1.5 Procedure
Step 1 On switche 1 and switch 2: Configure CSSs.
1. Connect CSS cards through cables.
In the following figure, the S12700 switches have the CSS cards EH1D2VS08000 installed. An S12700 has a maximum number of MPUs, SFUs, and CSS cards installed. Each chassis must have at least one MPU and one SFU installed. You are advised to install two SFUs and two CSS cards in each chassis.
Figure 1-1 CSS card connections
![[All About Switches] 1 Example for Configuring the Egress of a Large-scale Campu-1666293-2](https://forum.huawei.com/enterprise/en/huawei/static/image/lazy_loading.gif)
l The two chassis are connected by at least one CSS cable.
l One CSS card can only be connected to one CSS card in the other chassis but not the local chassis.
l An interface in group 1 of a CSS card can only be connected to any interface in group 1 of the CSS card on the other chassis. The requirements for interfaces in group 2 are the same.
l CSS cards have the same number of cluster cables connected. (If the CSS cards have different numbers of cluster cables connected, the total cluster bandwidth depends on the cluster with the least cluster cables connected.) In addition, interfaces on CSS cards are connected based on interface numbers.
2. Configure clustering on Switch 1.
# Set the cluster mode to CSS card (the default value does not need to be configured). Retain the default cluster ID 1 (the default value does not need to be configured) and set the priority to 100.
<HUAWEI> system-view
[HUAWEI] set css mode css-card //Default setting. You do not need to run this command. The step is used for reference.
[HUAWEI] set css id 1 //Default setting. You do not need to run this command. The step is used for reference.
[HUAWEI] set css priority 100 //The default CSS priority is 1. Change the priority of the master switch to be higher than that of the backup switch.
[HUAWEI] css enable
Warning: The CSS configuration takes effect only after the system is rebooted. The next CSS mode is CSS-card. Reboot now? [Y/N]:y//Restart the switch.
3. Configure clustering on Switch 2.
Set the cluster mode to CSS card (the default value does not need to be configured). Set the CSS ID to 2 and retain the default priority 1 (the default value does not need to be configured).
<HUAWEI> system-view
[HUAWEI] set css id 2 //The default CSS ID is 1. Change the CSS ID to 2.
[HUAWEI] css enable
Warning: The CSS configuration takes effect only after the system is rebooted. The next CSS mode is CSS-card. Reboot now? [Y/N]:y//Restart the switch.
4. Check the CSS status after the switches restart.
− On Switch 1, the active switch of the CSS, the MASTER indicator on the active MPU is steady green. (Figure 1)
− On Switch 1, the CSS ID indicators numbered 1 on both MPUs are steady green. On Switch2, the CSS ID indicators numbered 2 on both MPUs are steady green. (Figure 1)
− The LINK/ALM indicators of interfaces on all CSS cards connected to cluster cables are steady green. (Figure 2)
− The MASTER indicators on all CSS cards in the active chassis are steady green, and the MASTER indicators on all CSS cards in the standby chassis are off. (Figure 2)
![[All About Switches] 1 Example for Configuring the Egress of a Large-scale Campu-1666293-4](https://forum.huawei.com/enterprise/en/huawei/static/image/lazy_loading.gif)
l After the CSS is established, subsequent operations will be performed on the master switch (switch 1) and data will be automatically synchronized to the standby switch (switch 2).
l The interface name in a CSS is in the format like 10GE1/4/0/0. The leftmost part indicates the CSS ID.
Step 2 On switch 1: Configure the inter-chassis Eth-Trunks between CSS and FWs and between CSS and routers. Configure VLANIF interfaces on the CSS and assign IP addresses to them.
1. Configure an inter-chassis Eth-Trunk between switches and routers. Configure VLANIF interfaces and assign IP addresses to them.
# In the CSS, create Eth-Trunk1 to connect to Router1 and add member interfaces to Eth-Trunk1.
<HUAWEI> system-view
[HUAWEI] sysname CSS //Rename the CSS.
[CSS] interface Eth-Trunk 1
[CSS-Eth-Trunk1] quit
[CSS] interface XGigabitethernet 1/4/0/0 //Add an interface on the master switch to Eth-Trunk1.
[CSS-XGigabitEthernet1/4/0/0] Eth-Trunk 1
[CSS-XGigabitEthernet1/4/0/0] quit
[CSS] interface XGigabitethernet 2/4/0/0 //Add an interface on the backup switch to Eth-Trunk1.
[CSS-XGigabitEthernet2/4/0/0] Eth-Trunk 1
[CSS-XGigabitEthernet2/4/0/0] quit
# In the CSS, create Eth-Trunk2 to connect to Router2 and add member interfaces to Eth-Trunk2.
[CSS] interface Eth-Trunk 2
[CSS-Eth-Trunk2] quit
[CSS] interface XGigabitethernet 1/4/0/1 //Add an interface on the master switch to Eth-Trunk2.
[CSS-XGigabitEthernet1/4/0/1] Eth-Trunk 2
[CSS-XGigabitEthernet1/4/0/1] quit
[CSS] interface XGigabitethernet 2/4/0/1 //Add an interface on the backup switch to Eth-Trunk2.
[CSS-XGigabitEthernet2/4/0/1] Eth-Trunk 2
[CSS-XGigabitEthernet2/4/0/1] quit
# Create VLANIF interfaces and assign IP addresses to them.
[CSS] vlan batch 10
[CSS] interface Eth-Trunk 1 //Add Eth-Trunk1 to VLAN 10.
[CSS-Eth-Trunk1] port link-type trunk
[CSS-Eth-Trunk1] port trunk allow-pass vlan 10
[CSS-Eth-Trunk1] quit
[CSS] interface Eth-Trunk 2 //Add Eth-Trunk2 to VLAN 10.
[CSS-Eth-Trunk2] port link-type trunk
[CSS-Eth-Trunk2] port trunk allow-pass vlan 10
[CSS-Eth-Trunk2] quit
[CSS] interface Vlanif 10 //Create VLANIF 10 for the CSS to communicate with Router1 and Router2.
[CSS-Vlanif10] ip address 10.10.4.1 24
[CSS-Vlanif10] quit
2. Configure the inter-chassis Eth-Trunks between switches and FWs and between CSS and routers. Configure VLANIF interfaces on the CSS and assign IP addresses to them.
# In the CSS, create Eth-Trunk4 to connect Public to FW1 and add member interfaces to Eth-Trunk4.
[CSS] interface Eth-Trunk 4
[CSS-Eth-Trunk4] quit
[CSS] interface Gigabitethernet 1/1/0/7 //Add an interface on the master switch to Eth-Trunk4.
[CSS-Gigabitethernet1/1/0/7] Eth-Trunk 4
[CSS-Gigabitethernet1/1/0/7] quit
[CSS] interface Gigabitethernet 2/1/0/7 //Add an interface on the backup switch to Eth-Trunk4.
[CSS-Gigabitethernet2/1/0/7] Eth-Trunk 4
[CSS-Gigabitethernet2/1/0/7] quit
# In the CSS, create Eth-Trunk5 to connect VRF-A to FW1 and add member interfaces to Eth-Trunk5.
[CSS] interface Eth-Trunk 5
[CSS-Eth-Trunk5] quit
[CSS] interface Gigabitethernet 1/1/0/8 //Add an interface on the master switch to Eth-Trunk5.
[CSS-Gigabitethernet1/1/0/8] Eth-Trunk 5
[CSS-Gigabitethernet1/1/0/8] quit
[CSS] interface Gigabitethernet 2/1/0/8 //Add an interface on the backup switch to Eth-Trunk5.
[CSS-Gigabitethernet2/1/0/8] Eth-Trunk 5
[CSS-Gigabitethernet2/1/0/8] quit
# In the CSS, create Eth-Trunk6 to connect Public to FW2 and add member interfaces to Eth-Trunk6.
[CSS] interface Eth-Trunk 6
[CSS-Eth-Trunk6] quit
[CSS] interface Gigabitethernet 1/2/0/7 //Add an interface on the master switch to Eth-Trunk6.
[CSS-Gigabitethernet1/2/0/7] Eth-Trunk 6
[CSS-Gigabitethernet1/2/0/7] quit
[CSS] interface Gigabitethernet 2/2/0/7 //Add an interface on the backup switch to Eth-Trunk6.
[CSS-Gigabitethernet2/2/0/7] Eth-Trunk 6
[CSS-Gigabitethernet2/2/0/7] quit
# In the CSS, create Eth-Trunk7 to connect VRF-A to FW2 and add member interfaces to Eth-Trunk7.
[CSS] interface Eth-Trunk 7
[CSS-Eth-Trunk7] quit
[CSS] interface Gigabitethernet 1/2/0/8 //Add an interface on the master switch to Eth-Trunk7.
[CSS-Gigabitethernet1/2/0/8] Eth-Trunk 7
[CSS-Gigabitethernet1/2/0/8] quit
[CSS] interface Gigabitethernet 2/2/0/8 //Add an interface on the backup switch to Eth-Trunk7.
[CSS-Gigabitethernet2/2/0/8] Eth-Trunk 7
[CSS-Gigabitethernet2/2/0/8] quit
# Create VLANIF interfaces and assign IP addresses to them.
[CSS] vlan batch 20 30
[CSS] interface Eth-Trunk 4 //Add Eth-Trunk4 to VLAN 20.
[CSS-Eth-Trunk4] port link-type trunk
[CSS-Eth-Trunk4] port trunk allow-pass vlan 20
[CSS-Eth-Trunk4] quit
[CSS] interface Eth-Trunk 6 //Add Eth-Trunk6 to VLAN 20.
[CSS-Eth-Trunk6] port link-type trunk
[CSS-Eth-Trunk6] port trunk allow-pass vlan 20
[CSS-Eth-Trunk6] quit
[CSS] interface Vlanif 20 //Create VLANIF 20 for Public to connect to FW1 and FW2.
[CSS-Vlanif20] ip address 10.10.2.1 24
[CSS-Vlanif20] quit
[CSS] interface Eth-Trunk 5 //Add Eth-Trunk5 to VLAN 30.
[CSS-Eth-Trunk5] port link-type trunk
[CSS-Eth-Trunk5] port trunk allow-pass vlan 30
[CSS-Eth-Trunk5] quit
[CSS] interface Eth-Trunk 7 //Add Eth-Trunk7 to VLAN 30.
[CSS-Eth-Trunk7] port link-type trunk
[CSS-Eth-Trunk7] port trunk allow-pass vlan 30
[CSS-Eth-Trunk7] quit
[CSS] interface Vlanif 30 //Create VLANIF 30 for VRF-A to connect to FW1 and FW2.
[CSS-Vlanif30] ip address 10.10.3.1 24
[CSS-Vlanif30] quit
3. Configure inter-chassis Eth-Trunks between switches and service networks. Configure VLANIF interfaces and assign IP addresses to them.
# In the CSS, create Eth-Trunk8 to connect to service network 1 and add member interfaces to Eth-Trunk8.
[CSS] interface Eth-Trunk 8
[CSS-Eth-Trunk8] quit
[CSS] interface Gigabitethernet 1/3/0/1 //Add an interface on the master switch to Eth-Trunk8.
[CSS-Gigabitethernet1/3/0/1] Eth-Trunk 8
[CSS-Gigabitethernet1/3/0/1] quit
[CSS] interface Gigabitethernet 2/3/0/1 //Add an interface on the backup switch to Eth-Trunk8.
[CSS-Gigabitethernet2/3/0/1] Eth-Trunk 8
[CSS-Gigabitethernet2/3/0/1] quit
# In the CSS, create Eth-Trunk9 to connect to service network 2 and add member interfaces to Eth-Trunk9.
[CSS] interface Eth-Trunk 9
[CSS-Eth-Trunk9] quit
[CSS] interface Gigabitethernet 1/3/0/2 //Add an interface on the master switch to Eth-Trunk9.
[CSS-Gigabitethernet1/3/0/2] Eth-Trunk 9
[CSS-Gigabitethernet1/3/0/2] quit
[CSS] interface Gigabitethernet 2/3/0/2 //Add an interface on the backup switch to Eth-Trunk9.
[CSS-Gigabitethernet2/3/0/2] Eth-Trunk 9
[CSS-Gigabitethernet2/3/0/2] quit
# Create VLANIF interfaces and assign IP addresses to them.
[CSS] vlan batch 100 200
[CSS] interface Eth-Trunk 8 //Add Eth-Trunk8 to VLAN 100.
[CSS-Eth-Trunk8] port link-type trunk
[CSS-Eth-Trunk8] port trunk allow-pass vlan 100
[CSS-Eth-Trunk8] quit
[CSS] interface Vlanif 100 //Create VLANIF 100 for CSS to connect to service network 1.
[CSS-Vlanif100] ip address 10.10.100.1 24
[CSS-Vlanif100] quit
[CSS] interface Eth-Trunk 9 //Add Eth-Trunk9 to VLAN 200.
[CSS-Eth-Trunk9] port link-type trunk
[CSS-Eth-Trunk9] port trunk allow-pass vlan 200
[CSS-Eth-Trunk9] quit
[CSS] interface Vlanif 200 //Create VLANIF 200 for CSS to connect to service network 2.
[CSS-Vlanif200] ip address 10.10.200.1 24
[CSS-Vlanif200] quit
Step 3 On routers: Configure the interfaces between routers and CSS.
# Configure Router1, create Eth-Trunk1 on Router1, and add member interfaces to Eth-Trunk1.
<Huawei> system-view
[Huawei] sysname Router1
[Router1] interface Eth-Trunk 1
[Router1-Eth-Trunk1] quit
[Router1] interface XGigabitethernet 1/0/1
[Router1-XGigabitEthernet1/0/1] undo shutdown
[Router1-XGigabitEthernet1/0/1] Eth-Trunk 1
[Router1-XGigabitEthernet1/0/1] quit
[Router1] interface XGigabitethernet 1/0/2
[Router1-XGigabitEthernet1/0/2] undo shutdown
[Router1-XGigabitEthernet1/0/2] Eth-Trunk 1
[Router1-XGigabitEthernet1/0/2] quit
# Configure the Dot1q termination subinterface for VLAN 10 and assign an IP address to the subinterface.
[Router1] interface Eth-Trunk 1.100
[Router1-Eth-Trunk1.100] ip address 10.10.4.2 24
[Router1-Eth-Trunk1.100] dot1q termination vid 10
[Router1-Eth-Trunk1.100] quit
# The configuration procedure on Router2 is the same as that on Router1 except that the interface addresses are different.
Step 4 On firewalls: Configure interfaces and zones.
# Configure interfaces and zones on FW1.
<USG> system-view
[USG] sysname FW1
[FW1] interface Eth-Trunk 4 //Configure the interface connected to CSS and assign an IP address to it.
[FW1-Eth-Trunk4] ip address 10.10.2.2 24
[FW1-Eth-Trunk4] quit
[FW1] interface Gigabitethernet 1/0/0 //Add an interface to Eth-Trunk4.
[FW1-GigabitEthernet1/0/0] Eth-Trunk 4
[FW1-GigabitEthernet1/0/0] quit
[FW1] interface Gigabitethernet 1/0/1 //Add an interface to Eth-Trunk4.
[FW1-GigabitEthernet1/0/1] Eth-Trunk 4
[FW1-GigabitEthernet1/0/1] quit
[FW1] interface Eth-Trunk 5 //Configure the interface connected to CSS and assign an IP address to it.
[FW1-Eth-Trunk5] ip address 10.10.3.2 24
[FW1-Eth-Trunk5] quit
[FW1] interface Gigabitethernet 1/1/0 //Add an interface to Eth-Trunk5.
[FW1-GigabitEthernet1/1/0] Eth-Trunk 5
[FW1-GigabitEthernet1/1/0] quit
[FW1] interface Gigabitethernet 1/1/1 //Add an interface to Eth-Trunk5.
[FW1-GigabitEthernet1/1/1] Eth-Trunk 5
[FW1-GigabitEthernet1/1/1] quit
[FW1] interface Eth-Trunk 1 //Configure the interface connecting FW1 to FW2.
[FW1-Eth-Trunk1] ip address 10.1.1.1 24
[FW1-Eth-Trunk1] quit
[FW1] interface Gigabitethernet 2/0/0 //Add an interface to Eth-Trunk1.
[FW1-GigabitEthernet2/0/0] Eth-Trunk 1
[FW1-GigabitEthernet2/0/0] quit
[FW1] interface Gigabitethernet 2/0/1 //Add an interface to Eth-Trunk1.
[FW1-GigabitEthernet2/0/1] Eth-Trunk 1
[FW1-GigabitEthernet2/0/1] quit
[FW1] firewall zone trust
[FW1-zone-trust] add interface Eth-Trunk 5 //Add Eth-Trunk5 connected to the intranet to a trusted zone.
[FW1-zone-trust] quit
[FW1] firewall zone untrust
[FW1-zone-untrust] add interface Eth-Trunk 4 //Add Eth-Trunk4 connected to the extranet to an untrusted zone.
[FW1-zone-untrust] quit
[FW1] firewall zone dmz
[FW1-zone-dmz] add interface Eth-Trunk 1 //Add the interface between FW1 and FW2 to the DMZ.
[FW1-zone-dmz] quit
# Configure interfaces and zones on FW2.
<USG> system-view
[USG] sysname FW2
[FW2] interface Eth-Trunk 6 //Configure the interface connected to CSS and assign an IP address to it.
[FW2-Eth-Trunk6] ip address 10.10.2.3 24
[FW2-Eth-Trunk6] quit
[FW2] interface Gigabitethernet 1/0/0 //Add an interface to Eth-Trunk6.
[FW2-GigabitEthernet1/0/0] Eth-Trunk 6
[FW2-GigabitEthernet1/0/0] quit
[FW2] interface Gigabitethernet 1/0/1 //Add an interface to Eth-Trunk6.
[FW2-GigabitEthernet1/0/1] Eth-Trunk 6
[FW2-GigabitEthernet1/0/1] quit
[FW2] interface Eth-Trunk 7 //Configure the interface connected to CSS and assign an IP address to it.
[FW2-Eth-Trunk7] ip address 10.10.3.3 24
[FW2-Eth-Trunk7] quit
[FW2] interface Gigabitethernet 1/1/0 //Add an interface to Eth-Trunk7.
[FW2-GigabitEthernet1/1/0] Eth-Trunk 7
[FW2-GigabitEthernet1/1/0] quit
[FW2] interface Gigabitethernet 1/1/1 //Add an interface to Eth-Trunk7.
[FW2-GigabitEthernet1/1/1] Eth-Trunk 7
[FW2-GigabitEthernet1/1/1] quit
[FW2] interface Eth-Trunk 1 //Configure the interface between FW2 and FW1.
[FW2-Eth-Trunk1] ip address 10.1.1.2 24
[FW2-Eth-Trunk1] quit
[FW2] interface Gigabitethernet 2/0/0 //Add an interface to Eth-Trunk1.
[FW2-GigabitEthernet2/0/0] Eth-Trunk 1
[FW2-GigabitEthernet2/0/0] quit
[FW2] interface Gigabitethernet 2/0/1 //Add an interface to Eth-Trunk1.
[FW2-GigabitEthernet2/0/1] Eth-Trunk 1
[FW2-GigabitEthernet2/0/1] quit
[FW2] firewall zone trust
[FW2-zone-trust] add interface Eth-Trunk 7 //Add Eth-Trunk7 connected to the intranet to the trusted zone.
[FW2-zone-trust] quit
[FW2] firewall zone untrust
[FW2-zone-untrust] add interface Eth-Trunk 6 //Add Eth-Trunk6 connected to the extranet to the untrusted zone.
[FW2-zone-untrust] quit
[FW2] firewall zone dmz
[FW2-zone-dmz] add interface Eth-Trunk 1 //Add the interface between FW1 and FW2 to the DMZ.
[FW2-zone-dmz] quit
Step 5 On routers: Configure VRRP. Configure Router1 as the VRRP master and Router2 as the VRRP backup.
# Configure Router1.
[Router1] interface Eth-Trunk 1.100
[Router1-Eth-Trunk1.100] vrrp vrid 1 virtual-ip 10.10.4.100 //Configure the VRRP virtual IP address.
[Router1-Eth-Trunk1.100] vrrp vrid 1 priority 120 //Increase the priority of Router1 to make Router1 become the Master.
[Router1-Eth-Trunk1.100] quit
# Configure Router2.
[Router2] interface Eth-Trunk 1.100
[Router2-Eth-Trunk1.100] vrrp vrid 1 virtual-ip 10.10.4.100 //Configure the VRRP virtual IP address.
[Router2-Eth-Trunk1.100] quit
After the configuration is complete, a VRRP group should have been set up between Router1 and Router2. You can run the display vrrp command to view the VRRP status of Router1 and Router2.
# Check the VRRP status of Router1. The status is master.
[Router1] display vrrp
Eth-Trunk1.100 | Virtual Router 1
State : Master
Virtual IP : 10.10.4.100
Master IP : 10.10.4.2
PriorityRun : 120
PriorityConfig : 120
MasterPriority : 120
Preempt : YES Delay Time : 0 s
TimerRun : 1 s
TimerConfig : 1 s
Auth type : NONE
Virtual MAC : 0000-5e00-0101
Check TTL : YES
Config type : normal-vrrp
Create time : 2015-05-17 22:53 UTC-05:13
Last change time : 2015-05-17 22:53 UTC-05:13
# Check the VRRP status of Router2. The status is backup.
[Router2] display vrrp
Eth-Trunk1.100 | Virtual Router 1
State : Backup
Virtual IP : 10.10.4.100
Master IP : 10.10.4.2
PriorityRun : 100
PriorityConfig : 100
MasterPriority : 120
Preempt : YES Delay Time : 0 s
TimerRun : 1 s
TimerConfig : 1 s
Auth type : NONE
Virtual MAC : 0000-5e00-0101
Check TTL : YES
Config type : normal-vrrp
Create time : 2015-05-17 22:53 UTC-05:13
Last change time : 2015-05-17 22:53 UTC-05:13