Configuring a Layer-2 Ethernet Interface

Basic Layer-2 Ethernet Interface Configuration

1. Display the system view.

   system-view

2. Display the specified interface view.

   interface interface-type interface-number

3. Switch the Layer-3 Ethernet interface to Layer-2 mode.

   portswitch

   An Ethernet interface works at Layer-3 by default. To use the Layer-3 Ethernet interface as a Layer-2 interface, switch the Ethernet interface to Layer-2 mode.

   When a Layer-3 Ethernet interface is configured to work in Layer-2 mode, the device automatically clears specific configurations, such as, DHCP, DDNS, and route configurations of the interface and retains specific configurations, such as HRP heartbeat interface configurations of the interface. If the interface is specified as a heartbeat interface, the interface cannot be configured to work in Layer-2 mode. Therefore, before you configure a Layer-3 Ethernet interface to work in Layer-2 mode, ensure that the interface has no configuration.

   To switch Layer-3 Ethernet interfaces to Layer-2 mode in a batch, run the portswitch batch interface-type { interface-number1 [ to interface-number2 ] } &<1-10> command in the system view.

   By default, a Layer-2 Ethernet interface belongs to VLAN 1 and works as a hybrid port.

   

   If the interfaces work at Layer 2 and IPv6 needs to be processed on FW, you need to run the ipv6 command to enable the global IPv6 function.

4. Optional: Enable the bypass detection function on the interface.

   detect-mode tap

   After bypass detection is enabled, the device detects packets received on this interface and then discards them.

5. Optional: Disable an interface from working in auto-negotiation mode.

   undo negotiation auto

   Only MEth, GE, 10GE, and WAN interfaces support this command. A 10GE interface supports this command only when it has a GE optical module installed.

   By default, an interface works in auto-negotiation mode.

   To set parameters duplex and speed to adjust the duplex mode and rate of an interface, run the undo negotiation auto command to disable the interface from working in auto-negotiation mode.

6. Optional: Specify a duplex mode.

   duplex { full | half | auto }

   Only MEth, GE, and WAN interfaces support this command.

7. Optional: Set a working rate.

   speed { 10 | 100 | 1000 }

   Only MEth, GE, and WAN interfaces support this command.

8. Optional: Configure an interface description.

   description interface-description

9. Optional: Specify the alias for an interface.

   alias alias

10. Optional: Set the maximum bandwidth for upstream traffic on the interface.

    bandwidth ingress bandwidth-number

11. Optional: Set the maximum bandwidth for downstream traffic on the interface.

    bandwidth egress bandwidth-number

Advanced Layer-2 Ethernet Interface Configuration

• Configure traffic suppression on an Ethernet interface.
  

  For broadcast traffic suppression and multicast traffic suppression based on packet rates, the granularity of parameter max-pps is 125. For example, if you set max-pps to 5, the actual value is 125. If you set max-pps to 126, the actual value is 250. The rest can be done in the same manner.

  The mode of broadcast traffic suppression and multicast traffic suppression of all interfaces on the same LPU must be the same. For example, if traffic suppression based on packet rates is configured for interface GigabitEthernet 0/0/1, you cannot configure traffic suppression based on suppression ratio for interface GigabitEthernet 0/0/2.

  • Configure broadcast traffic suppression.broadcast-suppression { ratio | pps max-pps }
  • Configure multicast traffic suppression.multicast-suppression { ratio | pps max-pps }
• Enable loopback.

  loopback

  When an interface is working properly, disable loopback. By default, loopback is disabled.

• Interface mode switching

  • In the system view, run theset device port-config-mode 100g-port enablecommand to enable the 100GE interface mode.

    Only the USG6712E/6716E supports this command.

    By default, the 100GE interface mode is disabled. If 100GE interfaces are required, run the set device port-config-mode 100g-port enable command to enable 100GE0/0/0 and 100GE0/0/1.100GE0/0/0 and 100GE0/0/1 are valid. In this case, XGE0/0/12 to XGE0/0/19, 40GE0/0/2, and 40GE0/0/3 become invalid.

  • In the system view, run the set device port-config-mode 40g-port enablecommand to enable the 40GE interface mode.

    Only the USG6680E supports this command.

    By default, the 40GE interface mode is disabled. XGE0/0/20 to XGE0/0/27, 40GE0/0/0, are valid. If more 40GE interfaces are required, run the set device port-config-mode 40g-port enable command to add 40GE0/0/2 and 40GE0/0/3. In this case, XGE0/0/20 to XGE0/0/27 become invalid.

  • In the system view, run the set device port-config-mode [ 10ge | ge ] command to configure the interface mode.

    Only the USG6525E/6555E/6565E/6585E support this command.

    By default, the interface mode is 10GE.

Follow-up Procedure

1. Configure the automatic interface disabling function based on the session usage.
   • In the system view, run the firewall exceeded session enable command to configure the function that the interface is automatically disabled when the session usage reaches the threshold.
   • In the system view, run the firewall exceeded session shutdown interface command to configure the list of interfaces that need to be disabled when the session usage reaches the threshold.
   • In the system view, run the snmp-agent session trap threshold command to configure the session usage threshold that triggers the interface to be automatically disabled.

2. Configure the automatic interface disabling function based on the CPU usage.
   • In the system view, run the firewall exceeded cpu-usage enable command to configure the function that the interface is automatically disabled when the CPU usage reaches the threshold.
   • In the system view, run the firewall exceeded cpu-usage shutdown interface command to configure the list of interfaces that need to be disabled when the CPU usage reaches the threshold.
   • In the system view, run the firewall exceeded cpu-usage threshold command to configure the CPU usage threshold that triggers the interface to be automatically disabled.