Shahed Israr

Shahed Israr is a Network Engineer specializing in GPON, FTTH, and telecom access network technologies. With hands-on experience in Huawei OLT and ONT configuration, U2000 NMS deployment, iMaster NCE-FAN Lite management systems, firmware upgrades, and advanced network troubleshooting, he helps Internet Service Providers (ISPs) and network professionals deploy, manage, and optimize fiber optic networks efficiently. Through GPON Solution, he shares practical technical guides, real-world solutions, and professional knowledge to support engineers working in modern GPON infrastructure.

Configure Selective QinQ in Huawei Switch

October 26, 2015February 2, 2011 by Shahed Israr

How to Configure Selective QinQ in Huawei Switch:

Networking Requirements:
As shown in Figure, common Internet access users (using PCs) and IPTV users (using IPTV terminals) connect to the carrier network through Switch A and Switch B and communicate with each other through the carrier network. [boxads]

It is required that packets of PCs and IPTV terminals are tagged VLAN 2 and VLAN 3 when the packets are transmitted through the carrier network.

Configuration Roadmap:

The configuration roadmap is as follows:

1. Create VLANs on Switch A and Switch B.
2. Configure types of interfaces on Switch A and Switch B, and add the interfaces to corresponding VLANs.
3. Configure selective QinQ on interfaces of Switch A and Switch B.

Configure QinQ Huawei Switch

October 26, 2015February 2, 2011 by Shahed Israr

How to Configure QinQ on Huawei Switch port/interface:

Today I will show how to configure QinQ in Huawei Switch port/interface. As shown in Figure, there are two enterprises on the network, namely, Enterprise 1 and Enterprise 2. Enterprise 1 has two office locations; Enterprise 2 has three office locations. The office locations of the two enterprises access SwitchG or SwitchF of the ISP network.

[boxads]

The network of Enterprise 1 is divided into VLAN 1000 to VLAN 1500; the network of Enterprise 2 is divided into VLAN 2000 to VLAN 3000. It is required that employees in the same VLAN can communicate with each other through the ISP network but the two enterprises are isolated from each other.

Networking diagram for QinQ on Huawei switch

Configuration Roadmap:

The configuration roadmap is as follows:

1. Create VLAN 10 and VLAN 20 on SwitchF; create VLAN 20 on SwitchG.
2. Configure GE 1/0/1, GE 2/0/1, and GE 3/0/1 of SwitchF as QinQ interfaces.
3. Configure GE 1/0/1 and GE 2/0/1 of SwitchG as QinQ interfaces.
4. Add GE 4/0/1 of SwitchF and GE 3/0/1 of SwitchG to VLAN 20 in tagged mode.

Cisco Switch VLAN Security

October 30, 2015February 2, 2011 by Shahed Israr

Cisco Switch VLAN Security

Today I will discuss about Cisco Switch VLAN Security issue. A Virtual Local Area Network (VLAN) is a broadcast domain. All members of a VLAN receive every broadcast packet sent by members of the same VLAN, but they do not receive packets sent by members of a different VLAN. All members of a VLAN are grouped logically into the same broadcast domain independent of their physical location. Adding, moving or changing members is achieved via software within a switch. Routing is required for communication among members of different VLANs.[boxads]

The next subsections describe the vulnerabilities and corresponding counter measures for the following areas: VLAN 1, Private VLAN, VTP, Trunk Auto-Negotiation, VLAN Hopping and Dynamic VLAN Assignment.

1. VLAN1

Cisco switches use VLAN 1 as the default VLAN to assign to their ports, including their management ports. Additionally, Layer 2 protocols, such as CDP and VTP, need to be sent on a specific VLAN on trunk links, so VLAN 1 was selected. In some cases, VLAN 1 may span the entire network if not appropriately pruned. It also provides attackers easier access and extended reach for their attacks.

Do not use VLAN 1 for either out-of-band management or in-band management.

To provide out-of-band management that separates management traffic from user traffic, use the following VLAN Security commands as an example.

Create the out-of-band management VLAN.

Switch(config)# vlan 6
Switch(config-vlan)# name ADMINISTRATION-VLAN

Create a management IP address and restrict access to it. Also, enable the interface.
Switch(config)# no access-list 10
Switch(config)# access-list 10 permit 10.1.6.1
Switch(config)# access-list 10 permit 10.1.6.2
Switch(config)# interface vlan 6
Switch(config-if)# description ADMIN-VLAN
Switch(config-if)# ip address 10.1.6.121 255.255.255.0
Switch(config-if)# ip access-group 10 in
Switch(config-if)# no shutdown

Cisco Switch System Availability

October 30, 2015February 1, 2011 by Shahed Israr

Cisco Switch System Availability

Today I will discuss about Cisco Switch System Availability issue. Many attacks exist and more are being created that cause denial of service (DoS), either partially or completely, to systems or networks. Switches are just as susceptible to these attacks. These attacks focus on making resources (e.g., system processor, bandwidth) unavailable. [boxads]

The following counter measures will mitigate the vulnerabilities to system availability on each switch:

To prevent fast flooding attacks and to guarantee that even the lowest priority processes get some processor time use the scheduler interval command. The following Cisco Switch System Availability example sets the maximum time before running the lowest priority process to 500 milliseconds access.

Switch(config)# scheduler interval 500

Another way to guarantee processor time for processes is to use the scheduler allocate command. This command sets the interrupt time and the process time.

The following Cisco Switch System Availability example makes 10 percent of the processor available for process tasks, with an interrupt time of 4000 microseconds and a process time of 400 microseconds.

Switch(config)# scheduler allocate 4000 400

Configure Eth-Trunk on Huawei Switch

October 26, 2015January 30, 2011 by Shahed Israr

How to configure Eth-Trunk on Huawei Switch port/interface:

Today i will show you how to configure Eth-Trunk on Huawei Switch port/interface.
Here i use one side GigabitEthernet 0/0/15 & 0/0/16 interface & other side GigabitEthernet 0/0/2 & 0/0/3, And Eth-Trunk 10. [boxads]

Step-1: At first login your switch & go to system-view mode & follow bellow configuration.

<HUAWEI> system-view
[HUAWEI]interface Eth-Trunk 10
[HUAWEI-Eth-Trunk10]port link-type trunk
[HUAWEI-Eth-Trunk10]port trunk allow-pass vlan xxx xxx xxx xx
[HUAWEI-Eth-Trunk10]quit
[HUAWEI]

[Here xxx is your desired VLAN]

Step-2: Now go to interface mode & add eth-trunk 10, And follow bellow configuration.

HSRP Tuning Example

October 30, 2015January 25, 2011 by Shahed Israr

HSRP Tuning Example

Today I will discuss about HSRP Tuning. As you see in the article “HSRP (Hot Standby Router Protocol)”, it is quite simple configure Hot Standby Router Protocol. [boxads]
Some cases require a custom configuration, using priority, track, preempt etc…and these are:

The standby preempt interface configuration command allows the router to become the active router when its priority is higher than all other HSRP-configured routers in this Hot Standby group. The configurations of both routers include this command so that each router can be the standby router for the other router. If you do not use the standby preempt command in the configuration for a router, that router cannot become the active router.
The standby priority interface configuration command sets the router’s HSRP priority (the default priority is 100).
The standby timers interface configuration command sets the interval in seconds between hello messages (called the hello time) to five seconds and sets the duration in seconds that a router waits before it declares the active router to be down (called the hold time) to eight seconds. (The defaults are three and 10 seconds, respectively.) If you decide to modify the default values, you must configure each router to use the same hello time and hold time.
The standby track command allows you to specify another interface on the router for the HSRP process to monitor in order to alter the HSRP priority for a given group. If the line protocol of the specified interface goes down, the HSRP priority is reduced. This means that another HSRP router with higher priority can become the active router if that router has standby preempt enabled.
The standby authentication interface configuration command establishes an authentication string whose value is an unencrypted eight-character string that is incorporated in each HSRP multicast message. This command is optional. If you choose to use it, each HSRP-configured router in the group should use the same string so that each router can authenticate the source of the HSRP messages that it receives.

Suppose to have this physical configuration: