It is recommended to implement the separation of management and data/customer traffic in your Huawei Service Routers (e.g. NE40E Series). Traffic passing through the management plane should be exclusively for management or administrative access purposes only like SSH, SNMP, NTP and AAA. These are the steps on hardening the security on Huawei Routers. Management instance can be configured using these commands: ip vpn-instance STRING<1-31> description TEXT<1-242> ipv4-family Here’s the recommended configuration or practices for these management services. Configure Authentication, Authorization…
Free Network Posts
Here are sample configuration on resequencing access lists in Cisco Routers for IOS, IOS-XE, IOS-XR and Nexus OS Cisco IOS/IOS-XE a. Show the existing access-list IOS#show access-lists acl_123 Extended IP access list acl_123 10 permit tcp 192.168.10.8 255.255.255.255 192.168.20.5 255.255.255.255 eq 22 20 permit tcp 172.16.0.10.8 255.255.255.255 192.168.20.5 255.255.255.255 eq 22 30 deny ip any any b. Add the new access list before the last deny rule IOS(config)#ip access-list extended acl_123 IOS(config-ext-nacl)#21 permit tcp host 192.168.11.8 host 192.168.20.5 eq 22…
Cisco uses RPL (Route Policy Language) while Huawei uses XPL (Extended Route Policy language). Basically they are the same concept but of course the commands are slightly different, though editing the policy or prefix-set requires vi/vim knowlege. Cisco IOS-XR RPL Huawei NE40E XPL Adding Prefix-Set:prefix-set FNT-Prefixes 192.168.0.0/24, 172.16.0.0/23end-set Adding Prefix-Set:xpl ip-prefix-list FNT-Prefixes192.168.0.0 24,172.16.0.0 23end-list Creating Route Policy:route-policy FNT-EXPORT if (destination in FNT-Prefixes) then prepend as-path 65555 2 endifend-policy Creating Route Policy:xpl route-filter FNT-EXPORT if ip route-destination in FNT-Prefixes then …
Here is sample basic IPv4 & IPv6(OSPFv3) Open Shortest Path First (OSPF) configuration between 2 Huawei Routers with MD5 authentication. Fig1. RouterA Configuration: Configure physical interface <RouterA>interface 100GE6/0/0 <RouterA>description Connection to RouterB <RouterA>undo shutdown <RouterA>eth-trunk 1 <RouterA>undo lldp enable <RouterA>undo dcn 2. Configure the Eth-Trunk IPv4/IPv6 address <RouterA>interface Eth-Trunk1 <RouterA>description Eth-Trunk to RouterB <RouterA>ipv6 enable <RouterA>ip address 192.168.10.1 255.255.255.252 <RouterA>ipv6 address fdfe:13bb:8abc:a00:8::2a/127 <RouterA>mode lacp-static 3. Configure the OSPF (IPv4) process (with optional parameters) <RouterA>ospf 8888 router-id 172.16.1.1 <RouterA>bfd all-interfaces min-tx-interval…
Here is sample tutorial on how to configure External Border Gateway Protocol (EBGP) between Huawei Router and another router. I will focus on the configuration of the Huawei router (RouterA). Fig.1.1 Procedure: 1. Configure the Loopback IP address a. Enter system view command: system-view <RouterA>system-view Enter system view, return user view with return command. <RouterA>interface LoopBack0 <RouterA>description RouterA Loopback0 <RouterA>ip address 172.16.1.1 255.255.255.255 <RouterA>quit Verify: <RouterA>display current-configuration interface LoopBack 0 2. Configure the P2P(point to point) IP, we will assume…
General/Overall: admin show inventory chassis admin show inventory all admin show inventory rack admin show environment all admin show environment alarms admin show diag admin show diag chassis admin show hw-module fpd location all admin show environment trace admin show platform admin show platform summary location all show pfm location all show inventory trace error show shelfmgr trace show controllers i2c server trace Power Supply: admin show inventory power-supply admin show power history rack <0-1> admin show diag power-supply…
Objective: To separate management traffic from data/customer traffic in your Huawei Routers Preferably, Data and Management are into 2 separate network domains. Pre-requisite: UTP cables (for each MPU management port in case for switchover) are connected to a network switch to access the OOB management gateway To go configuration mode: system-view To preview configuration change before commiting display configuration candidate * * Management IP Configuration* * a. Configure the vpn instance for management ip vpn-instance <vpn instance name> description <description> ipv4-family b. Set…
Leave a Comment