H3C路由器配置

1、整體配置過程與解釋：<H3C>sys 進(jìn)入到系統(tǒng)視圖 sysname XXX / 修改路由器名字H3Cip https enable #配置https local-user admin #創(chuàng)建用戶adminpassword simple admin#密碼admin service-type https #服務(wù)型httpsauthorization-attribute user-role level-15 #把權(quán)限給角色15 quit#退回上級模式telnet server enable#配置telnet服務(wù) local-user admin #配置telnet 用戶名passwor

2、d simple admin888 #配置明文密碼為admin888 server-type telnet #配置用戶telnet服務(wù)類型authorization-attribute user-role level-3 #配置用戶級別quituser interface vty 0 4 #線程模式 authorization-mode scheme #用戶名+密碼quit先配LoopBack 地址再配置ospfxian BBBint LoopBack 10 xian BBB-LoopBack10ip address x.x.x.x x.x.x.x /ip地址#router id 1.1.1.

3、1 配置路由id先配LoopBack 地址再配置ospfxian BBBint LoopBack 10 xian BBB-LoopBack10ip address x.x.x.x x.x.x.x /ip地址ospf 1 #進(jìn)程號1area 0 #骨干區(qū)域 network 55 network 55VLAN 10 /創(chuàng)建VLANint vlan 10 ip add 24/配置VLAN 10 的IP地址int g0/7 port link-type access #交換機(jī)模式#ospf 1 area 0.

4、0.0.0 import route direct /引入直連路由 network 55 network 55interface Vlan-interface1 ip address 04 interface GigabitEthernet0/5 port link-mode route/設(shè)置接口為路由模式 ip address 5 #interface GigabitEthernet0/7 port link-mode

5、 route /設(shè)置接口為路由模式 ip address 5 H3Cip route-static /配置靜態(tài)目的網(wǎng)段(多個目的路由需配多條)和下一條的出口地址H3Cip route-static /配置缺省路由只需配和下一跳 ip route-static 24 preferencce 60/設(shè)置優(yōu)先級為60，數(shù)字越小越優(yōu)先# ip http enableH3C-

6、ospf-1import-route direct /ospf加入直連H3C-ospf-1import-route static /ospf加入靜態(tài)路由#ospf 1 area network 55# ip unreachables enable 顯示跟蹤 ip ttl-expires enable 顯示跟蹤#ip route-static 24 ip route-static 24 ip route-static 24 10.

7、44.171.6#雙鏈路路由器設(shè)置：#市路由器：acl advanced 3300 /創(chuàng)建訪問控制列表ACL 3300 rule 0 permit ip destination 22 0 /配置允許目的 ip地址或網(wǎng)段（反掩碼）訪問#acl advanced 3333 /創(chuàng)建訪問控制列表ACL 3333rule 0 permit ip destination 55 /配置允許目的ip網(wǎng)段或固定地址（反掩碼）#policy-based-route xxx permit node 1 /創(chuàng)建策略路xxx，節(jié)點(diǎn)1 if-match acl

8、3000 /如果是ACL 3000 apply next-hop 1 /指定下一跳ip地址路由器#policy-based-route xxx permit node 11 /創(chuàng)建策略路xxx，節(jié)點(diǎn)11 if-match acl 3333 /如果是ACL3333 apply next-hop /指定下一跳ip地址路由器在內(nèi)網(wǎng)口應(yīng)用策略路由interface GigabitEthernet0/5 port link-mode route ip address 6 ip policy-based-rout

9、e xxx#acl advanced 3500 /創(chuàng)建ACL 3500 rule 1 permit ip destination 22 0 /允許指定目的地址通過，反掩碼 rule 11 deny ip destination 55 /拒絕目的網(wǎng)段通過，反掩碼#在外網(wǎng)接口應(yīng)用上網(wǎng)策略 （outbound是出，inbound是進(jìn)） interface GigabitEthernet0/10 port link-mode route ip address 0 packet-filter 35

10、00 outbound# 縣路由器：acl advanced 3300 /創(chuàng)建ACL 3300訪問 rule 0 permit ip source 22 0 /配置允許源ip固定地址，反掩碼rule 11 deny ip source 55 /拒絕目的網(wǎng)段通過，反掩碼#acl advanced 3333 /創(chuàng)建ACL 3333訪問 rule 0 permit ip source 55 /配置允許源ip段地址，反掩碼#policy-based-route xxx permit node 1 /創(chuàng)建策

11、略路xxx，節(jié)點(diǎn)1 if-match acl 3300 /如果是ACL 3300 apply next-hop 1 /指定下一跳ip地址路由器#policy-based-route xxx permit node 11 /創(chuàng)建策略路xxx，節(jié)點(diǎn)11 if-match acl 3333 /如果是ACL 3333 apply next-hop /指定下一跳ip地址路由器在內(nèi)網(wǎng)口應(yīng)用策略路由H3Cinterface Vlan-interface 1 ip address H3C-Vlan-interface

12、1ip policy-based-route xxx quit#在外網(wǎng)接口應(yīng)用上網(wǎng)策略 （outbound是出，inbound是進(jìn)） interface GigabitEthernet0/10 port link-mode route ip address 0 packet-filter 3300 outbound# 市A靜態(tài)配置：<shi AAA>dis cutelnet server enable#router id # ospf 1 import-route direc import-route static ar

13、ea network 55# ip unreachables enable ip ttl-expires enable#policy-based-route xxx permit node 1 if-match acl 3300 apply next-hop 0#policy-based-route xxx permit node 11 if-match acl 3333 apply next-hop #interface GigabitEthernet0/1 port link-mode rout

14、e ip address #interface GigabitEthernet0/3 port link-mode route ip address #interface GigabitEthernet0/5 port link-mode route ip address 6 ip policy-based-route xxx#interface GigabitEthernet0/10 port link-mode route ip addr

15、ess 1 packet-filter 3300 outbound# ip route-static 24 、ip route-static 24 0#acl advanced 3300 rule 1 permit ip destination 22 0 rule 11 deny ip destination 55#acl advanced 3333 rule 11 permit ip desti

16、nation 55#local-user admin class manage service-type telnet http https authorization-attribute user-role level-12 authorization-attribute user-role level-15 authorization-attribute user-role network-operator# ip http enable ip https enable#縣B動態(tài)ospf<xian BBB>dis cu# telnet se

17、rver enable# router id 0#ospf 1 area network 55 network 55 network 55# ip unreachables enable ip ttl-expires enable#policy-based-route yyy permit node 1 if-match acl 3300 apply next-hop 1#policy-based-route yyy permi

18、t node 11 if-match acl 3333 apply next-hop #interface Vlan-interface1 ip address ip policy-based-route yyy#interface GigabitEthernet0/3 port link-mode route ip address ospf cost 2#interface GigabitEthernet0/11 port link-mode route ip add

19、ress 0 packet-filter 3300 outbound#acl advanced 3300 rule 1 permit ip source 22 0 rule 11 deny ip source 55#acl advanced 3333 rule 11 permit ip source 55#local-user admin class manage service-type telnet http https authorizatio

20、n-attribute user-role level-15 authorization-attribute user-role network-operator# ip http enable ip https enable#縣A靜態(tài)<xian AAA>dis cu#telnet server enable# ip unreachables enabl ip ttl-expires enable#policy-based-route xxx permit node 1 if-match acl 3300 apply next-hop 1#policy-based-route xxx permit node 2 if-match acl 3333 apply next-hop #interface Vlan-interface1 ip address ip policy-based-route xxx#interface GigabitEthernet0/3 p