SMA commands -- display sma-anti-spoof ipv6 address-prefix

Use display sma-anti-spoof ipv6 address-prefix to display IPv6 prefix information for all ASs.

Syntax

display sma-anti-spoof ipv6 address-prefix

Views

Any view

Predefined user roles

network-admin

network-operator

mdc-admin

mdc-operator

Examples

# Display IPv6 prefix information for all ASs.

<Sysname> display sma-anti-spoof ipv6 address-prefix

Alliance number: 1 AS number: 10

IPv6 prefix Effecting time

AA:AA::/64 May 1 14:12:49 2009

AA:AA::AA:AB/128 May 1 14:12:49 2009

Alliance number: 1 AS number: 11

IPv6 prefix Effecting time

BB:BB::/64 May 1 14:02:49 2009(i)

Table 1 Command output

Field | Description
Alliance number | Trust alliance ID.
IPv6 prefix | IPv6 prefix list of the AS.
Effecting time | Time when the IPv6 prefix starts to take effect. Letter i in the round brackets indicates that the prefix takes effect immediately when the AER receives the prefix.

SMA commands -- display sma-anti-spoof ipv6 packet-tag

Use display sma-anti-spoof ipv6 packet-tag to display SMA tag information for all AS pairs.

Syntax

display sma-anti-spoof ipv6 packet-tag

Views

Any view

Predefined user roles

network-admin

network-operator

mdc-admin

mdc-operator

Examples

# Display SMA tag information for all AS pairs.

<Sysname> display sma-anti-spoof ipv6 packet-tag

Alliance number: 1

Source AS number: 10 Destination AS number: 11

State machine ID: 100 Tag: 0xABCD

Effecting time: May 1 14:12:49 2009(i) Transition interval: 10s

Source AS number: 11 Destination AS number: 10

State machine ID: 101 Tag: 0xCDEF

Effecting time: May 1 14:02:49 2009 Transition interval: 12s

Table 2 Command output

Field | Description
Alliance number | Trust alliance ID.
Tag | SMA tag, a binary number of up to 128 bits, displayed in hexadecimal format. For example, 0xABCD.
Effecting time | Time when the tag starts to take effect. Letter i in the round brackets indicates that the tag takes effect immediately when the AER receives the tag.
Transition interval | Tag aging timer in seconds. The tag ages out after the timer expires.

SMA commands -- sma-anti-spoof ipv6 enable

Use sma-anti-spoof ipv6 enable to enable SMA.

Use undo sma-anti-spoof ipv6 enable to disable SMA.

Syntax

sma-anti-spoof ipv6 enable

undo sma-anti-spoof ipv6 enable

Default

SMA is disabled.

Views

System view

Predefined user roles

network-admin

mdc-admin

Usage guidelines

You must enable SMA for all SMA configurations to take effect.

Examples

# Enable SMA.

<Sysname> system-view

[Sysname] sma-anti-spoof ipv6 enable

Related commands

sma-anti-spoof ipv6 server

SMA commands -- sma-anti-spoof ipv6 port-type

Use sma-anti-spoof ipv6 port-type to configure an SMA interface type.

Use undo sma-anti-spoof ipv6 port-type to restore the default.

Syntax

sma-anti-spoof ipv6 port-type { egress | ingress }

undo sma-anti-spoof ipv6 port-type

Default

An interface is not an SMA interface and does not perform SMA.

Views

Layer 3 interface view

Predefined user roles

network-admin

network-operator

Parameters

egress: Configures an interface as an SMA egress interface.

ingress: Configures an interface as an SMA ingress interface.

Usage guidelines

To ensure correct packet classification, tag adding, tag checking, and packet forwarding, you must configure the SMA interface type. SMA interfaces include the following types:

· Ingress interface—Connected to an SMA-disabled router in the local AS.

· Egress interface—Connected to an AER in other member AS.

Examples

# Configure GigabitEthernet 1/0/1 as an SMA ingress interface. (Applicable to routers.)

<Sysname> system-view

[Sysname] interface gigabitethernet 1/0/1

[Sysname-GigabitEthernet1/0/1] sma-anti-spoof ipv6 port-type ingress

# Configure VLAN-interface 200 as an SMA egress interface. (Applicable to switches.)

<Sysname> system-view

[Sysname] interface vlan-interface 200

[Sysname-Vlan-interface200] sma-anti-spoof ipv6 port-type egress

Related commands

sma-anti-spoof ipv6 enable

SMA commands -- sma-anti-spoof ipv6 server

Use sma-anti-spoof ipv6 server to configure an SSL link between an AER and its ACS.

Use undo sma-anti-spoof ipv6 server to restore the default.

Syntax

sma-anti-spoof ipv6 server ipv6-address ssl-client-policy policy-name

undo sma-anti-spoof ipv6 server

Default

No SSL link is configured between an AER and its ACS.

Views

System view

Predefined user roles

network-admin

mdc-admin

Parameters

ipv6-address: Specifies the ACS IPv6 address.

ssl-client-policy policy-name: Specifies an existing SSL client policy by its name, a case-insensitive string of 1 to 31 characters.

Usage guidelines

Use the sma-anti-spoof ipv6 enable command to enable SMA before you use this command to configure an SSL link between an AER and its ACS. If you specify a nonexistent SSL client policy, the SSL link between the AER and ACS cannot be established.

Examples

# Configure the AER to establish an SSL link with the ACS at 1::1 by using SSL client policy ssl.

<Sysname> system-view

[Sysname] sma-anti-spoof ipv6 server 1::1 ssl-client-policy ssl

Related commands

sma-anti-spoof ipv6 enable