电厂网络设备调试报告

XXXX电厂网络设备调试报告一、网关加密设备根据国网公司全国电力二次系统安全防护总体方案要求，在山东省电力公司安排部署下，山东XXX有限公司于2012年6月在XXXX电厂部署纵向加密认证装置及调试。在完成本阶段的工作后现将工程实施情况做出说明。一、 工程介绍根据国网公司全国电力二次系统安全防护总体方案要求，计划在XXX电厂部署纵向加密认证装置，保证实时业务的加密传输，非实时、保护业务的明文传输。根据现场环境及客户的要求本次装置部署在路由器与交换机之间，保证所有业务VPN都通过纵向加密装置传输。具体网络拓扑结构请参见下图： XXXX电厂节点网络拓扑图实现在部署完成的节点对纵向加密装置进行远程监控、配置、管理。二、 本阶段实施情况本阶段工程于XXXX电厂部署百兆RJ45电口纵向加密设备一台。完成XXX电厂两台百兆RJ45电口纵向加密设备的部署，实现实时业务加密通信；非实时、保护业务明文通信。转发给公司的业务数据传输正常。并在配置中考虑了在未来非实时、保护业务接入密通的需要，能够较快的实现业务的明密通转换。在设备接入的情况下充分考虑到现有网络中交换机与路由器的互连，中心节点网管机对交换机、路由器的远程管理。在设备的配置中保证厂站端交换机的网管正常。通过现场测试与阶段性运行，设备接入后厂站端交换机、路由器网管功能全部正常。 完成一台纵向加密的安装调试，设备运行状况正常。三、 调试报告 首先通过网线连接设备的eth4接口，打开纵向加密管理工1 对设备的基本参数进行配置2 配置vlan3 配置路由4 配置隧道5 配置策略6 将隧道对应的证书导入至此，纵向加密配置完成。 XXXXXXXXXXX(安装)调试工程师；XXX XXXXXXXXXXXXX(记录)人员；XXXXX二、交换机、路由器配置调试文档1. 现场沟通在客户现场经过于客户负责人进行方案沟通，了解到用户购买设备的用途及网络的基本架构情况，并向项目负责人处要取获得网络调试所需要的网络规划数据，并根据网络规划数据现场对设备进行调试和安装。2、 数据网络路由器配置如下：SD-JiaHongZhan.R1dis cu# version 5.20, Release 2209P15, Standard# sysname SD-JiaHongZhan.R1# super password level 3 cipher $c$3$CTWtbnxTybrdIiVNPI7ssukmA7w=# configure-user count 5# domain default enable system# router id 86# telnet server enable# dar p2p signature-file cfa0:/p2p_default.mtd# port-security enable# mpls lsr-id 86#ip vpn-instance vpn-rt route-distinguisher 23721:1 vpn-target 23721:101 export-extcommunity vpn-target 23721:100 import-extcommunity#ip vpn-instance vpn-nrt route-distinguisher 23721:2 vpn-target 23721:201 export-extcommunity vpn-target 23721:200 import-extcommunity#vlan 1#mpls ttl propagate vpn undo ttl expiration pop#mpls ldp#domain system access-limit disable state active idle-cut disable self-service-url disable#user-group system group-attribute allow-guest#local-user admin password cipher $c$3$40gC1cxf/wIJNa1ufFPJsjKAof+QP5aV authorization-attribute level 3 service-type telnet#interface Aux0 async mode flow link-protocol ppp#interface Cellular0/0 async mode protocol link-protocol ppp#interface Serial4/0 description to-RZDD-R-NE40-1 link-protocol ppp ip address 52 ospf cost 500 mpls mpls ldp#interface Serial4/1 description to-RZDD-R-NE40-2 link-protocol ppp ip address 52 ospf cost 500 mpls mpls ldp#interface NULL0#interface LoopBack0 ip address 86 55#interface GigabitEthernet0/0 port link-mode route#interface GigabitEthernet0/0.10 description ce-manage vlan-type dot1q vid 10 ip address 0 40#interface GigabitEthernet0/0.199 description VPN-RT vlan-type dot1q vid 199 ip binding vpn-instance vpn-rt ip address 26 28#interface GigabitEthernet0/0.299 description VPN-NRT vlan-type dot1q vid 299 ip binding vpn-instance vpn-nrt ip address 26 28#interface GigabitEthernet0/1 port link-mode route#bgp 23721 undo synchronization timer keepalive 5 hold 15 group rzdd internal peer rzdd connect-interface LoopBack0 peer 54 group rzdd peer 54 group rzdd # ipv4-family vpn-instance vpn-rt import-route direct # ipv4-family vpn-instance vpn-nrt import-route direct # ipv4-family vpnv4 peer rzdd enable peer 54 enable peer 54 group rzdd peer 54 enable peer 54 group rzdd#ospf 1 import-route direct area network area network # snmp-agent snmp-agent local-engineid 800063A2035866BA7FAA48 snmp-agent community write raddrw snmp-agent community read rzddro snmp-agent community write rzddrw snmp-agent sys-info version all undo snmp-agent trap enable voice dial# load xml-configuration# load tr069-configuration#user-interface con 0user-interface tty 13user-interface aux 0user-interface vty 0 4 set authentication password cipher $c$3$wjDircwXvMELIqIp/gS9nLzGdO#return3、数据网络交换机配置如下SD-JiaHongZhan.S1dis cu# sysname SD-JiaHongZhan.S1# super password level 3 cipher 1D.L#-MI_,UMD0PV(YO1!#radius scheme system#domain system#vlan 1#vlan 10 description CE-Manage#vlan 199 description VPN-RT#vlan 299 description VPN-NRT#interface Vlan-interface10 description CE-Manage ip address 7 40#interface Vlan-interface199 description VPN-RT#interface Vlan-interface299 description VPN-NRT#interface Aux1/0/0#interface Ethernet1/0/1 port access vlan 199#interface Ethernet1/0/2 port access vlan 199#interface Ethernet1/0/3 port access vlan 199#interface Ethernet1/0/4 port access vlan 199#interface Ethernet1/0/5 port access vlan 199#interface Ethernet1/0/6 port access vlan 199 #interface Ethernet1/0/7 port access vlan 199#interface Ethernet1/0/8 port access vlan 199#interface Ethernet1/0/9 port access vlan 299#interface Ethernet1/0/10 port access vlan 299#interface Ethernet1/0/11 port access vlan 299#interface Ethernet1/0/12 port access vlan 299#interface Ethernet1/0/13 port access vlan 299#interface Ethernet1/0/14 port access vlan 299 #interface Ethernet1/0/15 port access vlan 299#interface Ethernet1/0/16 port access vlan 299#interface Ethernet1/0/17 port access vlan 299#interface Ethernet1/0/18 port access vlan 299#interface Ethernet1/0/19 port access vlan 299#interface Ethernet1/0/20 port access vlan 299#interface Ethernet1/0/21 port access vlan 299#interface Ethernet1/0/22 port access vlan 299 #interface Ethernet1/0/23 port access vlan 299#interface Ethernet1/0/24 port link-type trunk port trunk permit vlan 1 10 199 299 description to MSR3020-1#interface GigabitEthernet1/1/1#interface GigabitEthernet1/1/2#interface GigabitEthernet1/1/3#interface GigabitEthernet1/1/4# undo irf-fabric authentication-mode#interface NULL0# voice vlan mac-address 0001-e300-0000 mask ffff-ff00-0000# ip route-static 0 preference 60# snmp-agent snmp-agent local-engineid 800063A280F62E48316E6877 snmp-agent community read rzddro snmp-agent community write rzddrw snmp-agent sys-info version all#user-interface aux 0 7user-interface vty 0 4 set authentication password cipher ;1ST$Q&SQ=QMAF41!#return4、 数据网络路由器端口分配情况interface Serial4/0和interface Serial4/1用来和市局的路由器进行互联interface GigabitEthernet0/0接口用来和局域网交换机互联5、数据网络交换机端口分配情况interface Ethernet1/0/1- interface Ethernet1/0/8属于VLAN 199interface Ethernet1/0/9- interface Ethernet1/0/23属于VLAN 299交换机的interface Ethernet1/0/24用来上连路由器6、办公内网路由器配置如下RZJHC-R1dis cu# version 5.20, Release 2209P15, Standard# sysname RZJHC-R1# super password level 3 cipher $c$3$CTWtbnxxC10pT7uUvrZHmk1YLr0e# ftp server enable# domain default enable system# router id 97# telnet server enable# dar p2p signature-file cfa0:/p2p_default.mtd# port-security enable#vlan 1#domain system access-limit disable state active idle-cut disable self-service-url disable#user-group system group-attribute allow-guest#local-user abcd password cipher $c$3$1+SFRrfPojx/CBya4Jm68VTXlNRmo6Q= authorization-attribute level 3 service-type ftplocal-user admin password cipher $c$3$nH3DI7gxrRRbVjEB+lUxm5phiOczymvd authorization-attribute level 3 service-type telnet#cwmp undo cwmp enable#interface Aux0 async mode flow link-protocol ppp#interface Cellular0/0 async mode protocol link-protocol ppp ppp mp Mp-group 1 ospf cost 5000 ospf authentication-mode md5 10 cipher $c$3$IqIpnvXcfL0Hwry18cHg=#interface Serial4/0 fe1 unframed link-protocol ppp ppp mp Mp-group 1#interface Serial4/1 fe1 unframed link-protocol ppp#interface Mp-group1 ip address 8 52 ospf cost 5000 ospf authentication-mode md5 10 cipher $c$3$dl8Nu2ESu3LBNXalzg=#interface NULL0#interface LoopBack0 ip address 97 55#interface GigabitEthernet0/0 port link-mode route ip address 8 48#interface GigabitEthernet0/1 port link-mode route#ospf 1 import-route direct area 7 authentication-mode md5 network 97 network 2 network 6 stub no-summary#voice-setup # sip # sip-server # call-rule-set # call-route # dial-program default entity fax protocol standard-t38 default entity fax protocol standard-t38 hb-redundancy 0 default entity fax protocol standard-t38 lb-redundancy 0 # aaa-client # gk-client# snmp-agent snmp-agent local-engineid 800063A2035866BA7FAAD8 snmp-agent community read 80126589 snmp-agent community write Sednet02 snmp-agent sys-info version all snmp-agent target-host trap address udp-domain params securityname 80126589 snmp-agent target-host trap address udp-domain 3