Example
Assume the following configurations: One MA5616 functions as the NTP active peer (IP address
of the L3 interface of VLAN 2: 10.10.10.10/24) and works on clock stratum 4, the other
MA5616 (IP address: 10.10.10.20/24) functions as the NTP passive peer, the active peer sends
a clock synchronization request packet through the VLAN L3 interface to the passive peer, the
passive peer responds to the request packet, and the peer with a higher clock stratum is
synchronized by the peer with a lower clock stratum. To perform these configurations, do as
follows:
huawei(config)#
ntp-service refclock-master 4
huawei(config)#
ntp-service unicast-peer
huawei(config)#
vlan 2 standard
huawei(config)#
port vlan 2 0/0 0
huawei(config)#
interface vlanif 2
huawei(config-if-vlanif2)#
ip address 10.10.10.10 24
huawei(config-if-vlanif2)#
quit
3.10 Configuring the User Security
Configuring the security mechanism can protect operation users and access users against user
account theft and roaming or from the attacks from malicious users.
Context
The user security mechanism includes:
l
PITP: The purpose of the PITP feature is to provide the user physical location information
for the upper-layer authentication server. After the BRAS obtains the user physical location
information, the BRAS binds the information to the user account for authentication, thus
protecting the user account against theft and roaming.
l
DHCP option82: The user physical location information is added to the option82 field in
the DHCP request sent by the user. The information is used by the upper-layer
authentication server for authenticating the user, thus protecting the user account against
theft and roaming.
l
IP address binding: The IP address of the user is bound to the corresponding service port
for authenticating the user, thus ensuring the security of the authentication.
l
MAC address binding: The MAC address is bound to the service port, thus preventing the
access of illegal users.
l
Anti-MAC spoofing: It is a countermeasure taken by the system to prevent a user from
attacking the system with a forged MAC address.
l
Anti-IP spoofing: It is a countermeasure taken by the system to prevent a user from attacking
the system with a forged IP address.
lists the default settings of the user security mechanism.
Table 3-13
Default settings of the user security mechanism
Parameter
Default Setting
Remarks
PITP
Global function: disabled
VLAN-level function: enabled
The PITP function can be enabled
only when the functions at all
levels are enabled.
SmartAX MA5616 Multi-service Access Module
Configuration Guide
3 Basic Configuration
Issue 04 (2011-10-30)
Huawei Proprietary and Confidential
Copyright © Huawei Technologies Co., Ltd.
79
