Context
In link aggregation, multiple uplink Ethernet ports are aggregated into a group to increase
bandwidth and reliability of uplinks of the OLT. You are advised to configure link aggregation.
Congestion control queues packets from one port into multiple queues and schedules the packets
based on queue priorities. You are advised to configure congestion control.
Security policy involves system security, user security, and service security, ensuring service
security from different aspects.
NOTE
l
You are advised to enable the service security feature according to service types. For details, see
Principle of Security Data Plan
.
l
The configuration of the system security, user security, and service security introduced in this topic is on
the OLT side. The configuration on the ONU side is through the web and is simple, here we do not introduced
it.
Procedure
l
Configure link aggregation.
On the OLT side, configure upstream ports 0/19/0 and 0/19/1 as an aggregation group. Each
member port in the aggregation group is allocated packets based on the source MAC
address. The working mode is LACP static aggregation.
huawei(config)#
link-aggregation 0/19 0-1 ingress workmode lacp-static
l
Configure queue scheduling(On the OLT side).
According to "
12.2.2 Principle of QoS Planning
", all packets are scheduled in strict
priority queue mode and mapped into different queues based on priorities.
huawei(config)#
queue-scheduler strict-priority
huawei(config)#
cos-queue-map cos0 0 cos4 4 cos5 5 cos6 6
l
Configure system security.
–
Enable deny of service (DoS) anti-attack on the OLT.
1.
Run the
security anti-dos enable
command to globally enable DoS anti-attack.
2.
Run the
security anti-dos control-packet policy
command to configure a
protocol packet processing policy that will be used when a DoS attack occurs.
3.
Run the
security anti-dos control-packet rate
command to configure the
threshold for the rate of sending protocol packets to the CPU.
–
Enable IP address anti-attack on the OLT.
Run the
security anti-ipattack enable
command to enable IP address anti-attack.
l
Configure user security.
–
Enable MAC address anti-flapping on the OLT.
Run the
security anti-macduplicate enable
command to enable MAC address anti-
flapping.
–
Enable MAC address anti-spoofing on the OLT.
1.
In global config mode, run the
security anti-macspoofing enable
command to
globally enable MAC address anti-spoofing.
2.
Enable MAC address anti-spoofing at VLAN level in global config mode or
service profile mode:
SmartAX MA5600T/MA5603T/MA5608T Multi-service
Access Module
Commissioning and Configuration Guide
12 FTTO Configuration(SOHO and SME)
Issue 01 (2014-04-30)
Huawei Proprietary and Confidential
Copyright © Huawei Technologies Co., Ltd.
1136
