园区网真实详细配置大全案例

在这里插入图片描述

实现要求:
1、只允许行政部电脑对全网telnet管理
2、所有dhcp都在核心
3、wifi用户只能上外网,不能访问局域网其它电脑
4、所有交换机上开rstp协议,接入交换机上都开bpdu保护,核心lsw1设置为根桥
5、只允许vlan 10-40上网
5、所有接入交换机开dhcp snoop
6、所有的交换机指定核心交换机为ntp时间服务器,ntp再指向外网作为服务器。
7、ac+ap为二层组网
8、所有的交换和路由console登陆都要账号密码
9、所有的管理vlan为999,网关在核心
10、nat上网,外线为pppoe拨号上网

R1配置:

dis current-configuration
[V200R003C00]

sysname isp

clock timezone China-Standard-Time minus 08:00:00
dhcp enable

ip pool pppoe
gateway-list 60.0.0.1
network 60.0.0.0 mask 255.255.255.0
dns-list 8.8.8.8

aaa
authentication-scheme default
authorization-scheme default
accounting-scheme default
domain default
domain default_admin
local-user admin password cipher % % U6C1S:n4<F*(iTL^nQ'/5x% %
local-user admin service-type ppp

firewall zone Local
priority 15

interface Virtual-Template0
ppp authentication-mode chap
remote address pool pppoe
ip address 60.0.0.1 255.255.255.0

interface GigabitEthernet0/0/0
ip address 8.8.8.1 255.255.255.0

interface GigabitEthernet0/0/1
pppoe-server bind Virtual-Template 0

user-interface con 0
authentication-mode password
user-interface vty 0 4
user-interface vty 16 20

wlan ac

return

R2配置:

<out_router>dis current-configuration
[V200R003C00]

sysname out_router

clock timezone China-Standard-Time minus 08:00:00

portal local-server load flash:/portalpage.zip

drop illegal-mac alarm

ntp-service unicast-server 192.168.99.1

wlan ac-global carrier id other ac id 0

set cpu-usage threshold 80 restore 75

acl number 2000
rule 5 permit source 192.168.10.100 0
rule 10 deny
acl number 2001
rule 5 permit source 192.168.0.0 0.0.63.255

aaa
authentication-scheme default
authorization-scheme default
accounting-scheme default
domain default
domain default_admin
local-user admin password cipher % % |#rD/aWa47N_{G/1^[Q3`.0#% %
local-user admin privilege level 15
local-user admin service-type telnet terminal

firewall zone Local
priority 15

interface Dialer0
link-protocol ppp
ppp chap user admin
ppp chap password cipher % % KoFK!Yrm<T9h0T3{J3@@, l / l/% l/%$
ip address ppp-negotiate
dialer user admin
dialer bundle 1
nat outbound 2001

interface GigabitEthernet0/0/0
pppoe-client dial-bundle-number 1

interface GigabitEthernet0/0/1
ip address 10.0.0.1 255.255.255.0

interface GigabitEthernet0/0/2

interface NULL0

ip route-static 0.0.0.0 0.0.0.0 Dialer0
ip route-static 192.168.0.0 255.255.192.0 10.0.0.2

user-interface con 0
authentication-mode aaa
user-interface vty 0 4
acl 2000 inbound
authentication-mode aaa
user-interface vty 16 20

wlan ac

return

lsw1配置

dis current-configuration

sysname core

vlan batch 10 20 30 40 50 100 999

cluster enable
ntdp enable
ndp enable

undo nap slave enable

drop illegal-mac alarm

stp mode rstp
stp root primary
dhcp enable

diffserv domain default

acl number 2000
rule 5 permit source 192.168.10.100 0
rule 10 deny

acl number 3000
rule 1 deny ip source 192.168.40.0 0.0.0.255 destination 192.168.99.0 0.0.0.255
rule 5 deny ip source 192.168.40.0 0.0.0.255 destination 192.168.0.0 0.0.31.255
rule 10 permit ip

drop-profile default

ip pool vlan20

ip pool vlan40
gateway-list 192.168.40.1
network 192.168.40.0 mask 255.255.255.0
dns-list 8.8.8.8

aaa
authentication-scheme default
authorization-scheme default
accounting-scheme default
domain default
domain default_admin
local-user admin password cipher XJUN8<9N-:5NZPO3JBXBHA!!
local-user admin privilege level 15
local-user admin service-type telnet terminal

ntp-service unicast-server 8.8.8.8
ntp-service refclock-master 2
ntp-service unicast-server 192.168.99.1

interface Vlanif1

interface Vlanif10
description xzb
ip address 192.168.10.1 255.255.255.0
dhcp select interface
dhcp server static-bind ip-address 192.168.10.100 mac-address 5489-981f-2e0e
dhcp server dns-list 8.8.8.8

interface Vlanif20
description scb
ip address 192.168.20.1 255.255.255.0
dhcp select interface
dhcp server dns-list 8.8.8.8

interface Vlanif30
description yfb
ip address 192.168.30.1 255.255.255.0
dhcp select interface
dhcp server static-bind ip-address 192.168.30.100 mac-address 5489-9832-7ea4
dhcp server dns-list 8.8.8.8

interface Vlanif40
description wifi_yw
ip address 192.168.40.1 255.255.255.0
dhcp select global

interface Vlanif50
description ap_manage
ip address 192.168.50.1 255.255.255.0
dhcp server excluded-ip-address 192.168.50.2
dhcp select interface

interface Vlanif100
description to_router
ip address 10.0.0.2 255.255.255.0

interface Vlanif999
description manage_all
ip address 192.168.99.1 255.255.255.0

interface MEth0/0/1

interface Eth-Trunk1
port link-type trunk
port trunk allow-pass vlan 10 999
mode lacp-static

interface Eth-Trunk2
port link-type trunk
port trunk allow-pass vlan 20 999
mode lacp-static

interface Eth-Trunk3
port link-type trunk
port trunk allow-pass vlan 30 999

interface Eth-Trunk4
port link-type trunk
port trunk allow-pass vlan 40 50 999
traffic-filter inbound acl 3000
mode lacp-static

interface GigabitEthernet0/0/1
port link-type trunk
port trunk pvid vlan 100
port trunk allow-pass vlan 100

interface GigabitEthernet0/0/2
port link-type access
port default vlan 50

interface GigabitEthernet0/0/3
eth-trunk 1

interface GigabitEthernet0/0/4
eth-trunk 1

interface GigabitEthernet0/0/5
eth-trunk 2

interface GigabitEthernet0/0/6
eth-trunk 2

interface GigabitEthernet0/0/7
eth-trunk 3

interface GigabitEthernet0/0/8
eth-trunk 3

interface GigabitEthernet0/0/9
eth-trunk 4

interface GigabitEthernet0/0/10
eth-trunk 4

ip route-static 0.0.0.0 0.0.0.0 10.0.0.1

user-interface con 0
authentication-mode aaa
user-interface vty 0 4
acl 2000 inbound
authentication-mode aaa

lsw2配置:

<xzb_hj>dis current-configuration

sysname xzb_hj

vlan batch 10 999

stp bpdu-protection

cluster enable
ntdp enable
ndp enable

error-down auto-recovery cause bpdu-protection interval 60

undo nap slave enable

drop illegal-mac alarm

stp mode rstp
dhcp enable

dhcp snooping enable

diffserv domain default

acl number 2000
rule 5 permit source 192.168.10.100 0
rule 10 deny

drop-profile default

aaa
authentication-scheme default
authorization-scheme default
accounting-scheme default
domain default
domain default_admin
local-user admin password cipher XJUN8<9N-:5NZPO3JBXBHA!!
local-user admin privilege level 15
local-user admin service-type telnet terminal

ntp-service unicast-server 192.168.99.1

interface Vlanif1

interface Vlanif999
ip address 192.168.99.2 255.255.255.0

interface MEth0/0/1

interface Eth-Trunk1
port link-type trunk
port trunk allow-pass vlan 10 999
mode lacp-static
dhcp snooping trusted

interface GigabitEthernet0/0/1
eth-trunk 1

interface GigabitEthernet0/0/2
eth-trunk 1

interface GigabitEthernet0/0/3
port link-type access
port default vlan 10
stp edged-port enable
dhcp snooping enable

ip route-static 0.0.0.0 0.0.0.0 192.168.99.1

user-interface con 0
authentication-mode aaa
user-interface vty 0 4
acl 2000 inbound
authentication-mode aaa

lsw3配置

<scb_hj>dis current-configuration

sysname scb_hj

vlan batch 20 999

stp bpdu-protection

cluster enable
ntdp enable
ndp enable

error-down auto-recovery cause bpdu-protection interval 60

undo nap slave enable

drop illegal-mac alarm

stp mode rstp
dhcp enable

dhcp snooping enable

diffserv domain default

acl number 2000
rule 5 permit source 192.168.10.100 0
rule 10 deny

drop-profile default

aaa
authentication-scheme default
authorization-scheme default
accounting-scheme default
domain default
domain default_admin
local-user admin password cipher XJUN8<9N-:5NZPO3JBXBHA!!
local-user admin privilege level 15
local-user admin service-type telnet terminal

ntp-service unicast-server 192.168.99.1

interface Vlanif1

interface Vlanif999
ip address 192.168.99.3 255.255.255.0

interface MEth0/0/1

interface Eth-Trunk2
port link-type trunk
port trunk allow-pass vlan 20 999
mode lacp-static
dhcp snooping trusted

interface GigabitEthernet0/0/1
eth-trunk 2

interface GigabitEthernet0/0/2
eth-trunk 2

interface GigabitEthernet0/0/3
port hybrid pvid vlan 20
port hybrid untagged vlan 20
stp edged-port enable
dhcp snooping enable

ip route-static 0.0.0.0 0.0.0.0 192.168.99.1

user-interface con 0
authentication-mode aaa
user-interface vty 0 4
acl 2000 inbound
authentication-mode aaa

port-group link-type

return

lsw4配置:

<yfb_hj>dis current-configuration

sysname yfb_hj

vlan batch 30 999

stp bpdu-protection

cluster enable
ntdp enable
ndp enable

error-down auto-recovery cause bpdu-protection interval 60

undo nap slave enable

drop illegal-mac alarm

stp mode rstp
dhcp enable

dhcp snooping enable

diffserv domain default

acl number 2000
rule 5 permit source 192.168.10.100 0
rule 10 deny

drop-profile default

aaa
authentication-scheme default
authorization-scheme default
accounting-scheme default
domain default
domain default_admin
local-user admin password cipher XJUN8<9N-:5NZPO3JBXBHA!!
local-user admin privilege level 15
local-user admin service-type telnet terminal

ntp-service unicast-server 192.168.99.1

interface Vlanif1

interface Vlanif999
ip address 192.168.99.4 255.255.255.0

interface MEth0/0/1

interface Eth-Trunk3
port link-type trunk
port trunk allow-pass vlan 30 999
dhcp snooping trusted

interface GigabitEthernet0/0/1
eth-trunk 3

interface GigabitEthernet0/0/2
eth-trunk 3

interface GigabitEthernet0/0/3
port link-type access
port default vlan 30
stp edged-port enable
dhcp snooping enable

interface GigabitEthernet0/0/4
port link-type access
port default vlan 30
stp edged-port enable
dhcp snooping enable

ip route-static 0.0.0.0 0.0.0.0 192.168.99.1

user-interface con 0
authentication-mode aaa
user-interface vty 0 4
acl 2000 inbound
authentication-mode aaa

lsw5配置

<jdzx_hj>dis current-configuration

sysname jdzx_hj

vlan batch 40 50 999

stp bpdu-protection

cluster enable
ntdp enable
ndp enable

error-down auto-recovery cause bpdu-protection interval 60

undo nap slave enable

drop illegal-mac alarm

dhcp enable

dhcp snooping enable

diffserv domain default

acl number 2000
rule 5 permit source 192.168.10.100 0
rule 10 deny

drop-profile default

aaa
authentication-scheme default
authorization-scheme default
accounting-scheme default
domain default
domain default_admin
local-user admin password cipher XJUN8<9N-:5NZPO3JBXBHA!!
local-user admin privilege level 15
local-user admin service-type telnet terminal

ntp-service unicast-server 192.168.99.1

interface Vlanif1

interface Vlanif999
ip address 192.168.99.5 255.255.255.0

interface MEth0/0/1

interface Eth-Trunk4
port link-type trunk
port trunk allow-pass vlan 40 50 999
mode lacp-static
dhcp snooping trusted

interface GigabitEthernet0/0/1
eth-trunk 4

interface GigabitEthernet0/0/2
eth-trunk 4

interface GigabitEthernet0/0/3
port link-type trunk
port trunk pvid vlan 50
port trunk allow-pass vlan 40 50
stp edged-port enable
dhcp snooping enable

ip route-static 0.0.0.0 0.0.0.0 192.168.99.1

user-interface con 0
authentication-mode aaa
user-interface vty 0 4
acl 2000 inbound
authentication-mode aaa

return

AC配置:

dis current-configuration

set memory-usage threshold 0

ssl renegotiation-rate 1

vlan batch 50

authentication-profile name default_authen_profile
authentication-profile name dot1x_authen_profile
authentication-profile name mac_authen_profile
authentication-profile name portal_authen_profile
authentication-profile name macportal_authen_profile

diffserv domain default

radius-server template default

pki realm default
rsa local-key-pair default
enrollment self-signed

acl number 2000
rule 5 permit source 192.168.10.100 0
rule 10 deny

ike proposal default
encryption-algorithm aes-256
dh group14
authentication-algorithm sha2-256
authentication-method pre-share
integrity-algorithm hmac-sha2-256
prf hmac-sha2-256

free-rule-template name default_free_rule

portal-access-profile name portal_access_profile

aaa
authentication-scheme default
authentication-scheme radius
authentication-mode radius
authorization-scheme default
accounting-scheme default
domain default
authentication-scheme radius
radius-server default
domain default_admin
authentication-scheme default
local-user test password irreversible-cipher 1 a 1a 1arMSnJPC9I>KaTeX parse error: Undefined control sequence: \V at position 14: =QQ~JN4fKC5o,\̲V̲*x.# =o=Tm+og^8…
local-user test privilege level 15
local-user test service-type telnet terminal
local-user admin password irreversible-cipher 1 a 1a 1ayRep#S@6lN f X d fXd fXd/:y#d+]wLBZ\kT
L/6WIy~>Uj8Rh J ∣ 8 I " < ∣ 9 J|8I"<|9 J∣8I"<∣9
local-user admin privilege level 15
local-user admin service-type http

interface Vlanif50
ip address 192.168.50.2 255.255.255.0

interface GigabitEthernet0/0/1
port link-type access
port default vlan 50

interface GigabitEthernet0/0/7
undo negotiation auto
duplex half

interface GigabitEthernet0/0/8
undo negotiation auto
duplex half

interface NULL0

snmp-agent local-engineid 800007DB03000000000000
snmp-agent

ssh server secure-algorithms cipher aes256_ctr aes128_ctr
ssh server key-exchange dh_group14_sha1
ssh client secure-algorithms cipher aes256_ctr aes128_ctr
ssh client secure-algorithms hmac sha2_256
ssh client key-exchange dh_group14_sha1

capwap source ip-address 192.168.50.2

user-interface con 0
authentication-mode aaa
user-interface vty 0 4
acl 2000 inbound
authentication-mode aaa
protocol inbound all
user-interface vty 16 20
protocol inbound all

wlan
traffic-profile name default
security-profile name test
security wpa-wpa2 psk pass-phrase %^%#KL!*>z6z’m±`M{B{k+I(U9G1"rHU4W[n&;mq&+
%^%# aes
security-profile name default
security-profile name default-wds
security-profile name default-mesh
ssid-profile name test
ssid wlan-guset
ssid-profile name default
vap-profile name test
service-vlan vlan-id 40
ssid-profile test
security-profile test
vap-profile name default
wds-profile name default
mesh-handover-profile name default
mesh-profile name default
regulatory-domain-profile name default
air-scan-profile name default
rrm-profile name default
radio-2g-profile name default
radio-5g-profile name default
wids-spoof-profile name default
wids-profile name default
wireless-access-specification
ap-system-profile name default
port-link-profile name default
wired-port-profile name default
serial-profile name preset-enjoyor-toeap
ap-group name group1
radio 0
vap-profile test wlan 1
radio 1
vap-profile test wlan 1
radio 2
vap-profile test wlan 1
ap-group name default
ap-id 0 type-id 69 ap-mac 00e0-fcf6-0b20 ap-sn 210235448310E91E775B
ap-name 1_lou_ap
ap-group group1
provision-ap

dot1x-access-profile name dot1x_access_profile

mac-access-profile name mac_access_profile

ntp-service unicast-server 192.168.99.1

return

本文来自互联网用户投稿,该文观点仅代表作者本人,不代表本站立场。本站仅提供信息存储空间服务,不拥有所有权,不承担相关法律责任。如若转载,请注明出处:http://www.mzph.cn/news/131370.shtml

如若内容造成侵权/违法违规/事实不符,请联系多彩编程网进行投诉反馈email:809451989@qq.com,一经查实,立即删除!

相关文章

MFC 窗体插入图片

1.制作BMP图像1.bmp 放到res文件夹下&#xff0c;资源视图界面导入res文件夹下的1.bmp 2.添加控件 控件类型修改为Bitmap 图像&#xff0c;选择IDB_BITMAP1 3.效果

【触想智能】工业显示器上市前的检测项目分享

工业显示器在上市前&#xff0c;需要做一项重要的工作&#xff0c;那就是工业显示器出厂前的产品可靠性检测。 工业显示器选择的测试项目相比商用端更为严格&#xff0c;常见的性能测试项目包括高温老化、防尘防水、电磁静电干扰、防摔防撞等&#xff0c;在工业级应用领域&…

学习Opencv(蝴蝶书/C++)相关——1. 前言 和 第1章.概述

文章目录 1. 整体架构1.1 OpenCV3.01.2 Opencv4.xX. 在线文档X.1 Opencv cheatsheet(小抄)1. 整体架构 1.1 OpenCV3.0 对于Opencv3.x版本,网上最常见的图,图自OpenCV Tutorial-Itseez 现在已经不是500+的算法了,而是2500+,详见:About

CANoe新建XML自动化Test Modules

文章目录 1.打开Test Modules2.新建Environment3.新建XML Test Modules4.新建.can文件5.打开XML Test Modules6.新建xml脚本并保存7.编译8.在.can文件写个测试用例9.修改报告格式为HTML10.运行查看报告后面介绍的文章会重复用到这部分,这里单独介绍下,后面不做重复介绍。 1.…

springboot中使用redis管理session

前言 使用软件&#xff1a; redis&#xff1a; linux版本下载 windows版本下载 安装redis 下载redis http://download.redis.io/releases/ 源码安装redis&#xff08;ubuntu&#xff09; #将指定版本的redis上传到服务器#解压 sudo tar -xzvf redis-6.2.4.tar.gzcd re…

python创建一个简单的flask应用

下面用python在本地和服务器上分别创建一个简单的flask应用&#xff1a; 1.在pc本地 1&#xff09;pip flask后创建一个简单的脚本flask_demo.py from flask import Flaskapp Flask(__name__)app.route(/) def hello_world():return Hello, World!winR进入命令行&#xff0c;…

MongoDB设置密码

关于为什么要设置密码 公司的测试服务器MongoDB服务对外网开放的&#xff0c;结果这几天发现数据库被每天晚上被人清空的了&#xff0c;还新建了个数据库&#xff0c;说是要支付比特币。查了日志看到有个境外的IP登录且删除了所有的集合。所以为了安全起见&#xff0c;我们给m…

NLP之Bert介绍和简单示例

文章目录 1. Bert 介绍2. 代码示例2.1 代码流程 1. Bert 介绍 2. 代码示例 from transformers import AutoTokenizertokenizer AutoTokenizer.from_pretrained("bert-base-chinese") input_ids tokenizer.encode(欢迎来到Bert世界, return_tensorstf) print(input…

图形化ping工具gping

一、介绍 gping能够以折线图的方式&#xff0c;实时展示 ping 的结果&#xff0c;支持 Windows、Linux 和 macOS 操作系统。并且支持多个目标同时Ping同时展示折线图方便对比。下面扩展一下ICMP及ICMP隧道。 ICMP消息结构&#xff1a; ICMP消息是由一个类型字段、一个代码字段、…

台球厅桌球室计时计算软件计费方法,台球厅的电脑怎么计时

台球厅桌球室计时计算软件计费方法&#xff0c;台球厅的电脑怎么计时 今天给大家分享的是 佳易王桌球计时计费软件V18.0版本&#xff0c;只需点开始计时即可&#xff0c;结账的时候&#xff0c;软件自动计算金额。 灯控为可选&#xff0c;点开始计时&#xff0c;相应的桌灯亮…

pytorch 中 nn.Conv2d 解释

1. pytorch nn.Con2d 中填充模式 torch.nn.Conv2d(in_channels, out_channels, kernel_size, stride1, padding0, dilation1, groups1, biasTrue, padding_mode‘zeros’, deviceNone, dtypeNone) 1.1 padding 参数的含义 首先 &#xff0c;padd N, 代表的是 分别在 上下&…

Android 控件背景实现发光效果

主要实现的那种光晕效果&#xff1a;中间亮&#xff0c;四周逐渐变淡的。 这边有三种发光效果&#xff0c;先上效果图。 第一种、圆形发光体 实现代码&#xff1a;新建shape_light.xml&#xff0c;导入以下代码。使用时&#xff0c;直接给view设置为background。 <?xml …

IOS手机耗电量测试

1. 耗电量原始测试方法 1.1 方法原理&#xff1a; 根据iPhone手机右上角的电池百分比变化来计算耗电量。 1.2实际操作&#xff1a; 在iOS通用设置中打开电池百分比数值显示&#xff0c;然后操作30分钟&#xff0c;60分钟&#xff0c;90分钟&#xff0c;看开始时和结束时电池…

专业媒体播放软件Movist Pro中文

Movist Pro是一款专为Mac用户设计的专业媒体播放器。它支持广泛的视频和音频格式&#xff0c;包括MP4、AVI、MKV等&#xff0c;并提供了高级播放控件和定制的视频设置。其直观易用的用户界面&#xff0c;使得播放高清视频更为流畅&#xff0c;且不会卡顿或滞后。同时&#xff0…

Linux 将Qt程序打包为AppImage包

前言 在 Linux 环境下&#xff0c;开发完 Qt 程序后&#xff0c;也需要制作为一个安装包或者可执行文件进行分发。这里介绍使用 linuxdeployqt 将 Qt 程序打包为 .AppImage 应用程序&#xff08;类似于 Windows 的绿色免安装软件&#xff09; 环境配置 配置 Qt 环境变量 这…

链队的练习

链队的练习 相关内容&#xff1a;队列的链式存储结构&#xff08;链队&#xff09; //链队的初始化、入队、出队、取对头 #include<stdio.h> #include<malloc.h> #define OK 1 #define ERROR 0 typedef int Status; //结点结构 typedef struct QNode{ int data; …

C++ Package继承层次,采用继承实现快递包裹的分类计价(分为空运2日达、陆运3日达)。

一、问题描述&#xff1a; Package继承层次&#xff0c;采用继承实现快递包裹的分类计价&#xff08;分为空运2日达、陆运3日达&#xff09;。自定义一个或多个快递公司&#xff0c;自定义计价方法&#xff0c;设计合适、合理的界面文本提示&#xff0c;以广东省内某市为起点&…

【深蓝学院】手写VIO第8章--相机与IMU时间戳同步--作业

0. 题目 1. T1 逆深度参数化时的特征匀速模型的重投影误差 参考常鑫助教的答案&#xff1a;思路是将i时刻的观测投到world系&#xff0c;再用j时刻pose和外参投到j时刻camera坐标系下&#xff0c;归一化得到预测的二维坐标&#xff08;这里忽略了camera的内参&#xff0c;逆深…

一款简单而强大的文档翻译网站

一款文字/文件翻译的网站,支持多个领域的翻译&#xff0c;支持常见的语言翻译(韩/日/法/英/俄/德…),最大百分比的保持原文排版(及个别除外基本100%还原)。 新用户注册就有100页的免费额度&#xff0c;每月系统还会随机赠送翻译额度&#xff0c;说实话这比好多的企业要好的多了…

Magics测量两个圆形中心点距离的方法

摘要&#xff1a;本文介绍如何使用magics测量两个圆孔之间的距离。 问题来源&#xff1a;3D模型打开后&#xff0c;两个圆孔中心点之间的间距测量无法直接通过测距实现&#xff0c;需要进行一些小小的设置才行。 工具选择“量尺”&#xff0c;如果不设置的话&#xff0c;它会默…