内网核心路由器配置

1、1.1.1 内网核心路由器配置内网核心路由器配置：<Quidway><Quidway>disp cur# sysname Quidway#controller E1 2/0/0#controller E1 2/0/1#controller E1 2/0/2#controller E1 2/0/3#interface Aux0 async mode flow link-protocol ppp#interface Ethernet0/0/0 ip address 10.64.226.130 255.255.255.240#interface Ethernet0/0/1#i

2、nterface Ethernet1/0/0 ip address 10.64.224.201 255.255.255.0#interface NULL0#aaa authentication-scheme default# authorization-scheme default# accounting-scheme default# domain default#ospf 1# ip route-static 0.0.0.0 0.0.0.0 10.64.224.200 ip route-static 10.64.225.0 255.255.255.224 10.64.226.132 ip

3、route-static 10.64.225.32 255.255.255.224 10.64.226.132 ip route-static 10.64.225.64 255.255.255.224 10.64.226.132 ip route-static 10.64.225.96 255.255.255.224 10.64.226.132 ip route-static 10.64.225.128 255.255.255.224 10.64.226.132 ip route-static 10.64.225.160 255.255.255.224 10.64.226.132 ip rou

4、te-static 10.64.225.192 255.255.255.224 10.64.226.132 ip route-static 10.64.225.224 255.255.255.224 10.64.226.132 ip route-static 10.64.226.0 255.255.255.224 10.64.226.132 ip route-static 10.64.226.32 255.255.255.240 10.64.226.132 ip route-static 10.64.226.48 255.255.255.240 10.64.226.132 ip route-s

5、tatic 10.64.226.64 255.255.255.240 10.64.226.132 ip route-static 10.64.226.80 255.255.255.240 10.64.226.132 ip route-static 10.64.226.96 255.255.255.240 10.64.226.132 ip route-static 10.64.226.112 255.255.255.240 10.64.226.132 ip route-static 10.64.226.144 255.255.255.240 10.64.226.133 ip route-stat

6、ic 10.64.226.160 255.255.255.240 10.64.226.135 ip route-static 10.64.227.0 255.255.255.192 10.64.226.132 ip route-static 10.64.227.64 255.255.255.192 10.64.226.132# snmp-agent snmp-agent local-engineid 800007DB00E0FC474A9E6877 snmp-agent community read public snmp-agent sys-info location BeiJing Chi

7、na snmp-agent sys-info version all snmp-agent group v3 managev3group write internet snmp-agent target-host trap address udp-domain 192.168.50.20 udp-port 5000 params securityname public snmp-agent mib-view included internet internet snmp-agent usm-user v3 managev3user managev3group snmp-agent trap e

8、nable standard authentication coldstart linkup linkdown snmp-agent trap life 300#user-interface con 0user-interface aux 0user-interface vty 0 4#return<Quidway>1.1.2 内网防火墙配置内网防火墙选用的是两台天融信NW4000E做双机热备，具体安装配置如下：第一步：在天融信光盘包中执行集中管理器软件，安装到本地计算机上，然后把计算机的ip改成10.64.226.137 255.255.255.240。第二步：双击集中管理器里的

9、E0口ip，输入用户名superman密码talent，进入配置界面，如下图所示：第三步：在网络区域里设置接口ip地址和缺省访问权限，可读，可写，可执行。如下图所示：第四步：在通信策略里面设置4条transfer规则（E0到E2,E2到E0,E1到E2,E2到E1,通信方式全是transfer），如下图所示：第五步：在高级管理下的特殊对象中的透明网络里把E0和E1口区域设置成透明模式，如下图所示：第六步：在高级管理中的路由表里添加2条路由，一条是到交换网络的路由，一条是到NE20网络的路由。如下图所示：第七步：保存所有配置，在工具条上点击配置存储，再按是确定就ok了。如下图所示：内网防火墙A具

10、体配置：System>System>System>show configsystem -n 'TOPSEC'system -i 0system -h offsystem -f areasystem port onsystem stp offlogin lock 3 60 2system timeout 100 300 200 5authentication -a 300 60 5log -t topsecscm offsystem -d 0ifconfig 'eth0' 10.64.226.133 255.255.255.240ifconfig

11、 'eth1' 10.64.226.134 255.255.255.240ifconfig 'eth2' 10.64.226.145 255.255.255.240ifconfig eth0 -m 1500ifconfig eth1 -m 1500ifconfig eth2 -m 1500ID 111 route add -s 0.0.0.0/0.0.0.0 -d 10.64.227.0/255.255.255.192 -g 10.64.226.129ID 112 route add -s 0.0.0.0/0.0.0.0 -d 10.64.224.0/255.2

12、55.255.0 -g 10.64.226.130ID 1 area 'ssn' -d 'eth2' -a any -l session enable pingID 2 area '内网2' -d 'eth1' -a any -l session enable pingID 3 area '内网1' -d 'eth0' -a any -l session enable pingID 4 area 'area_4' -d 'global' -a anyID 103 vl

13、an add '内网1-内网2' -a '内网2' '内网1' stpoff -p 0ID 100 system client add 'gui' -t 'gui' -a 'ssn' -i 0.0.0.0-255.255.255.255ID 101 system client add 'telnet' -t 'telnet' -a 'ssn' -i 0.0.0.0-255.255.255.255ID 102 system client add '

14、;upgrade' -t 'upgrade' -a 'ssn' -i 0.0.0.0-255.255.255.255ID 104 system client add '121' -t 'monitor' -a 'ssn' -i 0.0.0.0-255.255.255.255ID 105 system client add '1' -t 'gui' -a '内网1' -i 0.0.0.0-255.255.255.255ID 106 system client a

15、dd '2' -t 'gui' -a '内网2' -i 0.0.0.0-255.255.255.255ID 107 transfer when '内网1' access 'ssn' -m 'round'ID 108 transfer when 'ssn' access '内网1' -m 'round'ID 109 transfer when '内网2' access 'ssn' -m 'round'ID

16、110 transfer when 'ssn' access '内网2' -m 'round'System>内网防火墙B具体配置：System>show configsystem -n 'TOPSEC'system -i 0system -h offsystem -f areasystem port onsystem stp offlogin lock 3 60 2system timeout 100 300 200 5authentication -a 300 60 5log -t topsecscm offsyst

17、em -d 0ifconfig 'eth0' 10.64.226.135 255.255.255.240ifconfig 'eth1' 10.64.226.136 255.255.255.240ifconfig 'eth2' 10.64.226.161 255.255.255.240ifconfig eth0 -m 1500ifconfig eth1 -m 1500ifconfig eth2 -m 1500ID 110 route add -s 0.0.0.0/0.0.0.0 -d 10.64.227.0/255.255.255.192 -g 1

18、0.64.226.129ID 111 route add -s 0.0.0.0/0.0.0.0 -d 10.64.224.0/255.255.255.0 -g 10.64.226.130ID 1 area 'ssn' -d 'eth2' -a any -l session enable pingID 2 area '内网2' -d 'eth1' -a any -l session enable pingID 3 area '内网1' -d 'eth0' -a any -l session enabl

19、e pingID 4 area 'area_4' -d 'global' -a anyID 103 vlan add '内网1-内网2' -a '内网2' '内网1' stpoff -p 0ID 100 system client add 'gui' -t 'gui' -a 'ssn' -i 0.0.0.0-255.255.255.255ID 101 system client add 'telnet' -t 'telnet' -a &

20、#39;ssn' -i 0.0.0.0-255.255.255.255ID 102 system client add 'upgrade' -t 'upgrade' -a 'ssn' -i 0.0.0.0-255.255.255.255ID 104 system client add '1' -t 'gui' -a '内网1' -i 0.0.0.0-255.255.255.255ID 105 system client add '2' -t 'gui' -a

21、'内网2' -i 0.0.0.0-255.255.255.255ID 106 transfer when '内网1' access 'ssn' -m 'round'ID 107 transfer when 'ssn' access '内网1' -m 'round'ID 108 transfer when '内网2' access 'ssn' -m 'round'ID 109 transfer when 'ssn' acc

22、ess '内网2' -m 'round'System>1.1.3 DMZ区交换机配置DMZ区具体配置：<Quidway>disp cur# sysname Quidway#radius scheme system server-type huawei primary authentication 127.0.0.1 1645 primary accounting 127.0.0.1 1646 user-name-format without-domaindomain system radius-scheme system access-limi

23、t disable state active idle-cut disable self-service-url disable messenger time disable domain default enable system# local-server nas-ip 127.0.0.1 key huawei# gvrp# stp enable#vlan 1#vlan 200#vlan 300#vlan 400#interface Aux0/0#interface Ethernet0/1 port access vlan 200#interface Ethernet0/2 port ac

24、cess vlan 200#interface Ethernet0/3 port access vlan 200#interface Ethernet0/4#interface Ethernet0/5#interface Ethernet0/6#interface Ethernet0/7#interface Ethernet0/8#interface Ethernet0/9#interface Ethernet0/10#interface Ethernet0/11#interface Ethernet0/12#interface Ethernet0/13#interface Ethernet0

25、/14#interface Ethernet0/15#interface Ethernet0/16#interface Ethernet0/17 port access vlan 300#interface Ethernet0/18 port access vlan 300#interface Ethernet0/19 port access vlan 300#interface Ethernet0/20 port access vlan 300#interface Ethernet0/21#interface Ethernet0/22#interface Ethernet0/23#interface Ethernet0/