华为AR1220路由器配置参数实际应用实例解说一.docx

1、华为AR1220路由器配置参数实际应用实例解说一华为AR1220路由器配置参数实际应用实例解说一1.配置参数GZdis cuV200R001C00SPC200 /路由器软件版本，可从官方下载# sysname GZ /路由器名字GZ ftp server enable /ftp 服务开通以便拷贝出配置文件备份#voice# http server port 1025 /http undo http server enable# drop illegal-mac alarm# l2tp aging 0# vlan batch 10 20 30 40 50 /本路由器设置的VLAN ID # ig

2、mp global limit 256# multicast routing-enable /开启组播# dhcp enable /全局下开启DHCP服务 然后在各VLAN上开启单独的DHCP#ip vpn-instance 1 ipv4-family#acl number 2000 rule 10 permit#acl number 2001 /以太网访问规则列表。 rule 6 permit source 172.23.68.0 0.0.0.255 /允许此网段访问外网 rule 7 permit source 172.23.69.0 0.0.0.255 /允许此网段访问外网 rule 8

3、 permit source 172.23.65.0 0.0.0.3 /允许此网段的前三个IP访问外网 rule 9 deny /不允许其他网段访问外网#acl number 3000 /此规则并未应用 rule 40 permit ip source 172.23.65.0 0.0.0.255 destination 172.23.69.0 0.0.0.255#acl number 3001/定义两个网段主机互不访问，学生不能访问65网段。 rule 5 deny ip source 172.23.65.0 0.0.0.255 destination 172.23.68.0 0.0.0.25

4、5 rule 10 deny ip source 172.23.68.0 0.0.0.255 destination 172.23.65.0 0.0.0.255#aaa /默认视图窗口 定义本地登录和密码 authentication-scheme default authorization-scheme default accounting-scheme default domain default domain default_admin local-user admin password cipher MQ;4B+4Z,YWX*NZ55OA! local-user admin servi

5、ce-type telnet web http local-user dfwd password cipher VE5U!7QCO;V2HX,1! local-user dfwd privilege level 15 local-user dfwd service-type telnet terminal web http local-user huawei password cipher RY,UPVHCMV+Q=QMAF41! /新建用户dfwd 密码 local-user huawei ftp-directory flash: /该用户名默认配置指向的ftp路径 local-user h

6、uawei service-type ftp / 该用户采用FTP访问#firewall zone trust /定义信任区域 priority 15 /定义信任区域下的策略#firewall zone untrust /定义不信任区域 priority 1 /定义不信任区域下的策略#firewall interzone trust untrust /配置安全域间 firewall enable/该安全域间启用防火墙 packet-filter 3001 inbound /入口执行3001规则 packet-filter 3001 outbound /出口执行3001规则 packet-fil

7、ter default deny outbound#interface Vlanif10 ip address 172.23.65.100 255.255.255.0 /定义vlan的网关地址和子网掩码 pim dm /组播协议需开启的功能 igmp enable /组播协议需开启的功能 zone trust /定义VLAN是信任区域#interface Vlanif20 ip address 172.23.1.1 255.255.255.240 /定义vlan的网关地址和子网掩码 pim dm /组播协议需开启的功能 igmp enable/组播协议需开启的功能 zone trust/定义V

8、LAN是信任区域#interface Vlanif30 ip address 10.10.10.1 255.255.255.252 /定义vlan的网关地址和子网掩码 pim dm /组播协议需开启的功能 igmp enable /组播协议需开启的功能 zone trust /定义VLAN是信任区域# interface Vlanif40 ip address 172.23.68.100 255.255.255.0 /定义vlan的网关地址和子网掩码 pim dm /组播协议需开启的功能 igmp enable /组播协议需开启的功能 dhcp select interface /自动分配该V

9、LAN网关所在的地址段IPdhcp server excluded-ip-address 172.23.68.201 172.23.69.254 /定义该段IP不自动分配dhcp server dns-list 61.139.2.69 /定义该VLAN所在IP地址段的DNS地址 zone untrust /定义该VLAN为不信任区域 #interface Vlanif50 ip address 172.23.69.100 255.255.255.0 /定义vlan的网关地址和子网掩码 pim dm /组播协议需开启的功能 igmp enable /组播协议需开启的功能 dhcp select

10、interface /开启本VLAN的DHCP功能并选择端口为定义的网关地址dhcp server excluded-ip-address 172.23.69.201 172.23.69.252 /定义手动获取的IP地址段 dhcp server dns-list 61.139.2.69 /定义该VLAN段IP的DNS#interface Ethernet0/0/0 /物理端端口0 port link-type access /定义该端口类型 port default vlan 10 /定义端口所在VLAN#interface Ethernet0/0/1 /物理端端口1 port link-t

11、ype access /定义该端口类型 port default vlan 30 /定义端口所在VLAN#interface Ethernet0/0/2 /物理端端口2 port link-type access / 定义该端口类型 port default vlan 20 /定义端口所在VLAN qos gts cir 6000 cbs 600000 /定义该端口数据缓存带宽围#interface Ethernet0/0/3 /物理端端口3 port link-type access port default vlan 30#interface Ethernet0/0/4 /物理端端口4 p

12、ort link-type access /定义该端口类型 port default vlan 40 /定义端口所在VLAN#interface Ethernet0/0/5 /物理端端口5 port link-type access /定义该端口类型 port default vlan 50 /定义端口所在VLAN#interface Ethernet0/0/6 /物理端端口6 port link-type access /定义该端口类型#interface Ethernet0/0/7 /物理端端口6 port link-type access /定义该端口类型 port default vl

13、an 10 /定义端口所在VLAN#interface GigabitEthernet0/0/0 /三层口不在任何一个VLAN中，有映射功能。 ip address 125.69.71.128 255.255.255.0 /定义该端口的网关地址和子网掩码 nat server protocol tcp global current-interface 10001 inside 172.23.68.222 10001 /允许网IP端口映射到外网 nat server protocol tcp global current-interface 10002 inside 172.23.68.222

14、10002 nat server protocol tcp global current-interface 10003 inside 172.23.68.222 10003 nat server protocol tcp global current-interface 10004 inside 172.23.68.222 10004 nat server protocol tcp global current-interface 10005 inside 172.23.68.222 10005 nat server protocol tcp global current-interface

15、 10006 inside 172.23.68.222 10006 nat server protocol tcp global current-interface 10007 inside 172.23.68.222 10007 nat server protocol tcp global current-interface 10008 inside 172.23.68.222 10008 nat server protocol tcp global current-interface 10009 inside 172.23.68.222 10009 nat server protocol

16、tcp global current-interface 10010 inside 172.23.68.222 10010 nat server protocol udp global current-interface 11001 inside 172.23.68.222 11001 nat server protocol udp global current-interface 11002 inside 172.23.68.222 11002 nat server protocol udp global current-interface 11003 inside 172.23.68.22

17、2 11003 nat server protocol udp global current-interface 11004 inside 172.23.68.222 11004 nat server protocol udp global current-interface 11005 inside 172.23.68.222 11005 nat server protocol udp global current-interface 11006 inside 172.23.68.222 11006 nat server protocol udp global current-interfa

18、ce 11007 inside 172.23.68.222 11007 nat server protocol udp global current-interface 11008 inside 172.23.68.222 11008 nat server protocol udp global current-interface 11009 inside 172.23.68.222 11009 nat server protocol udp global current-interface 11010 inside 172.23.68.222 11010 nat outbound 2001

19、/在该端口上执行编号为2001的访问规则#interface GigabitEthernet0/0/1 /三层口不在任何一个VLAN中，有映射功能。 ip address 10.10.10.6 255.255.255.252 /定义该端口的网关地址和子网掩码 pim dm /组播协议需开启的功能 igmp enable /组播协议需开启的功能 undo negotiation auto /关闭端口自动协商功能 zone trust /定义该端口是信任区域#interface Cellular0/0/0 link-protocol ppp#interface Cellular0/0/1 link

20、-protocol ppp#interface NULL0#igmp#pim c-bsr GigabitEthernet0/0/0 c-rp GigabitEthernet0/0/0 group-policy 2000 c-rp GigabitEthernet0/0/1 group-policy 2000# ip route-static 0.0.0.0 0.0.0.0 125.71.213.1 /新增静态路由列表，访问外网 ip route-static 10.1.187.0 255.255.255.0 10.10.10.2 ip route-static 10.102.0.0 255.25

21、5.0.0 172.23.1.2 ip route-static 10.110.0.0 255.255.0.0 172.23.1.2 ip route-static 172.23.66.0 255.255.255.0 10.10.10.2 ip route-static 172.23.67.0 255.255.255.0 10.10.10.5 ip route-static 192.168.14.0 255.255.255.0 172.23.1.2 ip route-static 192.168.18.0 255.255.255.0 172.23.1.2 ip route-static 192

22、.168.20.0 255.255.255.0 172.23.1.2# super password level 3 cipher EO2:%&(X.$CLYaDZEJ1!user-interface con 0user-interface vty 0 4 authentication-mode aaauser-interface vty 16 20#port-group 1 group-member Ethernet0/0/0 group-member Ethernet0/0/1 group-member Ethernet0/0/2 group-member Ethernet0/0/3 group-member Ethernet0/0/4 group-member Ethernet0/0/5 group-member Ethernet0/0/6 group-member Ethernet0/0/7#port-group eth0/0/2#Return