. The system has a default accountingscheme named default. It can only be modified, but cannot be deleted.

1. Run the aaa command to enter the AAA mode.2. Run the authentication-scheme command to add an authentication scheme.3. Run the authentication-mode radius command to configure the authentication mode

of the authentication scheme.4. Run the quit command to return to the AAA mode.

l Configure the accounting scheme.NOTE

l The accounting scheme specifies how all the users in an ISP domain are charged.

l The system supports up to 128 accounting schemes. The system has a default accounting schemenamed default. It can be modified, but cannot be deleted.

1. In the AAA mode, run the accounting-scheme command to add an AAA accountingscheme.

2. Run the accounting-mode radius command to configure the accounting mode.3. Run the accounting interim interval command to set the interval of real-time

accounting. By default, the interval is 0 minutes, that is, the real-time accounting isnot performed.

4. Run the quit command to return to the AAA mode.l Configure the RADIUS server template.

1. Run the radius-server template command to create an RADIUS server template andenter the RADIUS server template mode.

2. Run the radius-server authentication command to configure the IP address and theUDP port ID of the RADIUS server for authentication.

NOTE

l To guarantee normal communication between the MA5600T and the RADIUS server, beforeconfiguring the IP address and UDP port of the RADIUS server, make sure that the route betweenthe RADIUS server and the MA5600T is in the normal state.

l Make sure that the configuration of the RADIUS service port of the MA5600T is consistent withthe port configuration of the RADIUS server.

3. Run the radius-server accounting command to configure the IP address and the UDPport ID of the RADIUS server for accounting.

4. Run the radius-server shared-key command to configure the shared key of theRADIUS server.

NOTE

l The RADIUS client (MA5600T) and the RADIUS server use the MD5 algorithm to encrypt theRADIUS packets. They check the validity of the packets by setting the encryption key. Theycan receive the packets from each other and can respond to each other only when their keys arethe same.

l By default, the shared key of the RADIUS server is huawei.

5. (Optional) Run the radius-server timeout command to set the response timeout timeof the RADIUS server. By default, the timeout time is 5s.

The MA5600T sends the request packets to the RADIUS server. If the RADIUS serverdoes not respond within the response timeout time, the MA5600T re-transmits the



2-63

request packets to the RADIUS to ensure that users can get corresponding servicesfrom the RADIUS server.

6. (Optional) Run the radius-server retransmit command to set the maximum re-transmit time of the RADIUS request packets. By default, the maximum re-transmittime is 3.

When the re-transmit time of the RADIUS request packets to a RADIUS serverexceeds the maximum re-transmit time, the MA5600T considers that itscommunication with the RADIUS server is interrupted, and thus transmits theRADIUS request packets to another RADIUS server.

7. Run the (undo)radius-server user-name domain-included command to configurethe user name (not) to carry the domain name when transmitted to the RADIUS server.By default, the user name of the RADIUS server carries the domain name.

– An access user is named in the format of userid@domain-name, and the part after@ is the domain name. The MA5600T classifies a user into a domain accordingto the domain name.

– If an RADIUS server group rejects the user name carrying the domain name, theRADIUS server group cannot be set or used in two or more domains. Otherwise,when some access users in different domains have the same user name, theRADIUS server considers that these users are the same because the namestransmitted to the server are the same.

8. Run the quit command to return to the global config mode.

l Create a domain.

NOTE


l When the user name is in the format of userid@domain-name (for example,[email protected]), "domain-name" followed by "@" is the domain name, and "userid"is the user name used for authentication.

l The domain name for user login cannot exceed 15 characters, and the other domain names cannotexceed 20 characters.

1. Run the aaa command to enter the AAA mode.

2. In the AAA mode, run the domain command to create a domain.

l Use the authentication scheme.

NOTE

You can use an authentication scheme in a domain only after the authentication scheme is created.

In the domain mode, run the authentication-scheme command to use the authenticationscheme.

l Use the accounting scheme.

NOTE

You can use an accounting scheme in a domain only after the accounting scheme is created.

In the domain mode, run the accounting-scheme command to use the accounting scheme.

l Use the RADIUS server template.

NOTEYou can use a RADIUS server template in a domain only after the RADIUS server template is created.




Issue 03 (2010-01-28)

1. In the domain mode, run the radius-server template command to use the RADIUSserver template.


----End

ExampleUser1 in the isp domain adopts the HWTACACS protocol for authentication and accounting.The accounting interval is 10 minutes, the authentication password is a123456, HWTACACSserver 129.7.66.66 functions as the primary authenticationand accounting server, andHWTACACS server 129.7.66.67 functions as the standby authenticationand accounting server.On the HWTACACS server, the authentication port ID is 1812, accounting port ID 1813, andother parameters adopt the default values. To perform the preceding configuration, do as follows:

huawei(config)#aaa huawei(config-aaa)#authentication-scheme newscheme huawei(config-aaa-authen-newscheme)#authentication-mode radiushuawei(config-aaa-authen-newscheme)#quit huawei(config-aaa)#accounting-scheme newschemehuawei(config-aaa-accounting-newscheme)#accounting-mode radius huawei(config-aaa-accounting-newscheme)#accounting interim interval 10huawei(config-aaa-accounting-newscheme)#quithuawei(config)#radius-server template hwtesthuawei(config-radius-hwtest)#radius-server authentication 129.7.66.66 1812huawei(config-radius-hwtest)#radius-server authentication 129.7.66.67 1812 secondaryhuawei(config-radius-hwtest)#radius-server accounting 129.7.66.66 1813huawei(config-radius-hwtest)#radius-server accounting 129.7.66.67 1813 secondaryhuawei(config-radius-hwtest)#quit huawei(config)#aaa huawei(config-aaa)#domain isp huawei(config-aaa-domain-isp)#authentication-scheme newscheme huawei(config-aaa-domain-isp)#accounting-scheme newscheme huawei(config-aaa-domain-isp)#radius-server hwtest huawei(config-aaa-domain-isp)#quit

2.13.3 Configuring the Remote AAA (HWTACACS Protocol)The MA5600T is interconnected with the HWTACACS server through the HWTACACSprotocol to implement authentication, authorization, and accounting.

Background Informationl What is HWTACACS:

– HWTACACS is a security protocol with enhanced functions on the base of TACACS(RFC1492). Similar to the RADIUS protocol, HWTACACS implements multiplesubscriber AAA functions through communications with the HWTACACS server inthe client/server (C/S) mode.

– HWTACACS is used for the authentication, authorization, and accounting for the 802.1access users and management users.

l Principle of HWTACACS:Adopting the client/server architecture, HWTACACS is a protocol through which the NAS(MA5600T) transmits the encrypted HWTACACS data packets to communicate with theHWTACACS database of the security server. The working mode is as follows:– HWTACACS authentication. When the remote user connects to the corresponding port

of the NAS, the NAS communicates with the daemon of the HWTACACS server, and



2-65

obtains the prompt of entering the user name from the daemon. Then, the NAS displaysthe message to the user. When the remote user enters the user name, the NAS transmitsthe user name to the daemon. Then, the NAS obtains the prompt of entering thepassword, and displays the message to the user. After the remote user enters thepassword, the NAS transmits the password to the daemon.

– HWTACACS authorization. After being authenticated, the user can be authorized. TheNAS communicates with the daemon of the HWTACACS server, and then returns theaccept or reject response of the authorization.

NOTE

l The HWTACACS configuration only defines the parameters used for data exchange between theMA5600T and the HWTACACS server. To make these parameters take effect, you need to use theHWTACACS server group in a domain.

l The settings of an HWTACACS server template can be modified regardless of whether the templateis bound to a server or not.

Procedure

Step 1 Configure the AAA authentication scheme.

NOTE

l The authentication scheme specifies how all the users in an ISP domain are authenticated.

l The system supports up to 16 authentication schemes. The system has a default authentication schemenamed default. It can be modified, but cannot be deleted.

1. Run the aaa command to enter the AAA mode.2. Run the authentication-scheme command to add an authentication scheme.3. Run the authentication-mode local command to configure the authentication mode of the

authentication scheme. Use the HWTACACS protocol to authenticate users.4. Run the quit command to return to the AAA mode.

Step 2 Configure the AAA authorization scheme.

NOTE

l The authorization scheme specifies how all the users in an ISP domain are authorized.

1. In the AAA mode, run the authorization-scheme command to add an AAA authorizationscheme.

2. Run the authorization-mode hwtacacs command to configure the authorization mode.3. Run the quit command to return to the AAA mode.4. Run the quit command to return to the global config mode.

Step 3 Configure the AAA accounting scheme.

NOTE

l The accounting scheme specifies how all the users in an ISP domain are charged.

l The system supports up to 128 accounting schemes. The system has a default accounting scheme nameddefault. It can be modified, but cannot be deleted.

1. In the AAA mode, run the accounting-scheme command to add an AAA accountingscheme.

2. Run the accounting-mode hwtacacs command to configure the accounting mode. Bydefault, the accounting is not performed.




Issue 03 (2010-01-28)

3. Run the accounting interim interval command to set the interval of real-time accounting.By default, the interval is 0 minutes, that is, the real-time accounting is not performed.


Step 4 Configure the HWTACACS protocol.l The configuration of the HWTACACS protocol of the MA5600T is on the basis of the

HWTACACS server group. In actual networking scenarios, an HWTACACS server groupcan be an independent HWTACACS server or a combination of two HWTACACS servers,that is, a primary server and a secondary server with the same configuration but different IPaddresses.

l Each HWTACACS server template contains the primary/secondary server IP address, sharedkey, and HWTACACS server type.

l Primary and secondary authentication, accounting, and authorization servers can beconfigured. The IP address of the primary server, however, must be different from that ofthe secondary server. Otherwise, the configuration of primary and secondary servers willfail. By default, the IP addresses of the primary and secondary servers are both 0.0.0.0.

1. Run the hwtacacs-server template command to create an HWTACACS server templateand enter the HWTACACS server template mode.

2. Run the hwtacacs-server authentication command to configure a primary authenticationserver. You can select secondary to configure a secondary authentication server.

NOTE

l To ensure normal communication between the MA5600T and the HWTACACS server, beforeconfiguring the IP address and the TCP port of the HWTACACS server, make sure that the routebetween the HWTACACS server and the MA5600T is in the normal state.

l Make sure that the HWTACACS server port of the MA5600T is the same as the port of theHWTACACS server.

3. Run the hwtacacs-server accounting command to configure a primary accounting server.You can select secondary to configure a secondary accounting server.

4. Run the hwtacacs-server authorization command to configure a primary authorizationserver. You can select secondary to configure a secondary authorization server.

5. (Optional) Run the hwtacacs-server shared-key command to configure the shared key ofthe HWTACACS server.

NOTE

l The HWTACACS client (MA5600T) and the HWTACACS server use the MD5 algorithm to encryptthe HWTACACS packets. They check the validity of the packets by configuring the encryption key.They can receive the packets from each other and can respond to each other only when their keys arethe same.

l By default, the HWTACACS server does not have a key.

6. (Optional) Run the hwtacacs-server timer response-timeout to set the response timeouttime of the HWTACACS server.

NOTE

l If the HWTACACS server does not respond to the HWTACACS request packets within the timeouttime, the communication between the MA5600T and the current HWTACACS server is consideredinterrupted.

l By default, the response timeout time of the HWTACACS server is 5s.

7. (Optional) In the global config mode, run the hwtacacs-server accounting-stop-packetcommand to configure the re-transmission mechanism of the accounting-stop packets ofthe HWTACACS server.



2-67

NOTE

l To prevent the loss of the accounting packets, the MA5600T supports the re-transmission of theaccounting-stop packets of the HWTACACS server.

l By default, the re-transmit time of the accounting-stop packets of the HWTACACS server is 100.

8. (Optional) Run the (undo)hwtacacs-server user-name domain-included command toconfigure the user name (not) to carry the domain name when transmitted to theHWTACACS server.l By default, the user name of the HWTACACS server carries the domain name.

l After the undo hwtacacs-server user-name domain-included command is executed,he domain name is deleted from the user name when the client sends authentication andauthorization requests to the HWTACACS server. The domain name in the user nameof the accounting request is, however, reserved. This is to ensure that the users can bedistinguished from each other in the accounting.

9. Run the quit command to return to the global config mode.


NOTE


l When the user name is in the format of userid@domain-name (for example, [email protected]),"domain-name" followed by "@" is the domain name, and "userid" is the user name used for authentication.


1. Run the aaa command to enter the AAA mode.2. In the AAA mode, run the domain command to create a domain.

Step 6 Use the authentication scheme.

NOTE

You can use an authentication scheme in a domain only after the authentication scheme is created.

In the domain mode, run the authentication-scheme command to use the authentication scheme.

Step 7 Use the accounting scheme.

NOTE


In the domain mode, run the accounting-scheme command to use the accounting scheme.

Step 8 Use the authorization scheme.

NOTE

You can use an authorization scheme in a domain only after the authorization scheme is created.

In the domain mode, run the authorization-mode command to use the authorization scheme.

Step 9 Use the HWTACACS server template.

NOTE

You can use an HWTACACS server template in a domain only after the HWTACACS server template is created.

1. In the domain mode, run the hwtacacs-server template command to use the HWTACACSserver template.




Issue 03 (2010-01-28)


----End

Example

User1 in the isp domain adopts the HWTACACS protocol for authentication, authorization, andaccounting. The accounting interval is 10 minutes, the authentication password is a123456,HWTACACS server 129.7.66.66 functions as the primary authentication, authorization, andaccounting server, and HWTACACS server 129.7.66.67 functions as the standby authentication,authorization, and accounting server. On the HWTACACS server, the parameters adopt thedefault values. To perform the preceding configuration, do as follows:

huawei(config)#aaa huawei(config-aaa)#authentication-scheme newscheme huawei(config-aaa-authen-newscheme)#authentication-mode hwtacacshuawei(config-aaa-authen-newscheme)#quithuawei(config-aaa)#authorization-scheme newschemehuawei(config-aaa-author-newscheme)#authorization-mode hwtacacshuawei(config-aaa-author-newscheme)#quithuawei(config-aaa)#accounting-scheme newschemehuawei(config-aaa-accounting-newscheme)#accounting-mode hwtacacs huawei(config-aaa-accounting-newscheme)#accounting interim interval 10huawei(config-aaa-accounting-newscheme)#quithuawei(config)#hwtacacs-server template hwtesthuawei(config-hwtacacs-hwtest)#hwtacacs-server authentication 129.7.66.66huawei(config-hwtacacs-hwtest)#hwtacacs-server authentication 129.7.66.67 secondaryhuawei(config-hwtacacs-hwtest)#hwtacacs-server authorization 129.7.66.66huawei(config-hwtacacs-hwtest)#hwtacacs-server authorization 129.7.66.67 secondaryhuawei(config-hwtacacs-hwtest)#hwtacacs-server accounting 129.7.66.66huawei(config-hwtacacs-hwtest)#hwtacacs-server accounting 129.7.66.67 secondaryhuawei(config-hwtacacs-hwtest)#quit huawei(config)#aaa huawei(config-aaa)#domain isp huawei(config-aaa-domain-isp)#authentication-scheme newschemehuawei(config-aaa-domain-isp)#authorization-scheme newscheme huawei(config-aaa-domain-isp)#accounting-scheme newscheme huawei(config-aaa-domain-isp)#hwtacacs-server hwtest huawei(config-aaa-domain-isp)#quit

2.13.4 Configuration Example of the RADIUS Authentication andAccounting

The MA5600T is interconnected with the RADIUS server through the RADIUS protocol toimplement authentication and accounting.

Service Requirementsl The RADIUS server performs authentication and accounting for users in the ISP1 and ISP2

domains.l The RADIUS server with the IP address 129.7.66.66 functions as the primary server for

authentication and accounting.l The RADIUS server with the IP address 129.7.66.67 functions as the secondary server for

authentication and accounting.l The authentication port number is 1812, and the accounting port number is 1813.

l Other parameters adopt the default settings.



2-69

NetworkingFigure 2-7 shows an example network of the RADIUS Authentication and Accountingapplication.

Figure 2-7 Example network of the RADIUS Authentication and Accounting application.

ProcedureStep 1 Configure the authentication scheme.

Configure authentication scheme named newscheme (users are authenticated throughRADIUS).huawei(config)#aaahuawei(config-aaa)#authentication-scheme newscheme Info: Create a new authentication schemehuawei(config-aaa-authen-newscheme)#authentication-mode radius huawei(config-aaa-authen-newscheme)#quit

Step 2 Configure the accounting scheme.

Configure accounting scheme named newscheme (users are authenticated through RADIUS).the interval is 10 minutes.huawei(config-aaa)#accounting-scheme newscheme Info: Create a new accounting schemehuawei(config-aaa-accounting-newscheme)#accounting-mode radiushuawei(config-aaa-accounting-newscheme)#accounting interim interval 10huawei(config-aaa-accounting-newscheme)#quithuawei(config-aaa)#quit

Step 3 Configure the RADIUS protocol.

Create RADIUS server template named hwtest with the RADIUS server 129.7.66.66 as theprimary authentication and accounting server, and the RADIUS server 129.7.66.67 as thesecondary authentication and accounting server.




Issue 03 (2010-01-28)

huawei(config)#radius-server template hwtacacs Note: Create a new server templatehuawei(config-radius-hwtacacs)#radius-server authentication 129.7.66.66 1812huawei(config-radius-hwtacacs)#radius-server authentication 129.7.66.67 1812 secondary huawei(config-radius-hwtacacs)#radius-server accounting 129.7.66.66 1813huawei(config-radius-hwtacacs)#radius-server accounting 129.7.66.67 1813 secondaryhuawei(config-radius-hwtacacs)#quit


Create a domain named isp1.

huawei(config)#aaa huawei(config-aaa)#domain isp1 Info: Create a new domain


You can use an authentication scheme in a domain only after the authentication scheme iscreated.

huawei(config-aaa-domain-isp1)#authentication-scheme newscheme



huawei(config-aaa-domain-isp1)#accounting-scheme newscheme

Step 7 Use the RADIUS server template.

You can use a RADIUS server template in a domain only after the RADIUS server template iscreated.

huawei(config-aaa-domain-isp1)#radius-server radtesthuawei(config-aaa-domain-isp1)#quit

Step 8 Configure a local AAA user.

Create a local user with the user name user1 and the password a123456.

huawei(config-aaa)#local-user shenzhen@isp1 password a123456

----End

ResultUser 1 in ISP 1 can pass authentication only if both the user name and password are correct, andthen can log in to the MA5600T. Then, the user starts to be accounted.

Configuration File

aaa authentication-scheme newschemeauthentication-mode radius quit accounting-scheme newscheme accounting-mode radius accounting interim interval 10 quit



2-71

quit radius-server template radtest radius-server authentication 129.7.66.66 1812 radius-server authentication 129.7.66.67 1812 secondaryradius-server accounting 129.7.66.66 1813 radius-server accounting 129.7.66.67 1813 secondary quit aaa

domain isp1 authentication-scheme newschemeaccounting-scheme newschemeradius-server radtest quitlocal-user shenzhen@isp1 password a123456

2.13.5 Configuration Example of the HWTACACS Authentication(802.1X access user)

The MA5600T is interconnected with the HWTACACS server through the HWTACACSprotocol to implement authentication, authorization, and accounting.

Service Requirementsl The HWTACACS server performs authentication, authorization, and accounting for

802.1X access users.l The user logs in to the server carrying the domain name.

l The HWTACACS server with the IP address 129.7.66.66 functions as the primary serverfor authentication, authorization, and accounting.

l The HWTACACS server with the IP address 129.7.66.67 functions as the secondary serverfor authentication, authorization, and accounting.


NetworkingFigure 2-8 shows an example network of the HWTACACS authentication.




Issue 03 (2010-01-28)

Figure 2-8 Example network of the HWTACACS authentication

Procedure

Step 1 Configure an authentication scheme.

Configure authentication scheme named newscheme (users are authenticated throughHWTACACS).

huawei(config)#aaahuawei(config-aaa)#authentication-scheme newschemehuawei(config-aaa-authen-newscheme)#authentication-mode hwtacacshuawei(config-aaa-authen-newscheme)#quit

Step 2 Configure an authorization scheme.

Configure authorization scheme named newscheme (users are authorized throughHWTACACS).

huawei(config-aaa)#authorization-scheme newschemehuawei(config-aaa-author-newscheme)#authorization-mode hwtacacshuawei(config-aaa-author-newscheme)#quit

Step 3 Configure the accounting scheme.

Configure accounting scheme named newscheme (users are authenticated throughHWTACACS). the interval is 10 minutes.

huawei(config-aaa)#accounting-scheme newschemehuawei(config-aaa-accounting-newscheme)#accounting-mode hwtacacshuawei(config-aaa-accounting-newscheme)#accounting interim interval 10huawei(config-aaa-accounting-newscheme)#quithuawei(config-aaa)#quit

Step 4 Configure the HWTACACS protocol.



2-73

Create HWTACACS server template named hwtest with the HWTACACS server 129.7.66.66as the primary authentication, authorization and accounting server, and the HWTACACS server129.7.66.67 as the secondary authentication, authorization and accounting server.

huawei(config)#hwtacacs-server template hwtest Create a new HWTACACS-server templatehuawei(config-hwtacacs-radtest)#hwtacacs-server authentication 129.7.66.66huawei(config-hwtacacs-radtest)#hwtacacs-server authentication 129.7.66.67 secondaryhuawei(config-hwtacacs-hwtest)#hwtacacs-server authorization 129.7.66.66huawei(config-hwtacacs-hwtest)#hwtacacs-server authorization 129.7.66.67 secondaryhuawei(config-hwtacacs-radtest)#hwtacacs-server accounting 129.7.66.66 huawei(config-hwtacacs-radtest)#hwtacacs-server accounting 129.7.66.67 secondaryhuawei(config-hwtacacs-radtest)#quit

Step 5 Configure the 802.1X authentication.1. Enable the 802.1X global switch. Enable the 802.1X authentication for ports 1, 2, and 3.

The 802.1X needs to be triggered by DHCP. Therefore, the DHCP-trigger authenticationmust be enabled.huawei(config)#dot1x enablehuawei(config)#dot1x service-port 1huawei(config)#dot1x service-port 2huawei(config)#dot1x service-port 3huawei(config)#dot1x dhcp-trigger enable

2. Configure an 802.1X profile. In the local termination authentication, the 802.1X profileshould be configured to be in the EAP termination mode. The count of allowed handshakefailure is 1 and the handshake interval is 20s.huawei(config)#dot1x-template 3huawei(config-dot1x-template3)#keepalive retransmit 1 interval 20huawei(config-dot1x-template3)#eap-end It will cause user offline. Are you sure to continue? (y/n)[n]yhuawei(config-dot1x-template3)#quit


Create a domain named isp1.

huawei(config)#aaa huawei(config-aaa)#domain isp1 Info: Create a new domain



huawei(config-aaa-domain-isp1)#authentication-scheme newscheme

Step 8 Use the authorization scheme.

You can use an authorization scheme in a domain only after the authorization scheme is created.

huawei(config-aaa-domain-isp1)#authorization-scheme newscheme



huawei(config-aaa-domain-isp1)#accounting-scheme newscheme

Step 10 Bind the HWTACACS server template.

You can use a HWTACACS server template in a domain only after the HWTACACS servertemplate is created.




Issue 03 (2010-01-28)

huawei(config-aaa-domain-isp1)#hwtacacs-server hwtest

Step 11 Bind 802.1X template.

You can use an 802.1X template in a domain only after the 802.1X template is created.

huawei(config-aaa-domain-isp1)#dot1x-template 3huawei(config-aaa-domain-isp#quit

----End

ResultUser 1 in ISP 1 can pass authentication only if both the user name and password are correct, andthen can log in to the MA5600T. Then, the user starts to be accounted.

Configuration File

aaa authentication-scheme newschemeauthentication-mode hwtacacsquitauthorization-scheme newschemeauthorization-mode hwtacacsquit accounting-scheme newscheme accounting-mode hwtacacs accounting interim interval 10 quit quithwtacacs-server template hwtesthwtacacs-server authentication 129.7.66.66hwtacacs-server authentication 129.7.66.67 secondaryhwtacacs-server authorization 129.7.66.66hwtacacs-server authorization 129.7.66.67 secondaryhwtacacs-server accounting 129.7.66.66hwtacacs-server accounting 129.7.66.67 secondaryquitdot1x enabledot1x service-port 1dot1x service-port 2dot1x service-port 3dot1x dhcp-trigger enabledot1x-template 3keepalive retransmit 1 interval 20eap-endquit

domain isp1 authentication-scheme newschemeauthorization-scheme newscheme accounting-scheme newschemehwtacacs-server hwtestdot1x-template 3quit



2-75

2.13.6 Configuration Example of the HWTACACS Authentication(Management User)

The MA5600T allows the management user of the device to log in to the system by theHWTACACS authentication mode.

Prerequisitel The route from the MA5600T to the HWTACACS server must be configured.

l The management user information (user name@domain and password) must be configuredon the HWTACACS server.

Service Requirementsl The HWTACACS server performs authentication for management user of domain isp1.

l The user logs in to the server carrying the domain name.

l The HWTACACS server with the IP address 129.7.66.66 functions as the primary serverfor authentication.

l The HWTACACS server with the IP address 129.7.66.67 functions as the secondary serverfor authentication.


Networking

Figure 2-9 shows an example network of the HWTACACS authentication.

Figure 2-9 Example network of the HWTACACS authentication




Issue 03 (2010-01-28)

Procedure

Step 1 Configure the authentication scheme.

Configure authentication scheme named login-auth (users are authenticated throughHWTACACS).

huawei(config)#aaahuawei(config-aaa)#authentication-scheme login-authhuawei(config-aaa-authen-login-auth)#authentication-mode hwtacacshuawei(config-aaa-authen-login-auth)#quit

Step 2 Configure the HWTACACS protocol.

Create HWTACACS server template named ma56t-login with HWTACACS server129.7.66.66 as the primary authentication server, and HWTACACS server 129.7.66.67 as thesecondary authentication server.

huawei(config)#hwtacacs-server template ma56t-login Create a new HWTACACS-server templatehuawei(config-hwtacacs-ma56t-login)#hwtacacs-server authentication 129.7.66.66 1812huawei(config-hwtacacs-ma56t-login)#hwtacacs-server authentication 129.7.66.67 1812 secondaryhuawei(config-hwtacacs-ma56t-login)#quit

Step 3 Create a domain named isp1.

NOTE


l In the user name format userid@domain-name (for example, [email protected]), "userid"indicates the user name for authentication and "domain-name" followed by "@" indicates the domain name.


huawei(config)#aaahuawei(config-aaa)#domain isp1 Info: Create a new domain

Step 4 Use the authentication scheme login-auth.


huawei(config-aaa-domain-isp1)#authentication-scheme login-auth

Step 5 Bind the HWTACACS server template ma56t-login to the user.

You can use a HWTACACS server template in a domain only after the HWTACACS servertemplate is created.

huawei(config-aaa-domain-isp1)#hwtacacs-server ma56t-login

----End

Resultl When the HWTACACS server is reachable, the management user can log in to the

MA5600T through Telnet. After entering the user name and password specified on theHWTACACS server, the management user can successfully log in to the MA5600T.



2-77

l When the HWTACACS server is unreachable, the management user cannot log in to theMA5600T through Telnet by entering the user name and password specified on theHWTACACS server.

Configuration Filehuawei(config)#aaahuawei(config-aaa)#authentication-scheme login-authhuawei(config-aaa-authen-login-auth)#authentication-mode hwtacacshuawei(config-aaa-authen-login-auth)#quithuawei(config-aaa)#quithuawei(config)#hwtacacs-server template ma56t-loginhuawei(config-hwtacacs-ma56t-login)#hwtacacs-server authentication 129.7.66.66huawei(config-hwtacacs-ma56t-login)#hwtacacs-server authentication 129.7.66.67 secondaryhuawei(config-hwtacacs-ma56t-login)#quithuawei(config)#aaahuawei(config-aaa)#domain isp1huawei(config-aaa-domain-isp1)#authentication-scheme login-authhuawei(config-aaa-domain-isp1)#hwtacacs-server ma56t-loginhuawei(config-aaa-domain-isp1)#quithuawei(config-aaa)#quit

2.14 Configuring the ACLThis topic describes the type, rule, and configuration of the ACL on the MA5600T.

Background InformationAn access control list (ACL) is used to filter certain packets by a series of preset rules. In thismanner, the objects that need to be filtered can be identified. After the specific objects areidentified, the corresponding data packets are permitted to pass or prohibited from passingaccording to the preset policy. The ACL-based traffic filtering process is a prerequisite forconfiguring the QoS or user security.

Table 2-12 lists the ACL types.

Table 2-12 ACL types

Type ValueRange

Feature

Basic ACL 2000-2999 The rules of a standard ACL are only defined accordingto the L3 source IP address for analyzing and processingdata packets.

Advanced ACL 3000-3999 The rules of an advanced ACL are defined according tothe source IP address, destination IP address, type of theprotocol over IP, and features of the protocol (includingTCP source port, TCP destination port, and ICMPmessage type).Compared with the basic ACL, the advanced ACLcontains more accurate, abundant, and flexible rules.




Issue 03 (2010-01-28)

Type ValueRange

Feature

Link layer ACL 4000-4999 A link-layer ACL allows definition of rules according tothe link-layer information such as the source MACaddress, VLAN ID, link-layer protocol type, anddestination MAC address, and the data is processedaccordingly.

User-definedACL

5000-5999 The rules of a user-defined ACL are defined according toany 32 bytes of the first 80 bytes in the L2 data frame foranalyzing and processing data packets.

When a packet reaches the port and matches two or more ACL rules, the matching sequence isas follows:l If the rules of an ACL are activated at the same time, the rule configured earlier has priority

over the one configured later.l If the rules of an ACL are activated one by one, the rule activated later has priority over

the one activated earlier.l If the rules are issued to the port from different ACLs, the rule activated later has priority

over the one activated earlier.

PrecautionsBecause the ACL is flexible in use, Huawei provides the following suggestions on itsconfiguration:l It is recommended that you define a general rule, such as permit any or deny any, in each

ACL, so that each packet has a matching traffic rule that determines to forward or filter theunspecified packet.

l The activated ACL rules share the hardware resources with the protocol modules (such asDHCP module and IPoA module) . In this case, the hardware resources are limited and maybe insufficient. To prevent the failure of enabling other service functions due to insufficienthardware resources, it is recommended you enable the protocol module first and thenactivate ACL rules in the data configuration. If you fail to enable a protocol module, performthe following steps:

1. Check whether ACL rules occupy too many resources.2. If ACL rules occupy too many resources, deactivate or delete the unimportant or

temporarily unused ACL configurations, and then configure and enable the protocolmodule.

2.14.1 Configuring a Basic ACLThis topic is applicable to the scenario where the device needs to classify traffic for packetsaccording to the source IP address.

2.14.2 Configuring an Advanced ACLThis topic describes how to classify traffic for the data packets according to the source IP address,destination IP address, protocol type over IP, and features for protocol, such as source port ofthe TCP, destination port of the TCP, and ICMP type of the data packets.

2.14.3 Configuring a Link Layer ACL



2-79

This topic describes how to classify traffic according to the link layer information such as sourceMAC address, source VLAN ID, L2 protocol type, and destination MAC address.

2.14.4 Configuring a User-defined ACLThis topic describes how to classify traffic according to any 32 bytes of the first 80 bytes of aL2 data frame.

2.14.1 Configuring a Basic ACLThis topic is applicable to the scenario where the device needs to classify traffic for packetsaccording to the source IP address.

Context

The number of a basic ACL is in the range of 2000-2999.

A basic ACL is only defined according to the L3 source IP address for analyzing and processingdata packets.

Procedure

Step 1 (Optional) Set a time range.Run the time-range command to create a time range, which can be used when an ACL rule iscreated.

Step 2 Create a basic ACL.Run the acl command to create a basic ACL, and then enter the ACL mode. The number of abasic ACL can only be in the range of 2000-2999.

Step 3 Configure a basic ACL rule.In the acl-basic mode, run the rule command to create a basic ACL rule. The parameters are asfollows:

l rule-id: Indicates the ACL rule ID. To create an ACL rule with a specified ID, use thisparameter.

l permit: Indicates the keyword for allowing the data packets that meet related conditions topass.

l deny: Indicates the keyword for discarding the data packets that meet related conditions.

l time-range: Indicates the keyword of the time range during which the ACL rule will beeffective.

Step 4 Activate the ACL.After an ACL is configured, only an ACL gets generated but it will not be functional. You needto run other commands to activate the ACL. Some common commands are as follows:

l Run the packet-filter command to activate an ACL.

l Run the firewall packet-filter command to activate an ACL. For details, see Configuringthe Firewall.

l Perform the QoS operation. For details, see Configuring Traffic Management Based onACL Rules.

----End




Issue 03 (2010-01-28)

Example

To configure that from 00:00 to 12:00 on Fridays, port 0/9/0 on the MA5600T receives only thepackets from 2.2.2.2, and discards the packets from other addresses, do as follows:

huawei(config)#time-range time1 00:00 to 12:00 frihuawei(config)#acl 2000huawei(config-acl-basic-2000)#rule permit source 2.2.2.2 0.0.0.0 time-range time1huawei(config-acl-basic-2000)#rule deny time-range time1huawei(config-acl-basic-2000)#quithuawei(config)#packet-filter inbound ip-group 2000 port 0/9/0huawei(config)#save

2.14.2 Configuring an Advanced ACLThis topic describes how to classify traffic for the data packets according to the source IP address,destination IP address, protocol type over IP, and features for protocol, such as source port ofthe TCP, destination port of the TCP, and ICMP type of the data packets.

Context

The number of an advanced ACL is in the range of 3000-3999.

An advanced ACL can classify traffic according to the following information:l Protocol type

l Source IP address

l Destination IP address

l Source port ID (source port of the UDP or TCP packets)

l Destination port ID (destination port of the UDP or TCP packets)

l ICMP packet type

l Precedence value: priority field of the data packet

l Type of service (ToS) value: ToS field of the data packet

l Differentiated services code point (DSCP) value: DSCP of the data packet

Procedure


Step 2 Create an advanced ACL.Run the acl command to create an advanced ACL, and then enter the acl-adv mode. The numberof an advanced ACL can only be in the range of 3000-3999.

Step 3 Configure a rule of the advanced ACL.In the acl-adv mode, run the rule command to create an ACL rule. The parameters are as follows:l rule-id: Indicates the ACL rule ID. To create an ACL rule with a specified ID, use this

parameter.l permit: Indicates the keyword for allowing the data packets that meet related conditions to

pass.



2-81


l time-range: Indicates the keyword of the time range during which the ACL rules areeffective.

Step 4 Activate the ACL.After an ACL is configured, only an ACL is generated and the ACL does not take effect. Youneed to run other commands to activate the ACL. Some common commands are as follows:l Run the packet-filter command to activate an ACL.

l Run the firewall packet-filter command to activate an ACL. For details, see 2.11.1Configuring Firewall.

l Perform the QoS operation. For details, see 2.15.4 Configuring Traffic Management Basedon ACL Rules.

----End

Example

Assume that the service board of the MA5600T resides in slot 1 and belongs to a VLAN, andthe IP address of the VLAN L3 interface is 10.10.10.101. To prohibit the ICMP (such as ping)and telnet operations from the user side to the VLAN interface on the device, do as follows:

huawei(config)#acl 3001huawei(config-acl-basic-3001)rule 1 deny icmp destination 10.10.10.101 0huawei(config-acl-basic-3001)rule 2 deny tcp destination 10.10.10.101 0 destination-port eq telnet huawei(config-acl-basic-3001)quithuawei(config)#packet-filter inbound ip-group 3001 rule 1 port 0/1/0huawei(config)#packet-filter inbound ip-group 3001 rule 2 port 0/1/0huawei(config)#save

2.14.3 Configuring a Link Layer ACLThis topic describes how to classify traffic according to the link layer information such as sourceMAC address, source VLAN ID, L2 protocol type, and destination MAC address.

Context

The number of a link layer ACL is in the range of 4000-4999.

A link layer ACL can classify traffic according to the following link layer information:l Protocol type over Ethernet

l 802.1p priority

l VLAN ID

l Source MAC address

l Destination MAC address

Procedure





Issue 03 (2010-01-28)

Step 2 Create a link layer ACL.Run the acl command to create a link layer ACL, and then enter the acl-link mode. The numberof a link layer ACL can only be in the range of 4000-4999.

Step 3 Configure a link layer ACL rule.In the acl-link mode, run the rule command to create a link layer ACL rule. The parameters areas follows:

l rule-id: Indicates the ACL rule ID. To create an ACL rule with a specified ID, use thisparameter.

l permit: Indicates the keyword for allowing the data packets that meet related conditions topass.


l time-range: Indicates the keyword of the time range during which the ACL rule is effective.

Step 4 Activate the ACL.After an ACL is configured, only an ACL is generated and the ACL does not take effect. Youneed to run other commands to activate the ACL. Some common commands are as follows:

l Run the packet-filter command to activate an ACL.


----End

Example

To create a link layer ACL rule that allows data packets with protocol type 0x8863 (pppoe-control message), VLAN ID 12, CoS 1, source MAC address 2222-2222-2222, and destinationMAC address 00e0-fc11-4141 to pass, do as follows:

huawei(config)#acl 4001huawei(config-acl-link-4001)rule 1 permit type 0x8863 cos 1 source 122222-2222-2222 0000-0000-0000 destination 00e0-fc11-4141 0000-0000-0000huawei(config-acl-basic-4001)quithuawei(config)#save

2.14.4 Configuring a User-defined ACLThis topic describes how to classify traffic according to any 32 bytes of the first 80 bytes of aL2 data frame.

PrerequisiteConfiguring a user-defined ACL requires a deep understanding of the L2 data frame structure.Be sure to make a data plan according to the format of the L2 data frame.

Context

The number of a user-defined ACL must be in the range of 5000-5999.

A user-defined ACL rule can be created according to any 32 bytes of the first 80 bytes of a L2data frame



2-83

Figure 2-10 First 64 bytes of a data frame

Table 2-13 lists the meaning of the letters and their offset values.

Table 2-13 Description of letters and their offset values

Letter Description Offset Letter

Description Offset

A Destination MACaddress

0 L IP check sum 28

B Source MAC address 6 M Source IP address 30

C VLAN tag 12 N Destination IP address 34

D: Protocol type 16 O TCP source port 38

E IP version number 18 P TCP destination port 40

F Type of service 19 Q Serial number 42

G Length of the IP packet 20 R Acknowledgementfield

46

H ID 22 S IP header length andreserved bit

50

I Flags 24 T Reserved bit and flagsbit

51

J7 Time to live 26 U Window size 52

K Protocol ID ("6"represents TCP and"17" represents UDP)

27 V Other 54

NOTE

The offset value of each field is the offset value in data frame ETH II+VLAN tag. In a user-defined ACL,you can use the two parameters of rule mask and offset to extract any bytes from the first 80 bytes of thedata frame. After the comparison with the user-defined rule, the data frame matching the rule is filteredfor related processing.




Issue 03 (2010-01-28)

Procedure


Step 2 Create a user-defined ACL.Run the acl command to create a user-defined ACL, and then enter the acl-user mode. Thenumber of a user-defined ACL can only be in the range of 5000-5999.

Step 3 Configure the user-defined ACL rule.In the acl-user mode, run the rule command to create an ACL rule. The parameters are as follows:l rule-id: Indicates the ACL rule ID. To create an ACL rule with a specified ID, use this

parameter.l permit: Indicates the keyword for allowing the data packets that meet related conditions to

pass.l deny: Indicates the keyword for discarding the data packets that meet related conditions.

l rule-string: Indicates the character string of the user-defined rule. The character string is inhexadecimal notation. The number of characters in the string must be an even number.

l rule-mask: Indicates the mask of the user-defined rule. It is a positive mask, used to performthe AND operation with the data packets for extracting the information of the data packets.

l offset: Indicates the offset. With the header of the packet as the reference point, it specifiesthe byte from which the AND operation begins. Together with the rule mask, it extracts acharacter string from the packets.

l time-range: Indicates the keyword of the time range during which the ACL rule will beeffective.

Step 4 Activate the ACL.After an ACL is configured, only an ACL gets generated but it will not be functional. You needto run other commands to activate the ACL. Some common commands are as follows:l Run the packet-filter command to activate an ACL.


----End

ExampleAssume that the packet sent from port 0/3/0 to the MA5600T is the QinQ packet containing twoVLAN tags. To change the CoS priority in the outer VLAN tag (VLAN ID: 10) to 5, do asfollows:



2-85

Figure 2-11 QinQ packet format

huawei(config)#acl 5001 huawei(config-acl-user-5001)#rule 1 permit 8100 ffff 16

NOTEThe type value of a QinQ packet varies with different vendors. Huawei adopts the default 0x8100. As shown inFigure 2-11, the offset of this type value should be 16 bytes.

huawei(config-acl-user-5001)#rule 10 permit 0a ff 19

NOTE"19" indicates the ADN operation after an offset of 19 bytes with the header of the packet as the base. "0a" refersto the value of the inner tag field of the QinQ packet. In this example, the second byte of the inner tag field is apart of the VLAN ID, which is exactly the value of the inner VLAN ID (VLAN 10).huawei(config-acl-user-5001)#quithuawei(config)#traffic-priority inbound user-group 5001 cos 5 port 0/3/0

2.15 Configuring QoSThis topic describes how to configure quality of service (QoS) on the MA5600T.

Background InformationConfiguring QoS in the system can provide different quality guarantees for different services.QoS does not have a unified service model. Therefore, make the QoS plan for networkwideservices before making the configuration solution.

On the MA5600T, the key points for implementing QoS are as follows:l Traffic management

Configuring traffic management can limit the traffic for a user service or user port.l Queue scheduling

For the service packets that are already configured with traffic management, through theconfiguration of queue scheduling, the service packets can be placed into queues withdifferent priorities, thus implementing QoS inside the system.

In addition to the preceding key points, the MA5600T supports hierarchical quality of service(HQoS) and ACL-based traffic management.




Issue 03 (2010-01-28)

l HQoSTwo levels of traffic management is supported: for HQoS users and for the HQoS usergroup.

l ACL-based traffic managementIn the scenario where users have flexible requirements on implementing QoS for trafficstreams, the ACL can be used to implement flexible traffic classification (see 2.14Configuring the ACL), and then QoS can be implemented for traffic streams.

2.15.1 Configuring Traffic ManagementThis topic describes how to configure traffic management on the MA5600T.

2.15.2 Configuring the Queue SchedulingA queue is an unit based on which packets are scheduled in a physical port. After the queuescheduling is configured, the packet of the priority service can be processed in time whennetwork congestion occurs.

2.15.3 Configuring Early DropEarly drop means that the system drops the packets that wait to enter the queue when congestionoccurs. This process occurs after traffic management.

2.15.4 Configuring Traffic Management Based on ACL RulesThe ACL can be used to implement flexible traffic classification according to user requirements.After traffic classification based on ACL rules is completed, you can perform QoS for the trafficstreams.

2.15.1 Configuring Traffic ManagementThis topic describes how to configure traffic management on the MA5600T.

OverviewThe MA5600T supports traffic management for the inbound and outbound traffic streams of thesystem. Traffic management can be implemented based on the following three granularities:l Based on service port

NOTEFor details on configuring traffic classification, see 5.5 Creating a GPON Service Port.

l Based on port+CoS

l Based on port+VLAN

In addition, the MA5600T supports rate limit on the Ethernet port and traffic suppression oninbound broadcast packets and unknown (multicast or unicast) packets.

2.15.1.1 Configuring Traffic Management Based on Service PortThis topic describes how to configure traffic management based on service port. Whenconfiguring a service port, you need to bind an IP traffic profile to the service port and managethe traffic of the service port through the traffic parameters defined in the profile.

2.15.1.2 Configuring Traffic Management Based on Port+CoSThis topic describes how to configure traffic management based on port+CoS so that differentIP traffic profiles can be specified for the traffic streams that have different 802.1p priorities ona port.

2.15.1.3 Configuring Rate Limitation on an Ethernet PortThis topic describes how to configure upstream rate limitation on a specified Ethernet port.



2-87

2.15.1.4 Configuring Traffic SuppressionThis topic describes how to configure traffic suppression. The purpose of traffic suppression isto ensure the provisioning of the normal service of system users by suppressing the broadcast,unknown multicast, and unknown unicast packets received by the system.

2.15.1.1 Configuring Traffic Management Based on Service PortThis topic describes how to configure traffic management based on service port. Whenconfiguring a service port, you need to bind an IP traffic profile to the service port and managethe traffic of the service port through the traffic parameters defined in the profile.

Background InformationTraffic management based on service port is implemented by creating an IP traffic profile andthen binding the IP traffic profile when creating the service port.

l The system has seven default IP traffic profiles with the IDs of 0–6. You can run the displaytraffic table command to query the traffic parameters of the default traffic profiles.

l It is recommended that you use the default traffic profiles. A new IP traffic profile is createdonly when the default traffic profiles cannot meet the requirements.

Table 2-14 lists the traffic parameters defined in the IP traffic profiles.

Table 2-14 Traffic parameters defined in the IP traffic profiles

Item Parameter Description

Parameters of tworate three colormanagement

CIR: committed information rateCBS: committed burst sizePIR: peak information ratePBS: peak burst sizeNOTE

l CIR is mandatory, and the other three parameters are optional. If youconfigure only CIR, the system calculates the other three parameters basedon the formula.

l The system marks the service packets with colors according to the fourparameters. The red packet is discarded directly, and the packets of the othertwo colors are marked on their DEI field in the VLAN tag, the yellow colorindicated as 1 and the green color indicated as 0.

Priority policies The priority policies are classified into the following three types:l user-cos: Copy the 802.1p priority in the outer VLAN tag of the

packet to the 802.1p priority in the VLAN tag of the outbound packet.l user-inner-cos: Copy the 802.1p priority in the inner VLAN tag

(CTag) of the packet to the 802.1p priority in the VLAN tag of theoutbound packet.

l user-tos: Copy the ToS priority in the VLAN tag of the packet to the802.1p priority in the VLAN tag of the outbound packet.




Issue 03 (2010-01-28)

Item Parameter Description

Schedulingpolicies

There are three types of scheduling policies, which are available onlyto the inbound packet:l Tag-In-Package: The system performs scheduling according to the

802.1p priority of the packet.l Local-Setting: It is the local priority. That is, the system performs

scheduling according to the 802.1p priority specified in the trafficprofile bound to the traffic stream.

l CTag-In-Package: The system performs scheduling according to the802.1p priority in the inner VLAN tag (CTag) carried by the packet.

NOTE"Outbound" (upstream) in this document refers to the direction from the user side to the network side, and"inbound" (downstream) refers to the direction from the network side to the user side.

Procedure

Step 1 Run the display traffic table command to query whether there is a proper traffic profile in thesystem.Check whether an existing traffic profile meets the planned traffic management parameters,priority policy, and scheduling policy to confirm the index of the traffic profile to be used. If aproper traffic profile does not exist in the system, create an IP traffic profile.

Step 2 Run the traffic table ip command to create a traffic profile.The usage of this command is complicated. The following is a detailed description:l The traffic management parameters must contain at least CIR, which must be assigned with

a value.l Keyword priority must be entered to set the outer 802.1p priority of the packet. Two options

are available for setting the priority policy:– Enter a value in the range of 0–7 to specify a priority for the packet.

– If the priority of the user-side packet is copied according to user-cos, user-inner-cos, oruser-tos, you need to enter the default 802.1p priority of the packet (a value in the rangeof 0–7). If the user-side packet does not carry a priority, the specified default 802.1ppriority of the packet is adopted as the priority of the outbound packet.

l (Optional) Enter keyword inner-priority to set the inner 802.1p priority (the 802.1p priorityin the CTag) of the packet. Two options are available for setting the priority policy:– Enter a value in the range of 0–7 to specify a priority for the packet.

– If the priority of the user-side packet is copied according to user-cos, user-inner-cos, oruser-tos, you need to enter the default 802.1p priority of the packet (a value in the rangeof 0–7). If the user-side packet does not carry a priority, the specified default 802.1ppriority of the packet is adopted as the priority of the outbound packet.

l Keyword priority-policy must be entered to specify a scheduling policy for the inboundpacket. For details about the scheduling policies, see Table 2-14.

Step 3 Run the service port command to bind a proper traffic profile.

----End



2-89

Example

Assume that the CIR is 2048 kbit/s, 802.1p priority of the outbound packet is 6, and thescheduling policy of the inbound packet is Tag-In-Package. To add traffic profile 9 with thesesettings, do as follows:

huawei(config)#traffic table ip index 9 cir 2048 priority 6 priority-policy tag-In-Package Create traffic descriptor record successfully ------------------------------------------------ TD Index : 9 TD Name : ip-traffic-table_9 Priority : 6 Copy Priority : - CTAG Default Priority: 0 Priority Policy : tag-pri CIR : 2048 kbps CBS : 67536 bytes PIR : 4096 kbps PBS : 133072 bytes Referenced Status : not used ------------------------------------------------huawei(config)#display traffic table ip index 9 ------------------------------------------------ TD Index : 9 TD Name : ip-traffic-table_9 Priority : 6 Copy Priority : - CTAG Default Priority: 0 Priority Policy : tag-pri CIR : 2048 kbps CBS : 67536 bytes PIR : 4096 kbps PBS : 133072 bytes Referenced Status : not used ------------------------------------------------

2.15.1.2 Configuring Traffic Management Based on Port+CoS

This topic describes how to configure traffic management based on port+CoS so that differentIP traffic profiles can be specified for the traffic streams that have different 802.1p priorities ona port.

PrerequisiteA proper IP traffic profile must be created and the index of the IP traffic profile to be used mustbe confirmed. For the configuration method, see 2.15.1.1 Configuring Traffic ManagementBased on Service Port.

Background Informationl Traffic management based on service ports conflicts with traffic management based on port

+CoS. By default, the system supports traffic management based on service ports.l If service ports are configured on the board, the traffic management mode of the board

cannot be changed.

Procedure

Step 1 According to the type of the board to be configured, enter the ADSL, SHDSL, VDSL, or GPONmode.




Issue 03 (2010-01-28)

Step 2 Run the car-mode port-cos command to configure the traffic management mode of the serviceboard to traffic management based on port+CoS.The configured traffic management mode is valid to all the ports on the board. The configuredtraffic management mode has the following two options:l service-port: Indicates traffic management based on service port (default).

l port-cos: Indicates traffic management based on port+CoS.

Step 3 Run the car-port command to specify the 802.1p priority for the port, and bind an IP trafficprofile to the traffic streams that meet the specified 802.1p priority.

When traffic management based on port+CoS is selected for a board, pay attention to thefollowing points:

l For a non-xPON board, you can bind the corresponding traffic profile in the inbound/outbound direction according to a CoS value of a port on the board.

l For a GPON board, you can bind the corresponding traffic profile in the inbound/outbounddirection according to a CoS value of a GEM port on the board.

----End

ExampleTo configure GEM port 130 on port 0 of the GPON board in slot 0/2, and bind traffic profile 2to the packets with priority 0, do as follows:

huawei(config)#interface gpon 0/2huawei(config-if-gpon-0/2)#car-mode port-coshuawei(config-if-gpon-0/2)#car-port 0 gemport 130 cos 0 inbound 2 outbound 2huawei(config-if-gpon-0/2)#display car-mode The CAR mode of the board : port-coshuawei(config-if-gpon-0/2)#display car-port 0 gemport 130 ---------------------------------------------- Port GEM port CoS Inbound-index Outbound-index ---------------------------------------------- 0 130 7 2 2 ----------------------------------------------

2.15.1.3 Configuring Rate Limitation on an Ethernet PortThis topic describes how to configure upstream rate limitation on a specified Ethernet port.

PrerequisiteThe Ethernet board must be configured in the system.

Background Informationl Rate limitation on an Ethernet port is valid only to the Ethernet board.

l Traffic streams exceeding the specified rate are discarded.

Procedure

Step 1 In the global config mode, run the line-rate command to configure upstream rate limitation ona specified Ethernet port.



2-91

The main parameters are as follows:l target-rate: Indicates the limited rate of the port, in the unit of kbit/s.

l port: Indicates the shelf ID/slot ID/port ID.

Step 2 You can run the display qos-info line-rate port command to query the configured rate limitationon the specified Ethernet port

----End

Example

To limit the rate of Ethernet port 0/19/0 to 6400 kbit/s, do as follows:

huawei(config)#line-rate 6400 port 0/19/0huawei(config)#display qos-info line-rate port 0/19/0

line-rate: port 0/19/0: Line rate: 6400 Kbps

2.15.1.4 Configuring Traffic Suppression

This topic describes how to configure traffic suppression. The purpose of traffic suppression isto ensure the provisioning of the normal service of system users by suppressing the broadcast,unknown multicast, and unknown unicast packets received by the system.


Traffic suppression can be configured based on a board or based on the port on a board.

Procedurel Configure traffic suppression based on a board.

1. Query the thresholds of traffic suppression.In the privilege mode, run the display traffic-suppress all command to query thethresholds of traffic suppression.

2. Run the traffic-suppress command to suppress the traffic of the board in a slot.The main parameters are as follows:– broadcast: Suppresses the broadcast traffic.

– multicast: Suppresses the unknown multicast traffic.

– value: Indicates the index of the traffic suppression level. The index value is thevalue queried in step 1.

l Configure traffic suppression based on the port on a board.1. According to the board configured in the system, enter one of the following modes:

– Run the interface GIU command to enter the GIU mode.

– Run the interface SCU command to enter the SCU mode.

– Run the interface eth command to enter the ETH mode.

2. Query the thresholds of traffic suppression.




Issue 03 (2010-01-28)

Run the display traffic-suppress all command to query the thresholds of trafficsuppression.

3. Run the traffic-suppress command to suppress the traffic of the port on a GIU orSCU board.The main parameters are as follows:– broadcast: Suppresses the broadcast traffic.– multicast: Suppresses the unknown multicast traffic.– unicast: Suppresses the unknown unicast traffic.– value: Indicates the index of the traffic suppression level. The index value is the

value queried in step 2.

----End

ExampleTo suppress the broadcast packets according to traffic suppression level 8 on port 0 on the SCUboard in slot 0/9, do as follows:huawei(config)#interface scu 0/9huawei(config-if-scu-0/9)#display traffic-suppress all

Command: display traffic-suppress all Traffic suppression ID definition: --------------------------------------------------------------------- NO. Min bandwidth(kbps) Max bandwidth(kbps) Package number(pps) --------------------------------------------------------------------- 1 6 145 12 2 12 291 24 3 24 582 48 4 48 1153 95 5 97 2319 191 6 195 4639 382 7 390 9265 763 8 781 18531 1526 9 1562 37063 3052 10 3125 74126 6104 11 6249 148241 12207 12 12499 296483 24414 13 0 0 0 --------------------------------------------------------------------- --------------------------------------------------------------------- PortID Broadcast_index Multicast_index Unicast_index --------------------------------------------------------------------- 0 7 7 OFF 1 7 7 OFF 2 7 7 OFF 3 7 7 OFF --------------------------------------------------------------------- huawei(config-if-scu-0/9)#traffic-suppress all broadcast value 12huawei(config-if-scu-0/9)#display traffic-suppress all Traffic suppression ID definition: --------------------------------------------------------------------- NO. Min bandwidth(kbps) Max bandwidth(kbps) Package number(pps) --------------------------------------------------------------------- 1 6 145 12 2 12 291 24 3 24 582 48 4 48 1153 95 5 97 2319 191 6 195 4639 382 7 390 9265 763 8 781 18531 1526



2-93

9 1562 37063 3052 10 3125 74126 6104 11 6249 148241 12207 12 12499 296483 24414 13 0 0 0 --------------------------------------------------------------------- --------------------------------------------------------------------- PortID Broadcast_index Multicast_index Unicast_index --------------------------------------------------------------------- 0 12 OFF OFF 1 12 OFF OFF 2 12 OFF OFF 3 12 OFF OFF ---------------------------------------------------------------------

2.15.2 Configuring the Queue SchedulingA queue is an unit based on which packets are scheduled in a physical port. After the queuescheduling is configured, the packet of the priority service can be processed in time whennetwork congestion occurs.

2.15.2.1 Configuring the Queue Scheduling ModeThis topic describes how to configure the queue scheduling mode for ensuring that packets inthe queue with a higher priority can be processed in time in case of congestion.

2.15.2.2 Configuring the Mapping Between the Queue and the 802.1p PriorityThis topic describes how to configure the mapping between the queue and the 802.1p priorityso that packets with different 802.1p priorities are mapped to the specified queues based on theconfigured mapping. This enhances the flexibility of mapping packets to queues.

2.15.2.3 Configuring the Queue DepthThis topic describes how to configure the queue depth (the queue buffer space) to re-allocatebuffer space to the queues, thus to improve the flexibility of QoS.

2.15.2.1 Configuring the Queue Scheduling Mode

This topic describes how to configure the queue scheduling mode for ensuring that packets inthe queue with a higher priority can be processed in time in case of congestion.


The MA5600T supports the three queue scheduling modes: strict-priority queue (PQ), weightedround robin (WRR), and PQ+WRR.

l PQ

The PQ gives preference to packets in a queue with a higher priority. The packets of a lowerpriority queue can be transmitted only when a queue with a higher priority is empty.

By default, the system adopts the PQ mode.

l WRR

The system supports WRR for eight queues. Each queue has a weight value (w7, w6, w5,w4, w3, w2, w1, and w0 in a descending order) for resource acquisition. In the WRRscheduling mode, the queues are scheduled in turn, which ensures that each queue can bescheduled.

Table 2-15 lists the mapping between the queue weights and the actual queues.




Issue 03 (2010-01-28)

Table 2-15 Mapping between the queue weights and the actual queues

QueueNumber

ConfiguredWeight

Actual QueueWeight (PortSupporting EightQueues)

Actual QueueWeight (PortSupporting FourQueues)

7 W7 W7 -

6 W6 W6 -

5 W5 W5 -

4 W4 W4 -

3 W3 W3 W7+W6

2 W2 W2 W5+W4

1 W1 W1 W3+W2

0 W0 W0 W1+W0

Wn: Indicates the weight of queue n. The weight sum of the queues (except the queue withweight value 255) must be equal to 0 or 100, where 0 indicates that the strict PQ schedulingmode is used and 255 indicates that the queue is not used.

l PQ+WRR– The system schedules some queues by PQ and schedules the other queues by WRR.

When the specified WRR value is 0, it indicates that the queue is scheduled in the PQmode.

– The queue scheduled in the PQ mode should be the queue that has the highest priority.

– The weight sum of the scheduled queues must be equal to 100.

Procedure

Step 1 Run the queue-scheduler command to configure the queue scheduling mode.

Step 2 Run the display queue-scheduler command to query the configuration information about thequeue scheduling mode.

----End

ExampleTo adopt the WRR scheduling mode and set the weight values of the eight queues to 10, 10, 20,20, 10, 10, 10, and 10 respectively, do as follows:

huawei(config)#queue-scheduler wrr 10 10 20 20 10 10 10 10huawei(config)#display queue-scheduler Queue scheduler mode : WRR --------------------------------- Queue Scheduler Mode WRR Weight --------------------------------- 0 WRR 10 1 WRR 10



2-95

2 WRR 20 3 WRR 20 4 WRR 10 5 WRR 10 6 WRR 10 7 WRR 10 ---------------------------------

To adopt the PQ+WRR scheduling mode and set the weight values of the six queues to 20, 20,10, 30, 10, and 10 respectively, do as follows:

huawei(config)#queue-scheduler wrr 20 20 10 30 10 10 0 0huawei(config)#display queue-scheduler Queue scheduler mode : WRR --------------------------------- Queue Scheduler Mode WRR Weight --------------------------------- 0 WRR 20 1 WRR 20 2 WRR 10 3 WRR 30 4 WRR 10 5 WRR 10 6 PQ -- 7 PQ -- ---------------------------------

2.15.2.2 Configuring the Mapping Between the Queue and the 802.1p PriorityThis topic describes how to configure the mapping between the queue and the 802.1p priorityso that packets with different 802.1p priorities are mapped to the specified queues based on theconfigured mapping. This enhances the flexibility of mapping packets to queues.

Background Informationl The configuration is valid to all the service boards in the system.

l By default, the mapping between the queue and the 802.1p priority is as listed in Table2-16.

Table 2-16 Mapping between the queue and the 802.1p priority

Queue Number Actual QueueNumber (PortSupporting EightQueues)

Actual QueueNumber (PortSupporting FourQueues)

802.1p Priority

7 7 3 7

6 6 3 6

5 5 2 5

4 4 2 4

3 3 1 3

2 2 1 2

1 1 0 1

0 0 0 0




Issue 03 (2010-01-28)

Procedure

Step 1 Run the cos-queue-map command to configure the mapping between the 802.1p priority andthe queue.

Step 2 Run the display cos-queue-map command to query the mapping between the 802.1p priorityand the queue.

----End

ExampleTo map 802.1p priority 0 to queue 0, 802.1p priority 1 to queue 2, and the other 802.1p prioritiesto queue 6, do as follows:

huawei(config)#cos-queue-map cos0 0 cos1 2 cos2 6 cos3 6 cos4 6 cos5 6 cos6 6 cos7 6huawei(config)#display cos-queue-map CoS and queue map: ------------------------ CoS Queue ID ------------------------ 0 0 1 2 2 6 3 6 4 6 5 6 6 6 7 6 ------------------------

2.15.2.3 Configuring the Queue DepthThis topic describes how to configure the queue depth (the queue buffer space) to re-allocatebuffer space to the queues, thus to improve the flexibility of QoS.

Background InformationThe queue depth determines the capability of a queue for processing burst packets. The greaterthe queue depth, the larger the buffer space, and the more capable is the queue in processingburst packets.

The queue depth of the port is allocated on a percentage basis. Table 2-17 lists the default queuedepths of the system.

Table 2-17 Queue depth allocation

Queue Number Queue Depth (PortSupporting Eight Queues)

Actual Queue Number(Port Supporting FourQueues)

7 L7 (default: 6) -

6 L6 (default: 25) -



2-97

Queue Number Queue Depth (PortSupporting Eight Queues)

Actual Queue Number(Port Supporting FourQueues)



3 L3 (default: 13) L7+L6 (default: 31)




Ln: Indicates the depth of queue n. The sum of all the queue depths must be equal to 100.

Procedure

Step 1 Run the queue-buffer command to configure the queue depth of the service board.

Step 2 Run the display queue-buffer command to query the queue depth of the current service board.

----End

Example

To set the queue depths to 20, 20, 10, 10, 10, 10, 10, and 10, do as follows:

huawei(config)#queue-buffer 20 20 10 10 10 10 10 10huawei(config)#display queue-buffer ------------------------ Queue Depth size ratio ------------------------ 0 20 1 20 2 10 3 10 4 10 5 10 6 10 7 10 ------------------------

2.15.3 Configuring Early DropEarly drop means that the system drops the packets that wait to enter the queue when congestionoccurs. This process occurs after traffic management.

Procedurel Configure the early drop threshold.

Run the early-drop command to configure the mapping between service priorities and dropthresholds. After configuration is successful, if the packets of the specified service priority




Issue 03 (2010-01-28)

reach the threshold of the queue (the percentage of the queue depth), subsequent packetsof the same service priority will be dropped instead of entering the queue.

l Query the configured early drop threshold.You can run the display early-drop command to query the configured early drop threshold.

----End

ExampleTo set the early drop threshold of the packet with CoS value 0 to 40, CoS value 2 to 60, and CoSvalues 3 and 4 to 80, do as follows:

huawei(config)#early-drop cos0 40 cos2 60 cos3 80 cos6 80 {<cr>|cos1<k>|cos4<k>|cos5<k>|cos7<k>}:Command: early-drop cos0 40 cos2 60 cos3 80 cos6 80 huawei(config)#display early-drop ------------------------ Priority Threshold ------------------------ 0 40 1 100 2 60 3 80 4 100 5 100 6 80 7 100 ------------------------

The following figure shows the implementation of the early drop as configured.

2.15.4 Configuring Traffic Management Based on ACL RulesThe ACL can be used to implement flexible traffic classification according to user requirements.After traffic classification based on ACL rules is completed, you can perform QoS for the trafficstreams.



2-99

2.15.4.1 Controlling the Traffic Matching an ACL RuleThis topic describes how to control the traffic matching an ACL rule on a specified port, andprocess the traffic that exceeds the limit, such as adding the DSCP tag or dropping the packetdirectly.

2.15.4.2 Adding a Priority Tag to the Traffic Matching an ACL RuleThis topic describes how to add a priority tag to the traffic matching an ACL rule on a specifiedport so that the traffic can obtain the service that match the specified priority. The priority tagtype can be ToS, DSCP, or 802.1p.

2.15.4.3 Enabling the Statistics Collection of the Traffic Matching an ACL RuleThis topic describes how to enable the statistics collection of the traffic matching an ACL rule,thus analyzing and monitoring the traffic.

2.15.4.4 Enabling the Mirroring of the Traffic Matching an ACL RuleThis topic describes how to mirror the traffic matching an ACL rule on a port to a specified port.Mirroring does not affect packet receipt and transmission on the mirroring source port. You canmonitor the traffic of the mirroring source port by analyzing the traffic that passes the mirroringdestination port.

2.15.4.5 Enabling the Redirection of the Traffic Matching an ACL RuleThis topic describes how to redirect the traffic matching an ACL rule on a specified port. Afterthis operation is executed successfully, the original port does not forward the traffic matchingthe ACL rule, but the specified port forwards the traffic.

2.15.4.1 Controlling the Traffic Matching an ACL RuleThis topic describes how to control the traffic matching an ACL rule on a specified port, andprocess the traffic that exceeds the limit, such as adding the DSCP tag or dropping the packetdirectly.

PrerequisiteThe ACL and the rule of the ACL are configured, and the port for traffic limit is working in thenormal state.

Background Informationl The traffic statistics are only effective for the permit rules of an ACL.

l The limited traffic must be an integer multiple of 64 kbit/s.

Procedure

Step 1 Run the traffic-limit command to control the traffic matching an ACL rule on a specified port.Run this command to set the action to be taken when the traffic received on the port exceeds thelimited value. Two options are available:l drop: Drop the traffic that exceeds the limited value.

l remark-dscp value: To set the DSCP priority for the traffic that exceeds the limited value,use this parameter.

Step 2 Run the display qos-info traffic-limit port command to query the traffic limit information onthe specified port.

----End




Issue 03 (2010-01-28)

Example

To limit the traffic that matches ACL 2001 received on port 0/11/0 to 512 kbit/s, and add theDSCP priority tag (af1) to packets that exceed the limit, do as follows:

huawei(config)#traffic-limit inbound ip-group 2001 512 exceed remark-dscp af1 port 0/11/0//"af1" represents a dscp type: Assured Forwarding 1 service (10).huawei(config)#display qos-info traffic-limit port 0/11/0traffic-limit:port 0/11/0: Inbound: Matches: Acl 2001 rule 5 running Target rate: 512 Kbps Exceed action: remark-dscp af1

2.15.4.2 Adding a Priority Tag to the Traffic Matching an ACL Rule

This topic describes how to add a priority tag to the traffic matching an ACL rule on a specifiedport so that the traffic can obtain the service that match the specified priority. The priority tagtype can be ToS, DSCP, or 802.1p.

Prerequisite

The ACL and the rule of the ACL are configured, and the port for traffic limit is working in thenormal state.

Background Informationl The traffic statistics are only valid to permit rules of an ACL.

l The ToS and the DSCP priorities are mutually exclusive. Therefore, they cannot beconfigured at the same time.

Procedure

Step 1 Run the traffic-priority command to add a priority tag to the traffic matching an ACL rule ona specified port.

Step 2 Run the display qos-info traffic-priority port command to query the configured priority.

----End

Example

To add a priority tag to the traffic that matches ACL 2001 received on port 0/11/0, and the DSCPpriority and local priority of the traffic are 10 (af1) and 0 respectively, do as follows:

huawei(config)#traffic-priority inbound ip-group 2001 dscp af1 local-precedence 0 port 0/11/0huawei(config)#display qos-info traffic-priority port 0/11/0 traffic-priority: port 0/11/0: Inbound: Matches: Acl 2001 rule 5 running Priority action: dscp af1 local-precedence 0



2-101

2.15.4.3 Enabling the Statistics Collection of the Traffic Matching an ACL RuleThis topic describes how to enable the statistics collection of the traffic matching an ACL rule,thus analyzing and monitoring the traffic.

PrerequisiteThe ACL and the rule of the ACL are configured, and the port for traffic statistics is working inthe normal state.

Background InformationThe traffic statistics are only valid to permit rules of an ACL.

Procedure

Step 1 Run the traffic-statistic command to enable the statistics collection of the traffic matching anACL rule on a specified port.

Step 2 Run the display qos-info traffic-mirror port command to query the statistics information aboutthe traffic matching an ACL rule on a specified port.

----End

ExampleTo enable the statistics collection of the traffic that matches ACL 2001 received on port0/19/0, do as follows:

huawei(config)#traffic-statistic inbound ip-group 2001 port 0/19/0huawei(config)#display qos-info traffic-statistic port 0/19/0

traffic-statistic:port 0/19/0: Inbound: Matches: Acl 2001 rule 5 running 0 packet

2.15.4.4 Enabling the Mirroring of the Traffic Matching an ACL RuleThis topic describes how to mirror the traffic matching an ACL rule on a port to a specified port.Mirroring does not affect packet receipt and transmission on the mirroring source port. You canmonitor the traffic of the mirroring source port by analyzing the traffic that passes the mirroringdestination port.

PrerequisiteThe ACL and the rule of the ACL are configured, and the port for traffic mirroring is workingin the normal state.

Background Informationl The traffic statistics are only valid to permit rules of an ACL.

l The destination mirroring port cannot be an aggregation port.




Issue 03 (2010-01-28)

l The system supports only one mirroring destination port and the mirroring destination portmust be the upstream port.

Procedure

Step 1 Run the traffic-mirror command to enable the mirroring of the traffic matching an ACL ruleon a specified port.

Step 2 Run the display qos-info traffic-mirror port command to query the mirroring informationabout the traffic matching an ACL rule on a specified port.

----End

Example

To mirror the traffic that matches ACL 2001 received on port 0/11/0 to port 0/19/0, do as follows:

huawei(config)#traffic-mirror inbound ip-group 2001 port 0/11/0 to port 0/19/0huawei(config)#display qos-info traffic-mirror port 0/11/0 traffic-mirror: port 0/11/0: Inbound: Matches: Acl 2001 rule 5 running Mirror to: port 0/19/0

2.15.4.5 Enabling the Redirection of the Traffic Matching an ACL Rule

This topic describes how to redirect the traffic matching an ACL rule on a specified port. Afterthis operation is executed successfully, the original port does not forward the traffic matchingthe ACL rule, but the specified port forwards the traffic.

Prerequisite

The ACL and the rule of the ACL are configured, and the port for redirection is working in thenormal state.

Contextl The traffic statistics are only valid to permit rules of an ACL.

l Currently, the service ports support only redirection of the traffic matching the ACL ruleto upstream ports. The upstream ports support only redirection of the traffic matching theACL rule to ports on the board of the same type.

Procedure

Step 1 Run the traffic-redirect command to redirect the traffic matching an ACL rule on a specifiedport.

Step 2 Run the display qos-info traffic-redirect port command to query the redirection informationabout the traffic matching an ACL rule on a specified port.

----End



2-103

Example

To redirect the traffic that matches ACL 2001 received on port 0/19/0 to port 0/19/1, do asfollows:

huawei(config)#traffic-redirect inbound ip-group 2001 port 0/19/0 to port 0/19/1huawei(config)#display qos-info traffic-redirect port 0/19/0traffic-redirect: port 0/19/0: Inbound: Matches: Acl 2001 rule 5 running Redirected to: port 0/19/1

2.16 Configuring GPON ProfilesConfiguring an GPON Profile is a prerequisite for configuring an GPON access service. Thistopic describes how to configure a DBA profile and an GPON ONT profile.

2.16.1 Configuring a DBA ProfileA DBA profile defines the traffic parameters of xPON and can be bound to dynamically allocatethe bandwidth and improve the usage of the upstream bandwidth.

2.16.2 Configuring the GPON ONT Profile (Distributed Mode)In the distributed mode, GPON ONT profiles include the GPON ONT capability profile and theGPON ONT alarm profile. This topic describes how to configure these profiles.

2.16.3 Configuring the GPON ONT Profile (Profile Mode)GPON ONT profiles are classified into line profiles, service profiles, and alarm profiles in theprofile mode. This topic describes how to configure these profiles.

2.16.1 Configuring a DBA ProfileA DBA profile defines the traffic parameters of xPON and can be bound to dynamically allocatethe bandwidth and improve the usage of the upstream bandwidth.


Table 2-18 lists the default settings of the DBA profiles.

Table 2-18 Default settings of the DBA profiles


Default DBA profile IDin the system

1-9 You can run the display dba-profile all command to querythe parameter values of eachdefault DBA profile.

Procedure

Step 1 Add a DBA profile.




Issue 03 (2010-01-28)

Run the dba-profile add command to add a DBA profile. The system provides nine defaultDBA profiles numbered 1-9, which define the typical values of traffic parameters. These DBAprofiles cannot be added or deleted.

NOTE

l By default, T-CONT is not bound to any DBA profile. Hence, a DBA profile must be configured for T-CONT.

l When you add a DBA profile, the bandwidth value must be a multiple of 64. If you enter a bandwidth valuenot of a multiple of 64, the system adopts the closest multiple of 64 that is smaller than the value you enter.

l The TDM service has strict requirements on delay. Therefore, when configuring a DBA profile, configureit as a fixed bandwidth type and enable bandwidth compensation.

Step 2 Query a DBA profile.

Run the display dba-profile command to query a DBA profile.

----End

ExampleAssume that the name and type of a DBA profile are "DBA_bandwidth" and "type3"respectively, and that the bandwidth required by a user is 10 Mbit/s. To add such a DBA profile,do as follows:

huawei(config)#dba-profile add profile-name DBA_10M type3 assure 10240 max 10240huawei(config)#display dba-profile profile-name DBA_10M ----------------------------------------------------------------- Profile-name : DBA_10M Profile-ID: 10 type: 3 Bandwidth compensation: No Fix(kbps): 0 Assure(kbps): 10240 Max(kbps): 10240 bind-times: 0 -----------------------------------------------------------------

2.16.2 Configuring the GPON ONT Profile (Distributed Mode)In the distributed mode, GPON ONT profiles include the GPON ONT capability profile and theGPON ONT alarm profile. This topic describes how to configure these profiles.

Background InformationGPON ONT profiles contain the parameters required for configuring the GPON access service.Of which,l The GPON ONT capability profile contains the physical port type and quantity of the ONU,

mapping mode from service port to GEM port, and traffic control type.l The GPON ONT alarm profile provides a series of alarm threshold parameters that are used

for performance measurement and monitoring of activated ONU lines. After a GPON alarmprofile is bound to an ONU, the ONU sends alarms to the log host and the NMS if theperformance statistics of the line exceed the threshold that is specified in the profile.



2-105

NOTE

l In this document, MDU and ONT are called ONU collectively.

l The description in this topic is based on the GPON distributed mode. You can query the current GPON modein the diagnose mode.huawei(config)#diagnosehuawei(diagnose)%%display xpon mode --------------------------------------------------- Current config mode: Distributing-mode ---------------------------------------------------

2.16.2.1 Configuring a GPON ONT Capacity ProfileA GPON ONT capability profile identifies the actual capability of a GPON ONU. After an ONTis added and bound to a GPON ONT capability profile, the ONU carries the correspondingservices according to parameters configured in the capability profile.

2.16.2.2 Configuring a GPON ONT Alarm ProfileThis topic describes how to add an alarm profile, and configure most of the performanceparameters for various ONT lines as a profile. After the alarm profile is configured and boundsuccessfully, the ONT can directly use the profile when it is activated.

2.16.2.1 Configuring a GPON ONT Capacity Profile

A GPON ONT capability profile identifies the actual capability of a GPON ONU. After an ONTis added and bound to a GPON ONT capability profile, the ONU carries the correspondingservices according to parameters configured in the capability profile.

Contextl All GPON ONUs must be bound to the GPON ONT capability profile. Specify the ONT

capability profile when running the ont add command to add an ONU offline or runningthe ont confirm command to confirm an automatically discovered ONU.

l Currently, the system provides seven default ONT capability profiles that are solidified inthe system. The default profiles cannot be modified. The default profile IDs range from1-7. The reserved ONT capability profile IDs are 8-16.

l The contents of the capability profile restrict the port number that is used in commands forGEM port mapping, T-CONT/PQ mapping, and the ONT VLAN management.

l The ONT capability profile must be configured according to the actual capability of theONU. Different the capability profile parameters vary according to different ONUs.

Procedure

Step 1 Run the ont-profile add command to configure an ONT capability profile.

When you add an ONT capability profile, if the profile ID is not specified, the systemautomatically allocates the least idle profile ID; if the profile name is not specified, the systemadopts the default name ont-profile_x, where, x is the corresponding ONT capability profileID.

The system supports up to 128 ONT capability profiles.

The system default profiles include the MDU profile and several common ONT (such as OT925,HG850, and HG810) profiles, which can be directly used. It is recommended to manuallyconfigure an ONT capability profile only when the default ONT capability profile fails to meetactual requirements.




Issue 03 (2010-01-28)

Step 2 Run the display ont-profile command to query the ONT capability profile.

----End

Example

Assume the following parameters: profile ID 30, two POTS ports, four Ethernet ports, mappingmode VLAN ID, and flow control type PQ. To configure such an ONT capability profile for theONT HG850a and query the capability profile after the configuration is completed, do as follows:

huawei(config)#ont-profile add profile-id 30{ <cr>|profile-name<K> }: Command: ont-profile add profile-id 31 Press 'Q' or 'q' to quit input > Number of POTS ports<0-8> [0]:2 > Number of ETH ports<0-8> [0]:4 > TDM port type<1-E1,2-T1> [1]: > TDM service type<1-TDMoGEM> [1]: > Number of TDM ports<0-8> [0]: > Number of MOCA ports<0-8> [0]: > Number of CATV UNI ports<0-8> [0]: > Mapping mode<1-VLANID, 2-802_1pPRI, 3-VLANID_802_1pPRI, 4-PORTID, 5-PORTID_VLANID, 6-PORTID_802_1pPRI, 7-PORTID_VLANID_802_1pPRI, 9-IPTOS, 10-VLANID_IPTOS> [1]: > The type of flow control<1-PQ, 2-GEMPORT-CAR, 3-FLOW-CAR> [1]: Adding an ONT profile succeeded Profile ID : 30 Profile name: ont-profile_30 huawei(config)#display ont-profile profile-id 30 --------------------------------------------------------------------------- Profile ID : 30 Profile name: ont-profile_30 --------------------------------------------------------------------------- Number of POTS ports: 2 Number of ETH ports: 4 TDM port type: E1 TDM service type: TDMoGem Number of TDM ports: 0 Number of MOCA ports: 0 Number of CATV UNI ports: 0 Mapping mode: VLAN ID The type of flow control: PQ --------------------------------------------------------------------------- Binding times: 0 ---------------------------------------------------------------------------

2.16.2.2 Configuring a GPON ONT Alarm Profile

This topic describes how to add an alarm profile, and configure most of the performanceparameters for various ONT lines as a profile. After the alarm profile is configured and boundsuccessfully, the ONT can directly use the profile when it is activated.


An ONT alarm profile defines a series of alarm thresholds that are used to monitor theperformance of an activated ONT line. When the statistics result of a parameter reaches the alarmthreshold, the NE is notified and an alarm is sent to the log server and the NMS.

l The MA5600T supports up to 50 alarm profiles.



2-107

l The system contains a default alarm profile with the ID 1. This profile cannot be deletedbut can be modified.

Procedure

Step 1 Run the gpon alarm-profile add command to add a GPON ONT alarm profile.

All parameters in the default profile are set to 0, which indicates that no alarm is reported. Whenan alarm profile is created, the default values of all alarm thresholds are 0, which indicates thatno alarm is reported.

Step 2 Run the display gpon alarm-profile command to query the alarm profile.

----End

ExampleTo add GPON ONT alarm profile 5, set the alarm threshold for the packet loss of the GEM portto 10, set the alarm threshold for the number of mis-transmitted packets to 30, and use the defaultvalue 0 for all other thresholds, do as follows:

huawei(config)#gpon alarm-profile add profile-id 5 { <cr>|profile-name<K> }: Command: gpon alarm-profile add profile-id 5 Press 'Q' or 'q' to quit input > GEM port loss of packets threshold (0~100)[0]: 10> GEM port misinserted packets threshold (0~100)[0]: 30> GEM port impaired blocks threshold (0~100)[0]: > Ethernet FCS errors threshold (0~100)[0]: > Ethernet excessive collision count threshold (0~100)[0]: > Ethernet late collision count threshold (0~100)[0]: > Too long Ethernet frames threshold (0~100)[0]: > Ethernet buffer (Rx) overflows threshold (0~100)[0]: > Ethernet buffer (Tx) overflows threshold (0~100)[0]: > Ethernet single collision frame count threshold (0~100)[0]: > Ethernet multiple collisions frame count threshold (0~100)[0]: > Ethernet SQE count threshold (0~100)[0]: > Ethernet deferred transmission count threshold (0~100)[0]: > Ethernet internal MAC Tx errors threshold (0~100)[0]: > Ethernet carrier sense errors threshold (0~100)[0]: > Ethernet alignment errors threshold (0~100)[0]: > Ethernet internal MAC Rx errors threshold (0~100)[0]: > PPPOE filtered frames threshold (0~100)[0]: > MAC bridge port discarded frames due to delay threshold (0~100)[0]: > MAC bridge port MTU exceeded discard frames threshold (0~100)[0]: > MAC bridge port received incorrect frames threshold (0~100)[0]: > CES general error time threshold(0~100)[0]: > CES severely time threshold(0~100)[0]: > CES bursty time threshold(0~100)[0]: > CES controlled slip threshold(0~100)[0]: > CES unavailable time threshold(0~100)[0]: > Drop events threshold(0~100)[0]: > Undersize packets threshold(0~100)[0]: > Fragments threshold(0~100)[0]: > Jabbers threshold(0~100)[0]: > Failed signal of ONT threshold(Format:1e-x, x: 3~8)[3]: > Degraded signal of ONT threshold(Format:1e-x, x: 4~9)[4]: Adding an Alarm profile succeeded Profile ID : 5 Profile name: alarm-profile_5 huawei(config)#display gpon alarm-profile profile-id 5 -------------------------------------------------------------- Profile ID : 5




Issue 03 (2010-01-28)

Profile name: alarm-profile_5 -------------------------------------------------------------- GEM port loss of packets threshold: 10 GEM port misinserted packets threshold: 30 GEM port impaired blocks threshold: 0 Ethernet FCS errors threshold: 0 Ethernet excessive collision count threshold: 0 Ethernet late collision count threshold: 0 Too long Ethernet frames threshold: 0 Ethernet buffer (Rx) overflows threshold: 0 Ethernet buffer (Tx) overflows threshold: 0 Ethernet single collision frame count threshold: 0 Ethernet multiple collisions frame count threshold: 0 Ethernet SQE count threshold: 0 Ethernet deferred transmission count threshold: 0 Ethernet internal MAC Tx errors threshold: 0 Ethernet carrier sense errors threshold: 0 Ethernet alignment errors threshold: 0 Ethernet internal MAC Rx errors threshold: 0 PPPOE filtered frames threshold: 0 MAC bridge port discarded frames due to delay threshold: 0 MAC bridge port MTU exceeded discard frames threshold: 0 MAC bridge port received incorrect frames threshold: 0 CES general error time threshold: 0 CES severely time threshold: 0 CES bursty time threshold: 0 CES controlled slip time threshold: 0 CES unavailable time threshold: 0 Drop events threshold: 0 Undersize packets threshold: 0 Fragments threshold: 0 Jabbers threshold: 0 Failed signal of ONU threshold (Format:1e-x): 3 Degraded signal of ONU threshold (Format:1e-x): 4 -------------------------------------------------------------- Binding Times: 0 --------------------------------------------------------------

2.16.3 Configuring the GPON ONT Profile (Profile Mode)GPON ONT profiles are classified into line profiles, service profiles, and alarm profiles in theprofile mode. This topic describes how to configure these profiles.


In the profile mode, GPON ONT profiles are classified into line profiles and service profilesaccording to the GPON ONT parameters. The line profile is mainly used to configure theinformation related to DBA, T-CONT, and GEM port. The service profile is mainly used toconfigure the actual ONT capability and the parameters relevant to services.

The line profile is mandatory and the service profile is optional and dependent of servicerequirements. Set related attributes in line profile mode and service profile mode, and directlybind the ONT to the line profile and service profile.

GPON supports the function of changing the bound profile for ONTs that are configured withservices, but the following cases are excluded:

l A GEM port is configured with a service, but the new profile to be used does not containthe configuration of the service.

l A GEM port is configured with a service and the service exists in the new profile to beused, but the service types (ETH/TDM) are different.



2-109

l A GEM port is configured with a service and the service exists in the new profile to beused, but the subtending attributes (ON/OFF) are different.

NOTEThe description in this topic is based on the GPON profile mode. You can query the current GPON mode in thediagnose mode.huawei(config)#diagnosehuawei(diagnose)%%display xpon mode --------------------------------------------------- Current config mode: Profile-mode ---------------------------------------------------

2.16.3.1 Configuring a GPON ONT Line ProfileConfigure the GPON ONT line profile so that you can reference the profile when adding anONT. Regardless of whether the ONT is in the OMCI or SNMP management mode, the ONTneeds to be bound with a GPON ONT line profile.

2.16.3.2 Configuring a GPON ONT Service ProfileThe GPON ONT service profile provides a channel for configuring the service of the ONTmanaged in the OMCI mode. To configure the service of the ONU (such as the MDU) managedin the SNMP mode, you need to log in to the ONU.

2.16.3.3 Configuring a GPON ONT Alarm ProfileThis topic describes how to add an alarm profile, and configure most of the performanceparameters for various ONT lines as a profile. After the alarm profile is configured and boundsuccessfully, the ONT can directly use the profile when it is activated.

2.16.3.1 Configuring a GPON ONT Line ProfileConfigure the GPON ONT line profile so that you can reference the profile when adding anONT. Regardless of whether the ONT is in the OMCI or SNMP management mode, the ONTneeds to be bound with a GPON ONT line profile.

Default ConfigurationTable 2-19 lists the default settings of the GPON ONT line profile.

Table 2-19 Default settings of the GPON ONT line profile


QoS mode Priority-queue (PQ) scheduling mode

Mapping mode supported by the ONT VLAN mapping mode

Upstream FEC switch Disabled

Procedure

Step 1 Run the ont-lineprofile gpon command to add a GPON ONT line profile, and then enter theGPON ONT line profile mode.

Regardless of whether the ONT is in the OMCI or SNMP management mode, the line profilemust be configured for the ONT. After adding a GPON ONT line profile, directly enter theGPON ONT line profile mode to configure the related attributes of the ONT line.




Issue 03 (2010-01-28)

Step 2 Bind the T-CONT with a DBA profile.

Run the tcont command to bind the T-CONT with a DBA profile. Ensure that Adding a DBAProfile is completed before the configuration.

By default, T-CONT 0 of an ONT is used by OMCI and is bound with DBA profile 1. Theconfiguration suggestions for the OMCI T-CONT are as follows:

l Do not modify the DBA profile bound to the T-CONT. If you need to modify the profile,ensure that the fixed bandwidth of the modified profile is not lower than 5 Mbit/s.

l Do not bind the GEM port with the T-CONT. That is, ensure that the T-CONT does not carryany service.

Step 3 (Optional) Configure the QoS mode of the GPON ONT line profile.

Run the qos-mode command to configure the QoS mode of the GPON ONT line profile so thatthe QoS mode is the same as the QoS mode of the GEM port. By default, the QoS mode of theONT line profile is the PQ scheduling mode. The three QoS modes are as follows:l flow-car: When this mode is selected, flow-car should be selected in the gem mapping

command, and the maximum traffic depends on the traffic profile bound to the service port.Run the traffic table ip command to create a required traffic profile before the configuration.

NOTE

The service port here refers to the service channel from the ONT to the OLT, and is different from the serviceport created by running the service-port command.

l gem-car: When this mode is selected, gem-car should be selected in the gem add command,and the maximum traffic depends on the traffic profile bound to the GEM port.

l priority-queue: When this mode is selected, priority-queue should be selected in the gemadd command. The system has eight default queues (0-7). Queue 7 has the highest priorityand the traffic of this queue must be ensured first. The maximum traffic depends on the DBAprofile bound to the corresponding T-CONT.

Step 4 Configure the binding relation between the GEM index and the T-CONT.

Run the gem add command to configure the binding relation between the GEM index and theT-CONT in the GPON ONT line profile.

The ONT can carry services only after the mapping between the GEM port and the T-CONT,and the mapping between the GEM port and the service port are configured for the ONT. Acorrect attribute should be selected for service-type based on the service type. Select eth whenthe Ethernet service is carried. Select tdm when the TDM service is carried.

Step 5 Configure the mapping between the GEM port and the ONT-side service.

Run the gem mapping command to set up the mapping between the GEM port and the ONT-side service.

Before the configuration, run the mapping-mode command to configure the mapping modesupported by the ONT so that the mapping mode supported by the ONT is the same as theconfigured mapping mode between the GEM port and the ONT-side service. By default, theONT supports the VLAN mapping mode.

l The mapping modes of the ETH port and the MOCA port are as follows:– If the port is specified and then the VLAN is further specified, the mapping mode should

be configured to port-vlan in the mapping-mode command. That is, the port+VLANmapping mode is used.



2-111

– If the port is specified and then the priority is further specified, the mapping mode shouldbe configured to port-priority in the mapping-mode command. That is, the port+prioritymapping mode is used.

– If the port and the VLAN are specified and then the priority is further specified, themapping mode should be configured to port-vlan-priority in the mapping-modecommand. That is, the port+VLAN+priority mapping mode is used.

l As a special port, the IPHOST or E1 port is not restricted by the ONT mapping mode.

Step 6 Configure the upstream FEC switch.

Run the fec-upstream command to configure the upstream FEC switch of the GPON ONT lineprofile. By default, this switch is disabled.

In the FEC check, the system inserts redundancy data into normal packets. In this way, the linehas certain error tolerant function, but certain bandwidth resources are wasted. Enabling the FECfunction enhances the error tolerant capability of the line but occupies certain bandwidth.Therefore, determine whether to enable the FEC function based on the actual line planning.

Step 7 Run the commit command to make the parameters of the profile take effect. The configurationof a line profile takes effect only after you perform this operation.

NOTE

If this profile is not bound, all the parameters that are configured take effect when the profile is bound. If thisprofile is already bound, the configuration takes effect on all ONTs bound with this profile immediately.

Step 8 Run the quit command to return to the global config mode.

----End

Example

Assume that the GEM index is 1, the GEM port is bound with T-CONT 1 and mapped to ETH1 of the ONT. To add GPON ONT line profile 5, create a channel for carrying the Ethernetservice, with T-CONT 1 and bound with DBA profile 12, use the QoS policy of controlling thetraffic based on GEM ports, and bind the GEM port with default traffic profile 6, do as follows:

huawei(config)#ont-lineprofile gpon profile-id 5huawei(config-gpon-lineprofile-5)#tcont 1 dba-profile-id 12huawei(config-gpon-lineprofile-5)#qos-mode gem-car huawei(config-gpon-lineprofile-5)#gem add 1 eth tcont 1 gem-car 6 huawei(config-gpon-lineprofile-5)#mapping-mode port huawei(config-gpon-lineprofile-5)#gem mapping 1 0 eth 1huawei(config-gpon-lineprofile-5)#commithuawei(config-gpon-lineprofile-5)#quit

2.16.3.2 Configuring a GPON ONT Service Profile

The GPON ONT service profile provides a channel for configuring the service of the ONTmanaged in the OMCI mode. To configure the service of the ONU (such as the MDU) managedin the SNMP mode, you need to log in to the ONU.


Table 2-20 lists the default settings of the GPON ONT service profile.




Issue 03 (2010-01-28)

Table 2-20 Default settings of the GPON ONT service profile


Mode for the ONT to process theVLAN tag of the multicast data packets

Unconcern

Coding mode for the E1 port of theONT

HDB3

Source of the priority copied for theupstream packets on the ONT port

Unconcern

QinQ attribute for the Ethernet port ofthe ONT

Unconcern

Transparent transmission function ofthe ONT

Disabled

MAC address learning function of theONT

Enabled

Procedure

Step 1 Run the ont-srvprofile gpon command to add a GPON ONT service profile, and then enter theGPON ONT service profile mode.

If the ONT management mode is the SNMP mode, you need not configure the service profile.After adding a GPON ONT service profile, directly enter the GPON ONT service profile modeto configure the related items. Select the configuration items according to the servicerequirements.

Step 2 Configure the Internet access service.

1. Run the ont-port eth command to configure the port capability set of the ONT. Thecapability set plans the number of various ports supported by the ONT. The port capabilityset must be the same as the actual ONT capability set.

2. Run the port vlan command to configure the port VLAN of the ONT.

Step 3 Configure the voice service.

NOTE

The voice service of the ONT is issued to the NMS for configuration through XML, and the OLT transparentlytransmits the service. Therefore, you only need to run the service-port command to create a service port channelfor carrying the voice service.

1. Run the ont-port pots command to configure the port capability set of the ONT. The portcapability set must be the same as the actual ONT capability set.


Step 4 Configure the multicast service.

1. Run the ont-port eth command to configure the port capability set of the ONT. The portcapability set must be the same as the actual ONT capability set.




2-113

3. Run the multicast-forward command to configure the mode for the ONT to process theVLAN tag of the multicast data packets. By default, the multicast forwarding mode of theONT is unconcern.

l Unconcern: indicates the unconcern forwarding mode. After this mode is selected, theOLT does not process the VLAN tag of the multicast data packets.

l Tag: Set the multicast forwarding mode to contain the VLAN tag. To transparentlytransmit the VLAN tag of the multicast packets, select transparent. To switch theVLAN tag of the multicast packets, select translation, and then configure the VLANID that is switched to.

l Untag: Set the multicast forwarding mode not to contain the VLAN tag.

Step 5 Configure the E1 service.

1. Run the ont-port e1 command to configure the port capability set of the ONT. The portcapability set must be the same as the actual ONT capability set.


3. Run the port e1 command to configure the coding mode supported by the E1 port of theONT. By default, the coding mode supported by the E1 port is HDB3. The coding modesupported by the E1 port must be the same as the coding mode of the interconnected device.

Step 6 Configure the transparent LAN service (TLS).



3. Run the port q-in-q eth ont-portid enable command to enable the QinQ function for theEthernet port of the ONT. By default, the QinQ function for the Ethernet port of the ONTis disabled.

4. Run the port priority-policy command to configure the source of the priority copied forthe upstream packets on the ONT port. By default, the source of the priority copied for theupstream packets on the Ethernet port of the ONT is not concerned.

l Unconcern: The source of the priority copied for the upstream packets on the Ethernetport of the ONT is not concerned.

l Assigned: Specify the priority. Run the ont port native-vlan command to specify theport priority.

l Copy-cos: Copy the priority. Copy the priority from C-TAG.

5. Run the transparent enable command to enable the transparent transmission of the ONT.By default, the transparent transmission of the ONT is disabled. After the transparenttransmission of the ONT is enabled, all packets (including service packets and protocolpackets) are transparently transmitted through the ONT.

NOTE

The service port corresponding to TLS must also be of the TLS type. Run the service-port to create a serviceport. Select other-all for multi-service.

Step 7 Configure the 1:1 service (the packet reported by the ONT is required to carry two layers ofVLAN tags).






Issue 03 (2010-01-28)

3. Run the port q-in-q eth ont-portid enable command to enable the QinQ function for theEthernet port of the ONT. By default, the QinQ function for the Ethernet port of the ONTis disabled.

4. Run the port priority-policy command to configure the source of the priority copied forthe upstream packets on the ONT port. By default, the source of the priority copied for theupstream packets on the Ethernet port of the ONT is not concerned.

l Unconcern: The source of the priority copied for the upstream packets on the Ethernetport of the ONT is not concerned.

l Assigned: Specify the priority. Run the ont port native-vlan command to specify theport priority.

l Copy-cos: Copy the priority. Copy the priority from C-TAG.

5. Run the transparent disable command to disable the transparent transmission of the ONT.

Step 8 Run the mac-learning command to configure the MAC address learning function of the ONT.By default, the function is enabled.

Step 9 Run the commit command to make the parameters of the profile take effect. The configurationof the service profile takes effect only after you perform this operation.

NOTE

If this profile is not bound, all the parameters that are configured take effect when the profile is bound. If thisprofile is already bound, the configuration takes effect on all ONTs bound with this profile immediately.

Step 10 Run the quit command to return to the global config mode.

----End

Example

Assume that the profile is used for the Internet access service, the ONT supports four ETH ports,and the VLAN ID of the ETH ports is 10. To add GPON ONT service profile 5, do as follows:

huawei(config)#ont-srvprofile gpon profile-id 5huawei(config-gpon-srvprofile-5)#ont-port eth 4huawei(config-gpon-srvprofile-5)#port vlan eth 1-4 10huawei(config-gpon-srvprofile-5)#commithuawei(config-gpon-srvprofile-5)#quit

Assume that the profile is used for the multicast service, the ONT supports four ETH ports, theVLAN ID of the ETH ports is 100, and switch the multicast VLAN tag to 841 because the STBonly supports carrying the VLAN tag of 841. To add GPON ONT service profile 6, do as follows:

huawei(config)#ont-srvprofile gpon profile-id 6huawei(config-gpon-srvprofile-6)#ont-port eth 4huawei(config-gpon-srvprofile-6)#port vlan eth 1-4 100huawei(config-gpon-srvprofile-6)#multicast-forward tag translation 841huawei(config-gpon-srvprofile-6)#commithuawei(config-gpon-srvprofile-6)#quit

2.16.3.3 Configuring a GPON ONT Alarm Profile

This topic describes how to add an alarm profile, and configure most of the performanceparameters for various ONT lines as a profile. After the alarm profile is configured and boundsuccessfully, the ONT can directly use the profile when it is activated.



2-115

Background InformationAn ONT alarm profile defines a series of alarm thresholds that are used to monitor theperformance of an activated ONT line. When the statistics result of a parameter reaches the alarmthreshold, the NE is notified and an alarm is sent to the log server and the NMS.

l The MA5600T supports up to 50 alarm profiles.

l The system contains a default alarm profile with the ID 1. This profile cannot be deletedbut can be modified.

Procedure

Step 1 Run the gpon alarm-profile add command to add a GPON ONT alarm profile.

All parameters in the default profile are set to 0, which indicates that no alarm is reported. Whenan alarm profile is created, the default values of all alarm thresholds are 0, which indicates thatno alarm is reported.

Step 2 Run the display gpon alarm-profile command to query the alarm profile.

----End

ExampleTo add GPON ONT alarm profile 5, set the alarm threshold for the packet loss of the GEM portto 10, set the alarm threshold for the number of mis-transmitted packets to 30, and use the defaultvalue 0 for all other thresholds, do as follows:

huawei(config)#gpon alarm-profile add profile-id 5 { <cr>|profile-name<K> }: Command: gpon alarm-profile add profile-id 5 Press 'Q' or 'q' to quit input > GEM port loss of packets threshold (0~100)[0]: 10> GEM port misinserted packets threshold (0~100)[0]: 30> GEM port impaired blocks threshold (0~100)[0]: > Ethernet FCS errors threshold (0~100)[0]: > Ethernet excessive collision count threshold (0~100)[0]: > Ethernet late collision count threshold (0~100)[0]: > Too long Ethernet frames threshold (0~100)[0]: > Ethernet buffer (Rx) overflows threshold (0~100)[0]: > Ethernet buffer (Tx) overflows threshold (0~100)[0]: > Ethernet single collision frame count threshold (0~100)[0]: > Ethernet multiple collisions frame count threshold (0~100)[0]: > Ethernet SQE count threshold (0~100)[0]: > Ethernet deferred transmission count threshold (0~100)[0]: > Ethernet internal MAC Tx errors threshold (0~100)[0]: > Ethernet carrier sense errors threshold (0~100)[0]: > Ethernet alignment errors threshold (0~100)[0]: > Ethernet internal MAC Rx errors threshold (0~100)[0]: > PPPOE filtered frames threshold (0~100)[0]: > MAC bridge port discarded frames due to delay threshold (0~100)[0]: > MAC bridge port MTU exceeded discard frames threshold (0~100)[0]: > MAC bridge port received incorrect frames threshold (0~100)[0]: > CES general error time threshold(0~100)[0]: > CES severely time threshold(0~100)[0]: > CES bursty time threshold(0~100)[0]: > CES controlled slip threshold(0~100)[0]: > CES unavailable time threshold(0~100)[0]: > Drop events threshold(0~100)[0]: > Undersize packets threshold(0~100)[0]: > Fragments threshold(0~100)[0]:




Issue 03 (2010-01-28)

> Jabbers threshold(0~100)[0]: > Failed signal of ONT threshold(Format:1e-x, x: 3~8)[3]: > Degraded signal of ONT threshold(Format:1e-x, x: 4~9)[4]: Adding an Alarm profile succeeded Profile ID : 5 Profile name: alarm-profile_5 huawei(config)#display gpon alarm-profile profile-id 5 -------------------------------------------------------------- Profile ID : 5 Profile name: alarm-profile_5 -------------------------------------------------------------- GEM port loss of packets threshold: 10 GEM port misinserted packets threshold: 30 GEM port impaired blocks threshold: 0 Ethernet FCS errors threshold: 0 Ethernet excessive collision count threshold: 0 Ethernet late collision count threshold: 0 Too long Ethernet frames threshold: 0 Ethernet buffer (Rx) overflows threshold: 0 Ethernet buffer (Tx) overflows threshold: 0 Ethernet single collision frame count threshold: 0 Ethernet multiple collisions frame count threshold: 0 Ethernet SQE count threshold: 0 Ethernet deferred transmission count threshold: 0 Ethernet internal MAC Tx errors threshold: 0 Ethernet carrier sense errors threshold: 0 Ethernet alignment errors threshold: 0 Ethernet internal MAC Rx errors threshold: 0 PPPOE filtered frames threshold: 0 MAC bridge port discarded frames due to delay threshold: 0 MAC bridge port MTU exceeded discard frames threshold: 0 MAC bridge port received incorrect frames threshold: 0 CES general error time threshold: 0 CES severely time threshold: 0 CES bursty time threshold: 0 CES controlled slip time threshold: 0 CES unavailable time threshold: 0 Drop events threshold: 0 Undersize packets threshold: 0 Fragments threshold: 0 Jabbers threshold: 0 Failed signal of ONU threshold (Format:1e-x): 3 Degraded signal of ONU threshold (Format:1e-x): 4 -------------------------------------------------------------- Binding Times: 0 --------------------------------------------------------------



2-117

3 Protocol Configuration

About This Chapter

Protocol configurations mainly include protocol common configurations. There is no obviouslogical relation between protocol configurations. You can perform protocol configurationsaccording to actual requirements.

3.1 Configuring ARP ProxyThis topic describes how to configure the ARP proxy of the L3 interface so that users on isolatedports of the same broadcast domain or on ports of different broadcast domains can communicatewith each other. To reduce the network load, the ARP request packets are limited in a VLAN.

3.2 Configuring the BFDThis topic describes how to configure the BFD on the MA5600T.

3.3 Configuring the RouteThis topic describes the routing policy supported by the MA5600T and how to configure therouting protocol.

3.4 Configuration Example of a VRF InstanceThis topic describes how to categorize VRF instances by VLANs, and realize the virtual staticroute forwarding in different VRF instances.

3.5 Configuring the MSTPThe MA5600T supports the application of the Multiple Spanning Tree Protocol (MSTP),Spanning Tree Protocol (STP), and Rapid Spanning Tree Protocol (RSTP). The MA5600Tsupports the MSTP ring network, which can meet various networking requirements.

3.6 Configuring Ethernet OAMIn a broad sense, operation, administration, and maintenance (OAM) means a set of methodsfor monitoring and diagnosing network faults. The Ethernet OAM feature includes two sub-features: Ethernet CFM OAM and Ethernet EFM OAM.

SmartAX MA5600TCommissioning and Configuration Guide 3 Protocol Configuration


3-1

3.1 Configuring ARP ProxyThis topic describes how to configure the ARP proxy of the L3 interface so that users on isolatedports of the same broadcast domain or on ports of different broadcast domains can communicatewith each other. To reduce the network load, the ARP request packets are limited in a VLAN.

Networking

Figure 3-1 shows an example network of the ARP proxy.

PC1 and PC2 are in sub VLAN 10, service ports are isolated, and PC3 is in sub VLAN 20. Userpackets can be forwarded in the L3 forwarding mode through the super VLAN interface. TheIP address of the super VLAN interface is 10.0.0.254, and the interface is in the same subnet asPC1, PC2, and PC3. After the ARP proxy function is enabled, PC1 and PC2 can communicatewith each other, and PC3 can communicate with PC1 and PC2.

Figure 3-1 Example network of the ARP proxy

Data Plan

Table 3-1 provides the data plan for configuring the ARP proxy.

Table 3-1 Data plan for configuring the ARP proxy

Item Data

Super VLAN VLAN ID: 100

3 Protocol ConfigurationSmartAX MA5600T



Issue 03 (2010-01-28)

Item Data

Sub VLAN: VLAN 10, VLAN 20

IP address: 10.0.0.254/24

Sub VLAN VLAN ID: 10

VLAN type: smart VLAN

Sub VLAN VLAN ID: 20

VLAN type: MUX VLAN

Upstream port Port: 0/19/0

VLAN: standard VLAN 30

IP address: 10.0.1.254/24

Configuration FlowchartFigure 3-2 shows the flowchart for configuring the ARP proxy.

Figure 3-2 Flowchart for configuring the ARP proxy



3-3

ProcedureStep 1 Create a super VLAN.

huawei(config)#vlan 100 super

Step 2 Create sub VLANs, and add them to the super VLAN.huawei(config)#vlan 10 smart huawei(config)#vlan 20 mux huawei(config)#supervlan 100 subvlan 10huawei(config)#supervlan 100 subvlan 20

Step 3 Configure the service ports of the sub VLANs.huawei(config)#service-port vlan 10 gpon 0/2/0 gemport 128 multi-service user-vlan 15 rx-cttr 5 tx-cttr 5huawei(config)#service-port vlan 10 gpon 0/2/0 gemport 129 multi-service user-vlan 16 rx-cttr 5 tx-cttr 5huawei(config)#service-port vlan 20 gpon 0/2/0 gemport 130 multi-service user-vlan 17 rx-cttr 5 tx-cttr 5

Step 4 Configure the upstream port.huawei(config)#vlan 30 standardhuawei(config)#port vlan 30 0/19 0huawei(config)#interface vlanif 30huawei(config-if-vlanif30)#ip address 10.0.1.254 24

NOTEThe IP address of the L3 interface of the super VLAN must be in the same subnet with the IP addressobtained by the PC1-PC3.

Step 5 Configure an L3 Interface for the super VLANhuawei(config)#interface vlanif 100huawei(config-if-vlanif100)#ip address 10.0.0.254 24

NOTEThe IP address of the L3 interface of the super VLAN must be in the same subnet with the IP addressobtained by the PC.

Step 6 Enable ARP proxy.1. Enable the ARP proxy function globally.

huawei(config)#arp proxy enable2. Enable the global ARP proxy on the VLAN interface.

huawei(config-if-vlanif100)#arp proxy enable3. Enable ARP proxy on the sub VLAN interface.

huawei(config-if-vlanif100)#arp proxy enable subvlan 10huawei(config-if-vlanif100)#quit

NOTESkip substep c in step 6 if you only want PCs in different VLANs to communicate with each other.


----End

ResultAfter the global ARP proxy function and the ARP proxy function of the super VLAN interfaceare enabled, PC1, PC2, and PC3 in different VLANs can communicate with each other.




Issue 03 (2010-01-28)

After the global ARP proxy function, the ARP proxy function of the super VLAN interface, andthat of the sub VLAN interface are enabled, PC1 and PC2 in the same VLAN can communicatewith each other.

3.2 Configuring the BFDThis topic describes how to configure the BFD on the MA5600T.

ContextBidirectional Forwarding Detection (BFD) protocol is a draft standardized by the InternetEngineering Task Force (IETF). BFD detects the traffic forwarding capability of the link orsystem by quickly sending BFD control packets (the UDP packets in a specified format) atintervals between two nodes.

3.2.1 Configuration Example of the BFD Link Detection (Static Route)The MA5600T supports detecting the fault of a static route by using the BFD. This topicdescribes how to configure the BFD link detection based on an example network.

3.2.2 Configuration Example of the BFD Link Detection (Dynamic Route)The MA5600T supports detecting the fault of a dynamic route by using the BFD. This topicdescribes how to configure the BFD link detection based on the dynamic routing protocol OSPF.

3.2.1 Configuration Example of the BFD Link Detection (StaticRoute)

The MA5600T supports detecting the fault of a static route by using the BFD. This topicdescribes how to configure the BFD link detection based on an example network.

PrerequisiteThe BFD function must be enabled globally on the MA5600T.

NetworkingFigure 3-3 shows an example network of the BFD link detection.

Different static routes exist between the MA5600T and Router_3 through Router_1 andRouter_2, and the BFD session is bound to the static route. When one link is faulty, the BFDsession notifies the bound route for route switching.



3-5

Figure 3-3 Example network of the BFD link detection

Data PlanTable 3-2 provides the data plan for configuring the BFD link detection.

Table 3-2 Data plan for configuring the BFD link detection

Item Data Remarks

MA5600T Upstream ports: 0/19/0 and 0/19/1 -

VLANs VLAN ID: 30VLAN type: Smart VLANIP address of the L3 interface: 10.10.10.1/24

-

VLAN ID: 40VLAN type: Smart VLANIP address of the L3 interface: 20.20.20.1/24

-

BFD session Session name: ToRouter_1Minimum transmit interval: 10 msMinimum receive interval: 10 msDetection multiplier: 3Identifier: auto-negotiation

-

Session name: ToRouter_2Minimum transmit interval: 10 msMinimum receive interval: 10 msDetection multiplier: 3Identifier: auto-negotiation

-




Issue 03 (2010-01-28)

Item Data Remarks

Requirements forthe upper-layerdevice

Router_1:l IP address of the L3 interface: see the example

networkl VLAN ID: 30

l BFD session parameters: consistent with theparameters of the MA5600T




For detailsabout theconfigurationof the routers,see thecorrespondingconfigurationguide.

Procedure

Step 1 Create VLANs and add upstream ports to the VLANs.huawei(config)#vlan 30 smarthuawei(config)#port vlan 30 0/19 0huawei(config)#vlan 40 smarthuawei(config)#port vlan 40 0/19 1

Step 2 Configure the IP address of the L3 interface of the VLAN.huawei(config)#interface vlanif 30huawei(config-if-vlanif30)#ip address 10.10.10.1 24huawei(config-if-vlanif30)#quithuawei(config)#interface vlanif 40huawei(config-if-vlanif40)#ip address 20.20.20.1 24huawei(config-if-vlanif40)#quit

Step 3 Configure the BFD sessions.You can configure BFD sessions only after the BFD function is enabled.huawei(config)#bfdhuawei(config-bfd)#quithuawei(config)#bfd ToRouter_1 bind peer-ip 10.10.10.2 source-ip 10.10.10.1 autohuawei(config-bfd-session-torouter_1)#min-rx-interval 10huawei(config-bfd-session-torouter_1)#min-tx-interval 10huawei(config-bfd-session-torouter_1)#detect-multiplier 3huawei(config-bfd-session-torouter_1)#commithuawei(config-bfd-session-torouter_1)#quithuawei(config)#bfd ToRouter_2 bind peer-ip 20.20.20.2 source-ip 20.20.20.1 autohuawei(config-bfd-session-torouter_2)#min-rx-interval 10huawei(config-bfd-session-torouter_2)#min-tx-interval 10huawei(config-bfd-session-torouter_2)#detect-multiplier 3huawei(config-bfd-session-torouter_2)#commithuawei(config-bfd-session-torouter_2)#quit

Step 4 Bind the BFD sessions to the static routes.huawei(config)#ip route-static 30.30.30.1 24 10.10.10.2 preference 2 track bfd-session ToRouter_1huawei(config)#ip route-static 30.30.30.1 24 20.20.20.2 preference 6 track bfd-session ToRouter_2

Step 5 Save the data.



3-7

huawei(config)#save

----End

Result

BFD sessions ToRouter_1 and ToRouter_2 are in the up state. The priority of the route to whichToRouter_1 is bound takes effect and carries services because it has a higher priority. When afaulty link is detected, BFD session ToRouter_1 turns to the down state, which triggers thedeactivation of the bound route. In this case, the route to which ToRouter_2 is bound takes effectand carries services.

3.2.2 Configuration Example of the BFD Link Detection (DynamicRoute)

The MA5600T supports detecting the fault of a dynamic route by using the BFD. This topicdescribes how to configure the BFD link detection based on the dynamic routing protocol OSPF.

Prerequisite

The BFD function must be enabled globally on the MA5600T.

Networking

Figure 3-4 shows an example network of the BFD link detection.

Dynamic routes between the MA5600T and Router_1, Router_2 are generated through OSPF.The BFD session is bound to the OSPF route. When one link is faulty, the BFD session reportsthat the bound OSPF neighbor is down, thus switching the route.

Figure 3-4 Example network of the BFD link detection




Issue 03 (2010-01-28)

Data PlanTable 3-3 provides the data plan for configuring the BFD link detection.

Table 3-3 Data plan for configuring the BFD link detection

Item Data Remarks

MA5600T Upstream ports: 0/19/0 and 0/19/1 -

VLANs VLAN ID: 30VLAN type: Smart VLANIP address of the L3 interface: 10.10.10.1/24

-

VLAN ID: 40VLAN type: Smart VLANIP address of the L3 interface: 20.20.20.1/24

-

BFD session Minimum transmit interval: 10 msMinimum receive interval: 10 msDetection multiplier: 3

-

Requirements forthe upper-layerdevice



l OSPF: enabled




l OSPF: enabled


For detailsabout theconfigurationof the router,see thecorrespondingconfigurationguide.

ProcedureStep 1 Create VLANs and add upstream ports to the VLANs.

huawei(config)#vlan 30 smarthuawei(config)#port vlan 30 0/19 0huawei(config)#vlan 40 smarthuawei(config)#port vlan 40 0/19 1

Step 2 Configure the IP address of the L3 interface of the VLAN.huawei(config)#interface vlanif 30huawei(config-if-vlanif30)#ip address 10.10.10.1 24huawei(config-if-vlanif30)#quithuawei(config)#interface vlanif 40



3-9

huawei(config-if-vlanif40)#ip address 20.20.20.1 24huawei(config-if-vlanif40)#quit

Step 3 Configure OSPF.huawei(config)#ospf 1huawei(config-ospf-1)#area 0huawei(config-ospf-1-area-0.0.0.0)#network 10.10.10.0 0.0.0.255huawei(config-ospf-1-area-0.0.0.0)#network 20.20.20.0 0.0.0.255huawei(config-ospf-1-area-0.0.0.0)#quithuawei(config-ospf-1)#quit

Step 4 Enable BFD in the L3 interface mode.huawei(config)#interface vlanif 30huawei(config-if-vlanif30)#ospf bfd enablehuawei(config-if-vlanif30)#ospf bfd min-rx-interval 10 min-tx-interval 10 detect-multiplier 3huawei(config-if-vlanif30)#ospf cost 30huawei(config-if-vlanif30)#quithuawei(config)#interface vlanif 40huawei(config-if-vlanif40)#ospf bfd enablehuawei(config-if-vlanif40)#ospf bfd min-rx-interval 10 min-tx-interval 10 detect-multiplier 3huawei(config-if-vlanif30)#ospf cost 40huawei(config-if-vlanif40)#quit


----End

ResultAfter establishing the neighbor relation with each router through OSPF, the MA5600Tautomatically creates two BFD sessions. When the active link is faulty, its bound BFD sessionis down, which triggers the OSPF neighbor relation to be down. Thus, the route is switched tothe standby link.

3.3 Configuring the RouteThis topic describes the routing policy supported by the MA5600T and how to configure therouting protocol.

3.3.1 Configuration Example of the Routing PolicyThis topic provides an example for configuring a routing policy for imported routes.

3.3.2 Configuration Example of the Static RouteThis topic describes how to manually add the static route to implement the interconnectionbetween MA5600T.

3.3.3 Configuration Example of RIPThis topic provides an example for configuring RIP on the MA5600T.

3.3.4 Configuration Example of OSPFThis topic provides an example for configuring OSPF on the MA5600T.

3.3.5 Configuration Example of IS-ISThis operation enables the corresponding device configured data to run the IS-IS protocol onthe MA5600T.

3.3.6 Configuration Example of BGP




Issue 03 (2010-01-28)

This topic provides an example for configuring the BGP on the MA5600T.

3.3.1 Configuration Example of the Routing PolicyThis topic provides an example for configuring a routing policy for imported routes.

Service Requirementsl Consider two MA5600Ts with routing function enabled, namely MA5600T_A and

MA5600T_B. Both of them are running the OSPF routing protocol, and within area 0.l MA5600T_A imports static routes, and MA5600T_B is configured with the routing

filtering policy.

Figure 3-5 Example network for configuring the routing policy

Procedure

Step 1 Configuring MA5600T_A.1. Configure the IP address of the L3 interface on MA5600T_A.

huawei(config)#vlan 2 smarthuawei(config)#port vlan 2 0/7 0huawei(config)#interface vlanif 2huawei(config-if-vlanif2)#ip address 10.0.0.1 24huawei(config-if-vlanif2)#quit

2. Enable OSPF on MA5600T_A and specify the area ID to which the interface belongs.huawei(config)#ospfhuawei(config-ospf-1)#area 0huawei(config-ospf-1-area-0.0.0.0)#network 10.0.0.0 0.0.0.255huawei(config-ospf-1-area-0.0.0.0)#quithuawei(config-ospf-1)#quit

3. Configure the OSPF router ID on MA5600T_A.huawei(config)#router id 1.1.1.1

4. Configure three static routes.huawei(config)#ip route-static 20.0.0.1 32 vlanif 2 10.0.0.1huawei(config)#ip route-static 30.0.0.1 32 vlanif 2 10.0.0.1huawei(config)#ip route-static 40.0.0.1 32 vlanif 2 10.0.0.1

5. Import static routes into the OSPF routing table to improve its capability of obtaining routes.huawei(config)#ospfhawei(config-ospf-1)#import-route statichawei(config-ospf-1)#quit



3-11


Step 2 Configuring MA5600T_B.1. Configure the IP address of the L3 interface on MA5600T_B.


2. Configure the ACL.huawei(config)#acl 2000huawei(config-acl-basic-2000)#rule deny source 30.0.0.0 255.255.255.0huawei(config-acl-basic-2000)#rule permit source anyhuawei(config-acl-basic-2000)#quit

3. Enable OSPF on MA5600T_B and specify the area id to which the interface belongs.huawei(config)#ospf huawei(config-ospf-1)#area 0huawei(config-ospf-1-area-0.0.0.0)#network 10.0.0.0 0.0.0.255huawei(config-ospf-1-area-0.0.0.0)#quithuawei(config-ospf-1)#quit

4. Configure the OSPF router ID of MA5600T_B.huawei(config)#router id 2.2.2.2

5. Filter imported routes.huawei(config)#ospfuawei(config-ospf-1)#filter-policy 2000 importhuawei(config-ospf-1)#quit


----End

Result1. MA5600T_A and MA5600T_B run OSPF successfully, and they can communicate well

with each other.2. After a filter is configured on MA5600T_B, parts of the three imported static routes are

available while part of them is screened on MA5600T_B. That is, routes from segments20.0.0.0 and 40.0.0.0 are available, while the route from segment 30.0.0.0 is screened.

Configuration FileConfiguration on MA5600T_A.

vlan 2 smartport vlan 2 0/7 0interface vlanif 2ip address 10.0.0.1 24quitospfarea 0network 10.0.0.0 0.0.0.255quitquitrouter id 1.1.1.1ip route-static 20.0.0.1 32 vlanif 2 10.0.0.1ip route-static 30.0.0.1 32 vlanif 2 10.0.0.1ip route-static 40.0.0.1 32 vlanif 2 10.0.0.1ospf




Issue 03 (2010-01-28)

import-route staticquitsave

Configuration on MA5600T_B.

vlan 2 smartport vlan 2 0/7 0interface vlanif 2ip address 10.0.0.1 24acl 2000rule deny source 30.0.0.0 255.255.255.0rule permit source anyquitospfarea 0network 10.0.0.0 0.0.0.255quitquitrouter id 2.2.2.2ospffilter-policy 2000 importquitsave

3.3.2 Configuration Example of the Static RouteThis topic describes how to manually add the static route to implement the interconnectionbetween MA5600T.

Service Requirements

In this example network, MA5600T_A, MA5600T_B, and MA5600T_C have the routingfunction. It is expected that after the configuration, any two PCs can communicate with eachother.

Figure 3-6 Example network for configuring the static route



3-13

PrerequisiteConfigure a native VLAN of the L3 interface of each MA5600T to ensure a normalcommunication among MA5600T devices.

Procedure

Step 1 Configure the IP address of the L3 interface.

The configurations for the three MA5600T devices are the same. Here, the configuration of theMA5600T is considered as an example.

huawei(config)#vlan 2 smarthuawei(config)#port vlan 2 0/19 0huawei(config)#interface vlanif 2huawei(config-if-vlanif2)#ip address 1.1.1.2 24huawei(config-if-vlanif2)#ip address 1.1.2.1 24 subhuawei(config-if-vlanif2)#quit

Step 2 Configure static routes.1. Configure static route for MA5600T_A.

huawei(config)#ip route-static 1.1.5.0 255.255.255.0 1.1.2.2huawei(config)#ip route-static 1.1.4.0 255.255.255.0 1.1.2.2

2. Configure static route for MA5600T_B.huawei(config)#ip route-static 1.1.5.0 255.255.255.0 1.1.3.1huawei(config)#ip route-static 1.1.1.0 255.255.255.0 1.1.3.1

3. Configure static routes for MA5600T_C.huawei(config)#ip route-static 1.1.1.0 255.255.255.0 1.1.2.1huawei(config)#ip route-static 1.1.4.0 255.255.255.0 1.1.3.2

Step 3 Configure the host gateways.1. Configure the default gateway of Host A to 1.1.1.2.2. Configure the default gateway of Host B to 1.1.4.2.3. Configure the default gateway of Host C to 1.1.5.2.

Step 4 Save the data.huawei#save

----End

ResultAfter the configuration, an interconnection can be set up between all the hosts and between allthe MA5600T devices.

Configuration FileConfiguration example of MA5600T_A.

vlan 2 smartport vlan 2 0/19 0interface vlanif 2ip address 1.1.1.2 24ip address 1.1.2.1 24 subquitip route-static 1.1.5.0 255.255.255.0 1.1.2.2ip route-static 1.1.4.0 255.255.255.0 1.1.2.2




Issue 03 (2010-01-28)

3.3.3 Configuration Example of RIPThis topic provides an example for configuring RIP on the MA5600T.

Service Requirementsl MA5600T_A is subtended with MA5600T_B through port 0/19/1, and uses port 0/19/0 to

transmit services in the upstream. Besides, it connects to the management center networkthrough the WAN.

l RIP is enabled on MA5600T_A and MA5600T_B so that the administrator can accessMA5600T_A and MA5600T_B through the RIP route. Then, you can operate and maintainMA5600T_A and MA5600T_B.

Figure 3-7 Example network for configuring RIP

Data Plan

Table 3-4 provides the data plan for configuring RIP.

Table 3-4 Data plan for configuring RIP

Item Data

MA5600T_A Upstream port: 0/19/0Administration VLAN: smart VLAN 100IP address of the L3 interface in the administration VLAN:192.13.24.5/22Loopback interface address: 192.13.2.1/24

RIP version: V2RIP route filtering policy: filtering routes based on the IP address prefixlist "abc". Only the routes with the IP addresses 192.13.2.1 and192.13.2.2 can be advertised through the L3 interface of VLAN 100.



3-15

Item Data

Subtending port: 0/19/1Subtending administration VLAN: smart VLAN 10IP address of the L3 interface in the subtending administration VLAN:192.15.24.1/26

MA5600T_B Subtending port: 0/19/0Administration VLAN: smart VLAN 10IP address of the L3 interface in the administration VLAN:192.15.24.2/26Loopback interface address: 192.13.2.2/24

RIP version: V2RIP route filtering policy: filtering routes based on the IP address prefixlist "abc". Only the route with the IP address 192.13.2.2 can beadvertised through the L3 interface of VLAN 10.

Procedurel Configure MA5600T_A.

1. Configure the RIP-supported L3 interface.huawei(config)#vlan 100 smarthuawei(config)#port vlan 100 0/9 0huawei(config)#interface vlanif 100huawei(config-if-vlanif100)#ip address 192.13.24.5 22huawei(config-if-vlanif100)#quithuawei(config)#interface loopBack 0huawei(config-if-loopback0)#ip address 192.13.2.1 24huawei(config-if-loopback0)#quit

2. Enable RIP.huawei(config)#rip 1huawei(config-rip-1)#network 192.13.24.0huawei(config-rip-1)#network 192.13.2.0huawei(config-rip-1)#version 2huawei(config-rip-1)#quit

3. Configure the route filtering policy.huawei(config)#ip ip-prefix abc permit 192.13.2.1 32huawei(config)#ip ip-prefix abc permit 192.13.2.2 32huawei(config)#rip 1huawei(config-rip-1)#filter-policy ip-prefix abc export vlanif 100huawei(config-rip-1)#quit

4. Configure the subtending port.huawei(config)#vlan 10 smarthuawei(config)#port vlan 10 0/9 1huawei(config)#interface vlanif 10 huawei(config-if-vlanif10)#ip address 192.15.24.1 26huawei(config-if-vlanif10)#quit

5. Enable RIP on the subtending port.huawei(config)#rip 1huawei(config-rip-1)#network 192.15.24.0huawei(config-rip-1)#quit

6. Save the data.




Issue 03 (2010-01-28)

huawei(config)#savel Configure MA5600T_B.

1. Configure the RIP-supported L3 interface.huawei(config)#vlan 10 smarthuawei(config)#port vlan 10 0/19 0huawei(config)#interface vlanif 10huawei(config-if-vlanif10)#ip address 192.15.24.2 26huawei(config-if-vlanif10)#quithuawei(config)#interface loopBack 0huawei(config-if-loopback0)#ip address 192.13.2.2 24huawei(config-if-loopback0)#quit

2. Enable RIP.huawei(config)#rip 1huawei(config-rip-1)#network 192.15.24.0huawei(config-rip-1)#network 192.13.2.0huawei(config-rip-1)#version 2huawei(config-rip-1)#quit

3. Configure the route filtering policy.huawei(config)#ip ip-prefix abc permit 192.13.2.2 32huawei(config)#rip 1huawei(config-rip-1)#filter-policy ip-prefix abc export vlanif 10huawei(config-rip-1)#quit


----End

ResultThe maintenance terminal of the administration center can access MA5600T_A andMA5600T_B, and operate and maintain the two devices.

Configuration FileConfiguration on MA5600T_A

vlan 100 smartport vlan 100 0/19 0interface vlanif 100ip address 192.13.24.5 22quitinterface loopBack 0ip address 192.13.2.1 24quitrip 1network 192.13.24.0network 192.13.2.0version 2quitip ip-prefix abc permit 192.13.2.1 32ip ip-prefix abc permit 192.13.2.2 32rip 1filter-policy ip-prefix abc export vlanif 100quitvlan 10 smartinterface vlanif 10ip address 192.15.24.1 26quitrip 1network 192.15.24.0quitsave



3-17

Configuration on MA5600T_B

vlan 10 smartport vlan 10 0/19 0interface vlanif 10ip address 192.15.24.2 26quitinterface loopBack 0ip address 192.13.2.2 24quitrip 1network 192.15.24.0network 192.13.2.0version 2quitip ip-prefix abc permit 192.13.2.2 32rip 1filter-policy ip-prefix abc export vlanif 10quitsave

3.3.4 Configuration Example of OSPFThis topic provides an example for configuring OSPF on the MA5600T.

Service Requirementsl OSPF is enabled on the four MA5600Ts.

l MA5600T_A is configured with the highest designated router (DR) priority,MA5600T_C is configured with the second highest DR priority, and MA5600T_A realizesthe broadcast of network link status for the DR.

Figure 3-8 Example network for configuring OSPF

Data PlanTable 3-5 provides the data plan for configuring OSPF.




Issue 03 (2010-01-28)

Table 3-5 Data plan for configuring OSPF

Item Data Remarks

MA5600T_A IP address of the L3 interface:192.1.1.1/24

-

Priority: 100 -

VLAN ID: 2 -

Router ID: 1.1.1.1 -

MA5600T_B IP address of the L3 interface:192.1.1.2/24

-

Priority: 80 -

VLAN ID: 2 -


MA5600T_C IP address of the L3 interface:192.1.1.3/24

-

Priority: 90 -

VLAN ID: 2 -


MA5600T_D IP address of the L3 interface:192.1.1.4/24

-

Priority: not configured Default: 1

VLAN ID: 2 -


Background Informationl The native VLAN of each interface of the MA5600T must be configured to ensure a normal

communication.l The OSPF area IDs of the MA5600T devices must be consistent.

Procedure

Step 1 Configure MA5600T_A.1. Configure the IP address of the L3 interface.


2. Configure the OSPF Router ID.



3-19

huawei(config)#router id 1.1.1.1

3. Enable OSPF.huawei(config)#ospfhuawei(config-ospf-1)#area 0huawei(config-ospf-1-area-0.0.0.0)#network 192.1.1.0 0.0.0.255huawei(config-ospf-1-area-0.0.0.0)#network 1.1.1.1 0.0.0.0huawei(config-ospf-1-area-0.0.0.0)#quithuawei(config-ospf-1)#quit

4. Configure the OSPF priority.huawei(config)#interface vlanif 2huawei(config-if-vlanif2)#ospf dr-priority 100huawei(config-if-vlanif2)#quit


Step 2 Configure MA5600T_B.

1. Configure the IP address of the L3 interface.huawei(config)#vlan 2 muxhuawei(config)#port vlan 2 0/19 0huawei(config)#interface vlanif 2huawei(config-if-vlanif2)#ip address 192.1.1.2 24huawei(config-if-vlanif2)#quit

2. Configure the OSPF Router ID.huawei(config)#router id 2.2.2.2


4. Configure the OSPF priority.huawei(config)#interface vlanif 2huawei(config-if-vlanif2)#ospf dr-priority 80huawei(config-if-vlanif2)#quit


Step 3 Configure MA5600T_C.




4. Configure the OSPF priority.




Issue 03 (2010-01-28)

huawei(config)#interface vlanif 2huawei(config-if-vlanif2)#ospf dr-priority 90huawei(config-if-vlanif2)#quit


Step 4 Configure MA5600T_D.





----End

Result

Run the display ip routing-table command and you can find the learnt route table. Hosts cancommunicate with each other.

Configuration File

Configuration on each MA5600T is similar. Take MA5600T_A for example.

vlan 2 smartport vlan 2 0/19 0interface vlanif 2ip address 192.1.1.1 24quitrouter id 1.1.1.1ospfarea 0network 192.1.1.0 0.0.0.255network 1.1.1.1 0.0.0.0quitquitinterface vlanif 2ospf dr-priority 100quitsave

3.3.5 Configuration Example of IS-ISThis operation enables the corresponding device configured data to run the IS-IS protocol onthe MA5600T.



3-21

Service Requirementsl The MA5600T forwards the access VoIP service through the L3 interface to the NGN

network.l The MA5600T obtains the routes of the NGN networking through the IS-IS protocol. The

area ID of the Level-2 router differs from the area ID of the Level-1-2 router to which theLevel-2 router connects.

Figure 3-9 Example network for configuring IS-IS

Data PlanTable 3-6 provides the data plan for configuring IS-IS.

Table 3-6 Data plan for configuring IS-IS

Item Data

MA5600T IS-IS process ID: 1

NET (Network entity title): 10.0000.0000.0001.00, where:l Area ID: 10

l System ID: 0000.0000.0001

l Level: Level-1

l Host name: MA5600T

IS-IS interface:l Port number: 0/19/0

l VLAN ID: 20

l IP address: 192.15.24.5/16

Router1 IS-IS process ID: 1




Issue 03 (2010-01-28)

Item Data


l System ID: 0000.0000.0002

l Level: Level-1

l Host name: Router1

IS-IS interface: 1/0/0IP address: 192.15.20.8/16

Router2 IS-IS process ID: 1


l System ID: 0000.0000.0005

l Level: Level-1-2

l Host name: Router2

IS-IS interface: 1/0/0IP address: 192.15.18.5/16

Procedurel Configure IS-IS on the MA5600T.

1. Configure the L3 interface.huawei(config)#vlan 20 standardhuawei(config)#port vlan 20 0/19 0huawei(config)#interface vlanif 20huawei(config-if-vlanif20)#ip address 192.15.24.5 16 huawei(config-if-vlanif20)#quit

2. Start the IS-IS process.huawei(config)#isis 1huawei(config-isis-1)#

3. Configure the NET.huawei(config-isis-1)#network-entity 10.0000.0000.0001.00

4. Configure the router level.huawei(config-isis-1)#is-level level-1

5. Configure the local host name.huawei(config-isis-1)#is-name MA5600Thuawei(config-isis-1)#quit

6. Enable the IS-IS function on an interface.huawei(config)#interface vlanif 20huawei(config-if-vlanif20)#isis enable 1

l Configure IS-IS on Router1.

The process of configuring IS-IS on Router1 is similar to that of configuring IS-IS on theMA5600T. The details are not provided in this chapter.



3-23

l Configure IS-IS on Router2.

The process of configuring IS-IS on Router2 is similar to that of configuring IS-IS on theMA5600T. The details are not provided in this chapter.

----End

Resultl Run the display isis lsdb command and you can query the IS-IS LSDB.l Run the display isis route command and you can query the IS-IS route. The routing table

of the Level-1 router should have a default route, and the next hop should be the Level-1-2router. The Level-2 router should have the routes to all the Level-1 routers and the Level-2routers.

Configuration Filevlan 20 standardport vlan 20 0/19 0interface vlanif 20ip address 192.15.24.5 16 quitisis 1network-entity 10.0000.0000.0001.00is-level level-1is-name MA5600Tquitinterface vlanif 20isis enable 1

3.3.6 Configuration Example of BGPThis topic provides an example for configuring the BGP on the MA5600T.

Service RequirementsIn this example network, an EBGP connection is set up between MA5600T_A andMA5600T_B, and an IBGP connection is set up among MA5600T_B, MA5600T_C, andMA5600T_D.

Figure 3-10 Example network for configuring the BGP




Issue 03 (2010-01-28)

Data PlanTable 3-7 provides the data plan for configuring the BGP.

Table 3-7 Data plan for configuring the BGP

Item Data Remarks

MA5600T_A IP address of VLAN interface 6:200.1.1.2/24

It is used for the EBGPconnection toAS2001.

IP address of VLAN interface 2:8.1.1.1/8

-


AS number: 2000 -

MA5600T_B IP address of VLAN interface 6:200.1.1.1/24

It is used for the EBGPconnection toAS2000.


It is used for the IBGPconnection to theMA5600T_C.


It is used for the IBGPconnection to theMA5600T_D.


AS number: 2001 -

MA5600T_C IP address of VLAN interface 3:9.1.3.2/24

It is used for the IBGPconnection to theMA5600T_B.


It is used for the IBGPconnection to theMA5600T_D.


AS number: 2001 -

MA5600T_D IP address of VLAN interface 5:9.1.2.2/24

It is used for the IBGPconnection to theMA5600T_C.


It is used for the IBGPconnection to theMA5600T_B.



3-25

Item Data Remarks


AS number: 2001 -

Procedure

Step 1 Configure MA5600T_A.

1. Configure the IP address of the L3 interface.

huawei(config)#vlan 6 smarthuawei(config)#port vlan 6 0/19 0huawei(config)#interface vlanif 6huawei(config-if-vlanif6)#ip address 200.1.1.2 24huawei(config-if-vlanif6)#quithuawei(config)#vlan 2 smarthuawei(config)#port vlan 2 0/19 0huawei(config)#interface vlanif 2huawei(config-if-vlanif2)#ip address 8.1.1.1 8huawei(config-if-vlanif2)#quit

2. Enable the BGP function.huawei(config)#bgp 2000huawei(config-BGP)#router-id 1.1.1.1huawei(config-BGP)#peer 200.1.1.1 as-number 2001huawei(config-BGP)#network 8.0.0.0 8huawei(config-BGP)#quit


Step 2 Configure MA5600T_B.

1. Configure the IP address of the L3 interface.huawei(config)#vlan 6 smarthuawei(config)#port vlan 6 0/19 0huawei(config)#interface vlanif 6huawei(config-if-vlanif6)#ip address 200.1.1.1 24huawei(config-if-vlanif6)#quithuawei(config)#vlan 3 smarthuawei(config)#port vlan 3 0/19 0huawei(config)#interface vlanif 3huawei(config-if-vlanif3)#ip address 9.1.3.1 24huawei(config-if-vlanif3)#quithuawei(config)#vlan 4 smarthuawei(config)#port vlan 4 0/19 0huawei(config)#interface vlanif 4huawei(config-if-vlanif4)#ip address 9.1.1.1 24huawei(config-if-vlanif4)#quit

2. Enable the BGP function.huawei(config)#bgp 2001huawei(config-BGP)#router-id 2.2.2.2huawei(config-BGP)#peer 200.1.1.2 as-number 2000huawei(config-BGP)#peer 9.1.3.2 as-number 2001huawei(config-BGP)#peer 9.1.1.2 as-number 2001huawei(config-BGP)#import-route directhuawei(config-BGP)#quit





Issue 03 (2010-01-28)

Step 3 Configure MA5600T_C.

1. Configure the IP address of the L3 interface.huawei(config)#vlan 3 smarthuawei(config)#port vlan 3 0/19 0huawei(config)#interface vlanif 3huawei(config-if-vlanif3)#ip address 9.1.3.2 24huawei(config-if-vlanif3)#quithuawei(config)#vlan 5 smarthuawei(config)#port vlan 5 0/19 0huawei(config)#interface vlanif 5huawei(config-if-vlanif5)#ip address 9.1.2.1 24huawei(config-if-vlanif5)#quit

2. Enable the BGP function.huawei(config)#bgp 2001 huawei(config-BGP)#router-id 3.3.3.3huawei(config-BGP)#peer 9.1.3.1 as-number 2001huawei(config-BGP)#peer 9.1.2.2 as-number 2001huawei(config-BGP)#quit


Step 4 Configure MA5600T_D.

1. Configure the IP address of the L3 interface.huawei(config)#vlan 4 smarthuawei(config)#port vlan 4 0/19 0huawei(config)#interface vlanif 4huawei(config-if-vlanif4)#ip address 9.1.1.2 24huawei(config-if-vlanif4)#quithuawei(config)#vlan 5 smarthuawei(config)#port vlan 5 0/19 0huawei(config)#interface vlanif 5huawei(config-if-vlanif5)#ip address 9.1.2.2 24huawei(config-if-vlanif5)#quit

2. Enable the BGP function.huawei(config)#bgp 2001huawei(config-BGP)#router-id 4.4.4.4huawei(config-BGP)#peer 9.1.2.1 as-number 2001huawei(config-BGP)#peer 9.1.1.1 as-number 2001huawei(config-BGP)#quit


----End

Result

l Run the display bgp peer command, and you can see that:

– The EBGP connection is set up between MA5600T_A and MA5600T_B.

– The IBGP connections are set up among MA5600T_B, MA5600T_C, andMA5600T_D.

– The route with the destination subnet 8.0.0.0/8 exists on MA5600T_C andMA5600T_D, and the next hop of the route is the interface address of MA5600T_A

l Run the ping command on MA5600T_C and MA5600T_D to ping the Layer 3 interface(8.1.1.1/24) on MA5600T_A. The ping command is executed successfully.



3-27

Configuration FileConfiguration on each MA5600T is similar. Take MA5600T_A for example.

vlan 6 smartport vlan 6 0/19 0interface vlanif 6ip address 200.1.1.2 24quitvlan 2 smartport vlan 2 0/19 0interface vlanif 2ip address 8.1.1.1 8quitbgp 2000router-id 1.1.1.1peer 200.1.1.1 as-number 2001network 8.0.0.0 8quit

3.4 Configuration Example of a VRF InstanceThis topic describes how to categorize VRF instances by VLANs, and realize the virtual staticroute forwarding in different VRF instances.

Background Informationl VRF is an L3 virtual private network (L3VPN). VRF is a mechanism in which a device

works as multiple virtual routing devices. After the L3 interfaces of the device are dividedinto different VRFs, multiple route forwarding instances can be emulated on the device.

l Multiple virtual routing devices can be created on the MA5600T. That is, multiple L3VPNscan be established to implement the L3 isolation and independent packet forwarding amongdifferent VRFs. MA5600T supports the following VRF functions:– In different VRF instances, the IP address can be reused. It means that the IP addresses

of the L3 interfaces which belong to different VRF instances can be the same.– The ping and trace route functions are supported in a VRF.

– The users of different VRF instances can obtain the IP addresses through the DHCPrelay or the DHCP proxy.

– The static routes and the dynamic routes in a VRF instance do not affect each other, andthe routing entry in each VRF instance supports the routing function independently.

NetworkingFigure 3-11 shows an example network for configuring the VRF instance.

The MA5600T categorizes VRF instances by VLANs to provide L3VPN solutions. In thisexample, VRF instance VRF1 is categorized by VLAN 200, and static routes are added in thevirtual route forwarding entries of VRF1. The MA5600T selects the routes for the users of VPN1by querying the routing entries of VRF1. Similarly, VRF instance VRF2 is categorized by VLAN300 and is used to select the routes for the users of VPN2. The MA5600T realizes the L3 isolationand independent packet forwarding through different VRF instances.

This example describes how to configure the function of virtual static route forwarding by addingstatic routes application on the instance. The function of virtual dynamic route forwarding canbe realized by enabling the process of the dynamic routing protocols such as the OSPF, RIP, IS-IS, and BGP in a VRF instance.




Issue 03 (2010-01-28)

Figure 3-11 Example network for configuring the VRF instance

Data PlanTable 3-8 provides the data plan for configuring a VRF instance.

Table 3-8 Data plan for configuring a VRF instance

Item Data

VRF1 (for VPN1) Name of the VPN instance: vpn1Route distinguisher (RD) of the VPN instance: 100:1

Upstream port: 0/19/0VLAN: 200VLAN type: smart VLANVPN1 user:l GPON port: 0/2/0

l ONT ID: 0

l GEM Port ID: 0

IP address of the L3 interface of VLAN 200: 10.10.10.1/24IP address of router1: 10.10.10.2/24IP address of the VPN1 server: 10.10.20.1/24

VRF2 (for VPN2) Name of the VPN instance: vpn2RD of the VPN instance: 100:2



3-29

Item Data

Upstream port: 0/19/0VLAN: 300VLAN type: smart VLANVPN1 user:l GPON port: 0/2/1

l ONT ID: 1

l GEM Port ID: 1

IP address of the L3 interface of VLAN 300: 10.10.10.1/24IP address of router2: 10.10.10.3/24IP address of the VPN2 server: 10.10.30.1/24

Procedurel Configure VRF1 (for VPN1).

1. Create a VPN instance.huawei(config)#ip vpn-instance vpn1

2. Configure the RD of the VPN instance.huawei(config-vpn-instance-vpn1)#route-distinguisher 100:1

3. Create a smart VLAN and add the upstream port and the service port to it.huawei(config-vpn-instance-vpn1)#quithuawei(config)#vlan 200 smarthuawei(config)#port vlan 200 0/19 0huawei(config)#service-port vlan 200 gpon 0/2/0 ont 0 gemport 0 multi-service user-8021p 0 user-vlan 200 rx-cttr 6 tx-cttr 6

4. Associate the L3 interface with the VPN instance.huawei(config)#interface vlanif 200huawei(config-if-vlanif200)#ip binding vpn-instance vpn1 All IPv4 related configurations on this interface are removed!

5. Configure the IP address of the VLAN L3 interface.huawei(config-if-vlanif200)#ip address 10.10.10.1 24

6. Configure the static route.huawei(config-if-vlanif200)#quithuawei(config)#ip route-static vpn-instance vpn1 10.10.20.0 24 10.10.10.2


l Configure VRF2 (for VPN2).1. Create a VPN instance.

huawei(config)#ip vpn-instance vpn2 2. Configure the RD of the VPN instance.

huawei(config-vpn-instance-vpn2)#route-distinguisher 100:23. Create a smart VLAN and add the upstream port and the service port to it.

huawei(config-vpn-instance-vpn2)#quithuawei(config)#vlan 300 smarthuawei(config)#port vlan 300 0/19 0




Issue 03 (2010-01-28)

huawei(config)#service-port vlan 300 gpon 0/2/1 ont 1 gemport 1 multi-service user-8021p 0 user-vlan 300 rx-cttr 6 tx-cttr 6

4. Associate the L3 interface with the VPN instance.huawei(config)#interface vlanif 300huawei(config-if-vlanif300)#ip binding vpn-instance vpn2 All IPv4 related configurations on this interface are removed!

5. Configure the IP address of the VLAN L3 interface.huawei(config-if-vlanif300)#ip address 10.10.10.1 24

6. Configure the static route.huawei(config-if-vlanif300)#quithuawei(config)#ip route-static vpn-instance vpn2 10.10.30.0 24 10.10.10.3


----End

ResultRun the following commands and find that the VRF instances are configured successfully.

huawei(config)#display ip routing-table vpn-instance vpn1 { <cr>|verbose<K>|statistics<K>|protocol<K>|acl<K>|ip-prefix<K>|ip_addr<X.X.X.X> }: Command: display ip routing-table vpn-instance vpn1 Routing Tables: vpn1 Destinations : 3 Routes : 3 Destination/Mask Proto Pre Cost NextHop Interface 10.10.10.0/24 Direct 0 0 10.10.10.1 vlanif200 10.10.10.1/32 Direct 0 0 127.0.0.1 InLoopBack0 10.10.20.0/24 Static 60 0 10.10.10.2 vlanif200 huawei(config)#display ip routing-table vpn-instance vpn2 { <cr>|verbose<K>|statistics<K>|protocol<K>|acl<K>|ip-prefix<K>|ip_addr<X.X.X.X> }: Command: display ip routing-table vpn-instance vpn2 Routing Tables: vpn2 Destinations : 3 Routes : 3 Destination/Mask Proto Pre Cost NextHop Interface 10.10.10.0/24 Direct 0 0 10.10.10.1 vlanif300 10.10.10.1/32 Direct 0 0 127.0.0.1 InLoopBack0 10.10.30.0/24 Static 60 0 10.10.10.3 vlanif300

The MA5600T categorizes VRF instances by VLANs to provide L3VPN solutions, realizingthe L3 isolation of users or services.l For the users of VPN1, the MA5600T selects the routes by querying the routing entries of

VPN1. For example, for the packets to be sent to the VPN1 server (with IP address10.10.20.1), the MA5600T selects its next hop router (with IP address 10.10.10.2) toforward the packets.

l For the users of VPN2, the MA5600T selects the routes by querying the routing entries ofVPN2. For example, for the packets to be sent to the VPN2 server (with IP address10.10.30.1), the MA5600T selects its next hop router (with IP address 10.10.10.3) toforward the packets.



3-31

l For the users outside the VPNs, the route to the VPN1 server or the VPN2 server is notavailable.

3.5 Configuring the MSTPThe MA5600T supports the application of the Multiple Spanning Tree Protocol (MSTP),Spanning Tree Protocol (STP), and Rapid Spanning Tree Protocol (RSTP). The MA5600Tsupports the MSTP ring network, which can meet various networking requirements.

Background Informationl MSTP applies to a redundant network. It makes up for the drawback of STP and RSTP.

MSTP makes the network converge fast and the traffic of different VLANs distributedalong their respective paths, which provides a better load-sharing mechanism.

l MSTP trims a loop network into a loop-free tree network. It prevents the proliferation andinfinite cycling of the packets in the loop network. In addition, MSTP supports load sharingby VLAN during data transmission.

Procedure

Step 1 Enabling the MSTP function.l By default, the MSTP function is disabled.

l After the MSTP function is enabled, the device determines whether it works in STPcompatible mode or MSTP mode based on the configured protocol.

l After the MSTP function is enabled, MSTP maintains dynamically the spanning tree of theVLAN based on the received BPDU packets. After the MSTP function is disabled, theMA5600T becomes a transparent bridge and does not maintain the spanning tree.

1. Run the stp enable command to enable the MSTP function of the bridge.2. Run the stp port enable command to enable the MSTP function of the port.3. Run the display stp command or the display stp port command to query the MPLS state

of the bridge or the port.

Step 2 Configuring the MST region name.1. Run the stp region-configuration command to enter MST region mode.2. Run the region-name command to configure the name of the MST region.

By default, the MST region name is the bridge MAC address of the device.

Step 3 Configuring the MSTP instance.

The MSTP protocol configures the VLAN mapping table (mapping between the VLAN and thespanning tree), which maps the VLAN to the spanning tree.

1. Run the stp region-configuration command to switch over to MST region mode.2. Run the instance vlan command to map the specified VLAN to the specified MSTP

instance.l By default, all VLANs are mapped to CIST, that is, instance 0.

l One VLAN can be mapped to only one instance. If you re-map a VLAN to anotherinstance, the original mapping is disabled.

l A maximum of 10 VLAN sections can be configured for an MSTP instance.




Issue 03 (2010-01-28)

NOTE

A VLAN section refers to the consecutive VLAN IDs from the start VLAN ID to the end VLAN ID.

3. Run the check region-configuration command to query the parameters of the current MSTregion.

Step 4 Activating the configuration of the MST region.1. Run the stp region-configuration command to switch over to MST region mode.2. Run the active region-configuration command to activate the configuration of the MST

region.3. Run the display stp region-configuration command to query the effective configuration

of the MST region.

Step 5 Setting the priority of the device in the specified spanning tree instance.1. Run the stp priority command to set the priority of the device in the specified spanning

tree instance.2. Run the display stp command to query the MSTP configuration of the device.

Step 6 Other optional configurations.l Setting the MST region parameters.

– Run the stp md5-key command to set the MD5-Key for the MD5 encryption algorithmconfigured on the MST region.

– In the MSTP region mode, run the vlan-mapping module command to map all VLANsto the MSTP instances by modular arithmetic.

– In the MSTP region mode, run the revision-level command to set the MSTP revisionlevel of the device.

– Run the reset stp region-configuration command to restore the default settings to allparameters of the MST region.

l Specifying the device as a root bridge or a backup root bridge.– Run the stp root command to specify the device as a root bridge or a backup root bridge.

l Setting the time parameters of the specified network bridge.– Run the stp timer forward-delay command to set the Forward Delay of the specified

network bridge.– Run the stp timer hello command to set the Hello Time of the specified network bridge.

– Run the stp timer max-age command to set the Max Age of the specified network bridge.

– Run the stp time-factor command to set the timeout time factor of the specified networkbridge.

l Setting the parameters of the specified port.– Run the stp port transmit-limit command to set the number of packets transmitted by

the port within the Hello Time.– Run the stp port edged-port enable command to set the port as an edge port.

– Run the stp port cost command to set the path cost of a specified port.

– Run the stp port port-priority command to set the priority of the specified port.

– Run the stp port point-to-point command to set whether the link that is connected to theport is a point-to-point link.

l Configuring the device protection function.



3-33

– Run the stp bpdu-protection enable command to enable the BPDU protection functionof the device.

– Run the stp port loop-protection enable command to enable the loop protection functionof the port.

– Run the stp port root-protection enable command to enable the root protection functionof the port.

l Setting the maximum number of hops of the MST region.– Run the stp max-hops command to set the maximum number of hops of the MST region.

l Setting the diameter of the switching fabric.– Run the stp bridge-diameter command to set the diameter of the switching fabric.

l Setting the calculation standard for the path cost.– Run the stp pathcost-standard command to set the calculation standard for the path cost.

l Clear the MSTP protocol statistics.– Run the reset stp statistics command to clear the MSTP protocol statistics.

----End

ExampleConfigure the MSTP parameters as follows:

l Enable the MSTP function.

l Enable the MSTP function on port 0/7/0.

l Set the MSTP running mode to MSTP compatible mode.

l Configure MST region parameters:– Configure the MD5-Key for the MD5 encryption algorithm to 0x11ed224466.

– Configure the MST region name to huawei-mstp-bridge.

– Map VLAN2-VLAN10 and VLAN12-VLAN16 to MSTP instance 3.

– Map all the VLANs to the specified MSTP instances.

– Configure the MSTP revision level of the device to 100.

l Configure the maximum hops for the MST region to 10.

l Activate the configuration of the MST region manually.

l Configure the current device as the root bridge of MSTP instance 2.

l Configure the priority of the device in spanning tree instance 2 to 4096.

l Configure the diameter of the switching network to 6.

l Configure the calculation standard for the path cost to IEEE 802.1t.

l Configure the time parameters of a specified bridge:– Configure the forward delay to 2000 centiseconds.

– Configure the hello time to 1000 centiseconds.

– Configure the max age to 3000 centiseconds.

– Configure the timeout time factor to 6.

l Configure the parameters of a specified port:




Issue 03 (2010-01-28)

– Configure the maximum number of packets transmitted in a hello time period to 16.

– Configure port 0/7/0 to be an edge port.

– Configure the path cost of the port in a specified spanning tree instance to 1024.

– Configure the priority of the port to 64.

– The link connected to port 0/7/0 is a point-to-point link.

l Enable the BPDU protection function on the device.huawei(config)#stp enable Change global stp state may active region configuration,it may take severalminutes,are you sure to change global stp state? [Y/N][N]yhuawei(config)#stp port 0/7/0 enablehuawei(config)#stp mode mstphuawei(config)#stp md5-key 11ed224466huawei(config)#stp region-configurationhuawei(stp-region-configuration)#region-name huawei-mstp-bridgehuawei(stp-region-configuration)#instance 3 vlan 2 to 10 12 to 16huawei(stp-region-configuration)#vlan-mapping module 16huawei(stp-region-configuration)#revision-level 100huawei(stp-region-configuration)#active region-configurationhuawei(stp-region-configuration)#quithuawei(config)#stp instance 2 root primaryhuawei(config)#stp instance 2 priority 4096huawei(config)#stp max-hops 10huawei(config)#stp bridge-diameter 6huawei(config)#stp pathcost-standard dot1thuawei(config)#stp timer forward-delay 2000huawei(config)#stp timer hello 1000huawei(config)#stp timer max-age 3000huawei(config)#stp time-factor 6huawei(config)#stp port 0/7/0 transmit-limit 16huawei(config)#stp port 0/7/0 edged-port enablehuawei(config)#stp port 0/7/0 instance 0 cost 1024huawei(config)#stp port 0/7/0 instance 0 port-priority 64huawei(config)#stp port 0/7/0 point-to-point force-truehuawei(config)#stp bpdu-protection enable

3.6 Configuring Ethernet OAMIn a broad sense, operation, administration, and maintenance (OAM) means a set of methodsfor monitoring and diagnosing network faults. The Ethernet OAM feature includes two sub-features: Ethernet CFM OAM and Ethernet EFM OAM.

3.6.1 Configuration Example of Ethernet CFM OAMThis topic describes how to configure the Ethernet CFM OAM on the MA5600T.

3.6.2 Configuration Example of Ethernet EFM OAMThis topic describes how to configure Ethernet EFM OAM on the MA5600T.

3.6.1 Configuration Example of Ethernet CFM OAMThis topic describes how to configure the Ethernet CFM OAM on the MA5600T.

Prerequisite

The router must support Ethernet CFM OAM.



3-35

Service RequirementsThe two devices on the two ends send detection packets periodically to each other to check thelink connectivity.

NetworkingFigure 3-12 shows an example network for configuring Ethernet CFM OAM.

In this example network, the Ethernet CFM OAM mechanism is adopted for the link betweenMA5600T_A and MA5600T_B for detecting link faults. The local MEP and remote MEP areconfigured on both MA5600T_A and MA5600T_B. The ID of the local MEP on MA5600T_Bis the same as the ID of the remote MEP on MA5600T_A, and the ID of the remote MEP onMA5600T_B is the same as the ID of the local MEP on MA5600T_A.

Figure 3-12 Example network for configuring Ethernet CFM OAM

Data PlanTable 3-9 provides the data plan for configuring Ethernet CFM OAM.

Table 3-9 Data plan for configuring Ethernet CFM OAM

Item Data

MA5600T_A Port: 0/19/0Smart VLAN: 100MEP: 2/6/0CC-interval: 10 minutes

MA5600T_B Port: 0/19/1Smart VLAN: 200MEP: 2/6/0CC-interval: 10 minutes

Procedure





Issue 03 (2010-01-28)

The VLAN ID is 100, and the VLAN is a smart VLAN.

huawei(config)#vlan 100 smart

Step 2 Add an upstream port to the VLAN.

Add port 0/19 to VLAN 100.

huawei(config)#port vlan 100 0/19 0

Step 3 (Optional) Set the native VLAN of the port.

This step is to set the packets of the upstream Ethernet port to or not to carry the VLAN tag.Whether the native VLAN needs to be set for the upstream port depends on whether the upper-layer device connected to the upstream port supports packets carrying a VLAN tag. The settingon the MA5600T must be the same as that on the upper-layer device. In this example, and thepackets are of the untagged type.

huawei(config)#interface scu 0/19huawei(config-if-scu-0/9)#native-vlan 0 100huawei(config-if-scu-0/9)#quit

Step 4 Configure an MD.l MDs with the same index or level cannot be created.

l The name format and the name of an MD must be unique.

l The total length of the names of an MD and its MAs cannot be longer than 44 characters.huawei(config)#cfm md 2 name-format string huawei level 3

Step 5 Configure an MA.l The system supports up to 4096 MAs and each MD can be configured with up to 48 MAs.

That is, if an MD is configured with 4096 MAs, the other MDs in the system cannot beconfigured with any MA. An MA of a non-existing MD cannot be created. An existing MAcannot be created again.

l The total length of the names of an MD and its MAs cannot be longer than 44 characters.

l The interval for the MA to transmit CCMs is 10 minute. By default, the interval is 1 minute.huawei(config)#cfm ma 2/6 name-format string cfmhuawei cc-interval 10m

Step 6 Configure an MEP.l MEP refers to the maintenance association end points. Ethernet CFM OAM is used to test

the link connectivity by using the MEPs at the two ends of a maintenance channel.l By default, the MEP management function is enabled, the priority of sending CFM packets

is 7, and the function of sending CC packets is enabled.huawei(config)#cfm mep 2/6/0 direction down port 0/19/0 priority 7

Step 7 Configure an RMEP.

By default, the detection function of the RMEP is disabled.

huawei(config)#cfm remote-mep-detect enable

Step 8 Enable the local CFM globally. By default, the local CFM is disabled globally.huawei(config)#cfm enable

Step 9 Enable the detection function of the remote MEP detection globally. By default, the remote MEPdetection is disabled globally.huawei(config)#cfm remote-mep-detect enable



3-37


NOTE

Configuration on MA5600T_B is the same as that on MA5600T_A and it is not repeated here.

----End

ResultAfter the configuration, run the display cfm statistics mep command on MA5600T_A orMA5600T_B and you can find packet statistics. Of the statistics, neither "CCM Sent Pkt Num"nor "CCM Received Pkt Num" values zero.

Configuration File

vlan 100 smartport vlan 100 0/19 0interface scu 0/19native-vlan 0 100quitcfm md 2 name-format string huawei level 3cfm ma 2/6 name-format string cfmhuawei cc-interval 10mcfm mep 2/6/0 direction down port 0/19 priority 7cfm remote-mep-detect enablecfm enablecfm remote-mep-detect enable save

3.6.2 Configuration Example of Ethernet EFM OAMThis topic describes how to configure Ethernet EFM OAM on the MA5600T.

PrerequisiteThe Ethernet EFM OAM license must be obtained and installed.

Service Requirementsl Ethernet EFM OAM is enabled on both local MA5600T_A and remote MA5600T_B.

l When the remote end is faulty, the local end generates an alarm.

l The local end can be used to locate a fault through the EFM remote end loopback.

Figure 3-13 Example network of Ethernet EFM OAM

Data PlanTable 3-10 provides the data plan for configuring Ethernet EFM OAM.




Issue 03 (2010-01-28)

Table 3-10 Data plan for configuring Ethernet EFM OAM

Item Data

MA5600T_A Port: 0/19/0Ethernet OAM mode: active

MA5600T_B Port: 0/19/1Ethernet OAM mode: passiveLoopback control parameter: process

Procedurel Configure local MA5600T_A.

1. (Optional) Configure the Ethernet OAM mode of the port.Configure Ethernet OAM port 0/19/0 to actively initiate the discovery process and theloopback control packet. The default mode is the active mode.huawei(config)#efm oam mode 0/19/0 active

2. (Optional) Configure the loopback control parameter of the Ethernet OAM port.By default, EFM remote loopback is disabled, and the configuration of the local endis process.huawei(config)#efm loopback 0/19/0 process

3. Enable Ethernet OAM of the port.After Ethernet OAM is enabled, the loopback control parameter and Ethernet OAMmode of the port cannot be modified.huawei(config)#efm oam 0/19/0 enable


5. (Optional) Enable EFM remote loopback.When the remote end is faulty, use the EFM remote loopback function to locate thefault.huawei(config)#efm loopback 0/19/0 start Starting loopback will interrupt all the services on this port. Are you sureto start loopback? (y/n)[n]:y

l Configure remote MA5600T_B.1. Configure the Ethernet OAM mode of the port.

Configure Ethernet OAM port 0/19/1 to work in the passive mode. The default modeis the active mode.huawei(config)#efm oam mode 0/19/1 passive

2. Configure the loopback control parameter of the Ethernet OAM port.The Ethernet OAM loopback control parameter of the remote end must be process. Inthis way, the EFM remote loopback function can be used normally.huawei(config)#efm loopback 0/19/1 process

3. Enable Ethernet OAM of the port.After Ethernet OAM is enabled, the loopback control parameter and Ethernet OAMmode of the port cannot be modified.



3-39

huawei(config)#efm oam 0/19/1 enable4. Save the data.

huawei(config)#save

----End

ResultAfter the configuration is completed, you can run the display efm oam status command onMA5600T_A or MA5600T_B to query the relevant information about the local end or remoteend.

Configuration FileOn local MA5600T_A:

efm oam mode 0/19/0 activeefm loopback 0/19/0 processefm oam 0/19/0 enablesaveefm loopback 0/19/0 starty

On remote MA5600T_B:

efm oam mode 0/19/1 passiveefm loopback 0/19/1 processefm oam 0/19/1 enablesave




Issue 03 (2010-01-28)

4 Configuring the GPON Internet AccessService (Distributed Mode)

About This Chapter

The GPON broadband Internet access service is applicable to the scenario that provides userswith the Internet access service through optical fibers. The networking mode for the service canbe FTTH, FTTB, FTTC, FTTO, or FTTM. This topic describes how to configure the Internetaccess service provided by the MA5600T through GPON.

Application ContextGPON is mainly used in the FTTx solution. The FTTx technology is mainly used for adoptingoptical network in the access network. Its coverage is from the CO device of the regionaltelecommunications room to the subscriber terminal. The optical line terminal (OLT) functionsas the CO device. The optical network unit (ONU) or the optical network terminal (ONT)functions as the subscriber terminal.

l FTTH refers to fiber to the home. In this networking scenario, the MA5600T functions asan OLT and is connected to the ONT at lower layer through the ODN. The ONT is connectedto subscribers to provide the voice, Internet access, and IPTV services.

l FTTB refers to fiber to the building. In this networking scenario, the MA5600T functionsas an OLT and is connected to the MDU or ONUs of other types at lower layer through theODN. The ONU or MDU is connected to subscribers. FTTB can be further classified intoFTTB+DSL and FTTB+LAN. These two modes respectively use the home gateway withan RJ-11 upstream port and the home gateway with a LAN upstream port to provide thevoice, Internet access, and IPTV services.

l FTTC refers to fiber to the curb. FTTC is mainly used to provide services for residentialsubscribers. The ONU is placed in the cabinet at the curb. It uses coaxial cables to transmitCATV signals or uses twisted pairs to transmit the voice and Internet access services. Inthis networking scenario, the MA5600T functions as an OLT and is connected to the MDUor outdoor cabinets for ONUs of other types at lower layer through the ODN. The ONU orMDU is connected to subscribers. FTTC and FTTB are the same in configuration and differfrom each other only in the networking mode.

l FTTO refers to fiber to the office. The Ethernet port of the ONU is connected to the LANof subscribers so that subscribers can be directly connected to the Internet, or connected to

SmartAX MA5600TCommissioning and Configuration Guide

4 Configuring the GPON Internet Access Service(Distributed Mode)


4-1

the headquarters or branch offices through VPN. In this networking scenario, theMA5600T functions as an OLT and is connected to the ONU at lower layer through theODN. The ONU is connected to subscribers to provide the voice, Internet access, IPTV,and private line services.

Prerequisitel Configure the AAA function.

– To enable the AAA function on the device, see 2.13 Configuring AAA.

– If the AAA function is implemented by the BRAS, a connection to the BRAS must beestablished. The BRAS should be capable of identifying the VLAN tag of theMA5600T in the upstream direction. For the identification purpose, the user name andpassword for dial-up Internet access must be configured on the BRAS.

l The GPON ONT profile is already created. Configuring a GPON ONT CapabilityProfile, Configuring a GPON ONT Alarm Profile are already completed.

l The GPON mode is already switched to the distributing-mode.

Data Plan

Before configuring the GPON Internet access service, plan the data items as listed in Table4-1.

Table 4-1 Data plan for the GPON Internet access service

Item Data Remarks

MA5600T Access rate Configure the data according to theuser requirements.

Access port Configure the data according to thenetwork planning.

VLAN planning The cooperation with the upper-layerdevice should be considered in theVLAN planning. The upstream VLANmust be the same as that of the upper-layer device.

QoS policy Configure the data according to theQoS policy of the entire network.Generally, the priority of the Internetaccess service is lower than thepriorities of the voice and videoservices.

T-CONT ID It is recommended that you do not useT-CONT 0 to transmit services.

GEM port index -

ONT Capability set profile The ONT capability set profile must bethe same as the actual capacity set.




Issue 03 (2010-01-28)

Item Data Remarks

ONT index GPON supports a split ratio of up to1:128. You need to plan the ONTsconnected to the MA5600T tofacilitate management.

Authentication mode You can use the passwordauthentication and the serial numberauthentication.

Upper-layer LANswitch

The LAN switch transparentlytransmits the service packets of theMA5600T on L2.The VLAN ID must be the same as theupstream VLAN ID of the MA5600T.

-

BRAS The BRAS performs the relatedconfigurations according to theauthentication and accountingrequirements for dialup users, forexample, configures the access userdomain (including the authenticationscheme, accounting scheme, andauthorization scheme bound to thedomain) and specifies the RADIUSserver.If the BRAS is used to authenticateusers, you need to configure the username and the password for each useron the BRAS. If the BRAS is used toallocate IP addresses, you need toconfigure the corresponding IPaddress pool on the BRAS.

-

Procedure4.1 Configuring a VLANConfiguring VLAN is a prerequisite for configuring a service. Hence, before configuring aservice, make sure that the VLAN configuration based on planning is complete.

4.2 Configuring an Upstream PortThis topic describes how to add an upstream port for an Internet access service to a VLAN.

4.3 Configuring a GPON ONTThe MA5600T provides end users with services through the ONT. The MA5600T can managethe ONT and the ONT can work in the normal state only after the channel between theMA5600T and the ONT is available.

4.4 Configuring a GPON PortTo work normally and carry the service, a GPON port must be enabled first. This topic describeshow to enable a GPON port and configure related attributes of the port.




4-3

4.5 Creating a GPON Service PortA service port is a service channel connecting the user side to the network side. To provisionservices, a service port must be created.




Issue 03 (2010-01-28)


Prerequisite


Application Context




l Householduser














4-5










Common -

VLANforwarding mode

VLAN+MAC -

Procedure




VLANType



StandardVLAN




SmartVLAN







Issue 03 (2010-01-28)

VLANType



MUXVLAN




SuperVLAN




NOTE









4-7


VLANAttribute



ApplicationScenario

Common





QinQVLAN








Issue 03 (2010-01-28)

VLANAttribute



ApplicationScenario

VLANStacking





NOTE











4-9








----End

Example

Assume that a stacking VLAN with ID of 50 is to be configured for extension of the VLAN. Aservice port is added to VLAN 50. The outer VLAN tag 50 of the stacking VLAN identifies theaccess device and the inner VLAN tag 10 identifies the user with access to the device. For theVLAN, description needs to be configured for easy maintenance. To configure such a VLAN,do as follows:

huawei(config)#vlan 50 smart huawei(config)#vlan attrib 50 stackinghuawei(config)#service-port vlan 50 gpon 0/2/0 gemport 128 huawei(config)#stacking label vlan 50 baselabel 10 huawei(config)#vlan desc 50 description stackingvlan/label10

Assume that a QinQ VLAN with ID of 100 is to be configured for an enterprise user to ensurehigher security and the VLAN forwarding policy is S+C. For the VLAN, description needs tobe configured for easy maintenance. To configure such a VLAN, do as follows:

huawei(config)#vlan 100 smart huawei(config)#vlan attrib 100 q-in-q huawei(config)#vlan desc 100 description qinqvlan/forhuawei huawei(config)#vlan forwarding 100 vlan-connect


Procedure

Step 1 Configure an upstream port for the VLAN.

Run port vlan command to add the upstream port to the VLAN.

Step 2 Configure the attribute of the upstream port.If the default attribute of the upstream port does not meet the requirement for interconnectionof the upstream port with the upper-layer device, you need to configure the attribute. Forconfiguration details, see 2.7 Configuring the Attributes of an Upstream Ethernet Port.




Issue 03 (2010-01-28)

Step 3 Configure redundancy backup for the uplink.

To ensure reliability of the uplink, two upstream ports must be available. That is, redundancybackup of the upstream ports needs to be configured. For details, see 7.1 Configuring the UplinkRedundancy Backup.

----End

Example

Assume that the 0/19/0 and 0/19/1 upstream ports are to be added to VLAN 50. The 0/19/0 and0/19/1 need to be configured into an aggregation group for double upstream accesses. For thetwo upstream ports, the working mode is full-duplex (full) and the port rate is 100 Mbit/s. Toconfigure such upstream ports, do as follows:

huawei(config)#port vlan 50 0/19 0 huawei(config)#port vlan 50 0/19 1 huawei(config)#interface giu 0/19 huawei(config-if-giu-0/19)#duplex 0 fullhuawei(config-if-giu-0/19)#duplex 1 fullhuawei(config-if-giu-0/19)#speed 0 100huawei(config-if-giu-0/19)#speed 1 100huawei(config-if-giu-0/19)#quit huawei(config)#link-aggregation 0/19 0 0/19 1 egress-ingress workmode lacp-static


Prerequisite

The GPON ONT profile is already created. Configuring a GPON ONT Capability Profile,Configuring a GPON ONT Alarm Profile are already completed.


The MA5600T uses the ONT Management and Control Interface (OMCI) protocol to manageand configure the GPON ONT, and supports the offline configuration of the ONT. The ONTneed not save the configuration information locally. This helps to provision services.

Table 4-6 lists the default settings of the GPON ONT.

Table 4-6 Default settings of the GPON ONT


ONT auto-find function of a GPONport

Disabled

ONT status after an ONT is added Activated

Default VLAN of the ONT port 1




4-11

Procedure


Step 2 Add a GPON ONT.1. Run the port portid ont-auto-find command to enable the auto-find function of the ONT.

After the function is enabled, the system reports the SN and password of the auto-find ONTand you can add an ONT according to the information reported by the system. By default,the ONT auto-find function of a GPON port is disabled.

NOTE

An auto-find ONT is in the auto-find state. The auto-find ONT can work in the normal state only after itis confirmed or added.

2. Run the ont add command to add an ONT offline, or run the ont confirm command toconfirm the auto-find ONT.

NOTE

l If the ONU is an independent NE and is directly managed by the NMS through the SNMP managementmode, select the SNMP management mode. For this mode, you only need to configure the parametersfor the GPON line and the parameters for the management channel on the OLT.

l If the ONU is not an independent NE and all its configuration data is issued by the OLT through OMCI,select the OMCI management mode. For this mode, you need to configure all parameters (includingline parameters, UNI port parameters, and service parameters) that are required for the ONU on theOLT.

l Generally, the ONT management mode is set to the OMCI mode.

3. When the ONT management mode is the SNMP mode, you need to configure the SNMPmanagement parameters for the ONT. The procedure is as follows:

a. Run the ont ipconfig command to configure the management IP address of the ONT.The IP address should not be in the same subnet for the IP address of the VLAN port.

b. Run the ont snmp-profile command to bind the ONT with an SNMP profile.Run the snmp-profile add command to add an SNMP profile before the configuration.

c. Run the ont snmp-route command to configure a static route for the NMS server,that is, configure the IP address of the next hop.

Step 3 Configure the default VLAN (native VLAN) for the ONT port.

Run the ont port native-vlan command to configure the default VLAN for the ONT port. Bydefault, the default VLAN ID of the ONT port is 1.



Step 4 Bind an alarm profile.

Run the ont alarm-profile command bind an alarm profile. Ensure that 2.16.3.3 Configuringa GPON ONT Alarm Profile is completed before the configuration.

Step 5 Activate the ONT.

Run the ont activate command to activate the ONT. The ONT can transmit services only whenit is in the activated state.




Issue 03 (2010-01-28)

After being added, the ONT is in the activated state by default. The step is required only whenthe ONT is in the deactivated state.

----End

ExampleTo add an ONT that is managed by the OLT through the OMCI protocol, confirm this ONTaccording to the SN 3230313185885B41 automatically reported by the system, and bind theONT with capability profile 3 that match the ONT, do as follows:

huawei(config)#interface gpon 0/18huawei(config-if-gpon-0/18)#port 0 ont-auto-find enable huawei(config-if-gpon-0/18)#ont confirm 0 sn-auth 3230313185885B41 profile-id 3 manage-mode omci description HG850a

To add an ONU that is managed as an independent NE and whose SN is known as3230313185885641, bind the ONU with capability profile 4 that matches the ONU, configurethe NMS parameters for the ONU, and set the management VLAN to 100, do as follows:

huawei(config)#snmp-profile add profile-id 1 v2c public private 134.140.5.53 161 huaweihuawei(config)#interface gpon 0/18huawei(config-if-gpon-0/18)#ont add 0 2 sn-auth 3230313185885641 profile-id 4 manage-mode snmp huawei(config-if-gpon-0/18)#ont ipconfig 0 2 static ip-address 133.7.22.220 mask255.255.254.0 gateway 133.7.22.1 vlan 100 huawei(config-if-gpon-0/18)#ont snmp-profile 0 2 profile-id 1 huawei(config-if-gpon-0/18)#ont snmp-route 0 2 ip-address 133.7.22.190 mask 255.255.254.0 next-hop 133.7.22.100


Default ConfigurationTable 4-7 lists the default settings of the GPON port.

Table 4-7 Default settings of the GPON port


GPON port Enabled

Downstream FEC function of theGPON port

Disabled

Compensation distance range of theGPON port ranging

Minimum logical distance: 0 km; maximum logicaldistance: 20 km

Procedure





4-13

Step 2 Configure the laser of the GPON port.l Run the undo shutdown command to enable the laser of the GPON port. By default, the

laser of the GPON port is enabled and the GPON port is available. In this case, skip this step.l If the GPON port is not to be used, run the shutdown command the disable the laser of the

GPON port.

CAUTIONThe GPON port that is carrying services cannot be disabled.

Step 3 Configure the downstream FEC function of the GPON port.

Run the port portid fec command to configure the FEC function of the GPON port. By default,the FEC function is disabled.

NOTE

l FEC is to insert redundant data into normal packets so that the line has certain error tolerance. Somebandwidth, however, must be consumed. Enabling FEC enhances the error correction capability of the linebut at the same time occupies certain bandwidth. Determine whether to enable FEC according to the actualline planning.

l If a large number of ONTs are already online, enabling FEC on the GPON port may cause certain ONTs togo offline. Therefore, it is suggested that FEC should not be enabled on a GPON port that connects to onlineONTs.

Step 4 Configure the renewal time of the ONT key.

Run the port portid ont-password-renew command to configure the interval for renewing theONT key. To ensure the system security, the ONT key renewal must be configured.

Step 5 Configure the compensation distance in the ranging.Run the port range command to configure the compensation distance range of the GPON portranging. By default, the minimum logical distance is 0 km, and the maximum logical distanceis 20 km. The difference between the minimum logical distance and the maximum logicaldistance must not exceed 20 km.

----End

ExampleAssume that the key renew interval of the ONT under the port is 10 hours, the minimumcompensation distance of ranging is 10 km, and the maximum compensation distance of rangingis 15 km. To enable the FEC function of GPON port 0/2/0, do as follows:huawei(config)#interface gpon 0/2huawei(config-if-gpon-0/2)#port 0 fec enablehuawei(config-if-gpon-0/2)#port 0 ont-password-renew 10huawei(config-if-gpon-0/2)#port 0 range min-distance 10 max-distance 15 This command will result in the ONT's re-register in the port. Are you sure to execute this command? (y/n)[n]: y





Issue 03 (2010-01-28)


A service port can carry a single service or multiple services. When a service port carries multipleservices, the MA5600T supports the following modes of classifying traffic:l By user-side VLAN

l By user-side service encapsulation mode

l By VLAN+user-side packet priority

l By VLAN+user-side service encapsulation mode

Table 4-8 lists the default settings of a service port.

Table 4-8 Default settings of a service port


Traffic profile ID 0-6

Administrative status of the serviceport

Activated

Maximum number of MAC addressesthat are learned

1023

Procedure

Step 1 Create a traffic profile.

Run the traffic table ip command to create a traffic profile. There are seven default trafficprofiles in the system with the IDs of 0-6.

Before creating a service port, run the display traffic table command to check whether thetraffic profiles in the system meet the requirement. If no traffic profile in the system meets therequirement, add a traffic profile that meets the requirement. For details about the traffic profile,see 2.15.1.1 Configuring Traffic Management Based on Service Port.

Step 2 Create a service port.

You can choose to create a single service port or multiple service ports in batches according torequirements.

l Run the service-port command to create a single service port. Service ports are classifiedinto single-service service ports and multi-service service ports. Multi-service service portsare generally used for the triple play service.– Single-service service port:

By default, a service port is a single-service service port if you do not enter multi-service.

– Multi-service service port based on the user-side VLAN:Select multi-service user-vlan { untagged | user-vlanid | priority-tagged | other-all }.– untagged: When untagged is selected, user-side packets do not carry a tag.




4-15

– user-vlanid: When user-vlanid is selected, user-side packets carry a tag and the valueof user-vlanid must be the same as the tag carried in user-side packets, that is, C-VLAN.

– priority-tagged: When priority-tagged is selected, the VLAN tag is 0 and thepriorities of user-side packets are 0-7.

– other-all: When other-all is selected, service ports for the transparent LAN service(TLS) are created, which are mainly used in the QinQ transparent transmissionservice for enterprises. All the traffic except known traffic in the system is carriedover this channel.

– Multi-service service port based on the user-side service encapsulation mode:Select multi-service user-encap user-encap.

– Multi-service service port based on VLAN+user-side packet priority (802.1p):Select multi-service user-8021p user-8021p [ user-vlan user-vlanid ].

– Multi-service service port based on VLAN + user-side service encapsulation mode(user-encap):Select multi-service user-vlan { untagged | user-vlanid | priority-tagged } user-encap user-encap.NOTE

l The system supports creating service ports by index. One index maps one service port and the inputof a large number of traffic parameters is not required. Therefore, the configuration of service portsis simplified. During the creation of a service port, index indicates the index of the service port and itis optional. If it is not input, the system automatically adopts the smallest value.

l vlan indicates the S-VLAN. An S-VLAN can only be a MUX VLAN or smart VLAN.

l rx-cttr is the same as outbound in terms of meanings and functions. Either of them indicates the indexof the traffic from the network side to the user side. tx-cttr is the same as inbound in terms of meaningsand functions. Either of them indicates the index of the traffic from the user side to the network side.The traffic profile bound to the service port is created in Step 1.

l Run the multi-service-port command to create service ports in batches.

Step 3 Configure the attributes of the service port. Configure the attributes of the service port accordingto requirements.l Run the service-port desc command to configure the description of the service port.

Configure the description for a service port to facilitate maintenance. In general, configurethe purpose and related service information as the description of a service port.

l Run the service-port index adminstatus command to configure the administrative statusof the service port. By default, a service port is in the activated state.A service port can be activated at two levels: port level and service port level. To provisionservices for a user, the access port and the corresponding service port of the user must beactivated.

l Run the mac-address max-mac-count service-port command to configure the maximumnumber of MAC addresses learned by the service port to restrict the maximum number ofPCs that can access the Internet by using a same account. By default, the maximum numberof MAC addresses learned by the service port is 1023.

----End

ExampleConnect ONT to GPON port 0/2/0 of the MA5600T. Plan an Internet access user. The ONTprovides the Internet-access-only service with a rate of 4096 kbit/s for this user, the index of the




Issue 03 (2010-01-28)

GEM port that carries the service is 135, the service VLAN ID is 1000, and only three users areallowed to use a same account for Internet access at the same time. The query shows that thereis no proper traffic profile in the system. Then, create traffic profile 10. This user is not registeredyet. Therefore, the service is not provided for the user for the moment. To configure such a user,do as follows:

huawei(config)#traffic table ip index 10 cir 4096 priority 3 priority-policy local-Setting Create traffic descriptor record successfully ------------------------------------------------ TD Index : 10 TD Name : ip-traffic-table_10 Priority : 3 Copy Priority : - CTAG Default Priority: 0 Priority Policy : local-pri CIR : 4096 kbps CBS : 133072 bytes PIR : 8192 kbps PBS : 264144 bytes Referenced Status : not used ------------------------------------------------huawei(config)#service-port 5 vlan 1000 gpon 0/2/0 gemport 135 inbound traffic-table index 10 outbound traffic-table index 10huawei(config)#mac-address max-mac-count service-port 5 3huawei(config)#service-port 5 adminstatus disable

Connect ONT to GPON port 0/3/0 of the MA5600T. A commercial user requires the Internetaccess service with a rate of 8192 kbit/s to be provided. For subsequent service expansion, theONT provides the Internet access service for this user in the multi-service mode. The user isdifferentiated based on the user-end VLAN, S-VLAN ID is 1023, C-VLAN ID is 100, and theindex of the GEM port that carries the service is 130. The query shows that there is no propertraffic profile in the system. Then, create traffic profile 8. The Internet access service is requiredto be provided immediately. The description of the service port is added to facilitate maintenance.To configure such a user, do as follows:

huawei(config)#traffic table ip index 8 cir 8192 priority 4 priority-policy local-Setting Create traffic descriptor record successfully ------------------------------------------------ TD Index : 8 TD Name : ip-traffic-table_8 Priority : 4 Copy Priority : - CTAG Default Priority: 0 Priority Policy : local-pri CIR : 8192 kbps CBS : 264144 bytes PIR : 16384 kbps PBS : 526288 bytes Referenced Status : not used ------------------------------------------------huawei(config)#service-port 10 vlan 1023 gpon 0/3/0 gemport 130 multi-service user-vlan 100 inbound traffic-table index 8 outbound traffic-table index 8huawei(config)#service-port desc 10 description gpon/Vlanid:1023/uservlan:100`




4-17

5 Configuring the GPON Internet AccessService (Profile Mode)

About This Chapter

The GPON broadband Internet access service is applicable to the scenario that provides userswith the Internet access service through optical fibers. The networking mode for the service canbe FTTH, FTTB, FTTC, FTTO, or FTTM. This topic describes how to configure the Internetaccess service provided by the MA5600T through GPON.

Application ContextGPON is mainly used in the FTTx solution. The FTTx technology is mainly used for adoptingoptical network in the access network. Its coverage is from the CO device of the regionaltelecommunications room to the subscriber terminal. The optical line terminal (OLT) functionsas the CO device. The optical network unit (ONU) or the optical network terminal (ONT)functions as the subscriber terminal.

l FTTH refers to fiber to the home. In this networking scenario, the MA5600T functions asan OLT and is connected to the ONT at lower layer through the ODN. The ONT is connectedto subscribers to provide the voice, Internet access, and IPTV services.

l FTTB refers to fiber to the building. In this networking scenario, the MA5600T functionsas an OLT and is connected to the MDU or ONUs of other types at lower layer through theODN. The ONU or MDU is connected to subscribers. FTTB can be further classified intoFTTB+DSL and FTTB+LAN. These two modes respectively use the home gateway withan RJ-11 upstream port and the home gateway with a LAN upstream port to provide thevoice, Internet access, and IPTV services.

l FTTC refers to fiber to the curb. FTTC is mainly used to provide services for residentialsubscribers. The ONU is placed in the cabinet at the curb. It uses coaxial cables to transmitCATV signals or uses twisted pairs to transmit the voice and Internet access services. Inthis networking scenario, the MA5600T functions as an OLT and is connected to the MDUor outdoor cabinets for ONUs of other types at lower layer through the ODN. The ONU orMDU is connected to subscribers. FTTC and FTTB are the same in configuration and differfrom each other only in the networking mode.

l FTTO refers to fiber to the office. The Ethernet port of the ONU is connected to the LANof subscribers so that subscribers can be directly connected to the Internet, or connected to


5 Configuring the GPON Internet Access Service (ProfileMode)


5-1

the headquarters or branch offices through VPN. In this networking scenario, theMA5600T functions as an OLT and is connected to the ONU at lower layer through theODN. The ONU is connected to subscribers to provide the voice, Internet access, IPTV,and private line services.

Prerequisitel Configure the AAA function.

– To enable the AAA function on the device, see 2.13 Configuring AAA.

– If the AAA function is implemented by the BRAS, a connection to the BRAS must beestablished. The BRAS should be capable of identifying the VLAN tag of theMA5600T in the upstream direction. For the identification purpose, the user name andpassword for dial-up Internet access must be configured on the BRAS.

l The GPON profile for the Internet access service is already created.– For an ONT, 2.16.3.1 Configuring a GPON ONT Line Profile, 2.16.3.2 Configuring

a GPON ONT Service Profile, and 2.16.3.3 Configuring a GPON ONT AlarmProfile are already completed.

– For an MDU or ONU, 2.16.3.1 Configuring a GPON ONT Line Profile and 2.16.3.3Configuring a GPON ONT Alarm Profile are already completed.

l The GPON mode is already switched to the profile-mode.

Data PlanBefore configuring the GPON Internet access service, plan the data items as listed in Table5-1.

Table 5-1 Data plan for the GPON Internet access service

Item Data Remarks

MA5600T Access rate Configure the data according to theuser requirements.

Access port Configure the data according to thenetwork planning.

VLAN planning The cooperation with the upper-layerdevice should be considered in theVLAN planning. The upstream VLANmust be the same as that of the upper-layer device.

QoS policy Configure the data according to theQoS policy of the entire network.Generally, the priority of the Internetaccess service is lower than thepriorities of the voice and videoservices.

T-CONT ID It is recommended that you do not useT-CONT 0 to transmit services.

GEM port index -




Issue 03 (2010-01-28)

Item Data Remarks

ONT ONT line profile, ONT service profile The ONT service profile must be thesame as the actual capacity.

ONT index GPON supports a split ratio of up to1:128. You need to plan the ONTsconnected to the MA5600T tofacilitate management.

Authentication mode You can use the passwordauthentication and the serial numberauthentication.

Upper-layer LANswitch

The LAN switch transparentlytransmits the service packets of theMA5600T on L2.The VLAN ID must be the same as theupstream VLAN ID of the MA5600T.

-

BRAS The BRAS performs the relatedconfigurations according to theauthentication and accountingrequirements for dialup users, forexample, configures the access userdomain (including the authenticationscheme, accounting scheme, andauthorization scheme bound to thedomain) and specifies the RADIUSserver.If the BRAS is used to authenticateusers, you need to configure the username and the password for each useron the BRAS. If the BRAS is used toallocate IP addresses, you need toconfigure the corresponding IPaddress pool on the BRAS.

-

Procedure1. 5.1 Configuring a VLAN

Configuring VLAN is a prerequisite for configuring a service. Hence, before configuringa service, make sure that the VLAN configuration based on planning is complete.

2. 5.2 Configuring an Upstream PortThis topic describes how to add an upstream port for an Internet access service to a VLAN.

3. 5.3 Configuring a GPON ONTThe MA5600T provides end users with services through the ONT. The MA5600T canmanage the ONT and the ONT can work in the normal state only after the channel betweenthe MA5600T and the ONT is available.

4. 5.4 Configuring a GPON Port




5-3

To work normally and carry the service, a GPON port must be enabled first. This topicdescribes how to enable a GPON port and configure related attributes of the port.

5. 5.5 Creating a GPON Service PortA service port is a service channel connecting the user side to the network side. To provisionservices, a service port must be created.




Issue 03 (2010-01-28)


Prerequisite


Application Context




l Householduser














5-5










Common -

VLANforwarding mode

VLAN+MAC -

Procedure




VLANType



StandardVLAN




SmartVLAN







Issue 03 (2010-01-28)

VLANType



MUXVLAN




SuperVLAN




NOTE









5-7


VLANAttribute



ApplicationScenario

Common





QinQVLAN








Issue 03 (2010-01-28)

VLANAttribute



ApplicationScenario

VLANStacking





NOTE











5-9








----End

Example

Assume that a stacking VLAN with ID of 50 is to be configured for extension of the VLAN. Aservice port is added to VLAN 50. The outer VLAN tag 50 of the stacking VLAN identifies theaccess device and the inner VLAN tag 10 identifies the user with access to the device. For theVLAN, description needs to be configured for easy maintenance. To configure such a VLAN,do as follows:

huawei(config)#vlan 50 smart huawei(config)#vlan attrib 50 stackinghuawei(config)#service-port vlan 50 gpon 0/2/0 gemport 128 huawei(config)#stacking label vlan 50 baselabel 10 huawei(config)#vlan desc 50 description stackingvlan/label10

Assume that a QinQ VLAN with ID of 100 is to be configured for an enterprise user to ensurehigher security and the VLAN forwarding policy is S+C. For the VLAN, description needs tobe configured for easy maintenance. To configure such a VLAN, do as follows:

huawei(config)#vlan 100 smart huawei(config)#vlan attrib 100 q-in-q huawei(config)#vlan desc 100 description qinqvlan/forhuawei huawei(config)#vlan forwarding 100 vlan-connect


Procedure

Step 1 Configure an upstream port for the VLAN.

Run port vlan command to add the upstream port to the VLAN.

Step 2 Configure the attribute of the upstream port.If the default attribute of the upstream port does not meet the requirement for interconnectionof the upstream port with the upper-layer device, you need to configure the attribute. Forconfiguration details, see 2.7 Configuring the Attributes of an Upstream Ethernet Port.




Issue 03 (2010-01-28)

Step 3 Configure redundancy backup for the uplink.

To ensure reliability of the uplink, two upstream ports must be available. That is, redundancybackup of the upstream ports needs to be configured. For details, see 7.1 Configuring the UplinkRedundancy Backup.

----End

Example

Assume that the 0/19/0 and 0/19/1 upstream ports are to be added to VLAN 50. The 0/19/0 and0/19/1 need to be configured into an aggregation group for double upstream accesses. For thetwo upstream ports, the working mode is full-duplex (full) and the port rate is 100 Mbit/s. Toconfigure such upstream ports, do as follows:

huawei(config)#port vlan 50 0/19 0 huawei(config)#port vlan 50 0/19 1 huawei(config)#interface giu 0/19 huawei(config-if-giu-0/19)#duplex 0 fullhuawei(config-if-giu-0/19)#duplex 1 fullhuawei(config-if-giu-0/19)#speed 0 100huawei(config-if-giu-0/19)#speed 1 100huawei(config-if-giu-0/19)#quit huawei(config)#link-aggregation 0/19 0 0/19 1 egress-ingress workmode lacp-static


Prerequisite

The GPON ONT profile is already created.

l For an ONT, 2.16.3.1 Configuring a GPON ONT Line Profile, 2.16.3.2 Configuring aGPON ONT Service Profile, and 2.16.3.3 Configuring a GPON ONT Alarm Profileare already completed.

l For an MDU or ONU, 2.16.3.1 Configuring a GPON ONT Line Profile and 2.16.3.3Configuring a GPON ONT Alarm Profile are already completed.


The MA5600T uses the ONT Management and Control Interface (OMCI) protocol to manageand configure the GPON ONT, and supports the offline configuration of the ONT. The ONTneed not save the configuration information locally. This helps to provision services.

In the profile mode, the related configuration of the GPON ONT is already integrated in theservice profile and the line profile. When adding an ONT, you only need to bind the ONT withthe corresponding service profile and line profile.

Table 5-6 lists the default settings of the GPON ONT.




5-11

Table 5-6 Default settings of the GPON ONT


ONT auto-find function of a GPONport

Disabled

ONT status after an ONT is added Activated

Default VLAN of the ONT port 1

Procedure


Step 2 Add a GPON ONT.1. Run the port portid ont-auto-find command to enable the auto-find function of the ONT.

After the function is enabled, the system reports the SN and password of the auto-find ONTand you can add an ONT according to the information reported by the system. By default,the ONT auto-find function of a GPON port is disabled.

NOTE

An auto-find ONT is in the auto-find state. The auto-find ONT can work in the normal state only after itis confirmed or added.

2. Run the ont add command to add an ONT offline, or run the ont confirm command toconfirm the auto-find ONT.

NOTE

l If the ONU is an independent NE and is directly managed by the NMS through the SNMP managementmode, select the SNMP management mode. For this mode, you only need to configure the parametersfor the GPON line and the parameters for the management channel on the OLT. You only need to bindthe ONU with a line profile.

l If the ONU is not an independent NE and all its configuration data is issued by the OLT through OMCI,select the OMCI management mode. For this mode, you need to configure all parameters (includingline parameters, UNI port parameters, and service parameters) that are required for the ONU on theOLT. Configuring management channel parameters is not supported. You need to bind the ONT witha line profile and a service profile.

l Generally, the ONT management mode is set to the OMCI mode. You need to bind the ONT with aline profile and a service profile.

3. When the ONT management mode is the SNMP mode, you need to configure the SNMPmanagement parameters for the ONT. The procedure is as follows:

a. Run the ont ipconfig command to configure the management IP address of the ONT.The IP address should not be in the same subnet for the IP address of the VLAN port.

b. Run the ont snmp-profile command to bind the ONT with an SNMP profile.Run the snmp-profile add command to add an SNMP profile before the configuration.

c. Run the ont snmp-route command to configure a static route for the NMS server,that is, configure the IP address of the next hop.

Step 3 Configure the default VLAN (native VLAN) for the ONT port.

Run the ont port native-vlan command to configure the default VLAN for the ONT port. Bydefault, the default VLAN ID of the ONT port is 1.




Issue 03 (2010-01-28)



Step 4 Bind an alarm profile.

Run the ont alarm-profile command bind an alarm profile. Ensure that 2.16.3.3 Configuringa GPON ONT Alarm Profile is completed before the configuration.

Step 5 Activate the ONT.

Run the ont activate command to activate the ONT. The ONT can transmit services only whenit is in the activated state.

After being added, the ONT is in the activated state by default. The step is required only whenthe ONT is in the deactivated state.

----End

Example

To add an ONT that is managed by the OLT through the OMCI protocol, confirm this ONTaccording to the SN 3230313185885B41 automatically reported by the system, and bind theONT with line profile 3 and service profile 3 that match the ONT, do as follows:

huawei(config)#interface gpon 0/18huawei(config-if-gpon-0/18)#port 0 ont-auto-find enable huawei(config-if-gpon-0/18)#ont confirm 0 sn-auth 3230313185885B41 omci ont-lineprofile-id 3 ont-srvprofile-id 3 desc HG850a

To add an ONU that is managed as an independent NE and whose SN is known as3230313185885641, bind the ONU with line profile 4 that matches the ONU, configure the NMSparameters for the ONU, and set the management VLAN to 100, do as follows:

huawei(config)#snmp-profile add profile-id 1 v2c public private 134.140.5.53 161 huawei huawei(config)#interface gpon 0/18huawei(config-if-gpon-0/18)#ont add 0 2 sn-auth 3230313185885641 snmp ont-lineprofile-id 4 huawei(config-if-gpon-0/18)#ont ipconfig 0 2 static ip-address 133.7.22.220 mask 255.255.254.0 gateway 133.7.22.1 vlan 100 huawei(config-if-gpon-0/18)#ont snmp-profile 0 2 profile-id 1 huawei(config-if-gpon-0/18)#ont snmp-route 0 2 ip-address 133.7.22.190 mask 255.255.254.0 next-hop 133.7.22.100



Table 5-7 lists the default settings of the GPON port.




5-13

Table 5-7 Default settings of the GPON port


GPON port Enabled

Downstream FEC function of theGPON port

Disabled

Compensation distance range of theGPON port ranging

Minimum logical distance: 0 km; maximum logicaldistance: 20 km

Procedure


Step 2 Configure the laser of the GPON port.l Run the undo shutdown command to enable the laser of the GPON port. By default, the

laser of the GPON port is enabled and the GPON port is available. In this case, skip this step.l If the GPON port is not to be used, run the shutdown command the disable the laser of the

GPON port.

CAUTIONThe GPON port that is carrying services cannot be disabled.

Step 3 Configure the downstream FEC function of the GPON port.

Run the port portid fec command to configure the FEC function of the GPON port. By default,the FEC function is disabled.

NOTE

l FEC is to insert redundant data into normal packets so that the line has certain error tolerance. Somebandwidth, however, must be consumed. Enabling FEC enhances the error correction capability of the linebut at the same time occupies certain bandwidth. Determine whether to enable FEC according to the actualline planning.

l If a large number of ONTs are already online, enabling FEC on the GPON port may cause certain ONTs togo offline. Therefore, it is suggested that FEC should not be enabled on a GPON port that connects to onlineONTs.

Step 4 Configure the renewal time of the ONT key.

Run the port portid ont-password-renew command to configure the interval for renewing theONT key. To ensure the system security, the ONT key renewal must be configured.

Step 5 Configure the compensation distance in the ranging.Run the port range command to configure the compensation distance range of the GPON portranging. By default, the minimum logical distance is 0 km, and the maximum logical distanceis 20 km. The difference between the minimum logical distance and the maximum logicaldistance must not exceed 20 km.

----End




Issue 03 (2010-01-28)

ExampleAssume that the key renew interval of the ONT under the port is 10 hours, the minimumcompensation distance of ranging is 10 km, and the maximum compensation distance of rangingis 15 km. To enable the FEC function of GPON port 0/2/0, do as follows:

huawei(config)#interface gpon 0/2 huawei(config-if-gpon-0/2)#port 0 fec enablehuawei(config-if-gpon-0/2)#port 0 ont-password-renew 10huawei(config-if-gpon-0/2)#port 0 range min-distance 10 max-distance 15 This command will result in the ONT's re-register in the port. Are you sure to execute this command? (y/n)[n]: y


Background InformationA service port can carry a single service or multiple services. When a service port carries multipleservices, the MA5600T supports the following modes of classifying traffic:l By user-side VLAN

l By user-side service encapsulation mode

l By VLAN+user-side packet priority

l By VLAN+user-side service encapsulation mode

Table 5-8 lists the default settings of a service port.

Table 5-8 Default settings of a service port


Traffic profile ID 0-6

Administrative status of the serviceport

Activated

Maximum number of MAC addressesthat are learned

1023

Procedure

Step 1 Create a traffic profile.

Run the traffic table ip command to create a traffic profile. There are seven default trafficprofiles in the system with the IDs of 0-6.

Before creating a service port, run the display traffic table command to check whether thetraffic profiles in the system meet the requirement. If no traffic profile in the system meets therequirement, add a traffic profile that meets the requirement. For details about the traffic profile,see 2.15.1.1 Configuring Traffic Management Based on Service Port.




5-15

Step 2 Create a service port.

You can choose to create a single service port or multiple service ports in batches according torequirements.

l Run the service-port command to create a single service port. Service ports are classifiedinto single-service service ports and multi-service service ports. Multi-service service portsare generally used for the triple play service.

– Single-service service port:

By default, a service port is a single-service service port if you do not enter multi-service.

– Multi-service service port based on the user-side VLAN:

Select multi-service user-vlan { untagged | user-vlanid | priority-tagged | other-all }.

– untagged: When untagged is selected, user-side packets do not carry a tag.

– user-vlanid: When user-vlanid is selected, user-side packets carry a tag and the valueof user-vlanid must be the same as the tag carried in user-side packets, that is, C-VLAN.

– priority-tagged: When priority-tagged is selected, the VLAN tag is 0 and thepriorities of user-side packets are 0-7.

– other-all: When other-all is selected, service ports for the transparent LAN service(TLS) are created, which are mainly used in the QinQ transparent transmissionservice for enterprises. All the traffic except known traffic in the system is carriedover this channel.

– Multi-service service port based on the user-side service encapsulation mode:

Select multi-service user-encap user-encap.

– Multi-service service port based on VLAN+user-side packet priority (802.1p):

Select multi-service user-8021p user-8021p [ user-vlan user-vlanid ].

– Multi-service service port based on VLAN + user-side service encapsulation mode(user-encap):

Select multi-service user-vlan { untagged | user-vlanid | priority-tagged } user-encap user-encap.

NOTE

l The system supports creating service ports by index. One index maps one service port and the inputof a large number of traffic parameters is not required. Therefore, the configuration of service portsis simplified. During the creation of a service port, index indicates the index of the service port and itis optional. If it is not input, the system automatically adopts the smallest value.

l vlan indicates the S-VLAN. An S-VLAN can only be a MUX VLAN or smart VLAN.

l rx-cttr is the same as outbound in terms of meanings and functions. Either of them indicates the indexof the traffic from the network side to the user side. tx-cttr is the same as inbound in terms of meaningsand functions. Either of them indicates the index of the traffic from the user side to the network side.The traffic profile bound to the service port is created in Step 1.

l Run the multi-service-port command to create service ports in batches.

Step 3 Configure the attributes of the service port. Configure the attributes of the service port accordingto requirements.




Issue 03 (2010-01-28)

l Run the service-port desc command to configure the description of the service port.Configure the description for a service port to facilitate maintenance. In general, configurethe purpose and related service information as the description of a service port.

l Run the service-port index adminstatus command to configure the administrative statusof the service port. By default, a service port is in the activated state.A service port can be activated at two levels: port level and service port level. To provisionservices for a user, the access port and the corresponding service port of the user must beactivated.

l Run the mac-address max-mac-count service-port command to configure the maximumnumber of MAC addresses learned by the service port to restrict the maximum number ofPCs that can access the Internet by using a same account. By default, the maximum numberof MAC addresses learned by the service port is 1023.

----End

ExampleConnect ONT 1 to GPON port 0/2/0 of the MA5600T. Plan an Internet access user. The ONTprovides the Internet-access-only service with a rate of 4096 kbit/s for this user, the index of theGEM port that carries the service is 126, the service VLAN ID is 1000, and only three users areallowed to use a same account for Internet access at the same time. The query shows that thereis no proper traffic profile in the system. Then, create traffic profile 10. This user is not registeredyet. Therefore, the service is not provided for the user for the moment. To configure such a user,do as follows:huawei(config)#traffic table ip index 10 cir 4096 priority 3 priority-policy local-Setting Create traffic descriptor record successfully ------------------------------------------------ TD Index : 10 TD Name : ip-traffic-table_10 Priority : 3 Mapping Priority : - Mapping Index : - CTAG Mapping Priority: - CTAG Mapping Index : - CTAG Default Priority: 0 Priority Policy : local-pri CIR : 4096 kbps CBS : 133072 bytes PIR : 8192 kbps PBS : 264144 bytes Referenced Status : not used ------------------------------------------------ huawei(config)#service-port 5 vlan 1000 gpon 0/2/0 ont 1 gemport 126 inbound traffic-table index 10 outbound traffic-table index 10 huawei(config)#mac-address max-mac-count service-port 5 3huawei(config)#service-port 5 adminstatus disable

Connect ONT 2 to GPON port 0/3/0 of the MA5600T. A commercial user requires the Internetaccess service with a rate of 8192 kbit/s to be provided. For subsequent service expansion, theONT provides the Internet access service for this user in the multi-service mode. The user isdifferentiated based on the user-end VLAN, S-VLAN ID is 1023, C-VLAN ID is 100, and theindex of the GEM port that carries the service is 126. The query shows that there is no propertraffic profile in the system. Then, create traffic profile 8. The Internet access service is requiredto be provided immediately. The description of the service port is added to facilitate maintenance.To configure such a user, do as follows:huawei(config)#display traffic table ip from-index 0 { <cr>|to-index<K> }:




5-17

Command: display traffic table ip from-index 0 ---------------------------------------------------------------------------- TID CIR(kbps) CBS(bytes) PIR(kbps) PBS(bytes) Pri Copy-policy Pri-Policy ---------------------------------------------------------------------------- 0 1024 34768 2048 69536 6 - tag-pri 1 2496 81872 4992 163744 6 - tag-pri 2 512 18384 1024 36768 0 - tag-pri 3 576 20432 1152 40864 2 - tag-pri 4 64 4048 128 8096 4 - tag-pri 5 2048 67536 4096 135072 0 - tag-pri 6 off off off off 0 - tag-pri ---------------------------------------------------------------------------- Total Num : 7 huawei(config)#traffic table ip index 8 cir 8192 priority 4 priority-policy local-Setting Create traffic descriptor record successfully ------------------------------------------------ TD Index : 8 TD Name : ip-traffic-table_8 Priority : 4 Mapping Priority : - Mapping Index : - CTAG Mapping Priority: - CTAG Mapping Index : - CTAG Default Priority: 0 Priority Policy : local-pri CIR : 8192 kbps CBS : 264144 bytes PIR : 16384 kbps PBS : 526288 bytes Referenced Status : not used ------------------------------------------------ huawei(config)#service-port 10 vlan 1023 gpon 0/3/0 ont 2 gemport 126 multi-service user-vlan 100 inbound traffic-table index 8 outbound traffic-table index 8 huawei(config)#service-port desc 10 description gpon/Vlanid:1023/uservlan:100 `




Issue 03 (2010-01-28)

6 Configuring the Multicast Service (xPON)

About This Chapter

This topic describes how to configure the multicast service on the MA5600T in a single-NEnetwork.

Application Context

The multicast feature of the MA5600T is mainly applicable to the live TV and near-video ondemand (NVOD) multicast video services.

Currently, the multicast application of the MA5600T is oriented to L2, which forwards databased on VLAN ID + multicast MAC address. A multicast program in the network is identifiedby VLAN ID + multicast IP address uniquely. The MA5600T differentiates multicast sourcesthrough VLANs. It allocates a unique VLAN to each multicast source, controls the multicastdomain and the user authority based on VLANs, and provides a platform for different ISPs toimplement different multicast video services.

In terms of multicast processing mode, the MA5600T supports IGMP proxy and IGMP snooping.Both of them provide the function of forwarding multicast video data, but their processingmechanisms are different:

l IGMP snooping obtains related information and maintains the multicast forwarding entriesby listening to the IGMP packets in the communication between the user and the multicastrouter.

l IGMP proxy intercepts the IGMP packets between the user and the multicast router,processes the IGMP packets, and then forwards the IGMP packets to the upper-layermulticast router. For the multicast user, the MA5600T is a multicast router that implementsthe router functions in the IGMP protocol; for the multicast router, the MA5600T is amulticast user.

In terms of multicast program configuration, the MA5600T supports statically configuring amulticast program library and dynamically generating a multicast program library.

l Statically configuring a multicast program library: Configure the program list before theusers watch the video programs. In this mode, the authority profile can be used to controlthe multicast. The program list and the authority profile, however, need to be maintained

SmartAX MA5600TCommissioning and Configuration Guide 6 Configuring the Multicast Service (xPON)


6-1

according to the video service change. The program host, program prejoin, and multicastbandwidth management functions are supported.

l Dynamically generating a multicast program library: Dynamically generate the programlist according to the programs demanded by the users. In this mode, the program list neednot be configured or maintained; however, the functions such as program management,user multicast bandwidth management, program preview, and program prejoin are notsupported.

If the traffic with a high priority is suddenly overloaded and the service with a low priority isaffected, IGMP packets are notdiscarded. MA5600Tprocesses and sends the IGMP packets first.

Data PlanBefore configuring the multicast video service, plan the data items as listed in Table 6-1.

Table 6-1 Data items planned for the multicast service

Device Data Item Remarks

MA5600T L2 multicast protocol -

IGMP version -

Multicast program configuration mode -

Parameter values of the multicastprotocol

-

Program list -

User authentication policy -

Program bandwidth, upstream portbandwidth, and user bandwidth

-

Multicast ONT -

Multicast log policy -

Upper-layermulticast router

IGMP version The IGMP version of theupper-layer multicastrouter cannot be earlierthan the IGMP versionused by the MA5600T.

Configuration FlowchartFigure 6-1 shows the scheme of configuring the multicast service under GPON.

6 Configuring the Multicast Service (xPON)SmartAX MA5600T



Issue 03 (2010-01-28)

Figure 6-1 Scheme of configuring the multicast service under GPON


Table 6-2 lists the default configuration of the multicast service provided by the MA5600T.

Table 6-2 Default configuration of the multicast service

Feature Default Configuration

Multicast protocol Disable



6-3

Feature Default Configuration

IGMP version V3

Multicast program configuration mode Static configuration mode

Multicast bandwidth management Enable

Multicast preview Enable

Multicast log switch Enable

Multicast mode of the GPON ONT Unconcern

Multicast forwarding mode of the GPONONT

Unconcern

1. 6.1 Configuring Multicast Global ParametersThe general parameters of L2 multicast protocols (including IGMP proxy and IGMPsnooping) configured for a device are applicable to all the multicast VLANs on the device.

2. 6.2 Configuring the Multicast VLAN and the Multicast ProgramIn the application of multicast service, multicast VLANs (MVLANs) are used to distinguishmulticast ISPs. Generally, a multicast VLAN is allocated to each multicast ISP for theVLAN-based management of multicast programs, multicast protocols, IGMP versions, andthe VLAN-based control of multicast domain and user right.

3. 6.3 Configuring the Multicast GPON ONTWhen the MA5600T is connected with an ONT or an MDU, you need to configure themulticast interconnection data to forward the multicast traffic streams.

4. 6.4 Configuring a Multicast UserThis topic describes how to configure a multicast user and the related authority to provisionthe multicast service.

5. 6.5 (Optional) Configuring the Multicast BandwidthTo limit the multicast bandwidth of a user, you can enable multicast bandwidthmanagement, that is, connection admission control (CAC), and then control the bandwidthof a multicast user by setting the program bandwidth and the user bandwidth.

6. 6.6 (Optional) Configuring Multicast PreviewMulticast preview is an advertizing method provided by carriers for ISPs. The purpose isto allow users to have an overview of a program in a controlled way. In other words, theduration, interval, and count of the user previews are controlled.

7. 6.7 (Optional) Configuring Program PrejoinIn program prejoin, the MA5600T receives in advance the multicast stream of a programfrom the upper-layer multicast router to the upstream port before a user sends a request tojoin a program, thus shortening the waiting time of the user for requesting the program.

8. 6.8 (Optional) Configuring the Multicast Logging FunctionMulticast log serves as a criterion for carriers to evaluate the viewership of multicastprograms.




Issue 03 (2010-01-28)

6.1 Configuring Multicast Global ParametersThe general parameters of L2 multicast protocols (including IGMP proxy and IGMP snooping)configured for a device are applicable to all the multicast VLANs on the device.

Context

The multicast global parameters include general query, group-specific query, and the policy ofprocessing multicast packets.

The description of a general query is as follows:

l Purpose: A general query packet is periodically sent by the MA5600T to check whetherthere is any multicast user who leaves the multicast group without sending the leave packet.Based on the query result, the MA5600T periodically updates the multicast forwardingtable and releases the bandwidth of the multicast user that has left the multicast group.

l Principle: The MA5600T periodically sends the general query packet to all online IGMPusers. If the MA5600T does not receive the response packet from a multicast user withina specified time (Robustness variable x General query interval + Maximum response timeof a general query), it regards the user as having left the multicast group and deletes theuser from the multicast group.

The description of a group-specific query is as follows:

l Purpose: A group-specific query packet is sent by the MA5600T after a multicast user thatis not configured with the quick leave attribute sends the leave packet. The group-specificquery packet is used to check whether the multicast user has left the multicast group.

l Principle: When a multicast user leaves a multicast group, for example, switches to anotherchannel, the user unsolicitedly sends a leave packet to the MA5600T. If the multicast useris not configured with the quick leave attribute, the MA5600T sends a group-specific querypacket to the multicast group. If the MA5600T does not receive the response packet fromthe multicast user within a specified duration (Robustness variable x Group-specific queryinterval + Maximum response time of a group-specific query), it deletes the multicast userfrom the multicast group.

Table 6-3 lists the default settings of the multicast global parameters. In the actual application,you can modify the values according to the data plan.

Table 6-3 Default settings of the multicast global parameters


General query parameter Query interval: 125sMaximum response time: 10sRobustness variable (query times): 2

Group-specific queryparameter

Query interval: 1sMaximum response time: 0.8s.Robustness variable (query times): 2



6-5


Policy of processing multicastpackets

IGMP packet: normal (IGMP packets are processed ascontrollable multicast)Unknown multicast packet: discard

ProcedureStep 1 In the global config mode, run the btv command to enter the BTV mode.

Step 2 Configure the general query parameters.1. Run the igmp proxy router gen-query-interval command to set the general query interval.

By default, the general query interval is 125s.2. Run the igmp proxy router gen-response-time command to set the maximum response

time of the general query. By default, the maximum response time of the general query is10s.

3. Run the igmp proxy router robustness command to set the robustness variable (querytimes) of the general query. By default, the robustness variable (query times) is 2.

Step 3 Set the group-specific query parameters.1. Run the igmp proxy router sp-response-time command to set the group-specific query

interval. By default, the group-specific query interval is 1s.2. Run the igmp proxy router sp-query-interval command to set the maximum response

time of the group-specific query. By default, the maximum response time of the group-specific query is 0.8s.

3. Run the igmp proxy router sp-query-number command to set the robustness variable(query times) of the group-specific query. By default, the robustness variable (query times)is 2.

Step 4 Configure the policy of processing multicast packets.

By default, the normal mode for processing IGMP packets is adopted. In this mode, IGMPpackets are processed as controllable multicast. The discard mode is adopted for unknownmulticast packets. In this mode, unknown multicast packets are discarded.

The default values are adopted for multicast service and need not be modified. To control theforwarding of multicast packets when configuring other services, run the following commandsto configure the policy.

1. Run the igmp policy command to set the policy of processing IGMP packets.2. Run the multicast-unknown policy command to set the policy of processing unknown

multicast packets.

Step 5 Run the display igmp config global command to check whether the values of the multicastparameters are correct.

----End

ExampleTo configure the multicast general query parameters by setting the query interval to 150s,maximum response time to 20s, and number of queries to 3, do as follows:




Issue 03 (2010-01-28)

huawei(config)#btvhuawei(config-btv)#igmp proxy router gen-query-interval 150huawei(config-btv)#igmp proxy router gen-response-time v3 20huawei(config-btv)#igmp proxy router robustness 3

To configure the multicast group-specific query parameters by setting the query interval to 200s,maximum response time to 100s, and number of queries to 3, do as follows:

huawei(config)#btvhuawei(config-btv)#igmp proxy router sp-query-interval 200huawei(config-btv)#igmp proxy router sp-response-time v3 100huawei(config-btv)#igmp proxy router sp-query-number 3

6.2 Configuring the Multicast VLAN and the MulticastProgram

In the application of multicast service, multicast VLANs (MVLANs) are used to distinguishmulticast ISPs. Generally, a multicast VLAN is allocated to each multicast ISP for the VLAN-based management of multicast programs, multicast protocols, IGMP versions, and the VLAN-based control of multicast domain and user right.

ContextTo create a multicast VLAN, a common VLAN must be created first. The multicast VLAN canbe the same as the unicast VLAN. In this case, the two VLANs can share the same service streamchannel. The multicast VLAN can be different from the unicast VLAN. In this case, the twoVLANs use different service stream channels.

One user port can be added to multiple multicast VLANs under the following restrictions:

l Among all the multicast VLANs of a user port, only one multicast VLAN is allowed tohave dynamically generated programs.

l The IGMP versions supported by all the multicast VLANs of the user port must be thesame.

l One user port is not allowed to belong to multiple multicast VLANs that are in the IGMPv3 snooping mode.

The source IP address in the multicast packets that are sent to the upper device by the OLT maybe as follows:l If the IP address of the program VLAN interface is configured, the source IP address is the

IP address of VLAN interface. Make sure that the IP address is in the same subnet with theIP addresses of the BRAS and the upper layer router.

l If the IP address of the program VLAN interface is not configured, the source IP addressis the host IP address of the program.

l If the host IP address is not configured, the default address 0.0.0.0 is used.

Table 6-4 lists the default settings of the multicast VLAN attributes, including the L2 multicastprotocol, IGMP version, multicast program, and multicast upstream port.

Table 6-4 Default settings of the multicast VLAN attributes


Program matching mode enable (static configuration mode)



6-7


Multicast upstream port mode default

L2 multicast protocol off (multicast function disabled)

IGMP version v3

Priority of forwarding IGMPpackets by the upstream port

6

Procedure

Step 1 Create a multicast VLAN.

1. Run the vlan command to create a VLAN, and set the VLAN type according to the actualapplication. For details on the VLAN configuration, see Configuring VLAN.

2. Run the multicast-vlan command to set the created VLAN to a multicast VLAN.

Step 2 Configure multicast programs.The multicast VLAN can be configured statically or generated dynamically.

l Static configuration mode: Configure a program list for the multicast VLAN beforehand,and bind the program to a right profile to implement program right management.

1. Run the igmp match mode enable command to set the static configuration mode. Bydefault, the system adopts the static configuration mode.

2. Run the igmp program add [name name ] ip ip-addr [ sourceip ip-addr ] [ hostip ip-addr ] command to add a multicast program.

NOTE

If the IGMP version of a multicast VLAN is v3, the program must be configured with a source IPaddress. If the IGMP version of a multicast VLAN is v2, the program must not be configured witha source IP address.

3. Add a right profile.In the BTV mode, run the igmp profile add command to add a right profile.

4. Bind the program to the right profile.

In the BTV mode, run the igmp profile command to bind the program to the right profile,and set the right to watch.

NOTE

When a user is bound to multiple right profiles, and the right profiles have different rights to aprogram, the right with the highest priority prevails. You can run the igmp right-priority commandto adjust the priorities of the four rights: watch, preview, forbidden, and idle. By default, the prioritiesof the four rights are forbidden > preview > watch > idle.

l Dynamic generation mode: A program list is dynamically generated according to theprograms requested by users. In this mode, the program list need not be configured ormaintained; however, the functions such as program management, user multicastbandwidth management, program preview, and program prejoin are not supported.

1. Run the igmp match mode disable command to set the dynamic generation mode.




Issue 03 (2010-01-28)

CAUTIONThe igmp match mode command can be executed only when the IGMP mode is disabled.

2. Run the igmp match group command to configure the IP address range of the programgroup that can be dynamically generated. Users can request only the programs whose IPaddresses are within the specified range.

Step 3 Configure the multicast upstream port.

1. Run the igmp uplink-port command to configure the multicast upstream port. The packetsof the multicast VLAN corresponding to the upstream port are forwarded and received bythis upstream port.

2. In the BTV mode, run the igmp uplink-port-mode command to change the mode of themulticast upstream port. By default, the port is in the default mode. In the MSTP network,the port adopts the MSTP mode.

l Default mode: If the multicast VLAN contains only one upstream port, the multicastpackets that go upstream can be sent only by this port. If the multicast VLAN containsmultiple upstream ports, the multicast packets that go upstream are sent by all theupstream ports.

l MSTP mode: This mode is adopted in the MSTP network.

Step 4 Select the multicast mode.

Run the igmp mode { proxy | snooping } command to select the L2 multicast mode. By default,the multicast mode is disabled.

In the IGMP snooping mode, proxy can be enabled for the report packet and the leave packet.When a multicast user joins or leaves a multicast program, the MA5600T can implement IGMPproxy. IGMP snooping and IGMP proxy are controlled separately.

l Run the igmp report-proxy enable command to enable the proxy of the snooping reportpacket. When the first user requests to join a program, after authenticating the user, theMA5600T sends the user report packet to the network side and receives a correspondingmulticast stream from the multicast router. The report packets of the users that follow thefirst user are not sent by the MA5600T to the network side.

l Run the igmp leave-proxy enable command to enable the proxy of the snooping leavepacket. When the last user requests to leave the program, the MA5600T sends the user leavepacket to the network side to request the upper-layer device to stop sending multicast streams.The leave packets of the users that precede the last user are not sent by the MA5600T to thenetwork side.

Step 5 Set the IGMP version.

Run the igmp version{ v2 | v3 } command to set the IGMP version. By default, IGMP v3 isenabled in the system. If the upper-layer and lower-layer devices in the network are IGMP v2devices and cannot recognize the IGMP v3 packets, run this command to change the IGMPversion.

IGMP v3 is compatible with IGMP v2 in packet processing. If IGMP v3 is enabled on theMA5600T and the upper-layer multicast router switches to IGMP v2, the MA5600Tautomatically switches to IGMP v2 when receiving the IGMP v2 packets. If the MA5600T doesnot receive any more IGMP v2 packets within the preset IGMP v2 timeout time, it automatically



6-9

switches back to IGMP v3. In the BTV mode, run the igmp proxy router timeout commandto set the IGMP v2 timeout time. By default, the timeout time is 400s.

Step 6 Change the priority for forwarding IGMP packets.

Run the igmp priority command to change the priority for forwarding the IGMP packets by theupstream port. By default, the priority is 6 and need not be changed.

l In the IGMP proxy mode, the IGMP packets sent from the upstream port to the network sideadopt the priority set through the preceding command in the multicast VLAN.

l In the IGMP snooping mode, the IGMP packets forwarded to the network side adopt thepriority of the user service stream. The priority of the service stream is set through the trafficprofile.

Step 7 Check whether the configuration is correct.l Run the display igmp config vlan command to query the attributes of the multicast VLAN.

l Run the display igmp program vlan command to query the information about the programof the multicast VLAN.

----End

ExampleAssume the following configurations: VLAN 101 is created, multicast programs are configuredstatically, the IP address of the program is 224.1.1.1, the program bandwidth is 5000 kbit/s, theupstream port of the multicast VLAN is 0/19/0, the IGMP proxy is used, and the IGMP versionis IGMP V3. To perform these configurations, do as follows:

huawei(config)#vlan 101 smart huawei(config)#multicast-vlan 101 huawei(config-mvlan101)#igmp match mode enable huawei(config-mvlan101)#igmp program add name movie ip 224.1.1.1 sourceip 10.10.10.10 hostip 10.0.0.254 bandwidth 5000huawei(config-mvlan101)#igmp uplink-port 0/19/0huawei(config-mvlan101)#igmp mode proxy Are you sure to change IGMP mode?(y/n)[n]:yhuawei(config-mvlan101)#igmp version v3

Assume the following configurations: VLAN 101 is created, multicast programs are configureddynamically, the upstream port of the multicast VLAN is 0/19/0, the IGMP proxy is used, andthe IGMP version is IGMP V3. To perform these configurations, do as follows:

huawei(config)#vlan 101 smart huawei(config)#multicast-vlan 101 huawei(config-mvlan101)#igmp match mode disable This operation will delete all the programs in current multicast vlan Are you sure to change current match mode? (y/n)[n]: y Command is being executed, please wait... Command has been executed successfully huawei(config-mvlan101)#igmp uplink-port 0/19/0 huawei(config-mvlan101)#igmp mode proxy Are you sure to change IGMP mode?(y/n)[n]:y huawei(config-mvlan101)#igmp version v3




Issue 03 (2010-01-28)

6.3 Configuring the Multicast GPON ONTWhen the MA5600T is connected with an ONT or an MDU, you need to configure the multicastinterconnection data to forward the multicast traffic streams.

PrerequisiteBefore configuring the multicast GPON ONT, you must add the ONT correctly. For theconfiguration method, see Configuring the GPON ONT.

Contextl When the OLT is connected with an ONT such as the HG850a, the MA5600T manages the

ONT in the OMCI mode. In this case, you need to configure the ONT line profile and theONT service profile, configure the multicast data in the ONT service profile, and bind theprofiles to the ONT to issue the multicast service.

l When the OLT is connected with an MDU such as the MA5620G or MA5616, theMA5600T manages the MDU in the SNMP mode. In this case, you need not configure theONT service profile. You only need to configure the multicast data on the MDUinterconnected with the MA5600T to forward the multicast traffic streams.

Table 6-5 provides the multicast mode mapping between the GPON boards on the MA5600Tand certain MDUs. Here, "NG" indicates that the service can be implemented and "OK" indicatesthat the multicast service can be implemented.l Mode 1: OLT: IGMP snooping. MDU: IGMP snooping.

l Mode 2: OLT: The multicast mode is off, and the multicast stream mode is transparent.MDU: Transparent.

Table 6-5 Multicast mode mapping between the GPON boards on the MA5600T and certainMDUs

Board+MDU Mode 1 Mode 2

GPBC+MA5610 NG NG

GPBC+MA5620G OK OK

GPBC+MA5626G OK OK

GPBC+MA5652G NG NG

Procedurel In the GPON profile mode:

1. Add an ONT line profile.For the configuration method, see Configuring the GPON ONT Line Profile.

2. Add an ONT service profile.

Run the ont-srvprofile gpon command to add a GPON ONT service profile, and thenenter the GPON ONT service profile mode.



6-11

If the ONT management mode is the SNMP mode, you need not configure the serviceprofile. After adding a GPON ONT service profile, directly enter the GPON ONTservice profile mode to configure the related multicast data.

– Run the ont-port command to configure the port capability set of the ONT. Theport capability set in the ONT service profile must be the same as the actual ONTcapability set.

– Run the port vlan command to configure the port VLAN of the ONT.

– Configure the multicast mode of the ONT. Run the multicast mode { igmp-snooping|olt-control|unconcern } command to select the multicast mode.

– igmp-snooping: IGMP snooping obtains related information and maintains themulticast forwarding entries by listening to the IGMP packets in thecommunication between the user and the multicast router.

– olt-control: It is the dynamic controllable multicast mode. A multicastforwarding entry can be created for the multicast join packet of the user onlyafter the packet passes the authentication.

– unconcern: It is the unconcern mode. After this mode is selected, the OLT doesnot limit the multicast mode, and the multicast mode on the OLT automaticallymatches the multicast mode on the ONT.

– Configure the multicast forwarding mode. Run the multicast-forward { tag|unconcern|untag } command to configure the processing mode on the VLAN tagof the multicast data packets.

– tag: Set the multicast forwarding mode to contain the VLAN tag.

– untag: Set the multicast forwarding mode not to contain the VLAN tag.

– unconcern: The forwarding mode is not concerned.

– After the configuration is complete, run the commit command to make theconfigured service profile take effect.

NOTE

For an ONT that is added through the ont add command or an automatically found ONT that isconfirmed through the ont comfirm command, if you run the commit command after modifyingthe ONT line profile parameters and the ONT service profile parameters, the modified profileparameters take effect immediately.

l In the GPON distributing mode:

1. For the configuration method, see 2.16.2 Configuring the GPON ONT Profile(Distributed Mode).

2. In the GPON mode, run the command ont port vlan to add the ONT ports to a multicastVLAN.

3. In the GPON mode, run the command ont igmp-forward { translationvlanid |transparent | unconcern } to configure the IGMP packet forwarding mode.

– translation: Indicates the VLAN switching mode of IGMP packet. You need toinput the VLAN ID after switching, and the VLAN tag will be switched to thespecified VLAN ID.

– transparent: Set the upstream IGMP packet forwarding mode to be transparent.

– unconcern: It is the unconcern mode. After this mode is selected, the OLT doesnot limit the multicast mode, and the multicast mode on the OLT automaticallymatches the multicast mode on the ONT.




Issue 03 (2010-01-28)

4. In the GPON mode, run the command ont multicast-forward { tag | untag }{ translationvlanid | transparent | unconcern } to configure the ONT multicastforwarding mode.– tag: Sets the multicast packets forwarded by the ONT to carry a VLAN tag. The

VLAN tag is set through parameter translation vlanid.– untag: Sets the multicast packets forwarded by the ONT not to carry a VLAN tag.

– translation: Sets the VLAN tag carried by the multicast packets that are forwardedby the ONT.

– transparent: Sets the VLAN tag carried by the multicast packets that aretransparently transmitted by the ONT.

– unconcern: Indicates that the multicast forwarding mode is not concerned.

----End

Example

To configure the ONT service profile 10 of 4 ETH ports, 2 POTS ports, the VLAN of the ETHport as 10, the multicast mode as IGMP snooping, the multicast forwarding mode as unconcernin the GPON profile mode, do as follows:

huawei(config)#ont-srvprofile gpon profile-id 10huawei(config-gpon-srvprofile-10)#ont-port eth 4 pots 2huawei(config-gpon-srvprofile-10)#port vlan eth 1 10huawei(config-gpon-srvprofile-10)#multicast mode igmp-snoopinghuawei(config-gpon-srvprofile-10)#multicast-forward unconcernhuawei(config-gpon-srvprofile-10)#commithuawei(config-gpon-srvprofile-10)#quit

To add the ONT port 1-2 to the multicast VLAN 100, the IGMP packet forwarding mode totransparent and the multicast forwarding mode to untag in the GPON distributing mode, do asfollows:

huawei(config-if-gpon-0/2)#ont port vlan 0 0 eth 100 1-2huawei(config-if-gpon-0/2)#ont igmp-forward 0 0 transparenthuawei(config-if-gpon-0/2)#ont multicast-forward 0 0 untag

6.4 Configuring a Multicast UserThis topic describes how to configure a multicast user and the related authority to provision themulticast service.

Prerequisite

Before configuring a multicast user, you need to create the service channel. The procedure is asfollows:

l Configure a GPON multicast user

1. Configure the VLAN2. Configure the upstream port3. Configure the multicast GPON ONT4. Configure the GPON user port5. Configure the GPON traffic stream



6-13

Context

Add a multicast user and bind the multicast user to the multicast VLAN to create a multicastmember. Bind the multicast user to an authority profile to implement multicast userauthentication.

Table 6-6 lists the default settings of the multicast user attributes.

Table 6-6 Default settings of the multicast user attributes


Limitation on the number ofprograms that can be watched bythe multicast user

Number of programs that can be watched concurrently: 8Maximum number of programs at various levels that canbe watched: no limit

Quick leave mode of themulticast user

mac-based

Global switch of multicast userauthentication

enable

Procedure

Step 1 In the global config mode, run the btv command to enter the BTV mode.

Step 2 Configure a multicast user and the multicast user attributes.1. Add a multicast user.

Run the igmp user add service-port command to add a multicast user.2. Configure the maximum number of programs that can be watched by the multicast user.

l Run the igmp user add service-port index max-program { max-program-num | no-limit } command to set the maximum number of programs that can be watched by themulticast user concurrently. Up to eight programs can be watched by the multicast userconcurrently. By default, the system supports eight programs.

l Run the igmp user watch-limit service-port { hdtv | sdtv | streaming-video }command to set the maximum number of programs at various levels that can be watchedby the multicast user.

3. Set the quick leave mode of the multicast user.

Run the igmp user add service-port index quickleave { immediate | disable | mac-based } command to set the quick leave mode of the multicast user. By default, the quickleave mode is the mac-based mode.

l immediate: After receiving the leave request packet of the multicast user, the systemimmediately deletes the multicast user from the multicast group. This setting isapplicable to the scenario where only one terminal is connected to the same port or theterminal works in the IGMP proxy mode.

l disable: After receiving the leave request packet of the multicast user, the system sendsACK packets to confirm that the multicast user leaves, and then deletes the multicastuser from the multicast group.




Issue 03 (2010-01-28)

l mac-based: It is the quick leave mode based on the MAC address. The system detectsthe MAC address in the leave packet of the user. If it is the same as the MAC addressin the report packet of the user, the system immediately deletes the multicast user fromthe multicast group. Otherwise, the system does not delete the multicast user. In thismode, the application scenario with multiple terminals is supported.

Step 3 Configure multicast user authentication.To control the authority of a multicast user, you can enable the multicast user authenticationfunction.1. Configure the multicast user authentication switch.

Run the igmp user add service-port index { auth | no-auth } command to configurewhether to authenticate a multicast user. The default configuration is no-auth.

NOTE

After configuring multicast user authentication, you need to enable the global authentication switchto make the configuration take effect. By default, the global switch of multicast user authenticationis enabled. You can run the igmp proxy authorization command to change the configuration.

2. Bind the multicast user to a global profile. The multicast user is bound to an authority profileto implement user authentication.

Run the igmp user bind-profile command to bind the user to an authority profile. Afterthe binding, the multicast user uses the authority of the programs configured in the boundprofile.

Step 4 Bind the multicast user to a multicast VLAN.

In the multicast VLAN mode, run the igmp multicast-vlan member command to bind the userto the multicast VLAN. Then, the user becomes a multicast member of the multicast VLAN andcan demand programs configured for the multicast VLAN.

Step 5 Run the display igmp user command to check whether the related information about themulticast user is correct.

----End

ExampleTo add multicast user (port) 0/1/1 to multicast VLAN 101, enable user authentication, enablelog report, set the maximum bandwidth to 10 Mbit/s, and bind the user to right profile music,do as follows:

huawei(config)#service-port 100 vlan 101 gpon 0/1/1 ont 0 gemport 1 rx-cttr 2 tx-cttr 2huawei(config)#btvhuawei(config-btv)#igmp user add service-port 100 auth log enable max-bandwidth 10240huawei(config-btv)#igmp user bind-profile service-port 100 profile-name musichuawei(config-btv)#quithuawei(config)#multicast-vlan 101huawei(config-mvlan10)#igmp multicast-vlan member service-port 100

6.5 (Optional) Configuring the Multicast BandwidthTo limit the multicast bandwidth of a user, you can enable multicast bandwidth management,that is, connection admission control (CAC), and then control the bandwidth of a multicast userby setting the program bandwidth and the user bandwidth.



6-15

PrerequisiteThe program matching mode of the multicast VLAN must be the static configuration mode.

Context

If the CAC function (not the dynamic ANCP CAC function) is enabled and a user demands amulticast program, the system compares the remaining bandwidth of the user (bandwidthconfigured for the user – total bandwidth of the online programs of the user) with the bandwidthof the multicast program. If the remaining bandwidth of the user is sufficient, the system addsthe user to the multicast group. If the bandwidth is insufficient, the system does not respond tothe request of the user.

If the CAC function is disabled, the system does not guarantee the bandwidth of the multicastprogram. When the bandwidth is not guaranteed, problems such as mosaic and delay occur inthe multicast program.

Table 6-7 lists the default settings of the CAC parameters.

Table 6-7 Default settings of the CAC parameters


Global CAC switch enable

Bandwidth of the multicastprogram

5000 kbit/s

Bandwidth of the multicast user no-limit

Bandwidth of the GPON port 716800 kbit/s

Procedure

Step 1 In the global config mode, run the btv command to enter the BTV mode.

Step 2 Enable the global CAC switch.

By default, the global CAC switch is already enabled. You can run the igmp bandwidthCAC{ enable | disable } command to change the setting.

Step 3 Configure the bandwidth of the multicast program.l Run the igmp program add ip ip-addr bandwidth command to configure the bandwidth of

a single multicast program.l Run the igmp bandwidth port frameid/slotid/portid max-bandwidth{ bandwidth | no-

limit } command to configure the program bandwidth of a physical port on a board. Thiscommand is available for only the GPON port. The default bandwidth of a port is 716800kbit/s.

Step 4 Configure the bandwidth of the multicast user.

Run the igmp user add service-port index max-bandwidth command to allocate the bandwidththat is available to the multicast user.




Issue 03 (2010-01-28)

Step 5 Check whether the multicast bandwidth configuration is correct.

l Run the display igmp config global command to check the status of the global CAC switch.

l Run the display igmp program command to query the bandwidth of the multicast program.

l Run the display igmp user command to query the bandwidth of the multicast user.

----End

Example

To enable bandwidth management for multicast users, set the user bandwidth to 10 Mbit/s whenadding multicast user 0/1/1, and configure the program bandwidth to 1 Mbit/s when addingmulticast program 224.1.1.1.

huawei(config)#btv huawei(config-btv)#igmp bandwidthcAC enable huawei(config-btv)#igmp user add port 0/1/1 max-bandwidth 10240 huawei(config-btv)#quit huawei(config)#multicast-vlan 101 huawei(config-mvlan101)#igmp program add ip 224.1.1.1 bandwidth 1024

6.6 (Optional) Configuring Multicast PreviewMulticast preview is an advertizing method provided by carriers for ISPs. The purpose is toallow users to have an overview of a program in a controlled way. In other words, the duration,interval, and count of the user previews are controlled.


Context

The difference between program preview and normal program watching is that, after the usergoes online, the duration of the preview is restricted. When the duration expires, the user goesoffline. The user can request the program again only after the preview interval expires. The countby which the user can request the program within a day (the start time can be configured) isrestricted by the preview count of the user.

Multicast preview parameters are managed through the preview profile. One program can bebound to only one preview profile, but one preview profile can be referenced by multipleprograms.

Table 6-8 lists the default settings of the multicast preview parameters.

Table 6-8 Default settings of the multicast preview parameters


Global multicast previewfunction

enable

Preview profile Preview profile with index 0



6-17


Preview profile parameters Maximum preview duration: 120sMaximum preview count: 8Minimum interval between two previews: 120s

Time for resetting the previewrecord

4:00:00 am

Valid duration of multicastpreview

30s

ProcedureStep 1 In the global config mode, run the btv command to enter the BTV mode.

Step 2 Enable the global multicast preview function.

By default, the global multicast preview function is enabled. You can run the igmp preview{enable | disable } command to change the setting.

Step 3 Configure the preview profile.

Run the igmp preview-profile add command to configure the preview profile, and set theparameters: maximum preview duration, maximum preview count, and minimum intervalbetween two previews. The system has a default preview profile with index 0.

Step 4 Bind the program to the preview profile.

In the multicast VLAN mode, run the igmp program add ip ip-addr preview-profile indexcommand to bind the program to be previewed to the preview profile so that the program hasthe preview attributes as defined in the preview profile. By default, the program is bound to thepreview profile with index 0.

Step 5 Change the time for resetting the preview record.

Run the igmp preview auto-reset-time command to change the time for resetting the previewrecord. The preview record of the user remains valid within one day. On the second day, thepreview record is reset. By default, the system resets the preview record at 4:00:00 a.m.

Step 6 Modify the valid duration of multicast preview.

Run the igmp proxy recognition-time command to modify the valid duration of multicastpreview. If the actual preview duration of the user is shorter than the valid duration, the previewis not regarded as a valid one and is not added to the preview count. By default, the valid durationof multicast preview is 30s.

Step 7 Run the display igmp config global command to check whether the values of the multicastpreview parameters are correct.

----End

ExampleTo enable preview of multicast programs by using the system default preview profile, do asfollows:




Issue 03 (2010-01-28)

huawei(config)#btv huawei(config-btv)#igmp preview enable

To enable preview of multicast programs, create preview profile 1, set the maximum previewtime to 150s, the maximum preview count to 10, and apply this preview profile when addingprogram 224.1.1.1, do as follows:

huawei(config)#btv huawei(config-btv)#igmp preview enable huawei(config-btv)#igmp preview-profile add index 1 duration 150 times 10huawei(config-btv)#quithuawei(config)#multicast-vlan 101huawei(config-mvlan101)#igmp program add ip 224.1.1.1 preview-profile 1

6.7 (Optional) Configuring Program PrejoinIn program prejoin, the MA5600T receives in advance the multicast stream of a program fromthe upper-layer multicast router to the upstream port before a user sends a request to join aprogram, thus shortening the waiting time of the user for requesting the program.


Context

Multicast program prejoin is the same as program request. The MA5600T plays the role of auser and sends the report packet for receiving in advance the multicast stream from the upper-layer multicast router to the upstream port.

After the prejoin function is enabled, if the upper-layer multicast router does not support staticmulticast entry forwarding, the unsolicited report function needs to be enabled so that the usercan request the program quickly. Generally, the upper-layer multicast router processes the userrequest by responding to the group-specific query and the general query.

Table 6-9 lists the default settings of the prejoin parameters.

Table 6-9 Default settings of the prejoin parameters


Prejoin function disable

Unsolicited report of IGMP packets disable

Procedure

Step 1 Enable the prejoin function.Run the igmp program add ip ip-addr prejoin enable command to enable the prejoin functionof a program. By default, the prejoin function is disabled.

Step 2 After the prejoin function is enabled, if the upper-layer multicast router does not support staticmulticast entry forwarding, the unsolicited report function needs to be enabled for IGMP packets.



6-19

l Run the igmp program add ip ip-addr unsolicited enable command to enable theunsolicited report function for IGMP packets. By default, the unsolicited report function isdisabled.

l Run the igmp unsolicited-report interval command to modify the interval for unsolicitedlyreporting IGMP packets. By default, the interval is 10s.

Step 3 Check whether the prejoin function is configured correctly.l Run the display igmp program command to query the status of the prejoin function and the

unsolicited report function.l Run the display igmp config vlan command to query the interval for unsolicitedly reporting

IGMP packets.

----End

ExampleTo enable the prejoin function when adding program 224.1.1.1, do as follows:

huawei(config-mvlan101)#igmp program add ip 224.1.1.1 prejoin enable

6.8 (Optional) Configuring the Multicast Logging FunctionMulticast log serves as a criterion for carriers to evaluate the viewership of multicast programs.

PrerequisiteIf the syslog is used for reporting multicast logs, the syslog server must be properly configured.

ContextMulticast logs have three control levels: multicast VLAN level, multicast user level, andmulticast program level. The system generates logs only when the logging functions at the threelevels are enabled.

When the user stays online for longer than the valid time for generating logs, the system generateslogs in any of the following conditions:l The user goes offline naturally, by force, or abnormally.

l The user is blocked or deleted.

l The program is deleted.

l The program priority is changed.

l The upstream port to which the program is bound changes.

l The VLAN of the upstream port to which the program is bound changes.

l The right mode is switched.

l The user preview times out.

l The IGMP mode is switched.

l The bandwidth CAC is not passed.

The system supports up to 32K logs. When the user goes online, the system records only theonline date and time. The system generates a complete log only when the user goes offline.




Issue 03 (2010-01-28)

The MA5600T can report the multicast log to the log server in the syslog mode and the calldetailed record (CDR) mode. By default, the MA5600T reports the log in the syslog mode.

l Syslog mode: Logs are reported to the syslog server in the form of a single log.

l CDR mode: Logs are reported to the log server in the form of a log file (.cvs). One log filecontains multiple logs.

Table 6-10 lists the default settings of the multicast logging parameters.

Table 6-10 Default settings of the multicast logging parameters


Report mode of the multicast log Syslog mode

Logging function at the multicastVLAN level

enable

Logging function at the multicastuser level

enable

Logging function at the multicastprogram level

enable

Interval for automaticallylogging

2 hours

Minimum online duration forgenerating a valid log

30s

Parameters of the log report in theCDR mode

Report interval: 600sMaximum number of logs that can be reported each time:200

Procedurel Configure the parameters of the logging function of the multicast host.

1. Enable the multicast logging functions.

Multicast logs have three control levels: multicast VLAN level, multicast user level,and multicast program level. The system generates logs only when the loggingfunctions at the three levels are enabled. By default, the three functions are enabled.

– In the BTV mode,run the igmp log { enable | disable } command to configure thelogging function at the multicast VLAN level.

– In the BTV mode,Run the igmp user add service-port index log { enable |disable } command to configure the logging function at the multicast user level.

– In the Multicast VLAN mode,run the igmp program add ip ip-addr log{ enable | disable } command to configure the logging function at the multicastprogram level.

2. Modify the interval for automatically logging.

In the BTV mode,run the igmp proxy log-interval command to modify the intervalfor automatically logging. When the user stays online for a long time, the system



6-21

generates logs at the preset interval. This is to prevent the problem that a log is notgenerated when the user leaves the multicast group without sending a leave packet,which can affect the accounting. By default, the interval is two hours.

3. Modify the minimum online duration for generating a valid log.

In the BTV mode,run the igmp proxy recognition-time command to modify theminimum online duration for generating a valid log. If the user is in a multicast group(such as to preview a program) for shorter than the preset duration, the user operationis not regarded as a valid one and a log is not generated. A log is generated only whena user stays online for longer than the specified duration. By default, the minimumonline duration is 30s.

l Configure the function of CDR-mode log report.1. Configure the multicast log server and the data transmission mode for the CDR-mode

log report.

Run the file-server auto-backup cdr command to configure the active and standbymulticast log servers.

2. Enable the function of CDR-mode log report.

In the BTV mode,run the igmp cdr { enable | disable } command to configure thefunction of CDR-mode log report. After the function is enabled, the MA5600T reportsthe local multicast logs to the multicast log server in the form of a file. After thefunction is disabled, the MA5600T reports each single log to the syslog server in thedefault syslog mode.

3. Configure the parameters of the log report in the CDR mode.– In the BTV mode,run the igmp cdr-interval command to set the report interval.

By default, the interval is 600s.– In the BTV mode,run the igmp cdr-number command to set the maximum number

of logs that can be reported each time. When the number of the multicast logs inthe CDR file reaches the preset value, the MA5600T reports the logs. By default,the maximum number is 200.

4. Check whether the configuration is correct.– Run the display file-server command to query the configuration of the CDR

multicast log server.– Run the display igmp config global command to query the status and other

parameters of the function of CDR-mode log report.

----End

ExampleTo configure the multicast log to be reported to log server 10.10.10.1 in the CDR mode,and usethe TFTP transmission mode, do as follows:

huawei(config)#file-server auto-backup cdr primary 10.10.10.1 tftphuawei(config)#btvhuawei(config-btv)#igmp cdr enable




Issue 03 (2010-01-28)

7 Configuring Redundancy Backup

About This Chapter

The MA5600T provides the powerful redundancy backup mechanism. Redundancy or backupimplements the high reliability and self-healing capability of the system, which maximallypreserves the services provided by carriers and network stability of customers, and minimizesthe loss in case of an accident.

Background InformationIn the carrier-class operation, to ensure that the system still works in the normal state in case ofcertain accidents or disasters, generally, add redundancy (backup) devices or parts to enhancethe reliability of the entire system.

The MA5600T supports the following redundancy backup modes:l LACP aggregation for uplink ethernet port

l Uplink redundancy backup

l Smart link redundancy backup

l MPLS service board redundancy backup

l PON port redundancy backup

l Type B dual homing protection switching

7.1 Configuring the Uplink Redundancy BackupThis topic describes how to configure the uplink aggregation group or uplink protection groupto improve the reliability of service transmission.

7.2 Configuring the GPON Port Redundancy BackupThis topic describes how to configure 1+1 redundancy backup for the GPON service board. Inthis way, when the GPON service board is faulty, the service is not affected.

SmartAX MA5600TCommissioning and Configuration Guide 7 Configuring Redundancy Backup


7-1

7.1 Configuring the Uplink Redundancy BackupThis topic describes how to configure the uplink aggregation group or uplink protection groupto improve the reliability of service transmission.


Redundancy backup for the uplink includes the following information:

l Uplink aggregation group: Aggregate multiple Ethernet ports as an aggregation group toincrease the bandwidth and balance the inbound and outbound load of each member. Inaddition, the ports in an aggregation group back up each other, which enhance the linksecurity.

NOTE

1. The ETH board and GIU slot support the configuration of the aggregation group.

2. Inter-board aggregation is supported between two GIU slots. The ETH board, however, does notsupport inter-board aggregation.

l Upstream port protection group: An upstream port protection group contains a workingport and a protection group. In the normal state, the working port carries services. Whenthe link of the working port fails, the system automatically switches the service on theworking port to the protect port to ensure normal service transmission and to protect theuplink.

NOTEA protection group works in either of the following modes:

1. Port status detection mode.

l Two ports of the protection group or the transmit ports on two boards are enabled. You candetermine whether to perform a switchover according to the port status.

l When the number of ports that are in the up state on the standby board is larger than the numberof ports that are in the up state on the active board, a switchover is triggered.

2. Time delay detection mode.

l Only one transmit port of the protection group is enabled, and the other is disabled.

l When the enabled transmit port is in the down state, disable the transmit port and enable the othertransmit port.

l If the second port is in the up state, a switchover is performed. Otherwise, the detection continues.

Procedurel Configure redundancy backup for the uplink by configuring an aggregation group.

1. Create an Ethernet port aggregation group.Run the link-aggregation command to add multiple upstream Ethernet ports to thesame aggregation group to implement protection and load balancing between ports.

When configuring port aggregation, note that the GIU slot supports inter-boardaggregation. When you run the link-aggregation command, if frameid/slotid isentered twice, inter-board aggregation is configured; if frameid/slotid is entered onlyonce, intra-board aggregation is configured.

2. (Optional) Add members to the aggregation group.

7 Configuring Redundancy BackupSmartAX MA5600T



Issue 03 (2010-01-28)

Run the link-aggregation add-member command to add an Ethernet port to anexisting aggregation port to increase the bandwidth of the aggregation port andimproves the link reliability.

NOTEThis step is optional and is recommended if you need to further increase the bandwidth of anaggregation group or improve the link reliability.

3. Query the information about the aggregation group.Run the display link-aggregation command to query the types, number, and workingmodes of aggregated Ethernet ports.

l Configure redundancy backup for the uplink by configuring an upstream port protectiongroup.1. Create an upstream port protection group.

In the protect mode, run the protect-group command to create an upstream portprotection group. After the protection group is configured successfully, the systemswitches the service over to the standby port to protect the uplink if the connectionbetween the active port and the upper-layer device is broken.

When running the protect-group to create a protection group, if frameid/slotid/portid is entered, a port-level protection group is created; if frameid/slotid is entered,a board-level protection group is created.

NOTE

1. The GIU slot does not support the board-level protection group.

2. The uplink protection group of the GIU slot can work in only the timedelay detection mode.

2. Query the information about the protection group.Run the display protect-group command to query the information about theprotection group and all the members in the protection group.

----End

ExampleAssume the following configurations: The MA5600T transmits services upstream through theGIU slot, upstream ports 0/19/0 and 0/19/1 on the same GIU slot are configured as an upstreamport aggregation group, packets are distributed to the member ports of the aggregation groupaccording to the source MAC address, and the working mode is the LACP static aggregationmode. To perform these configurations, do as follows:

huawei(config)#link-aggregation 0/19 0-1 egress-ingress workmode lacp-static

Assume the following configurations: The MA5600T transmits services upstream through theGIU slot, upstream ports 0/19/0 and 0/19/1 on the same GIU slot are configured as an inter-board aggregation group, packets are distributed to the member ports of the aggregation groupaccording to the source MAC address, and the working mode is the LACP static aggregationmode. To perform these configurations, do as follows:

huawei(config)#link-aggregation 0/19 0 0/20 0 egress-ingress workmode lacp-static

Assume the following configurations: The MA5600T transmits services upstream through theGIU slot, upstream ports 0/19/0 and 0/19/1 on the same GIU slot are configured as an upstreamport protection group, port 0/19/0 functions as the active port, port 0/19/1 functions as theprotection port, the working mode is the delay detection mode, and enable the protection groupfunction. To perform these configurations, do as follows:



7-3

huawei(config-protect)#protect-group first 0/19/0 second 0/19/1 eth workmode timedelay enable

Assume the following configurations: The MA5600T transmits services upstream through theGIU slot, the ports on the active and standby GIU slots are configured as a inter-board protectiongroup, the port in slot 0/19 functions as the active port, the port in 0/20 functions as the protectionport, the working mode is the delay detection mode, and the protection group function is enabled.To perform these configurations, do as follows:

huawei(config-protect)#protect-group first 0/19 second 0/20 eth workmode timedelay enable

7.2 Configuring the GPON Port Redundancy BackupThis topic describes how to configure 1+1 redundancy backup for the GPON service board. Inthis way, when the GPON service board is faulty, the service is not affected.


The GPON port supports redundancy backup on the same board and the redundancy on differentboards. The differences are as follows:

l Port redundancy backup on the same board does not require extra GPON service board,which saves hardware resources. In case that the GPON service board fails, however, theservices on the entire board are interrupted.

l Port redundancy backup on the different boards requires an independent standby GPONservice board, which increases the hardware cost. In the case that the active GPON serviceboard fails, however, the services can be automatically switched over to the GPON portson the standby board, and the service access is not affected.

NOTEOnly GPON boards of the same type support inter-board redundancy backup.

Procedure

Step 1 Create a GPON port protection group.Run the protect-group command to a protection group that protects the ports on the GPONaccess side.

NOTE

1. Configure protect-target to gpon-uni-port.

2. The working mode of the GPON port protection group can be only timedelay.

Step 2 Add members to the protection group.Run the protect-group member command to add members to a protection group.

NOTE

l When adding members to the protection group, add a working member, and then add a protection member.

l Adding a protection group member based on the board is not supported for the GPON port, and only addinga protection group member based on the port is supported.

l The member ports can be ports on different GPON boards, but the GPON board types must be the same.

Step 3 Enable the protection group.

7 Configuring Redundancy BackupSmartAX MA5600T



Issue 03 (2010-01-28)

Run the protect-group enable command to enable the GPON protection group. After aprotection group is created, the protection group is in the disabled state by default. You shouldenable the protection group to make the configuration take effect.

Step 4 Query the information about the protection group.Run the display protect-group command to query the information about the protection groupand all the members in the protection group.

NOTEThe GPON protection group supports the binding to a PPPoE single-MAC address pool. When the PPPoE single-MAC address function is enabled, run the bind mac-pool single-mac command to bind a GPON protectiongroup to a PPPoE single-MAC address. If the GPON protection group is not bound to the PPPoE source MACaddress, when the GPON protection group is switched over, the PPPoE service carried on this port is interrupted.In this case, you must re-dial and determine the service interruption time according to the BRAS configuration.This may fail to meet the switchover performance requirement that the service interruption time must not exceed50 ms.

----End

ExampleTo configure redundancy backup for ports 0/2/0 and 0/2/1 on the same GPON board of theMA5600T so that when port 0/2/0 is faulty, the system can automatically switch the service toport 0/2/1 to continue service access, do as follows:huawei(config)#protect-group 0 protect-target gpon-uni-port workmode timedelayhuawei(protect-group-0)#protect-group member port 0/2/0 role workhuawei(protect-group-0)#protect-group member port 0/2/1 role protecthuawei(protect-group-0)#protect-group enableTo configure inter-board redundancy backup for ports 0/2/0 and 0/3/0 on different GPON boardsof the MA5600T so that when port 0/2/0 is faulty, the system can automatically switch the serviceto port 0/3/0 to continue service access, do as follows:huawei(config)#protect-group 0 protect-target gpon-uni-port workmode timedelayhuawei(protect-group-0)#protect-group member port 0/2/0 role workhuawei(protect-group-0)#protect-group member port 0/3/0 role protecthuawei(protect-group-0)#protect-group enable



7-5

8 Configuring the NE Subtending Throughthe FE or GE Port

The MA5600Ts (NEs) can be directly connected to each other though the FE or GE port.Subtending saves the upstream optical fibers and simplifies networking and serviceconfiguration.

Background Informationl The two ports to be subtended must be the same in the port type, port rate, and port duplex

mode.l If the ETHB board is used for subtending, the network role of the port on the ETHB board

must be set.

Procedure

Step 1 Configure the VLAN of the master NE.The VLAN type is smart, and the VLAN attribute is common. For details about the configuration,see 2.10 Configuring a VLAN.

Step 2 Add an upstream port to the VLAN of the master NE.

Run the port vlan command to add an upstream port to the VLAN.

Step 3 Add a subtending port to the VLAN of the master NE.

Run the port vlan command to add a subtending port to the VLAN.

Step 4 Set the network role of the subtending port of the master NE.This step is required only when the ETHB board is used for subtending.1. Run the interface eth command to enter the ETH mode.2. Run the network-role command to set the network role of the port to subtending.

By default, the port functions as a cascade port.

Step 5 Configure the VLAN of the slave NE. The VLAN of the slave NE is the same as the VLAN ofthe master VLAN.The VLAN type is smart, and the VLAN attribute is common. For details about the configuration,see 2.10 Configuring a VLAN.

SmartAX MA5600TCommissioning and Configuration Guide 8 Configuring the NE Subtending Through the FE or GE Port


8-1

Step 6 Add an upstream port to the VLAN of the slave NE.

Run the port vlan command to add an upstream port to the VLAN.

----End

ExampleAssume that master NE huawei_A and slave NE huawei_B are subtended through the GIU board.To add upstream port 0/19/0 and subtending port 0/19/1 of huawei_A to VLAN 100, and addupstream port 0/19/0 of huawei_B to VLAN 100, do as follows:

huawei_A(config)#vlan 100 smarthuawei_A(config)#port vlan 100 0/19 0huawei_A(config)#port vlan 100 0/19 1

huawei_B(config)#vlan 100 smarthuawei_B(config)#port vlan 100 0/19 0

Assume that master NE huawei_A and slave NE huawei_B are subtended through the ETHBboard. To add upstream port 0/19/0 and subtending port 0/6/0 of huawei_A to VLAN 100, andadd upstream port 0/19/0 of huawei_B to VLAN 100, do as follows:

huawei_A(config)#vlan 100 smarthuawei_A(config)#port vlan 100 0/19 0huawei_A(config)#port vlan 100 0/6 0huawei_A(config)#interface eth 0/6huawei_A(config-if-eth-0/6)#network-role cascadehuawei_A(config-if-eth-0/6)#quit

huawei_B(config)#vlan 100 smarthuawei_B(config)#port vlan 100 0/19 0

8 Configuring the NE Subtending Through the FE or GE PortSmartAX MA5600T



Issue 03 (2010-01-28)

9 FTTx Solution Configuration

About This Chapter

The FTTx solution configuration describes how to configure typical FTTH, FTTB/C, FTTO,and FTTM services (such as high-speed Internet access, multicast, VoIP, and mobile bearerservices) on the OLT and the ONU step by step through examples.

9.1 Configuration Example of the FTTx Service (GPON Access)This topic describes how to configure the Internet access service, voice service, multicast service,and mobile bearer service in the GPON access mode in various FTTx scenarios.

9.2 Configuring the P2P Optical Fiber Access ServiceThis topic describes the P2P optical fiber access technology and how to configure the P2P opticalfiber access service on the OLT.

SmartAX MA5600TCommissioning and Configuration Guide 9 FTTx Solution Configuration


9-1

9.1 Configuration Example of the FTTx Service (GPONAccess)

This topic describes how to configure the Internet access service, voice service, multicast service,and mobile bearer service in the GPON access mode in various FTTx scenarios.

Context

The description in this topic is based on the GPON profile mode. You can query the currentGPON mode in the diagnose mode.

huawei(config)#diagnosehuawei(diagnose)%%display xpon mode --------------------------------------------------- Current config mode: Profile-mode ---------------------------------------------------

9.1.1 FTTx NetworkFTTx applications include FTTH, FTTB, FTTC, FTTO, FTTM, and VIP P2P access.

9.1.2 FTTx Data Plan (GPON Access)This topic plans the data in a unified manner for connecting to the OLT in the FTTx GPONaccess mode for various example networks. The subsequent examples are configured based onthe following data plan.

9.1.3 Configuring the FTTH ServiceThis topic describes how to configure the Internet access, VoIP, and IPTV services in the FTTHGPON access mode.

9.1.4 Configuring the FTTB and FTTC Access ServicesThis topic describes how to configure the Internet access, voice and multicast in the FTTB andFTTC Access Services.

9.1.5 Configuring the FTTO (OLT+OT928G) ServiceThrough the MA5600T+OT928G network, the fiber to the office (FTTO) solution is providedfor enterprise users. This topic describes how to configure the TDM PBX access and enterpriseEthernet private access service in the FTTO scenario.

9.1.6 Configuring the FTTM (OLT+OT928G) ServiceIn the FTTM network, the OT928G functions as a base station AG and is connected to the 2Gor 3G base station in various modes. After the OLT transmits signals upstream to the upper-layer network, the OT928G is connected to the base station controller (BSC) or radio networkcontroller (RNC) to implement the 2G or 3G service through the FTTM network.

9.1.7 Configuring the FTTM (OLT+ATN930) ServiceIn the FTTM network, the ATN930 functions as a base station AG and is connected to the 2Gor 3G base station in various modes. After the OLT transmits signals upstream to the upper-layer network, the ATN930 is connected to the base station controller (BSC) or radio networkcontroller (RNC) to implement the FTTM network application over the 2G or 3G network.

9.1.1 FTTx NetworkFTTx applications include FTTH, FTTB, FTTC, FTTO, FTTM, and VIP P2P access.

9 FTTx Solution ConfigurationSmartAX MA5600T



Issue 03 (2010-01-28)

NetworkFigure 9-1 shows an example network of full access services in the FTTx scenario. FTTxapplications include FTTH, FTTB, FTTC, FTTO, FTTM, and VIP P2P access.

l FTTH indicates fiber to the home. The ONT is connected to the OLT in the PON mode toimplement FTTH. The voice, data, and video services are provided through a single opticalfiber.

l FTTB/FTTC indicates fiber to the building/fiber to the curb. The MDU is connected to theOLT in the PON mode to implement FTTB/FTTC, and provides voice, data, and videoservices for the users in communities.

l FTTO indicates fiber to the office. The SBU is connected to the OLT in the PON mode toimplement FTTO. In this way, the Intranet TDM PBX, Intranet IP PBX, and Intranet privateline services are provided.

l FTTM indicates fiber to the mobile base station. The CBU is connected to the OLT in thePON mode to implement base station backhaul.

l P2P indicates point to point. The VIP household and enterprise users can be directlyconnected to the OLT through GE optical fibers to implement end-to-end QoS.

Figure 9-1 Example network of full access services in the FTTx scenario



9-3

9.1.2 FTTx Data Plan (GPON Access)This topic plans the data in a unified manner for connecting to the OLT in the FTTx GPONaccess mode for various example networks. The subsequent examples are configured based onthe following data plan.

Data Plan

Table 9-1 provides the unified data plan for configuring the HSI, IPTV, VoIP, emulationservices, and private line services in an FTTx network.

NOTE

The ONU in the data plan refers to the ONT and the MDU collectively.

Table 9-1 Data plan for the FTTx GPON access

ServiceClassification

Item Data Remarks

Networkdata

FTTH OLT PON port: 0/1/1ONT ID: 1

In the currentnetwork, FTTH,FTTB, and FTTCcan be implementedon the same OLT.Generally, differentslots are used for theimplementation.Implementingvarious FTTxnetworksconcurrently,however, is notrecommended ingeneral.

FTTB/C OLT PON port: 0/2/1ONT ID: 1

FTTO/M OLT PON port: 0/3/1ONT ID: 1

P2P FE ports of the OPFA board onthe OLT:l 0/5/1

l 0/5/2

l 0/5/3

Devicemanagement

Inband NMS IPaddress of the OLT

192.168.50.1/24 To configure theMDU from the OLTby logging in to theMDU throughTelnet, themanagement VLANof the OLT and thatof the MDU must bethe same, and themanagement IPaddress of the OLTand that of the MDUmust be in the samenetwork segment.In the GPON access,the network

ManagementVLAN of the OLT

4000

Inband NMS IPaddress of the MDU

192.168.50.2/24

ManagementVLAN of the MDU

4000




Issue 03 (2010-01-28)


Item Data Remarks

Inband gateway IPaddress of the MDU

192.168.50.254/24 managementprotocol of theMDU adopts SNMPand that of the ONTadopts OMCI.

ServiceVLAN

HSI service HG: PVC 8/35, untagONU VLAN: 1001-1024OLT VLANs:l CVLAN (using the VLAN

of the ONU): 1001-1024l SVLAN: 100

l For the Internetaccess service,you can use twoprecisely-boundVLAN tags toextend VLANsand identifyusers. On theONU, each useris allocated with aCVLAN. On theOLT, each OLT,each slot of theOLT, or eachPON port can beallocated with anSVLAN.

l The ONUVLANs of thesame OLT mustbe planned in aunified mannerand each ONUVLAN ID mustbe unique.

IPTV service Multicast VLAN: 1000 Generally, multicastVLANs are dividedaccording tomulticast sources.



9-5


Item Data Remarks

VoIP service HG: PVC 8/40; VLAN ID: 3ONU VLAN: 200OLT VLAN (VLANtransparently transmitting theONU service): 200

Generally, the VoIPservice can beidentified by asingle VLAN tag.Each OLT, each slotof the OLT, or eachPON port can beallocated with aVLAN to reduceVLAN broadcastdomains.

Emulation service TDM emulation SVLAN: 500ATM emulation SVLAN: 700ETH emulation SVLAN: 800

They are theSVLANs of theOLT thattransparentlytransmit the ONUservice.

QinQ private lineservice

ONU SVLAN: 2000OLT VLAN (VLANtransparently transmitting theONU service): 2000

QinQ is used toimplement the L2VPN private lineservice. In the caseof FTTH, enableQinQ on the OLT; inthe case of FTTB/FTTC, enable QinQon the ONU.Each slot of the OLTcan be allocatedwith an SVLAN toreduce VLANbroadcast domains.

QoS(priority)

HSI service Priority: 1; queue scheduling:WRR

Generally, the QoSpriorities are NMSservice and IP voiceservice > privateline service > IPTVservice > Internetaccess service in adescending order.Generally, thepriority is set on theONU, and the OLTinherits the priorityset on the ONU.

IPTV service Priority: 4; queue scheduling:WRR

VoIP service Priority: 6; queue scheduling:PQ

Emulation service Priority: 6; queue scheduling:PQ


Priority: 5; queue scheduling:PQ




Issue 03 (2010-01-28)


Item Data Remarks

QoS (DBA) HSI service l Profile name: PPPOE

l Profile type: Type4

l Maximum bandwidth: 100Mbit/s

l T-CONT ID: 4

DBA is used tocontrol the upstreambandwidth of theONU. DBA profilesare bound toTCONTs. DifferentTCONTs areplanned for differentbandwidthassurance types.Generally, theservice with a highpriority adopts afixed bandwidth oran assuredbandwidth, and theservice with a lowpriority adopts themaximumbandwidth or besteffort.

IPTV service l Profile name: IPTV



l T-CONT ID: 3

VoIP service l Profile name: VOIP


l Assured bandwidth: 15Mbit/s


l T-CONT ID: 2

Emulation service l Profile name:– For TDM emulation:

TDM– For ADM emulation:

ATM– For ETH emulation: ETH


l Fixed bandwidth 32 Mbit/s

l T-CONT ID: 1


l Profile name: PrivateLine


l Assured bandwidth: 20Mbit/s


l T-CONT ID: 5

QoS (CAR) Emulation service No rate limitation in theupstream and downstreamdirections

Traffic control canbe implemented onthe BRAS, or on theOLT or ONU by



9-7


Item Data Remarks

VoIP service No rate limitation in theupstream and downstreamdirections

using port ratelimitation or using atraffic profile tolimit the upstreamand downstreamtraffic.Generally, in thecase of FTTH, limitthe rate on the OLT;in the case of FTTB/FTTC, limit the rateon the ONU.

IPTV service No rate limitation in theupstream and downstreamdirections

HSI service Upstream and downstreambandwidth: 4 Mbit/s

IPTVservice data

Multicast protocol OLT: IGMP proxyONU: IGMP snooping

Multicast version IGMP V3 IGMP v3 and IGMPv2 are supported,and IGMP v3 iscompatible withIGMP v2.

Multicast programconfiguration mode

Static configuration mode The OLT can alsogenerate a multicastprogram library,that is, dynamicallygenerate a programlist according to theprograms requestedby users. In thismode, the programlist need not beconfigured ormaintained;however, thefunctions such asprogrammanagement, usermulticast bandwidthmanagement,program preview,and program prejoinare not supported.

IP address of themulticast server

10.10.10.10

Multicast program 224.1.1.10




Issue 03 (2010-01-28)


Item Data Remarks

VoIP servicedata

Signaling and mediaIP addresses

17.10.10.10/24 H.248 and SIPsupport separatemedia andsignaling. Themedia and signalingIP address can be thesame or different.

Gateway IP address 17.10.10.0/24

MG interface (H.248)NOTE

The parameters of theMG interface must bethe same as theparameters on theMGC. H.248 hasmany negotiationparameters, and theparameters here aremandatory.

MG interface ID: 0 It is the MGinterface ID used forthe VoIP service tobe configured,which determinesthe virtual accessgateway (VAG)specified for theuser.

Signaling port ID of the MGinterface: 2944

It is the transportlayer protocol portID used for thesignaling exchangebetween the MG andthe MGC.

IP address of the primary MGCto which the MG interfacebelongs: 200.200.200.200/24

When dual homingis configured, the IPaddress and the portID of the secondaryMGC must also beconfigured.

Port ID of the primary MGC towhich the MG interfacebelongs: 2944

Coding mode of the MGinterface: text

-

Transmission mode of the MGinterface: UDP

The transmissionmode of the MGinterface is selectedaccording to therequirements on theMGC. Generally,UDP is adopted.



9-9


Item Data Remarks

SIP interface (SIP)NOTE

The parameters of theSIP interface must bethe same as theparameters on thesoftswitch. SIP hasmany negotiationparameters, and theparameters here aremandatory.

SIP interface ID: 0 It is the SIP interfaceID used for the VoIPservice to beconfigured, whichdetermines thevirtual accessgateway (VAG)specified for theuser.

Signaling port ID of the SIPinterface: 5056

IP address of the primarysoftswitch to which the SIPinterface belongs:200.200.200.200/24

When dual homingis configured, the IPaddress and the portID of the secondarysoftswitch must alsobe configured.Port ID of the primary

softswitch to which the SIPinterface belongs: 5060/24

Coding mode of the SIPinterface: text

Transmission mode of the SIPinterface: UDP

The transmissionmode is selectedaccording to therequirements on thesoftswitch.Generally, UDP isadopted.

Home domain of the SIPinterface: huawei




Issue 03 (2010-01-28)


Item Data Remarks

Index of the profile used by theSIP interface: 1

Different profileindexes are used forinterconnectionwith non-Huaweisoftswitches. Youcan run the if-h248attribute profile-index command toquery the profileindex. Forinterconnectionwith a ZTEsoftswitch, useprofile 5; forinterconnectionwith a Bellsoftswitch, noconstant profile isused. Profile 0 canbe used and the datais negotiated withthe Bell softswitch.

PSTN users phone1-phone24:83110001-83110024

User priorities: Phone 1: Cat2;Phone 2-Phone 24: Cat3(default)

According to theservicerequirements, userpriorities must bespecified. The userpriorities include thefollowing:l cat1:

government1(category 1governmentusers)

l cat2:government2(category 2governmentusers)

l cat3: common(common users)

Emulationservice data

Local LSR ID 10.10.10.10/32 Generally, the IPaddress of the



9-11


Item Data Remarks

Remote (OLT) LSRID

loopback interfaceis used as the LSRID.

10.20.20.20/32

Remote (PTN) LSRID

30.30.30.30/32

9.1.3 Configuring the FTTH ServiceThis topic describes how to configure the Internet access, VoIP, and IPTV services in the FTTHGPON access mode.

ContextAs shown in Figure 9-2, in the FTTH scenario, users are connected to the OLT through the ONTin the GPON mode to implement the Internet access, VoIP, and IPTV services.

Figure 9-2 Example network of the FTTH service

9.1.3.1 Configuring the FTTH Internet Access ServiceThe OLT is connected to the remote ONT through a GPON port to provide users with the high-speed Internet access service.

9.1.3.2 Configuration Example of the FTTH VoIP Service (H.248-based)The OLT is connected to the remote ONT through a GPON port to provide users with the IP-based high-quality and low-cost VoIP service.

9.1.3.3 Configuration Example of the FTTH VoIP Service (SIP-based)The OLT is connected to the remote ONT through a GPON port to provide users with the IP-based high-quality and low-cost VoIP service.

9.1.3.4 Configuring the FTTH IPTV ServiceThe OLT is connected to the remote ONT through a GPON port to provide users with the IPTVservice.




Issue 03 (2010-01-28)

9.1.3.1 Configuring the FTTH Internet Access Service

The OLT is connected to the remote ONT through a GPON port to provide users with the high-speed Internet access service.

Service Requirementsl The user PC is connected to the ONT through the LAN port in the PPPoE dialing mode.

The ONT is connected to the OLT and then to the upper-layer network in the GPON modeto provide the high-speed Internet access service.

l The high-speed Internet access service is identified by two precisely-bound VLAN tags.On the ONT, each user is allocated with a CVLAN; on the OLT, each slot is allocated withan SVLAN.

l The high-speed Internet access service adopts a bandwidth-ensured mode with themaximum bandwidth 100 Mbit/s as the DBA profile and performs the 4 Mbit/s ratelimitation on both the upstream and downstream directions.

Table 9-2 Data plan

Item Data

OLT Service VLAN ID: 100Service VLAN type: SmartService VLAN attribute: q-in-qUpstream port: 0/19/0

ONT ONT ID: 1ID of the port on the ONT that is connected to the PC: 1Type of the port on the ONT that is connected to the PC:ETHVLAN ID of the port on the ONT that is connected to thePC: 10

Prerequisitel The OLT is connected to the BRAS.

l Related configurations are performed on the BRAS according to the authentication andaccounting requirements for dialup users. For details about the configuration, see thecorresponding configuration guide.

l The VLAN of the LAN switch port connected to the OLT is the same as the upstreamVLAN of the OLT.

Procedurel Configure the OLT:

1. Create a service VLAN and add an upstream port to it.The VLAN ID is 100, and the VLAN is a smart VLAN, VLAN attribute is QinQ. Addupstream port 0/19/0 to VLAN 100.



9-13

huawei(config)#vlan 100 smarthuawei(config)#vlan attrib 100 q-in-qhuawei(config)#port vlan 100 0/19 0

2. Configure a traffic profile.

You can run the display traffic table ip command to query the traffic profiles existingin the system. If the traffic profiles existing in the system do not meet the requirements,you need to run the traffic table ip command to add a traffic profile.

The profile ID is 8, the CIR is 4 Mbit/s, the priority is 1, and packets are scheduledaccording to the priority carried.huawei(config)#traffic table ip index 8 cir 4096 priority 1 priority-policy tag-In-Packag

3. Add a DBA profile.

You can run the display dba-profile command to query the DBA profiles existing inthe system. If the DBA profiles existing in the system do not meet the requirements,you need to run the dba-profile add command to add a DBA profile.

Configure the DBA profile ID to 10, type to type4, and upstream bandwidth to 100Mbit/s.huawei(config)#dba-profile add profile-id 10 type4 max 102400

4. (Optional) Add an alarm profile.– The ID of the default GPON alarm profile is 1. The thresholds of all the alarm

parameters in the default alarm profile are 0, which indicates that no alarm isreported.

– In this example, the default alarm profile is used, and therefore the configurationof the alarm profile is not required.

– Run the gpon alarm-profile add command to configure an alarm profile, whichis used for monitoring the performance of an activated ONT line.

5. Add an ONT line profile.Add GPON ONT line profile 10 and bind T-CONT 4 to the DBA profile 10. In thisway, the T-CONT can provide flexible DBA solutions based on differentconfigurations in the DBA profile.huawei(config)#ont-lineprofile gpon profile-id 10huawei(config-gpon-lineprofile-10)#tcont 4 dba-profile-id 10

Add GEM port 1 for transmitting ETH traffic streams and bind GEM port 1 to T-CONT 4. The QoS mode is priority-queue (default).

NOTE

1. To change the QoS mode, run the qos-mode command to configure the QoS mode to gem-caror flow-car, and run the gem add command to configure the ID of the traffic profile bound tothe GEM port.

2. When the QoS mode is PQ, the default queue priority is 0; when the QoS is flow-car, trafficprofile 6 is bound to the port by default (no rate limitation); when the QoS mode is gem-car,traffic profile 6 is bound to the port by default (no rate limitation).

huawei(config-gpon-lineprofile-10)#gem add 1 eth tcont 4

Configure the service mapping mode from the GEM port to the ONT to VLAN(default), and map CVLAN 10 to GEM port 1.huawei(config-gpon-lineprofile-10)#mapping-mode vlanhuawei(config-gpon-lineprofile-10)#gem mapping 1 0 vlan 10huawei(config-gpon-lineprofile-10)#commithuawei(config-gpon-lineprofile-10)#quit




Issue 03 (2010-01-28)

NOTEAfter a profile is configured, run the commit command to make the configuration take effect beforethe system quits the profile mode.

6. Add an ONT service profile.The service profile type should be consistent with the actual ONT type. Consideringthe HG850a as an example, configure four ETH ports and two POTS ports. The IDof the VLAN to which the ETH ports 1 belong is 10.huawei(config)#ont-srvprofile gpon profile-id 10huawei(config-gpon-srvprofile-10)#ont-port eth 4 pots 2huawei(config-gpon-srvprofile-10)#port vlan eth 1 10huawei(config-gpon-srvprofile-10)#commithuawei(config-gpon-srvprofile-10)#quit


7. Add an ONT.The ONT is connected to GPON port 0/1/1. Configure the ONT ID to 1, SN to32303131D659FD40, management to OMCI, the bound line profile ID is 10, and thebound service profile ID is 10.

NOTE

l You can run the ont add command to add an ONT offline or run the ont confirm command toconfirm an automatically discovered ONT.

l Before confirming an automatically discovered ONT, you must run the port portid ont-auto-find command in the GPON mode to enable the ONT automatic discovery function of the port.

l In this example, the method of confirming an automatically discovered ONT is used.huawei(config)#interface gpon 0/1huawei(config-if-gpon-0/1)#port 1 ont-auto-find enablehuawei(config-if-gpon-0/1)#display ont autofind 1 ------------------------------------------------------------------------ Number F/ S/ P SN Password ------------------------------------------------------------------------ 1 0/ 1/ 1 32303131D659FD40 ------------------------------------------------------------------------huawei(config-if-gpon-0/1)#ont confirm 1 ontid 1 sn-auth 32303131D659FD40 omci ont-lineprofile-id 10 ont-srvprofile-id 10 desc HG850a

NOTE

l After an ONT is added, it is recommended that you run thedisplay ont info command toquery the ONT status. In this step, ensure that Config State and Match State of the ONTare normal and match respectively.

l If the ONT state in the actual query result is different from the preceding description, runthe display ont capability command to query the actual ONT capabilities, and then add aproper ONT profile based on the queried ONT capabilities. Then, add an ONT again.

8. (Optional) Bind the alarm profile to the ONT.The default alarm profile (profile 1) is adopted.huawei(config-if-gpon-0/1)#ont alarm-profile 1 1 profile-id 1

9. Specify the VLAN for the ONT port.ETH port 1 on the ONT is connected to the PC and the native VLAN is VLAN 10.huawei(config-if-gpon-0/1)#ont port native-vlan 1 1 eth 1 vlan 10

10. Add a service port to the VLAN.



9-15

Configure the management service port ID to 1, SVLAN ID to 100, GEM port ID to1, and CVLAN ID to 10. Use traffic profile 8.huawei(config-if-gpon-0/1)#quithuawei(config)#service-port 1 vlan 100 gpon 0/1/1 ont 1 gemport 1 multi-service user-vlan 10 rx-cttr 8 tx-cttr 8

11. Configure queue scheduling.

Use the 3PQ+5WRR queue scheduling. Queues 0-4 adopt the WRR mode, with theweights of 10, 10, 20, 20, and 40 respectively; queues 5-7 adopt the PQ mode. Thepriority of the HSI service is 1, adopting the WRR scheduling.

NOTEQueue scheduling is a global configuration. You need to configure queue scheduling only once onthe OLT, and then the configuration takes effect globally. In the subsequent phases, you need notconfigure queue scheduling repeatedly when configuring other services.huawei(config)#queue-scheduler wrr 10 10 20 20 40 0 0 0

Configure the mapping between queues and 802.1p priorities. Priorities 0-7 mapqueues 0-7 respectively.

huawei(config)#cos-queue-map cos0 0 cos1 1 cos2 2 cos3 3 cos4 4 cos5 5 cos6 6 cos7 7

NOTEFor the service board that supports only four queues, the mapping between 802.1p priorities andqueue IDs is as follows: priorities 0 and 1 map queue 1; priorities 2 and 3 map queue 2; priorities 4and 5 map queue 3; priorities 6 and 7 map queue 4.


l Configure the ONT. Consider the HG850a as an example. The configurations on othertypes of ONTs are similar.

NOTE

l If PPPoE dialing is directly performed on the PC, the ONT need not be configured.

l If PPPoE dialing is performed on the ONT, the ONT needs to be configured.

1. Configure the IP address of the PC network adapter to be in the same network segmentwith the IP address of the local maintenance Ethernet port of the HG850a (default:192.168.100.1).

2. Open the Web browser, and enter the IP address of the local maintenance Ethernetport of the HG850a.

3. On the login interface, enter the user name (default: telecomadmin) and password(default: admintelecom) of the administrator. After the password authentication ispassed, the Web configuration interface is displayed.

4. In the navigation pane, choose Basic > WAN. In the interface that is displayed, youcan browse and configure the WAN port of the HG850a, as shown in Figure 9-3.




Issue 03 (2010-01-28)

Figure 9-3 ONT parameters

Table 9-3 ONT parameters

Parameter Description

Enabled Choose Enable to make the configuration take effect.

Service List Choose Internet from the Service List drop-down list.

VLAN ID Indicates the C-VLAN ID.

IPGetMode Indicates the IP address obtaining mode.

NAT Indicates the network address translation (NAT).

NAT Type Indicates the NAT type.

Username Indicates the user name for the simulated PPPoEdialing access.

Password Indicates the password for the simulated PPPoEdialing access.

Binding Options Indicates binding to the L3 LAN port for the dataservice. The selected LAN port indicates that the WANport is bound to the LAN port. This WAN port can beconsidered as a route.

5. After the parameters are configured as shown in Figure 9-3, click Apply to make the

configuration take effect.6. In the navigation pane, choose Status > Device. In the interface that is displayed, click

the WAN tab. Then you can see that the status is displayed as Connected, as shownin Figure 9-4.



9-17

Figure 9-4 Querying the ONT status

----End

ResultConnect the ONT to the PC, and perform dialing on the PC by using the PPPoE dialing software.After the dialing is successful, the user can access the Internet.

Configuration Filevlan 100 smartvlan attrib 100 q-in-qport vlan 100 0/19 0traffic table ip index 8 cir 4096 priority 1 priority-policy tag-In-Packagdba-profile add profile-id 10 type4 max 102400ont-lineprofile gpon profile-id 10 tcont 4 dba-profile-id 10 gem add 1 eth tcont 4 mapping-mode vlan gem mapping 1 0 vlan 10 commit quitont-srvprofile gpon profile-id 10 ont-port eth 4 pots 2 port vlan eth 1 10 commit quitinterface gpon 0/1port 1 ont-auto-find enabledisplay ont autofind 1ont confirm 1 ontid 1 sn-auth 32303131D659FD40 omci ont-lineprofile-id 10 ont-srvprofile-id 10 desc HG850aont alarm-profile 1 1 profile-id 1ont port native-vlan 1 1 eth 1 vlan 10quitservice-port 1 vlan 100 gpon 0/1/1 ont 1 gemport 1 multi-service user-vlan 10 rx-cttr 8 tx-cttr 8queue-scheduler wrr 10 10 20 20 40 0 0 0cos-queue-map cos0 0 cos1 1 cos2 2 cos3 3 cos4 4 cos5 5 cos6 6 cos7 7save

9.1.3.2 Configuration Example of the FTTH VoIP Service (H.248-based)The OLT is connected to the remote ONT through a GPON port to provide users with the IP-based high-quality and low-cost VoIP service.




Issue 03 (2010-01-28)

Service Requirementsl The ONT is connected to the MGC through H.248.

l The ONT obtains the IP address through DHCP.

l Two phone sets are connected to two TEL ports of the ONT respectively, and calls can bemade between two phone sets.

l The DBA mode of the VoIP service is assured bandwidth + maximum bandwidth, and norate limitation is performed on the upstream and downstream traffic.

Table 9-4 Data plan

Item Data

OLT S-VLAN ID: 200S-VLAN type: smart VLANUpstream port: 0/19/0C-VLAN ID: 20

ONT ONT ID: 1

Prerequisitel The interface data and the PSTN user data corresponding to the MG interface must be

configured on the MGC.l The OLT must be connected to the MGC.


1. Create a service VLAN and add an upstream port to it.The VLAN ID is 200, and the VLAN is a smart VLAN. Add upstream port 0/19/0 toVLAN 200.huawei(config)#vlan 200 smarthuawei(config)#port vlan 200 0/19 0



The profile ID is 9, no rate limitation in the upstream and downstream directions, thepriority is 6, and packets are scheduled according to the priority carried.huawei(config)#traffic table ip index 9 cir off priority 6 priority-policy tag-In-Packag


You can run the display dba-profile command to query the traffic profiles existingin the system. If the traffic profiles existing in the system do not meet the requirements,you need to run the dba-profile add command to add a traffic profile.

Configure the profile ID to 20, type to type3, assured bandwidth to 15 Mbit/s, andmaximum bandwidth to 30 Mbit/s.



9-19

huawei(config)#dba-profile add profile-id 20 type3 assure 15360 max 30720

4. (Optional) Add an alarm profile.

– The ID of the default GPON alarm profile is 1. The thresholds of all the alarmparameters in the default alarm profile are 0, which indicates that no alarm isreported.





NOTE




Configure the service mapping mode from the GEM port to the ONU to VLAN(default), and map CVLAN 20 to GEM port 2.huawei(config-gpon-lineprofile-10)#mapping-mode vlanhuawei(config-gpon-lineprofile-10)#gem mapping 2 1 vlan 20huawei(config-gpon-lineprofile-10)#commithuawei(config-gpon-lineprofile-10)#quit


6. Add an ONT service profile.The service profile type should be consistent with the actual ONT type. Consideringthe HG850a as an example, configure four ETH ports and two POTS ports.huawei(config)#ont-srvprofile gpon profile-id 10huawei(config-gpon-srvprofile-10)#ont-port eth 4 pots 2huawei(config-gpon-srvprofile-10)#commithuawei(config-gpon-srvprofile-10)#quit






Issue 03 (2010-01-28)

NOTE



l In this example, the method of confirming an automatically discovered ONT is used.

huawei(config)#interface gpon 0/1huawei(config-if-gpon-0/1)#port 1 ont-auto-find enablehuawei(config-if-gpon-0/1)#display ont autofind 1 ------------------------------------------------------------------------ Number F/ S/ P SN Password ------------------------------------------------------------------------ 1 0/ 1/ 1 32303131D659FD40 ------------------------------------------------------------------------huawei(config-if-gpon-0/1)#ont confirm 1 ontid 1 sn-auth 32303131D659FD40 omci ont-lineprofile-id 10 ont-srvprofile-id 10 desc HG850a

NOTE



8. (Optional) Bind the alarm profile to the ONU.The default alarm profile (profile 1) is adopted.huawei(config-if-gpon-0/1)#ont alarm-profile 1 1 profile-id 1

9. Add a service port to the VLAN.Configure the service port ID to 2, SVLAN ID to 200, GEM port ID to 2, and CVLANID to 20. Bind traffic profile 9 to the service port.huawei(config-if-gpon-0/1)#quithuawei(config)#service-port 2 vlan 200 gpon 0/1/1 ont 1 gemport 2 multi-service user-vlan 20 rx-cttr 9 tx-cttr 9


Use the 3PQ+5WRR queue scheduling. Queues 0-4 adopt the WRR mode, with theweights of 10, 10, 20, 20, and 40 respectively; queues 5-7 adopt the PQ mode. Thepriority of the VOIP service is 6, adopting the PQ scheduling.






9-21




NOTE

In the case of the HG850a, to provide voice services of different versions, you must select different ONTsoftware versions. Before the configuration, ensure that the current software version of the HG850asupports H.248. Currently, the H.248 protocol is supported by V100R001C02, V100R001C04.

1. Log in to the BMS V200R012C05 and enable FTP.2. Choose Profile > ONT VAS Profile from the main menu.3. In the ONT VAS Profile, right-click and choose Add.4. In the dialog box that is displayed, set parameters such as Profile Name, Vendor

ID, Terminal Type, and Version. The detailed settings are as follows:– Profile Name: VOIPHG850a

– Vendor ID: HWTC

– Terminal Type: EchoLife:HG850a

– Version: V1R1C01B010-Later

5. Choose Layer3 > WANInterface. Right-click and choose add.6. As shown in Figure 9-5, click the added WAN property configuration 1, and then

configure parameters WAN VLAN ID, IP get mode, and WAN Service Type asfollows:– WAN VLAN ID: 20 (the same as the CVLAN on the OLT)

– IP get mode: DHCP

– WAN Service Type: VOIP

Adopt the default settings for other parameters.




Issue 03 (2010-01-28)

Figure 9-5 WAN interface configuration

7. Click Voice > Country code and signaling protocol. In the right pane, select thecountry code according to actual conditions. Then, configure Signal Protocol toH248, as shown in Figure 9-6.



9-23

Figure 9-6 ONT VAS Profile

8. Click H.248 Global digitmap configure. In the right pane, configure Digitmap tox.T.

9. As shown in Figure 9-7. Choose H.248MGC > H.248 protocol basic configure. Inthe right pane, configure MGC server IP and MGC port to the following values:– MGC server IP: 200.200.200.200

– MGC port: 2944

NOTE

You can configure the IP address of the MGC server only after deleting the default MGC domain.




Issue 03 (2010-01-28)

Figure 9-7 MGC configure

10. Click OK.11. In the Physical Map navigation tree on the Main Topology tab, double-click the

required OLT, or select the required OLT, right-click, and choose DeviceManagement.

12. In the navigation tree, choose GPON > GPON ONU.13. Click the GPON ONU tab and enter the filtering criterion to query the GPON ONU

records.14. In the information list, select HG850a, right-click, and choose Bind VAS Profile.15. In the dialog box that is displayed, select profile VOIPHG850 and click OK.

----End

ResultConnect two phone sets to two TEL ports on the ONT, and calls can be made between two phonesets.

Configuration Filevlan 200 smartport vlan 200 0/19 0traffic table ip index 9 cir off priority 6 priority-policy tag-In-Packag



9-25

dba-profile add profile-id 20 type3 assure 16384 max 26624ont-lineprofile gpon profile-id 10 tcont 2 dba-profile-id 20 gem add 2 eth tcont 2 mapping-mode vlan gem mapping 2 1 vlan 20 commit quitont-srvprofile gpon profile-id 10 ont-port eth 4 pots 2 commit quitinterface gpon 0/1port 1 ont-auto-find enabledisplay ont autofind 1ont confirm 1 ontid 1 sn-auth 32303131D659FD40 omci ont-lineprofile-id 10 ont-srvprofile-id 10ont alarm-profile 1 1 profile-id 1quitservice-port 2 vlan 200 gpon 0/1/1 ont 1 gemport 2 multi-service user-vlan 20 rx-cttr 9 tx-cttr 9queue-scheduler wrr 10 10 20 20 40 0 0 0cos-queue-map cos0 0 cos1 1 cos2 2 cos3 3 cos4 4 cos5 5 cos6 6 cos7 7save

9.1.3.3 Configuration Example of the FTTH VoIP Service (SIP-based)The OLT is connected to the remote ONT through a GPON port to provide users with the IP-based high-quality and low-cost VoIP service.

Service Requirementsl The ONT is connected to the SIP server through SIP.

l The ONT obtains the IP address through DHCP.

l Two phone sets are connected to two TEL ports of the ONT respectively, and calls can bemade between two phone sets.

l The DBA mode of the VoIP service is assured bandwidth + maximum bandwidth, and norate limitation is performed on the upstream and downstream traffic.

Table 9-5 Data plan

Item Data

OLT S-VLAN ID: 200S-VLAN type: smart VLANUpstream port: 0/19/0C-VLAN ID: 20

ONT ONT ID: 1IP address of the SIP server: 200.200.200.200/24Port ID of the SIP server: 5060




Issue 03 (2010-01-28)

Prerequisitel The SIP interface data and the PSTN user data corresponding to the MG interface must be

configured on the SIP server.

l The OLT must be connected to the SIP server.


1. Create a service VLAN and add an upstream port to it.The VLAN ID is 200, and the VLAN is a smart VLAN. Add upstream port 0/19/0 toVLAN 200.huawei(config)#vlan 200 smarthuawei(config)#port vlan 200 0/19 0



The profile ID is 9, no rate limitation in the upstream and downstream directions, thepriority is 6, and packets are scheduled according to the priority carried.huawei(config)#traffic table ip index 9 cir off priority 6 priority-policy tag-In-Packag



Configure the profile ID to 20, type to type3, assured bandwidth to 15 Mbit/s, andmaximum bandwidth to 30 Mbit/s.huawei(config)#dba-profile add profile-id 20 type3 assure 15360 max 30720









9-27

NOTE



huawei(config-gpon-lineprofile-10)#gem add 2 eth tcont 2Configure the service mapping mode from the GEM port to the ONU to VLAN(default), and map CVLAN 20 to GEM port 2.huawei(config-gpon-lineprofile-10)#mapping-mode vlanhuawei(config-gpon-lineprofile-10)#gem mapping 2 1 vlan 20huawei(config-gpon-lineprofile-10)#commithuawei(config-gpon-lineprofile-10)#quit


6. Add an ONT service profile.The service profile type should be consistent with the actual ONT type. Consideringthe HG850a as an example, configure four ETH ports and two POTS ports.huawei(config)#ont-srvprofile gpon profile-id 10huawei(config-gpon-srvprofile-10)#ont-port eth 4 pots 2huawei(config-gpon-srvprofile-10)#commithuawei(config-gpon-srvprofile-10)#quit



NOTE



l In this example, the method of confirming an automatically discovered ONT is used.huawei(config)#interface gpon 0/1huawei(config-if-gpon-0/1)#port 1 ont-auto-find enablehuawei(config-if-gpon-0/1)#display ont autofind 1 ------------------------------------------------------------------------ Number F/ S/ P SN Password ------------------------------------------------------------------------ 1 0/ 1/ 1 32303131D659FD40 ------------------------------------------------------------------------huawei(config-if-gpon-0/1)#ont confirm 1 ontid 1 sn-auth 32303131D659FD40 omci ont-lineprofile-id 10 ont-srvprofile-id 10 desc HG850a




Issue 03 (2010-01-28)

NOTE






Use the 3PQ+5WRR queue scheduling. Queues 0-4 adopt the WRR mode, with theweights of 10, 10, 20, 20, and 40 respectively; queues 5-7 adopt the PQ mode. Thepriority of the VOIP service is 6, adopting the PQ scheduling.







NOTE

In the case of the HG850a, to provide voice services of different versions, you must select different ONTsoftware versions. Before the configuration, ensure that the current software version of the HG850asupports SIP. Currently, the SIP protocol is supported by V100R001C01, V100R001C03, V100R001C05,V100R001C07.

1. Open the Web browser, and enter the IP address of the local maintenance Ethernetport of the HG850a (default: 192.168.100.1).

2. On the login interface, enter the user name (default: telecomadmin) and password(default: admintelecom) of the administrator. After the password authentication ispassed, the Web configuration interface is displayed.



9-29

3. In the navigation pane, choose Basic > WAN. On the interface that is displayed, clickNew in the upper-right corner.

4. Configure parameters of the voice WAN port, as shown in Figure 9-8.– Service list: VoIP

– VLAN ID: 20 (the same as the C-VLAN ID on the OLT)

– IPGetMode: DHCP

– NAT: Enable

– NAT Type: NAPT

For other parameters, use the default values.

Figure 9-8 WAN port parameters

5. Click Apply.6. In the navigation pane, choose Basic > VoIP.7. Configure the basic VoIP parameters. Configure the phone number to 88860001, as

shown in Figure 9-9.– SIP Local Port: 5060

– Register Server Address: 200.200.200.200

– Register Server Port: 5060




Issue 03 (2010-01-28)

Figure 9-9 VoIP parameters

8. Click Apply. Add another phone number 88860000 in the same way.9. In the navigation pane, click Advanced > VoIP, and click the Port tab in the right

pane, as shown in Figure 9-10.

Figure 9-10 Port bind

10. Bind ports 0 and 1 to the two phone numbers added in the preceding steps respectively.

Click the required port, and then select the numbers mapping the port.11. In the navigation pane, choose Status > VoIP to view the port status, as shown in

Figure 9-11.



9-31

Figure 9-11 Port status

----End

Result

Connect two phone sets to two TEL ports on the ONT, and calls can be made between two phonesets.

Configuration Filevlan 200 smartport vlan 200 0/19 0traffic table ip index 9 cir off priority 6 priority-policy tag-In-Packagdba-profile add profile-id 20 type3 assure 16384 max 26624ont-lineprofile gpon profile-id 10 tcont 2 dba-profile-id 20 gem add 2 eth tcont 2 mapping-mode vlan gem mapping 2 1 vlan 20 commit quitont-srvprofile gpon profile-id 10 ont-port eth 4 pots 2 commit quitinterface gpon 0/1port 1 ont-auto-find enabledisplay ont autofind 1ont confirm 1 ontid 1 sn-auth 32303131D659FD40 omci ont-lineprofile-id 10 ont-srvprofile-id 10ont alarm-profile 1 1 profile-id 1quitservice-port 2 vlan 200 gpon 0/1/1 ont 1 gemport 2 multi-service user-vlan 20 rx-cttr 9 tx-cttr 9queue-scheduler wrr 10 10 20 20 40 0 0 0cos-queue-map cos0 0 cos1 1 cos2 2 cos3 3 cos4 4 cos5 5 cos6 6 cos7 7save

9.1.3.4 Configuring the FTTH IPTV Service

The OLT is connected to the remote ONT through a GPON port to provide users with the IPTVservice.

Service Requirementsl The OLT adopts IGMP proxy, an L2 multicast protocol.




Issue 03 (2010-01-28)

l Multicast programs are configured statically and multicast users are authenticated.

l The IGMP version of the multicast VLAN is IGMP V3.

l The user accesses the device through GPON, and has the right to demand programs fromthe multicast source.

Table 9-6 Data plan

Item Data

OLT Service VLAN ID: 1000Service VLAN type: smart VLANUpstream port: 0/19/0

ONT ONT ID: 1ID of the port on the ONT that is connected to the STB: 3Type of the port on the ONT that is connected to the STB:ETHNative VLAN ID of the port on the ONT that is connectedto the STB: 30

Prerequisitel The license for the multicast program or the multicast user must already be requested and

installed.

l The OLT is connected to the BRAS and the multicast source.


Procedurel Configure the OLT.

1. Create a service VLAN and add an upstream port to it.The VLAN ID is 1000, and the VLAN is a smart VLAN, Add upstream port 0/19/0to VLAN 1000.huawei(config)#vlan 1000 smarthuawei(config)#port vlan 1000 0/19 0



The profile ID is 10, no rate limitation in the upstream and downstream directions,the priority is 4, and packets are scheduled according to the priority carried.huawei(config)#traffic table ip index 10 cir off priority 4 priority-policy tag-In-Packag




9-33


Configure the DBA profile ID to 30, type to type4, and upstream bandwidth to 60Mbit/s.huawei(config)#dba-profile add profile-id 30 type4 max 61440







NOTE




Configure the service mapping mode from the GEM port to the ONU to VLAN(default), and map CVLAN 30 to GEM port 3.huawei(config-gpon-lineprofile-10)#mapping-mode vlanhuawei(config-gpon-lineprofile-10)#gem mapping 3 2 vlan 30huawei(config-gpon-lineprofile-10)#commithuawei(config-gpon-lineprofile-10)#quit


6. Add an ONT service profile.The service profile type must be the same as the actual ONT type. Considering theHG850a as an example, configure four ETH ports and two POTS ports. The ID of theVLAN to which ETH port 3 belongs is 30.huawei(config)#ont-srvprofile gpon profile-id 10huawei(config-gpon-srvprofile-10)#ont-port eth 4 pots 2huawei(config-gpon-srvprofile-10)#port vlan eth 3 30huawei(config-gpon-srvprofile-10)#commithuawei(config-gpon-srvprofile-10)#quit




Issue 03 (2010-01-28)



NOTE



l In this example, the method of confirming an automatically discovered ONT is used.

huawei(config)#interface gpon 0/1huawei(config-if-gpon-0/1)#port 1 ont-auto-find enablehuawei(config-if-gpon-0/1)#display ont autofind 1 ------------------------------------------------------------------------ Number F/ S/ P SN Password ------------------------------------------------------------------------ 1 0/ 1/ 1 32303131D659FD40 ------------------------------------------------------------------------huawei(config-if-gpon-0/1)#ont confirm 1 ontid 1 sn-auth 32303131D659FD40 omci ont-lineprofile-id 10 ont-srvprofile-id 10 desc HG850a

NOTE




9. Specify the VLAN for the ONT port.ETH port 3 on the ONT is connected to the STB and the native VLAN of the port isVLAN 30.huawei(config-if-gpon-0/1)#ont port native-vlan 1 1 eth 3 vlan 30



Use the 3PQ+5WRR queue scheduling. Queues 0-4 adopt the WRR mode, with theweights of 10, 10, 20, 20, and 40 respectively; queues 5-7 adopt the PQ mode. Thepriority of the IPTV service is 4, adopting the PQ scheduling.



9-35





12. Create a multicast VLAN and select the IGMP mode.Select the IGMP proxy mode.huawei(config)#multicast-vlan 1000huawei(config-mvlan1000)#igmp mode proxy Are you sure to change IGMP mode?(y/n)[n]:y

13. Set the IGMP version.Set the IGMP version of the multicast VLAN to IGMP v3.huawei(config-mvlan1000)#igmp version v3

14. Add an IGMP upstream port.The IGMP upstream port is port 0/19/0 and works in the default mode, and protocolpackets are transmitted to all the IGMP upstream ports in the multicast VLAN.huawei(config-mvlan1000)#igmp uplink-port 0/19/0huawei(config-mvlan1000)#btvhuawei(config-btv)#igmp uplink-port-mode defaultAre you sure to change the uplink port mode?(y/n)[n]:y

15. (Optional) Set the multicast global parameters.In this example, the default settings are used for all the multicast global parameters.

16. Configure the program library.Configure the IP address of the multicast program to 224.1.1.10, program name toprogram1, IP address of the program source to 10.10.10.10.huawei(config-btv)#multicast-vlan 1000huawei(config-mvlan1000)#igmp program add name program1 ip 224.1.1.10 sourceip 10.10.10.10

17. Configure the right profile.Configure the profile name to profile0, with the right of watching program 1.huawei(config-mvlan1000)#btvhuawei(config-btv)#igmp profile add profile-name profile0huawei(config-btv)#igmp profile profile-name profile0 program-name program1 watch

18. Configure a multicast user.Set the user of service port 3 as a multicast user and bind right profile named profile0to the service port.huawei(config-btv)#igmp policy service-port 3 normalhuawei(config-btv)#igmp user add service-port 3 authhuawei(config-btv)#igmp user bind-profile service-port 3 profile-name profile0huawei(config-btv)#multicast-vlan 1000huawei(config-mvlan1000)#igmp multicast-vlan member service-port 3huawei(config-mvlan1000)#quit




Issue 03 (2010-01-28)


l The ONT need not be configured.

----End

ResultThe user can watch program 1 on the TV.

Configuration Filevlan 1000 smartport vlan 1000 0/19 0traffic table ip index 10 cir off priority 4 priority-policy tag-In-Packagdba-profile add profile-id 30 type4 max 61440ont-lineprofile gpon profile-id 10 tcont 3 dba-profile-id 30 gem add 3 eth tcont 3 mapping-mode vlan gem mapping 3 2 vlan 30 commit quitont-srvprofile gpon profile-id 10 ont-port eth 4 pots 2 port vlan eth 3 30 commit quitinterface gpon 0/1port 1 ont-auto-find enabledisplay ont autofind 1ont confirm 1 ontid 1 sn-auth 32303131D659FD40 omci ont-lineprofile-id 10 ont-srvprofile-id 10ont alarm-profile 1 1 profile-id 1ont port native-vlan 1 1 eth 3 vlan 30quitservice-port 3 vlan 1000 gpon 0/1/1 ont 1 gemport 3 multi-service user-vlan 30 rx-cttr 10 tx-cttr 10queue-scheduler wrr 10 10 20 20 40 0 0 0cos-queue-map cos0 0 cos1 1 cos2 2 cos3 3 cos4 4 cos5 5 cos6 6 cos7 7multicast-vlan 1000igmp mode proxyyigmp version v3igmp uplink-port 0/19/0btvigmp uplink-port-mode defaultymulticast-vlan 1000igmp program add name program1 ip 224.1.1.10 sourceip 10.10.10.10btvigmp profile add profile-name profile0igmp profile profile-name profile0 program-name program1 watchigmp policy service-port 3 normaligmp user add service-port 3 authigmp user bind-profile service-port 3 profile-name profile0multicast-vlan 1000igmp multicast-vlan member service-port 3quitsave

9.1.4 Configuring the FTTB and FTTC Access ServicesThis topic describes how to configure the Internet access, voice and multicast in the FTTB andFTTC Access Services.



9-37

Context

In the FTTB and FTTC Access Services, the user can access to the ONU by LAN or xDSL. TheONU is connected to the MA5600T through an GPON port to provide users with the high-speedInternet access service, VoIP service and IPTV service.

Figure 9-12 Example network of the multiple service in FTTB and FTTC service

9.1.4.1 Configuring the FTTB and FTTC Internet Access Services (LAN Access)The MA5600T is connected to a remote ONU through the GPON port to provide users with thehigh-speed Internet access service. The ONUs that support LAN access include MA5620,MA5626, MA5610, and MA5612. This topic considers the MA5620 as an example, and usesthe GPBC board on the OLT.

9.1.4.2 Configuring the FTTB and FTTC Internet Access Services (ADSL2+ Access)The MA5600T is connected to a remote ONU through the GPON port to provide users with thehigh-speed Internet access service. The ONUs that support ADSL2+ access include MA5616.This topic considers the MA5616 as an example, and uses the GPBC board on the OLT.

9.1.4.3 Configuring the FTTB and FTTC Internet Access Services (VDSL2 Access)The MA5600T is connected to a remote ONU through the GPON port to provide users with thehigh-speed Internet access service. The ONUs that support VDSL2 access include MA5616 andMA5652G. This topic considers the MA5616 as an example, and uses the GPBC board on theOLT.

9.1.4.4 Configuring the FTTB and FTTC VoIP Services (Based on the H.248 Protocol)The MA5600T is connected to a remote ONU through the GPON port to provide users with theVoIP service. The ONUs that support H.248 Protocol include MA5620, MA5626, MA5616, andMA5612. This topic considers the MA5620 as an example, and uses the GPBC board on theOLT.

9.1.4.5 Configuring the FTTB and FTTC VoIP Services (Based on the SIP Protocol)The MA5600T is connected to a remote ONU through the GPON port to provide users with theVoIP service. The ONUs that support SIP Protocol include MA5620, MA5626, MA5616, andMA5612. This topic considers the MA5620 as an example, and uses the GPBC board on theOLT.




Issue 03 (2010-01-28)

9.1.4.6 Configuring the FTTB and FTTC IPTV ServicesThe MA5600T is connected to a remote ONU through the GPON port to provide users with thehigh-speed Internet access service. This topic considers the MA5620 as an example, and usesthe GPBC board on the OLT.

9.1.4.1 Configuring the FTTB and FTTC Internet Access Services (LAN Access)The MA5600T is connected to a remote ONU through the GPON port to provide users with thehigh-speed Internet access service. The ONUs that support LAN access include MA5620,MA5626, MA5610, and MA5612. This topic considers the MA5620 as an example, and usesthe GPBC board on the OLT.

Service Requirementsl The user PC is connected to the ONU through the FE port in the PPPoE dialing mode. The

ONU is connected to the OLT and then to the upper-layer network in the GPON mode toprovide the high-speed Internet access service.

l The high-speed Internet access service is identified by two precisely-bound VLAN tags.On the ONU, each user is allocated with a CVLAN; on the OLT, each slot is allocated withan SVLAN.


PrerequisiteCorresponding MA5620 version: V800R307. If another version is used, the configuration differsslightly. For details, see the configuration guide of the corresponding ONU version.


1. Create an SVLAN and add an upstream port to it.

Create smart VLAN 100, VLAN attribute QinQ and add upstream port 0/19/0 to it.huawei(config)#vlan 100 smarthuawei(config)#vlan attrib 100 q-in-qhuawei(config)#port vlan 100 0/19 0

2. Add an ONU on the OLT.

The ONU is connected to the GPON port of the OLT through an optical fiber. Youcan perform the service configuration only after adding an ONU successfully on theOLT. To log in to the ONU through Telnet and configure the ONU from the OLT,you must configure the inband management VLAN and IP address for the OLT andthe ONU on the OLT.

(1) Configure the inband management VLAN and IP address of the OLT.Create management VLAN 4000 and add upstream port 0/19/0 to it. Configurethe inband management IP address to 192.168.50.1/24.

NOTETo manage the ONU through SNMP, you must configure the management VLAN, configurethe IP address, and create a management service port.huawei(config)#vlan 4000 smarthuawei(config)#port vlan 4000 0/19 0



9-39

huawei(config)#interface vlanif 4000huawei(config-if-vlanif4000)#ip address 192.168.50.1 24huawei(config-if-vlanif4000)#quit

(2) Add a DBA profile.Configure the DBA profile name to PPPoE, type to Type4, and upstreambandwidth to 100 Mbit/s.huawei(config)#dba-profile add profile-name PPPoE type4 max 102400

(3) (Optional) Add an alarm profile.– The ID of the default GPON alarm profile is 1. The thresholds of all the alarm

parameters in the default alarm profile are 0, which indicates that no alarm isgenerated.

– In this example, the default alarm profile is used, and therefore theconfiguration of the alarm profile is not required.

– Run the gpon alarm-profile add command to add an alarm profile, which isused for monitoring the performance of an activated ONU line.

(4) Add an ONU line profile.Add GPON ONU line profile 10 and bind T-CONT 4 to DBA profile namedPPPoE. In this way, the T-CONT can flexibly provide DBA solutions based ondifferent configurations in the DBA profile.

NOTE

The ONU line profile must not be the existed on and you can create different ONU line profilesbased on different services. This topic considers creating the ONU line profile 10 for example.huawei(config)#ont-lineprofile gpon profile-id 10huawei(config-gpon-lineprofile-10)#tcont 4 dba-profile-name PPPoEAdd GEM port 0 for carrying management traffic streams and GEM port 1 forcarrying traffic streams of the ETH type. Bind GEM port 0 and GEM port 1 toT-CONT 4. Configure the QoS mode to priority-queue (default).

NOTE

a. To change the default QoS mode, run the qos-mode command to configure the QoS modeto gem-car or flow-car, and run the gem add command to configure the index of the trafficprofile to which the GEM port is bound.

b. When the QoS mode is PQ, the default queue priority is 0; when the QoS is flow-car,traffic profile 6 is bound by default (no rate limitation); when the QoS mode is gem-car,traffic profile 6 is bound by default (no rate limitation).

NOTE

l Before running the multi-service-port command to create service ports in batches, ensurethat the number of GEM ports is the same as the number of CVLANs. Therefore, you mustcreate GEM ports according to the number of CVLANs.

l To run the service-port command to create service ports one by one, note that one GEMport can be bound to a maximum of eight service ports. Therefore, you must createsufficient GEM ports according to the number of service ports. This topic considers thismethod to create one GEM port for example. The service virtual ports in the same GEMport only to replace the mapping VLAN and the mapping-index.

huawei(config-gpon-lineprofile-10)#gem add 0 eth tcont 4huawei(config-gpon-lineprofile-10)#gem add 1 eth tcont 4Configure the mapping mode from the GEM port to ONU-side service to VLAN(default), map the service port of management VLAN 4000 to GEM port 0, andmap the service port of SVLAN 100 (CVLAN 1001) to GEM port 1.huawei(config-gpon-lineprofile-10)#mapping-mode vlanhuawei(config-gpon-lineprofile-10)#gem mapping 0 0 vlan 4000huawei(config-gpon-lineprofile-10)#gem mapping 1 1 vlan 1001




Issue 03 (2010-01-28)

After the configuration is complete, run the commit command to make theconfigured parameters take effect.huawei(config-gpon-lineprofile-10)#commithuawei(config-gpon-lineprofile-10)#quit

(5) Add an ONU.Connect the ONU to GPON port 0/2/1. The ONU ID is 0, the SN is32303131B39FD641, the management mode is SNMP, and the bound line profileID is 10.

NOTE

l You can run the ont add command to add an ONU offline or run the ont confirm commandto confirm an automatically discovered ONU.

l Before running the ont confirm command to confirm the automatically discovered ONU,you must run the port ont-auto-find command in the GPON mode to enable the ONUautomatic discovery function.

l In this example, the method of confirming an automatically discovered ONU is used.

huawei(config)#display ont autofind all ------------------------------------------------------------------------ Number F/ S/ P SN Password ------------------------------------------------------------------------ 1 0/ 2/ 1 32303131B39FD641 ------------------------------------------------------------------------ The number of GPON autofind ONT is 1huawei(config)#interface gpon 0/2huawei(config-if-gpon-0/2)#ont confirm 0 ontid 0 sn-auth 32303131B39FD641 snmp ont-lineprofile-id 10

NOTE

l After an ONU is added, it is recommended that you run the display ont info commandor the display ont state command to query the ONU status. In this step, ensure thatConfig State and Match State of the ONU are normal and match respectively.

l If the ONU state in the actual query result is different from the preceding description,run the display ont capability command to query the actual ONU capabilities andthen add a proper ONU profile and a proper ONU based on the queried ONUcapabilities.

(6) (Optional) Bind the alarm profile to the ONU.The default profile (profile 1) is used.huawei(config-if-gpon-0/2)#ont alarm-profile 1 0 profile-id 1

(7) Configure the inband management VLAN and IP address of the ONU.Configure the static IP address of the ONU to 192.168.50.2/24 and themanagement VLAN ID to 4000 (the same as the management VLAN of theOLT).huawei(config-if-gpon-0/2)#ont ipconfig 1 0 static ip-address 192.168.50.2 mask 255.255.255.0 vlan 4000huawei(config-if-gpon-0/2)#quit

(8) Configure an inband management service port.Configure the management service port ID to 0, management VLAN ID to 4000,GEM port ID to 0, and CVLAN ID to 4000. The rate of the inband service porton the OLT is not limited. Therefore, use traffic profile 6 (default). To limit the



9-41

rate of the service port, run the traffic table ip command to add a traffic profileand bind it to the service port.huawei(config)#service-port 0 vlan 4000 gpon 0/2 ont 0 gemport 0 multi-service user-vlan 4000 rx-cttr 6 tx-cttr 6

NOTE

Now, the ONU is successfully added to the OLT, and the management channel between the OLTand the ONU is available. You can log in to the ONU by running the telnet command on the OLTto configure the ONU.

3. Create a service port.

Configure the service port ID to 1001, SVLAN ID to 100, GEM port ID to 1, andCVLAN ID to 1001. Rate limitation for upstream and downstream packets isperformed on the ONU instead of on the OLT. Therefore, use traffic profile 6 (default).To limit the rate of the service port, run the traffic table ip command to add a trafficprofile and bind it to the service port.

NOTEThe CVLAN must be consistent with the upstream VLAN of the ONU.

huawei(config)#service-port 1001 vlan 100 gpon 0/2/1 ont 0 gemport 0 multi-service user-vlan 1001 rx-cttr 6 tx-cttr 6

NOTE

l In this example, run the service-port command to create service ports one by one. The followingconsiders the creation of one service port as an example. Note that one GEM port can be boundto a maximum of eight service ports. When creating a service port, pay attention to itsrelationships with the GEM port and the CVLAN.

l You can also run the multi-service-port command to create service ports in batches. In the caseof GPON access, you must confirm a service port by specifying ont+gemindex. In addition,ensure that the number of GEM ports is the same of the number of CVLANs.

4. Configure the queue scheduling.

Use the 3PQ+5WRR queue scheduling. Queues 0-4 adopt the WRR mode, with theweight as 10, 10, 20, 20, and 40 respectively; queues 5-7 adopt the PQ mode. Configurethe priority of the Internet access service to 1 and adopt the WRR mode.

NOTEQueue scheduling is configured globally. You need to configure queue scheduling only once on theOLT, and then the configuration takes effect globally. In the subsequent phases, you need notconfigure queue scheduling repeatedly when configuring other services.huawei(config)#queue-scheduler wrr 10 10 20 20 40 0 0 0





l Configure the ONU.1. Log in to the ONU to perform the configuration.




Issue 03 (2010-01-28)

On the OLT, use the management IP address of the ONU to log in to the ONU throughTelnet. User name: root. Password: mduadmin.huawei(config)#telnet 192.168.50.2{ <cr>|service-port<0,4294967295> }:

Command: telnet 192.168.50.2 Press CTRL_] to quit telnet mode Trying 192.168.50.2 ... Connected to 192.168.50.2 ...>>User name:root>>User password:

2. Configure the traffic profile.


Add traffic profile 8, and set the CIR to 4 Mbit/s. The priority is 1, bind the trafficprofile 8 and the priority policy is scheduled by the priority that the packets bear.huawei(config)#traffic table ip index 8 cir 4096 priority 1 priority-policy tag-In-Packag

3. Create a VLAN.Create S-VLAN, VLAN ID from 1001 to 1024.

NOTE

The VLAN ID must be consistent with the CVLAN of the OLT.huawei(config)#vlan 1001-1024 smart

4. Add an upstream port to the VLAN.Add upstream port 0/0/1 to S-VLAN, VLAN ID from 1001 to 1024.huawei(config)#port vlan 1001-1024 0/0 1

5. Add a service port to the VLAN.Create service port 100, bind port 0/1/1 to it, and configure the C-VLAN to be 1001.

NOTEIn this step, you need to create 24 service ports in batches. The following considers the creation ofone service port as an example. For the rest, replace the SVLANs, and corresponding ports.huawei(config)#service-port 1001 vlan 1001 eth 0/1/1 multi-service user-encap untagged rx-cttr 8 tx-cttr 8


----End

ResultUsers can enjoy the high-speed Internet service with PC by PPPoE.

Configuration FileOn the OLT side.

vlan 100 smartvlan attrib 100 q-in-qport vlan 100 0/19 0vlan 4000 smartport vlan 4000 0/19 0



9-43

interface vlanif 4000ip address 192.168.50.1 24quitdba-profile add profile-name PPPoE type4 max 102400ont-lineprofile gpon profile-id 10tcont 4 dba-profile-name PPPoEgem add 0 eth tcont 4gem add 1 eth tcont 4mapping-mode vlangem mapping 0 0 vlan 4000gem mapping 1 1 vlan 1001commitquitinterface gpon 0/2port 1 ont-auto-find enabledisplay ont autofind allont confirm 1 ontid 0 sn-auth 32303131B39FD641 snmp ont-lineprofile-id 10ont ipconfig 1 0 static ip-address 192.168.50.2 mask 255.255.255.0 vlan 4000ont alarm-profile 1 0 profile-id 1service-port 0 vlan 4000 gpon 0/2/1 ont 0 gemport 0 multi-service user-vlan 4000 rx-cttr 6 tx-cttr 6service-port 1001 vlan 100 gpon 0/2/1 ont 0 gemport 1 multi-service user-vlan 1001 rx-cttr 6 tx-cttr 6queue-scheduler wrr 10 10 20 20 40 0 0 0cos-queue-map cos0 0 cos1 1 cos2 2 cos3 3 cos4 4 cos5 5 cos6 6 cos7 7save

On the ONU side.

traffic table ip index 8 cir 4096 priority 1 priority-policy tag-In-Packagvlan 1001-1024 smartport vlan 1001-1024 0/0 1service-port 1001 vlan 1001 eth 0/1/1 multi-service user-vlan untagged rx-cttr 8 tx-cttr 8save

9.1.4.2 Configuring the FTTB and FTTC Internet Access Services (ADSL2+ Access)

The MA5600T is connected to a remote ONU through the GPON port to provide users with thehigh-speed Internet access service. The ONUs that support ADSL2+ access include MA5616.This topic considers the MA5616 as an example, and uses the GPBC board on the OLT.

Service Requirementsl The user PC is connected to the ONU through the ADSL2+ port in the PPPoE dialing mode.

The ONU is connected to the OLT and then to the upper-layer network in the GPON modeto provide the high-speed Internet access service.



Prerequisitel Corresponding MA5616 version: V800R307. If another version is used, the configuration

differs slightly. For details, see the configuration guide of the corresponding MDU version.

l The ADSL mode of ONU is NGADSL.




Issue 03 (2010-01-28)

NOTE

l In the privilege mode, run the display adsl mode command to query the ADSL mode.

l In the diagnose mode, run the adsl mode switch-to command to modify the ADSL mode.



Create smart VLAN 100, VLAN attribute QinQ and add upstream port 0/19/0 to it.huawei(config)#vlan 100 smarthuawei(config)#vlan attrib 100 q-in-qhuawei(config)#port vlan 100 0/19 0




NOTETo manage the ONU through SNMP, you must configure the management VLAN, configurethe IP address, and create a management service port.huawei(config)#vlan 4000 smarthuawei(config)#port vlan 4000 0/19 0huawei(config)#interface vlanif 4000huawei(config-if-vlanif4000)#ip address 192.168.50.1 24huawei(config-if-vlanif4000)#quit







NOTE

The ONU line profile must not be the existed on and you can create different ONU line profilesbased on different services. This topic considers creating the ONU line profile 10 for example.



9-45

huawei(config)#ont-lineprofile gpon profile-id 10huawei(config-gpon-lineprofile-10)#tcont 4 dba-profile-name PPPoEAdd GEM port 0 for carrying management traffic streams and GEM port 1 forcarrying traffic streams of the ETH type. Bind GEM port 0 and GEM port 1 toT-CONT 4. Configure the QoS mode to priority-queue (default) and the queuepriority to 6.

NOTE



NOTE



huawei(config-gpon-lineprofile-10)#gem add 0 eth tcont 4 priority-queue 6huawei(config-gpon-lineprofile-10)#gem add 1 eth tcont 4 priority-queue 6Configure the mapping mode from the GEM port to ONU-side service to VLAN(default), map the service port of management VLAN 4000 to GEM port 0, andmap the service port of SVLAN 100 (CVLAN 1001) to GEM port 1.huawei(config-gpon-lineprofile-10)#mapping-mode vlanhuawei(config-gpon-lineprofile-10)#gem mapping 0 0 vlan 4000huawei(config-gpon-lineprofile-10)#gem mapping 1 1 vlan 1001After the configuration is complete, run the commit command to make theconfigured parameters take effect.huawei(config-gpon-lineprofile-10)#commithuawei(config-gpon-lineprofile-10)#quit


NOTE



l In this example, the method of confirming an automatically discovered ONU is used.huawei(config)#display ont autofind all ------------------------------------------------------------------------ Number F/ S/ P SN Password




Issue 03 (2010-01-28)

------------------------------------------------------------------------ 1 0/ 2/ 1 32303131B39FD641 ------------------------------------------------------------------------ The number of GPON autofind ONT is 1huawei(config)#interface gpon 0/2huawei(config-if-gpon-0/2)#ont confirm 0 ontid 0 sn-auth 32303131B39FD641 snmp ont-lineprofile-id 10

NOTE



(6) (Optional) Bind the alarm profile to the ONU.

The default profile (profile 1) is used.huawei(config-if-gpon-0/2)#ont alarm-profile 1 0 profile-id 1

(7) Configure the inband management VLAN and IP address of the ONU.

Configure the static IP address of the ONU to 192.168.50.2/24 and themanagement VLAN ID to 4000 (the same as the management VLAN of theOLT).huawei(config-if-gpon-0/2)#ont ipconfig 1 0 static ip-address 192.168.50.2 mask 255.255.255.0 vlan 4000huawei(config-if-gpon-0/2)#quit

(8) Configure an inband management service port.

Configure the management service port ID to 0, management VLAN ID to 4000,GEM port ID to 0, and CVLAN ID to 4000. The rate of the inband service porton the OLT is not limited. Therefore, use traffic profile 6 (default). To limit therate of the service port, run the traffic table ip command to add a traffic profileand bind it to the service port.huawei(config)#service-port 0 vlan 4000 gpon 0/2 ont 0 gemport 0 multi-service user-vlan 4000 rx-cttr 6 tx-cttr 6

NOTE








9-47

NOTE















Add traffic profile 8, and set the CIR to 4 Mbit/s. The priority is 1, bind the trafficprofile 8 and the priority policy is scheduled by the priority that the packets bear.huawei(config)#traffic table ip index 8 cir 4096 priority 1 priority-policy tag-In-Packag

3. Create a VLAN. Add an upstream port to the VLAN.




Issue 03 (2010-01-28)

Configure the SVLAN, the VLAN ID from 1001-1024. Add the upstream port 0/0/1to these VLAN.huawei(config)#vlan 1001-1024 smarthuawei(config)#port vlan 1001-1024 0/0 1

4. Add a service port to the VLAN.Considers one of service virtual ports for example. The SVLAN is 1001, VPI 8, VCI35, CVLAN untagged. The other service virtual ports can be added similarly byreplacing the right SVLAN and the ADSL2+ port ID.

NOTEThe CVLAN must be consistent with the upstream VLAN of the ONU.huawei(config)#service-port 1001 vlan 1001 adsl 0/1/1 vpi 8 vci 35 multi-service user-vlan untagged rx-cttr 8 tx-cttr 8

NOTE

In the case of batch service provisioning, run the multi-service-port command to add service portsin batches.

5. Configure the ADSL2+ line profile.– Run the display adsl line-profile command to query the existing ADSL2+ line

profiles in the current system. A profile can be directly used if it meets therequirements.

– If no ADSL2+ line profile in the system meets the requirements, you need to addan ADSL2+ line profile. Run the adsl line-profile quickadd command to add anADSL2+ line profile.

The data in the ADSL2+ line profile must be configured according to the actual lineconditions.

Add ADSL2+ line profile 4 and use default settings for the parameters.

huawei(config)#adsl line-profile quickadd 46. Configure the ADSL2+ channel profile.

– Run the display adsl channel-profile command to query the existing ADSL2+channel profiles in the current system. A profile can be directly used if it meets therequirements.

– If no ADSL2+ channel profile in the system meets the requirements, you need toadd an ADSL2+ channel profile. Run the adsl channel-profile quickaddcommand to add an ADSL2+ channel profile.

The data in the ADSL2+ channel profile must be configured according to the actualchannel conditions. In this example, the traffic profile is used to limit the user accessrate; therefore, when the ADSL2+ channel profile is configured, the line rateparameters need not be configured.

Add ADSL2+ channel profile 4 and use default settings for the parameters.

huawei(config)#adsl channel-profile quickadd 47. Configure the ADSL2+ line template.

– Run the display adsl line-template command to query the existing ADSL2+ linetemplates in the current system. A template can be directly used if it meets therequirements.

– If no ADSL2+ line template in the system meets the requirements, you need to addan ADSL2+ line template. Run the adsl line-template quickadd command to addan ADSL2+ line template.



9-49

Bind the ADSL2+ line profile configured in Step 5 and the ADSL2+ channel profileconfigured in Step 6 to form ADSL2+ line template 3. Set the downstream rateadaptation ratio to 100% and the upstream rate adaptation ratio to 100%.

huawei(config)#adsl line-template quickadd 3 line 4 channel1 4 100 100

8. Activate the ADSL2+ port and bind the line template to the ADSL2+ port.Activate ADSL2+ port 0/1/1 and bind line template 3 to it.

NOTE

The other ADSL2+ ports can be activated similarly. If you want to activate all the ports of a board,use the command activate all.huawei(config)#interface adsl 0/1huawei(config-if-adsl-0/1)#deactivate 1huawei(config-if-adsl-0/1)#activate 1 template-index 3

9. (Optional) Bind the ADSL2+ alarm template to the port.Bind default ADSL2+ alarm template 1 to the port. To meet actual requirements, youcan run the adsl alarm-template quickadd command to add an ADSL2+ alarmtemplate.huawei(config-if-adsl-0/1)#alarm-config 1 1


----End

ResultThe PC is connected to the modem and thus the PPPoE dialup can be performed to implementthe high-speed Internet access service.


vlan 100 smartvlan attrib 100 q-in-qport vlan 100 0/19 0vlan 4000 smartport vlan 4000 0/19 0interface vlanif 4000ip address 192.168.50.1 24quitdba-profile add profile-name PPPoE type4 max 102400ont-lineprofile gpon profile-id 10tcont 4 dba-profile-name PPPoEgem add 0 eth tcont 4gem add 1 eth tcont 4mapping-mode vlangem mapping 0 0 vlan 4000gem mapping 1 1 vlan 1001commitquitinterface gpon 0/2port 1 ont-auto-find enabledisplay ont autofind allont confirm 1 ontid 0 sn-auth 32303131B39FD641 snmp ont-lineprofile-id 10ont ipconfig 1 0 static ip-address 192.168.50.2 mask 255.255.255.0 vlan 4000ont alarm-profile 1 0 profile-id 1service-port 0 vlan 4000 gpon 0/2/1 ont 0 gemport 0 multi-service user-vlan 4000 rx-cttr 6 tx-cttr 6service-port 1001 vlan 100 gpon 0/2/1 ont 0 gemport 1 multi-service




Issue 03 (2010-01-28)

user-vlan 1001 rx-cttr 6 tx-cttr 6queue-scheduler wrr 10 10 20 20 40 0 0 0cos-queue-map cos0 0 cos1 1 cos2 2 cos3 3 cos4 4 cos5 5 cos6 6 cos7 7save

On the ONU side.

traffic table ip index 8 cir 4096 priority 1 priority-policy tag-In-Packagvlan 1001-1024 smartport vlan 1001-1024 0/0 1service-port vlan 10 adsl 0/1/1 vpi 8 vci 35 multi-service user-vlan untagged rx-cttr 8 tx-cttr 8adsl line-profile quickadd 4adsl channel-profile quickadd 4adsl line-template quickadd 3interface adsl 0/1deactivate 1activate 1 template-index 3alarm-config 1 1save

9.1.4.3 Configuring the FTTB and FTTC Internet Access Services (VDSL2 Access)The MA5600T is connected to a remote ONU through the GPON port to provide users with thehigh-speed Internet access service. The ONUs that support VDSL2 access include MA5616 andMA5652G. This topic considers the MA5616 as an example, and uses the GPBC board on theOLT.

Service Requirementsl The user PC is connected to the ONU through the VDSL2 port in the PPPoE dialing mode.

The ONU is connected to the OLT and then to the upper-layer network in the GPON modeto provide the high-speed Internet access service.



Prerequisitel Corresponding MA5616 version: V800R307. If another version is used, the configuration

differs slightly. For details, see the configuration guide of the corresponding ONU version.l The VDSL mode is Normal.

NOTEYou can run the display vdsl mode command in the privilege mode to query the VDSL mode.



Create smart VLAN 100, VLAN attribute QinQ and add upstream port 0/19/0 to it.

huawei(config)#vlan 100 smarthuawei(config)#vlan attrib 100 q-in-qhuawei(config)#port vlan 100 0/19 0



9-51











NOTE

The ONU line profile must not be the existed on and you can create different ONU line profilesbased on different services. This topic considers creating the ONU line profile 10 for example.huawei(config)#ont-lineprofile gpon profile-id 10huawei(config-gpon-lineprofile-10)#tcont 4 dba-profile-name PPPoEAdd GEM port 0 for carrying management traffic streams and GEM port 1 forcarrying traffic streams of the ETH type. Bind GEM port 0 and GEM port 1 toT-CONT 4. Configure the QoS mode to priority-queue (default) and the queuepriority to 6.




Issue 03 (2010-01-28)

NOTE



NOTE



huawei(config-gpon-lineprofile-10)#gem add 0 eth tcont 4 priority-queue 6huawei(config-gpon-lineprofile-10)#gem add 1 eth tcont 4 priority-queue 6

Configure the mapping mode from the GEM port to ONU-side service to VLAN(default), map the service port of management VLAN 4000 to GEM port 0, andmap the service port of SVLAN 100 (CVLAN 1001) to GEM port 1.huawei(config-gpon-lineprofile-10)#mapping-mode vlanhuawei(config-gpon-lineprofile-10)#gem mapping 0 0 vlan 4000huawei(config-gpon-lineprofile-10)#gem mapping 1 1 vlan 1001



NOTE




huawei(config)#display ont autofind all ------------------------------------------------------------------------ Number F/ S/ P SN Password ------------------------------------------------------------------------ 1 0/ 2/ 1 32303131B39FD641 ------------------------------------------------------------------------ The number of GPON autofind ONT is 1huawei(config)#interface gpon 0/2



9-53

huawei(config-if-gpon-0/2)#ont confirm 0 ontid 0 sn-auth 32303131B39FD641 snmp ont-lineprofile-id 10

NOTE





(8) Configure an inband management service port.Configure the management service port ID to 0, management VLAN ID to 4000,GEM port ID to 0, and CVLAN ID to 4000. The rate of the inband service porton the OLT is not limited. Therefore, use traffic profile 6 (default). To limit therate of the service port, run the traffic table ip command to add a traffic profileand bind it to the service port.huawei(config)#service-port 0 vlan 4000 gpon 0/2 ont 0 gemport 0 multi-service user-vlan 4000 rx-cttr 6 tx-cttr 6

NOTE









Issue 03 (2010-01-28)

NOTE






Configure the mapping between queues and 802.1p priorities. Priorities 0-7 mapqueues 0-7 respectively.huawei(config)#cos-queue-map cos0 0 cos1 1 cos2 2 cos3 3 cos4 4 cos5 5 cos6 6 cos7 7








Add traffic profile 8, and set the CIR to 4 Mbit/s.huawei(config)#traffic table ip index 8 cir 4096 priority 1 priority-policy tag-In-Packag

3. Create a VLAN. Add an upstream port to the VLAN.Configure the SVLAN, the VLAN ID from 1001-1024. Add the upstream port 0/0/1to these VLAN.



9-55

huawei(config)#vlan 1001-1024 smarthuawei(config)#port vlan 1001-1024 0/0 1

4. Add a service port to the VLAN.Considers one of service virtual ports for example. The SVLAN is 1001, VDSL modePTM, CVLAN untagged. The other service virtual ports can be added similarly byreplacing the right SVLAN and the VDSL port ID.

NOTEThe CVLAN must be consistent with the upstream VLAN of the ONU.huawei(config)#service-port 1001 vlan 1001 vdsl mode ptm 0/1/1 multi-service user-vlan untagged rx-cttr 8 tx-cttr 8

NOTE

In the case of batch service provisioning, run the multi-service-port command to add service portsin batches.

5. Configure the VDSL2 line profile.

– Run the display vdsl line-profile command to query the existing VDSL2 lineprofiles in the current system. A profile can be directly used if it meets therequirements.

– If no VDSL2 line profile in the system meets the requirements, you need to add aVDSL2 line profile. Run the vdsl line-profile quickadd command to quickly adda VDSL2 line profile.

The data in the VDSL2 line profile must be configured according to the actual lineconditions.

Quickly add VDSL2 line profile 4 and use default settings for the parameters.huawei(config)#vdsl line-profile quickadd 4

6. Configure the VDSL2 channel profile.

– Run the display vdsl channel-profile command to query the existing VDSL2channel profiles in the current system. A profile can be directly used if it meets therequirements.

– If no VDSL2 channel profile in the system meets the requirements, you need toadd a VDSL2 channel profile. Run the vdsl channel-profile quickadd commandto add a VDSL2 channel profile.

NOTE

The data in the VDSL2 channel profile must be configured according to the actual channelconditions. In this example, the traffic profile is used to limit the subscriber access rate;therefore, when the VDSL2 channel profile is configured, the line rate parameters need not beconfigured.

Quickly add VDSL2 channel profile 4 and use default settings for the parameters.

huawei(config)#vdsl channel-profile quickadd 4

7. Configure the VDSL2 line template.

– Run the display vdsl line-template command to query the existing VDSL2 linetemplates in the current system. A template can be directly used if it meets therequirements.

– If no VDSL2 line template in the system meets the requirements, you need to adda VDSL2 line template. Run the vdsl line-template quickadd command to add aVDSL2 line template.




Issue 03 (2010-01-28)

Bind the VDSL2 line profile configured in Step 5 and the VDSL2 channel profileconfigured in Step 6 Set the downstream rate adaptation ratio to 80% and the upstreamrate adaptation ratio to 20%.huawei(config)#vdsl line-template quickadd 3 line 4 channel1 4 100 100

8. Activate VDSL2 port 0/1/1 and bind line template 3 to it.NOTE

The other VDSL2 ports can be activated similarly. If you want to activate all the ports of a board,use the command activate all.huawei(config)#interface vdsl 0/1huawei(config-if-vdsl-0/1)#deactivate 1huawei(config-if-vdsl-0/1)#activate 1 template-index 3

9. Bind the VDSL2 alarm template.In this example, bind default VDSL2 alarm template 1. To meet actual requirements,you can run the vdsl alarm-template add command to add a VDSL2 alarm template.huawei(config-if-vdsl-0/1)#alarm-config 1 1


----End

ResultThe PC is connected to the modem and thus the PPPoE dialup can be performed to implementthe high-speed Internet access service.

Configuration FileOn the OLT side.vlan 100 smartvlan attrib 100 q-in-qport vlan 100 0/19 0vlan 4000 smartport vlan 4000 0/19 0interface vlanif 4000ip address 192.168.50.1 24quitdba-profile add profile-name PPPoE type4 max 102400ont-lineprofile gpon profile-id 10tcont 4 dba-profile-name PPPoEgem add 0 eth tcont 4gem add 1 eth tcont 4mapping-mode vlangem mapping 0 0 vlan 4000gem mapping 1 1 vlan 1001commitquitinterface gpon 0/2port 1 ont-auto-find enabledisplay ont autofind allont confirm 1 ontid 0 sn-auth 32303131B39FD641 snmp ont-lineprofile-id 10ont ipconfig 1 0 static ip-address 192.168.50.2 mask 255.255.255.0 vlan 4000ont alarm-profile 1 0 profile-id 1service-port 0 vlan 4000 gpon 0/2/1 ont 0 gemport 0 multi-service user-vlan 4000 rx-cttr 6 tx-cttr 6service-port 1001 vlan 100 gpon 0/2/1 ont 0 gemport 1 multi-service user-vlan 1001 rx-cttr 6 tx-cttr 6queue-scheduler wrr 10 10 20 20 40 0 0 0cos-queue-map cos0 0 cos1 1 cos2 2 cos3 3 cos4 4 cos5 5 cos6 6 cos7 7save



9-57

On the ONU side.

traffic table ip index 8 cir 4096 priority 0 priority-policy tag-In-Packagvlan 1001-1024 smartport vlan 1001-1024 0/0 1service-port vlan 1001 vdsl mode ptm 0/1/1 multi-service user-vlan untagged rx-cttr 8 tx-cttr 8vdsl line-profile quickadd 4vdsl channel-profile quickadd 4vdsl line-template quickadd 3 line 4 channel1 4 100 100interface vdsl 0/1deactivate 1activate 1 template-index 3alarm-config 1 1save

9.1.4.4 Configuring the FTTB and FTTC VoIP Services (Based on the H.248 Protocol)

The MA5600T is connected to a remote ONU through the GPON port to provide users with theVoIP service. The ONUs that support H.248 Protocol include MA5620, MA5626, MA5616, andMA5612. This topic considers the MA5620 as an example, and uses the GPBC board on theOLT.

Service Requirementsl The user phone is connected to the ONU through the POTS port, the ONU is connected to

the OLT through GPON and then to the softswitch, thus implementing the VoIP service.l The DBA of the VoIP service adopts the assured bandwidth + maximum bandwidth mode,

and no rate limitation is performed on the upstream and downstream traffic.l The polarity-reversal accounting is adopted.

Prerequisitel Corresponding ONU version: V800R307. If another version is used, the configuration

differs slightly. For details, see the configuration guide of the corresponding ONU version.l The MGC interface data and the PSTN user data corresponding to the MG interface must

be configured on the MGC.l To run the command display board 0 to make sure the Status of the voice board of ONU

is Normal.



Create smart VLAN 200 and add upstream port 0/19/0 to it.

huawei(config)#vlan 200 smarthuawei(config)#port vlan 200 0/19 0






Issue 03 (2010-01-28)



(2) Add a DBA profile.Configure the DBA profile name to VoIP, type to Type3, assured bandwidth to15Mbit/s and upstream bandwidth to 30Mbit/s.huawei(config)#dba-profile add profile-name VoIP type3 assure 15360 max 30720





(4) Add an ONU line profile.Add GPON ONU line profile 10 and bind T-CONT 2 to DBA profile namedVoIP. In this way, the T-CONT can flexibly provide DBA solutions based ondifferent configurations in the DBA profile.

NOTE

The ONU line profile must not be the existed on and you can create different ONU line profilesbased on different services. This topic considers creating the ONU line profile 10 for example.huawei(config)#ont-lineprofile gpon profile-id 10huawei(config-gpon-lineprofile-10)#tcont 2 dba-profile-name VoIPAdd GEM port 0 for carrying management traffic streams and GEM port 1 forcarrying traffic streams of the ETH type. Bind GEM port 0 and GEM port 1 toT-CONT 2. Configure the QoS mode to priority-queue (default).

NOTE



huawei(config-gpon-lineprofile-10)#gem add 0 eth tcont 2huawei(config-gpon-lineprofile-10)#gem add 1 eth tcont 2Configure the mapping mode from the GEM port to ONU-side service to VLAN(default), map the service port of management VLAN 4000 to GEM port 0, andmap the service port of SVLAN 200 (CVLAN 200) to GEM port 1.huawei(config-gpon-lineprofile-10)#mapping-mode vlanhuawei(config-gpon-lineprofile-10)#gem mapping 0 0 vlan 4000huawei(config-gpon-lineprofile-10)#gem mapping 1 1 vlan 200



9-59



NOTE




huawei(config)#display ont autofind all ------------------------------------------------------------------------ Number : 1 F/S/P : 0/2/1 Ont SN : 32303131B39FD641 Password : VenderID : HWTC Ont Version : Ont SoftwareVersion : V8R307 C00 Ont EquipmentID : SmartAX MA5616 Ont autofind time : 2009-08-21 16:51:45 ------------------------------------------------------------------------ The number of GPON autofind ONT is 1huawei(config)#interface gpon 0/2huawei(config-if-gpon-0/2)#ont confirm 0 ontid 0 sn-auth 32303131B39FD641 snmp ont-lineprofile-id 10

NOTE








Issue 03 (2010-01-28)


NOTE




Add traffic profile 9, and no rate limitation on user packets. The priority is 6 and thepriority policy is scheduled by the priority that the packets bear.huawei(config)#traffic table ip index 9 cir off priority 6 priority-policy tag-In-Packag


Configure the service port ID to 200, SVLAN ID to 200, GEM port ID to 1, bindtraffic profile 9 and CVLAN ID to 200.




Use the 3PQ+5WRR queue scheduling. Queues 0-4 adopt the WRR mode, with theweight as 10, 10, 20, 20, and 40 respectively; queues 5-7 adopt the PQ mode. Configurethe priority of the VoIP service to 6 and adopt the PQ mode.







9-61





2. Configure the upstream port of the media stream and the signaling stream.Create VLAN 10 and add upstream port 0/0/0 to the VLAN. Configure the IP addressof the VLAN L3 interface to 17.10.10.10 and subnet mask to 255.255.0.0,

NOTE

l The VLAN ID of the default upstream Ethernet port is 1. Use the default VLAN if nospecific VLAN is required for the upstream transmission.

l If you need to use another VLAN to transmit packets in the upstream direction, run theport vlan command to add the specified upstream port to the VLAN.

huawei(config)#vlan 200 smarthuawei(config)#port vlan 200 0/0 0huawei(config)#interface vlanif 200huawei(config-if-vlanif200)#ip address 17.10.10.10huawei(config-if-vlanif200)#quit

3. Configure the media and signaling IP address pools.Configure both the media IP address and the signaling IP address to 17.10.10.10huawei(config)#voiphuawei(config-voip)#ip address media 17.10.10.10 17.10.10.1huawei(config-voip)#ip address signaling 17.10.10.10huawei(config-voip)#quit

NOTE

l You can configure the attributes of the MG interface only when the media IP address andthe signaling IP address exist in the media and signaling IP address pools.

l The media IP address and the signaling IP address can be different. You can plan the IPaddresses according to the actual network.

4. Configure the static route.Because the IP address of the VLAN interface and the IP address of the MGC are indifferent network segments, you should configure a route for the network segmentfrom gateway 17.10.10.1 to 200.200.200.0.huawei(config)#ip route-static 200.200.200.0 24 17.10.10.1

5. Add an MG interface.Add MG interface 0.huawei(config)#interface h248 0 Are you sure to add MG interface?(y/n)[n]:y

6. Configure the attributes of the MG interface.– Signaling IP address: 17.10.10.10




Issue 03 (2010-01-28)

– Coding mode: text

– Port number of the transport layer protocol: 2944

– Transfer mode: UDP

– IP address of the primary MGC: 200.200.200.200

– Port number of the transport layer protocol of the primary MGC: 2944

– Media IP address 1: 17.10.10.10huawei(config-if-h248-0)#if-h248 attribute mgip 17.10.10.10 mgport 2944 code text transfer udp primary-mgc-ip1 200.200.200.200 primary-mgc-port 2944 mg-media-ip1 17.10.10.10

7. Reset the MG interface.huawei(config-if-h248-0)#reset coldstart Are you sure to reset MG interface?(y/n)[n]:yhuawei(config-if-h248-0)#quit

8. Configure the PSTN user data.Configure the telephone number of the user on port 0/3/1 to 0/3/24, telephone numberof the user from 83110001 to 83110024, and terminal ID to 0.

NOTE

l To configure the PSTN data of a single user, run the mgpstnuser add command.

l To configure the PSTN data of multiple users in batches, run the mgpstnuser batadd command.

l If the user of the MG interface is configured to support terminal layering, you need not configurethe terminal ID and the system automatically allocates it. If the user of the MG interface doesnot support terminal layering, this parameter is mandatory. The terminal ID must be unique onone MG interface.

huawei(config)#esl userhuawei(config-esl-user)#mgpstnuser batadd 0/3/1 0/3/24 0 terminalid 0 telno 83110001

9. Change the call priority of the PSTN user.Configure the call priority of the user on port 0/3/1 to Cat2 and the users of 0/3/1 to0/3/24 to Cat3(Default)huawei(config-esl-user)#mgpstnuser modify 0/3/1 priority cat2huawei(config-esl-user)#quit

10. Modify the attributes of all the PSTN ports so that the PSTN ports supports the polarityreversal.Modify the attributes of the PSTN port 0/3/1 to 0/3/24 so that the PSTN ports supportsthe polarity reversal.huawei(config)#pstnporthuawei(config-pstnport)#pstnport attribute batset 0/3/1 0/3/24 reverse-pole-pulse enablehuawei(config-pstnport)#quit


----End

Result

After the configuration is completed, users can make calls between two phones.



9-63

l The caller can hear the dial tone after picking up the phone.

l When the caller dials the phone number of the callee, the phone of the callee can ringnormally, and the caller can hear the ringback tone.

l The caller and the callee can communicate with each other successfully.

l After the callee hangs up the phone, the caller can hear the busy tone.

Configuration FileOn the OLT side.vlan 200 smartport vlan 200 0/19 0vlan 4000 smartport vlan 4000 0/19 0interface vlanif 4000ip address 192.168.50.1 24quitdba-profile add profile-name VoIP type3 assure 15360 max 30720ont-lineprofile gpon profile-id 10tcont 2 dba-profile-name VoIPgem add 0 eth tcont 2gem add 1 eth tcont 2mapping-mode vlangem mapping 0 0 vlan 4000gem mapping 1 1 vlan 200commitquitinterface gpon 0/2port 1 ont-auto-find enabledisplay ont autofind 1ont confirm 1 ontid 0 sn-auth 32303131B39FD641 snmp ont-lineprofile-id 10ont ipconfig 1 0 static ip-address 192.168.50.2 mask 255.255.255.0 vlan 4000ont alarm-profile 1 0 profile-id 1service-port 0 vlan 4000 gpon 0/2/1 ont 1 gemport 0 multi-service user-vlan 4000 rx-cttr 6 tx-cttr 6traffic table ip index 9 cir off priority 6 priority-policy tag-In-Packageservice-port 200 vlan 200 gpon 0/2/1 ont 1 gemport 1 multi-service user-vlan 200 rx-cttr 9 tx-cttr 9queue-scheduler wrr 10 10 20 20 40 0 0 0cos-queue-map cos0 0 cos1 1 cos2 2 cos3 3 cos4 4 cos5 5 cos6 6 cos7 7save

On the ONU side.vlan 200 smartport vlan 200 0/0 0interface vlanif 200ip address 17.10.10.10 16quitvoipip address media 17.10.10.10 17.10.10.1ip address signaling 17.10.10.10quitip route-static 200.200.200.0 24 17.10.10.1interface h248 0if-h248 attribute mgip 17.10.10.10 mgport 2944 code text transfer udp primary-mgc-ip1 200.200.200.200 primary-mgc-port 2944 mg-media-ip1 17.10.10.10reset coldstartquitesl usermgpstnuser batadd 0/3/1 0/3/24 0 terminalid 0 telno 83110001mgpstnuser modify 0/3/1 priority cat2quitpstnportpstnport attribute batset 0/3/1 0/3/24 reverse-pole-pulse enable




Issue 03 (2010-01-28)

quitsave

9.1.4.5 Configuring the FTTB and FTTC VoIP Services (Based on the SIP Protocol)The MA5600T is connected to a remote ONU through the GPON port to provide users with theVoIP service. The ONUs that support SIP Protocol include MA5620, MA5626, MA5616, andMA5612. This topic considers the MA5620 as an example, and uses the GPBC board on theOLT.

Service Requirementsl The user phone is connected to the ONU through the POTS port, the ONU is connected to

the OLT through GPON and then to the softswitch, thus implementing the VoIP service.l The DBA of the VoIP service adopts the assured bandwidth + maximum bandwidth mode,

and no rate limitation is performed on the upstream and downstream traffic.l The polarity-reversal accounting is adopted.

Prerequisitel Corresponding ONU version: V800R307. If another version is used, the configuration

differs slightly. For details, see the configuration guide of the corresponding ONU version.l The PSTN user data corresponding to the SIP interface must be configured on the IMS.

l To run the command display board 0 to make sure the Status of the voice board of ONUis Normal.











9-65

(2) Add a DBA profile.

Configure the DBA profile name to VoIP, type to Type3, assured bandwidth to15Mbit/s and upstream bandwidth to 30Mbit/s.huawei(config)#dba-profile add profile-name VoIP type3 assure 15360 max 30720

(3) (Optional) Add an alarm profile.

– The ID of the default GPON alarm profile is 1. The thresholds of all the alarmparameters in the default alarm profile are 0, which indicates that no alarm isgenerated.



(4) Add an ONU line profile.

Add GPON ONU line profile 10 and bind T-CONT 2 to DBA profile namedVoIP. In this way, the T-CONT can flexibly provide DBA solutions based ondifferent configurations in the DBA profile.

NOTE

The ONU line profile must not be the existed on and you can create different ONU line profilesbased on different services. This topic considers creating the ONU line profile 10 for example.huawei(config)#ont-lineprofile gpon profile-id 10huawei(config-gpon-lineprofile-10)#tcont 2 dba-profile-name VoIP

Add GEM port 0 for carrying management traffic streams and GEM port 1 forcarrying traffic streams of the ETH type. Bind GEM port 0 and GEM port 1 toT-CONT 2. Configure the QoS mode to priority-queue (default).

NOTE



huawei(config-gpon-lineprofile-10)#gem add 0 eth tcont 2huawei(config-gpon-lineprofile-10)#gem add 1 eth tcont 2



(5) Add an ONU.

Connect the ONU to GPON port 0/2/1. The ONU ID is 0, the SN is32303131B39FD641, the management mode is SNMP, and the bound line profileID is 10.




Issue 03 (2010-01-28)

NOTE




huawei(config)#display ont autofind all ------------------------------------------------------------------------ Number : 1 F/S/P : 0/2/1 Ont SN : 32303131B39FD641 Password : VenderID : HWTC Ont Version : Ont SoftwareVersion : V8R307 C00 Ont EquipmentID : SmartAX MA5616 Ont autofind time : 2009-08-21 16:51:45 ------------------------------------------------------------------------ The number of GPON autofind ONT is 1huawei(config)#interface gpon 0/2huawei(config-if-gpon-0/2)#ont confirm 0 ontid 0 sn-auth 32303131B39FD641 snmp ont-lineprofile-id 10

NOTE








9-67

NOTE




Add traffic profile 9, and no rate limitation on user packets. The priority is 6 and thepriority policy is scheduled by the priority that the packets bear.huawei(config)#traffic table ip index 9 cir off priority 6 priority-policy tag-In-Packag


Configure the service port ID to 200, SVLAN ID to 200, GEM port ID to 1, bindtraffic profile 9 and CVLAN ID to 200.




Use the 3PQ+5WRR queue scheduling. Queues 0-4 adopt the WRR mode, with theweight as 10, 10, 20, 20, and 40 respectively; queues 5-7 adopt the PQ mode. Configurethe priority of the VoIP service to 6 and adopt the PQ mode.








Command:




Issue 03 (2010-01-28)

telnet 192.168.50.2 Press CTRL_] to quit telnet mode Trying 192.168.50.2 ... Connected to 192.168.50.2 ...>>User name:root>>User password:

2. Configure the upstream port of the media stream and the signaling stream.Create VLAN 200 and add upstream port 0/0/0 to the VLAN. Configure the IP addressof the VLAN L3 interface to 17.10.10.10 and subnet mask to 255.255.0.0,

NOTE

l The VLAN ID must be consistent with the CVLAN of the OLT.

l The VLAN ID of the default upstream Ethernet port is 1. Use the default VLAN if nospecific VLAN is required for the upstream transmission.

l If you need to use another VLAN to transmit packets in the upstream direction, run theport vlan command to add the specified upstream port to the VLAN.

huawei(config)#vlan 200 smarthuawei(config)#port vlan 200 0/0 0huawei(config)#interface vlanif 200huawei(config-if-vlanif200)#ip address 17.10.10.10huawei(config-if-vlanif200)#quit

3. Configure the media and signaling IP address pools.Configure both the media IP address and the signaling IP address to 17.10.10.10huawei(config)#voiphuawei(config-voip)#ip address media 17.10.10.10 17.10.10.1huawei(config-voip)#ip address signaling 17.10.10.10huawei(config-voip)#quit

NOTE

l You can configure the attributes of the SIP interface only when the media IP address andthe signaling IP address exist in the media and signaling IP address pools.

l The media IP address and the signaling IP address can be different. You can plan the IPaddresses according to the actual network.

4. Configure the static route.Because the IP address of the VLAN interface and the IP address of the IMS are indifferent network segments, you should configure a route for the network segmentfrom gateway 17.10.10.1 to 200.200.200.0.huawei(config)#ip route-static 200.200.200.0 24 17.10.10.1

5. Add an SIP interface.Add SIP interface 0.huawei(config)#interface sip 0 Are you sure to add SIP interface?(y/n)[n]:y

6. Configure the basic attributes of the SIP interface.– Signaling IP address: 17.10.10.10

– Coding mode: text

– Signaling port ID: 5060

– Transfer mode: UDP

– IP address of the primary IMS: 200.200.200.200

– Signaling port ID of the primary IMS: 5060

– Media IP address 1: 17.10.10.10

– Homing domain name of SIP interface: huawei



9-69

– SIP profile ID: 1huawei(config-if-sip-0)#if-sip attribute basic media-ip 17.10.10.10 signal-ip 17.10.10.10 signal-port 5060 transfer udp primary-proxy-ip1 200.200.200.200 primary-proxy-port 5060 home-domain huawei sipprofile-index 1

7. Configure the optional attributes of the SIP interface.You can configure the optional attributes such as the domain name, description,register server uniform resource identifier (URI), phone context and conferencefactory URI by running commandif-sip attribute optional. No configuration here.

8. Reset the SIP interface.huawei(config-if-sip-0)#reset Are you sure to reset SIP interface?(y/n)[n]:yhuawei(config-if-sip-0)#quit

9. Configure the PSTN user data.Configure the telephone number of the user on port 0/3/1 to 0/3/24, telephone numberof the user from 83110001 to 83110024, and terminal ID to 0.

NOTE

l To configure the PSTN data of a single user, run the sippstnuser add command.

l To configure the PSTN data of multiple users in batches, run the sippstnuser batadd command.

huawei(config)#esl userhuawei(config-esl-user)#sippstnuser batadd 0/3/1 0/3/24 0 telno 83110001

10. Change the call priority of the PSTN user.Configure the call priority of the user on port 0/3/1 to Cat2 and the users of 0/3/1 to0/3/24 to Cat3(Default)huawei(config-esl-user)#sippstnuser attribute set 0/3/1 priority cat2huawei(config-esl-user)#quit

11. Modify the attributes of all the PSTN ports so that the PSTN ports supports the polarityreversal.Modify the attributes of the PSTN port 0/3/1 to 0/3/24 so that the PSTN ports supportsthe polarity reversal.huawei(config)#pstnporthuawei(config-pstnport)#pstnport attribute batset 0/3/1 0/3/24 reverse-pole-pulse enablehuawei(config-pstnport)#quit


----End

Result

After the configuration is completed, users can make calls between two phones.l The caller can hear the dial tone after picking up the phone.

l When the caller dials the phone number of the callee, the phone of the callee can ringnormally, and the caller can hear the ringback tone.

l The caller and the callee can communicate with each other successfully.

l After the callee hangs up the phone, the caller can hear the busy tone.




Issue 03 (2010-01-28)

Configuration FileOn the OLT side.vlan 200 smartport vlan 200 0/19 0vlan 4000 smartport vlan 4000 0/19 0interface vlanif 4000ip address 192.168.50.1 24quitdba-profile add profile-name VoIP type3 assure 15360 max 30720ont-lineprofile gpon profile-id 10tcont 2 dba-profile-name VoIPgem add 0 eth tcont 2gem add 1 eth tcont 2mapping-mode vlangem mapping 0 0 vlan 4000gem mapping 1 1 vlan 200commitquitinterface gpon 0/2port 1 ont-auto-find enabledisplay ont autofind 1ont confirm 1 ontid 0 sn-auth 32303131B39FD641 snmp ont-lineprofile-id 10ont ipconfig 1 0 static ip-address 192.168.50.2 mask 255.255.255.0 vlan 4000ont alarm-profile 1 0 profile-id 1service-port 0 vlan 4000 gpon 0/2/1 ont 1 gemport 0 multi-service user-vlan 4000 rx-cttr 6 tx-cttr 6traffic table ip index 9 cir off priority 6 priority-policy tag-In-Packageservice-port 200 vlan 200 gpon 0/2/1 ont 1 gemport 1 multi-service user-vlan 200 rx-cttr 9 tx-cttr 9queue-scheduler wrr 10 10 20 20 40 0 0 0cos-queue-map cos0 0 cos1 1 cos2 2 cos3 3 cos4 4 cos5 5 cos6 6 cos7 7save

On the ONU side.vlan 200 smartport vlan 200 0/0 0interface vlanif 200ip address 17.10.10.10 16quitvoipip address media 17.10.10.10 17.10.10.1ip address signaling 17.10.10.10quitip route-static 200.200.200.0 24 17.10.10.1interface sip 0if-sip attribute basic media-ip 17.10.10.10 signal-ip 17.10.10.10 signal-port 5060 transfer udp primary-proxy-ip1 200.200.200.200 primary-proxy-port 5060 home-domain huawei sipprofile-index 1resetquitesl usersippstnuser batadd 0/3/1 0/3/24 0 telno 83110001sippstnuser attribute set 0/3/1 priority cat2quitpstnportpstnport attribute batset 0/3/1 0/3/24 reverse-pole-pulse enablequitsave

9.1.4.6 Configuring the FTTB and FTTC IPTV ServicesThe MA5600T is connected to a remote ONU through the GPON port to provide users with thehigh-speed Internet access service. This topic considers the MA5620 as an example, and usesthe GPBC board on the OLT.



9-71

Service Requirementsl The user set-top box (STB) is connected to the ONU through FE port, and the ONU is

connected to the OLT and then to the upper-layer network through GPON, thusimplementing the IPTV service.

l The DBA of the IPTV service adopts the maximum bandwidth mode, and no rate limitationis performed on the upstream and downstream traffic.

l The OLT and the ONU adopt the multicast proxy mode. The multicast packets on useraccess side of the ONU are terminated on the ONU to reduce the load on the OLT.

l Multicast programs are configured statically.

l Multicast logs are reported to the log server in the CDR format.

Prerequisitel The license for the multicast program or the multicast user must already be requested and

installed.l Corresponding MA5620 version: V800R307. If another version is used, the configuration

differs slightly. For details, see the configuration guide of the corresponding ONU version.









(2) Add a DBA profile.Configure the DBA profile name to IPTV, type to Type4, and upstreambandwidth to 100 Mbit/s.huawei(config)#dba-profile add profile-name IPTV type4 max 102400





Issue 03 (2010-01-28)




(4) Add an ONU line profile.Add GPON ONU line profile 10 and bind T-CONT 3 to DBA profile namedIPTV. In this way, the T-CONT can flexibly provide DBA solutions based ondifferent configurations in the DBA profile.

NOTE

The ONU line profile must not be the existed on and you can create different ONU line profilesbased on different services. This topic considers creating the ONU line profile 10 for example.huawei(config)#ont-lineprofile gpon profile-id 10huawei(config-gpon-lineprofile-10)#tcont 3 dba-profile-name IPTV

Add GEM port 0 for carrying management traffic streams and GEM port 1 forcarrying traffic streams of the ETH type. Bind GEM port 0 and GEM port 1 toT-CONT 3. Configure the QoS mode to priority-queue (default).

NOTE



huawei(config-gpon-lineprofile-10)#gem add 0 eth tcont 3huawei(config-gpon-lineprofile-10)#gem add 1 eth tcont 3




NOTE






9-73

huawei(config)#interface gpon 0/2huawei(config-if-gpon-0/2)#port 1 ont-auto-find enablehuawei(config-if-gpon-0/2)#display ont autofind 1 ------------------------------------------------------------------------ Number F/ S/ P SN Password ------------------------------------------------------------------------ 1 0/ 2/ 1 32303131B39FD641 ------------------------------------------------------------------------

huawei(config-if-gpon-0/2)#ont confirm 1 ontid 0 sn-auth 32303131B39FD641 snmp ont-lineprofile-id 10

NOTE






NOTE







Issue 03 (2010-01-28)




Use the 3PQ+5WRR queue scheduling. Queues 0-4 adopt the WRR mode, with theweight as 10, 10, 20, 20, and 40 respectively; queues 5-7 adopt the PQ mode. Configurethe priority of the IPTV service to 4 and adopt the WRR mode.


Configure the mapping between queues and 802.1p priorities. Priorities 0-7 mapqueues 0-7 respectively.huawei(config)#cos-queue-map cos0 0 cos1 1 cos2 2 cos3 3 cos4 4 cos5 5 cos6 6 cos7 7


5. Configure a multicast subtending port.Configure port 0/2/1 connected to the ONU as the multicast subtending port.huawei(config)#btvhuawei(config-btv)#igmp cascade-port 0/2/1 ontid 0 gemport-index 1

NOTEIf the multicast subtending port is not configured and multicast users are directly configured, themaximum number of programs for each multicast user is limited. If multicast users are directlyconfigured:

l If set users to be authenticated, you can run the command igmp profile add to add a multicastauthority profile, and then use the command igmp profile to modify the authority parameters.At last, use the command igmp user bind-profile to bind this profile to the user need to beauthenticated.

l If set users to be authenticated, delete the no-auth parameter.

The corresponding configuration procedure is as follows:huawei(config-btv)#igmp user add service-port 1000 no-authhuawei(config-btv)#multicast-vlan 1000huawei(config-mvlan1000)#igmp multicast-vlan member service-port 1000

6. Set the IGMP version.Use IGMP V3.huawei(config)#multicast-vlan 1000huawei(config-mvlan1000)#igmp version v3

7. Select the IGMP mode.Select the IGMP proxy mode.huawei(config-mvlan1000)#igmp mode proxy Are you sure to change IGMP mode?(y/n)[n]:y

8. Configure the IGMP upstream port.The IGMP upstream port is port 0/19/0 and works in the default mode, and protocolpackets are transmitted to all the IGMP upstream ports in the multicast VLAN.



9-75

huawei(config-mvlan1000)#igmp uplink-port 0/19/0

9. Set the multicast global parameters.In this example, the default settings are used for all the multicast global parameters.

10. Configure the program library.The multicast IP address of the program is 224.1.1.10 and the IP address of the programsource is 10.10.10.10huawei(config-mvlan1000)#igmp program add name program1 ip 224.1.1.10 sourceip 10.10.10.10

11. Configure a log server.Enable CDR log reporting, and configure the IP address of the active server to10.10.10.20.huawei(config-mvlan1000)#btvhuawei(config-btv)#igmp cdr enablehuawei(config-btv)#quithuawei(config)#file-server auto-backup cdr primary 10.10.10.20 tftp







Add traffic profile 10, and no rate limitation on user packets. The priority is 1, bindthe traffic profile 8 and the priority policy is scheduled by the priority that the packetsbear.huawei(config)#traffic table ip index 10 cir off priority 4 priority-policy tag-In-Packag

3. Configure a VLAN and add an upstream port to the VLAN.Create S-VLAN 1000 and add upstream port 0/0/1 to S-VLAN 1000.

NOTEThe CVLAN must be consistent with the upstream VLAN of the ONU.huawei(config)#vlan 1000huawei(config)#port vlan 1000 0/0 1

4. Configure a service port.Add service port 1000, CVLAN to untagged , and bind VLAN 1000 and traffic profile10 to it.




Issue 03 (2010-01-28)

huawei(config)#service-port 1000 vlan 1000 eth 0/1/1 multi-service user-vlan untagged rx-cttr 10 tx-cttr 10

5. Configure the multicast mode and multicast protocol version.Configure the multicast mode to IGMP Proxy and adopt IGMP V3.huawei(config)#multicast-vlan 1000huawei(config-mvlan1000)#igmp mode proxyhuawei(config-mvlan1000)#igmp version v3

6. Configure a multicast upstream port and a multicast program.Configure upstream port 0/0/1 as the upstream multicast port, and configure the IPaddress of the multicast to 224.1.1.10 and the source IP address to 10.10.10.10.

NOTE

The program IP and the multicast source IP of the ONU must be the same as configuration on theOLT.huawei(config-mvlan1000)#igmp uplink-port 0/0/1huawei(config-mvlan1000)#igmp program add ip 224.1.1.10 sourceip 10.10.10.10

7. Configure a multicast user and add the user to the multicast VLAN.Configure service port 1000 as a multicast user, add the user to VLAN 1000, and adoptthe no-auth mode for the multicast user.

NOTE

l If set users to be authenticated, you can run the command igmp profile add to add a multicastauthority profile, and then use the command igmp profile to modify the authority parameters.At last, use the commandigmp user bind-profile to bind this profile to the user need to beauthenticated.

l If set users to be authenticated, delete the no-auth parameter.huawei(config-mvlan1000)#btvhuawei(config-btv)#igmp user add service-port 1000 no-authhuawei(config-btv)#multicast-vlan 1000huawei(config-mvlan1000)#igmp multicast-vlan member service-port 100

8. Save the configuration.huawei(config)#save

----End

ResultThe user can watch program 1 on the TV.


vlan 1000 smartport vlan 1000 0/19 0vlan 4000 smartport vlan 4000 0/19 0interface vlanif 4000ip address 192.168.50.1 24quitdba-profile add profile-name IPTV type4 max 61440ont-lineprofile gpon profile-id 10tcont 3 dba-profile-name IPTVgem add 0 eth tcont 3gem add 1 eth tcont 3mapping-mode vlan



9-77

gem mapping 0 0 vlan 4000gem mapping 1 1 vlan 1000commitquitinterface gpon 0/2port 1 ont-auto-find enabledisplay ont autofind 1ont confirm 1 ontid 0 sn-auth 32303131B39FD641 snmp ont-lineprofile-id 10ont ipconfig 1 0 static ip-address 192.168.50.2 mask 255.255.255.0 vlan 4000ont alarm-profile 1 0 profile-id 1service-port 0 vlan 4000 gpon 0/2/1 ont 1 gemport 0 multi-service user-vlan 4000 rx-cttr 6 tx-cttr 6service-port 1000 vlan 100 gpon 0/2/1 ont 1 gemport 1 multi-service user-vlan 1000 rx-cttr 6 tx-cttr 6queue-scheduler wrr 10 10 20 20 40 0 0 0cos-queue-map cos0 0 cos1 1 cos2 2 cos3 3 cos4 4 cos5 5 cos6 6 cos7 7btvigmp cascade-port 0/2/1 ontid 0multicast-vlan 1000igmp version v3igmp mode proxyigmp uplink-port 0/19/0igmp program add name program1 ip 224.1.1.10 sourceip 10.10.10.10btvigmp cdr enablequitfile-server auto-backup cdr primary 10.10.10.20 tftpsave

On the ONU side.

vlan 1000port vlan 1000 0/0 1traffic table ip index 10 cir off priority 4 priority-policy tag-In-Packagservice-port 1000 vlan 1000 eth 0/1/1 multi-service user-vlan untagged rx-cttr 10 tx-cttr 10multicast-vlan 1000igmp mode proxyigmp version v3igmp uplink-port 0/0/1igmp program add name program1 ip 224.1.1.10 sourceip 10.10.10.10btvigmp user add service-port 1000 no-authmulticast-vlan 1000igmp multicast-vlan member service-port 100save

9.1.5 Configuring the FTTO (OLT+OT928G) ServiceThrough the MA5600T+OT928G network, the fiber to the office (FTTO) solution is providedfor enterprise users. This topic describes how to configure the TDM PBX access and enterpriseEthernet private access service in the FTTO scenario.

Context

In the FTTO solution, an OT928G, which functions as the SBU, provides various types of portsand supports multiple networking modes to meet networking requirements for various servicesin different environments. The OT928G features the following:

l Provides eight POTS ports for connecting to the phone sets of the enterprise to provide theIP-based, high-quality, and low-cost VoIP service.

l Provides eight E1 ports for connecting to the enterprise TDM PBX to provide the TDMprivate line service.




Issue 03 (2010-01-28)

l Provides four FE electrical ports and one FE/GE adaptive electrical port for connecting tothe LAN switch of the enterprise to provide the Ethernet private line service.

9.1.5.1 Configuring the TDM PBX Access ServiceThe OT928G provides eight E1 ports for connecting to the TDM PBX of the enterprise, and theOLT transmits signals of the TDM PBX upstream to the SDH network.

9.1.5.2 Configuring the Enterprise Ethernet Private ServiceThe OT928G provides five FE/GE ports for connecting to the enterprise Ethernet switch, andthe OLT transmits signals of the switch upstream to the IP network.

9.1.5.1 Configuring the TDM PBX Access Service

The OT928G provides eight E1 ports for connecting to the TDM PBX of the enterprise, and theOLT transmits signals of the TDM PBX upstream to the SDH network.

Service Requirementsl The E1 port of the OT928G is connected to the TDM PBX of the enterprise.

l Through native TDM, the TDM service data can be transmitted in the GPON network.

l Signals are transmitted upstream to the OLT through GPON, and then the OLT transmitsthe signals upstream to the SDH network.


In this solution, the native TDM encapsulates TDM frames into GPON GEM frames(TDMoGEM) and transmits the TDM service over the GPON network. This mode featuressimple encapsulation, low network cost, and good link quality.

Currently, the typical TDM service carried over the GPON network is the PBX fixed linetelephony service. It is implemented by taking advantage of the GPON features such as long-distance transmission and flexible networking. For the TDM service, the GPON networkfunctions like a transparent transmission channel and does not care about what specific servicesare carried over it.

Figure 9-13 shows an example network of the TDM PBX access service. The OT928G isconnected to the TDM PBX of the enterprise through the E1 port and aggregated to the OLTthrough the GPON upstream port. The OLT provides the E1 or STM-1 port to transmit the TDMservice to the SDH network.

Figure 9-13 Example network of the TDM PBX access service



9-79

Procedurel The OT928G provides the PBX access, and the OLT transmits signals upstream to the SDH

network through the E1 or STM-1 port.

For details about the configuration, see 9.1.6.1 Configuring the Native TDM MobileBearer Service (Based on the SDH Network).

----End

9.1.5.2 Configuring the Enterprise Ethernet Private ServiceThe OT928G provides five FE/GE ports for connecting to the enterprise Ethernet switch, andthe OLT transmits signals of the switch upstream to the IP network.

Service Requirementsl The FE/GE port of the OT928G is connected to the enterprise Ethernet LAN switch.

l The QinQ VLAN encapsulation mode is adopted so that data can be transparentlytransmitted in the GPON network.

l Signals are transmitted upstream to the OLT through GPON, and then the OLT transmitsthe signals upstream to the IP network.

Background InformationFigure 9-14 shows an example network of the enterprise Ethernet private service.

The Intranet data of branch A and B are transmitted to the OT928G through Ethernet switches.Configure the QinQ VLAN private line on both OT928G_1 and OT928G_2 so that the servicedata and BPDUs between enterprise private networks can be transparently transmitted in thepublic network. This provides a transparent and safe data channel for enterprise private networksthat are located in different places.

Figure 9-14 Example network of the enterprise Ethernet private service

Data PlanTable 9-7 provides the data plan for the OLT, and Table 9-8 provides the data plan for theOT928G.




Issue 03 (2010-01-28)

Table 9-7 Data plan for configuring the enterprise Ethernet private service-OLT side

Item Data

VLAN SVLAN: smart VLAN 2000 with the attribute QinQ

GPON service board Port: 0/3/1ONT ID: 1ONT authentication mode: SNONT SN: 485754434224C902

DBA profile Profile name: PrivateLineType: type3Assured bandwidth: 20 Mbit/sMaximum bandwidth: 50 Mbit/s

ONT line profile Profile ID: 10GEM port IDs: 0 and 1T-CONT ID: 5QoS mode: PQ, priority: 0GEM port mapping mode: VLAN

ONT service profile Profile ID: 10Port type and numbers: 5 ETH ports, 8 E1 ports, and 8 POTS portsPort VLAN of ETH ports:l Port 1 and 2 belong to VLAN 50

l Port 3 and 4 belong to VLAN 60

VLAN service profile Profile ID: 1Enable transparent transmission of BPDUs.

ONT management mode OMCI

Table 9-8 Data plan for configuring the enterprise Ethernet private service-OT928G side

Item Data

VLAN Private VLANs of enterprise branch A: VLAN 50 and VLAN 60Private VLANs of enterprise branch B: VLAN 50 and VLAN 60

ETH ports ETH ports 1 and 2 receive the internal enterprise packets of VLAN50.ETH ports 3 and 4 receive the internal enterprise packets of VLAN60.



9-81


NOTEOLT_1 and OLT_2 have the same configuration.


Create smart VLAN 2000 and add upstream port 0/19/0 to it.huawei(config)#vlan 2000 smarthuawei(config)#vlan attrib 2000 q-in-qhuawei(config)#port vlan 2000 0/19 0


The ONU is connected to the GPON port of the OLT through an optical fiber. Youcan perform the service configuration only after adding an ONU successfully on theOLT.

(1) Add a DBA profile.Configure the profile name to PrivateLine, profile type to Type3, assuredbandwidth to 20 Mbit/s, and maximum bandwidth to 50 Mbit/s.huawei(config)#dba-profile add profile-name PrivateLine type3 assure 20480 max 51200





(3) Add an ONT line profile.Add GPON ONT line profile 10 and bind T-CONT 5 to the DBA profile namedPrivateLine. In this way, the T-CONT can provide flexible DBA solutions basedon different configurations in the DBA profile.huawei(config)#ont-lineprofile gpon profile-id 10huawei(config-gpon-lineprofile-10)#tcont 5 dba-profile-name PrivateLineAdd GEM port 0 and GEM port 1 for transmitting ETH traffic streams, and bindGEM port 0 and GEM port 1 to T-CONT 5, then configure the QoS mode topriority-queue (default) and the queue priority to 0.

NOTE

a. The QoS mode must be consistent with the actual hardware capability supported by theONT.

b. To change the QoS mode, run the qos-mode command to configure the QoS mode to gem-car or flow-car, and run the gem add to configure the ID of the traffic profile bound to theGEM port.

c. When the QoS mode is PQ, the default queue priority is 0; when the QoS is flow-car,traffic profile 6 is bound to the port by default (no rate limitation); when the QoS mode isgem-car, traffic profile 6 is bound to the port by default (no rate limitation).





Issue 03 (2010-01-28)

Configure the service mapping mode from the GEM port to the ONU to VLAN(default), and map internal VLAN 50 and VLAN 60 of the enterprise to GEMport 0 and 1.huawei(config-gpon-lineprofile-10)#mapping-mode vlanhuawei(config-gpon-lineprofile-10)#gem mapping 0 0 vlan 50huawei(config-gpon-lineprofile-10)#gem mapping 1 1 vlan 60


(4) Configure an ONT service profile.The service profile ID is 10, and the OT928G supports five ETH ports, eight E1ports, and eight POTS ports.huawei(config)#ont-srvprofile gpon profile-id 10huawei(config-gpon-srvprofile-10)#ont-port eth 5 tdm 8 tdm-type e1 tdm-srvtype tdmogem pots 8

Configure the port VLAN of the OT928G. Add ETH ports 1 and 2 to VLAN 50and ETH ports 3 and 4 to VLAN 60.huawei(config-gpon-srvprofile-10)#port vlan eth 1-2 50huawei(config-gpon-srvprofile-10)#port vlan eth 3-4 60

Save the configuration and quit the service profile configuration mode.huawei(config-gpon-srvprofile-10)#commithuawei(config-gpon-srvprofile-10)#quit

(5) Add an ONT.Connect the OT928G to GPON port 0/3/1. The ONT ID is 1, the SN is485754434224C902, the management mode is OMCI, and the bound line profileID is 10, the bound service profile ID is 10.

NOTE




huawei(config)#interface gpon 0/3huawei(config-if-gpon-0/3)#port 1 ont-auto-find enablehuawei(config-if-gpon-0/3)#display ont autofind 1 Command: display ont autofind 1 ------------------------------------------------------------------------ Number F/ S/ P SN Password ------------------------------------------------------------------------ 1 0/ 3/ 1 485754434224C902 ------------------------------------------------------------------------



9-83

huawei(config-if-gpon-0/3)#ont confirm 1 ontid 1 sn-auth 485754434224C902 profile-id 20 manage-mode omci description OT928G_0/3/1/1_profile20 Number of ONTs that can be added: 1, success: 1 PortID :1, ONTID :1

NOTE

l After an ONU is added, it is recommended that you run the display ont info commandor the display ont state command to query the ONU status. In this step, ensure thatConfig Stateand Match State of the ONU are normal and match respectively.

l If the ONU state in the actual query result is different from the preceding description,run the display ont capability command to query the actual ONU capabilities, andthen add a proper ONU profile based on the queried ONU capabilities. Then, add anONU again.



3. Enable transparent transmission of BPDUs, and bind VLAN service profile 1 to theSVLAN.huawei(config)#vlan service-profile profile-id 1huawei(config-vlan-srvprof-1)#bpdu tunnel enable Info: Please use the commit command to make modifications take effecthuawei(config-vlan-srvprof-1)#commithuawei(config-vlan-srvprof-1)#quithuawei(config)#vlan bind service-profile 2000 profile-id 1

4. Create service ports.

Service port IDs are 10 and 20, service VLAN ID is 2000, GEM port IDs are 0 and 1,and CVLAN IDs are 50 and 60. The rates of upstream and downstream packets arenot limited. Therefore, use traffic profile 6 (default). To limit the rate of the serviceport, run the traffic table ip command to add a traffic profile and bind it to the serviceport.

huawei(config)#service-port 10 vlan 2000 gpon 0/3/1 ont 1 gemport 0 multi-service user-vlan 50 tag-transform default rx-cttr 6 tx-cttr 6huawei(config)#service-port 20 vlan 2000 gpon 0/3/1 ont 1 gemport 1 multi-service user-vlan 60 tag-transform default rx-cttr 6 tx-cttr 6


Use the 3PQ+5WRR queue scheduling. Queues 0-4 adopt the WRR mode, with theweights of 10, 10, 20, 20, and 40 respectively; queues 5-7 adopt the PQ mode. Thepriority of the TDM emulation service is 6, adopting the PQ scheduling.







Issue 03 (2010-01-28)



l Configure the OT928G.NOTE

The OT928G need not be configured. All the configurations are performed on the OLT and issued to theOT928G through the OMCI protocol.

----End

ResultThe private networks distributed in two places can communicate with each other and variousservices can be provided between these private networks.

Configuration FileConfigure the OLT.

vlan 2000 smartvlan attrib 2000 q-in-qport vlan 2000 0/19 0dba-profile add profile-name PrivateLine type3 assure 20480 max 51200ont-profile add profile-id 20interface gpon 0/3port 1 ont-auto-find enabledisplay ont autofind 1ont confirm 1 ontid 1 sn-auth 485754434224C902 profile-id 20 manage-mode omci description OT928G_0/3/1/1_profile20ont alarm-profile 1 1 profile-id 1tcont bind-profile 1 1 5 profile-name PrivateLinegemport add 1 gemportid 130 ethgemport add 1 gemportid 131 ethont gemport bind 1 1 130 5 priority-queue 5ont gemport bind 1 1 131 5 priority-queue 5ont gemport mapping 1 1 130 vlan 50ont gemport mapping 1 1 131 vlan 60ont port vlan 1 1 eth 50 1-2ont port vlan 1 1 eth 60 3-4vlan service-profile profile-id 1bpdu tunnel enablecommitquitvlan bind service-profile 2000 profile-id 1service-port 10 vlan 2000 gpon 0/3/1 ont 1 gemport 1 multi-service user-vlan 50 rx-cttr 6 tx-cttr 6service-port 20 vlan 2000 gpon 0/3/1 ont 1 gemport 1 multi-service user-vlan 60 rx-cttr 6 tx-cttr 6queue-scheduler wrr 10 10 20 20 40 0 0 0cos-queue-map cos0 0 cos1 1 cos2 2 cos3 3 cos4 4 cos5 5 cos6 6 cos7 7save

9.1.6 Configuring the FTTM (OLT+OT928G) ServiceIn the FTTM network, the OT928G functions as a base station AG and is connected to the 2Gor 3G base station in various modes. After the OLT transmits signals upstream to the upper-layer network, the OT928G is connected to the base station controller (BSC) or radio networkcontroller (RNC) to implement the 2G or 3G service through the FTTM network.



9-85

Context

The OLT+CBU mobile bearer solutions include the GPON native TDM solution and the GPONEthernet solution.

l The GPON native TDM solution is applicable to the wireless 2G service and the carryingof the wireless 3G CS domain. This solution is mainly used to carry the voice service.

l The GPON Ethernet solution is applicable to the carrying of the wireless 3G PS domain.This solution is mainly used to carry the data service.

9.1.6.1 Configuring the Native TDM Mobile Bearer Service (Based on the SDH Network)The OLT encapsulates TDM frames directly into GPON GEM frames through native TDM andtransmits the TDM service over the GPON network. As such, the traditional circuit switchingservices can be carried over the GPON network.

9.1.6.2 Configuring the Ethernet Mobile Bearer ServiceThe ETH port accesses the 3G NodeB base station data and transmits the data upstream to theOLT through the GPON. The OLT recovers the data and transmits the recovered data to the PSNnetwork through the FE, GE, or 10GE port, implementing the IP-based wireless service.

9.1.6.1 Configuring the Native TDM Mobile Bearer Service (Based on the SDHNetwork)

The OLT encapsulates TDM frames directly into GPON GEM frames through native TDM andtransmits the TDM service over the GPON network. As such, the traditional circuit switchingservices can be carried over the GPON network.

Service Requirementsl The E1 physical port of the OT928G is used for connecting to the 2G or 3G base station in

a unified manner.

l GPON is adopted for carrying the mobile AN in a unified manner to meet mobile carriers'requirements for a high bandwidth and for covering high base station density.

l The E1 or STM-1 port of the OLT is used for upstream transmission to the SDH network.


Figure 9-15 shows an example network of the native TDM mobile bearer service.

The OT928G accesses the TDM service data of the base station through the E1 port, encapsulatesservice packets into GEM frames in the native TDM encapsulation mode, and transmits the GEMframes to the OLT through the GPON. The TOPA board on the OLT transmits the E1/STM-1signals through different daughter boards.

l For the E1 upstream service: The NH1A daughter board performs TDM packetdecapsulation, de-jitter buffer, and clock synchronization, recovers E1 frames through de-mapping after obtaining the VC12, and then transmits E1 frames to the upper-layer SDHdevice through the corresponding E1 port.

l For the STM-1 upstream service: The O2CE daughter board performs TDM packetdecapsulation, de-jitter buffer, and clock synchronization, maps the VC12 to the VC4 afterobtaining the VC12, and then transmits STM-1 signals to the upper-layer SDH device.




Issue 03 (2010-01-28)

Figure 9-15 Example network of the native TDM mobile bearer service

Data PlanTable 9-9 and Table 9-10 provides the data plans for configuring the native TDM mobile bearerservice on the OLT side and the OT928G side.

Table 9-9 Data plan for configuring the native TDM mobile bearer service-OLT side

Item Data

GPON service board Port: 0/3/1ONT ID: 1ONU authentication mode: SNONT SN: 485754434224C902

TOPA service board Port: 0/6/0Daughter board type: NH1A (providing E1 ports) or O2CE(providing STM-1 ports)VC12 ID: 0 (for only the STM-1 port)

DBA profile Profile name: NativeTDMType: type1Fixed bandwidth: 44800 kbit/sBandwidth compensation: enabled

ONT line profile Profile ID: 10GEM port ID: 1T-CONT ID: 5QoS mode: PQGEM port mapping mode: E1

ONT service profile Profile ID: 10Port type and quantity: 5 ETH ports, 8 E1 ports, and 8 POTSports




9-87

Item Data

Clock source Two clock sources:l Line clock, provided by the TOPA board, with the index 0

and priority 0l BITS clock, provided by the BIUA board (in slot 0/0,

providing two clock outputs), with the index 1 and priority 1

Table 9-10 Data plan for configuring the native TDM mobile bearer service-OT928G side

Item Data

E1 port Accessing base station signals on E1 port 1


1. Add an ONT to the OLT.

The ONT is connected to the GPON port of the OLT through an optical fiber. Youcan perform the service configuration only after adding an ONT successfully on theOLT.

(1) Add a DBA profile.Configure the DBA profile name to NativeTDM, DBA type to type1, and fixedbandwidth to 44800bit/s, and enable bandwidth compensation.

NOTEThe bandwidth of each E1 port on the OT928G is 4416 kbit/s. When the OT928G uses thenative TDM mode, which is actually the TDMoEoGEM encapsulation mode, the packetcontains the Ethernet information, GEM frame, and TDM payload. In addition, other overheadcosts caused by packet fragmentation and queue buffering must also be taken intoconsideration. Therefore, bandwidth compensation must be enabled. Recommended TDMfrequency bandwidth formula: bandwidth = (4416 x N + 640) kbit/s, where, N is the numberof E1 ports.huawei(config)#dba-profile add profile-name NativeTDM type1 fix 44800




– Run the gpon alarm-profile add command to add an alarm profile, which isused for monitoring the performance of an activated ONT line.

(3) Add an ONT line profile.Add GPON MDU line profile 10 and bind T-CONT 5 to DBA profile namedNativeTDM. In this way, the T-CONT can provide flexible DBA solutions basedon different configurations in the DBA profile.




Issue 03 (2010-01-28)

huawei(config)#ont-lineprofile gpon profile-id 10huawei(config-gpon-lineprofile-10)#tcont 5 dba-profile-name NativeTDMAdd GEM port 1 for transmitting TDM traffic streams. Bind GEM port 1 to T-CONT 5. Configure the QoS mode to priority-queue (default).

NOTE


b. To change the QoS mode, run the qos-mode command to configure the QoS mode to gem-car or flow-car, and run the gem add command to configure the ID of the traffic profilebound to the GEM port.


huawei(config-gpon-lineprofile-10)#gem add 1 tdm tcont 5Configure the GEM port mapping mode to E1 to map the traffic streams on E1port 1 of the ONT to GEM port 1. As special ports, E1 ports are not subject tothe ONT mapping mode.huawei(config-gpon-lineprofile-10)#gem mapping 1 1 e1 1After the configuration is complete, run the commit command to make theconfigured parameters take effect.huawei(config-gpon-lineprofile-10)#commithuawei(config-gpon-lineprofile-10)#quit

(4) Configure an ONT service profile.The service profile ID is 10, and the OT928G supports five ETH ports, eight E1ports, and eight POTS ports.huawei(config)#ont-srvprofile gpon profile-id 10huawei(config-gpon-srvprofile-10)#ont-port eth 5 tdm 8 tdm-type e1 tdm-srvtype tdmogem pots 8Save the configuration and quit the service profile configuration mode.huawei(config-gpon-srvprofile-10)#commit


NOTE



l In this example, the method of confirming an automatically discovered ONU is used.huawei(config)#interface gpon 0/3huawei(config-if-gpon-0/3)#port 1 ont-auto-find enablehuawei(config-if-gpon-0/3)#display ont autofind 1 Command: display ont autofind 1 ------------------------------------------------------------------------



9-89

Number F/ S/ P SN Password ------------------------------------------------------------------------ 1 0/ 3/ 1 485754434224C902 ------------------------------------------------------------------------ huawei(config-if-gpon-0/3)#ont confirm 1 ontid 1 sn-auth 485754434224C902 profile-id 20 manage-mode omci description OT928G_0/3/1/1_profile20 Number of ONTs that can be added: 1, success: 1 PortID :1, ONTID :1

NOTE



(6) (Optional) Bind the alarm profile to the ONT.The default profile (profile 1) is used.huawei(config-if-gpon-0/3)#ont alarm-profile 1 1 profile-id 1







3. Configure the TDM connection.

Set up a native TDM connection between GEM port 1 and upstream port 0/6/0 of theTOPA board.

– In the case of the E1 upstream port, the configuration is as follows:huawei(config)#tdm-connect tdm 0/6/0 gpon 0/3/1 ontid 1 gemportIndex 1

– In the case of the STM-1 upstream port, you must configure the VC12 parameter.VC12 is the virtual container that carries the E1 service. One STM-1 port contains




Issue 03 (2010-01-28)

63 E1 ports. Accordingly, there are 63 VC12 virtual containers. The configurationis as follows:huawei(config)#tdm-connect tdm 0/6/0 vc12 0 gpon 0/6/1 ontid 1 gemportIndex 1

4. Configure the clock board.NOTE

l In the TDM service, clock synchronization is very important. The entire SDH network must usethe same clock source. Otherwise, error codes will be introduced, which affect the service qualityor even interrupt the service.

l The default clock mode of the E1 port on the TOPA board is line, indicating tracing the SDHclock. Modification is not required.

(1) Configure clock source and priority of the OLT.Add the line clock, provided by the TOPA board, with the index 0.huawei(config)#clock source 0 0/6/0 0Add the BITS clock, provided by the BIUA board, with the index 1.huawei(config)#clock source 1 0/0/0 1Configure the clock priority and prefer the line clock.huawei(config)#clock priority 0/1


l Configuration on the OT928G:NOTE

The OT928G need not be configured. All the configurations are performed on the OLT and issued to theOT928G through the OMCI protocol.

----End

ResultMobile terminals (mobile phones) near the base station can obtain their network informationnormally and make calls and send messages to each other normally.

Configuration Filedba-profile add profile-name NativeTDM type1 fix 44800ont-lineprofile gpon profile-id 10tcont 5 dba-profile-name NativeTDMgem add 1 tdm tcont 5gem mapping 1 1 e1 1commitquitont-srvprofile gpon profile-id 10ont-port eth 5 tdm 8 tdm-type e1 tdm-srvtype tdmogem pots 8commitinterface gpon 0/3port 1 ont-auto-find enabledisplay ont autofind 1ont confirm 1 ontid 1 sn-auth 485754434224C902 omci ont-lineprofile-id 10 ont-srvprofile-id 10 desc OT928G_0/3/1/1_line10_ser10ont alarm-profile 1 1 profile-id 1queue-scheduler wrr 10 10 20 20 40 0 0 0cos-queue-map cos0 0 cos1 1 cos2 2 cos3 3 cos4 4 cos5 5 cos6 6 cos7 7tdm-connect tdm 0/6/0 gpon 0/3/1 ontid 1 gemportIndex 1clock source 0 0/6/0 0clock source 1 0/0/0 1clock priority 0/1save



9-91

9.1.6.2 Configuring the Ethernet Mobile Bearer Service

The ETH port accesses the 3G NodeB base station data and transmits the data upstream to theOLT through the GPON. The OLT recovers the data and transmits the recovered data to the PSNnetwork through the FE, GE, or 10GE port, implementing the IP-based wireless service.

Service Requirementsl The service is transmitted to the 3G NodeB base station through the ETH port of the

OT928G.

l The service is transmitted to the PSN through the FE, GE, or 10GE port of the OLT.

l The GPON is used as the mobile bearer access network, meeting the requirements fortransition to the ALL IP bearer network.


Figure 9-16 shows an example network of the Ethernet private line service of the enterprise.

The data of the 3G base station is transmitted to the OT928G through the FE or GE port,encapsulated as GEM frames on the OT928G, and then transmitted upstream to the OLT throughthe GPON. The OLT recovers the data and transmits the recovered data to the PSN networkthrough the FE, GE, or 10GE port, meeting the requirements for transition to the ALL IP bearernetwork.

Figure 9-16 Example network of the Ethernet mobile bearer service

Data Plan

Table 9-11 provides the data plan for configuring the Ethernet mobile bearer service.

Table 9-11 Data plan for configuring the Ethernet mobile bearer service

Item Data

VLAN SVLAN: smart VLAN 500; attribute: Common

GPON service board Port: 0/3/1ONT ID: 1ONT authentication mode: SNONT SN: 485754434224C902




Issue 03 (2010-01-28)

Item Data

DBA profile Profile name: Eth_FttmType: type3Assured bandwidth: 20 Mbit/sMaximum bandwidth: 50 Mbit/s

ONT line profile Profile ID: 10GEM port ID: 1T-CONT ID: 5QoS mode: PQ, priority: 0GEM port mapping mode: VLAN

ONT service profile Profile ID: 10Port type and quantity: 5 ETH ports, 8 E1 ports, and 8 POTS portsETH port VLAN of the ONT: adding port 1 to VLAN 10


ONT port Base station packets containing VLAN tag 10, accessed throughETH port 1 of the ONT



Create smart VLAN 2000, and add upstream port 0/19/0 to it.


2. Add an ONT to the OLT.

The ONT is connected to the GPON port of the OLT through an optical fiber. Youcan perform the service configuration only after adding an ONT successfully on theOLT.


Configure the DBA profile name to Eth_Fttm, DBA type to type3, assuredbandwidth to 20 Mbit/s, and maximum bandwidth to 50 Mbit/s.huawei(config)#dba-profile add profile-name Eth_Fttm type3 assure 20480 max 51200






9-93

– Run the gpon alarm-profile add command to add an alarm profile, which isused for monitoring the performance of an activated ONT line.

(3) Add an ONT line profile.Add GPON ONT line profile 10 and bind T-CONT 5 to DBA profile namedEth_Fttm. In this way, the T-CONT can provide flexible DBA solutions basedon different configurations in the DBA profile.huawei(config)#ont-lineprofile gpon profile-id 10huawei(config-gpon-lineprofile-10)#tcont 5 dba-profile-name Eth_FttmAdd GEM port 1 for transmitting ETH traffic streams. Bind GEM port 1 to T-CONT 5. Configure the QoS mode to priority-queue (default) and the queuepriority to 0.

NOTE


b. To change the QoS mode, run the qos-mode command to configure the QoS mode to gem-car or flow-car, and run the gem add command to configure the ID of the traffic profilebound to the GEM port.


huawei(config-gpon-lineprofile-10)#gem add 1 eth tcont 5 priority-queue 0Configure the service mapping mode from the GEM port to the ONT to VLAN(default), and map CVLAN tag 10 to GEM port 1.huawei(config-gpon-lineprofile-10)#mapping-mode vlanhuawei(config-gpon-lineprofile-10)#gem mapping 1 1 vlan 10After the configuration is complete, run the commit command to make theconfigured parameters take effect.huawei(config-gpon-lineprofile-10)#commithuawei(config-gpon-lineprofile-10)#quit

(4) Configure an ONT service profile.The service profile ID is 10, and the OT928G supports five ETH ports, eight E1ports, and eight POTS ports.huawei(config)#ont-srvprofile gpon profile-id 10huawei(config-gpon-srvprofile-10)#ont-port eth 5 tdm 8 tdm-type e1 tdm-srvtype tdmogem pots 8Configure the port VLAN of the OT928G. Add ETH port 1 to VLAN 10.huawei(config-gpon-srvprofile-10)#port vlan eth 1 10Save the configuration and quit the service profile configuration mode.huawei(config-gpon-srvprofile-10)#commit





Issue 03 (2010-01-28)

NOTE




huawei(config)#interface gpon 0/3huawei(config-if-gpon-0/3)#port 1 ont-auto-find enablehuawei(config-if-gpon-0/3)#display ont autofind 1 Command: display ont autofind 1 ------------------------------------------------------------------------ Number F/ S/ P SN Password ------------------------------------------------------------------------ 1 0/ 3/ 1 485754434224C902 ------------------------------------------------------------------------ huawei(config-if-gpon-0/3)#ont confirm 1 ontid 1 sn-auth 485754434224C902 profile-id 20 manage-mode omci description OT928G_0/3/1/1_profile20 Number of ONTs that can be added: 1, success: 1 PortID :1, ONTID :1

NOTE



(6) (Optional) Bind the alarm profile to the ONT.


3. Create the service port.

Configure the service port ID to 1, SVLAN ID to 2000, GEM port ID to 1, and CVLANID to 10. Rate limitation for upstream and downstream packets is not performed.Therefore, use traffic profile 6 (default). To limit the rate of the service port, run thetraffic table ip command to add a traffic profile and bind it to the service port.





9-95







l Configure the OT928G.

NOTEThe OT928G need not be configured. All the configurations are performed on the OLT and issued to theOT928G through the OMCI protocol.

----End

ResultMobile terminals (mobile phones) near the 3G base station can obtain their network informationnormally and make calls and send messages to each other normally.


vlan 2000 smartport vlan 2000 0/19 0dba-profile add profile-name Eth_Fttm type3 assure 20480 max 51200ont-lineprofile gpon profile-id 10tcont 5 dba-profile-name Eth_Fttmgem add 1 eth tcont 5 priority-queue 0mapping-mode vlangem mapping 1 1 vlan 10commitquitont-srvprofile gpon profile-id 10ont-port eth 5 tdm 8 tdm-type e1 tdm-srvtype tdmogem pots 8port vlan eth 1 10commitinterface gpon 0/3port 1 ont-auto-find enabledisplay ont autofind 1ont confirm 1 ontid 1 sn-auth 485754434224C902 omci ont-lineprofile-id 10 ont-srvprofile-id 10 desc OT928G_0/3/1/1_line10_ser10ont alarm-profile 1 1 profile-id 1service-port 30 vlan 2000 gpon 0/3/1 ont 1 gemport 1 multi-service user-vlan 10 rx-cttr 6 tx-cttr 6queue-scheduler wrr 10 10 20 20 40 0 0 0




Issue 03 (2010-01-28)

cos-queue-map cos0 0 cos1 1 cos2 2 cos3 3 cos4 4 cos5 5 cos6 6 cos7 7save

9.1.7 Configuring the FTTM (OLT+ATN930) ServiceIn the FTTM network, the ATN930 functions as a base station AG and is connected to the 2Gor 3G base station in various modes. After the OLT transmits signals upstream to the upper-layer network, the ATN930 is connected to the base station controller (BSC) or radio networkcontroller (RNC) to implement the FTTM network application over the 2G or 3G network.

9.1.7.1 Configuring the TDM PWE3 Mobile Bearer Service Between the CBU and the OLTThe CBU ATN930 is connected to the 2G or 3G base station through the E1 port and transmitsthe TDM service to the OLT after emulation. The OLT terminates the emulation data and restoresTDM signals, and then transmits the signals to the SDH network through the E1 port. In thisway, the traditional circuit-switched service is implemented over the GPON network.

9.1.7.2 Configuring the TDM PWE3 Mobile Bearer Service on the CBU (MPLS-based)The CBU ATN930 is connected to the 2G or 3G base station through the E1 port and transmitsthe TDM service to the OLT after emulation. The OLT transparently transmits emulation signalsto the MPLS network and remote PTN network through the GE port. In this way, the traditionalcircuit-switched service is implemented over the GPON network.

9.1.7.3 Configuring the TDM PWE3 Mobile Bearer Service on the CBU (IP-based)The CBU ATN930 is connected to the 2G or 3G base station through the E1 port and transmitsthe TDM service to the OLT after emulation. The OLT transparently transmits emulation signalsto the IP network and remote PTN network through the GE port. In this way, the traditionalcircuit-switched service is implemented over the GPON network.

9.1.7.4 Configuring the ETH PWE3 Mobile Bearer Service on the CBUThe CBU ATN930 is connected to the 3G base station through the FE or GE port, and transmitsthe Ethernet data upstream to the OLT after ETH PWE3 encapsulation. The OLT transparentlytransmits emulation signals to the MPLS network and remote PTN network through the Ethernetport. In this way, the ETH service is implemented over the GPON network.

9.1.7.1 Configuring the TDM PWE3 Mobile Bearer Service Between the CBU andthe OLT

The CBU ATN930 is connected to the 2G or 3G base station through the E1 port and transmitsthe TDM service to the OLT after emulation. The OLT terminates the emulation data and restoresTDM signals, and then transmits the signals to the SDH network through the E1 port. In thisway, the traditional circuit-switched service is implemented over the GPON network.

Service Requirementsl The E1 port is used for connecting to the 2G or 3G base station in a unified manner.

l GPON is adopted for bearing the mobile AN in a unified manner to meet mobile carriers'requirements for a high bandwidth and for covering high base station density.

l Through SAToP emulation, the TDM service data can be transmitted in the GPON network.

l The PWE3 encapsulation mode is IP+UDP.

l The E1 port of the OLT is used for upstream transmission to the SDH network.

Figure 9-17 shows an example network of the TDMoPSN mobile bearer service.

The ATN930 is connected to the 2G or 3G base station through the E1 port to provide the TDMaccess, and then transmits the service data upstream to the GPON service board of the OLT



9-97

through GPON after SAToP emulation. The OLT terminates the emulation data and restoresTDM signals, and then transmits the signals to the SDH network through the E1 port (providedby the EH1A daughter board) of the TOPA board. In this way, the 2G or 3G mobile bearerservice is implemented between the ATN930 and the OLT in the TDM PW mode.

Figure 9-17 Example network of the TDM PWE3 mobile bearer service between the CBU andthe OLT

Data PlanTable 9-12 provides the data plan for the OLT, and Table 9-13 provides the data plan for theATN930.

Table 9-12 Data plan for configuring the TDM PWE3 mobile bearer service-OLT side

Item Data

VLAN Inband management VLAN: smart VLAN 4000SVLAN: smart VLAN 500

IP address Inband management IP address: 192.168.50.1/24

GPON service board Port: 0/3/1ONU ID: 1ONU authentication mode: SNONU SN: 48575443E6D8B541

TOPA service board Port: 0/6/0Daughter board type: NH1A (providing E1 ports)IP address of the board: 20.20.20.20MAC address of the board: 0800-3E32-5310Local UDP port ID: 50050

DBA profile Profile name: TDMType: type1Fixed bandwidth: 32 Mbit/sBandwidth compensate: enable




Issue 03 (2010-01-28)

Item Data

ONU line profile Profile ID: 10, bound to the DBA profile named TDMGEM port IDs: 0 and 1T-CONT ID: 1

ONU management mode SNMP

Table 9-13 Data plan for configuring the TDM PWE3 mobile bearer service-ATN930 side

Item Data

VLAN Inband management VLAN: smart VLAN 4000, adding GPONupstream port 0/0/0 to this VLANSVLAN: smart VLAN 500, adding GPON upstream port 0/0/0 tothis VLAN

IP address Inband management IP address: 192.168.50.2/24IP address of the L3 interface of VLAN 500: 10.50.50.50/24IP address of loopback interface 0: 5.5.5.5/32

MAC address MAC address of L3 interface of VLAN 500: 00E0-FC01-0450MAC address of the GPON port of the ATN930: 0018-82D6-D178

MPLS MPLS LSR ID: 5.5.5.5Global MPLS: enabledMPLS L2 VPN: enabledMAC address of the board: 0800-3E32-5310Local UDP port ID: 50050Remote UDP port ID: 50050

PW template Template name: cbu2olt_satopTemplate type: TDM SAToPPeer IP address: 20.20.20.20PW load time: 125 μsJitter buffer size: 2500 μsControl word: supportedRTP: enabled

Tunnel Tunnel ID: 10Link layer encapsulation protocol of the tunnel interface: IPDestination IP address: 20.20.20.20Policy name: ip-policy



9-99

Item Data

E1 port Port: 0/3/0Working mode of the port: UDTTransmit clock of the port: systemTDM virtual path link ID: 10

Clock source SAToP clock (channel 0 , clock source 0) + GPON line clock (port0/0/0, clock source 1)Priority: p0 > p1





2. Add an ONU to the OLT.

The ONU is connected to the GPON port of the OLT through an optical fiber. Youcan perform the service configuration only after adding an ONU successfully on theOLT. To log in to the ONU through Telnet and configure the ONU from the OLT,you must configure the inband management VLANs and IP addresses of the OLT andthe ONU on the OLT.


NOTETo manage the ONU through SNMP, you must configure the management VLAN, configurethe management IP address, and create a management service port.huawei(config)#vlan 4000 smarthuawei(config)#port vlan 4000 0/19 0huawei(config)#interface vlanif 4000huawei(config-if-vlanif4000)#ip address 192.168.50.1 24huawei(config-if-vlanif4000)#quit

(2) Add a DBA profile.Configure the DBA profile name to TDM, DBA type to type1, fixed bandwidthto 32 Mbit/s, and enable the bandwidth compensate function.huawei(config)#dba-profile add profile-name TDM type1 fix 32768 bandwidth_compensate yes







Issue 03 (2010-01-28)


(4) Add an ONU line profile.Add GPON MDU line profile 10 and bind T-CONT 1 to DBA profile namedTDM. In this way, the T-CONT can provide flexible DBA solutions based ondifferent configurations in the DBA profile.huawei(config)#ont-lineprofile gpon profile-id 10huawei(config-gpon-lineprofile-10)#tcont 1 dba-profile-name TDMAdd GEM port 0 for transmtting management traffic streams and GEM port 1for transmitting ETH traffic streams. Bind GEM port 0 and GEM port 1 to T-CONT 1. Configure the QoS mode to priority-queue (default) and the queuepriority to 6.

NOTE

a. To change the QoS mode, run the qos-mode command to configure the QoS mode to gem-car or flow-car, and run the gem add command to configure the ID of the traffic profilebound to the GEM port.

b. When the QoS mode is PQ, the default queue priority is 0; when the QoS is flow-car,traffic profile 6 is bound to the port by default (no rate limitation); when the QoS mode isgem-car, traffic profile 6 is bound to the port by default (no rate limitation).

huawei(config-gpon-lineprofile-10)#gem add 0 eth tcont 1 priority-queue 6 cascade onhuawei(config-gpon-lineprofile-10)#gem add 1 eth tcont 1 priority-queue 6 cascade onConfigure the mapping mode from the GEM port to ONU-side service to VLAN(default), map the service port of management VLAN 4000 to GEM port 0, andmap the service port of SVLAN 500 to GEM port 1.huawei(config-gpon-lineprofile-10)#mapping-mode vlanhuawei(config-gpon-lineprofile-10)#gem mapping 0 0 vlan 4000huawei(config-gpon-lineprofile-10)#gem mapping 1 1 vlan 500After the configuration is complete, run the commit command to make theconfigured parameters take effect.huawei(config-gpon-lineprofile-10)#commithuawei(config-gpon-lineprofile-10)#quit

(5) Add an ONU.Connect the ATN930 to GPON port 0/3/1. The ONU ID is 1, the SN is48575443E6D8B541, the management mode is SNMP, and the bound lineprofile ID is 10.

NOTE



l In this example, the method of confirming an automatically discovered ONU is used.huawei(config)#interface gpon 0/3huawei(config-if-gpon-0/3)#port 1 ont-auto-find enablehuawei(config-if-gpon-0/3)#display ont autofind 1 Command: display ont autofind 1



9-101

------------------------------------------------------------------------ Number F/ S/ P SN Password ------------------------------------------------------------------------ 1 0/ 3/ 1 48575443E6D8B541 ------------------------------------------------------------------------ huawei(config-if-gpon-0/3)#ont confirm 1 ontid 1 sn-auth 48575443E6D8B541 snmp ont-lineprofile-id 10 desc ATN930_0/3/1/1_line10 Number of ONTs that can be added: 1, success: 1 PortID :1, ONTID :1

NOTE

l After an ONU is added, it is recommended that you run the display ont info commandor the display ont state command to query the ONU status. In this step, ensure thatConfig State and Config State of the ONU are normal and match respectively.



(7) Configure the inband management VLAN and IP address of the ONU.Configure the static IP address of the ATN930 to 192.168.50.2/24 and themanagement VLAN ID to 4000 (the same as the management VLAN of theOLT).huawei(config-if-gpon-0/3)#ont ipconfig 1 1 static ip-address 192.168.50.2 mask 255.255.255.0 vlan 4000

(8) Configure an inband management service port.Configure the management service port ID to 0, management VLAN ID to 4000,GEM port ID to 0, and CVLAN ID to 4000. The rate of the inband service porton the OLT is not limited. Therefore, use traffic profile 6 (default). To limit therate of the service port, run the traffic table ip command to add a traffic profileand bind it to the service port.huawei(config-if-gpon-0/3)#quithuawei(config)#service-port 0 vlan 4000 gpon 0/3/1 ont 1 gemport 0 multi-service user-vlan 4000 rx-cttr 6 tx-cttr 6

NOTE

Now, the ONU is successfully added to the OLT, and the management channel between the OLTand the ONU is available. You can log in to the ATN930 by running the telnet 192.168.50.2command on the OLT to configure the ATN930.


Configure the management service port ID to 1, SVLAN ID to 500, GEM port ID to1, and CVLAN ID to 500. Rate limitation for upstream and downstream packets isperformed on the MDU instead of on the OLT. Therefore, use traffic profile 6 (default).




Issue 03 (2010-01-28)

To limit the rate of the service port, run the traffic table ip command to add a trafficprofile and bind it to the service port.

NOTEThe CVLAN must be the same as the upstream VLAN of the ATN930.








5. Configure the attribute of the TOPA board.

Configure the IP address of the upstream E1 port in slot 0/6.

huawei(config)#interface top 0/6huawei(config-if-top-0/6)#set ip-address 20.20.20.20huawei(config-if-top-0/6)#quit

6. Log in to the ATN930 to perform the configuration.

On the OLT, run the telnet 192.168.50.2 command to log in to the ATN930 to performthe configuration. For details about the configuration, see Configure the ONU..

7. Configure the SAToP connection.

NOTEPerform this step after the ATN930 is configured because certain parameters must be obtained fromthe ATN930.

Create a CESoP connection on TDM port 0/6/0. Configure the SVLAN ID to 500,local UDP port ID to 50050, remote MAC address (MAC address of VLAN interface500 of the ATN930, which can be queried by running the display interface vlanif500 command on the ATN930) to 00e0-fc01-0450, remote IP address (IP address ofthe loopback interface corresponding to the LSR ID of the ATN930) to 5.5.5.5, andthe remote UDP port ID to 50050.

huawei(config)#cesop-connect tdm 0/6/0 vlan 500 local-udp 50050 remote-mac 00e0-fc01-0450 remote-ip 5.5.5.5 remote-udp 50050




9-103

l Configure the ONU.

NOTEBecause the management VLAN and the management IP address have been configured, you can run thetelnet 192.168.50.2 command on the OLT to log in to the ATN930 to perform the configuration. Youcan also log in to the ATN930 through a serial port to perform the configuration.

1. Configure the IP address of the loopback interface.

Configure the IP address of loopback interface 0 to 5.5.5.5/32.

huawei(config)#interface loopback 0huawei(config-if-loopback0)#ip address 5.5.5.5 32huawei(config-if-loopback0)#quit

2. Configure the MPLS LSR ID and enable the global MPLS and L2 VPN functions.huawei(config)#mpls lsr-id 5.5.5.5 //Set the local LSR ID to the IP address of loopback interface 0huawei(config)#mpls //Enable global MPLShuawei(config-mpls)#quithuawei(config)#mpls l2vpn //Enable L2 VPN

3. Enable the basic MPLS functions for VLAN interface 500 and configure the IP addressof VLAN interface 500.huawei(config)#vlan 500 smart //Upstream VLANhuawei(config)#mpls vlan 500huawei(config)#port vlan 500 0/0 0huawei(config)#interface vlanif 500huawei(config-if-vlanif200)#ip address 10.50.50.50 24 //Configure the IP address of VLAN interface 500 to 10.50.50.50/24huawei(config-if-vlanif200)#mplshuawei(config-if-vlanif200)#quit

4. Configure the static route to the IP address of the TOPA board on the OLT.

Configure the destination IP address to 20.20.20.20, egress interface to VLANinterface 500, and next hop to 10.50.50.1.

huawei(config)#ip route-static 20.20.20.20 32 vlanif 500 10.50.50.1

5. Configure the static ARP entry of the next hop IP address of the static route.

The next hop IP address is 10.50.50.1, the MAC address of the TOPA board is0800-3E32-5310, and services are transmitted through upstream GPON port 0/0/0 thatis in VLAN 500.

huawei(config)#arp 10.50.50.1 0800-3E32-5310 500 0/0/0

6. Create an IP tunnel from the ATN930 to the OLT and configure the tunnel policy.

Configure the tunnel ID to 10, link layer encapsulation protocol of the tunnel interfaceto IP, destination IP address of the tunnel to 20.20.20.20, and tunnel policy name toip-policy.

huawei(config)#interface tunnel 10huawei(config-if-tunnel10)#tunnel-protocol mpls iphuawei(config-if-tunnel10)#destination 20.20.20.20huawei(config-if-tunnel10)#mpls ip commithuawei(config-if-tunnel10)#quithuawei(config)#tunnel-policy ip-policyInfo: New tunnel-policy is configured.huawei(config-tunnel-policy-ip-policy)#tunnel select-seq ip load-balance-number 1huawei(config-tunnel-policy-ip-policy)#quit

7. Create a PW profile and configure its attributes.

(1) Configure the PW name and type.




Issue 03 (2010-01-28)

Configure the PW name to cbu2olt_satop and type to SAToP.huawei(config)#pw-template cbu2olt_satophuawei(config-pw-template-cbu2olt_satop)#pw-type tdm satop

(2) Configure the IP address of the TOPA board of the remote device (OLT in thisexample) in the PW template.Configure the IP address to 20.20.20.20.huawei(config-pw-template-cbu2olt_satop)#peer-address 20.20.20.20

(3) Configure the PW load time.Configure the load time to 125 μs.huawei(config-pw-template-cbu2olt_satop)#tdm-load-time satop loadtime 125

(4) (Optional) Enable RTP. After RTP is enabled, PW packets of the TDM typecontain the RTP control header. By default, RTP is disabled.

NOTEThe RTP configuration must be the same as that on the OLT. On the OLT, RTP is enabled bydefault.huawei(config-pw-template-cbu2olt_satop)#rtp enable

(5) (Optional) Configure the jitter buffer size. The jitter buffer can effectivelyprevent jitter and delay. Only PW templates of the TDM type support the jitterbuffer configuration. By default, the jitter buffer size is 2000 μs.

NOTEThe value range of the jitter buffer is 500-32000 and the value must be an integer multiple of125. You can configure this value according to actual conditions. In this example, the jitterbuffer size is configured to 2500 μs.huawei(config-pw-template-cbu2olt_satop)#jitter-buffer buffer-size 2500

(6) Configure the PW template to or not to support the control word.huawei(config-pw-template-cbu2olt_satop)#control-word

(7) Configure the tunnel policy used by the PW template.Configure the tunnel policy name to ip-policy.huawei(config-pw-template-cbu2olt_satop)#tnl-policy ip-policyhuawei(config-pw-template-cbu2olt_satop)#quit

(8) Reset the PW template.

CAUTIONAfter modifying the attributes of a PW template, you must reset the PW. Afterthat, the modified attributes take effect. After a PW is reset, the protocol startsnegotiation again. In this case, the services are interrupted. Therefore, exercisecaution when you run this command.

huawei(config)#reset pw template cbu2olt_satop Info: In operation, please wait...OK!

8. Configure the TDM service port and create TDM VCL 10.huawei(config)#interface tdm 0/3huawei(config-if-tdm-0/3)#port 0 udt system //Confiugre TDM port 0 to work in the UDT mode, and use the system clock as the transmit clock of the porthuawei(config-if-tdm-0/3)#quit



9-105

huawei(config)#tdm-vcl tdm-vcl-id 10 satop 0/3/0 //Create TDM VCL 10 on port 0/3/0 and configure the type to SAToP

9. Bind the TDM to the PW.

The IP+UDP encapsulation mode is adopted. Such a PW does not use the signalingprotocol for parameter negotiation. You can manually specify the related informationby running the related command. The data of a static PW is transmitted between theprovider edges (PEs) through tunnels. Configure the TDM virtual path link (VPL) IDto 10, PW ID to 1, PW template name to cbu2olt_satop, working mode to UDP, localUDP port ID to 50050, and destination port ID to 50050.

huawei(config)#pw-ac-binding tdm 10 pw 1 pw-template cbu2olt_satop udp ingress-dst-port 50050 egress-dst-port 50050

NOTEThe destination port ID (dst-port) of the PW configured on the ATN930 must be the same as thedestination port ID (local-udp) configured on the remote PE (in this example, the peer PE is theOLT).

10. Configure the system clock source.

The system input clock and output clock sources of the ATN930 can be obtainedthrough the GPON line clock and adaptive recovery clock when it adopts GPON. Ifthe configuration is not performed, the ATN930 adopts the local oscillator as thesystem clock or output clock source.

(1) Obtain clock signals from channel 0 of the received SAToP data streams andupstream port 0/0/0 as the system clock source, with the IDs of 0 and 1respectively.huawei(config)#clock source 0 adapt-clock 0huawei(config)#clock source 1 0/0/0

(2) Configure the priority of the system clock. The priority of the adaptive clocksource is higher than that of the line clock source.huawei(config)#clock priority system 0/1

(3) Bind the adaptive clock source to PW 1.huawei(config)#interface tdm 0/3huawei(config-if-tdm-0/3)#adapt-clock-source 0 1huawei(config-if-tdm-0/3)#quit


----End

ResultOn the ATN930, you can run the display pw-ac-binding command to confirm that the PW isin the up (normal) state.huawei(config)#display pw-ac-binding tdm 10 { <cr>|secondary<K> }: Command: display pw-ac-binding tdm 10 Total : 1 (Up/Down : 1/0 Static/LDP : 1/0) ---------------------------------------------------------------------------- TDM PW PW PROTO RECEIVE TRNS TEMPLATE ID ID STATE TYPE LABEL LABEL NAME ---------------------------------------------------------------------------- 10 1 up UDP 50050 50050 cbu2olt_satop ---------------------------------------------------------------------------- Note : F--Frame, S--Slot, P--Port *: Secondary




Issue 03 (2010-01-28)

Configuration File

Configure the OLT.

vlan 500 smartport vlan 500 0/19 0vlan 4000 smartport vlan 4000 0/19 0interface vlanif 4000ip address 192.168.50.1 24quitdba-profile add profile-name TDM type1 fix 32768 bandwidth_compensate yesont-lineprofile gpon profile-id 10tcont 1 dba-profile-name TDMgem add 0 eth tcont 1 priority-queue 6 cascade ongem add 1 eth tcont 1 priority-queue 6 cascade onmapping-mode vlangem mapping 0 0 vlan 4000gem mapping 1 1 vlan 500commitquitinterface gpon 0/3port 1 ont-auto-find enabledisplay ont autofind 1ont confirm 1 ontid 1 sn-auth 48575443E6D8B541 snmp ont-lineprofile-id 10 desc ATN930_0/3/1/1_lineprofile10ont ipconfig 1 1 static ip-address 192.168.50.2 mask 255.255.255.0 vlan 4000ont alarm-profile 1 1 profile-id 1service-port 0 vlan 4000 gpon 0/3/1 ont 1 gemport 0 multi-service user-vlan 4000 rx-cttr 6 tx-cttr 6service-port 1 vlan 500 gpon 0/3/1 ont 1 gemport 1 multi-service user-vlan 500 rx-cttr 6 tx-cttr 6queue-scheduler wrr 10 10 20 20 40 0 0 0cos-queue-map cos0 0 cos1 1 cos2 2 cos3 3 cos4 4 cos5 5 cos6 6 cos7 7interface top 0/6set ip-address 20.20.20.20quittelnet 192.168.50.2cesop-connect tdm 0/6/0 vlan 500 local-udp 50050 remote-mac 00e0-fc01-0450 remote-ip 5.5.5.5 remote-udp 50050save

Configure the ATN930.

interface loopback 0ip address 5.5.5.5 32quitmpls lsr-id 5.5.5.5mplsquitmpls l2vpnvlan 500 smartmpls vlan 500port vlan 500 0/0 0interface vlanif 500ip address 10.50.50.50 24mplsquitip route-static 20.20.20.20 32 vlanif 500 10.50.50.1arp 10.50.50.1 0800-3E32-5310 500 0/0/0interface tunnel 10tunnel-protocol mpls ipdestination 20.20.20.20mpls ip commitquittunnel-policy ip-policytunnel select-seq ip load-balance-number 1quitpw-template cbu2olt_satop



9-107

pw-type tdm satoppeer-address 20.20.20.20tdm-load-time satop loadtime 125rtp enablejitter-buffer buffer-size 2500control-wordtnl-policy ip-policyquitreset pw template cbu2olt_satopinterface tdm 0/3port 0 udt systemquittdm-vcl tdm-vcl-id 10 satop 0/3/0pw-ac-binding tdm 10 pw 1 pw-template cbu2olt_satop udp ingress-dst-port 50050 egress-dst-port 50050clock source 0 adapt-clock 0clock source 1 0/0/0clock priority system 0/1interface tdm 0/3adapt-clock-source 0 1quitsave

9.1.7.2 Configuring the TDM PWE3 Mobile Bearer Service on the CBU (MPLS-based)

The CBU ATN930 is connected to the 2G or 3G base station through the E1 port and transmitsthe TDM service to the OLT after emulation. The OLT transparently transmits emulation signalsto the MPLS network and remote PTN network through the GE port. In this way, the traditionalcircuit-switched service is implemented over the GPON network.



l Through SAToP or CESoP emulation, the TDM service data can be transmitted in theGPON network.

l The PWE3 encapsulation mode is MPLS+MPLS, and the static LSP is adopted.

l The service is transmitted upstream to the MPLS network or and remote PTN networkthrough the GE port of the OLT.

Figure 9-18 shows an example network of the TDM PWE3 mobile bearer service.

The ATN930 is connected to the 2G or 3G base station through the E1 port to provide the TDMaccess, and then transmits the service data upstream to the GPON service board of the OLTthrough GPON after SAToP emulation. The OLT transparently transmits emulation signals tothe MPLS network and remote PTN network through the GE port. The PTN device terminatesemulation signals and restores them to TDM signals. In this way, the 2G or 3G mobile bearerservice is implemented between the ATN930 and the remote PTN in the TDM PW mode.




Issue 03 (2010-01-28)

Figure 9-18 Example network of the TDM PWE3 mobile bearer service on the CBU (MPLS-based)


The ATN930 supports static and dynamic PWs. You can configure the PW according to therequirements.

l A dynamic PW is created through LDP, and the LSP is generated dynamically. No manualconfiguration is required.

l The relevant information about a static PW is manually specified through the CLI, and theparameters are not negotiated through LDP. Therefore, a static LSP can work normallyonly after the LSRs along the LSP are configured.

The ATN930 supports SAToP encapsulation and CESoP encapsulation, and you can configurethe encapsulation mode according to the requirements.

l The structure-agnostic TDM over PSN (SAToP) standard provides the non-structurizedTDM service with the emulation and transmission functions. The protocol need not beaware of the structure of the TDM packets and transparently transmits the packets.Therefore, if the customer only needs to provide services based on E1, SAToP can meetthis requirement.

l The circuit emulation services over PSN (CESoP) standard provides the structurized TDMservice with emulation and transmission functions, and then the TDM frame structure andin-frame signaling can be identified. Therefore, if the customer needs to provide servicesbased on timeslot, CESoP can meet this requirement.

Data Plan

Table 9-14 provides the data plan for the OLT, Table 9-15 provides the data plan for theATN930, and Table 9-16 provides the data plan for the remote PTN.


Item Data





9-109

Item Data


DBA profile Profile name: TDMType: type1Fixeded bandwidth: 32 Mbit/s




Item Data



MPLS MPLS LSR ID: 5.5.5.5Global MPLS: enabledMPLS L2 VPN: enabledOut-label of the ingress node that functions as the static LSP: 8100In-label of the ingress node that functions as the static LSP: 8200

PW Template name: cbu2ptn_satopTemplate type: TDM SAToPPeer IP address: 30.30.30.30PW load time: 125 μsJitter buffer size: 2500 μsControl word: supportedRTP: enabledPW transmit label: 8448PW receive label: 8449




Issue 03 (2010-01-28)

Item Data

Tunnel Tunnel interface ID: 10Tunnel ID: 10Link layer encapsulation protocol of the tunnel interface: MPLS-TETunnel signaling protocol: staticDestination IP address: 30.30.30.30Policy name: mpls-static



Table 9-16 Data plan for configuring the TDM PWE3 mobile bearer service-PTN side

Item Data

IP address L3 interface IP address of VLAN 500 that functions as LSP1egress node and LSP2 ingress node: 10.60.60.60/24

MPLS LSR-ID: 30.30.30.30Tunnel interface ID: 10Tunnel ID: 10In-label of the egress node that functions as the static LSP: 8100Out-label of the ingress node that functions as the static LSP: 8200









9-111

(1) Configure the inband management VLAN and IP address of the OLT.

Create management VLAN 4000 and add upstream port 0/19/0 to it. Configurethe inband management IP address to 192.168.50.1/24.



Configure the profile name to TDM, profile type to Type1, Fixed bandwidth to32 Mbit/s.huawei(config)#dba-profile add profile-name TDM type1 fix 32768






Add GPON MDU line profile 10 and bind T-CONT 1 to the DBA profile namedTDM. In this way, the T-CONT can provide flexible DBA solutions based ondifferent configurations in the DBA profile.huawei(config)#ont-lineprofile gpon profile-id 10huawei(config-gpon-lineprofile-10)#tcont 1 dba-profile-name TDM

Add GEM port 0 for transmitting management traffic streams and GEM port 1for transmitting ETH traffic streams. Bind GEM port 0 and GEM port 1 to T-CONT 1. Configure the QoS mode to priority-queue (default) and the queuepriority to 6.

NOTE



huawei(config-gpon-lineprofile-10)#gem add 0 eth tcont 1 priority-queue 1 cascade onhuawei(config-gpon-lineprofile-10)#gem add 1 eth tcont 1 priority-queue 6 cascade on

Configure the mapping mode from the GEM port to ONU-side service to VLAN(default), map the service port of management VLAN 4000 to GEM port 0, andmap the service port of SVLAN 500 to GEM port 1.huawei(config-gpon-lineprofile-10)#mapping-mode vlanhuawei(config-gpon-lineprofile-10)#gem mapping 0 0 vlan 4000huawei(config-gpon-lineprofile-10)#gem mapping 1 1 vlan 500




Issue 03 (2010-01-28)


(5) Add an ONU.

Connect the ATN930 to GPON port 0/3/1. The ONU ID is 1, the SN is48575443E6D8B541, the management mode is SNMP, and the bound lineprofile ID is 10.

NOTE




huawei(config)#interface gpon 0/3huawei(config-if-gpon-0/3)#port 1 ont-auto-find enablehuawei(config-if-gpon-0/3)#display ont autofind 1 Command: display ont autofind 1 ------------------------------------------------------------------------ Number F/ S/ P SN Password ------------------------------------------------------------------------ 1 0/ 3/ 1 48575443E6D8B541 ------------------------------------------------------------------------ huawei(config-if-gpon-0/3)#ont confirm 1 ontid 1 sn-auth 48575443E6D8B541 snmp ont-lineprofile-id 10 desc ATN930_0/3/1/1_line10 Number of ONTs that can be added: 1, success: 1 PortID :1, ONTID :1

NOTE








9-113

Configure the static IP address of the ATN930 to 192.168.50.2/24 and themanagement VLAN ID to 4000 (the same as the management VLAN of theOLT).huawei(config-if-gpon-0/3)#ont ipconfig 1 1 static ip-address 192.168.50.2 mask 255.255.255.0 vlan 4000

(8) Configure an inband management service port.Configure the management service port ID to 0, management VLAN ID to 4000,GEM port ID to 0, and CVLAN ID to 4000. The rate of the inband service porton the OLT is not limited. Therefore, use traffic profile 6 (default). To limit therate of the service port, run the traffic table ip command to add a traffic profileand bind it to the service port.huawei(config-if-gpon-0/3)#quithuawei(config)#service-port 0 vlan 4000 gpon 0/3/1 ont 1 gemport 0 multi-service user-vlan 4000 rx-cttr 6 tx-cttr 6

NOTE



Configure the management service port ID to 1, SVLAN ID to 500, GEM port ID to1, and CVLAN ID to 500. Rate limitation for upstream and downstream packets isperformed on the MDU instead of on the OLT. Therefore, use traffic profile 6 (default).To limit the rate of the service port, run the traffic table ip command to add a trafficprofile and bind it to the service port.


huawei(config)#service-port 1 vlan 500 gpon 0/3/1 ont 1 multi-service user-vlan 500











Issue 03 (2010-01-28)

l Configure the ONU.NOTE

Because the management VLAN and the management IP address have been configured, you can run thetelnet 192.168.50.2 command on the OLT to log in to the ATN930 to perform the configuration. Youcan also log in to the ATN930 through a serial port to perform the configuration.


Configure the IP address of loopback interface 0 to 5.5.5.5/32.huawei(config)#interface loopback 0huawei(config-if-loopback0)#ip address 5.5.5.5 32huawei(config-if-loopback0)#quit


3. Enable the MPLS TE function for VLAN interface 500 and configure the IP addressof VLAN interface 500.huawei(config)#vlan 500 smart //Upstream VLANhuawei(config)#mpls vlan 500huawei(config)#port vlan 500 0/0 0huawei(config)#interface vlanif 500huawei(config-if-vlanif200)#ip address 10.50.50.50 24 //Configure the IP address of VLAN interface 500 to 10.50.50.50/24huawei(config-if-vlanif200)#mplshuawei(config-if-vlanif200)#mpls tehuawei(config-if-vlanif200)#quit

4. Create an MPLS tunnel from the ATN930 to the PTN.

Configure the tunnel ID to 10 and the link layer encapsulation protocol of the tunnelinterface to MPLS.huawei(config)#interface tunnel 10huawei(config-if-tunnel10)#tunnel-protocol mpls te

Configure the destination IP address of the tunnel to 30.30.30.30.huawei(config-if-tunnel10)#destination 30.30.30.30

Configure the MPLS TE tunnel ID to 10. A tunnel ID and an LSR ID uniquelyidentifies an MPLS TE tunnel.huawei(config-if-tunnel10)#mpls te tunnel-id 10

Configure the signaling protocol for creating the MPLS TE tunnel to static.huawei(config-if-tunnel10)#mpls te signal-protocol static

Save the configuration and quit the MPLS TE configuration.huawei(config-if-tunnel10)#mpls te commithuawei(config-if-tunnel10)#quit

5. Configure parameters of the ingress node of the static LSP.

Configure the tunnel interface ID to 10, IP address of the egress node of the LSP to30.30.30.30, next hop IP address (L3 interface IP address of the egress node in thesame tunnel) to 10.60.60.60, and out-label to 8100 (which must be the same as the in-label of the downstream LSR).

NOTEA static MPLS TE tunnel can be used only after it is bound to a static LSP.



9-115

huawei(config)#static-lsp ingress tunnel-interface tunnel 10 destination 30.30.30.30 nexthop 10.60.60.60 out-label 8100

6. Configure parameters of the egress node of the static LSP.

Configure the name of the static LSP to ptn2atn930, bind the static LSP to VLANinterface 500 of the ingress node (The VLAN interface IP address is the next hop IPaddress of the ingress node. The communication between LSRs is available only whenthe ingress node and the egress node are added to the same MPLS VLAN), andconfigure the in-label to 8200 (which must be the same as the out-label of the upstreamLSR).

huawei(config)#static-lsp egress ptn2atn930 incoming-interface vlanif 500 in-lable 8200

7. Configure the tunnel policy.

Configure the policy name to mpls-static, bind the policy to tunnel 10, and configurethe destination IP address of the tunnel to 30.30.30.30.

NOTEThe destination IP address should be consistent with that configured in the MPLS TE tunnel.

huawei(config)#tunnel-policy mpls-staticInfo: New tunnel-policy is configured.huawei(config-tunnel-policy-mpls-static)#tunnel binding destination 30.30.30.30 te tunnel 10huawei(config-tunnel-policy-mpls-static)#quit



Configure the PW name to cbu2ptn_satop, and type to SAToP.huawei(config)#pw-template cbu2ptn_satophuawei(config-pw-template-cbu2ptn_satop)#pw-type tdm satop

(2) Configure the loopback interface IP address of the remote PTN device in the PWprofile.

Configure the loopback interface IP address to 30.30.30.30.huawei(config-pw-template-cbu2ptn_satop)#peer-address 30.30.30.30

(3) Configure the PW load time.

Configure the load time to 125 μs.huawei(config-pw-template-cbu2ptn_satop)#tdm-load-time satop loadtime 125


NOTEThe RTP configuration must be the same as that on the PTN.huawei(config-pw-template-cbu2ptn_satop)#rtp enable


NOTEThe value range of the jitter buffer is 500-32000 and the value must be an integer multiple of125. You can configure this value according to actual conditions. In this example, the jitterbuffer size is configured to 2500 μs.




Issue 03 (2010-01-28)

huawei(config-pw-template-cbu2ptn_satop)#jitter-buffer buffer-size 2500

(6) Configure the PW template to or not to support the control word.huawei(config-pw-template-cbu2ptn_satop)#control-word

(7) Configure the tunnel policy used by the PW template.

Configure the tunnel policy name to mpls-static.huawei(config-pw-template-cbu2ptn_satop)#tnl-policy mpls-statichuawei(config-pw-template-cbu2ptn_satop)#quit



huawei(config)#reset pw template cbu2ptn_satop Info: In operation, please wait...OK!

9. Configure the TDM service port and create TDM VCL 10.huawei(config)#interface tdm 0/3huawei(config-if-tdm-0/3)#port 0 udt system //Confiugre TDM port 0 to work in the UDT mode //Use the system clock as the transmit clock of the porthuawei(config-if-tdm-0/3)#quithuawei(config)#tdm-vcl tdm-vcl-id 10 satop 0/3/0 //Create TDM VCL 10 on port 0/3/0 and configure the type to SAToP


The static LSP encapsulation mode is adopted. Such a PW does not use the LDPsignaling protocol for parameter negotiation. You can manually specify the relatedinformation by running the related command. The data of a static PW is transmittedbetween the provider edges (PEs) through tunnels. Configure the TDM virtual pathlink (VPL) ID to 10, PW ID to 1, PW template cbu2ptn_satop, type to MPLS, transmitlabel to 8448, and receive label to 8449.

huawei(config)#pw-ac-binding tdm 10 pw 1 pw-template cbu2ptn_satop static transmit-label 8448 receive-label 8449

NOTEWhen you configure a static TDM PW, the PW transmit-label and receive-label configured on theATN930 must be the same as the PW transmit-label and receive-label configured on the peer PE(the PTN in this example).



(1) Obtain clock signals from channel 0 of the received SAToP data streams andupstream port 0/0/0 as the system clock source, with the IDs of 0 and 1respectively.



9-117

huawei(config)#clock source 0 adapt-clock 0huawei(config)#clock source 1 0/0/0




----End

ResultOn the ATN930, you can run the display pw-ac-binding command to confirm that the PW isin the up (normal) state.huawei(config)#display pw-ac-binding tdm 10 { <cr>|secondary<K> }: Command: display pw-ac-binding tdm 10 Total : 1 (Up/Down : 1/0 Static/LDP : 1/0) ---------------------------------------------------------------------------- TDM PW PW PROTO RECEIVE TRNS TEMPLATE ID ID STATE TYPE LABEL LABEL NAME ---------------------------------------------------------------------------- 10 1 up static 8449 8448 cbu2ptn_satop ---------------------------------------------------------------------------- Note : F--Frame, S--Slot, P--Port *: Secondary


vlan 500 smartport vlan 500 0/19 0vlan 4000 smartport vlan 4000 0/19 0interface vlanif 4000ip address 192.168.50.1 24quitdba-profile add profile-name TDM type1 fix 32768ont-lineprofile gpon profile-id 10tcont 1 dba-profile-name TDMgem add 0 eth tcont 1 priority-queue 6 cascade ongem add 1 eth tcont 1 priority-queue 6 cascade onmapping-mode vlangem mapping 0 0 vlan 4000gem mapping 1 1 vlan 500commitquitinterface gpon 0/3port 1 ont-auto-find enabledisplay ont autofind 1ont confirm 1 ontid 1 sn-auth 48575443E6D8B541 snmp ont-lineprofile-id 10 desc ATN930_0/3/1/1_lineprofile10ont ipconfig 1 1 static ip-address 192.168.50.2 mask 255.255.255.0 vlan 4000ont alarm-profile 1 1 profile-id 1service-port 0 vlan 4000 gpon 0/3/1 ont 1 gemport 0 multi-service user-vlan 4000 rx-cttr 6 tx-cttr 6service-port 1 vlan 500 gpon 0/3/1 ont 1 gemport 1 multi-service




Issue 03 (2010-01-28)

user-vlan 500 rx-cttr 6 tx-cttr 6queue-scheduler wrr 10 10 20 20 40 0 0 0cos-queue-map cos0 0 cos1 1 cos2 2 cos3 3 cos4 4 cos5 5 cos6 6 cos7 7save

Configure the ATN930.

interface loopback 0ip address 5.5.5.5 32quitmpls lsr-id 5.5.5.5mplsmpls tequitmpls l2vpnvlan 500 smartmpls vlan 500port vlan 500 0/0 0interface vlanif 500ip address 10.50.50.50 24mplsmpls tequitinterface tunnel 10tunnel-protocol mpls tedestination 30.30.30.30mpls te tunnel-id 10mpls te signal-protocol staticmpls te commitquitstatic-lsp ingress tunnel-interface tunnel 10 destination 30.30.30.30 nexthop 10.60.60.60 out-label 8100static-lsp egress ptn2atn930 incoming-interface vlanif 500 in-lable 8200tunnel-policy mpls-statictunnel binding destination 30.30.30.30 te tunnel 10quitpw-template cbu2ptn_satoppw-type tdm satoppeer-address 30.30.30.30tdm-load-time satop loadtime 125rtp enablejitter-buffer buffer-size 2500control-wordtnl-policy mpls-staticquitreset pw template cbu2ptn_satopinterface tdm 0/3port 0 udt systemquittdm-vcl tdm-vcl-id 10 satop 0/3/0pw-ac-binding tdm 10 pw 1 pw-template cbu2ptn_satop static transmit-label 8448 receive-label 8449clock source 0 adapt-clock 0clock source 1 0/0/0clock priority system 0/1interface tdm 0/3adapt-clock-source 0 1quitsave

9.1.7.3 Configuring the TDM PWE3 Mobile Bearer Service on the CBU (IP-based)

The CBU ATN930 is connected to the 2G or 3G base station through the E1 port and transmitsthe TDM service to the OLT after emulation. The OLT transparently transmits emulation signalsto the IP network and remote PTN network through the GE port. In this way, the traditionalcircuit-switched service is implemented over the GPON network.



9-119



l Through SAToP or CESoP emulation, the TDM service data can be transmitted in theGPON network.

l The PWE3 encapsulation mode is IP+UDP.

l The service is transmitted upstream to the IP network or and remote PTN network throughthe GE port of the OLT.

Figure 9-19 shows an example network of the TDM PWE3 mobile bearer service.

The ATN930 is connected to the 2G or 3G base station through the E1 port to provide the TDMaccess, and then transmits the service data upstream to the GPON service board of the OLTthrough GPON after SAToP emulation. The OLT transparently transmits emulation signals tothe IP network and remote PTN network through the GE port. The PTN device terminatesemulation signals and restores them to TDM signals. In this way, the 2G or 3G mobile bearerservice is implemented between the ATN930 and the remote PTN in the TDM PW mode.

Figure 9-19 Example network of the TDM PWE3 mobile bearer service on the CBU (MPLS-based)


The ATN930 supports static and dynamic PWs. You can configure the PW according to therequirements.l A dynamic PW is created through LDP, and the LSP is generated dynamically. No manual

configuration is required.l The relevant information about a static PW is manually specified through the CLI, and the

parameters are not negotiated through LDP. Therefore, a static LSP can work normallyonly after the LSRs along the LSP are configured.

The ATN930 supports SAToP encapsulation and CESoP encapsulation, and you can configurethe encapsulation mode according to the requirements.l The structure-agnostic TDM over PSN (SAToP) standard provides the non-structurized

TDM service with the emulation and transmission functions. The protocol need not beaware of the structure of the TDM packets and transparently transmits the packets.Therefore, if the customer only needs to provide services based on E1, SAToP can meetthis requirement.




Issue 03 (2010-01-28)

l The circuit emulation services over PSN (CESoP) standard provides the structurized TDMservice with emulation and transmission functions, and then the TDM frame structure andin-frame signaling can be identified. Therefore, if the customer needs to provide servicesbased on timeslot, CESoP can meet this requirement.

Data Plan

Table 9-17 provides the data plan for the OLT, Table 9-18 provides the data plan for theATN930, and Table 9-19 provides the data plan for the remote PTN.


Item Data



GPON service board Port: 0/3/1ONU ID: 1ONU authentication mode: MAC address

DBA profile Profile ID: 20Type: type1Fixed bandwidth: 32 Mbit/s




Item Data



MPLS MPLS LSR ID: 5.5.5.5Global MPLS: enabledMPLS L2 VPN: enabled



9-121

Item Data

PW template Template name: cbu2ptn_satopTemplate type: TDM SAToPPeer IP address: 30.30.30.30PW load time: 125 μsJitter buffer size: 2500 μsControl word: supportedRTP: enabled

Tunnel Tunnel interface ID: 10Tunnel ID: 10Link layer encapsulation protocol of the tunnel interface: IPPolicy name: ip_policyLocal UDP port ID: 50000Remote UDP port ID: 50050



Table 9-19 Data plan for configuring the TDM PWE3 mobile bearer service-PTN side

Item Data


MPLS LSR-ID: 30.30.30.30Local UDP port ID: 50050Remote UDP port ID: 50000








Issue 03 (2010-01-28)





(2) Add a DBA profile.Configure the profile name to TDM, profile type to Type1, Fixed bandwidth to32 Mbit/s.huawei(config)#dba-profile add profile-name TDM type1 fix 32768





(4) Add an ONU line profile.Add GPON MDU line profile 10 and bind T-CONT 1 to the DBA profile namedTDM. In this way, the T-CONT can provide flexible DBA solutions based ondifferent configurations in the DBA profile.huawei(config)#ont-lineprofile gpon profile-id 10huawei(config-gpon-lineprofile-10)#tcont 1 dba-profile-name TDMAdd GEM port 0 for transmitting management traffic streams and GEM port 1for transmitting ETH traffic streams. Bind GEM port 0 and GEM port 1 to T-CONT 1. Configure the QoS mode to priority-queue (default) and the queuepriority to 6.

NOTE



huawei(config-gpon-lineprofile-10)#gem add 0 eth tcont 1 priority-queue 6 cascade onhuawei(config-gpon-lineprofile-10)#gem add 1 eth tcont 1 priority-queue 6 cascade on



9-123



(5) Add an ONU.

Connect the ATN930 to GPON port 0/3/1. The ONU ID is 1, the SN is48575443E6D8B541, the management mode is SNMP, and the bound lineprofile ID is 10.

NOTE




huawei(config)#interface gpon 0/3huawei(config-if-gpon-0/3)#port 1 ont-auto-find enablehuawei(config-if-gpon-0/3)#display ont autofind 1 Command: display ont autofind 1 ------------------------------------------------------------------------ Number F/ S/ P SN Password ------------------------------------------------------------------------ 1 0/ 3/ 1 48575443E6D8B541 ------------------------------------------------------------------------ huawei(config-if-gpon-0/3)#ont confirm 1 ontid 1 sn-auth 48575443E6D8B541 snmp ont-lineprofile-id 10 desc ATN930_0/3/1/1_line10 Number of ONTs that can be added: 1, success: 1 PortID :1, ONTID :1

NOTE






Issue 03 (2010-01-28)






Configure the management service port ID to 0, management VLAN ID to 4000,GEM port ID to 0, and CVLAN ID to 4000. The rate of the inband service porton the OLT is not limited. Therefore, use traffic profile 6 (default). To limit therate of the service port, run the traffic table ip command to add a traffic profileand bind it to the service port.huawei(config-if-gpon-0/3)#quithuawei(config)#service-port 0 vlan 4000 gpon 0/3/1 ont 1 gemport 0 multi-service user-vlan 4000 rx-cttr 6 tx-cttr 6

NOTE













9-125



l Configure the ONU.NOTE

Because the management VLAN and the management IP address have been configured, you can run thetelnet 192.168.50.2 command on the OLT to log in to the ATN930 to perform the configuration. Youcan also log in to the ATN930 through a serial port to perform the configuration.





3. Enable the MPLS function for VLAN interface 500 and configure the IP address ofVLAN interface 500.huawei(config)#vlan 500 smart //Upstream VLANhuawei(config)#mpls vlan 500huawei(config)#port vlan 500 0/0 0huawei(config)#interface vlanif 500huawei(config-if-vlanif200)#ip address 10.50.50.50 24 //Configure the IP address of VLAN interface 500 to 10.50.50.50/24huawei(config-if-vlanif200)#mplshuawei(config-if-vlanif200)#quit

4. Create an IP tunnel from the ATN930 to the PTN and configure the tunnel policy.

Configure the tunnel ID to 10, link layer encapsulation protocol of the tunnel interfaceto IP.

huawei(config)#interface tunnel 10huawei(config-if-tunnel10)#tunnel-protocol mpls ip

Configure the destination IP address of the tunnel to 30.30.30.30.

huawei(config-if-tunnel10)#destination 30.30.30.30

Save the configuration and quit the tunnel configuration.

huawei(config-if-tunnel10)#mpls ip commithuawei(config-if-tunnel10)#quit

5. Configure the tunnel policy used by the PW template.

Configure the tunnel policy name to ip-policy.

huawei(config)#tunnel-policy ip_policyInfo: New tunnel-policy is configured.huawei(config-tunnel-policy-ip_policy)#tunnel select-seq ip load-balance-number 1huawei(config-tunnel-policy-ip_policy)#quit





Issue 03 (2010-01-28)

(1) Configure the PW name and type.Configure the PW name to cbu2ptn_satop, and type to SAToP.huawei(config)#pw-template cbu2ptn_satophuawei(config-pw-template-cbu2ptn_satop)#pw-type tdm satop

(2) Configure the loopback interface IP address of the remote PTN device in the PWprofile.Configure the loopback interface IP address to 30.30.30.30.huawei(config-pw-template-cbu2ptn_satop)#peer-address 30.30.30.30

(3) Configure the PW load time.Configure the load time to 125 μs.huawei(config-pw-template-cbu2ptn_satop)#tdm-load-time satop loadtime 125


NOTEThe RTP configuration must be the same as that on the PTN.huawei(config-pw-template-cbu2ptn_satop)#rtp enable


NOTEThe value range of the jitter buffer is 500-32000 and the value must be an integer multiple of125. You can configure this value according to actual conditions. In this example, the jitterbuffer size is configured to 2500 μs.huawei(config-pw-template-cbu2ptn_satop)#jitter-buffer buffer-size 2500

(6) Configure the PW template to or not to support the control word.huawei(config-pw-template-cbu2ptn_satop)#control-word

(7) Configure the tunnel policy used by the PW template.Configure the tunnel policy name to ip_policy.huawei(config-pw-template-cbu2ptn_satop)#tnl-policy ip_policyhuawei(config-pw-template-cbu2ptn_satop)#quit



huawei(config)#reset pw template cbu2ptn_satop Info: In operation, please wait...OK!

7. Configure the TDM service port and create TDM VCL 10.huawei(config)#interface tdm 0/3huawei(config-if-tdm-0/3)#port 0 udt system //Confiugre TDM port 0 to work in the UDT mode //Use the system clock as the transmit clock of the porthuawei(config-if-tdm-0/3)#quit



9-127

huawei(config)#tdm-vcl tdm-vcl-id 10 satop 0/3/0 //Create TDM VCL 10 on port 0/3/0 and configure the type to SAToP


The IP+UDP encapsulation mode is adopted. Such a PW does not use the signalingprotocol for parameter negotiation. You can manually specify the related informationby running the related command. The data of a static PW is transmitted between theprovider edges (PEs) through tunnels. Configure the TDM virtual path link (VPL) IDto 10, PW ID to 1, PW template name to cbu2ptn_satop, working mode to UDP, localUDP port ID to 50050, and destination port ID to 50050.

huawei(config)#pw-ac-binding tdm 10 pw 1 pw-template cbu2ptn_satop udp ingress-dst-port 50000 egress-dst-port 50050

NOTEThe destination port ID (egress-dst-port) of the PW configured on the ATN930 must be the same asthe destination port ID (ingress-dst-port) configured on the remote PE (in this example, the peer PEis the OLT).



(1) Obtain clock signals from channel 0 of the received SAToP data streams andupstream port 0/0/0 as the system clock source, with the IDs of 0 and 1respectively.huawei(config)#clock source 0 adapt-clock 0huawei(config)#clock source 1 0/0/0




----End

ResultOn the ATN930, you can run the display pw-ac-binding command to confirm that the PW isin the up (normal) state.huawei(config)#display pw-ac-binding tdm 10 { <cr>|secondary<K> }: Command: display pw-ac-binding tdm 10 Total : 1 (Up/Down : 1/0 Static/LDP : 1/0) ---------------------------------------------------------------------------- TDM PW PW PROTO RECEIVE TRNS TEMPLATE ID ID STATE TYPE LABEL LABEL NAME ---------------------------------------------------------------------------- 10 1 up UDP 50050 50000 cbu2ptn_satop ----------------------------------------------------------------------------




Issue 03 (2010-01-28)

Note : F--Frame, S--Slot, P--Port *: Secondary

Configuration FileConfigure the OLT.vlan 500 smartport vlan 500 0/19 0vlan 4000 smartport vlan 4000 0/19 0interface vlanif 4000ip address 192.168.50.1 24quitdba-profile add profile-name TDM type1 fix 32768ont-lineprofile gpon profile-id 10tcont 1 dba-profile-name TDMgem add 0 eth tcont 1 priority-queue 6 cascade ongem add 1 eth tcont 1 priority-queue 6 cascade onmapping-mode vlangem mapping 0 0 vlan 4000gem mapping 1 1 vlan 500commitquitinterface gpon 0/3port 1 ont-auto-find enabledisplay ont autofind 1ont confirm 1 ontid 1 sn-auth 48575443E6D8B541 snmp ont-lineprofile-id 10 desc ATN930_0/3/1/1_lineprofile10ont ipconfig 1 1 static ip-address 192.168.50.2 mask 255.255.255.0 vlan 4000ont alarm-profile 1 1 profile-id 1service-port 0 vlan 4000 gpon 0/3/1 ont 1 gemport 0 multi-service user-vlan 4000 rx-cttr 6 tx-cttr 6service-port 1 vlan 500 gpon 0/3/1 ont 1 gemport 1 multi-service user-vlan 500 rx-cttr 6 tx-cttr 6queue-scheduler wrr 10 10 20 20 40 0 0 0cos-queue-map cos0 0 cos1 1 cos2 2 cos3 3 cos4 4 cos5 5 cos6 6 cos7 7save

Configure the ATN930.interface loopback 0ip address 5.5.5.5 32quitmpls lsr-id 5.5.5.5mplsquitmpls l2vpnvlan 500 smartmpls vlan 500port vlan 500 0/0 0interface vlanif 500ip address 10.50.50.50 24mplsquitinterface tunnel 10tunnel-protocol mpls ipdestination 30.30.30.30mpls ip commitquittunnel-policy ip-policytunnel select-seq ip load-balance-number 1quitpw-template cbu2ptn_satoppw-type tdm satoppeer-address 10.60.60.60tdm-load-time satop loadtime 125rtp enablejitter-buffer buffer-size 2500



9-129

control-wordtnl-policy ip_policyquitreset pw template cbu2ptn_satopinterface tdm 0/3port 0 udt systemquittdm-vcl tdm-vcl-id 10 satop 0/3/0pw-ac-binding tdm 10 pw 1 pw-template cbu2ptn_satop udp ingress-dst-port 50000 egress-dst-port 50050clock source 0 adapt-clock 0clock source 1 0/0/0clock priority system 0/1interface tdm 0/3adapt-clock-source 0 1quitsave

9.1.7.4 Configuring the ETH PWE3 Mobile Bearer Service on the CBUThe CBU ATN930 is connected to the 3G base station through the FE or GE port, and transmitsthe Ethernet data upstream to the OLT after ETH PWE3 encapsulation. The OLT transparentlytransmits emulation signals to the MPLS network and remote PTN network through the Ethernetport. In this way, the ETH service is implemented over the GPON network.

Service Requirementsl The ETH mode (the physical port is the GE port) is used for connecting to the 3G base

station.l GPON is adopted for bearing the mobile AN in a unified manner to meet mobile carriers'

requirements for a high bandwidth and for covering high base station density.l The PWE3 encapsulation mode is MPLS+MPLS, and the static LSP is adopted.

l The service is transmitted upstream to the MPLS network or and remote PTN networkthrough the Ethernet port of the OLT.

Figure 9-20 shows an example network of the ETH PWE3 mobile bearer service.

The ATN930 is connected to the 3G base station through the FE port and transmits the ETHservice upstream to the GPON board of the OLT through GPON after ETH emulation. The OLTtransparently transmits the emulation data to the MPLS network and remote PTN networkthrough the Ethernet port, and then the PTN device terminates the emulation data and restoresETH signals. Thus, the 3G mobile bearer service is implemented between the ATN930 and thePTN in the ETH PW mode.

Figure 9-20 Example network of the ETH PWE3 mobile bearer service on the CBU (MPLS-based)




Issue 03 (2010-01-28)


The ATN930 supports static and dynamic PWs. You can configure the PW according to therequirements.l A dynamic PW is created through LDP, and the LSP is generated dynamically. No manual

configuration is required.l The relevant information about a static PW is manually specified through the CLI, and the

parameters are not negotiated through LDP. Therefore, a static LSP can work normallyonly after the LSRs along the LSP are configured.

Data Plan

Table 9-20 provides the data plan for the OLT,Table 9-21 provides the data plan for theATN930, and Table 9-22 provides the data plan for the remote PTN.

Table 9-20 Data plan for configuring the ETH PWE3 mobile bearer service-OLT side

Item Data




DBA profile Profile name: ETMType: type1Fixed bandwidth: 100 Mbit/s

ONU line profile Profile ID: 10, bound to the DBA profile named ETHGEM port IDs: 0 and 1T-CONT ID: 1


Table 9-21 Data plan for configuring the ETH PWE3 mobile bearer service-ATN930 side

Item Data




9-131

Item Data


MPLS MPLS LSR ID: 5.5.5.5Global MPLS: enabledMPLS L2 VPN: enabledOut-label of the ingress node that functions as the static LSP: 8100In-label of the egress node that functions as the static LSP: 8200

PW Template name: cbu2olt_ethTemplate type: ethernetPeer IP address: 30.30.30.30Control word: supportedPW transmit label: 8448PW receive label: 8449

Tunnel Tunnel ID: 10Link layer encapsulation protocol of the tunnel interface: MPLS-TEDestination IP address: 30.30.30.30Tunnel signaling protocol: staticPolicy name: mpls-static

ETH port Port: 0/4/0ETH emulation service VLAN:3001User VLAN:20

Clock source GPON line clock (clock source ID 0)

Table 9-22 Data plan for configuring the ETH PWE3 mobile bearer service-PTN side

Item Data


MPLS LSR-ID:30.30.30.30Tunnel interface ID: 10Tunnel ID: 10In-label of the egress node that functions as the static LSP: 8100Out-label of the ingress node that functions as the static LSP: 8200




Issue 03 (2010-01-28)







(1) Configure the inband management VLAN and IP address of the OLT.

Create management VLAN 4000 and add upstream port 0/19/0 to it. Configurethe inband management IP address to 192.168.50.1/24.



Configure the profile name to ETH, profile type to Type1, Fixed bandwidth to102400 Mbit/s.huawei(config)#dba-profile add profile-name ETH type1 fix 102400






Add GPON MDU line profile 10 and bind T-CONT 1 to the DBA profile namedETH. In this way, the T-CONT can provide flexible DBA solutions based ondifferent configurations in the DBA profile.huawei(config)#ont-lineprofile gpon profile-id 10huawei(config-gpon-lineprofile-10)#tcont 1 dba-profile-name ETH

Add GEM port 0 for transmitting management traffic streams and GEM port 1for transmitting ETH traffic streams. Bind GEM port 0 and GEM port 1 to T-CONT 1. Configure the QoS mode to priority-queue (default) and the queuepriority to 6.



9-133

NOTE






(5) Add an ONU.Connect the ATN930 to GPON port 0/3/1. The ONU ID is 1, the SN is48575443E6D8B541, the management mode is SNMP, and the bound lineprofile ID is 10.

NOTE




huawei(config)#interface gpon 0/3huawei(config-if-gpon-0/3)#port 1 ont-auto-find enablehuawei(config-if-gpon-0/3)#display ont autofind 1 Command: display ont autofind 1 ------------------------------------------------------------------------ Number F/ S/ P SN Password ------------------------------------------------------------------------ 1 0/ 3/ 1 48575443E6D8B541 ------------------------------------------------------------------------ huawei(config-if-gpon-0/3)#ont confirm 1 ontid 1 sn-auth 48575443E6D8B541 snmp ont-lineprofile-id 10 desc ATN930_0/3/1/1_line10 Number of ONTs that can be added: 1, success: 1




Issue 03 (2010-01-28)

PortID :1, ONTID :1

NOTE








Configure the management service port ID to 0, management VLAN ID to 4000,GEM port ID to 0, and CVLAN ID to 4000. The rate of the inband service porton the OLT is not limited. Therefore, use traffic profile 6 (default). To limit therate of the service port, run the traffic table ip command to add a traffic profileand bind it to the service port.huawei(config-if-gpon-0/3)#quithuawei(config)#service-port 0 vlan 4000 gpon 0/3/1 ont 1 gemport 0 multi-service user-vlan 4000 rx-cttr 6 tx-cttr 6

NOTE










9-135






l Configure the ONU.

NOTEBecause the management VLAN and the management IP address have been configured, you can run thetelnet 192.168.50.2 command on the OLT to log in to the ATN930 to perform the configuration. Youcan also log in to the ATN930 through a serial port to perform the configuration.




2. Configure the MPLS LSR ID and enable the global MPLS and L2 VPN functions.huawei(config)#mpls lsr-id 5.5.5.5 //Set the local LSR ID to the IP address of loopback interface 0huawei(config)#mpls //Enable global MPLShuawei(config-mpls)#mpls te //Enable global MPLS TEuawei(config-mpls)#quithuawei(config)#mpls l2vpn //Enable L2 VPN

3. Enable the MPLS TE function for VLAN interface 800 and configure the IP addressof VLAN interface 800.huawei(config)#vlan 800 smart //Upstream VLANhuawei(config)#mpls vlan 800huawei(config)#port vlan 800 0/0 0huawei(config)#interface vlanif 800huawei(config-if-vlanif800)#ip address 10.50.50.50 24 //Configure the IP address of VLAN interface 500 to 10.50.50.50/24huawei(config-if-vlanif800)#mplshuawei(config-if-vlanif800)#mpls tehuawei(config-if-vlanif800)#quit

4. Create a service port for the Ethernet access service.

Create an SVLAN for ETH emulation (the services of this SVLAN are terminated bythe ETH PW termination device after ETH emulation of the services), and then createa service port and switch the CVLAN ID to the emulation SVLAN ID.

huawei(config)#vlan 3001huawei(config)#service-port vlan 3001 eth 0/4/0 multi-service user-vlan 20 rx-cttr 6 tx-cttr 6

5. Create an MPLS tunnel from the ATN930 to the PTN.




Issue 03 (2010-01-28)

Configure the tunnel ID to 10 and the link layer encapsulation protocol of the tunnelinterface to MPLS.

huawei(config)#interface tunnel 10huawei(config-if-tunnel10)#tunnel-protocol mpls te

Configure the destination IP address of the tunnel to 30.30.30.30.

huawei(config-if-tunnel10)#destination 30.30.30.30

Configure the MPLS TE tunnel ID to 10. A tunnel ID and an LSR ID uniquelyidentifies an MPLS TE tunnel.

huawei(config-if-tunnel10)#mpls te tunnel-id 10

Configure the signaling protocol for creating the MPLS TE tunnel to static.

huawei(config-if-tunnel10)#mpls te signal-protocol static

Save the configuration and quit the MPLS TE configuration.

huawei(config-if-tunnel10)#mpls te commithuawei(config-if-tunnel10)#quit

6. Configure parameters of the ingress node of the static LSP.

Configure the tunnel interface ID to 10, IP address of the egress node of the LSP to30.30.30.30, next hop IP address (L3 interface IP address of the egress node in thesame tunnel) to 10.60.60.60, and out-label to 8100 (which must be the same as the in-label of the downstream LSR).

NOTEA static MPLS TE tunnel can be used only after it is bound to a static LSP.

huawei(config)#static-lsp ingress tunnel-interface tunnel 10 destination 30.30.30.30 nexthop 10.60.60.60 out-label 8100

7. Configure parameters of the egress node of the static LSP.

Configure the name of the static LSP to ptn2atn930, bind the static LSP to VLANinterface 800 of the ingress node (The VLAN interface IP address is the next hop IPaddress of the ingress node. The communication between LSRs is available only whenthe ingress node and the egress node are added to the same MPLS VLAN), andconfigure the in-label to 8200 (which must be the same as the out-label of the upstreamLSR).

huawei(config)#static-lsp egress ptn2atn930 incoming-interface vlanif 800 in-lable 8200

8. Configure the tunnel policy.

Configure the policy name to mpls-static, bind the policy to tunnel 10, and configurethe destination IP address of the tunnel to 30.30.30.30.

NOTEThe destination IP address should be consistent with that configured in the MPLS TE tunnel.

huawei(config)#tunnel-policy mpls-staticInfo: New tunnel-policy is configured.huawei(config-tunnel-policy-mpls-static)#tunnel binding destination 30.30.30.30 te tunnel 10huawei(config-tunnel-policy-mpls-static)#quit





9-137

Configure the PW name to cbu2ptn_eth, and type to nto1.huawei(config)#pw-template cbu2ptn_ethhuawei(config-pw-template-cbu2ptn_eth)#pw-type ethernet tagged

(2) Configure the loopback interface IP address of the remote PTN device in the PWprofile.Configure the loopback interface IP address to 30.30.30.30.huawei(config-pw-template-cbu2ptn_eth)#peer-address 30.30.30.30

(3) Configure the PW template to or not to support the control word.huawei(config-pw-template-cbu2ptn_eth)#control-word

(4) Configure the tunnel policy used by the PW template.Configure the tunnel policy name to mpls-static.huawei(config-pw-template-cbu2ptn_eth)#tnl-policy mpls-statichuawei(config-pw-template-cbu2ptn_eth)#quit



huawei(config)#reset pw template cbu2ptn_eth Info: In operation, please wait...OK!


The system input/output clock source of ATN930 can be obtained from the GPONline clock. If the configuration is not performed, the ATN930 adopts the localoscillator as the system clock or output clock source.

huawei(config)#clock source 0 0/0/0huawei(config)#clock priority system 0

NOTEAfter the configuration is completed, you can run the display clock source command to confirmthat the configured system clock source is in the normal state.

11. Bind the ETH to the PW.

The static LSP encapsulation mode is adopted. Such a PW does not use the LDPsignaling protocol for parameter negotiation. You can manually specify the relatedinformation by running the related command. The data of a static PW is transmittedbetween the provider edges (PEs) through tunnels. Configure the VLAN ID to 10, PWID to 10, PW template cbu2ptn_eth, type to MPLS, transmit label to 8448, and receivelabel to 8449.

huawei(config)#pw-ac-binding vlan 3001 pw 10 pw-template cbu2ptn_eth static transmit-label 8848 receive-label 8849

NOTEWhen you configure a static TDM PW, the PW transmit-label and receive-label configured on theATN930 must be the same as the PW transmit-label and receive-label configured on the peer PE(the PTN in this example).




Issue 03 (2010-01-28)


----End

ResultOn the ATN930, you can run the display pw-ac-binding command to confirm that the PW isin the up (normal) state.huawei(config)#display pw-ac-binding vlan 3001 { <cr>|secondary<K> }: Command: display pw-ac-binding vlan 3001 Total : 1 (Up/Down : 1/0 Static/LDP : 1/0) ---------------------------------------------------------------------------- VLAN PW PW PROTO RECEIVE TRNS TEMPLATE ID ID STATE TYPE LABEL LABEL NAME ---------------------------------------------------------------------------- 3001 10 up static 8849 8848 cbu2ptn_eth ---------------------------------------------------------------------------- Note : F--Frame, S--Slot, P--Port *: Secondary

Configuration FileConfigure the OLT.vlan 800 smartport vlan 800 0/9 0vlan 4000 smartport vlan 4000 0/9 0interface vlanif 4000ip address 192.168.50.1 24quitdba-profile add profile-name ETH type1 fix 102400ont-lineprofile gpon profile-id 10tcont 1 dba-profile-name ETHgem add 0 eth tcont 1 priority-queue 6 gem add 1 eth tcont 1 priority-queue 6 mapping-mode vlangem mapping 0 0 vlan 4000gem mapping 1 1 vlan 800commitquitinterface gpon 0/3port 1 ont-auto-find enabledisplay ont autofind 1ont confirm 1 ontid 1 sn-auth 48575443E6D8B541 snmp ont-lineprofile-id 10 desc ATN930_0/3/1/1_lineprofile10ont alarm-profile 1 1 profile-id 1ont ipconfig static 1 1 ip-address 192.168.50.2 mask 255.255.255.0 vlan 4000 gateway 192.168.50.1 quitservice-port 0 vlan 4000 gpon 0/3/1 ont 1 gemport 0 multi-service user-vlan 4000 rx-cttr 6 tx-cttr 6service-port 1 vlan 800 gpon 0/3/1 ont 1 gemport 1 multi-service user-vlan 800 rx-cttr 6 tx-cttr 6queue-scheduler wrr 10 10 20 20 40 0 0 0cos-queue-map cos0 0 cos1 1 cos2 2 cos3 3 cos4 4 cos5 5 cos6 6 cos7 7save

Configure the ATN930.interface loopback 0ip address 5.5.5.5 32



9-139

quitmpls lsr-id 5.5.5.5 mpls mpls te quitmpls l2vpn vlan 800 smart mpls vlan 800port vlan 800 0/0 0interface vlanif 800ip address 10.50.50.50 24 mplsmpls tequitvlan 3001service-port vlan 3001 eth 0/4/0 multi-service user-vlan 20 rx-cttr 6 tx-cttr 6interface tunnel 10tunnel-protocol mpls tedestination 30.30.30.30mpls te tunnel-id 10mpls te signal-protocol staticmpls te commitquitstatic-lsp ingress tunnel-interface tunnel 10 destination 30.30.30.30 nexthop 10.60.60.60 out-label 8100static-lsp egress ptn2atn930 incoming-interface vlanif 800 in-label 8200tunnel-policy mpls-statictunnel binding destination 30.30.30.30 te tunnel 10quitpw-template cbu2ptn_ethpw-type ethernet taggedpeer-address 30.30.30.30control-wordtnl-policy mpls-staticquitreset pw template cbu2ptn_ethclock source 0 0/0/0clock priority system 0pw-ac-binding vlan 3001 pw 10 pw-template cbu2ptn_eth static transmit-label 8848 receive-label 8849save

9.2 Configuring the P2P Optical Fiber Access ServiceThis topic describes the P2P optical fiber access technology and how to configure the P2P opticalfiber access service on the OLT.

9.2.1 Configuring the FTTH P2P Optical Fiber Access Service (Single-Port for Single Service)The user is connected to the OLT through a modem, and the OLT provides the user with theInternet access service through FTTH.

9.2.2 Configuring the FTTH P2P Optical Fiber Access Service (Single-Port for MultipleServices)Users connected to the OLT through an Modem, and are thus provided with the Internet, VoIP,and IPTV service through a same port.

9.2.1 Configuring the FTTH P2P Optical Fiber Access Service(Single-Port for Single Service)

The user is connected to the OLT through a modem, and the OLT provides the user with theInternet access service through FTTH.




Issue 03 (2010-01-28)

Service Requirementsl The user accesses the Internet in the PPPoE dialing mode.

l The user bandwidth is 100 Mbit/s.

l The Modem is connected to the OPFA board of the OLT through the optical fiber.

l The BRAS provides the AAA function.

Figure 9-21 Example network of the optical fiber access service in the single-port for singleservice mode

Prerequisitel The OLT is connected to the BRAS.

l Related configurations are performed on the BRAS according to the authentication andaccounting requirements for dialup users. For details about the configuration, see thecorresponding configuration guide.


ProcedureStep 1 Create a VLAN and add an upstream port to the VLAN.

The VLAN ID is 100, and the VLAN is a smart VLAN. The upstream port is 0/19/0.huawei(config)#vlan 100 smarthuawei(config)#port vlan 100 0/19 0

Step 2 Configure a traffic profile.The profile ID is 10, the CIR is 100 Mbit/s, and packets are scheduled according to the prioritycarried.huawei(config)#traffic table ip index 10 cir 102400 priority 5 priority-policy tag-In-Package

Step 3 Configure a service port.Add a service port to the VLAN and use traffic profile 10.huawei(config)#service-port vlan 100 eth 0/5/1 rx-cttr 10 tx-cttr 10


----End



9-141

ResultConnect the modem to the PC, perform the PPPoE dialing on the PC. After the dialing issuccessful, the user can access the Internet.

Configuration Filevlan 100 smartport vlan 100 0/19 0traffic table ip index 10 cir 102400 priority 5 priority-policy tag-In-Packageservice-port vlan 100 eth 0/5/1 rx-cttr 10 tx-cttr 10save

9.2.2 Configuring the FTTH P2P Optical Fiber Access Service(Single-Port for Multiple Services)

Users connected to the OLT through an Modem, and are thus provided with the Internet, VoIP,and IPTV service through a same port.

Service Requirementsl Modem_1 and Modem_2 are provided with the triple play service through FTTH.

l The Internet access service is provided in the PPPoE access mode.

l The IPTV user connected to Modem_1 can watch all the programs, and the IPTV userconnected to Modem_2 can watch only program BTV-1.

l The VoIP service and the IPTV service are provided in the DHCP mode and obtain IPaddresses from the DHCP server in the DHCP standard mode.

l After receiving different traffic streams, the OLT provides different QoS guarantees to thetraffic streams according to the priorities of the traffic streams.

l Traffic streams are differentiated on the OLT by the user-side VLAN (C-VLAN).




Issue 03 (2010-01-28)

Figure 9-22 Example network of the optical fiber access service in the single-port for multipleservices mode

Table 9-23 Data plan for configuring the VLANs

Item Data

Upstream VLAN Internet access service: smart VLAN 100

VoIP service: smart VLAN 200

IPTV service: smart VLAN 1000

User-side VLAN Internet access service: VLAN 2

VoIP service: VLAN 3

IPTV service: VLAN 4

Prerequisitel The OLT is connected to the upper-layer devices such as the BRAS, multicast server,

SoftX3000, and DHCP server.l The VLAN of the LAN switch port connected to the OLT is the same as the upstream

VLAN of the OLT.

Procedurel Configure the Internet access service.



9-143

1. Create a VLAN and add an upstream port to the VLAN.The VLAN ID is 100, and the VLAN is a smart VLAN. The upstream port is0/19/0.huawei(config)#vlan 100 smarthuawei(config)#port vlan 100 0/19 0

2. Configure a traffic profile.Because the VoIP, IPTV, and Internet access services are provided through the sameport, you must set the 802.1p priority of each service. Generally, the priorities are ina descending order for the VoIP service, IPTV service, and Internet access service. Inthis example, set the traffic profile index to 7 and the priority of the Internet accessservice to 1.huawei(config)#traffic table ip index 7 cir 10240 priority 1 priority-policy local-Setting

3. Configure a service port.Add a service port to the VLAN and use traffic profile 7. The user-side VLAN ID is2.huawei(config)#service-port vlan 100 eth 0/5/2 multi-service user-vlan 2 rx-cttr 7 tx-cttr 7huawei(config)#service-port vlan 100 eth 0/5/3 multi-service user-vlan 2 rx-cttr 7 tx-cttr 7


Use the 3PQ+5WRR queue scheduling. Queues 0-4 adopt the WRR mode, with theweights of 10, 10, 20, 20, and 40 respectively; queues 5-7 adopt the PQ mode.






l Configure the VoIP service.1. Create a VLAN and add an upstream port to the VLAN.

The VLAN ID is 200, and the VLAN is a smart VLAN. The upstream port is0/19/0.huawei(config)#vlan 200 smarthuawei(config)#port vlan 200 0/19 0

2. Configure a traffic profile.The traffic profile index is 8, and the 802.1p priority of the VoIP service is 6.huawei(config)#traffic table ip index 8 cir 10240 priority 6 priority-policy local-Setting

3. Configure a service port.Add a service port to the VLAN and use traffic profile 8. The user-side VLAN ID is3.




Issue 03 (2010-01-28)

huawei(config)#service-port vlan 200 eth 0/5/2 multi-service user-vlan 3 rx-cttr 8 tx-cttr 8huawei(config)#service-port vlan 200 eth 0/5/3 multi-service user-vlan 3 rx-cttr 8 tx-cttr 8

4. Configure the DHCP relay.The VoIP service and the IPTV service are provided in the DHCP mode. The DHCPoption 60 domain is used to differentiate service types.– The DHCP domain of the VoIP service is voice.

– The IP addresses of VoIP DHCP server group 1 are 20.1.1.2 and 20.1.1.3.

– The IP address of the L3 interface of VLAN 200 is 10.1.1.1/24.huawei(config)#dhcp mode layer-3 option60huawei(config)#dhcp-server 1 ip 20.1.1.2 20.1.1.3huawei(config)#dhcp domain voicehuawei(config-dhcp-domain-voice)#dhcp-server 1huawei(config-dhcp-domain-voice)#quithuawei(config)#interface vlanif 200huawei(config-if-vlanif200)#ip address 10.1.1.1 24huawei(config-if-vlanif200)#dhcp domain voice gateway 10.1.1.1huawei(config-if-vlanif200)#quit

NOTEThe DHCP option 60 domain of the Ethernet phone (Ephone) varies with the terminal type. In theactual configuration, see the operation instructions of the Ephone.


l Configure the IPTV service.1. Create a VLAN and add an upstream port to the VLAN.

The VLAN ID is 1000, and the VLAN is a smart VLAN. The upstream portis0/19/0.huawei(config)#vlan 1000 smarthuawei(config)#port vlan 1000 0/19 0

2. Configure a traffic profile.The traffic profile index is 9, and the 802.1p priority of the IPTV service is 5.huawei(config)#traffic table ip index 9 cir off priority 5 priority-policy local-Setting

3. Configure a service port.Add a service port to the VLAN and use traffic profile 9. The user-side VLAN ID is4.huawei(config)#service-port 200 vlan 1000 eth 0/5/2 multi-service user-vlan 4 rx-cttr 9 tx-cttr 9huawei(config)#service-port 300 vlan 1000 eth 0/5/3 multi-service user-vlan 4 rx-cttr 9 tx-cttr 9

4. Configure the DHCP relay.The VoIP service and the IPTV service are provided in the DHCP mode. The DHCPoption 60 domain is used to differentiate service types.– The DHCP domain of the IPTV service is video.

– The IP addresses of IPTV DHCP server group 2 are 20.2.2.2 and 20.2.2.3.

– The IP address of the L3 interface of VLAN 1000 is 10.2.2.1/24.huawei(config)#dhcp mode layer-3 option60huawei(config)#dhcp-server 2 ip 20.2.2.2 20.2.2.3huawei(config)#dhcp domain videohuawei(config-dhcp-domain-video)#dhcp-server 2huawei(config-dhcp-domain-voice)#quit



9-145

huawei(config)#interface vlanif 1000huawei(config-if-vlanif1000)#ip address 10.2.2.1 24huawei(config-if-vlanif1000)#dhcp domain video gateway 10.2.2.1

NOTEThe DHCP option 60 domain of the set-top box (STB) varies with the terminal type. In the actualconfiguration, see the operation instructions of the STB.

5. Configure the multicast data.– The multicast VLAN ID is 1000.

– The IGMP mode is proxy.

– The multicast upstream port is 0/19/0.

– The multicast address of program BTV-1 is 224.1.1.10, and the program sourceIP address is 10.10.10.10.

– The multicast address of program BTV-2 is 224.1.1.20, and the program sourceIP address is 10.10.10.10.

– Right profile 0 allows users to watch program BTV-1 in the program library.

– The user on port 0/5/3 is bound to right profile 0.huawei(config-if-vlanif1000)#quithuawei(config)#multicast-vlan 1000huawei(config-mvlan1000)#igmp mode proxy Are you sure to change IGMP mode?(y/n)[n]:yhuawei(config-mvlan1000)#igmp uplink-port 0/19/0huawei(config-mvlan1000)#igmp program add name BTV-1 ip 224.1.1.10 sourceip 10.10.10.10huawei(config-mvlan1000)#igmp program add name BTV-2 ip 224.1.1.20 sourceip 10.10.10.10huawei(config-mvlan1000)#btvhuawei(config-btv)#igmp uplink-port-mode default Are you sure to change the uplink port mode?(y/n)[n]:yhuawei(config-btv)#igmp profile add profile-name profile0huawei(config-btv)#igmp profile profile-name profile0 program-name BTV-1 watchhuawei(config-btv)#igmp policy service-port 200 normalhuawei(config-btv)#igmp policy service-port 300 normal huawei(config-btv)#igmp user add service-port 200 no-auth max-program 8huawei(config-btv)#igmp user add service-port 300 authhuawei(config-btv)#igmp user bind-profile port service-port 200 profile-name profile0huawei(config-btv)#multicast-vlan 1000huawei(config-mvlan1000)#igmp multicast-vlan member service-port 200huawei(config-mvlan1000)#igmp multicast-vlan member service-port 300huawei(config-mvlan1000)#quit


----End

Result

After the related upstream device and downstream device are configured, the triple play service(Internet, VoIP, and IPTV services) is available.

l The Internet user can access the Internet in the PPPoE mode.

l The VoIP user can make and receive phone calls.

l The IPTV user connected to port 0/5/2 can watch all the programs, and the IPTV userconnected to port 0/5/3 can watch only program BTV-1.




Issue 03 (2010-01-28)

Configuration File

Internet service:

vlan 100 smartport vlan 100 0/19 0traffic table ip index 7 cir 10240 priority 1 priority-policy local-Settingservice-port vlan 100 eth 0/5/2 multi-service user-vlan 2 rx-cttr 7 tx-cttr 7service-port vlan 100 eth 0/5/3 multi-service user-vlan 2 rx-cttr 7 tx-cttr 7queue-scheduler wrr 10 10 20 20 40 0 0 0cos-queue-map cos0 0 cos1 1 cos2 2 cos3 3 cos4 4 cos5 5 cos6 6 cos7 7save

VoIP service:

vlan 200 smartport vlan 200 0/19 0traffic table ip index 8 cir 10240 priority 6 priority-policy local-Settingservice-port vlan 200 eth 0/5/2 multi-service user-vlan 3 rx-cttr 8 tx-cttr 8service-port vlan 200 eth 0/5/3 multi-service user-vlan 3 rx-cttr 8 tx-cttr 8dhcp mode layer-3 option60dhcp-server 1 ip 20.1.1.2 20.1.1.3dhcp domain voicedhcp-server 1quitinterface vlanif 200ip address 10.1.1.1 24dhcp domain voice gateway 10.1.1.1quitsave

IPTV service:

vlan 1000 smartport vlan 1000 0/19 0traffic table ip index 9 cir off priority 5 priority-policy local-Settingservice-port 200 vlan 1000 eth 0/5/2 multi-service user-vlan 4 rx-cttr 9 tx-cttr 9service-port 300 vlan 1000 eth 0/5/3 multi-service user-vlan 4 rx-cttr 9 tx-cttr 9dhcp mode layer-3 option60dhcp-server 2 ip 20.2.2.2 20.2.2.3dhcp domain videodhcp-server 2quitinterface vlanif 1000ip address 10.2.2.1 24dhcp domain video gateway 10.2.2.1quitmulticast-vlan 1000igmp mode proxyyigmp uplink-port igmp program add name BTV-1 ip 224.1.1.10 sourceip 10.10.10.10igmp program add name BTV-2 ip 224.1.1.20 sourceip 10.10.10.10btvigmp uplink-port-mode defaultyigmp profile add profile-name profile0igmp profile profile-name profile0 program-name BTV-1 watchigmp policy service-port 200 normaligmp policy service-port 300 normal igmp user add service-port 200 no-auth max-program 8igmp user add service-port 300 authigmp user bind-profile port service-port 200 profile-name profile0multicast-vlan 1000igmp multicast-vlan member service-port 200igmp multicast-vlan member service-port 300quitsave



9-147

10 FAQ

About This Chapter

FAQs analyze and answer the frequently asked questions of configuring the MA5600T device.

10.1 How to Query the MAC Addresses of the Online Users and the Ports That Provide theAccess for the Users in the MA5600T

10.2 How to Determine Whether the Users Configured on the MA5600T Can Get Online in theNormal State by Running the Commands

10.3 What Are the Prerequisites for the Link and Protocol Status of the L3 Interface of theMA5600T to Be Up

10.4 How to Shield the Alarms of the User Port Activation/Deactivation

10.5 What Are the Frequently Asked Questions (FAQs) About the System Security of theMA5600T

10.6 How to Change the Management IP Address and VLAN Remotely

10.7 How to Change the Management VLAN

10.8 How to Change the Management IP address

10.9 How to Handle the System Prompt "too many users" When a User Telnets to the Device

10.10 How to Change the Rate of the User Port in a PON System

10.11 What Are the Differences Between Firewall and Packet-Filter in Activating an ACL

10.12 How to Realize the Communication Between Users on the Same Board

10.13 What Are Key Aspects and Major Steps for the Active/Standby Switchover

10.14 How to Query the Multicast Bandwidth Parameters of the MA5600T

10.15 How to Select the Matched Hardware for Expanding the Bandwidth of the Upstream Port

10.16 How to Back Up Data

10.17 How to Confirm an Upgraded Board

SmartAX MA5600TCommissioning and Configuration Guide 10 FAQ


10-1

10.18 How to Configure the Data of an Upgraded Board

10 FAQSmartAX MA5600T



Issue 03 (2010-01-28)

10.1 How to Query the MAC Addresses of the Online Usersand the Ports That Provide the Access for the Users in theMA5600T

Question

How to query the MAC addresses and the ports of the online users that provide the access forthe users in the MA5600T?

Answer

Step 1 Run the display mac-address all command to query the MAC addresses of all the online users.

Step 2 Run the display location command to query the ports of the online users according to thespecified MAC addresses.

----End

10.2 How to Determine Whether the Users Configured onthe MA5600T Can Get Online in the Normal State byRunning the Commands

Question

How to determine whether the users configured on the MA5600T can get online in the normalstate by running the commands?

Answer

Run the display statistic vlan command to query the traffic statistics of the service VLAN. Ifthe quantity of the packets transmitted upstream increases but the quantity of the packetstransmitted downstream remains unchanged, it can be determined that the failure of the newusers to get online is caused by the upper layer IP network or the BRAS. In this case, you cancheck the upper layer network.

10.3 What Are the Prerequisites for the Link and ProtocolStatus of the L3 Interface of the MA5600T to Be Up

Question

What are the prerequisites for the link and protocol status of the L3 interface of the MA5600Tto be up?



10-3

Answer

On the MA5600T, the link status depends on the status of the port in the VLAN correspondingto the L3 interface. If the status of an Ethernet port in the VLAN corresponding to the L3 interfaceis up, the link status of the L3 interface is up.

The following three prerequisites determine whether the protocol status is up:l Link status: The protocol status can be up only when the link status is up.

l Whether an IP address exists on the L3 interface.

l Management status of the interface: The protocol status of the interface is up only whenthere is an IP address on the interface, the link status is up, and the management status isup.

10.4 How to Shield the Alarms of the User Port Activation/Deactivation

Question

How to shield the alarms of the user port activation/deactivation?

Answer

To prevent the excessive alarms (such as the alarms of the user port activation/deactivation)from affecting the normal operation, you can use the following methods to shield the alarms.

1. Run the display alarm history all detail command to query the alarm ID.2. Then, run the undo alarm output alarmid command to shield the specified alarm.

10.5 What Are the Frequently Asked Questions (FAQs)About the System Security of the MA5600T

Question

What are the frequently asked questions (FAQs) about the system security of the MA5600T?How to prevent the system breakdown or the service interruption of the MA5600T caused bythe network attacks through the proper configuration?

Answer

The common improper configurations that affect the system security are as follows:

l The ring network detection function and the anti-MAC address-spoofing function aredisabled. When the anti-MAC address-spoofing function is disabled, the illegal user sendsthe PPPoE and DHCP control packets by forging the MAC address of a legal user. In thiscase, the security of the system is affected.Run the ring check command to enable the ring network detection function on the userside.




Issue 03 (2010-01-28)

Run the security anti-macspoofing enable command to enable the anti-MAC address-spoofing function.

l Manage the device by using the IP address of the public network, and the access rights arenot limited strictly when the ACL rule is configured. In this case, the network is attacked.

To ensure the security of the device, manage the device by using the IP addresses of theprivate network. When configuring the ACL rule, you must comply with the principle ofthe minimum authorization to configure the accessible address segment. The accessibleaddress segment can contain only the mandatory IP addresses of the management networksegment. Other IP addresses cannot access the device management interface.

l The packets that access the device management interface are not controlled so that thedevice is attacked by the packets. In this case, the system becomes busy and the servicesare affected.

Run the firewall packet-filter command to apply the packet filtering rules of the firewallto the interface to filter the packets that access the interface. In this case, the packet attackis prevented.

10.6 How to Change the Management IP Address and VLANRemotely

Question

When the device is managed and maintained in the inband management mode, how to modifythe related configuration remotely if the IP address and the VLAN of the NMS are changed?

Answer

Step 1 Log in to the gateway where the MA5600T is located, and then run the telnet command to login to the MA5600T through the gateway.

Step 2 Run the display packet-filter or display firewall packet-filter statistics command to querythe ACL configuration. Make sure that the new IP address can access the device.

Step 3 Run the vlan command to create a management VLAN, run the port vlan command to add anupstream port to the VLAN, and then run the interface vlanif command to enable the L3interface of the VLAN. Then, run the ip address command to configure the management IPaddress, and run the ip route-static command to add a route.

Step 4 Log out of the MA5600T. Run the ip address command to change the IP address of the gatewayinterface to be in the same subnet as the new management IP address. Then, use the newmanagement IP address to log in to the device. Run the undo interface vlanif command to deletethe L3 interface of the original management VLAN, run the undo port vlan command to deletethe upstream port of the original management VLAN, and then run the undo vlan command todelete the original management VLAN. Run the undo ip route-static command to delete theoriginal route.

Step 5 Run the save command to save the data, and then exit.

----End



10-5

10.7 How to Change the Management VLAN

Question

When the VLAN to which the NMS belongs is changed, how to change the management VLANon the MA5600T?

Answer

Step 1 Delete the L3 interface and the upstream port of the original NMS VLAN and delete the originalNMS VLAN.

1. Run the undo interface vlanif command to delete the L3 interface of the originalmanagement VLAN.

2. Run the undo port vlan command to delete the upstream port of the original managementVLAN.

3. Run undo vlan command to delete the original management VLAN.

Step 2 Create an NMS VLAN, upstream port, L3 interface of the NMS VLAN, and management IPaddress.

1. Run the vlan command to create a management VLAN.

2. Run the port vlan command to add an upstream port to the VLAN.

3. Run the interface vlanif command to enable the L3 interface of the VLAN.

4. Run the ip address command to configure the management IP address.


----End

10.8 How to Change the Management IP address

Question

When the IP address of the NMS is changed, how to change the management IP address on theMA5600T?

Answer

Step 1 Run the interface vlanif command to enter the L3 interface of the management VLAN, run theip address command to delete the original management IP address, and then add a managementIP address.

Step 2 Run the ip route-static command to delete the original route, and then add a route.


----End




Issue 03 (2010-01-28)

10.9 How to Handle the System Prompt "too many users"When a User Telnets to the Device

Question

When a user telnets to the MA5600T, the system prompts "too many users" and the login fails.How to handle this problem?

Answer

The possible causes are as follows:

l The remote login to the MA5600T has exceeded the system restriction.

l The device is infected with viruses.

l The system software is faulty.

l The hardware, such as the control board, is faulty.

Step 1 Run the display client or display terminal user online command to query the user informationto check whether excessive users have logged in to the system. If yes, the prompt is correct.Otherwise, the device may be infected with viruses. In this case, you can configure a firewalland an ACL to handle this problem. The following is an example:

Step 2 Enable the firewall.

l huawei(config)#firewall enable

l huawei(config)#firewall default permit

Step 3 Specify the IP addresses that can access the device. Assume that the IP address of the device is218.3.253.15.

1. huawei(config)#acl 3000 //Configure an ACL.

2. huawei(config-acl-adv-3000)# rule permit tcp source 218.3.253.0 0.0.0.255 destination218.3.253.15 0 //The TCP packets with the source IP address of only 218.3.253.0 can bereceived.

NOTE0.0.0.255 is the inverse subnet mask of the source IP address.

3. huawei(config-acl-adv-3000)# rule deny tcp source any destination 218.3.253.15 0 //TheTCP packets with any other source IP address are prohibited from accessing the device.

Step 4 Apply firewall packet filtering rules to the management Ethernet port or the VLAN interface.

l In the inband network management mode:

1. huawei(config)#interface vlanif 4000 //Enter the NMS VLAN interface.

2. huawei(config-if-vlanif4000)# firewall packet-filter 3000 inboundl In the outband network management mode:

1. huawei(config)#interface meth 0 //Enter the MEth mode.

2. huawei(config-if-meth0)# firewall packet-filter 3000 inbound



10-7

Step 5 Reset the system after the preceding operations are performed. If the problem persists, contactHuawei technical support.

----End

10.10 How to Change the Rate of the User Port in a PONSystem

Question

How to change the rate of the user port in a PON system?

Answer

In a PON system, when the rate of the user port fails to meet the requirement, the possible causesare as follows:

l The rate of the ONT port does not meet the requirement.

l The user bandwidth configured in the DBA profile is improper.

l When the rate of the ONT port does not meet the requirement, run the ont port attributecommand to change the rate of the ONT port.

l When the user bandwidth configured in the DBA profile is improper, do as follows:

1. Run the undo tcont command to unbind the T-CONT from the DBA profile.2. Run the DBA-profile modify command to change the user bandwidth configured in

the DBA profile.3. Run the tcont command to bind the T-CONT to the DBA profile.

----End

10.11 What Are the Differences Between Firewall andPacket-Filter in Activating an ACL

Question

What are the differences between firewall and packet-filter in activating an ACL?

Answer

On the MA5600T, you can run the packet-filter or firewall command to activate an ACL. Thedifferences between these two commands are as follows:

l The firewall mode is mainly applied to the NMS.

l With these two modes, the rules of an ACL are implemented in different orders. Thefirewall mode is implemented by the software, and the rules configured earlier in an ACLare executed first. The packet-filter mode is implemented by the hardware, and the rulesconfigured later in an ACL are executed first.




Issue 03 (2010-01-28)

10.12 How to Realize the Communication Between Users onthe Same Board

Question

How to realize the communication between users on the same board, including users in the sameVLAN and in different VLANs?

Answer

When users are in different VLANs, user ports are isolated at L2. Therefore, even if users areon the same board, they cannot directly communicate with each other at L2. To realize thecommunication between users on the same board, users must belong to the same super VLAN,and thus different sub VLANs can communicate with each other through the ARP proxy. Thatis, through the L3 interface of the super VLAN, the services of different sub VLANs can beforwarded at L3, and then users in the same super VLAN can communicate with each other.

Step 1 Create VLAN 20,VLAN 30.

huawei(config)#vlan 20 smart huawei(config)#vlan 30 smart

Step 2 Create super VLAN 40.huawei(config)#vlan 40 super

Step 3 Add a sub VLAN 20 to super VLAN 40.huawei(config)#supervlan 40 subvlan 20

Step 4 Add a sub VLAN 30 to super VLAN 40.huawei(config)#supervlan 40 subvlan 30

Step 5 Enable the ARP proxy globally.huawei(config)#arp proxy enable

Step 6 Enable the ARP proxy on VLAN L3 interface 40.

huawei(config)#interface vlanif 40 huawei(config-if-Vlanif40)#arp proxy enable

Step 7 Configure the IP address of VLAN L3 interface 40.huawei(config-if-Vlanif40)#ip address 10.1.1.254 24 When only users in different VLANs need to communicate with each other, steps 8 is notrequired.

Step 8 Enable the ARP proxy on VLAN20,VLAN30.

huawei(config-if-vlanif40)#arp proxy enable subvlan 20huawei(config-if-vlanif40)#arp proxy enable subvlan 30

----End



10-9

10.13 What Are Key Aspects and Major Steps for the Active/Standby Switchover

QuestionWhat are key aspects and major steps for the active/standby switchover?

AnswerFor the active/standby switchover, there are two key aspects: data synchronization andsmoothing. The active/standby switchover can be implemented in the normal state only whenthe data is fully synchronized and smoothing is properly performed. Data synchronizationindicates that all the changes in the data of the active control board can be synchronized to thestandby control board. Smoothing is a series of operations that are performed during the active/standby switchover before the standby control board functions as the active control board. Toimplement the active/standby switchover, do as follows:l Set up the environment for active/standby switchover. That is, configure two control boards,

one active control board and one standby control board.l Run the display data sync state command to query the status of data synchronization

between active and standby control boards.l Run the system switch-over command to manually perform the active/standby switchover.

10.14 How to Query the Multicast Bandwidth Parameters ofthe MA5600T

QuestionHow to query the multicast bandwidth parameters of the MA5600T?

AnswerWhen the MA5600T provides the multicast service, pay attention to the following parameters:bandwidth of the multicast user and bandwidth of the multicast program.l Bandwidth of the multicast user

Run the display igmp user command to query the maximum bandwidth and the occupiedbandwidth of the multicast user.

l Bandwidth of the multicast programRun the display igmp program command to query the bandwidth allocated to the multicastprogram.




Issue 03 (2010-01-28)

10.15 How to Select the Matched Hardware for Expandingthe Bandwidth of the Upstream Port

QuestionWhen the upstream bandwidth of the device is insufficient, how to expand the bandwidth bychanging the port type? Assume that the 2GE GICF upstream board is used in thetelecommunications room, and the upstream bandwidth is to be expanded to 4GE or higher.

Answer

Step 1 Confirm the supported boards: According to the board matching relation description in theRelease Notes, it can be confirmed that the GICD board supports upstream transmission throughthe 4GE optical port, and the X1CA/X2CA board supports upstream transmission through the10GE optical port.

NOTE

Assume that the GICD board is selected.

Step 2 Confirm the installation position of the board: According to ETSI Service Shelf in the HardwareDescription, the GICD board can be installed in slot 9 or 20.

Step 3 Confirm the cable required: According to the external ports of each board as described in Boardin the Hardware Description, optical fibers are required for connecting the board to the ODF.

Step 4 Install the selected board and optical fibers to expand the upstream bandwidth.

----End

10.16 How to Back Up Data

QuestionAn upgrade may affect the services of the current network, for example, the upgrade of thedaughter board of a control board or the upgrade of the bandwidth of an upstream port. How toback up the original data of a device before the upgrade?

Answer

Generally, to back up the data, you can run the following commands:

l Enter the privilege mode, and run the save command to save the current database file andconfiguration file.

l Run the TFTP software, and run the backup data command to back up the database file.

l Run the backup configuration command to back up the configuration file.

l Run the backup language command to back up the language file.



10-11

10.17 How to Confirm an Upgraded Board

QuestionAfter a board (newly added) is upgraded on a device, the board is not displayed in the software.Or, the board status is displayed as Auto_find. In such cases, data cannot be configured on thenewly added board. So, how to add the board successfully?

AnswerA board can be added in two ways:

l Added offline. After you run the board add command to add a board to a vacant slot, thesystem generates a board fault alarm. After that, insert the board into the correspondingslot. If the type of the inserted board is the same as the type of the board added offline, thesystem generates a board recovery alarm (alarm ID 0x02310000). If the board types do notmatch, the system generates a non-match alarm (alarm ID 0x02300082).

l Auto-found. Insert the board into a vacant slot. When the system prompts that the board isautomatically found, you need to run the board confirm command to confirm the board.

NOTE

l To add a board successfully, make sure that the shelf ID and slot ID of the board added through the CLI arethe same as the actual shelf ID and slot ID of the board inserted manually.

l To add a board successfully, make sure that the type of the board added through the CLI is the same as theactual board type.

10.18 How to Configure the Data of an Upgraded Board

QuestionTo provision the service after a board upgrade, data needs to be configured on the upgradedboard. How to configure the data of an upgraded board?

AnswerA common procedure for configuring the data to provision service is as follows:

Step 1 Confirm the board.Commands: board confirm and board add

Step 2 Create a VLAN and add an upstream port to the VLAN.Commands: vlan and port vlan

Step 3 Create a service port.Command: service-port

Step 4 Activate the port.Command: activate

Step 5 Save the data.




Issue 03 (2010-01-28)

Command: save

----End



10-13

Commissioning and Configuration Guide(V800R006C02_03,GPON)

Documents