H3C路由器配置(5页).doc

-H3C路由器配置-第 5 页整体配置过程与解释：<H3C>sys 进入到系统视图 sysname XXX / 修改路由器名字H3Cip https enable #配置https local-user admin #创建用户adminpassword simple admin#密码admin service-type https #服务型httpsauthorization-attribute user-role level-15 #把权限给角色15 quit#退回上级模式telnet server enable#配置telnet服务 local-user admin #配置telnet 用户名password simple admin888 #配置明文密码为admin888 server-type telnet #配置用户telnet服务类型authorization-attribute user-role level-3 #配置用户级别quituser interface vty 0 4 #线程模式 authorization-mode scheme #用户名+密码quit先配LoopBack 地址再配置ospfxian BBBint LoopBack 10 xian BBB-LoopBack10ip address x.x.x.x x.x.x.x /ip地址router id 1.1.1.1 配置路由id先配LoopBack 地址再配置ospfxian BBBint LoopBack 10 xian BBB-LoopBack10ip address x.x.x.x x.x.x.x /ip地址ospf 1 #进程号1area 0 #骨干区域 VLAN 10 /创建VLANint vlan 10 ip add 10.1.1.1 24/配置VLAN 10 的IP地址int g0/7 port link-type access #交换机模式ospf 1 import route direct /引入直连路由 5 interface Vlan-interface1interface GigabitEthernet0/5 port link-mode route/设置接口为路由模式interface GigabitEthernet0/7 port link-mode route /设置接口为路由模式配置静态目的网段(多个目的路由需配多条)和下一条的出口地址配置缺省路由只需配和下一跳 ip route-static 10.1.1.0 24 10.44.171.6 preferencce 60/设置优先级为60，数字越小越优先 ip http enableH3C-ospf-1import-route direct /ospf加入直连H3C-ospf-1import-route static /ospf加入静态路由ospf 1 ip unreachables enable 显示跟踪 ip ttl-expires enable 显示跟踪双链路路由器设置：#市路由器：acl advanced 3300 /创建访问控制列表ACL 3300 rule 0 permit ip destination 10.44.200.222 0 /配置允许目的 ip地址或网段（反掩码）访问acl advanced 3333 /创建访问控制列表ACL 3333rule 0 permit ip destination 10.44.200.0 0.0.0.255 /配置允许目的ip网段或固定地址（反掩码）policy-based-route xxx permit node 1 /创建策略路xxx，节点1 if-match acl 3000 /如果是ACL 3000 apply next-hop 10.10.10.11 /指定下一跳ip地址路由器policy-based-route xxx permit node 11 /创建策略路xxx，节点11 if-match acl 3333 /如果是ACL3333 apply next-hop 10.44.171.6 /指定下一跳ip地址路由器在内网口应用策略路由interface GigabitEthernet0/5 port link-mode route ip policy-based-route xxxacl advanced 3500 /创建ACL 3500 rule 1 permit ip destination 10.44.200.222 0 /允许指定目的地址通过，反掩码 rule 11 deny ip destination 10.44.200.0 0.0.0.255 /拒绝目的网段通过，反掩码在外网接口应用上网策略 （outbound是出，inbound是进） interface GigabitEthernet0/10 port link-mode route packet-filter 3500 outbound# 县路由器：acl advanced 3300 /创建ACL 3300访问 rule 0 permit ip source 10.44.200.222 0 /配置允许源ip固定地址，反掩码rule 11 deny ip source 10.44.200.0 0.0.0.255 /拒绝目的网段通过，反掩码acl advanced 3333 /创建ACL 3333访问 rule 0 permit ip source 10.44.200.0 0.0.0.255 /配置允许源ip段地址，反掩码policy-based-route xxx permit node 1 /创建策略路xxx，节点1 if-match acl 3300 /如果是ACL 3300 apply next-hop 10.10.10.11 /指定下一跳ip地址路由器policy-based-route xxx permit node 11 /创建策略路xxx，节点11 if-match acl 3333 /如果是ACL 3333 apply next-hop 10.44.171.5 /指定下一跳ip地址路由器在内网口应用策略路由H3Cinterface Vlan-interface 1 H3C-Vlan-interface1ip policy-based-route xxx quit在外网接口应用上网策略 （outbound是出，inbound是进） interface GigabitEthernet0/10 port link-mode route packet-filter 3300 outbound市A静态配置：<shi AAA>dis cutelnet server enable# ospf 1 import-route direc import-route static ip unreachables enable ip ttl-expires enablepolicy-based-route xxx permit node 1 if-match acl 3300 policy-based-route xxx permit node 11 if-match acl 3333 interface GigabitEthernet0/1 port link-mode routeinterface GigabitEthernet0/3 port link-mode routeinterface GigabitEthernet0/5 port link-mode route ip policy-based-route xxxinterface GigabitEthernet0/10 port link-mode route packet-filter 3300 outboundacl advanced 3300 rule 1 permit ip destination 10.44.200.222 0acl advanced 3333local-user admin class manage service-type telnet http https authorization-attribute user-role level-12 authorization-attribute user-role level-15 authorization-attribute user-role network-operator ip http enable ip https enable县B动态ospf<xian BBB>dis cu telnet server enableospf 1# ip unreachables enable ip ttl-expires enablepolicy-based-route yyy permit node 1 if-match acl 3300 policy-based-route yyy permit node 11 if-match acl 3333 interface Vlan-interface1 ip policy-based-route yyyinterface GigabitEthernet0/3 port link-mode route ospf cost 2interface GigabitEthernet0/11 port link-mode route packet-filter 3300 outboundacl advanced 3300 rule 1 permit ip source 10.44.100.222 0acl advanced 3333local-user admin class manage service-type telnet http https authorization-attribute user-role level-15 authorization-attribute user-role network-operator ip http enable ip https enable#县A静态<xian AAA>dis cutelnet server enable ip unreachables enabl ip ttl-expires enablepolicy-based-route xxx permit node 1 if-match acl 3300 policy-based-route xxx permit node 2 if-match acl 3333 interface Vlan-interface1 ip policy-based-route xxxinterface GigabitEthernet0/3 port link-mode route interface GigabitEthernet0/10 port link-mode route packet-filter 3300 outboundline vty 0 4 authentication-mode scheme user-role network-operatorline vty 5 63 user-role network-operator#acl advanced 3300 rule 1 permit ip source 10.44.200.222 0# acl advanced 3333local-user admin class manage authorization-attribute user-role level-15 authorization-attribute user-role network-operator ip http enable ip https enable