華為交換機(jī)配置模版腳本

1、總體模版sysuser-interface vty 0 4authentication-mode passwordset authentication password cipher sdsy/sdsyuser privilege level 15quiuser-interface conso 0authentication-mode passwordset authentication password cipher sdsy/sdsyquiip route-static vlan 39quiint vlan 1quiundo int vlan 1vlan 255int vlan 255ip

2、 add 02 24int g0/0/8port link-type trunkport trunk allow-pass vlan allquiint range g0/0/1 to g0/0/7port link-typ accessport defaul vlan 39stp edged-port enableloopback-detection enableexiterrdisable recovery cause loopback-detetionerrdisable recovery interval 60dhcp-snooping enable int range g0/0/8

3、dhcp-snooping trust dhcp enable3A認(rèn)證Aaalocal-user meng password cipher meng privilege level 15User-interface vty 0 4Authentication mode aaa端口聚合創(chuàng)建聚合組命令如下：S9303interface Eth-Trunk1聚合組名稱為 ETH-Trunk1S9303-Eth-Trunk1description To-S9303-2/描述S9303-Eth-Trunk1undo port hybrid vlan 1去掉 VLAN1 的透傳S9303-Eth-Trun

4、k1port hybrid tagged vlan 100 to 200 /VLAN 透傳3進(jìn)入端口，將端口加入聚合組，命令如下：S9303interface GigabitEthernet1/1/16進(jìn)入 G1/1/16 端口S9303-GigabitEthernet1/1/16description To-S7810-G7/0/31 /端口描述S9303-GigabitEthernet1/1/16eth-trunk 1/加入聚合組 1S9303interface GigabitEthernet1/1/17進(jìn)入 G1/1/17 端口S9303-GigabitEthernet1/1/17des

5、cription To-S7810-G7/0/30 端口描述S9303-GigabitEthernet1/1/17eth-trunk 1加入聚合組 1dhcp enable#dhcp snooping enableuser-bind static ip-address 00保留手動分配的地址，不加保留的手動分配的地址沒法使用user-bind static ip-address 01 mac-address 4c1f-cc58-379e保留手動分配的地址和MAC地址捆綁#interface Vlanif1000ip address dhcp select interfacedhcp serve

6、r excluded-ip-address 00 54 保留手動分配的地址段expired day 0 hour 5dhcp server forbidden-ip 01 53 display dhcp client#interface GigabitEthernet0/0/1port link-type accessport default vlan 1000ip source check user-bind enableip source check user-bind check-item ip-address mac-address dhcp snooping enabledhcp s

7、nooping check user-bind enableexpired day 0 hour 5dhcp server forbidden-ip 01 53 display dhcp client鏡像命令:Mirroring-group 2 local 倉U建組Int g0/0/1Mirroring-group 2 mirroring-port both 設(shè)置被監(jiān)控對象Int g0/0/2Mirroring-group 2 monitor-port Sniffer 口備份和恢復(fù)Tftp put vrpcfg.cfg 22-hw-22.cfg 下載Tftp get 23-hw22.cfg v

8、rpcfg.vfgPrivilege levlesysname HuaWei_testDHCPIP-MAC 綁定super password level 1 cipher 456123 #dhcp snooping bind-table static ip-address 54 mac-address 0000-1111-1234 interfaceEthernet 0/0/2將 IP00 mac 0001-0002-0003 固定到接口上 interface GigabitEthernet 0/0/1 user-bind static ip-address 00 mac-address 00

9、01-0002-0003 interfaceGigabitEthernet 0/0/1 vlan 10接口上啟用：ip source check user-bind enable即可：具體配置過程如下：Ip+mac+端口綁定sysEnter system view, return user view with Ctrl+Z.HuaweiHuaweivlan 10在設(shè)備上創(chuàng)建 vlan 10Huawei-vlan10quitHuaweiinter gi0/0/1進(jìn)入接口視圖Huawei-GigabitEthernet0/0/1port link-type access /指定接口為 access

10、 類型：可直接接電腦或是服務(wù)器的那種類型Huawei-GigabitEthernet0/0/1port default vlan 10 / 將接口 劃入 vlan 10;Huawei-GigabitEthernet0/0/1quitHuaweiuser-bind static ip-address 00 mac-address 0001-0002-0003 interfaceGigabitEthernet 0/0/1 vlan 10/在全局模式下，將 IP 地址(00)，MAC 地址(0001-0002-0003)，具體接口( GigabitEthernet 0/0/1)，/和接口所屬vlan

11、(10)，綁定到一起。Huaweiinter gi0/0/1Huawei-GigabitEthernet0/0/1ip source check user-bind enable/在本接口上，檢查通過的IP源地址，即啟用源地址檢查功能；Info: Add permit rule for dynamic snooping bind-table, please wait a minute!done.Huawei-GigabitEthernet0/0/1di this查看接口配置：#interface GigabitEthernet0/0/1port link-type accessport def

12、ault vlan 10ip source check user-bind enable#returnHuawei-GigabitEthernet0/0/1查看防ARP/DHCP/ICMP收到的數(shù)量display auto-defend attack-source detailMAC AddressXXXX-XXXX-XXXX-XXXXInterfaceGigabitEthernet0/0/2VLAN: Outer/Inner0ARP:16DHCP:980592ICMP:982336Total1962944MAC AddressXXXX-e623-7bceInterfaceGigabitEth

13、ernet0/0/2VLAN: Outer/Inner0DHCP:34416ICMP:12352Total46768Pppoe設(shè)置interface Dialer1link-protocol pppppp pap local-user 28#1 password simple &9ip address ppp-negotiatedialer user 28#1dialer bundle 1dialer-group 1nat outbound 3001#interface Ethernet0/1pppoe-client dial-bundle-number 1#ip route-static D

14、ialer 1 preference 60#配置802.1x認(rèn)證示例組網(wǎng)需求如圖1所示，要求如下：對GE00Q接口上的接入用戶進(jìn)行802.1x認(rèn)證，以控制其訪問Internet,接入控制方式采用缺省方 式，即基于MAC的接入控制方式。認(rèn)證成功之前，用戶通過瀏覽器訪問外部網(wǎng)絡(luò)會被重定向至WEB 服務(wù)器，進(jìn)行802.1X客戶端的下載及安裝；認(rèn)證成功之后，用戶可直接訪問網(wǎng)絡(luò)。使用RADIUS服務(wù)器完成認(rèn)證。GEMW接口最大接入用戶數(shù)為100。對GE1/0/0接口下的打印機(jī)采用MAC旁路認(rèn)證。囹1 S3S802. Ik認(rèn)證組網(wǎng)圖RADIUS server192.168230UserPrinterSwi

15、tchGE 2/Q/1 VLANIF 20GE 1/0/0192.168 2.10GE 2/0/0GE 2/0/2VLAN IF 30192.168.3J0Free IP :W/24Web server192.16833。 I配置思路用如下的思路配置802.1x認(rèn)證。1.配置RADIUS服務(wù)器模板。2.配置AAA認(rèn)證模板。3.配置域。4.配置802.1X認(rèn)證。數(shù)據(jù)準(zhǔn)備為完成此配置舉例，需要準(zhǔn)備如下數(shù)據(jù)：RADIUS服務(wù)器IP地址，認(rèn)證端口號。RADIUS服務(wù)器密鑰為hello，重傳次數(shù)為2。AAA認(rèn)證方案abc。RADIUS服務(wù)器模版rd1。域 isp1。免認(rèn)證IP網(wǎng)段。HTTP訪問的重定向U

16、RL。說明：本案例只包括Switch的配置，RADIUS服務(wù)器的配置這里不做相關(guān)說明。操作步驟配置各接口的IP地址（略）配置RADIUS服務(wù)器模板#配置RADIUS服務(wù)器模板rdl。Quidway radius-server template rd1#配置RADIUS主用認(rèn)證服務(wù)器的IP地址、端口。Quidway-radius-rd1 radius-server authentication 0 1812#配置RADIUS服務(wù)器密鑰、重傳次數(shù)。Quidway-radius-rd1 radius-server shared-key simple 123Quidway-radius-rd1 rad

17、ius-server retransmit 2Quidway-radius-rd1 quit配置認(rèn)證方案，認(rèn)證方案abc，認(rèn)證方法為RADIUSQuidway aaaQuidway -aaa authentication-scheme abcQuidway-aaa-authen-abc authentication-mode radiusQuidway-aaa-authen-abc quit配置ispl域，綁定認(rèn)證方式和RADIUS服務(wù)器模板Quidway-aaa domain isplQuidway-aaa-domain-isp1 authentication-scheme abcQuidw

18、ay-aaa-domain-isp1 radius-server rd1Quidway-aaa-domain-isp1 quitQuidway-aaa quit配置802.1x認(rèn)證#在全局和接口下使能802.1x認(rèn)證。Quidway dot1x enableQuidway interface gigabitethernet1/0/0Quidway-GigabitEthernet1/0/0 dot1x enable#配置允許接入的最大用戶數(shù)。Quidway-GigabitEthernet1/0/0 dot1x max-user 100#配置MAC旁路認(rèn)證。Quidway-GigabitEther

19、net1/0/0 dot1x mac-bypass Quidway-GigabitEthernet1/0/0 quit#配置802.1x快速部署功能。Quidway dot1x free-ip 24Quidway dot1x url 0Quidway quit檢查配置結(jié)果用戶通過ping Free IP網(wǎng)段中的地址，驗證用戶在802.1X認(rèn)證成功之前可以訪問免認(rèn)證網(wǎng)段，且 通過瀏覽器訪問任何外部網(wǎng)站都會被重定向到WEB server頁面，此頁面提供客戶端的下載服務(wù)。在Switch執(zhí)行命令display dot1x interface，可以看到802.1x配置信息和統(tǒng)計信息。 display d

20、ot1x interface gigabitethernet1/0/0GigabitEthernet1/0/0 status: UP 802.1x protocol is Enabledmac-bypassPort control type is AutoAuthentication method is MAC-basedReauthentication is disabledMaximum users: 100Current users: 1Guest VLAN is disabledCritical VLAN is disabledRestrict VLAN is disabledAuthentication Success: 4Failure: