H3C 3600及3100交換機(jī)配置方法

1、進(jìn)入管理模式system-view顯示正在運(yùn)行的配置信息H3C dis cur保存配置信息H3Cquitsave配置telnet管理的用戶和口令H3Clocal-user adminH3C-password simple password123H3C-service-type telnetH3C-level 3H3C-quitH3Cuser-interface vty 0 4H3C-authentication-mode scheme一、 H3C 3600交換機(jī)1、 劃分VLAN，并對(duì)VLAN進(jìn)行IP路由創(chuàng)建vlan 1H3Cvlan 1H3Cint vlan 1H3C-Vlan-interf

2、ace1ip add 53 H3C-Vlan-interface1quitH3Cint e1/0/1H3C-Ethernet1/0/1port access vlan 1H3C-Ethernet1/0/1quitH3Cint e1/0/2H3C-Ethernet1/0/2port access vlan 1H3C-Ethernet1/0/2quit創(chuàng)建vlan 2H3Cvlan 2H3Cint vlan 2H3C-Vlan-interface1ip add 53 H3C-Vlan-interface1quitH3Cint e1/0/3H3C-Ethernet1/0/3port access v

3、lan 2H3C-Ethernet1/0/3quitH3Cint e1/0/4H3C-Ethernet1/0/4port access vlan 2H3C-Ethernet1/0/4quitH3Cint g1/0/1H3C-G1/0/1port access vlan 2H3C-G1/0/1quit 3100及3600交換機(jī)TRUNK 口應(yīng)用：兩臺(tái)交換機(jī)級(jí)聯(lián)SwitchA與SwitchB用trunk互連，相同VLAN的PC 之間可以互訪，不同VLAN的PC之間禁止互訪l 配置方法：#進(jìn)入GigabitEthernet 1/1以太網(wǎng)端口視圖。SWA interface GigabitEthern

4、et 1/1# 配置端口 GigabitEthernet 1/1 為 Trunk 端口并允許VLAN10、VLAN 20的報(bào)文通過。SWA-Gthernet1/0/1 port link-type trunkSWA-Gthernet1/0/1 port trunk permit vlan 10 20SWAint e10/1SWA-E1/0/1port acc vlan 10SWA-E1/0/2port acc vlan 20注：SWB交換機(jī)配置相同增加路由H3Cip route 54H3Cquitsave端口映像：H3Cmirroring-group 1 localH3Cmirroring-g

5、roup 1 monitor-port GigabitEthernet 1/1/4H3Cmirroring-group 1 mirroring-port GigabitEthernet 1/1/1 both端口匯聚：system-viewH3Clink-aggregation group 1 mode manualH3Cinterface ethernet1/0/1H3C-Ethernet1/0/1 port link-aggregation group 1H3C-Ethernet1/0/1 interface ethernet1/0/2H3C-Ethernet1/0/2 port link-

6、aggregation group 1H3C-Ethernet1/0/2 interface ethernet1/0/3H3C-Ethernet1/0/3 port link-aggregation group 12、IP MAC端口綁定H3Cinterface Ethernet1/0/1H3C-Ethernet1/0/1am user-bind mac-addr 0001-0002-0003 ip-addr 3、IP MAC 綁定arp static ip-address mac-address vlan-id interface-type interface-number 4、ACL訪問控

7、制列表公司企業(yè)網(wǎng)通過Switch的端口實(shí)現(xiàn)各部門之間的互連。研發(fā)部門由 GigabitEthernet1/1/1接入交換機(jī)，工資查詢服務(wù)器的地址為 。要求正確配置ACL，禁止研發(fā)部門在工作日8:00至18:00 訪問工資服務(wù)器。配置步驟定義時(shí)間段#定義8:00至18:00的周期時(shí)間段。 system-viewH3C time-range test 8:00 to 18:00 working-day(2)定義到工資服務(wù)器的ACL#進(jìn)入ACL3000視圖。H3C acl number 3000#定義其它部門到工資服務(wù)器的訪問規(guī)則。H3C-acl-adv-3000 rule 1 deny ip de

8、stination 0 time-range testH3C-acl-adv-3000 quit在端口上應(yīng)用ACL#在端口上應(yīng)用ACL 3000。H3C interface gigabitethernet1/1/1H3C-GigabitEthernet1/1/1 packet-filter inbound ip-group 3000二、 H3C 3100交換機(jī)1、廣播抑制H3Cint e1/0/1H3Cbroadcast-suppression 5H3Cint e1/0/2H3Cbroadcast-suppression 52、配置web管理H3Cint vlan 1H3C-ip add 53

9、 H3C-quitH3Cundo ip http shutdownH3Clocal-user adminH3C-password simple password123H3C-service-type telnetH3C-level 3H3C-quitH3Cuser-interface vty 0 4H3C-authentication-mode schemeH3C-quitH3Cquitsave華為（H3C）交換機(jī)常用配置命令S5000交換機(jī)33用戶名：admin刪除設(shè)備配置reset saved-configuration重啟reboot看當(dāng)前配置文件display current-conf

10、iguration改設(shè)備名sysname保存配置save進(jìn)入特權(quán)模式sysview華為只有2層模式 不像cisco enale之后還要conf t定義aclacl nubmere XXXX（3000 以上）進(jìn)入以后rule permit/deny IP/TCP/UDP 等 source XXX.XXX.XXX.XXX XXX.XXX.XXX.XXX（反 向）destination XXX.XXX.XXX.XXX XXX.XXX.XXX.XXX（反向）eq注意華為默認(rèn)沒有deny any any防火墻上端口加載ACLQuidway-Ethernet0/0firewall packet-filte

11、r 3000 inbound防火墻上新增加用戶local-user XXX （用戶名）password simple XXX （密碼）local-user XXX service-type ppp刪除某條命令undo （類似與 cisco 的 no） 靜態(tài)路由ip route-static XXX.XXX.XXX.XXX 對(duì)vpdn用戶設(shè)置acl的接口 inte*ce Virtual-Templatel 查看路由表 display ip routing-table設(shè)定telnet密碼 user-inte*ce vty 0 4 user privilege level 3 set authent

12、ication password simple XXX啟動(dòng)/關(guān)閉啟動(dòng)un shut關(guān)閉 shut動(dòng)態(tài)nat設(shè)置 acl number 3000 rule 0 permit ip source XXX.XXX.XXX.XXX rule 1 permit ip source XXX.XXX.XXX.XXX rule 2 permit ip source XXX.XXX.XXX.XXX inte*ce Ethernetl/0description =To-Internet(WAN)= ip address XXX.XXX.XXX.XXX XXX.XXX.XXX.XXX nat outbound 30

13、00 ipsec policy policyl利用acl來做 符合acl的IP地址可以出去(注意 此處的ACL隱含了 deny any any)不符合的IP地址不可以出去創(chuàng)建vlanshzb-crsw-s6506-1vlan 100華為vlan不支持name將port放入vlan創(chuàng)建了 vlan后 進(jìn)入vlan模式shzb-crsw-s6506-1-vlan100port GigabitEthernet 1/0/1 to GigabitEthernet 1/0/8表示從 G1/0/1 至到 1/0/8 放入 VLAN 100創(chuàng)建trunk inte*ce GigabitEthernet1/0/

14、1 duplex full speed 1000port link-type trunkport trunk permit vlan allport link-aggregation group 1 帶*號(hào)的是創(chuàng)建trunk鏈路的語句 vlan地址指定inte*ce Vlan-inte*ce2description serverip address XXX.XXX.XXX.XXX XXX.XXX.XXX.XXXvrrp vrid 2 virtual-ip XXX.XXX.XXX.XXXvrrp vrid 2 priority 120vrrp vrid 2 preempt-mode timer

15、delay 10其中vrrp語句指定vrrp類似與hsrp使用vrrp要注意的是華為不支持pvst只能一臺(tái)完全是主，一臺(tái)完全是備份在主vrrp設(shè)備上要指定stp instance 0 root primarystp TC-protection enablestp enable在從vrrp設(shè)備上要指定stp instance 0 root secondarystp TC-protection enablestp enable交換機(jī)下面綁acl首先進(jìn)入接口模式，輸入qos命令shzb-crsw-s6506T-GigabitEthernet1/0/1qos在輸入如下命令shzb-crsw-s6506-1-qoss-GigabitEthernet1/0/1packet-filter inbound ip-group 3000華為交換機(jī)只能指定inbound方向啟用ospfshzb-crsw-s6506-1ospf 100shzb-crsw-s6506-1-ospf-100area 0shzb-crsw-s6506T-ospfT00-area-network XXX.XXX.XXX.XXXXXX.XXX.XXX.XXX配置ospf重發(fā)布shzb-crsw-s6506T