华为中小企业型h3com方案

中小企业型方案

要求：某企业，专线接入，有华为路由器一台，三层交换机一台，二层交换机若干；1、要求划几个VLAN，为不同部门。2、所有主机能够通过路由器上网。

设计思路：1、路由器配置比较简单，主要做NAT转换和ACL控制哪些主机能上外网；2、三层交换机，划分VLAN，实现内部VLAN间路由，可直接接终端或二层交换机3、二层交换相接终端。。设计时，关于防病毒ACL列表、VLAN间互联隔离技术等问题此处未讨论。感兴趣的朋友，我们可以另起篇章进行讨论。本设计以华为产品为例，思科产品配置原理相同，只是命令行不同而已。欢迎有志之士把它翻译成思科的配置。基实也可以不要三层交换机，直接在路由器上做单臂也可以。。只是不适合复杂的网络和发展。。

配置：一、路由器配置

version5.20,Release1205P02,Basic

#

给路由器命名

sysnameHUAWE-ROUTE

#

domaindefaultenablesystem

#

vlan1

#

radiusschemesystem

server-typeextended

primaryauthentication127.0.0.11645

primaryaccounting127.0.0.11646

user-name-formatwithout-domain

#

domainsystem

access-limitdisable

stateactive

idle-cutdisable

self-service-urldisable

#

定义ACL列表，允许所有IP访问外网，这里你可以指定允许某些或禁止某些主机上网。

aclnumber2000

rule0permit

#

interfaceAux0

asyncmodeflow

link-protocolppp

#

接专线的接口，配置运营商分配的IP

interfaceEthernet0/0

natoutbound2000

duplexfull

speed100

ipaddress218.22.3.126255.255.255.252

#

接局域网三层交换机的地址

interfaceEthernet0/1

DESCTO—SWitch

duplexfull

speed100

ipaddress192.168.8.1255.255.255.252

#interfaceNULL0

#

至公网默认路由

iproute-static0.0.0.00.0.0.0218.22.3.125

至三层交换机回程路由

iproute-static192.168.0.0255.255.0.0

192.168.8.2

#

user-interfacecon0

user-interfaceaux0

未设置TELNET登陆密码，这样外网的人登陆不了，当然你也登陆不了。哈安全吧。（如果想TELNET，需要设置密码和ACL禁止外网的人登陆）

user-interfacevty04

#

Return

二、三层交换配置

#

给交换机命名

sysnamehwswich

#设备SUPER密码

superpasswordlevel3cipher;1>$VGEA)N2C+1!!

#

radiusschemesystem

server-typehuawei

primaryauthentication127.0.0.11645

primaryaccounting127.0.0.11646

user-name-formatwithout-domaindomainsystem

radius-schemesystem

access-limitdisable

stateactive

vlan-assignment-modeinteger

idle-cutdisable

self-service-urldisable

messengertimedisable

domaindefaultenablesystem

#

local-servernas-ip127.0.0.1keyhuawei

建立业务VLAN及与路由器互联口VLAN

vlan5

desc

to-router

#

vlan10

descbumen1

#

vlan

20

descbumen2

#

分别给SVI接口设计IP地址，即所属VLAN

PC终端的网关

#

interfaceVlan-interface5

DESCto-router

ipaddress192.168.8.2

255.255.255.252interfaceVlan-interface10

ipaddress192.168.1.1

255.255.255.0

#

interfaceVlan-interface20

ipaddress192.168.2.1

255.255.255.0

#与二层交换机互联接口

interfaceEthernet0/1

duplexfull

speed100

portlink-typetrunk

porttrunkpermitvlan1020

#

接普通终端的接口

interfaceEthernet0/2

portaccessvlan

10

#

interfaceEthernet0/3

portaccessvlan

20

#

interfaceEthernet0/4

shutdown

#

interfaceEthernet0/5

#

interfaceEthernet0/6

shutdown

#

interfaceEthernet0/7

shutdown

#

interfaceEthernet0/8

shutdown

#

interfaceEthernet0/9

shutdown

#

interfaceEthernet0/10

shutdown

#

interfaceEthernet0/11

shutdown

#

interfaceEthernet0/12

shutdown

#

interfaceEthernet0/13

shutdown

#

interfaceEthernet0/14

shutdown

#

interfaceEthernet0/15

shutdown

#

interfaceEthernet0/16

shutdown

#

interfaceEthernet0/17

shutdown

#

interfaceEthernet0/18

shutdown

#

interfaceEthernet0/19

shutdown

#

interfaceEthernet0/20

shutdown

#

interfaceEthernet0/21

shutdown

#

interfaceEthernet0/22

shutdown

#

interfaceEthernet0/23

shutdown

#

与路由器互联接口

interfaceEthernet0/24

descto-router

duplexfull

speed100

portaccessvlan

5#

SNMP网关配置，可以不要

snmp-agent

snmp-agentlocal-engineid800007DB000FE23F864D6877

snmp-agentcommunityread

public

snmp-agentsys-infocontactHuaWei_Hotline4008302118or8008302118

snmp-agentsys-infolocationBeiJingChina

snmp-agentsys-infoversionall

#设置默认路由

iproute-static0.0.0.00.0.0.0192.168.8.1user-interfaceaux0设置TELNET登陆密码

user-interfacevty04

authentication-modepassword

setauthenticationpasswordcipher

CZP'5O+PV9=FQ!!

#

return

三、二层交换机配置

#

sysnameL1-1

#

#

radiusschemesystem

server-typehuawei

primaryauthentication127.0.0.11645

primaryaccounting127.0.0.11646

user-name-formatwithout-domaindomainsystem

radius-schemesystem

access-limitdisable

stateactive

idle-cutdisable

self-service-urldisable

messengertimedisable

domaindefaultenablesystem

#

local-servernas-ip127.0.0.1keyhuawei

#

interfaceAux0/0

#

vlan1

#

vlan10

#

vlan20

##interfaceEthernet0/1

portaccessvlan10

#

interfaceEthernet0/2

portaccessvlan10

#

interfaceEthernet0/3

portaccessvlan10

#

interfaceEthernet0/4

portaccessvlan10

#

interfaceEthernet0/5

portaccessvlan10

#

interfaceEthernet0/6

portaccessvlan10

#

interfaceEthernet0/7

portaccessvlan10

#

interfaceEthernet0/8

portaccessvlan10

#

interfaceEthernet0/9

portaccessvlan10

#

interfaceEthernet0/10

portaccessvlan10

#

interfaceEthernet0/11

portaccessvlan10

#

interfaceEthernet0/12

portaccessvlan20

#

interfaceEthernet0/13

portaccessvlan20

#

interfaceEthernet0/14

portaccessvlan20

#

interfaceEthernet0/15

portaccessvlan20

#

interfaceEthernet0/16

portaccessvlan20

#

interfaceEthernet0/17

portaccessvlan20

#

interfaceEthernet0/18

portaccessvlan20

#

interfaceEthernet0/19

portaccessvlan20

#

interfaceEthernet0/20

portaccessvlan20

#

interfaceEthernet0/21

portacces