In an SVF system, the parent delivers configurations to ASs using service profiles. Service profiles are a set of service configurations. After service profiles are delivered to an AS, the AS parses and executes the services configured in the service profiles.
For services that can be batch configured for ASs using service profiles, see Service Configuration Supported on an AS.
An AS port group can be bound to a network basic profile, network enhanced profile, user access profile, traffic policy profile, and network QoS profile.
Ports of an AS can be added to a maximum of 32 different AS port groups.
Only a network basic profile can be bound to an AP port group, and an AP port group can be bound to only one network basic profile.
When an AS goes offline and then goes online again, the AS restarts if the global configuration of the AS is changed on the parent and the changed configuration is committed.
The system view is displayed.
The uni-mng view is displayed.
An AS administrator profile is created.
The user name and password required for AS logins are configured.
By default, the rate limits for outgoing ARP packets and DHCP packets are 32 kbit/s and 128 kbit/s respectively on an AS uplink fabric port.
The rate limit for outgoing ARP and DHCP packets on an uplink fabric port is configured.
BPDU protection is configured on the AS.
IPv6 function is configured on the AS.
Exit from the AS administrator profile view.
An AS group is created.
An AS with a specified name is added to the AS group.
ASs of which the name contains a specified string are added to the AS group.
All online ASs are added to the AS group.
The specified AS administrator profile is bound to the AS group.
Exit from the AS group view.
The configuration is committed.
After configuring service profiles and binding them to an AS group, you must run this command to commit the configuration so that the configuration can be delivered to ASs.
Example
<HUAWEI> system-view [HUAWEI] uni-mng [HUAWEI-um] as-admin-profile name profile_1 [HUAWEI-um-as-admin-profile_1] user test password Pwd@123456 // Specify the user name and password used to log in to ASs. [HUAWEI-um-as-admin-profile_1] quit [HUAWEI-um] as-group name group_1 [HUAWEI-um-as-group-group_1] as all // This configuration takes effect for all online ASs. [HUAWEI-um-as-group-group_1] as-admin-profile profile_1 // Bind the AS group to the AS administrator profile. [HUAWEI-um-as-group-group_1] quit [HUAWEI-um] commit as all // Commit the configuration to deliver it to ASs.
The system view is displayed.
The uni-mng view is displayed.
A network basic profile is created.
Service Functions |
Configuration Command |
Usage Description |
|---|---|---|
Configure the default VLAN on an interface. |
user-vlan vlan-id |
- |
Configure allowed VLANs on an interface. |
pass-vlan { vlan-id1 [ to vlan-id2 ] } &<1-10> |
A maximum of 32 allowed VLANs can be configured on each AS port. |
Configure a voice VLAN on an interface. |
voice-vlan vlan-id [ include-untagged ] |
The command configuration does not take effect on the service Eth-Trunk bound to a port group. When configuring a voice VLAN on an AS port, ensure that IP phones connected to the AS port support LLDP and have LLDP enabled. |
Exit from the network basic profile view.
An AS port group is created.
The AS port group description is configured to facilitate identification of the terminals connected to the AS port group.
Ports of a specified AS are added to the AS port group.
Ports of ASs of which the name contains a specified string are added to the AS port group.
The specified network basic profile is bound to the AS port group.
Exit from the AS port group view.
An AP port group is created.
The AP port group description is configured to facilitate identification of the terminals connected to the AP port group.
Ports of a specified AS are added to the AS port group.
Ports of ASs of which the name contains a specified string are added to the AS port group.
The specified network basic profile is bound to the AP port group.
When an AP port group is bound to a network basic profile, only the pass-vlan { vlan-id1 [ to vlan-id2 ] } &<1-10> command takes effect in the network basic profile view.
Exit from the AP port group view.
The configuration is committed.
After configuring service profiles and binding them to a port group, you must run this command to commit the configuration so that the configuration can be delivered to ASs.
Example
<HUAWEI> system-view [HUAWEI] uni-mng [HUAWEI-um] network-basic-profile name profile_1 [HUAWEI-um-net-basic-profile_1] pass-vlan 10 to 12 // Specify the allowed VLANs on AS ports. [HUAWEI-um-net-basic-profile_1] quit [HUAWEI-um] port-group name group_1 [HUAWEI-um-portgroup-group_1] as name as1 interface gigabitethernet 0/0/1 to 0/0/5 // Deliver the configuration to ports GE0/0/1 to GE0/0/5 on AS1. [HUAWEI-um-portgroup-group_1] network-basic-profile profile_1 // Bind the port group to the network basic profile. [HUAWEI-um-portgroup-group_1] quit [HUAWEI-um] commit as name as1 // Commit the configuration to deliver it to AS1.
The system view is displayed.
The uni-mng view is displayed.
A network enhanced profile is created.
Service Functions |
Configuration Command |
Usage Description |
|---|---|---|
Configure unknown unicast traffic suppression on an interface. |
unicast-suppression packets packets-per-second |
The command configuration does not take effect on the service Eth-Trunk bound to a port group. |
Configure multicast traffic suppression on an interface. |
multicast-suppression packets packets-per-second |
The command configuration does not take effect on the service Eth-Trunk bound to a port group. |
Configure broadcast traffic suppression on an interface. |
broadcast-suppression packets packets-per-second |
The command configuration does not take effect on the service Eth-Trunk bound to a port group. |
Enable DHCP snooping on an interface. |
dhcp snooping enable |
This command can only be used to check packets against DHCP dynamic binding entries but not DHCP static binding entries. |
Enable IP packet check on an interface. |
ip source check user-bind enable |
Before running this command, you must run the dhcp snooping enable command. |
Configure dynamic ARP inspection (DAI) on an interface. |
arp anti-attack check user-bind enable |
Before running this command, you must run the dhcp snooping enable command. |
Configure traffic rate limiting on an interface. |
rate-limit cir-value |
The command configuration does not take effect on the service Eth-Trunk bound to a port group. If user traffic is not limited, continuous burst data from numerous users can make the network congested. You can configure traffic rate limiting in inbound direction on an interface to limit traffic entering from the interface within a specified range. |
Configure an interface as an edge interface. |
user-access-port enable |
Ports connected to a Layer 2 STP network do not need to participate in spanning tree calculation. If these ports participate in the calculation, the network topology convergence speed is affected and the status changes of these ports may cause network flapping. After these ports are configured as edge ports, they do not participate in spanning tree calculation. This configuration speeds up network topology convergence and enhances network stability. |
Configure the system to set an interface to the Error-Down state when MAC address flapping is detected on the interface. |
mac-address flapping action error-down |
- |
Configure the alarm function for MAC address learning and aging on an interface. |
mac-address trap notification all |
- |
Enable the port security function. |
port-security enable |
If the mac-limit command is configured in the user access profile view on an AS port bound to a network enhanced profile, the port security function cannot be enabled on the AS port. |
Set the aging time of secure dynamic MAC addresses on an interface. |
port-security aging-time time |
The port security function must be enabled. |
Enable the sticky MAC function on an interface. |
port-security mac-address sticky |
The port security function must be enabled. |
Exit from the network enhanced profile view.
An AS port group is created.
The AS port group description is configured to facilitate identification of the terminals connected to the AS port group.
Ports of a specified AS are added to the AS port group.
Ports of ASs of which the name contains a specified string are added to the AS port group.
The network enhanced profile is bound to the AS port group.
Exit from the AS port group view.
The configuration is committed.
After configuring service profiles and binding them to a port group, you must run this command to commit the configuration so that the configuration can be delivered to ASs.
Example
<HUAWEI> system-view [HUAWEI] uni-mng [HUAWEI-um] network-enhanced-profile name profile_1 [HUAWEI-um-net-enhanced-profile_1] unicast-suppression packets 148810 // Configure unknown unicast traffic suppression for ASs. [HUAWEI-um-net-enhanced-profile_1] quit [HUAWEI-um] port-group name group_1 [HUAWEI-um-portgroup-group_1] as name as1 interface gigabitethernet 0/0/1 to 0/0/5 // Deliver the configuration to ports GE0/0/1 to GE0/0/5 on AS1. [HUAWEI-um-portgroup-group_1] network-enhanced-profile profile_1 // Bind the port group to the network enhanced profile. [HUAWEI-um-portgroup-group_1] quit [HUAWEI-um] commit as name as1 // Commit the configuration to deliver it to AS1.
The system view is displayed.
The uni-mng view is displayed.
A user access profile is created.
NAC provides three user authentication modes: 802.1X authentication, MAC address authentication, and Portal authentication. To implement user access authentication, run the dot1x-access-profile name access-profile-name, mac-access-profile name access-profile-name, and portal-access-profile name access-profile-name commands in the system view to create an access profile, bind one or multiple of the three user authentication modes to the authentication profile, and then bind the authentication profile to the user access profile in an SVF system.
Service Functions |
Configuration Command |
Usage Description |
|---|---|---|
Configure an authentication profile to set the user access authentication mode. |
authentication-profile authentication-profile-name |
The command configuration does not take effect on the service Eth-Trunk bound to a port group. The user access authentication mode configured through an authentication profile is mutually exclusive with MAC address limiting on an interface and cannot be both configured. The user access authentication mode configured through an authentication profile is mutually exclusive with the function of rate limiting incoming ARP and DHCP packets on an AS port and cannot be both configured.
|
Configure MAC address limiting on an interface. |
mac-limit maximum max-num |
|
Rate limit incoming ARP and DHCP packets on an AS port. |
traffic-limit inbound { arp | dhcp } cir cir-value |
By default, the forwarding rate of incoming ARP and DHCP packets on an AS port is not limited.
|
Configure the maximum number of access users on an AS port. |
authentication access-user maximum |
The maximum number of access users ranges from 1 to 1024. After the value is delivered to an AS, the effective value depends on the AS specifications. For details, see authentication access-point max-user. The authentication access-user maximum command configuration takes effect only for new users. The command configuration does not take effect on the service Eth-Trunk bound to a port group. |
Exit from the user access profile view.
An AS port group is created.
The AS port group description is configured to facilitate identification of the terminals connected to the AS port group.
Ports of a specified AS are added to the AS port group.
Ports of ASs of which the name contains a specified string are added to the AS port group.
The specified user access profile is bound to the AS port group.
Exit from the AS port group view.
The configuration is committed.
After configuring service profiles and binding them to a port group, you must run this command to commit the configuration so that the configuration can be delivered to ASs.
Example
<HUAWEI> system-view [HUAWEI] mac-access-profile name 1 [HUAWEI-mac-access-profile-1] quit [HUAWEI] authentication-profile name test [HUAWEI-authen-profile-test] mac-access-profile 1 // Configure a MAC access profile. [HUAWEI-authen-profile-test] quit [HUAWEI] uni-mng [HUAWEI-um] user-access-profile name huawei [HUAWEI-um-user-access-huawei] authentication-profile test // Bind the authentication profile to the user access profile. [HUAWEI-um-user-access-huawei] quit [HUAWEI-um] port-group name group_1 [HUAWEI-um-portgroup-group_1] as name as1 interface gigabitethernet 0/0/1 to 0/0/5 // Deliver the configuration to ports GE0/0/1 to GE0/0/5 on AS1. [HUAWEI-um-portgroup-group_1] user-access-profile huawei // Bind the port group to the user access profile. [HUAWEI-um-portgroup-group_1] quit [HUAWEI-um] commit as name as1 // Commit the configuration to deliver it to AS1.
The system view is displayed.
The uni-mng view is displayed.
A network QoS profile is created.
Service Functions |
Configuration Command |
Usage Description |
|---|---|---|
Configure priority mapping based on DSCP priorities. |
trust dscp |
- |
Set a scheduling mode for interface queues. |
qos { pq | wrr | drr } |
- |
Configure a queue scheduling weight. |
qos queue queue-index { drr | wrr } weight weight |
The queue scheduling mode of an AS port has been set to WRR or WDRR using the qos { pq | wrr | drr } command. |
Exit from the network QoS profile view.
An AS port group is created.
The AS port group description is configured to facilitate identification of the terminals connected to the AS port group.
Ports of a specified AS are added to the AS port group.
Ports of ASs of which the name contains a specified string are added to the AS port group.
The specified network QoS profile is bound to the AS port group.
Exit from the AS port group view.
The configuration is committed.
After configuring service profiles and binding them to a port group, you must run this command to commit the configuration so that the configuration can be delivered to ASs.
Example
<HUAWEI> system-view [HUAWEI] uni-mng [HUAWEI-um] network-qos-profile name test [HUAWEI-um-net-qos-test] trust dscp // Perform priority mapping on packets based on DSCP priorities. [HUAWEI-um-net-qos-test] quit [HUAWEI-um] port-group name group_1 [HUAWEI-um-portgroup-group_1] as name as1 interface gigabitethernet 0/0/1 to 0/0/5 // Deliver the configuration to ports GE0/0/1 to GE0/0/5 on AS1. [HUAWEI-um-portgroup-group_1] network-qos-profile test // Bind the port group to the network QoS profile. [HUAWEI-um-portgroup-group_1] quit [HUAWEI-um] commit as name as1 // Commit the configuration to deliver it to AS1.
The system view is displayed.
Run acl acl-number
An ACL number is configured. The ACL number ranges from 3000 to 3900.
Or run acl ipv6 acl6-number
An IPv6 ACL number is configured. The ACL number ranges from 3000 to 3900.
Run rule (advanced ACL view)
An ACL rule is configured.
Or run rule (advanced ACL6 view)
An ACL6 rule is configured.
Only 5-tuple information (source IP address, destination IP address, source MAC address, destination MAC address, and protocol type) can be specified in ACL rules and ACL6 rule.
Exit from the ACL view.
The uni-mng view is displayed.
An AS administrator profile is created.
Run acl number acl-number
An ACL rule to be used in the AS administrator profile is configured.
Or run acl ipv6 number acl-number
An IPv6 ACL rule to be used in the AS administrator profile is configured.
Exit from the AS administrator profile view.
An AS group is created.
An AS with a specified name is added to the AS group.
ASs of which the name contains a specified string are added to the AS group.
All online ASs are added to the AS group.
The specified AS administrator profile is bound to the AS group.
Exit from the AS group view.
The configuration is committed.
After configuring service profiles and binding them to an AS group, you must run this command to commit the configuration so that the configuration can be delivered to ASs.
A traffic policy profile is created.
A traffic policy is created.
A maximum of 64 traffic policies can be created in a traffic policy profile.
Exit from the traffic policy profile view.
An AS port group is created.
The AS port group description is configured to facilitate identification of the terminals connected to the AS port group.
Ports of a specified AS are added to the AS port group.
Ports of ASs of which the name contains a specified string are added to the AS port group.
Ports in the AS port group are bound to the traffic policy profile.
Exit from the AS port group view.
The configuration is committed.
After configuring service profiles and binding them to a port group, you must run this command to commit the configuration so that the configuration can be delivered to ASs.
Example
<HUAWEI> system-view [HUAWEI] acl 3001 [HUAWEI-acl-adv-3001] rule permit ip dscp cs1 [HUAWEI-acl-adv-3001] quit [HUAWEI] uni-mng [HUAWEI-um] as-admin-profile name profile_1 [HUAWEI-as-admin-profile_1] acl number 3001 [HUAWEI-as-admin-profile_1] quit [HUAWEI-um] as-group name group_1 [HUAWEI-um-as-group-group_1] as name as1 // This configuration takes effect for AS1 that has been online. [HUAWEI-um-as-group-group_1] as-admin-profile profile_1 // Bind the AS group to the AS administrator profile. [HUAWEI-um-as-group-group_1] quit [HUAWEI-um] commit as name as1 // Commit the configuration to deliver it to AS1. [HUAWEI-um] traffic-policy-profile name profile_1 [HUAWEI-um-traffic-policy-profile_1] policy a remark 8021p 2 if-match acl 3001 // Configure a traffic policy. [HUAWEI-um-traffic-policy-profile_1] quit [HUAWEI-um] port-group name group_1 [HUAWEI-um-portgroup-group_1] as name as1 interface gigabitethernet 0/0/1 to 0/0/5 // Deliver the configuration to ports GE0/0/1 to GE0/0/5 on AS1. [HUAWEI-um-portgroup-group_1] traffic-policy-profile profile_1 inbound // Bind the port group to the traffic policy profile. [HUAWEI-um-portgroup-group_1] quit [HUAWEI-um] commit as name as1 // Commit the configuration to deliver it to AS1.