Web Configuration

Maipu Communication Technology Co., Ltd

No. 16, Jiuxing Avenue
Hi-tech Park
Chengdu, Sichuan Province
People’s Republic of China - 610041
Tel: (86) 28-85148850, 85148041
Fax: (86) 28-85148948, 85148139
URL: http:// www.maipu.com
Email: overseas@maipu.com

Maipu Confidential & Proprietary Information Page 1 of 133

Web Configuration

All rights reserved. Printed in the People’s Republic of China.

No part of this document may be reproduced, transmitted, transcribed, stored in a retrieval system, or translated into any
language or computer language, in any form or by any means, electronic, mechanical, magnetic, optical, chemical, manual
or otherwise without the prior written consent of Maipu Communication Technology Co., Ltd.

Maipu makes no representations or warranties with respect to this document contents and specifically disclaims any implied
warranties of merchantability or fitness for any specific purpose. Further, Maipu reserves the right to revise this document
and to make changes from time to time in its content without being obligated to notify any person of such revisions or
changes.

Maipu values and appreciates comments you may have concerning our products or this document. Please address comments
to:

Maipu Communication Technology Co., Ltd

No. 16, Jiuxing Avenue
Hi-tech Park
Chengdu, Sichuan Province
People’s Republic of China - 610041
Tel: (86) 28-85148850, 85148041
Fax: (86) 28-85148948, 85148139
URL: http:// www.maipu.com
Email: overseas@maipu.com

All other products or services mentioned herein may be registered trademarks, trademarks, or service marks of their
respective manufacturers, companies, or organizations.

Maipu Confidential & Proprietary Information Page 2 of 133

Web Configuration

Maipu Feedback Form

Your opinion helps us improve the quality of our product documentation
and offer better services. Please fax your comments and suggestions to
(86) 28-85148948, 85148139 or email to overseas@maipu.com.

Document Web CONFIGURATION

Title
Product Document 1.0
Version Revision
Number
Evaluate Presentation:
this (Introductions, procedures, illustrations, completeness, arrangement, appearance)
document … Good … Fair … Average … Poor

Accessibility:
(Contents, index, headings, numbering)
… Good … Fair … Average … Poor
Editorial:
(Language, vocabulary, readability, clarity, technical accuracy, content)
… Good … Fair … Average … Poor
Your Please check suggestions to improve this document:
suggestions … Improve introduction … Make more concise
to improve
… Improve Contents … Add more step-by-step
the
procedures/tutorials
document
… Improve arrangement … Add more technical information
… Include images … Make it less technical
… Add more detail … Improve index

If you wish to be contacted, complete the following:

Name Company
Postcode Address
Telephone E-mail

Maipu Confidential & Proprietary Information Page 3 of 133

Web Configuration

Contents

Web Configuration .....................................................................................7

Preparations...........................................................................................................7
Login ......................................................................................................................................7

Product Information................................................................................................9
Features .................................................................................................................................9
System Version Information ..................................................................................................11

Switch Port Configuration ...................................................................................... 12

Basic Attribute Configuration..................................................................................................12
Port Type Configuration .........................................................................................................14
Port Storm Control ................................................................................................................15
Link Aggregation Configuration ..............................................................................................16
Port Monitoring Configuration.................................................................................................20
Port Monitoring Statistics .......................................................................................................23
802.1X Authentication Configuration ......................................................................................25
IP Source Guard Configuration...............................................................................................28
Port Security Configuration ....................................................................................................29
IP Binding Configuration ........................................................................................................31
IP Rule Configuration.............................................................................................................32
MAC Rule Configuration .........................................................................................................33
Global Parameter Configuration..............................................................................................35
MAC Address Management ....................................................................................................36
MAC Searching......................................................................................................................39
MAC Address Learning...........................................................................................................40
ARP Management..................................................................................................................43
ARP Binding ..........................................................................................................................44

VLAN Configuration............................................................................................... 45
Port Mode .............................................................................................................................45
Basic Configuration................................................................................................................46
MAC-VLAN Configuration .......................................................................................................48
IP Subnet VLAN Configuration................................................................................................49
Protocol VLAN Configuration ..................................................................................................50
Q-in-Q (Vlan dot1q tunnel) Configuration ...............................................................................52
L2 Protocol Control Configuration ...........................................................................................54

ACL Configuration................................................................................................. 56
Configure IP Standard Access List ..........................................................................................57

Maipu Confidential & Proprietary Information Page 4 of 133

Web Configuration

Configure IP Extended Access List ..........................................................................................59

Configure MAC Standard Access List.......................................................................................61
Configure MAC Extended Access List ......................................................................................63
Configure Time Range ...........................................................................................................65
Configure Action Group..........................................................................................................67
Apply ACL to Object...............................................................................................................75
Configure Meter ....................................................................................................................76

QoS Configuration ................................................................................................ 77

Priority Mapping ....................................................................................................................78
Queue Scheduling Mode ........................................................................................................81
Drop Mode............................................................................................................................84
Rate Limitation......................................................................................................................87
Port Flow Shaping .................................................................................................................89
Port Queue Flow Shaping.......................................................................................................91
Flow Statistics .......................................................................................................................93

OAM Configuration................................................................................................ 95
CFM Configuration.................................................................................................................95
Port Configuration .................................................................................................................99
OAM Basic Configurations ....................................................................................................100
OAM Status Display.............................................................................................................108
OAM Remote Loopback Test ................................................................................................110
ELMI Configuration ..............................................................................................................112
EVC-UNI Configuration ........................................................................................................114
EVC ....................................................................................................................................116

Anti-Attack Detection Configuration...................................................................... 118

Overview ............................................................................................................................118
Urpf Attack Detection ..........................................................................................................118
Attack Detection..................................................................................................................119
Scan Detection....................................................................................................................125

Static Route Configuration ................................................................................... 126

Overview ............................................................................................................................126
Introduction to Static Route .................................................................................................126
Configure Static Route.........................................................................................................127

DNS Configuration .............................................................................................. 127

Overview ............................................................................................................................127
DNS Server Configuration....................................................................................................128

System Management .......................................................................................... 128

Overview ............................................................................................................................128
Basic Information Configuration ...........................................................................................128
Administrator Configuration .................................................................................................130
Device Software Upgrade ....................................................................................................131
Configuration File Management............................................................................................132

Maipu Confidential & Proprietary Information Page 5 of 133

Web Configuration

Log Management ................................................................................................................132

Save Configuration ............................................................................................. 133

Overview ............................................................................................................................133

Maipu Confidential & Proprietary Information Page 6 of 133

Web Configuration

Web Configuration

Convention

Maipu switch in the manual refers to MyPower S3400, MyPower S3900,

and MyPower S4100 switch. Here, the configurations of MyPower S3400
and MyPower S4100 are the same, so if there is no special illustration, the
configuration of MyPower S4100 is also suitable for MyPower S3400.

Preparations
This section describes the preparations for the WEB configuration of Maipu
switch.

Note

The browser that supports the web configuration described in the chapter
is Internet Explorer7.0 or above.

Login
The web management system of the device supports two kinds of users,
including administrator and common users. Maipu switch described in the
manual does not have default user name or password, so you need to
telnet to the device and configure login user in shell so that the web
management system can be used normally. The following are the shell
commands for configuring users.

Configure administrator:

switch#configure terminal // enter into the configuration mode

switch (config)#user admin privilege 15 password 0 admin //

configure the administrator with user name as admin, priority as 15, and
password as admin. 15 is the highest priority.

Configure common users:

Maipu Confidential & Proprietary Information Page 7 of 133

Web Configuration

switch#configure terminal // enter into the configuration mode

switch (config)#user guest privilege 0 password 0 guest // configure the

user with user name as guest, priority as 0, and password as guest. 0 is
the lowest priority.

The administrator and common user correspond to different management

authorities.

The administrator authorities include switch port configuration, VLAN

configuration, ACL configuration, QoS configuration, OAM configuration,
anti-attack detection configuration, DNS configuration, system
management, and save configuration.

The corresponding function navigation is as follows:

The authorities of the common user include switch port configuration,

VLAN configuration, anti-attack detection configuration, DNS configuration,
system management, and save configuration.

The corresponding function navigation is as follows:

Maipu Confidential & Proprietary Information Page 8 of 133

Web Configuration

Product Information
The section describes the features and version information of Maipu switch.

Features
Maipu switch provides carrier-class Ethernet access switches for carriers’
customers. It supports next generation L2 and L3 features and meets the
requirements of customers for QoS, OAM, VPN, Multi-service and
Protection. It can help customers develop IPTV, VoIP, VPN, wireless access
and TDMoIP services. The high integrated platform design meets the
requirement of the customer that a box provides rich physical interface
and software features to reduce the total cost (TCO) and operating
expenses (OpEx).

It is the first in the world to adopt dual power supply, high integrated
E1/T1 interface, standard PoE, and optical-electric Ethernet access on the
access device. The operators adopt it to be deployed in 2G/3G base station
for developing multi-service access (wireless, VPN, and mobile) and
completing the reconstruction from TDM to IP.

Maipu switch has the following features:

z Multi-service Ethernet switch with highest integrity

z First to support dual power supply on access-level Ethernet device

z Supports perfect OAM protocol

Maipu Confidential & Proprietary Information Page 9 of 133

Web Configuration

z Supports VPN services defined by MEF

z 50ms Ethernet service protection

z Supports QinQ and selective QinQ

z Supports UDLD and improves operation and maintenance capabilities

z Supports rich L2 and L3 protocols

z Supports PoE and TDMoIP

You can view via , as follows:

Note

The following figure is the product information interface of S3900.

Note

The following figure is the product information interface of S4100

Maipu Confidential & Proprietary Information Page 10 of

133
Web Configuration

System Version Information

You can view the current system version information via

, as follows:

Note

The following is the version information of S3900.

Note

The following is the version information of S4100.

Maipu Confidential & Proprietary Information Page 11 of

133
Web Configuration

Switch Port Configuration

Basic Attribute Configuration
This section describes the configuration information of the port.

Port: The numbers of all ports in the switch;

Description: The port description information for easy memory. You can
configure the description information for one port. For example, one port
is distributed to Company A and you can configure the description
information as “company A”. The description information comprises up to
240 characters and there can be blanks between the characters. By
default, the port does not have description information;

Status: Port status. When the value is enabled, it indicates that the port
is enabled; when the value is disabled, it indicates that the port is disabled
and cannot enter into the normal working state. The default value is
enabled.

Link: The physical status of the port. By default, after the port is
connected, the light is on and the link status is UP; when the port is not
connected, the link status is down.

Set speed: The management speed of the port, including “10”, “100”,
“1000”, “10000”,and “auto”. Unit is M. “auto” means “auto-negotiation”;

Maipu Confidential & Proprietary Information Page 12 of

133
Web Configuration

Act speed: The actual speed of the port, including “10”, “100”, “1000”,
“10000”, and “auto”. Unit is M. “auto” means “auto-negotiation”;

Set duplex: The management duplex status of the port, including “auto”,
“full”, and “half”. “auto” means “auto-negotiation”; “full” means “full-
duplex”; “half” means “half-duplex”;

Act duplex: The actual duplex status of the port, including “auto”, “full”,
and “half”. “auto” means “auto-negotiation”; “full” means “full-duplex”;
“half” means “half-duplex”;

Set flow control: The management flow control of the port. “on” means
to enable the port flow control; “off” means to disable the port flow control;

Act flow control: The actual flow control of the port. “on” means to
enable the port flow control; “off” means to disable the port flow control.

Mdix: The signal sending mode of the port. “normal” means that lines 1
and 2 are used for sending and line 3 and 6 are used for receiving; “cross”
means that lines 1 and 2 are used for receiving and lines 3 and 6 are used
for sending; “auto” means to select normal or cross automatically.

Port Mode: The port mode, including lan and wan.

Mtu: The MTU of the port. MTU is checked when inputting and outputting
packets. The MTU is not checked when being output. If the length of the
frame received by the port exceeds the set MTU, the frame is discarded.
The unit is byte. It is required the configured value must be multiples of
four bytes. Otherwise, it is cut down to the multiples of four. For example,
the configured value is 1501 bytes, the system adjusts it to be 1500 bytes.
The default value is 1824.

Link delay: The status delay time of the port. The default value is 0.

Pvid: The ID of the VLAN to which the port belongs. The default value is 1.

Edit: Click the icon of one port and you can configure the port.

Maipu Confidential & Proprietary Information Page 13 of

133
Web Configuration

Tick the check box before the port number, click batch edit and you can
edit the ports in batches.

Port Type Configuration

This section describes the configuration information about the port type.

Port: The numbers of all ports in the switch, including the aggregation
port number;

Port type: The UNI/NNI attribute of the port. Each physical port of the
switch has UNI/NNI attribute. By default, all 10M/100M ports are set as
UNI ports and other ports are set as NNI ports. You can also modify the
UNI/NNI attribute of each port via configuration.

Communication with other UNI port: By default, the UNI port is

shutdown and the UNI ports cannot communicate with each other, but UNI
and NNI ports can communicate with each other; NNI ports can also
communicate with each other. You can make some UNI ports can
communicate with each other via configuration. “yes” means that the port
can communicate with other UNI port; “no” means that the port cannot
communicate with other UNI port.

Maipu Confidential & Proprietary Information Page 14 of

133
Web Configuration

Edit: Click the icon of one port and you can configure the port. Click
recover to recover the port to the factory status.

Tick the check box before the port number, click batch edit and you can
edit the ports in batches.

Refresh: Refresh the interface.

Port Storm Control

This section describes the configuration information about the port storm
control.

Port: The numbers of all ports in the switch;

Unicast: The unknown unicast storm information of the port. “disabled”

means that no unknown unicast storm information is configured; “bps”
means to configure the storm control for bps (bits per second); “pps”
means to configure the storm control for pps(packets per second). The
default value is “disabled”.

Threshold(kbps): The unknown unicast storm threshold of the port. The

unit of pps is pps and the value range is 0-1000000; the unit of bps is
kbps, the granularity is 64kbps, and the value range is 64-8000000, that
is, 64kbps to 8G; the range of the percentage is 1-100.

Maipu Confidential & Proprietary Information Page 15 of

133
Web Configuration

Broadcast: The broadcast storm information of the port. “disabled”

means that no broadcast storm information is configured; “bps” means to
configure the storm control for bps (bits per second); “pps” means to
configure the storm control for pps(packets per second). The default value
is “disabled”.

Threshold(kbps): The broadcast storm threshold of the port. The unit of

pps is pps and the value range is 0-1000000; the unit of bps is kbps, the
granularity is 64kbps, and the value range is 64-8000000, that is, 64kbps
to 8G; the range of the percentage is 1-100.

Multicast: The unknown multicast storm information of the port;

“disabled” means that no unknown multicast storm information is
configured; “bps” means to configure the storm control for bps (bits per
second); “pps” means to configure the storm control for pps(packets per
second). The default value is “disabled”.

Threshold(kbps): The unknown multicast storm threshold of the port.

The unit of pps is pps and the value range is 0-1000000; the unit of bps is
kbps, the granularity is 64kbps, and the value range is 64-8000000, that
is, 64kbps to 8G; the range of the percentage is 1-100.

Action Over Threshold: The action executed after storm suppression.

“shutdown” means to shut down the port; “trap” means to send TRAP
alarms; “none” means no storm control action. The default value is “none”.

Edit: Click the icon of one port and you can configure the port.

Tick the check box before the port number, click batch edit and you can
edit the ports in batches.

Refresh: Refresh the interface.

Link Aggregation Configuration

This section describes the configuration information about the link
aggregation.

Maipu Confidential & Proprietary Information Page 16 of

133
Web Configuration

Link Aggregation: The name of the link aggregation group;

Description: The description information of the link aggregation group;

Mode: The aggregation mode of the link aggregation. “manual” means the
manual aggregation mode; “lacp” means the protocol aggregation mode.

Load balance method: The load balance algorithm of the link

aggregation. “dst-ip” means the load balance algorithm based on
destination IP address; “dst-mac” means the load balance algorithm based
on destination MAC address; “src-dst-ip” means the load balance
algorithm based on source and destination IP address; “src-dst-mac”
means the load balance algorithm based on source and destination MAC
address; “src-ip” means the load balance algorithm based on source IP
address; “src-mac” means the load balance algorithm based on source
MAC address; The default value is src-mac.

Number of ports in total: The total number of ports in the aggregation

group;

Number of ports attached: The number of the ports that are

aggregated in the aggregation group;

Root port: The root port of the aggregation group;

Member port numbers: The numbers of the member ports in the

aggregation group;

Edit: Click the icon of one aggregation group and you can configure
the aggregation group. Click the icon of one aggregation group and you
can delete the aggregation group.

Add: Click Add and you can create one new link aggregation group;

Note

The following is the new aggregation port of S3900.

Maipu Confidential & Proprietary Information Page 17 of

133
Web Configuration

Note

The following is the new aggregation port of S4100.

Click the icon of one aggregation group to edit it.

Note

The following is the interface of editing the aggregation port of S3900.

Maipu Confidential & Proprietary Information Page 18 of

133
Web Configuration

Note

The following is the interface of editing the aggregation port of S4100.

Note

For example, in aggregation group 1, the member port is 0/0/0. When

clicking Edit, the check box before port 0/0/0 in the member port list is
selected. When the aggregation mode is manual, the port types of the
member ports can only be manual; when the aggregation mode is lacp,
the port types of the member ports are active and passive.

When clicking the icon of one aggregation group to delete the

aggregation group, click Yes to delete the record or click Cancel and the
aggregation group is not deleted.

batch delete: Click batch delete and you can delete the aggregation
groups in batches.

Refresh: Refresh the interface.

Maipu Confidential & Proprietary Information Page 19 of

133
Web Configuration

Note

To delete the link aggregations in batches, you should first tick the check
boxes before the aggregation groups. When the prompt box appears, click
Yes to delete the selected records or click Cancel and the selected
records are not deleted.

Port Monitoring Configuration

This section describes the configuration information about the port
monitoring.

Port: The number of the port configured with port monitoring in the
switch;

Enable port monitor: Whether to enable the port-level monitoring.

“Enabled” means to enable the port-level monitoring; “Disabled” means to
disable the port-level monitoring. The default value is Disabled;

Enable TCP connection restriction function: whether to enable the

TCP connection restriction function; “Enable” means to enable the TCP
connection restriction function; “Disable” means to disable the TCP
connection restriction function;

Enable Host Monitor: Whether to enable host-level monitoring.

“Enabled/IP” means to monitor by source IP; “Enabled/MAC” means to
monitor by source MAC; “Disabled” means not to monitor. The default
value is Disabled.

Host Limit: The maximum number of the hosts that are monitored;

Broadcast port: The broadcast packets of the port monitoring;

Multicast packet: The multicast packets of the port monitoring;

Admin packet: The administration packets of the port monitoring;

Forward packet: The forwarded packets of the port monitoring;

Other packet: The other packets of the port monitoring;

Total packet: All packets of the port monitoring;

Maipu Confidential & Proprietary Information Page 20 of

133
Web Configuration

Add: Click Add and you can perform the adding operation;

Note

Tick the check boxes in the port list and you can add port monitoring in
batches. For example, after selecting ports 0/0, 0/1, and 0/2, click set and
then the ports 0/0, 0/1, and 0/2 are configured with port monitoring.
When adding new port monitoring, the details of monitor protocol ether,
monitor protocol ip and monitor protocol tcp/udp are unavailable.

Edit: Click the icon of one port and you can configure the port. Click
the icon of one port and you can delete the port.

Click the icon of one port to edit it.

Batch edit: Click batch edit and you can edit the ports in batches.

Maipu Confidential & Proprietary Information Page 21 of

133
Web Configuration

As shown in the above figure, the selected ports are displayed in the
selected form in the lower port list.

Note

After clicking the edit icon, you can set the parameters of the port
monitoring. The host monitoring can be enabled only after the port
monitoring is enabled and you should select Monitor by source IP or
Monitor by source MAC. You can view the details by clicking the detail
button of monitor protocol ether, monitor protocol ip and monitor
protocol tcp/udp.

Maipu Confidential & Proprietary Information Page 22 of

133
Web Configuration

After clicking the delete all button of monitor protocol ether, monitor
protocol ip and monitor protocol tcp/udp, a confirming box appears
and click Yes to delete all information or click Cancel. Click and you can
delete the single monitoring information.

After deleting, the result is as follows:

Batch delete: Click batch delete and you can delete the port monitoring
in batches.

Refresh: Refresh the interface.

Port Monitoring Statistics

This section describes the statistics information about the port monitoring.

Port Packets: You can select administration packets, broadcast packets,

forwarding packets, multicast packets, other packets or all packets from
the Stat Type drop-down list. After selecting one, click Search and the
details about the select packet type are displayed as follows.

Maipu Confidential & Proprietary Information Page 23 of

133
Web Configuration

Port: the number of the port on which the port monitoring is enabled;

Received Packets Number: the number of the packets received by the

port;

Dropped Packet Number: the number of the packets dropped by the

port;

Amount: The total number of the packets received by the port;

Drop Amount: The total number of the packets dropped by the port;

Port Host Information: the numbers of all physical ports in the switch.
You can select administration packets, broadcast packets, forwarding
packets, multicast packets, other packets or all packets from the drop-
down list. After selecting one, click Search and the details about the
select packet type are displayed as follows.

Host Address: The address of the host in each host;

Backlist or not: Whether the host is in the backlist;

Limit: The maximum limitation of the host;

Received Packets Number: the number of the packets received by the

host;

Dropped Packet Number: the number of the packets dropped by the

host;

Amount: The total number of the packets received by the host;

Drop Amount: The total number of the packets dropped by the host;

Backlist Information: Display the backlist to view the hosts that initiate
the attack; If based on IP, the host address is IP address; if based on MAC,
the host address is the MAC address;

Maipu Confidential & Proprietary Information Page 24 of

133
Web Configuration

802.1X Authentication Configuration

This section describes the configuration information of the port 802.1X
authentication.

Port: The number of the port configured with 802.1X authentication;

Enable 802.1X Configuration: “enable” means to enable 8021X;

“disable” means to disable 8021X. The default value is disable;

Max User Number: the maximum number of users of the port. The
default value is 256;

Current user: The number of the current users of the port;

EAPOL packet transmission: the EAPOL packet transparent

transmission function of the port; “enable” means to enable the EAPOL
packet transparent transmission; “disable” means to disable the EAPOL
packet transparent transmission. The default value is disable.

Uplink port: the uplink port during EAPOL packet transparent

transmission;

Port multicast trigger: the function of triggering multicast on the port;

“enable” means to enable the function of triggering multicast on the port;
“disable” means to disable the function of triggering multicast on the port.
The default value is disable.

Guest Vlan: the guest vlan of the port;

EAP relay: the EAP mode of the port, including EAP relay or EAP
termination. “enable” means to enable the EAP relay mode; “disable”
means to disable the EAP relay mode (enable the EAP termination mode).
The default value is disable;

Reauthperiod: the re-authentication time of the port (second). When the

re-authentication is enabled on the port, the re-authentication is
performed during the period. The default value is 600. By default, the re-
authentication function is enabled on the port.

Timeout Quiet Period: the punishment time of the port (second). When
the successive failed authentication times of one reaches the upper
threshold, the user cannot perform authentication during the punishment
time. The default value is 60.

Maipu Confidential & Proprietary Information Page 25 of

133
Web Configuration

Max Authentication Failure Times: the maximum authentication failure

times of the port. When the authentication failure times of one user
reaches the upper threshold, the user can re-authenticate only after a
certain time. The default value is one.

Server Timeout: The server timeout of the port; by default, it is 30s;

Supptimeout: The client timeout of the port; by default, it is 30s;

Port Authentication Mode: the 802.1X authentication mode of the port,

including port-based authentication mode or user-based authentication
mode. “portbased” means the authentication mode based on the port;
“macbased” means the authentication mode based on the user. The
default value is macbased.

Host Mode: The option takes effect in the port-based authentication

mode, including single-host and multi-hosts; by default, it is multi-hosts;

Add: Click add and you can perform the adding operation.

 Note

The following is the interface of adding 802.1X configuration of S4100.

 Note

The following is the interface of adding 802.1X configuration of S3900.

Maipu Confidential & Proprietary Information Page 26 of

133
Web Configuration

Note

You can select multiple check boxes in the port list to perform batch
operation.

Edit: Click of one port and you can edit the port. Click recover to
recover the port to the factory status.

 Note

The following is the interface of editing the 802.1X configuration of S3900.

 Note

The following is the interface of editing the 802.1X configuration of S4100.

Maipu Confidential & Proprietary Information Page 27 of

133
Web Configuration

Note

For the port-based authentication mode, the maximum user number of the
port does not take effect; for the user-based authentication mode, the
configuration of guest vlan does not take effect.

Refresh: Refresh the interface.

IP Source Guard Configuration

This section describes the configuration information about IP Source Guard.

Port: The number of the port configured with IP Source Guard (including
aggregation port number);

Enable IP Source Guard: “enabled” means to enable the IP Source

Guard function one the port;

Filtrate: “IP+MAC” means to enable the IP Source Guard function by the

IP+MAC filtering mode; “IP” means to enable the IP Source Guard function
by the IP filtering mode;

Add: Click add and you can perform the adding operation. The filter mode
can be selected only when ISG is enabled.

Maipu Confidential & Proprietary Information Page 28 of

133
Web Configuration

Edit: Click of one port and you can edit the port.

Refresh: Refresh the interface.

Port Security Configuration

This section describes the configuration information about the port security.

Port: The number of the port configured with the port security (including
the aggregation port number);

Enable port security: the port security function. “Enabled” means to

enable the port security; “Disabled” means to disable the port security.
The default value is Disabled.

Port MAX Rule: the MAX rule of the port. The default value is 0;

Violation Mode: Used to decide the processing for receiving the error
packets;

Aging Time of MAC Address: the address aging time of the port (min);
the default value is 1;

Enabling Aging Function of Static Address of Port: It is the aging

function of the static address of the port; “TRUE” means to enable the
aging function of the static address of the port; “FALSE” means to disable
the aging time of the static address of the port. The default value is FALSE;

Edit: Click the icon of one port and you can edit the port. Click the
icon of one port and you can delete the port.

Add: Click add and you can perform the adding operation.

Maipu Confidential & Proprietary Information Page 29 of

133
Web Configuration

Note

You can tick multiple check boxes in the port list to perform the batch
operation.

Click the icon of one port and you can edit the port.

Click the icon of one port and you can delete the port.

You can tick the check boxes before the port numbers in the port list to
perform the batch operation.

Delete Specified MAC of Port: Tick the check boxes in the port list and
you can delete the specified MAC addresses of ports in batches;

Note

When type of mac address is all, it means to delete all MAC addresses;
when type of mac address is configured, it means to delete all MAC
address except for MAX rules; when type of mac address is learned, it
means to delete the MAC addresses learned by MAX rules.

Refresh: Refresh the interface.

Maipu Confidential & Proprietary Information Page 30 of

133
Web Configuration

IP Binding Configuration
This section describes the configuration information about the IP binding.

Port: The number of the port configured with IP binding (including the
aggregation port)

MAC Address: MAC address;

IpAddress: IP address

VLAN: VLAN ID;

Type Flag: dynamic binding or static binding;

Writing Flag: whether write into the hardware;

Edit: You can click of one port to delete it.

Note

One port can be bound for several times, so the interface adopts the
paging function for users to view. The interface can be paged as desired
by adjusting the text box before change page size. For example, the
interface has three pieces of information. If the user inputs one and then
clicks change page size, the interface is displayed by three pages. If the
user does not input, but clicks change page size directly, the interface is
paged by the default 20, as follows.

Add: Click add and you can perform the adding operation.

Maipu Confidential & Proprietary Information Page 31 of

133
Web Configuration

You can click of one port to delete it.

Batch delete: Tick the check boxes in the port list, click batch delete
and you can perform the batch operation.

delete by port: click delete by port and you can delete all binding
information on the port.

Refresh: Refresh the interface.

IP Rule Configuration
This section describes the configuration information about the IP rule.

Port: the number of the port configured with IP rule (including the
aggregation port);

Action: the executed action of the rule. “permit” means that the executed
action of the rule is permit; “deny” means that the executed action of the
rule is deny.

Startip: The start IP address of the rule application;

endIp: The end IP address of the rule application; if the parameter is not
specified, it is equivalent to add one single IP;

Rule: The IP rule;

Edit: You can click of one port to delete it.

Note

One port can be bound for several times, so the interface adopts the
paging function for users to view. The interface can be paged as desired
by adjusting the text box before change page size. For example, the
interface has three pieces of information. If the user inputs one and then
clicks change page size, the interface is displayed by three pages. If the

Maipu Confidential & Proprietary Information Page 32 of

133
Web Configuration

user does not input, but clicks change page size directly, the interface is
paged by the default 20, as follows.

Add: Click add and you can perform the adding operation.

Note

Tick the check boxes in the port list and you can perform the batch
operation. End IP must be larger than Start IP. If End IP is not input, it is
equivalent to add one single IP.

Batch delete: Tick the check boxes in the port list, click batch delete
and you can perform the batch operation.

Refresh: Refresh the interface.

MAC Rule Configuration

This section describes the configuration information about the MAC rule.

Port: the number of the port configured with MAC rule (including the
aggregation port);

Maipu Confidential & Proprietary Information Page 33 of

133
Web Configuration

Action: the executed action of the rule. “permit” means that the executed
action of the rule is permit; “deny” means that the executed action of the
rule is deny.

MAC Address: the MAC address of the rule application;

VLAN-ID: the ID of the VLAN bound to the MAC address;

IP Address: the IP address;

Rule: “MAC+VID” means the MAC+VLAN binding rule; “MAC+IP” means

the MAC+IP binding rule; “MAC” means the MAC binding rule;

Edit: You can click of one port to delete it.

Note

One port can be bound for several times, so the interface adopts the
paging function for users to view. The interface can be paged as desired
by adjusting the text box before change page size. For example, the
interface has three pieces of information. If the user inputs one and then
clicks change page size, the interface is displayed by three pages. If the
user does not input, but clicks change page size directly, the interface is
paged by the default 20, as follows.

Add: Click add and you can perform the adding operation.

Note

Tick the check boxes in the port list and you can perform the batch
operation.

Maipu Confidential & Proprietary Information Page 34 of

133
Web Configuration

Batch delete: Tick the check boxes in the port list, click batch delete
and you can perform the batch operation.

Refresh: Refresh the interface.

Global Parameter Configuration

This section describes the configuration information about the global
parameters.

 Note

The following is the global parameter configuration of S4100.

 Note

The following is the global parameter configuration of S3900.

Sampling period: the sampling period of the port monitoring (second).

After the port monitoring is enabled, the port monitoring function is used
to measure the packets to CPU in each period. The default value is 30s.

Host-inactive-times: the host aging time of the port monitoring (the unit
is the sampling period). The default value is 5s.

MAC Address Learning quantity: The number of the MAC addresses

learned by the system; by default, it is 32767.

MacAddress aging-time: The aging time of the dynamic MAC address.

The default value is 300s. Ticking the check box means to configure the

Maipu Confidential & Proprietary Information Page 35 of

133
Web Configuration

dynamic MAC address; no ticking the check box means to disable the
aging function;

SNMP switch: Ticking the check box means to enable snmp-server; not
ticking the check box means to disable the snmp-server;

Port Monitors TRAP Sending Switch (add options of backlist):

snmp-server must be enabled for enabling the port monitoring TRAP
sending switch;

Permit Host with TCP Connection: The list of the hosts that are
permitted to set up TCP connection with the switch; the displayed
information is the IP addresses of the hosts;

Add: Click Add and you can add the host that permits setting up the TCP
connection;

Note

One port can be bound for several times, so the interface adopts the
paging function for users to view. The interface can be paged as desired
by adjusting the text box before change page size. For example, the
interface has three pieces of information. If the user input one and then
click change page size, the interface is displayed by three pages. If the
user does not input, but clicks change page size directly, the interface is
paged by the default 20, as follows.

Batch delete: Tick the check boxes in the port list, click batch delete
and you can perform the batch operation.

Refresh: Refresh the interface.

MAC Address Management

This section describes the information about the MAC address
management.

Maipu Confidential & Proprietary Information Page 36 of

133
Web Configuration

MAC Address Type: The options in the drop-down list are dynamic, static,
drop, and all (without drop);

If static is selected, the displayed information is as follows:

If dynamic is selected, the displayed information is as follows:

If drop is selected, the displayed information is as follows:

If all (without drop) is selected, the displayed information is as follows:

Maipu Confidential & Proprietary Information Page 37 of

133
Web Configuration

Note

There are a lot of MAC addresses, so the interface adopts the paging
function for users to view. The interface can be paged as desired by
adjusting the text box before change page size. For example, the
interface has three pieces of information. If the user inputs one and then
clicks change page size, the interface is displayed by three pages. If the
user does not input, but clicks change page size directly, the interface is
paged by the default 20, as follows.

Edit: You can click of one port to delete it.

Add: Click Add and you can add a new MAC address. The MAC address
type includes static and drop.

Maipu Confidential & Proprietary Information Page 38 of

133
Web Configuration

Delete dynamic mac-address: You can choose to delete the dynamic

MAC by VLAN, port, and the combination of VLAN and port.

Refresh: Refresh the interface.

MAC Searching
This section describes the information about the MAC address.

MAC Address Type: DYNAMIC means dynamic MAC address; DROP means
to filter MAC address; STATIC means the static MAC address;

After inputting the MAC address, click Search, as follows.

With the fuzzy search function, after inputting a part of MAC address, click
Search, as follows.

Maipu Confidential & Proprietary Information Page 39 of

133
Web Configuration

When the user does not input MAC address, click Search and all MAC
addresses are displayed.

Refresh: Refresh the interface.

MAC Address Learning

This section describes the configuration information about MAC address
learning of the port and VLAN.

 Note

The following is the MAC address learning configuration of S3900.

Maipu Confidential & Proprietary Information Page 40 of

133
Web Configuration

 Note

The following is the MAC address learning configuration of S4100.

Port: the number of the port configured with MAC address learning
(including the aggregation port);

MAC Learning: Whether to enable the MAC address learning function on

the port;

MAC Address Learning Account: The maximum number of MAC

addresses learned by the port. By default, the number of the MAC
addresses learned by the port is not limited, that is, set the maximum
number of learned MAC addresses supported by hardware.

Maipu Confidential & Proprietary Information Page 41 of

133
Web Configuration

VLAN: the VLAN configured with MAC address learning

 Caution

When the MAC address learning function is not enabled on the port,
modifying the number of learned MAC addresses does not take effect.

In the MAC learning configuration based on port, Click of one port and
you can edit it.

 Note

The following is the interface of editing the MAC address learning of S3900.

Batch edit: Click batch edit and you can perform the batch editing
operation;

 Note

The following is the interface of editing the MAC address learning of S3900.

On the VLAN-based MAC Address Learning interface, click Add, as

follows:

 Note

The following is the interface of the MAC address learning of S3900.

Maipu Confidential & Proprietary Information Page 42 of

133
Web Configuration

Click and you can edit the corresponding port.

 Note

The following is the interface of the MAC address learning of S3900.

Click and you can delete the corresponding port; click Batch delete
and you can delete in batches.

Refresh: Refresh the interface.

ARP Management
This section describes the ARP information.

Note

There is lots of ARP to be displayed, so the interface adopts the paging

function for users to view. The interface can be paged as desired by
adjusting the text box before change page size. For example, the
interface has three pieces of information. If the user inputs one and then
clicks change page size, the interface is displayed by three pages. If the
user does not input, but clicks change page size directly, the interface is
paged by the default 20, as follows.

Maipu Confidential & Proprietary Information Page 43 of

133
Web Configuration

Search Mac by Ip: Input IP address in the text box before the search
button, click search and then you can find the corresponding MAC
addresses; When no matching item is found, it is displayed as not found.

Search Ip by Mac: Input MAC address in the text box before the search
button, click search and then you can find the corresponding IP addresses.
When no matching item is found, it is displayed as not found.

Refresh: Refresh the interface.

ARP Binding
This section describes the information about the ARP binding.

Advertise: Correspond to the arp advertise command in ARP binding.

After the user delivers the command, the check box before advertise
becomes selected.

Interval: Correspond to the arp advertise interval command in ARP

binding; the value range is 20-60000;

Limited: Correspond to the arp limited command in ARP binding; the

value range is 2000-100000; the default value is 2000;

Click Add:

Maipu Confidential & Proprietary Information Page 44 of

133
Web Configuration

Vrf: In the drop-down list, all configured vrf in the device is displayed; if
no configured vrf, it is displayed as “--”.

IP Address: The bound IP address of ARP;

MAC Address: The bound MAC address of ARP;

Alias: In the drop-down list, “--” and “alias” are displayed. If alias is
selected, alias is displayed in the alias list after configuring successfully, as
shown in the above figure;

Click the icon and you can perform the deleting operation; click batch
delete and you can perform the batch deleting operation;

Click refresh and you can refresh the interface.

Note

In the chapter, all physical ports in the port list are displayed in the form
of a/b/c; the aggregation ports are displayed as 1, 2, 3…64.

VLAN Configuration
This section describes the VLAN configuration of Maipu switch.

Port Mode
This section describes the configuration of the port mode.

Default VLAN (PVID) of Port

The packets without tag received by the port are divided to the default
value. The default VLAN of the port is 1. The user can configure the default
VLAN of the port as desired.

The default VLAN of the access port is the one to which it belongs, which
cannot be configured.

Maipu Confidential & Proprietary Information Page 45 of

133
Web Configuration

Trunk port can Hybrid port can belong to several VLANs. The default VLAN
can be configured.

Paging

The system has the default value for the number of the records displayed
in each page. You can input the desired number of the records displayed in

each page in the text box of , and then click

. When is selected,
automatically turn to the next page (if it is the last page, turn to the home
page) as long as the previous page is set successfully.

Basic Configuration
This section describes the port-based VLAN configuration.

Port-Based VLAN
The port-based VLAN regards the port as one member added to the VLAN.
The port can forward the packets of the VLAN.

Maipu Confidential & Proprietary Information Page 46 of

133
Web Configuration

Add VLAN
Click and you can add a new VLAN.

You can select multiple ports from the port list and click to add the
selected ports to the member port list, but the types of the selected ports
must be consistent (here, the classification standard is: hybrid mode/non-

Maipu Confidential & Proprietary Information Page 47 of

133
Web Configuration

hybrid mode); click and you can remove the ports from the

member port list (multiple ports can be selected). At last, click to

finish the VLAN configuration.

Edit VLAN
Click and you can edit the corresponding VLAN.

VLAN ID cannot be edited and the other parts are the same as the section
of Add VLAN.

MAC-VLAN Configuration
This section describes the MAC-based VLAN configuration in the port VLAN.

Introdu ction to MAC-VLAN

MAC-based VLAN is to divide VLAN ID to the packet according to the
source MAC address of the untag (without tag) packet received by the port.

Process the untag packets received by the port as follows:

z If the source MAC address of the packet is consistent with the MAC
address of the VLAN that is distributed based on MAC, the packet is
distributed to the VLAN ID of the MAC VLAN.

z If the packet does not match the MAC address set by MAC VLAN, the
packet is distributed to the default VLAN ID of the port.

Maipu Confidential & Proprietary Information Page 48 of

133
Web Configuration

A d d M A C - V LA N
Click , and you can add new MAC-VLAN.

IP Subnet VLAN Configuration

This section describes the IP subnet-based VLAN configuration in the port
VLAN.

Introdu ction to IP Sub net VL AN

IP subnet-based VLAN is to divide VLAN ID to the packet according to the
source IP address of the untag (without tag) packet received by the port.

Process the untag packets received by the port as follows:

z If the source IP address of the packet is in the segment of IP subnet-

based VLAN, the packet is distributed to the VLAN ID of the segment.

z If the packet is not in the segment of IP subnet VLAN, the packet is

distributed to the default VLAN ID of the port.

Add IP Subnet VLAN

Click , and you can add new IP subnet VLAN.

Maipu Confidential & Proprietary Information Page 49 of

133
Web Configuration

Protocol VLAN Configuration

This section describes the protocol-based VLAN configuration in the port
VLAN.

Introduction to Protocol VLAN

Protocol-based VLAN is to distribute VLAN ID to the packet according to
the frame encapsulation format and protocol type of the untag packet
(without tag) received by the port.

The protocol VLAN defines the protocol profile, which comprises the frame
encapsulation and protocol type. One port can be configured with several
protocol profiles. When the protocol VLAN is enabled on the port, the
protocol profile is configured on the port.

The protocol VLAN processes the untag packet received by the port as
follows:

z If the packet matches the protocol profile, the packet is distributed to

the VLAN ID of the protocol profile configured on the port.

z If the packet does not match the protocol profile, the packet is
distributed to the default VLAN ID of the port.

Add Protocol VLAN

Click to enter the interface for adding new protocol VLAN.

When configuring the protocol VLAN, multiple ports can be selected at the
same time. Profile is the existing protocol profile number. If there is no
protocol profile, configure the protocol profile first.

Maipu Confidential & Proprietary Information Page 50 of

133
Web Configuration

Configure Protocol Profile

Click on the Configure Protocol-
VLAN interface and you can configure the protocol profile.

Add Protocol Profile

Click to enter into the interface for adding new protocol profile.

Ether-type: When the packet frame encapsulation format is LLC, the

value range of the packet protocol type is 0x1-0xffff; when the packer
frame encapsulation format is others, the value range of the packet
protocol type is 0x600-0xffff.

Return to Protocol VLAN Configuration

Interfa ce
Click on the Configure Protocol
Profile interface and you can return to the interface for configuring the
protocol VLAN.

VLAN Function Division

This section describes the VLAN function division configuration of the port.

By default, the order of the priorities of the four VLANs from high to low is
MAC-based VLAN, IP subnet-based VLAN, protocol-based VLAN, and port-
based VLAN. On one port, the divided VLAN takes effect by the priority
and only one divided VLAN can take effect.

Maipu Confidential & Proprietary Information Page 51 of

133
Web Configuration

Ticking the check box means that the VLAN function is enabled on the port.
Otherwise, disable the VLAN function.

Q-in-Q (Vlan dot1q tunnel) Configuration

This section describes the Vlan dot1q tunnel configuration.

Introduction to Vlan dot1q tunnel

Vlan dot1q tunnel is the expansion based on the 802.1Q protocol, that is,
add another layer of 802.1Q tag (VLAN tag) to the original 802.1Q packet
header. The two layers of tags make the number of VLANs become 4K×4K.
QinQ encapsulates the VLAN Tag of the user’s private network in the VLAN
Tag of the public network so that the packet carries two layers of VLAN
TAG to cross the backbone network (public network) of operators. In the
public network, the packet is transmitted only according to the outer VLAN
TAG (that is, VLAN TAG of the public network) and the VLAN TAG of the
user’s private network is screened, saving the VLAN IDs of the public
network and providing a simple L2 VPN tunnel for users.

Vlan dot1q tunnel mapping is also the expansion based on 802.1Q.

Different from Vlan dot1q tunnel, Vlan dot1q tunnel mapping is not to add
one layer of 802.1Q tag to the original 802.1Q packet header, but replace
the original 802.1Q tag with new 802.1Q tag. Therefore, the packet still
carries only one layer of 802.1Q tag.

Maipu Confidential & Proprietary Information Page 52 of

133
Web Configuration

Basic Vlan dot1q tunnel Function

The Vlan dot1q tunnel function is enabled on the port. When the port
receives one packet, it adds one layer of VLAN TAG to the packet. The
VLAN ID of the added Tag is the default VLAN ID of the port. If the
received packet is the tag packet, it becomes the packet with two layers of
Tag; if the received packet does not carry Tag, the packet becomes single-
layer Tag packet.

Selective Vlan dot1q tunnel Function

The selective Vlan dot1q tunnel function cooperates with the port VLAN.
The ports add specified outer VLAN Tag to the packet according to the
selective Vlan dot1q tunnel (mapping) item and the VLAN ID in the packet
tag. Vlan dot1q tunnel mapping is to replace the VLAN ID in the packet
Tag with the specified VLAN ID. If the port does not match the selective
Vlan dot1q tunnel (mapping) item, encapsulate the outer VLAN Tag for the
packet. The VLAN Tag is the port PVID VLAN.

Q-IN-Q Configuration

TPID (Tag Protocol Identifier): It is one tag field in the packet and
indicates the protocol type of the VLAN Tag. The value of the VLAN Tag
field is 0x8100. The default value of the outer VLAN Tag in the Vlan dot1q
tunnel packet is 0x8100. Different manufacturers may set different outer
VLAN Tags for the Vlan dot1q tunnel packet, such as 0x9100.

802.1p: Configure the value of the priority filed in the inner Tag of the
port to be copied to the priority field in the outer Tag.

Note

Maipu Confidential & Proprietary Information Page 53 of

133
Web Configuration

In the system, by default, TPID is 0x8100.

Mapping Configuration
Click the icon for configuring the mapping to configure Q-IN-Q
mapping on the port.

Note

When configuring new selective Vlan dot1q tunnel and if there are conflict
items, the system automatically delete all conflict Vlan dot1q tunnel
(mapping) items and then set new items.

L2 Protocol Control Configuration

This section describes the L2 protocol tunnel configuration.

Introduction to L2 protocol control

The L2 protocol control function is to control the L2 protocol packets
received by the port. The L2 protocol control function can help to realize
the following functions:

1. L2 protocol tunnel

It helps to transmit the L2 protocol packets such as BPDU and LACPDU of

the customers’ network transparently in the operators’ network and realize
the spanning tree calculation and link aggregation functions of the whole
user network.

Enable the L2 protocol tunnel function on the port and the destination MAC
address of the L2 protocol packet entering the port is replaced as the
special multicast MAC address (by default, it is 01-00-0c-cd-cd-d0). The

Maipu Confidential & Proprietary Information Page 54 of

133
Web Configuration

protocol packet is converted to the tunnel packet, which serves as the

common L2 packet to be transmitted in the PVID VLAN of the port. When
the tunnel packet is forwarded out from the port on which the L2 protocol
tunnel function is enabled, the destination of the packet is recovered to
the destination MAC address of the L2 protocol packet; the tunnel packet
is replaced to common L2 packet to be sent out. The process of forwarding
the tunnel packet out from the port on which the L2 protocol tunnel is not
enabled is the same as forwarding common L2 packet, complying with the
forwarding principle in one VLAN. Enable the L2 protocol packet tunnel
function on the two edge ports of the protocol tunnel to realize the tunnel
function of the L2 protocol.

2. L2 protocol discard

It is to discard the L2 protocol packets such as BPDU and LACPDU received

by the port directly so that the packets do not take part in the protocol
processing.

3. L2 protocol peer

It is not to process the L2 protocol packets such as BPDU and LACPDU

received by the port, but forward them to the upper protocol module to
process. It is the default function.

Configure Special Multicast MAC for Replacing

Destination MAC of L2 Protocol Packet

Note

The MAC address should be the one prompted in the command line and
cannot be any other MAC address.

 Caution

On the devices at the two sides of the L2 protocol tunnel, the configured
special multicast MAC addresses for replacing the destination MAC
addresses of the L2 protocol packets should be consistent.

Maipu Confidential & Proprietary Information Page 55 of

133
Web Configuration

L2 Protocol Control Configuration

Select the port from the left port list and then configure the L2 protocol
control.

 Caution

When the port on which the L2 protocol tunnel function is enabled receives
the corresponding L2 protocol tunnel packets, the system shuts down the
port temporarily.

ACL Configuration
The full name of ACL is Access Control List, which is called Access List for
short. The configurations related with the ACL function in Maipu switch
include Action Group configuration, Traffic Meter configuration, and Time
Range configuration.

Main contents:

z Configure IP standard access list

z Configure IP extended access list

z Configure MAC standard access list

z Configure MAC extended access list

z Configure Time Range

z Configure Action Group

z Configure Traffic Meter

z Apply ACL to Object

Maipu Confidential & Proprietary Information Page 56 of

133
Web Configuration

Configure IP Standard Access List

On the interface, you can view and configure the IP access control list (IP-
ACL). The IP-ACL comprises one or more filtering rules. It permits or deny
the packets by matching the information in the packet and the parameters
in the access list. The filtering of the access list is a process from up to
down. That is, if one packet matches one rule, execute the operation
(permit or deny) of the rule. Otherwise, the packet is processed by
matching the next filtering rule. If the packet does not match any rule, it
is processed according to the default rule (deny any).

Create One IP Standard Access List

Click to create one ACL and select ACL Type as
Standard.

Create one IP standard access list, which can be named by numbers or

customized by the user.

If the access list is named by numbers, the four kinds of access lists all
have the fixed value ranges.

Access List Type Value Range

IP standard access list 1–1000
IP extended access list 1001–2000

Maipu Confidential & Proprietary Information Page 57 of

133
Web Configuration

MAC standard access list 2001–3000

MAC extended access list 3001–4000

Add One Rule

Click to add one rule.

The operation brings in the name and type of the specified ACL, which
cannot be changed.

Delete
Click and you can delete one access list (if the access list is referenced,
all configurations about the access list become invalid after the access list
is deleted, but you can create an access list with the same name to
recover).

Click after one rule in the list and you can delete the rule.

Bind Time Range

Select the existing time range to bind. You can also click Create a new
Time-Range and then bind it.

Maipu Confidential & Proprietary Information Page 58 of

133
Web Configuration

Bind Action Group

Select the existing action group to bind. You can also click Create a new
Action-Group and then bind it.

For the operations of creating action group and time range, refer to time
range configuration or action group configuration.

Configure IP Extended Access List

IP extended control list is to make the classification rules according to IP
protocol number, source IP address, destination IP address, source
TCP/UDP, destination TCP/UDP port number, packet priority, TCP tag, and
IP fragment tag, and process the packet. The contents defined by IP
extended access list are richer, more exact and more flexible than the IP
standard access list.

Create One IP Extended Access List

Click to create one ACL and select ACL Type as
Extended.

Maipu Confidential & Proprietary Information Page 59 of

133
Web Configuration

The ACL can be named by numbers or customized by the user. For naming
by numbers, refer to the following table.

Access List Type Value Range

IP standard access list 1–1000
IP extended access list 1001–2000
MAC standard access list 2001–3000
MAC extended access list 3001–4000

Protocol: Choose the matching protocol. The common protocols are

available. You can also select the protocol number to specify the protocol.

Maipu Confidential & Proprietary Information Page 60 of

133
Web Configuration

Add One Rule

Click to create one rule.

The operation brings in the name and type of the specified ACL, which
cannot be changed.

Delete
Click and you can delete one access list (if the access list is referenced,
all configurations about the access list become invalid after the access list
is deleted, but you can create an access list with the same name to
recover).

Click after one rule in the list and you can delete the rule.

Bind Object
Click to enter into the interface for binding object. For
details, refer to the section of Apply ACL to Object.

Configure MAC Standard Access List

MAC standard access list is to make rules only according to the source
MAC address of the Ethernet packet and process the packet.

Maipu Confidential & Proprietary Information Page 61 of

133
Web Configuration

Create One MAC Standard Access List

Click to create one MAC-ACL and select the
ACL type.

Create one MAC standard access list, which can be named by numbers or
by the user. For naming by number, refer to the IP-ACL section.

Create One Rule

Click to create one rule.

The operation brings in the name and type of the specified ACL, which
cannot be changed.

Maipu Confidential & Proprietary Information Page 62 of

133
Web Configuration

Delete
Click and you can delete one access list (if the access list is referenced,
all configurations about the access list become invalid after the access list
is deleted, but you can create an access list with the same name to
recover).

Click after one rule in the list and you can delete the rule.

Bind Object
For binding time range and action group, refer to the IP-ACL section.

Configure MAC Extended Access List

MAC extended access list is to make rules according to source MAC
address, destination MAC address, 802.1P priority, VLAN ID, and Ethernet
type of the Ethernet packet, and process the packet.

Create
Click to create one MAC extended access list
and then select the type.

Maipu Confidential & Proprietary Information Page 63 of

133
Web Configuration

Create one MAC extended access list, which can be named by numbers or
by the user. For naming by numbers, refer to the IP-ACL section.

Ethernet Type: The value range is 0x0600-0xFFFF.

The common types are:

z IP type: 0x0800

z ARP type: 0x0806

Precedence: The priority defined by IEEE802.1p and the value range is

0-7.

VLAN-ID: It is the VLAN number and the value range is 1-4094.

Create One Rule

Click to create one rule.

The operation brings in the name and type of the specified ACL, which
cannot be changed.

Maipu Confidential & Proprietary Information Page 64 of

133
Web Configuration

Delete
Click and you can delete one access list (if the access list is referenced,
all configurations about the access list become invalid after the access list
is deleted, but you can create an access list with the same name to
recover).

Click after one rule in the list and you can delete the rule.

Configure Time Range

Time range is the time set. One time range includes 0-n time periods. The
time range is the union set of the time periods. The time-range command
is used to set the time range.

The status of the time range includes ACTIVE and INACTIVE. The status of
the time range depends on the current status of the time periods in the
time range. If any time period is in the ACTIVE state, the time range is in
the ACTIVE state.

Create
Click to create one time range. The time range
includes two kinds:

Periodic time range: It is required to configure one day or several days

of each week, and the start time and the end time.

Maipu Confidential & Proprietary Information Page 65 of

133
Web Configuration

The name of the time range cannot begin with numbers or exceed 31
characters.

Absolute time range: It is required to configure the year, month, day, hour
and minute of the start time and end time.

Create One Rule

Click to create one time rule.

The operation brings in the name of the specified time range, which
cannot be changed.

Maipu Confidential & Proprietary Information Page 66 of

133
Web Configuration

Delete
Click and you can delete one time range (if the time range is
referenced, all configurations about the time range become invalid after
the time range is deleted, but you can create a time range with the same
name to recover).

Click after one time rule to delete the time rule.

Configure Action Group

Action group is the action set. One action group can include packet
mirroring, packet re-direction, packet modification, packet flow control,
packet counting action.

There are two kinds of actions groups, includi9ng ingress action group and
egress action group. The ingress action group is also divided to ingress L2
action group and ingress L3 action group.

The configuration interface of ingress L2 action group:

 Note

The following is the ingress L2 configuration interface of S3900.

 Note

The following is the ingress L2 configuration interface of S4100.

The configuration interface of ingress L3 action group:

 Note

Maipu Confidential & Proprietary Information Page 67 of

133
Web Configuration

The following is the ingress L3 configuration interface of S3900.

 Note

The following is the ingress L3 configuration interface of S4100.

The configuration interface of the egress action group:

 Note

The following is the egress configuration interface of S3900.

Create
Click to create one action group.

The interface for editing ingress L2 action group:

 Note

The following is the interface of creating ingress L2 of S3900.

Maipu Confidential & Proprietary Information Page 68 of

133
Web Configuration

 Note

The following is the interface of creating ingress L2 of S4100.

The interface for editing ingress L3 action group:

 Note

The following is the interface of creating ingress L3 of S3900.

 Note

The following is the interface of creating ingress L3 of S4100.

Maipu Confidential & Proprietary Information Page 69 of

133
Web Configuration

 Note

The following is the interface of creating egress action group of S3900.

The interface for editing the egress action group:

The name of the action group cannot begin with numbers and comprises
31 characters at most.

Counter:

Configure the counting action in the action group. Configuring counting

action is to count the matched packets.

 Note

The following is the interface of adding the action group of S3900.

Note

The following is the interface of adding the action group of S4100.

Maipu Confidential & Proprietary Information Page 70 of

133
Web Configuration

Meter:

Configure the referenced meter name in the action group. Configuring

meter is to limit or mark the matched packets. Select the existing meter
from the drop-down list.

Click Create a new meter to create a meter. For details, refer to

Configure Traffic Meter.

Mirror port:

Configure packet mirroring action in the action group. This is to mirror the
matched packets to the specified port.

Re-direct Port:

Configure packet re-directing action in the action group. The configuration

is to re-direct the matched packet to the specified port.

The interface for selecting the L2 re-direct port:

 Note

The following is the interface of selecting the L2 re-direct port of S3900.

 Note

The following is the interface of selecting the L2 re-direct port of S4100.

Maipu Confidential & Proprietary Information Page 71 of

133
Web Configuration

The interface for selecting the L3 re-direct port:

 Note

The following is the interface of selecting the L3 re-direct port of S3900.

 Note

The following is the interface of selecting the L3 re-direct port of S4100.

The interface for configuring the L3 re-direct to the next hop:

 Note

The following is the interface of configuring the L3 re-direct to the next

hop of S3900.

 Note

The following is the interface of configuring the L3 re-direct to the next

hop of S4100.

Maipu Confidential & Proprietary Information Page 72 of

133
Web Configuration

Configure L2 Remark:

Configure the L2 packet remarking action in the action group. The

configuration is to classify the matched packets so that the user can adopt
different QoS policies in the later data communication.

 Note

The following is the interface of configuring the L2 remark of S3900.

 Note

The following is the interface of configuring the L2 remark of S4100.

Configure L3 Remark:

Configure the L3 packet remarking action in the action group. The

configuration is to classify the matched packets so that the user can adopt
different QoS policies in the later data communication.

Edit
Click and you can edit the attributes of the action group.

Maipu Confidential & Proprietary Information Page 73 of

133
Web Configuration

The interface for editing ingress L2 action group:

 Note

The following is the interface of editing the ingress L2 of S3900.

 Note

The following is the interface of editing the ingress L2 of S4100.

The interface for editing ingress L3 action group:

 Note

The following is the interface of editing the ingress L3 of S3900.

 Note

The following is the interface of editing the ingress L3 of S4100.

The interface for editing the egress action group:

Maipu Confidential & Proprietary Information Page 74 of

133
Web Configuration

 Note

The following is the interface of editing the egress of S3900.

Here, the name of the action group cannot be changed, but the other
attributes can be edited.

Delete
Click and you can delete one action group (if the action group is
referenced, all configurations about the action group become invalid after
the action group is deleted, but you can create an action group with the
same name to recover).

Apply ACL to Object

After setting up one access list, it can be applied on one or more objects,
so as to realize the function of filtering ACL packets. In Maipu switch, the
access list can only be applied at the input and output directions of the
object. The objects include port object, global object, VLAN object and
interface object.

Apply
Click to apply ACL to object.

Maipu Confidential & Proprietary Information Page 75 of

133
Web Configuration

Ip-acl can be applied to all objects:

Mac-acl cannot be applied to VLAN or global:

Note

Viewing and deleting the time range and action group bound to ACL are
performed on the interface of the bound ACL.

Delete
Click and you can delete the binding relation between the binding
object and ACL (deleting the binding time domain and action group is
performed on the corresponding ACL interface).

Configure Meter
To support packet traffic control function, you can specify one meter name
in the action group. One meter can be configured as one global resource
and also can be referenced by multiple action groups.

The configuration of one meter needs to configure the processing action

for the colored packets. When it is configured to drop the colored packets,
the meter is used to complete the packet traffic restriction function. When
it is configured to remark the colored packets, the meter is used to classify
the packets according to the traffic so that the user can adopt different
QoS policies in the later data communication.

Maipu Confidential & Proprietary Information Page 76 of

133
Web Configuration

Create
Click to create one new meter.

Edit
Click after one meter record and you can edit the meter.

Delete
Click after one meter record and you can delete the meter.

QoS Configuration
This chapter describes the QoS usage and configuration of the port.

Main contents:

z Priority mapping

z Queue scheduling mode

z Dropping mode

z Speed limitation

z Port flow shaping

z Port queue flow shaping

Maipu Confidential & Proprietary Information Page 77 of

133
Web Configuration

z Traffic statistics

Priority Mapping
The priority mapping is to map to the local priority according to the dscp
or 802.1p value of the packet. The priority mapping is to configure the
relation of theses mappings. S4100 only has the front three kinds of
mapping.

The mapping relation is as follows:

1. dscp-lp mapping: Map to the local priority IP value according to the

DSCP value of the packet;

2. dot1p-lp mapping: Map to the local priority IP according to the 802.1p

priority of the packet;

3. dscp-dscp mapping: Modify the dscp value of the packet according to

the dscp of the packet;

4. lp-dscp mapping: map to the dscp value of the packet according to the
local priority Ip;

5. lp-dot1p mapping: map to the 802.1p priority of the packet according

to the local priority Ip;

6. lp-cosp mapping: map to the cosq value according to the local priority
Ip;

 Note

The following is the priority mapping of S3900.

 Note

The following is the priority mapping of S4100.

Maipu Confidential & Proprietary Information Page 78 of

133
Web Configuration

The display of the LP-COSQ mapping configuration:

 Note

The following is the LP-COSQ mapping of S3900.

If there is no LP-COSQ mapping configuration, it is displayed as default.

Edit
Edit single priority mapping: Click to edit the priority mapping of the
port.

 Note

The following is the single editing interface of S3900.

 Note

The following is the single editing interface of S4100.

Maipu Confidential & Proprietary Information Page 79 of

133
Web Configuration

Click Edit and the selected ports are displayed. The selected ports cannot
be changed, but the mappings of the ports can be edited.

Batch Edit: Click and you can edit the priorities of all selected ports.

 Note

The following is the batch editing interface of S3900.

 Note

The following is the batch editing interface of S4100.

The interface of editing LP-COSQ:

Delete
Delete Single Priority Mapping: Click to delete all priority mappings of
the port.

Maipu Confidential & Proprietary Information Page 80 of

133
Web Configuration

Batch Delete: Click to delete the priority mappings of

the selected ports.

 Note

The following is the batch deleting interface of S3900.

 Note

The following is the batch deleting interface of S4100.

Queue Scheduling Mode

Each port has eight output queues. The following scheduling policies can
be adopted:

SP (Strict Priority): Queue 7 has the highest priority and queue 0 has the
lowest priority;

RR (Round Robin): Packet-based fair scheduling. As long as one queue

schedules one packet, turn to the next queue;

WRR (Weighted Round Robin): Packet-based weighted scheduling. You can

configure how many packets are scheduled by each queue before turning
to the next queue. When it is configured as 0, it indicates strict priority
queue;

WDRR (Weighted Deficit Round Robin): It is an improvement for the WRR

algorithm. For details, refer to the chapter of QoS Configuration.

 Note

The following is the queue scheduling mode of S3900.

Maipu Confidential & Proprietary Information Page 81 of

133
Web Configuration

 Note

The following is the queue scheduling mode of S4100.

The SP and RR modes have no weight values, so they are displayed “--".

Edit
Edit Single Queue Scheduling: Click to edit the queue scheduling
mode of the port.

 Note

The following is the single editing interface of S3900.

Maipu Confidential & Proprietary Information Page 82 of

133
Web Configuration

 Note

The following is the single editing interface of S4100.

On the interface, there is the selected port and policies. The policies can
be modified.

Batch Edit: Click to edit the queue scheduling mode of the selected
ports.

 Note

The following is the batch editing interface of S3900.

 Note

The following is the batch editing interface of S4100.

Maipu Confidential & Proprietary Information Page 83 of

133
Web Configuration

The default value is the SP mode.

Delete
Delete Single Queue Scheduling: Click to delete the queue scheduling
mode of the port and recover to the SP mode.

Batch Delete: Click to delete the queue scheduling

mode of the selected port and recover to the SP mode.

 Note

The following is the batch deleting interface of S3900.

 Note

The following is the batch deleting interface of S4100.

Drop Mode
The port supports two drop modes, including Tail Drop and SWRED.

 Note

The following is the drop mode of S3900.

Maipu Confidential & Proprietary Information Page 84 of

133
Web Configuration

 Note

The following is the drop mode of S4100.

Edit
Edit Single: Click to edit the drop mode of one port.

 Note

The following is the single editing interface of S3900.

 Note

The following is the single editing interface of S4100.

Maipu Confidential & Proprietary Information Page 85 of

133
Web Configuration

Batch Edit: Click to edit the drop mode of the selected ports.

 Note

The following is the batch editing interface of S3900.

 Note

The following is the batch editing interface of S4100.

Maipu Confidential & Proprietary Information Page 86 of

133
Web Configuration

Delete
Delete Single: Click to delete the drop mode of the port. By default, the
drop mode is tail-drop mode.

Batch Delete: Click to delete the drop modes of the

selected ports. By default, the drop mode is tail-drop mode.

 Note

The following is the batch deleting interface of S3900.

 Note

The following is the batch deleting interface of S4100.

Rate Limitation
To ensure that that the information flow over the network does not
overload and cause blocking. Maipu series switches provide port-based
speed limitation at the input direction, that is, limit the total speed at the
receiving direction of the port and the overloading flow is dropped. The
configured parameters are bandwidth threshold (Kbit, 64K is the minimum
granularity and the burst flow (bytes).

Maipu Confidential & Proprietary Information Page 87 of

133
Web Configuration

The un-configured time range is displayed as --.

Edit
Edit Single: Click to edit the speed limitation of one port.

On the interface, there is the selected port and the related parameter
values for modification. The port cannot be modified.

Batch Edit: Click to edit the speed limitation of the selected ports.

On the interface, there are the selected ports. You can also input the
desired ports according to the port format.

Delete
Delete Single: Click to delete the speed limitation of the corresponding
port.

Maipu Confidential & Proprietary Information Page 88 of

133
Web Configuration

Batch Delete: Click to delete the speed limitations of all

selected ports.

The result after deleting:

Port Flow Shaping

Port-based flow shaping at the output direction makes packets be sent out
with even speed. The configured parameters are bandwidth threshold (Kbit,
64K is the minimum granularity and the burst flow (bytes). The burst flow
step length is 4K bytes.

Configure the flow shaping. The input parameters may be inconsistent

with the actual configured values, because the driver adjusts the input
value according to the chip. The last value of rate is an integer multiple of
64. When the input value is not the integer multiple of 64, the driver
adjusts it to the minimum integer multiple of 64, which is larger than the
current value. The value of burst-size after modification is an integer
multiple of 4096.

Maipu Confidential & Proprietary Information Page 89 of

133
Web Configuration

When the time range is not configured, it is displayed as --.

Edit
Edit Single: Click to configure the flow shaping of the port.

On the interface, there is the select port and the related values. The port
cannot be modified.

Batch Edit: Click to edit the flow shaping of all selected ports.

On the interface, there are only the selected ports. You can also input the
desired ports according to the port format.

Delete
Delete Single Flow Shaping: Click to delete the flows shaping of the
corresponding port.

Batch Delete: Click to delete the flow shaping of all

selected ports.

Maipu Confidential & Proprietary Information Page 90 of

133
Web Configuration

The result after deleting:

Port Queue Flow Shaping

Port-based flow shaping at the output direction makes packets be sent out
with even speed. The configured parameters are queue number,
committed information rate, committed burst size, peak burst size, and
peak information rate.

Configure the flow shaping for the queue on the port. The value range of
the queue number is 0-7. The later four parameters are committed
information rate (CIR), committed burst size (CBS), peak burst size (PBS),
and peak information rate (PIR). Here, PIR, CIR and step length are all 64.
If the input value is not the multiple of 64, the diver automatically adjusts
it. The values of CBS and PBS are an integer multiple of 4096. The
calculation method is consistent with the burst-size command.

Edit
Edit Single Flow Shaping: Click to edit the flow shaping of the current
queue number on the port.

Maipu Confidential & Proprietary Information Page 91 of

133
Web Configuration

On the interface, there are the selected ports, queue ID, and the flow
shaping values. Here, the selected ports and queue ID cannot be modified.

Batch Edit: Click to edit the flow shaping of any queue number of all
selected ports.

On the interface, there are only the select ports. Edit the flow shaping of
one queue of the selected ports.

Delete
Delete Single Flow Shaping: Click to delete the flow shaping of current
queue number on the port.

Batch Delete: Click to delete the flow shaping of the

selected queue numbers of the selected ports.

Maipu Confidential & Proprietary Information Page 92 of

133
Web Configuration

The result after deleting:

Flow Statistics
The port, vlan and global flow statistics are supported.

 Note

The following is the traffic statistics of S3900.

 Note

The following is the traffic statistics of S4100.

Maipu Confidential & Proprietary Information Page 93 of

133
Web Configuration

View Ports
Select the port and click .

 Note

The following is the interface of viewing ports of S3900.

 Note

The following is the interface of viewing ports of S4100.

Maipu Confidential & Proprietary Information Page 94 of

133
Web Configuration

View Vlan
Input Vlan ID and click .

 Note

The following is the interface of viewing VLAN of S3900.

 Note

The following is the interface of viewing VLAN of S4100.

View Global
Click the Global Tab.

OAM Configuration
CFM Configuration
The IEEE 802.1ag protocol calls Ethernet OAM function as Connectivity
Fault Management (CFM). It is service-based end-to-end Ethernet OAM
function.

Maipu Confidential & Proprietary Information Page 95 of

133
Web Configuration

The carrier-class Ethernet needs to provide different management scope

and contents for different organizations. Usually, there are three kinds of
organizations that refer to carrier-class Ethernet services, including users,
service providers, and network carriers. Users purchase Ethernet services
from service providers; service providers can use their own network or
other carriers’ network to provide end-to-end Ethernet services. In IEEE
802.1ag, carrier-class Ethernet is divided to one multi-domain OAM
network model, including three maintenance grades, that is, users, service
providers, and carriers. They correspond to different management
domains. The service providers are responsible for end-to-end service
management and the carriers provide service transmission.

Maintenance Domain (MD): It is a part of the network covered by the

connectivity fault management. Its limit is defined by a series of
maintenance points (MP) configured on the ports. The maintenance
domain name is used to identify the MD. According to multi-domain OAM
network model of 802.1ag, MD has hierarchical levels. The high level can
include the low level, but cannot intersect, that is, the range covered by
high level is larger than that covered by the low level. The integers of 0-7
are used to identify different levels. The higher the level, the bigger the
number.

Maintenance Association (MA): It is a set in MD and includes some MPs.

MA is identified by MD name + short MA name. MA serves one VLAN, in
which the packets sent by the MPs in MA are forwarded and the packets
sent by other MPs in the MA are received at the same time. Therefore, MA
is also called Service Instance (SI).

Maintenance point: It is one Maintenance Association End Point (MEP) or

Maintenance Association Intermediate Point (MIP). It is configured on the
port and belongs to one MA. On one port, each MA can be configured with
only one MP.

Maintenance Association End Point (MEP): It can receive and send

any CFM packet. Each MEP is identified by an integer, which is called MEP
ID. MEP is configured on the port and decides the MD range. The MA and
MD to which the MEP belongs decide the VLAN attribute and level attribute
of the packet sent by MEP. According to the location of MEP in MA, the
MEP direction includes inward and outward. If the packet in MA is received
from the port on which the MEP is configured, the MEP direction is outward.
Similarly, the outward MEP can only send packets to the network via the
port on which the MEP is configured. Contrariwise, if the packet in MA is
received from other port, the MEP direction is inward. The inward MEP
cannot send packets to the network via the port on which the MEP is
configured.

Maipu Confidential & Proprietary Information Page 96 of

133
Web Configuration

Maintenance Association Intermediate Point (MIP): It can process

and respond to some CFM packets (such as LT packet or the packet whose
destination is the LB which is at the same layer as itself), but cannot send
packets initiatively. The MA and MD to which the MIP belongs decide the
VLAN attribute and the MD level of the received packet.

CEM has the following functions:

z The function of checking connectivity;

z The function of checking loopback;

z The function of tracking link;

Add Maintenance Domain

Click to enter into the interface for adding the maintenance
domain.

Add Service Instance of Maintenance Domain:

The initial interface of the maintenance domain is as follows:

Click to enter into the interface for configuring the

service instance.

Maipu Confidential & Proprietary Information Page 97 of

133
Web Configuration

Click to cancel adding the service instance of the maintenance

domain.

Basic Information of Service Instance:

Click to set the interval of MEP sending CCM packets; click

to delete the service instance.

Local Maintenance End Point

Click to disable the function of MEP sending CCM packets; click

to delete the MEP.

Click to set the MEP on the port.

Maipu Confidential & Proprietary Information Page 98 of

133
Web Configuration

Remote Maintenance End Point

Action:

z Ping: loopback test;

z Traceroute: link tracking test;

Connectivity Checking Maintenance End Point:

Click to add remote MEP; click to delete the remote peer MEP.

Port Configuration
Configure the CFM function on the port.

Maipu Confidential & Proprietary Information Page 99 of

133
Web Configuration

You can set whether to enable the CFM function on the ports in batches.

OAM Basic Configurations

This section describes the information about the Ethernet OAM. The
interface includes four layers, that is, port OAM enabling configuration,
port OAM event log configuration, port OAM detection packet configuration,
and port OAM link monitoring configuration.

Port OAM Enabling Configuration

Port: the number of the port on which the OAM function is to be

configured;

Port status: “Enable” means to enable the Ethernet OAM; “Disable”

means to disable the Ethernet OAM; by default, the Ethernet OAM function
is disabled.

Set: select the port number and the port status, and then click Set, as
follows:

Maipu Confidential & Proprietary Information Page 100 of

133
Web Configuration

Note

After enabling the OAM function of the port, the OAM status in the list is
displayed in the bold black form. Otherwise, it is not in bold form.

Refresh: Perform the refreshing operation on the interface.

Port OAM Event Log Configuration

The following is the interface for configuring the OAM event log on the port.

Port: the number of the port on which the OAM event log is to be
configured;

Event Log Status: “Enable” means to enable the event log information;
“Disable” means to disable the event log information; by default, the event
log information is enabled;

Cache Size: the maximum number of the cached event log information of
the Ethernet OAM; the default value is 50;

Event Log Detail: When the port is configured with the maximum cache
size, there is the link of the details. Click Detail to display the detailed
information as follows. Click Close to hide the information.

Set: Select port number, event log status, and cache size, and then click
Set as follows.

Maipu Confidential & Proprietary Information Page 101 of

133
Web Configuration

After setting successfully, the following figure is displayed.

Note

After enabling the OAM event log of the port, the event log status in the
list is displayed in the bold black form. Otherwise, it is not in bold form.

Port OAM Detection Packet Configuration

The following is the interface for configuring the OAM detection packet.

Port: the number of the port on which the OAM detection packet is
configured;

Maipu Confidential & Proprietary Information Page 102 of

133
Web Configuration

OAM Mode: It is the Ethernet OAM mode. “Active” means the Ethernet
OAM mode is active; “Passive” means the Ethernet OAM mode is passive.
The default value is active.

Hello rate: It is the interval for sending hello packets (that is information
OAMPDU) of Ethernet OAM. The default value is 1000.

Hello Timeout: It is the timeout of the Ethernet OAM connection. The

default value is 5000;

Set: Select the port number, OAM mode, Hello rate, and Hello timeout,
and then click Set as follows.

After setting successfully, the following interface is displayed.

Refresh: Perform the refreshing operation on the interface.

Port OAM Link Monitoring Configuration

The following is the interface for configuring OAM link monitoring on the
port.

Port: the number of the port on which the OAM link monitoring is to be
configured;

Maipu Confidential & Proprietary Information Page 103 of

133
Web Configuration

Link monitor status: the link monitoring function of Ethernet OAM;

“Enable” means to enable the link monitoring function of Ethernet OAM;
“Disable” means to disable the link monitoring function of Ethernet OAM;
by default, the link monitoring function of Ethernet OAM is enabled;

Window (seconds) of monitor error symbol: the window period of the

error signal detection of the OAM link monitoring; the default value is 1s;

High threshold value and action: the upper threshold of the error
signal detection of Ethernet OAM link monitoring and the error response
processing for the upper threshold of the error signal detection of Ethernet
OAM link monitoring; by default, the upper threshold is no monitor;

Low threshold value and action: the low threshold of the error signal
detection of Ethernet OAM link monitoring and the error response
processing for the low threshold of the error signal detection of Ethernet
OAM link monitoring; by default, the low threshold is 1;

Window (seconds) of monitor error frame: the window period of the

error frame detection of Ethernet OAM link monitoring; the default value is
1 second;

High threshold value and action: the upper threshold of the error
frame detection of Ethernet OAM link monitoring and the error response
processing for the upper threshold of the error frame detection of Ethernet
OAM link monitoring; the default upper threshold value is no monitor;

Low threshold value and action: the low threshold of the error frame
detection of Ethernet OAM link monitoring and the error response
processing for the low threshold of the error frame detection of Ethernet
OAM link monitoring; the default low threshold is 1;

Window (seconds) of monitor error frame period: the window period

of the error frame periodical detection of Ethernet OAM link monitoring;
the default value is 1000 frames;

High threshold value and action: the upper threshold of the error
frame periodical detection of Ethernet OAM link monitoring and the error
response processing for the upper threshold of the error frame periodical

Maipu Confidential & Proprietary Information Page 104 of

133
Web Configuration

detection of Ethernet OAM link monitoring; the default upper threshold

value is no monitor;

Low threshold value and action: the low threshold of the error frame
periodical detection of Ethernet OAM link monitoring and the error
response processing for the low threshold of the error frame periodical
detection of Ethernet OAM link monitoring; the default low threshold is 1;

Window (seconds) of monitor error frame seconds: the window

period of the error frame seconds detection of Ethernet OAM link
monitoring; the default value is 60s.

High threshold value and action: the upper threshold of the error
frame seconds detection of Ethernet OAM link monitoring and the error
response processing for the upper threshold of the error frame seconds
detection of Ethernet OAM link monitoring; the default upper threshold
value is no monitor;

Low threshold value and action: the low threshold of the error frame
seconds detection of Ethernet OAM link monitoring and the error response
processing for the low threshold of the error frame seconds detection of
Ethernet OAM link monitoring; the default low threshold is 1;

The setting list includes Link Monitor Status, Monitor Error Symbol,
Monitor Error Frame, Monitor Error Frame Period, and Monitor Error Frame
Seconds.

The setting of link monitoring status is as follows:

The selected port numbers are automatically added to the port list. After
successful setting, the following interface is shown.

Maipu Confidential & Proprietary Information Page 105 of

133
Web Configuration

Note

After enabling OAM link monitoring configuration on the port, the link
monitoring status in the list is displayed in bold and black form. Otherwise,
it is displayed not in bold form.

The setting of the error signal detection is as follows:

After successful setting, the following interface is shown.

Refresh: to refresh the interface;

The setting of the error frame detection is as follows:

Maipu Confidential & Proprietary Information Page 106 of

133
Web Configuration

After successful setting, the following interface is shown.

Refresh: to refresh the interface;

The setting of the error frame periodical detection is as follows:

After successful setting, the following interface is shown.

Refresh: to refresh the interface;

The setting of the error frame seconds detection is as follows:

Maipu Confidential & Proprietary Information Page 107 of

133
Web Configuration

After successful setting, the following interface is shown.

Refresh: to refresh the interface;

Note

The interface comprises tabs. When the user sets one tab, the setting
takes effect only on the current tab. For example, select Monitor Error
Frame Seconds, click Set and the setting takes effect only on the tab.

OAM Status Display

This section describes the display information of Ethernet OAM status.

 Note

The following is the interface of displaying the OAM status of S3900.

 Note

The following is the interface of displaying the OAM status of S4100.

Maipu Confidential & Proprietary Information Page 108 of

133
Web Configuration

Details: to display the discovery information of Ethernet OAM connection,

as follows:

Close: to close the list of displaying the details;

Statistics: to display the statistics information of Ethernet OAM, as

follows:

Maipu Confidential & Proprietary Information Page 109 of

133
Web Configuration

Close: to close the list of displaying the statistics information;

Monitor: to display the Ethernet OAM link monitoring information, as

follows.

Close: to close the list of displaying Ethernet OAM link monitoring

information;

OAM Remote Loopback Test

This section describes the remote loopback test information of the
Ethernet OAM.

Maipu Confidential & Proprietary Information Page 110 of

133
Web Configuration

Port: the number of the port to be configured with OAM remote loopback
test;

Remote Loopback: The remote loopback function of Ethernet OAM;

“Enable” means that the remote loopback function of Ethernet OAM is not
disabled; “Disable” means that the remote loopback function of Ethernet
OAM is disabled; the default value is “Enable”.

The setting is as follows:

After setting successfully, the following interface is shown.

Note

After enabling the OAM remote loopback test function on the port, the
remote loopback function in the list is displayed in black and bold form.
Otherwise, it is displayed not in bold form.

Refresh: to refresh the interface;

Maipu Confidential & Proprietary Information Page 111 of

133
Web Configuration

Port: the number of the port to send the remote loopback command;

Loopback Test Time: the time of the remote loopback test; the unit is
second;

Start: to send the command of enabling remote loopback test to the peer
end;

Execute Test: After enabling the remote loopback command, click

Execute Test; after the test is complete, the data is displayed on the
interface.

Stop: to send the command of disabling remote loopback test to the peer
end;

ELMI Configuration
E-LMI (Ethernet local management interface) is put forward by MEF and
the serial No. is MEF16. Metro-E forum defines a group of extending
service attributes and related parameters used to provide the Ethernet
services from UNI to UNI. The E-LMI protocol can get and transmit the
sufficient EVC and UNI status information, and UNI and EVC configuration
information from the PE device to the CE device, so as to complete the
configuration of the CE device.

E-LMI Protocol Configuration on P E

Global E-LMI Function: Select and
, and then click Set.

Maipu Confidential & Proprietary Information Page 112 of

133
Web Configuration

Enable E-LMI on Port; Select the port, select

, and then click Set.

The result is as follows:

Enable the E-LMI function of the selected ports.

E-LMI Running Parameters on PE: Select the desired port, and click
.

Maipu Confidential & Proprietary Information Page 113 of

133
Web Configuration

In PE mode, T391 is invalid, so it is displayed “-“.

E-LMI Protocol Configuration on C E

Refer to the above section.

EVC-UNI Configuration
Configure the UNI type of the local port. Currently, there are three types,
including bundling, all-to-one, and multiplexing.

Bundling: One UNI port can be bound to several EVCs, and one or several
CEVLANs are mapped to the EVCs;

all-to-one: One UNI port is bound to only one EVC and all CEVLANs are
mapped to the EVC;

multiplexing: One UNI port can be bound to several EVCs and only one
CEVLAN is mapped to the EVCs.

Only the ports on which the E-LMI protocol is enabled in PE mode can be
displayed.

Edit
Click to edit the UNI-ID and UNI type of the port.

Maipu Confidential & Proprietary Information Page 114 of

133
Web Configuration

Batch edit: Select the desired ports, and then click to edit the
UNI-ID and the type of the ports.

The default type is bundling.

Create New UNI

When no port is selected, click , and then input the port.

Delete
Delete Single: Click to delete the UNI-ID of the port and recover the
default value of the system, that is, UNI-port-X/XX.

Batch Delete: Click to delete the UNI-IDs of the

selected ports and recover the default value of the system, that is, UNI-
port-X/XX.

The result is as follows:

Maipu Confidential & Proprietary Information Page 115 of

133
Web Configuration

EVC
EVC is put forward by MEF. It is the virtual connection to connect two or
more UNIs and switch Ethernet service frames between them.

Create
Click to create one new EVC.

View Details
Click to view the details of EVC.

Edit
Click to edit the EVC.

Maipu Confidential & Proprietary Information Page 116 of

133
Web Configuration

Delete
Click to delete the EVC.

Apply
Click to jump to the EVC binding interface to perform
the operation of applying EVC.

New EVC binding: Click to add new EVC binding.

Click and the result is as follows:

Maipu Confidential & Proprietary Information Page 117 of

133
Web Configuration

Click to delete one EVC; click to delete EVCs in

batches.

Click and turn to the EVC configuration interface.

Click an turn to the interface for configuring

the port mode.

Anti-Attack Detection
Configuration
Overview
This section describes the configurations of the attack detection and scan
detection.

Urpf Attack Detection

 Note

The following is the interface of URPF attack detection of S3900.

Maipu Confidential & Proprietary Information Page 118 of

133
Web Configuration

 Note

The following is the interface of URPF attack detection of S4100.

Add: Click to configure the new URPF detection.

 Note

The following is the interface of adding new URPF attack detection of

S3900.

 Note

The following is the interface of adding new URPF attack detection of

S4100.

Refresh: Click to refresh the urpf configuration interface.

Delete: Select the desired configuration, and click to delete it.

Attack Detection
Packet Attack Detection
The packet attack detection configuration includes:

z To detect and defend the land attack

Maipu Confidential & Proprietary Information Page 119 of

133
Web Configuration

z To detect the minimum IP packet attack

z To detect the maximum IP fragment

z Enable attack detection that destination MAC equals source MAC

z Enable invalid TCP attack detection

z Enable invalid ICMP attack detection

z Enable invalid IP attack detection

z Attack detection that source IP of IPv4/v6 equals destination IP

z Attack detection that destination port of UDP equal source port

z Attack detection that destination port of TCP equal source port

z Attack detection of TCP SYN packet with source port smaller than
1024

z Enable URPF to check the default route

 Note

The following is the packet attack detection of S3900.

 Note

The following is the packet attack detection of S4100.

If the configuration items are selected, it means enabling. Otherwise, it

means disabling.

Maipu Confidential & Proprietary Information Page 120 of

133
Web Configuration

ICMP flood Attack Detection

ICMP flood attack occupies the bandwidth by sending lots of ICMP packets
to the target IP so that the valid packets cannot reach the destination,
reaching the purpose of attack. During detection, record the ICMP packets
whose destination addresses are L3 interface addresses of the switch.
Once the receiving frequency of packets is higher than the normal range,
it is doubted that there is attack and the flow frequency of packets is
controlled strictly until the frequency is lower than the normal range. The
processing method has some limitation, that is, the valid packets are also
denied when denying the excessive packets. However, considering the
bearing capability of the system, the method is the most reasonable.

ip icmp intercept configuration:

Add: Click to configure new ICMP flood attack detection.

 Note

The following is the interface of adding ICMP flood attack detection of

S3900.

 Note

The following is the interface of adding ICMP flood attack detection of

S4100.

Input ACL and Detection Threshold, and then click .

ACL: The ACL can be serial No., a number between 1 and 2000. It can
also be the name of the ACL.

Detection Threshold: It is an integer from 0 to 65535. The default value

is 500.

Maipu Confidential & Proprietary Information Page 121 of

133
Web Configuration

Delete: Select the desired ICMP flood attack detection configurations, and
click to delete them.

SYN flood Atta ck Detection

SYN flood is the most famous attack for consuming the limited resources
of the system. It is an attack of deliberate three-way handshake invasion
and opening a large number of half-open TCP / IP connections. The attack
adopts the IP deception to send the SYN request that seems to be valid to
the attacked system. But in fact, the source address does not exist or is
not online at the moment. Therefore, the response ACK message cannot
reach the destination, while the attacked system is full of the half-open
connections and the resources are consumed up. The valid connections
cannot be responded. For the attack, you can use a simple holdup mode,
that is, threshold holdup. Once the packet frequency of the SYN request
received by one server exceeds the threshold, hold up the excessive. On
one hand, the SYN attack intensity is reduced; on the other hand, it does
not consume too many router resources and result in itself denying
services. Note that the validity of the SYN packet is not distinguished, so it
also results in the holdup of some valid requests. You can combine the
pseudo-source address detection function to filter most attack packets,
reducing the number of the valid packets that are held up.

ip tcp intercept list configuration:

Add: Click to configure the new syn flood attack detection.

 Note

The following is the interface of adding syn flood attack detection of S3900.

 Note

The following is the interface of adding syn flood attack detection of S4100.

Maipu Confidential & Proprietary Information Page 122 of

133
Web Configuration

Input ACL and Detection Threshold, and then click .

ACL: The ACL can be serial No., a number between 1 and 2000. It can
also be the name of the ACL.

Detection Threshold: It is an integer from 0 to 65535. The default value is

1000.

Delete: Select the desired syn flood attack detection configurations, and
click to delete them.

Smurf Attack Detection

Smurf is also a kind of attack. The attacker first uses the address of the
attacked host to send ICMP response request to one broadcast address;
hundreds of PCs on the broadcast network make response; lots of
response packets are sent to the attacked host. The result of the attack is
the same as that of ICMP flood and more secret. This kind of packets can
be held up by two methods. If pseudo-source address detection can find
the packets, deny them directly. Besides, enable the smurf detection
switch. If the source address is the address of the protected destination
server, while the destination address is one broadcast address, hold up the
packet. The smurf attack adopts the ICMP_ECHO packet, but considering
that the other ICMP request packets can also lead to the same
consequence, the detection is extended to ICMP_TSTAMP, ICMP_IREQ, and
ICMP_MASKREQ packets.

ip smurf intercept configuration:

Add: Click to configure new smurf attack detection.

 Note

The following is the interface of adding smurf attack detection of S3900.

 Note

Maipu Confidential & Proprietary Information Page 123 of

133
Web Configuration

The following is the interface of adding smurf attack detection of S4100.

Input ACL and Mask-len, and then click .

ACL: The ACL can be serial No., a number between 1 and 2000. It can
also be the name of the ACL.

Mask-len: It is an integer from 0 to 32. The default value is 24.

Delete: Select the desired smurf attack detection configurations, and click
to delete them.

Fraggle Attack Detection

Strictly speaking, fraggle attack is the variant of smurf. When there are
many firewalls to detect the ICMP packets strictly, fraggle does not send
ICMP request packet to the broadcast address any more, but sends UDP
packets. When the PC of the destination segment receives the packet and
finds that the destination port is unavailable, it sends one error packet of
“the destination port is unavailable” to the attacked host. Lots of error
packets rush into the attacked host at the same time, reaching the
purpose of attacking the host. The fraggle attack detection is similar to
smurf.

ip fraggle intercept configuration:

Add: Click to configure new fraggle attack detection.

 Note

The following is the interface of adding new fraggle attack detection of

S3900.

Maipu Confidential & Proprietary Information Page 124 of

133
Web Configuration

 Note

The following is the interface of adding new fraggle attack detection of

S4100.

Input ACL and Mask-len, and then click .

ACL: The ACL can be serial No., a number between 1 and 2000. It can
also be the name of the ACL.

Mask-len: It is an integer from 0 to 32. The default value is 24.

Delete: Select the desired fraggle attack detection configurations, and

click to delete them.

Scan Detection
Introduction to Scan Detection
The scan detection module can find the address scan and port scan attacks.
By default, the system has a set of scan detection thresholds. The user
can customize the scan threshold to reach the more detailed scan
detection. When it is found that the scan happens to one address, the user
can define prohibiting the access in a small period of time. The default
value is 15s. Meanwhile, the system records the IP scan in the log for the
user to analyze.

Scan Detection Configuration

 Note

The following is the scan detection configuration of S3900.

 Note

Maipu Confidential & Proprietary Information Page 125 of

133
Web Configuration

The following is the scan detection configuration of S4100.

When configuring the scan detection, whether to clear the scan statistics
information can be configured. To enable the scan detection, tick the To
enable the scan detection function check box. To configure the custom
scan, first select to enable the default scan. If the items of the custom
scan are not specified (that is, adopt the default values), it is regarded
that the default scan detection protection is enabled.

After the scan detection configuration is complete, click to

save the configuration.

Static Route Configuration

Overview
This section describes the static route configuration.

Introduction to Static Route

The static route is the customized route and is configured by the user
manually. It makes the transmission of the IP packet between the source
and destination adopt the specified path.

Compared with the dynamic routing protocol, the advantages of the static
route include the security and the resource efficiency. The static route
does not need to occupy the line bandwidth like the dynamic routing
protocol. It can improve the network performance and does not need to
occupy the CPU period to calculate and notify the route. The disadvantage
is that when the network topology changes, it does not have the auto re-
configuration mechanism and needs the user to configure manually.

Maipu Confidential & Proprietary Information Page 126 of

133
Web Configuration

The static route can be re-distributed to the dynamic routing protocol, but
the route of the dynamic routing protocol cannot be re-distributed to the
static route table. Besides, the route loop caused by configuring the static
route cannot be avoided.

The static route is useful for the security of the small network. For
example, there is only one path connected to the outer network. For the
large-scale network, the static route can perform the security control for
some services or links. Most networks adopt the dynamic routing protocol
between the network devices, but one or two static routes can be
configured for some special cases.

Configure Static Route

Configuring static route includes:

z Set the adding/deleting of static route;

z Set the next-hop IP address or forwarding interface, management

distance, Track ID, route tag, and next-hop name of the static route;

Click to add the configurations items of the static route.

DNS Configuration
Overview
This section describes the DNS configuration.

Maipu Confidential & Proprietary Information Page 127 of

133
Web Configuration

DNS Server Configuration

IP defines one naming method, allowing one device to be identified by its
location in IP. It is one hierarchical naming method for the domain. To
keep the tacking of the domain name, IP defines the name server, which
keeps the buffer (or database) of mapping the domain name to the IP
address. To map the domain name to IP address, you first need to identify
the host name and then specify the domain name server to make the
domain naming system take effect. This is the global naming scheme of
the Internet identifying the network device.

The Preferred DNS server and Alternate DNS server can be configured.

 Note

The DNS server configuration interface cannot configure or display the

IPv6 address.

System Management
Overview
This section describes the system management and configuration.

Basic Information Configuration

In Maipu switch, the main tasks of the system basic information
configuration are:

z Configure system name

z Configure system time

z Configure contact person information

Maipu Confidential & Proprietary Information Page 128 of

133
Web Configuration

NTP Configuration
Click to enter the NTP configuration interface.

NTP Client Configuration

For the NTP client, the following items can be configured:

z Enable client authentication

z Authentication key

z NTP client

z Trusted key

Authentication-key Configuration:

Click to add configuration; click to delete the configuration.

Enable Client Authentication Configuration:

You only need to tick the check box.

Maipu Confidential & Proprietary Information Page 129 of

133
Web Configuration

NTP Client Configuration:

Click to add configuration; click to delete the configuration.

Trusted-key Configuration:

Click to add configuration; click to delete the configuration.

NTP Server C onfiguration

For the NTP server, the following items can be configured:

z Stratum value

z Authentication-key

Stratum Configuration

Authentication Key Configuration

Administrator Configuration
Set the passwords of administrator and guest, set the password for
entering the enable mode, set whether to enable guest user, and so on.

Maipu Confidential & Proprietary Information Page 130 of

133
Web Configuration

Set the password of the administrator as follows:

Set the password of the guest as follows:

Set the password for entering the enable mode as follows:

Set whether to enable the guest user as follows:

Device Software Upgrade

The system can select two kinds of file upgrade.

z WEB file (*.rom)

z IOS file (*.bin)

Click Browse to select the desired upgrade file.

Note

Maipu Confidential & Proprietary Information Page 131 of

133
Web Configuration

Re-start the device. The IOS program upgrade can take effect only after
restarting the device.

Configuration File Management

File management configuration includes:

The backup of the configuration files in the system:

Click Backup to back up the configuration files of the device to the local.

The recovering of the configuration files in the system:

To recover to the previous configuration, find the desired configuration file

at the local and click Recover.

Log Management
The system log function includes two aspects:

z Add some header information to the printed log message, such as

time stamp and task name;

z Output and save the log message in various forms, including printing
to the console port, printing to the telnet terminal via the switch,
writing to the memory, writing to the flash file, sending to the log
server and so on;

Maipu Confidential & Proprietary Information Page 132 of

133
Web Configuration

You can click to update the log information; click to

clear the current log information.

Save Configuration
Overview
The save function is to save all current configurations to the device.

After modifying the system configuration, the user can save the current
configuration as the configuration parameters for enabling the switch next
time.

Click in the navigation and the system prompts a

dialog box. Click OK to save the configuration or Cancel to cancel the
saving operation.

Maipu Confidential & Proprietary Information Page 133 of

133