static-user
Function
The static-user command configures a static user.
The undo static-user command removes the layer 2 static user.
By default, no layer 2 static user is configured.
This command is supported only on the NetEngine 8000 F1A.
Format
static-user [ description ] { start-ip-address [ end-ip-address ] [ gateway gateway-ip-address ] | start-ipv6-address [ end-ipv6-address ] [ delegation-prefix start-ipv6-prefix [ end-ipv6-prefix ] prefix-length ] ipv6-gateway ipv6-address } * [ vpn-instance instance-name ] [ interface { interface-name | interface-type interface-number } [ vlan vlan-id [ qinq qinq-vlan ] ] | mac-address mac-address | detect | keep-online | domain-name domain-name | export ] *
static-user [ description ] start-ip-address [ end-ip-address ] [ gateway gateway-ip-address ] [ vpn-instance instance-name ] [ domain-name domain-name | interface-list list-name | mac-address mac-address | keep-online | export ] *
undo static-user { description | { start-ip-address [ end-ip-address ] | start-ipv6-address [ end-ipv6-address ] | delegation-prefix start-ipv6-prefix [ end-ipv6-prefix ] prefix-length } [ vpn-instance instance-name ] }
undo static-user { description | { start-ip-address [ end-ip-address ] gateway gateway-ip-address | start-ipv6-address [ end-ipv6-address ] | [ delegation-prefix start-ipv6-prefix [ end-ipv6-prefix ] prefix-length ] ipv6-gateway ipv6-address } * vpn-instance instance-name }
Parameters
| Parameter | Description | Value |
|---|---|---|
| description |
Specifies a description for a layer 2 static user. |
The value is a string of 1 to 32 case-insensitive characters. |
| start-ip-address |
Specifies a start IP address. |
The value is in dotted decimal notation. |
| end-ip-address |
Specifies an end IP address. The difference between the end IPv4 address and start-ip-address must not exceed 256. If this parameter is not specified, this command configures only one layer 2 static user. |
The value is in dotted decimal notation. |
| gateway gateway-ip-address |
Specifies a gateway address. |
The value is in dotted decimal notation. |
| start-ipv6-address |
Specifies a start IPv6 address. |
The value is a 32-digit hexadecimal number, in the format of X:X:X:X:X:X:X:X. |
| end-ipv6-address |
Specifies an end IPv6 address. |
The value is a 32-digit hexadecimal number, in the format of X:X:X:X:X:X:X:X. |
| delegation-prefix start-ipv6-prefix |
Specifies a start IPv6 delegation prefix. |
The value is a 32-digit hexadecimal number, in the format of X:X:X:X:X:X:X:X. |
| end-ipv6-prefix |
Specifies an end IPv6 delegation prefix. |
The value is a 32-digit hexadecimal number, in the format of X:X:X:X:X:X:X:X. |
| prefix-length |
Specifies an IPv6 delegation prefix length. |
The value is an integer of 1 to 128 case-sensitive characters, spaces not supported. |
| ipv6-gateway ipv6-address |
Specifies an IPv6 gateway address. |
The value is a 32-digit hexadecimal number, in the format of X:X:X:X:X:X:X:X. |
| vpn-instance instance-name |
Specifies a VPN instance name. The VPN instance specified must have been configured. |
The value is a string of 1 to 31 characters. |
| interface |
Indicates interfaces. |
- |
| interface-name |
Specifies an interface name. |
- |
| interface-type |
Specifies an interface type. |
- |
| interface-number |
Specifies an interface number. |
- |
| vlan vlan-id |
Specifies a VLAN ID. This parameter is applicable only to Ethernet sub-interfaces. |
The value ranges from 1 to 4094. |
| qinq qinq-vlan |
Specifies a QinQ VLAN ID. |
The value ranges from 1 to 4094. |
| mac-address mac-address |
Indicates MAC addresses. If this parameter is specified, it applies only to one layer 2 static user. |
The value is a 12-digit hexadecimal number, in the format of H-H-H. Each H is 4 digits. If an H contains fewer than 4 digits, the left-most digits are padded with zeros. For example, e0 is displayed as 00e0. |
| detect |
Configures the device to detect whether the configured layer 2 static user is online. If this parameter is not configured, IPv4 users are triggered to go online only when ARP/IPv4 packets are sent. IPv6 users are triggered to go online after they proactively send NS/NA/IPv6 packets. |
- |
| keep-online |
Configures the device to retain the online status of the configured layer 2 static user even if user detection fails. This parameter is configured when firewalls exist on the network and detection packets cannot be sent out. |
- |
| domain-name domain-name |
Specifies a domain name. If this parameter is not specified, the default domain name for the specified interface and VLAN is used. |
The value is a string of 1 to 64 case-insensitive characters. |
| export |
Advertises host routes of a layer 2 static user. |
- |
| interface-list list-name |
Specifies the name of an interface list. |
The value is a string of 1 to 32 case-insensitive characters. |
Usage Guidelines
Usage Scenario
To configure a layer 2 static user, run the static-user command. The device allows layer 2 static users to go online through any interface. Layer 2 static users can be flexibly configured. You can specify only an IP address or specify all parameters. You are advised to speicy the domain name used for a Layer 2 static user. If detect is configured, ensure that the physical location of the layer 2 static user is identified, the IPv4 address of the layer 2 static user is in the configured address pool and is disabled using the excluded-ip-address command. This is not required for IPv6 addresses.
Prerequisites
Before configuring an IPv4 address for a layer 2 static user, configure an address pool. If the address pool configured is a local address pool, run the excluded-ip-address command to disable the IPv4 address so that it cannot be assigned.
Before configuring an IPv6 address for a layer 2 static user, configure a local address pool first if the IPv6 address or delegation prefix is obtained from the local address pool. If the IPv6 address or delegation prefix is obtained from a remote address pool, whether the local address pool is configured first is not restricted. An access interface list has been configured using the static-user interface-list command and the specified access interface of static users has been bound to the configured interface list. Before specifying an interface for a layer 2 static user, configure the interface as a BAS interface.Follow-up Procedure
Run the ip-trigger or arp-trigger command on the user access interface to allow users to send IP or ARP packets to go online.
Run the ipv6-trigger or nd-trigger command on the user access interface to allow users to send IPv6 or ND packets to go online.Precautions
- IPv4 single-stack static users can go online through multiple interfaces bound to an interface list, but the device cannot initiate ARP or IP packets for the static users for login. When you configure IPv4 single-stack static users to go online through interfaces bound to an interface list using the static-user command, the detect and vlan keywords are removed from the command.
- IPv6 static users cannot go online through interfaces bound to an interface list.
- The IPv6 gateway address must be a link-local address (LLA), global unicast address (GUA), or local unique address (ULA). When ipv6-gatewa is configured for a Layer 2 IPv6 static user, if a client needs to ping the gateway address, please configure the gateway address on any interface on the BRAS.
- The IPv6 layer 2 static user function is under PAF control and is not supported by default.
- If the Layer 2 static user is an IPv4 single-stack user, the user can go online through multiple interfaces bound to an interface list. You cannot specify vlan in the static-user command. VLANs can be specified based on VLAN configurations of interfaces. The interfaces bound to the static IPv4 users who go online through ARP message sending on the device can be Layer 2 private line interfaces or Layer 2 interfaces. If other types of interfaces are bound to such users, the users cannot go online.
- If the layer 2 static user is an IPv4 single stack user, configuring an IPv4 address is mandatory. The other parameters can be specified or not.
- If the layer 2 static user is an IPv6 single stack user, configuring an IPv6 address and a gateway address is mandatory. The other parameters can be specified or not. If you want to configure IPv6 delegation prefixes, the numbers of IPv6 delegation prefixes and IPv6 addresses must be the same. The interfaces bound to the static IPv6 users who go online through NS message sending on the device must be Layer 2 interfaces. If other types of interfaces are bound to such users, the users cannot go online.
- If the layer 2 static user is an IPv4/IPv6 dual stack user, you must configure an IPv4 address, an IPv6 address, and an IPv6 gateway address, and the numbers of IPv4 and IPv6 addresses must be the same. The other parameters can be specified or not. If you want to configure IPv6 delegation prefixes, the numbers of IPv6 delegation prefixes, IPv4 addresses, and IPv6 addresses must be the same. The interfaces bound to the static IPv4/IPv6 dual-stack users who go online through ARP/NS message sending on the device can be Layer 2 private line interfaces or Layer 2 interfaces. If Layer 2 private line interfaces are bound to such users, IPv6 users cannot go online. If other types of interfaces are bound to such users, dual-stack IPv4/IPv6 users cannot go online.
- If keep-online is configured and the layer 2 static user goes online, the NetEngine 8000 F retains the online status of the layer 2 static user even if user detection fails.
- If the detect parameter is set, the mac-address parameter must be set, the static user's IPv4 address must be within the address range of the address pool, and this IPv4 address must be excluded from the automatic address assignment list using the excluded-ip-address command.
- Unnumbered routing mode is not supported for static IPv6 users.
- One-to-many mapping between one MAC address and multiple sessions is not supported for Layer 2 static IPv6 users. A static IPv6 user and a DHCPv6 user with the same MAC address cannot be online at the same time.
In VS mode, this command is supported only by the admin VS.
Example
<HUAWEI> system-view [~HUAWEI] interface GigabitEthernet 0/1/1 [*HUAWEI-GigabitEthernet0/1/1] commit [~HUAWEI-GigabitEthernet0/1/1] bas [~HUAWEI-GigabitEthernet0/1/1-bas] quit [~HUAWEI-GigabitEthernet0/1/1] quit [~HUAWEI] ip pool pool1 bas local [~HUAWEI-ip-pool-pool1] gateway 172.16.0.1 255.255.255.0 [~HUAWEI-ip-pool-pool1] section 0 172.16.0.2 172.16.0.200 [~HUAWEI-ip-pool-pool1] quit [~HUAWEI] static-user 172.16.0.8 interface GigabitEthernet 0/1/1 mac-address 00e0-fc12-3456