园区网真实详细配置大全案例

在这里插入图片描述

实现要求:
1、只允许行政部电脑对全网telnet管理
2、所有dhcp都在核心
3、wifi用户只能上外网,不能访问局域网其它电脑
4、所有交换机上开rstp协议,接入交换机上都开bpdu保护,核心lsw1设置为根桥
5、只允许vlan 10-40上网
5、所有接入交换机开dhcp snoop
6、所有的交换机指定核心交换机为ntp时间服务器,ntp再指向外网作为服务器。
7、ac+ap为二层组网
8、所有的交换和路由console登陆都要账号密码
9、所有的管理vlan为999,网关在核心
10、nat上网,外线为pppoe拨号上网

R1配置:

dis current-configuration
[V200R003C00]

sysname isp

clock timezone China-Standard-Time minus 08:00:00
dhcp enable

ip pool pppoe
gateway-list 60.0.0.1
network 60.0.0.0 mask 255.255.255.0
dns-list 8.8.8.8

aaa
authentication-scheme default
authorization-scheme default
accounting-scheme default
domain default
domain default_admin
local-user admin password cipher % % U6C1S:n4<F*(iTL^nQ'/5x% %
local-user admin service-type ppp

firewall zone Local
priority 15

interface Virtual-Template0
ppp authentication-mode chap
remote address pool pppoe
ip address 60.0.0.1 255.255.255.0

interface GigabitEthernet0/0/0
ip address 8.8.8.1 255.255.255.0

interface GigabitEthernet0/0/1
pppoe-server bind Virtual-Template 0

user-interface con 0
authentication-mode password
user-interface vty 0 4
user-interface vty 16 20

wlan ac

return

R2配置:

<out_router>dis current-configuration
[V200R003C00]

sysname out_router

clock timezone China-Standard-Time minus 08:00:00

portal local-server load flash:/portalpage.zip

drop illegal-mac alarm

ntp-service unicast-server 192.168.99.1

wlan ac-global carrier id other ac id 0

set cpu-usage threshold 80 restore 75

acl number 2000
rule 5 permit source 192.168.10.100 0
rule 10 deny
acl number 2001
rule 5 permit source 192.168.0.0 0.0.63.255

aaa
authentication-scheme default
authorization-scheme default
accounting-scheme default
domain default
domain default_admin
local-user admin password cipher % % |#rD/aWa47N_{G/1^[Q3`.0#% %
local-user admin privilege level 15
local-user admin service-type telnet terminal

firewall zone Local
priority 15

interface Dialer0
link-protocol ppp
ppp chap user admin
ppp chap password cipher % % KoFK!Yrm<T9h0T3{J3@@, l / l/% l/%$
ip address ppp-negotiate
dialer user admin
dialer bundle 1
nat outbound 2001

interface GigabitEthernet0/0/0
pppoe-client dial-bundle-number 1

interface GigabitEthernet0/0/1
ip address 10.0.0.1 255.255.255.0

interface GigabitEthernet0/0/2

interface NULL0

ip route-static 0.0.0.0 0.0.0.0 Dialer0
ip route-static 192.168.0.0 255.255.192.0 10.0.0.2

user-interface con 0
authentication-mode aaa
user-interface vty 0 4
acl 2000 inbound
authentication-mode aaa
user-interface vty 16 20

wlan ac

return

lsw1配置

dis current-configuration

sysname core

vlan batch 10 20 30 40 50 100 999

cluster enable
ntdp enable
ndp enable

undo nap slave enable

drop illegal-mac alarm

stp mode rstp
stp root primary
dhcp enable

diffserv domain default

acl number 2000
rule 5 permit source 192.168.10.100 0
rule 10 deny

acl number 3000
rule 1 deny ip source 192.168.40.0 0.0.0.255 destination 192.168.99.0 0.0.0.255
rule 5 deny ip source 192.168.40.0 0.0.0.255 destination 192.168.0.0 0.0.31.255
rule 10 permit ip

drop-profile default

ip pool vlan20

ip pool vlan40
gateway-list 192.168.40.1
network 192.168.40.0 mask 255.255.255.0
dns-list 8.8.8.8

aaa
authentication-scheme default
authorization-scheme default
accounting-scheme default
domain default
domain default_admin
local-user admin password cipher XJUN8<9N-:5NZPO3JBXBHA!!
local-user admin privilege level 15
local-user admin service-type telnet terminal

ntp-service unicast-server 8.8.8.8
ntp-service refclock-master 2
ntp-service unicast-server 192.168.99.1

interface Vlanif1

interface Vlanif10
description xzb
ip address 192.168.10.1 255.255.255.0
dhcp select interface
dhcp server static-bind ip-address 192.168.10.100 mac-address 5489-981f-2e0e
dhcp server dns-list 8.8.8.8

interface Vlanif20
description scb
ip address 192.168.20.1 255.255.255.0
dhcp select interface
dhcp server dns-list 8.8.8.8

interface Vlanif30
description yfb
ip address 192.168.30.1 255.255.255.0
dhcp select interface
dhcp server static-bind ip-address 192.168.30.100 mac-address 5489-9832-7ea4
dhcp server dns-list 8.8.8.8

interface Vlanif40
description wifi_yw
ip address 192.168.40.1 255.255.255.0
dhcp select global

interface Vlanif50
description ap_manage
ip address 192.168.50.1 255.255.255.0
dhcp server excluded-ip-address 192.168.50.2
dhcp select interface

interface Vlanif100
description to_router
ip address 10.0.0.2 255.255.255.0

interface Vlanif999
description manage_all
ip address 192.168.99.1 255.255.255.0

interface MEth0/0/1

interface Eth-Trunk1
port link-type trunk
port trunk allow-pass vlan 10 999
mode lacp-static

interface Eth-Trunk2
port link-type trunk
port trunk allow-pass vlan 20 999
mode lacp-static

interface Eth-Trunk3
port link-type trunk
port trunk allow-pass vlan 30 999

interface Eth-Trunk4
port link-type trunk
port trunk allow-pass vlan 40 50 999
traffic-filter inbound acl 3000
mode lacp-static

interface GigabitEthernet0/0/1
port link-type trunk
port trunk pvid vlan 100
port trunk allow-pass vlan 100

interface GigabitEthernet0/0/2
port link-type access
port default vlan 50

interface GigabitEthernet0/0/3
eth-trunk 1

interface GigabitEthernet0/0/4
eth-trunk 1

interface GigabitEthernet0/0/5
eth-trunk 2

interface GigabitEthernet0/0/6
eth-trunk 2

interface GigabitEthernet0/0/7
eth-trunk 3

interface GigabitEthernet0/0/8
eth-trunk 3

interface GigabitEthernet0/0/9
eth-trunk 4

interface GigabitEthernet0/0/10
eth-trunk 4

ip route-static 0.0.0.0 0.0.0.0 10.0.0.1

user-interface con 0
authentication-mode aaa
user-interface vty 0 4
acl 2000 inbound
authentication-mode aaa

lsw2配置:

<xzb_hj>dis current-configuration

sysname xzb_hj

vlan batch 10 999

stp bpdu-protection

cluster enable
ntdp enable
ndp enable

error-down auto-recovery cause bpdu-protection interval 60

undo nap slave enable

drop illegal-mac alarm

stp mode rstp
dhcp enable

dhcp snooping enable

diffserv domain default

acl number 2000
rule 5 permit source 192.168.10.100 0
rule 10 deny

drop-profile default

aaa
authentication-scheme default
authorization-scheme default
accounting-scheme default
domain default
domain default_admin
local-user admin password cipher XJUN8<9N-:5NZPO3JBXBHA!!
local-user admin privilege level 15
local-user admin service-type telnet terminal

ntp-service unicast-server 192.168.99.1

interface Vlanif1

interface Vlanif999
ip address 192.168.99.2 255.255.255.0

interface MEth0/0/1

interface Eth-Trunk1
port link-type trunk
port trunk allow-pass vlan 10 999
mode lacp-static
dhcp snooping trusted

interface GigabitEthernet0/0/1
eth-trunk 1

interface GigabitEthernet0/0/2
eth-trunk 1

interface GigabitEthernet0/0/3
port link-type access
port default vlan 10
stp edged-port enable
dhcp snooping enable

ip route-static 0.0.0.0 0.0.0.0 192.168.99.1

user-interface con 0
authentication-mode aaa
user-interface vty 0 4
acl 2000 inbound
authentication-mode aaa

lsw3配置

<scb_hj>dis current-configuration

sysname scb_hj

vlan batch 20 999

stp bpdu-protection

cluster enable
ntdp enable
ndp enable

error-down auto-recovery cause bpdu-protection interval 60

undo nap slave enable

drop illegal-mac alarm

stp mode rstp
dhcp enable

dhcp snooping enable

diffserv domain default

acl number 2000
rule 5 permit source 192.168.10.100 0
rule 10 deny

drop-profile default

aaa
authentication-scheme default
authorization-scheme default
accounting-scheme default
domain default
domain default_admin
local-user admin password cipher XJUN8<9N-:5NZPO3JBXBHA!!
local-user admin privilege level 15
local-user admin service-type telnet terminal

ntp-service unicast-server 192.168.99.1

interface Vlanif1

interface Vlanif999
ip address 192.168.99.3 255.255.255.0

interface MEth0/0/1

interface Eth-Trunk2
port link-type trunk
port trunk allow-pass vlan 20 999
mode lacp-static
dhcp snooping trusted

interface GigabitEthernet0/0/1
eth-trunk 2

interface GigabitEthernet0/0/2
eth-trunk 2

interface GigabitEthernet0/0/3
port hybrid pvid vlan 20
port hybrid untagged vlan 20
stp edged-port enable
dhcp snooping enable

ip route-static 0.0.0.0 0.0.0.0 192.168.99.1

user-interface con 0
authentication-mode aaa
user-interface vty 0 4
acl 2000 inbound
authentication-mode aaa

port-group link-type

return

lsw4配置:

<yfb_hj>dis current-configuration

sysname yfb_hj

vlan batch 30 999

stp bpdu-protection

cluster enable
ntdp enable
ndp enable

error-down auto-recovery cause bpdu-protection interval 60

undo nap slave enable

drop illegal-mac alarm

stp mode rstp
dhcp enable

dhcp snooping enable

diffserv domain default

acl number 2000
rule 5 permit source 192.168.10.100 0
rule 10 deny

drop-profile default

aaa
authentication-scheme default
authorization-scheme default
accounting-scheme default
domain default
domain default_admin
local-user admin password cipher XJUN8<9N-:5NZPO3JBXBHA!!
local-user admin privilege level 15
local-user admin service-type telnet terminal

ntp-service unicast-server 192.168.99.1

interface Vlanif1

interface Vlanif999
ip address 192.168.99.4 255.255.255.0

interface MEth0/0/1

interface Eth-Trunk3
port link-type trunk
port trunk allow-pass vlan 30 999
dhcp snooping trusted

interface GigabitEthernet0/0/1
eth-trunk 3

interface GigabitEthernet0/0/2
eth-trunk 3

interface GigabitEthernet0/0/3
port link-type access
port default vlan 30
stp edged-port enable
dhcp snooping enable

interface GigabitEthernet0/0/4
port link-type access
port default vlan 30
stp edged-port enable
dhcp snooping enable

ip route-static 0.0.0.0 0.0.0.0 192.168.99.1

user-interface con 0
authentication-mode aaa
user-interface vty 0 4
acl 2000 inbound
authentication-mode aaa

lsw5配置

<jdzx_hj>dis current-configuration

sysname jdzx_hj

vlan batch 40 50 999

stp bpdu-protection

cluster enable
ntdp enable
ndp enable

error-down auto-recovery cause bpdu-protection interval 60

undo nap slave enable

drop illegal-mac alarm

dhcp enable

dhcp snooping enable

diffserv domain default

acl number 2000
rule 5 permit source 192.168.10.100 0
rule 10 deny

drop-profile default

aaa
authentication-scheme default
authorization-scheme default
accounting-scheme default
domain default
domain default_admin
local-user admin password cipher XJUN8<9N-:5NZPO3JBXBHA!!
local-user admin privilege level 15
local-user admin service-type telnet terminal

ntp-service unicast-server 192.168.99.1

interface Vlanif1

interface Vlanif999
ip address 192.168.99.5 255.255.255.0

interface MEth0/0/1

interface Eth-Trunk4
port link-type trunk
port trunk allow-pass vlan 40 50 999
mode lacp-static
dhcp snooping trusted

interface GigabitEthernet0/0/1
eth-trunk 4

interface GigabitEthernet0/0/2
eth-trunk 4

interface GigabitEthernet0/0/3
port link-type trunk
port trunk pvid vlan 50
port trunk allow-pass vlan 40 50
stp edged-port enable
dhcp snooping enable

ip route-static 0.0.0.0 0.0.0.0 192.168.99.1

user-interface con 0
authentication-mode aaa
user-interface vty 0 4
acl 2000 inbound
authentication-mode aaa

return

AC配置:

dis current-configuration

set memory-usage threshold 0

ssl renegotiation-rate 1

vlan batch 50

authentication-profile name default_authen_profile
authentication-profile name dot1x_authen_profile
authentication-profile name mac_authen_profile
authentication-profile name portal_authen_profile
authentication-profile name macportal_authen_profile

diffserv domain default

radius-server template default

pki realm default
rsa local-key-pair default
enrollment self-signed

acl number 2000
rule 5 permit source 192.168.10.100 0
rule 10 deny

ike proposal default
encryption-algorithm aes-256
dh group14
authentication-algorithm sha2-256
authentication-method pre-share
integrity-algorithm hmac-sha2-256
prf hmac-sha2-256

free-rule-template name default_free_rule

portal-access-profile name portal_access_profile

aaa
authentication-scheme default
authentication-scheme radius
authentication-mode radius
authorization-scheme default
accounting-scheme default
domain default
authentication-scheme radius
radius-server default
domain default_admin
authentication-scheme default
local-user test password irreversible-cipher 1 a 1a 1arMSnJPC9I>KaTeX parse error: Undefined control sequence: \V at position 14: =QQ~JN4fKC5o,\̲V̲*x.# =o=Tm+og^8…
local-user test privilege level 15
local-user test service-type telnet terminal
local-user admin password irreversible-cipher 1 a 1a 1ayRep#S@6lN f X d fXd fXd/:y#d+]wLBZ\kT
L/6WIy~>Uj8Rh J ∣ 8 I " < ∣ 9 J|8I"<|9 J∣8I"<∣9
local-user admin privilege level 15
local-user admin service-type http

interface Vlanif50
ip address 192.168.50.2 255.255.255.0

interface GigabitEthernet0/0/1
port link-type access
port default vlan 50

interface GigabitEthernet0/0/7
undo negotiation auto
duplex half

interface GigabitEthernet0/0/8
undo negotiation auto
duplex half

interface NULL0

snmp-agent local-engineid 800007DB03000000000000
snmp-agent

ssh server secure-algorithms cipher aes256_ctr aes128_ctr
ssh server key-exchange dh_group14_sha1
ssh client secure-algorithms cipher aes256_ctr aes128_ctr
ssh client secure-algorithms hmac sha2_256
ssh client key-exchange dh_group14_sha1

capwap source ip-address 192.168.50.2

user-interface con 0
authentication-mode aaa
user-interface vty 0 4
acl 2000 inbound
authentication-mode aaa
protocol inbound all
user-interface vty 16 20
protocol inbound all

wlan
traffic-profile name default
security-profile name test
security wpa-wpa2 psk pass-phrase %^%#KL!*>z6z’m±`M{B{k+I(U9G1"rHU4W[n&;mq&+
%^%# aes
security-profile name default
security-profile name default-wds
security-profile name default-mesh
ssid-profile name test
ssid wlan-guset
ssid-profile name default
vap-profile name test
service-vlan vlan-id 40
ssid-profile test
security-profile test
vap-profile name default
wds-profile name default
mesh-handover-profile name default
mesh-profile name default
regulatory-domain-profile name default
air-scan-profile name default
rrm-profile name default
radio-2g-profile name default
radio-5g-profile name default
wids-spoof-profile name default
wids-profile name default
wireless-access-specification
ap-system-profile name default
port-link-profile name default
wired-port-profile name default
serial-profile name preset-enjoyor-toeap
ap-group name group1
radio 0
vap-profile test wlan 1
radio 1
vap-profile test wlan 1
radio 2
vap-profile test wlan 1
ap-group name default
ap-id 0 type-id 69 ap-mac 00e0-fcf6-0b20 ap-sn 210235448310E91E775B
ap-name 1_lou_ap
ap-group group1
provision-ap

dot1x-access-profile name dot1x_access_profile

mac-access-profile name mac_access_profile

ntp-service unicast-server 192.168.99.1

return

本文来自互联网用户投稿,该文观点仅代表作者本人,不代表本站立场。本站仅提供信息存储空间服务,不拥有所有权,不承担相关法律责任。如若转载,请注明出处:http://www.mzph.cn/news/131370.shtml

如若内容造成侵权/违法违规/事实不符,请联系多彩编程网进行投诉反馈email:809451989@qq.com,一经查实,立即删除!

相关文章

MFC 窗体插入图片

1.制作BMP图像1.bmp 放到res文件夹下&#xff0c;资源视图界面导入res文件夹下的1.bmp 2.添加控件 控件类型修改为Bitmap 图像&#xff0c;选择IDB_BITMAP1 3.效果

【触想智能】工业显示器上市前的检测项目分享

工业显示器在上市前&#xff0c;需要做一项重要的工作&#xff0c;那就是工业显示器出厂前的产品可靠性检测。 工业显示器选择的测试项目相比商用端更为严格&#xff0c;常见的性能测试项目包括高温老化、防尘防水、电磁静电干扰、防摔防撞等&#xff0c;在工业级应用领域&…

学习Opencv(蝴蝶书/C++)相关——1. 前言 和 第1章.概述

文章目录 1. 整体架构1.1 OpenCV3.01.2 Opencv4.xX. 在线文档X.1 Opencv cheatsheet(小抄)1. 整体架构 1.1 OpenCV3.0 对于Opencv3.x版本,网上最常见的图,图自OpenCV Tutorial-Itseez 现在已经不是500+的算法了,而是2500+,详见:About

CANoe新建XML自动化Test Modules

文章目录 1.打开Test Modules2.新建Environment3.新建XML Test Modules4.新建.can文件5.打开XML Test Modules6.新建xml脚本并保存7.编译8.在.can文件写个测试用例9.修改报告格式为HTML10.运行查看报告后面介绍的文章会重复用到这部分,这里单独介绍下,后面不做重复介绍。 1.…

springboot中使用redis管理session

前言 使用软件&#xff1a; redis&#xff1a; linux版本下载 windows版本下载 安装redis 下载redis http://download.redis.io/releases/ 源码安装redis&#xff08;ubuntu&#xff09; #将指定版本的redis上传到服务器#解压 sudo tar -xzvf redis-6.2.4.tar.gzcd re…

中间件redis的使用

Java中的中间件配置体现在springboot的yml配置文件中。Springboot框架支持微服务和中间件和restful api远程服务的调用。中间件是Java web系统的中间层的服务系统的调用接口。Springboot的自动装配和约定大于配置机制初始化springcontext的容器空间和注册组件。使用容器管理服务…

python创建一个简单的flask应用

下面用python在本地和服务器上分别创建一个简单的flask应用&#xff1a; 1.在pc本地 1&#xff09;pip flask后创建一个简单的脚本flask_demo.py from flask import Flaskapp Flask(__name__)app.route(/) def hello_world():return Hello, World!winR进入命令行&#xff0c;…

MongoDB设置密码

关于为什么要设置密码 公司的测试服务器MongoDB服务对外网开放的&#xff0c;结果这几天发现数据库被每天晚上被人清空的了&#xff0c;还新建了个数据库&#xff0c;说是要支付比特币。查了日志看到有个境外的IP登录且删除了所有的集合。所以为了安全起见&#xff0c;我们给m…

ffmpeg视频截取时DTS乱序导致无法截取的问题

最近在一个需求中&#xff0c;我需要批量从hls视频中截取出10s的视频&#xff0c;发现有很小概率会截取失败&#xff0c; 视频截取的完整命令如下&#xff1a; ffmpeg -i https://file.xindoo.xyz/utopia-file/local/video/605d3af0a9cb469c91fbb309422e6672/playlist.m3u8 -r…

NLP之Bert介绍和简单示例

文章目录 1. Bert 介绍2. 代码示例2.1 代码流程 1. Bert 介绍 2. 代码示例 from transformers import AutoTokenizertokenizer AutoTokenizer.from_pretrained("bert-base-chinese") input_ids tokenizer.encode(欢迎来到Bert世界, return_tensorstf) print(input…

机器人物理交互场景及应用的实际意义

机器人物理交互场景是指机器人与物理世界或人类进行实际的物理互动和交互的情境。这些场景涉及机器人在不同环境和应用中使用其物理能力&#xff0c;以执行任务、提供服务或与人类互动。 医疗协助&#xff1a; 外科手术助手&#xff1a;机器人可以用于外科手术&#xff0c;提供…

图形化ping工具gping

一、介绍 gping能够以折线图的方式&#xff0c;实时展示 ping 的结果&#xff0c;支持 Windows、Linux 和 macOS 操作系统。并且支持多个目标同时Ping同时展示折线图方便对比。下面扩展一下ICMP及ICMP隧道。 ICMP消息结构&#xff1a; ICMP消息是由一个类型字段、一个代码字段、…

台球厅桌球室计时计算软件计费方法,台球厅的电脑怎么计时

台球厅桌球室计时计算软件计费方法&#xff0c;台球厅的电脑怎么计时 今天给大家分享的是 佳易王桌球计时计费软件V18.0版本&#xff0c;只需点开始计时即可&#xff0c;结账的时候&#xff0c;软件自动计算金额。 灯控为可选&#xff0c;点开始计时&#xff0c;相应的桌灯亮…

pytorch 中 nn.Conv2d 解释

1. pytorch nn.Con2d 中填充模式 torch.nn.Conv2d(in_channels, out_channels, kernel_size, stride1, padding0, dilation1, groups1, biasTrue, padding_mode‘zeros’, deviceNone, dtypeNone) 1.1 padding 参数的含义 首先 &#xff0c;padd N, 代表的是 分别在 上下&…

关于python中全局变量报错解决办法

在函数外面可声明全局变量&#xff0c;如下所示&#xff0c;其中a为全局变量。 a 0 def bbbb():a 1函数处在全局变量声明范围内 若函数处在全局变量声明范围内&#xff0c;则不需要在函数中加global&#xff0c;可直接在函数中使用&#xff0c;如上所示。若强行加了&#x…

Android 控件背景实现发光效果

主要实现的那种光晕效果&#xff1a;中间亮&#xff0c;四周逐渐变淡的。 这边有三种发光效果&#xff0c;先上效果图。 第一种、圆形发光体 实现代码&#xff1a;新建shape_light.xml&#xff0c;导入以下代码。使用时&#xff0c;直接给view设置为background。 <?xml …

IOS手机耗电量测试

1. 耗电量原始测试方法 1.1 方法原理&#xff1a; 根据iPhone手机右上角的电池百分比变化来计算耗电量。 1.2实际操作&#xff1a; 在iOS通用设置中打开电池百分比数值显示&#xff0c;然后操作30分钟&#xff0c;60分钟&#xff0c;90分钟&#xff0c;看开始时和结束时电池…

视频批量混剪剪辑软件类似剪映设计一个模板后, 视频,图片,文字,转场,音频,特效都可以系统随机

随着自媒体时代的到来&#xff0c;越来越多的人加入到了视频创作行列。然而&#xff0c;视频剪辑是一项繁琐的任务&#xff0c;特别是当你需要批量处理多个视频时。为了提高效率&#xff0c;一款名为“视频闪闪”的批量剪辑软件应运而生。 www.shipinshanshan.com “视频闪闪”…

怎样学好java

最近在看一本java方面的书。《java从入门到精通》&#xff0c;里面看到一段如何学习java的话&#xff0c;觉得非常好&#xff0c;下面我分享一下。 如何学好java语言&#xff0c;是所有初学者都需要面对的问题。其实&#xff0c;每种语言的学习方法都大同小异。初学者需要注意…

专业媒体播放软件Movist Pro中文

Movist Pro是一款专为Mac用户设计的专业媒体播放器。它支持广泛的视频和音频格式&#xff0c;包括MP4、AVI、MKV等&#xff0c;并提供了高级播放控件和定制的视频设置。其直观易用的用户界面&#xff0c;使得播放高清视频更为流畅&#xff0c;且不会卡顿或滞后。同时&#xff0…