Configuring a Layer-3 Eth-Trunk Interface

Procedure

1. Access the system view.

   system-view

2. Create an Eth-Trunk interface and access the Eth-Trunk interface view.

   interface eth-trunk trunk-id

3. Configure an IP address for the Eth-Trunk interface.

   • Configure an IPv4 address for the Eth-Trunk interface.

     To configure an IPv4 address for the Eth-Trunk interface, run the ip address ip-address { mask | mask-length } [ sub ] command.

   • Configure an IPv6 address for the Eth-Trunk interface.

     Configure an IPv6 address for the Eth-Trunk interface based on actual situations:

     • To configure an automatic link-local address for the interface, run the ipv6 address auto link-local command.
     • To configure a link-local address for the interface, run the ipv6 address ipv6-address link-local command.
     • To configure a global unicast address for the interface, run the ipv6 address { ipv6-address | prefix-length } command.
     • To configure an IPv6 address in the EUI-64 format for the interface, run the ipv6 address ipv6-address/prefix-length [ eui-64 ] command.

4. Optional: Configure a MAC address for the Eth-Trunk interface.

   mac-address mac-address

   If the FW has multiple Layer-3 Eth-Trunk interfaces directly connected to Layer-2 interfaces of switches, change the MAC addresses of the Layer-3 Eth-Trunk interfaces to ensure that return packets sent from the switches are forwarded to correct Layer-3 Eth-Trunk interfaces.

   

   The mac-address command can be used only on the Eth-Trunk interface that works in Layer-3 mode.

   If an Eth-Trunk interface has a large number of Eth-Trunk sub-interfaces, changing the MAC address of the Eth-Trunk interface causes the local device to send a large number of gratuitous ARP packets to the peer device. If CPCAR is configured on the peer device, increase the bandwidth for transmitting gratuitous ARP packets, which prevents gratuitous ARP packets from being discarded.

5. Optional: Configure an MTU for the Eth-Trunk interface.

   • Configure an IPv4 MTU for the Eth-Trunk sub-interface.

     To configure an IPv4 MTU for the interface, run the mtu mtu command.

     The MTU is expressed in bytes. The default value is 1500.

     

     • The mtu mtu command cannot be used on Layer-2 Eth-Trunk interfaces.

     • The same MTU must be set for two directly connected interfaces. To use the mtu command to change the MTU of an interface, ensure that the MTUs on both ends are the same. Otherwise, services may be interrupted.

     • If you run the mtu command to change the MTU to be smaller than 1280 bytes for the Eth-Trunk interface running IPv6, IPv6 cannot properly run on the interface. When IPv6 runs on an Eth-Trunk interface, set the MTU to be greater than or equal to 1280 for the interface.

   • Configure an IPv6 MTU for the Eth-Trunk sub-interface.

     1. To enable IPv6 for the interface, run the ipv6 enable command

     2. To configure an IPv6 MTU for the interface, run the ipv6 mtu mtu command.

6. Optional: Configure the automatic interface disabling function based on the session usage.
   • In the system view, run the firewall exceeded session enable command to configure the function that the interface is automatically disabled when the session usage reaches the threshold.
   • In the system view, run the firewall exceeded session shutdown interface command to configure the list of interfaces that need to be disabled when the session usage reaches the threshold.
   • In the system view, run the snmp-agent session trap threshold command to configure the session usage threshold that triggers the interface to be automatically disabled.

7. Optional: Configure the automatic interface disabling function based on the CPU usage.
   • In the system view, run the firewall exceeded cpu-usage enable command to configure the function that the interface is automatically disabled when the CPU usage reaches the threshold.
   • In the system view, run the firewall exceeded cpu-usage shutdown interface command to configure the list of interfaces that need to be disabled when the CPU usage reaches the threshold.
   • In the system view, run the firewall exceeded cpu-usage threshold command to configure the CPU usage threshold that triggers the interface to be automatically disabled.

8. Optional: Configure the sticky load balancing function.

   redirect-reverse next-hop ipv4-address [ per-packet ]
   ipv6 redirect-reverse next-hop ipv6-address [ per-packet ]

   After this command is configured, the FW directly uses the inbound interface as the outbound interface of the response packet when forwarding the response packet, instead of searching the routing table for an outbound interface.