ZXR102900ESeriesConīægurationGuide
zte(cfg)#setarp-inspectionvlan1enable
zte(cfg)#setarp-inspectionport49untrust
zte(cfg)#setarp-inspectionport49limit15
zte(cfg)#setarp-inspectionvalidateipenable
zte(cfg)#setarp-inspectionvalidatedst-macenable
zte(cfg)#setarp-inspectionvalidatesrc-macenable
Note:
DAIdetectioncondition:theportsentisnon-trustedport,DAIfunctionisenabledon
theVLAN.WhenDHCPSnoopingisenabledandnon-trustedportisaddedintoDHCP
Snooping,DAIdetectionisvalid.
lConīægurationVeriīæcation
zte(cfg)#showarp-inspection
Enabledvalidation:ip,dst-mac,src-mac
Enabledvlanlist:1
PortIdTrustTypeLimit(pps)
-------------------------
49Untrust15
50Trust-
51Trust-
52Trust-
4.19AccessServiceConīguration
AccessServiceOverview
WiththerapidexpansionofEthernetconstructionscale,tomeetthefastincreaseof
subscribersandrequirementofdiversiīæedbroadbandservices,NetworkAccessService
(NAS)isembeddedontheswitchtoimprovetheauthenticationandmanagementof
accesssubscribersandbettersupportthebilling,security,operation,andmanagement
ofthebroadbandnetwork.
NASusesthe802.1xprotocolandRADIUSprotocoltorealizetheauthenticationand
managementofaccesssubscribers.Itishighlyefīæcient,safe,andeasytooperate.
IEEE802.1xiscalledport-basednetworkaccesscontrolprotocol.Itsprotocolsystem
includesthreekeyparts:clientsystem,authenticationsystem,andauthenticationserver.
lTheclientsystemisgenerallyauserterminalsysteminstalledwiththeclientsoftware.
AsubscriberoriginatestheIEEE802.1xprotocolauthenticationprocessthroughthis
clientsoftware.Tosupporttheport-basednetworkaccesscontrol,theclientsystem
mustsupporttheExtensibleAuthenticationProtocolOverLAN(EAPOL).
4-66
SJ-20120409144109-002|2012-07-02(R1.0)ZTEProprietaryandConīædential