Cisco和H3C路由器交换机基本配置.doc

Cisco和H3C路由器交换机基本配置H3C路由器和交换机的基本配置交换机：1.基本配置：(1)视图: 用户视图H3C 系统视图H3C-ui-vty0-4 用户界面视图H3C-ethernet1/0/1 以太网视图(2)reset saved-configuration 初始化 reboot 重启 system-view 进入系统视图H3Csysname H3C 设置主机名H3Csuper password (level 1/2/3) simple/cipher password 配置特权口令H3Csave (safely) 保存设置配置管理IPH3Cinterface vlan 1H3C-Vlan-interface1ip address 192.168.1.2 255.255.255.0 undo ip add配置端口H3Cinterface e1/0/2H3C-ethernet1/0/2duplex auto/full/half flow-control 开启以太网端口Ethernet0/0的流量控制。undo flow-control 关闭以太网端口流量控制 speed 10/100/autodisplay interface ethernet0/0配置网关H3Cip route-static 0.0.0.0 0.0.0.0 192.168.1.1配置Aux口令H3Cuser-interface aux 0 7H3C-ui-aux0-7authentication-mode password set authentication password simple/cipher wnt user privilege level 0/1/2/3配置Console口令H3Cuser-interface 0H3C-ui0authentication-mode password set authentication password simple/cipher wnt user privilege level 0/1/2/3配置vty口令H3Cuser-interface vty 0 4H3C-ui-vty0-4authentication-mode password set authentication password simple/cipher wnt user privilege level 0/1/2/3查看的命令H3Cdisplay history-commandH3Cdisplay versionH3Cdisplay current-configurationH3Cdisplay saved-configurationH3Cdisplay interfaceH3Cdisplay ip interfaceH3Cdisplay interface ethernet(0/0)H3Cdisplay ip host 显示域名解析表2.telnet(1)基于vtyH3Cip host hostname ip-address 静态域名解析 display ip host H3Cinterface vlan 1H3C-Vlan-interface1ip address 192.168.1.2 255.255.255.0 quitH3Cuser-interface vty 0 4H3C-ui-vty0-4authentication-mode password (none/password/scheme) set authentication password simple/cipher wnt user privilege level 0/1/2/3 quit(按Ctrl+键，断开telnet)(按Ctrl+K键，断开telnet)H3Cdisplay users all display users 显示连接本地的telnet会话 display tcp status 显示当前建立的所有TCP链接情况(2)基于用户SwitchH3Cinterface vlan 1H3C-Vlan-interface1ip address 192.168.1.2 255.255.255.0 quitH3Clocal-user bobH3C-luser-bobpassword simple/cipher wnt service-type telnet level 0/1/2/3 quitH3Csuper password simple/cipher wntH3Cuser-interface vty 0 4H3C-ui-vty0-4authentication-mode scheme quitH3Cdomain systemH3C-isp-systemauthentication default localtelnet IP3.vlan（1）可用命令H3C(undo) vlan 3H3C-Vlan3name wnt description gongsi (undo)port ethernet1/0/2 to ethernet1/0/5 把e1/0/2、3、4、5加入vlan 3 port ethernet1/0/6 ethernet1/0/10 把e1/0/6和e1/0/10加入vlan 3 port ethernet1/0/12 save (safely) undo name/description return/quitH3Cdisplay brief interface ethernet 查看端口属于哪个Vlan H3Cdisplay brief interface vlan-interface 查看有几个Vlan H3Cdisplay ip interface brief 查看Vlan信息 H3Cdisplay ip interface vlan-interface 3 查看已配置IP的Vlan信息 H3Cdisplay ip interface 查看配置IP的Vlan H3Cdisplay vlan allH3Cdisplay interface vlan-interfaceH3Cinterface vlan 0001H3C-Vlan-interface1ip address 192.168.1.2 255.255.255.0 undo ip add return/quitH3Cinterface e1/0/5H3C-ethernet1/0/5port access vlan 2（2）单个交换机+Vlan间路由H3Cvlan 2H3C-vlan2name caiwuport e1/0/3 to e1/0/6 quitH3Cvlan 3H3C-vlan3name kaifaport e1/0/8 to e1/0/10quitH3Cinterface vlan 2H3C-vlan-interface2ip add 192.168.1.1 255.255.255.0quitH3Cinterface vlan 3H3C-vlan-interface3ip add 192.168.2.1 255.255.255.0 quit (3)Vlan间路由SwitchAH3Cvlan 2H3C-vlan2name caiwuport e1/0/2 to e1/0/3 quitH3Cvlan 3H3C-vlan3name kaifaport e1/0/4 to e1/0/5quitH3Cinterface e1/0/1H3C-ethernete1/0/1port link-type trunk port trunk permit vlan allH3Cdisplay vlan allRouterAH3Cinterface e0/0H3C-ethernet0/0undo ip addressH3Cinterface e0/0.2H3C-ethernet0/0.2vlan-type dot1q vid 2 ip address 192.168.1.1 255.255.255.0 interface e0/0.3 e0/0.3vlan-type dot1q vid 3 ip address 192.168.2.1 255.255.255.0HostA :192.168.1.2 GW:192.168.1.1HostB :192.168.2.2 GW:192.168.2.1HostA:ping 192.168.2.2路由器：1.基本配置：(1)视图： 用户视图H3C 系统视图H3C-ui-vty0-4 用户界面视图H3C-ethernet1/0/1 以太网视图H3C-serial1/0/0.1 子接口视图H3C-ospf ospf协议视图H3C-rip rip协议视图H3C-serial1/0/0 H3C-serial1/0/0:1 同/异步串口视图H3C-async1/0/0 异步视图(2)修改系统时间clock datatime 11:20:30 2009/11/16 H3Cdisplay clock reset saved-configuration 初始化reboot 重启system-viewH3Csysname H3C 设置主机名H3Csuper password (level 1/2/3) simple/copher password 配置特权口令H3Csave (safely) 保存设置配置端口H3Cinterface e0/0H3C-ethernet0/0ip address 192.168.1.1 255.255.255.0duplex auto/full/halfflow-control 开启以太网端口Ethernet0/0的流量控制。undo flow-control 关闭以太网端口流量控制 speed 10/100/autodisplay interface ethernet0/0配置 aux口令H3Cuser-interface aux 0 7H3C-ui-aux0-7authentication-mode password set authentication password simple/cipher wnt user privilege level 0/1/2/3配置vty口令H3Cuser-interface vty 0 4H3C-ui-vty0-4authentication-mode password password set authentication password simple/cipher wnt user privilege level 0/1/2/3配置console口令H3Cuser-interface console 0H3C-ui-console0authentication-mode password set auehtication password simple/cipher wnt user privilege level 0/1/2/3配置接口IPH3Cinterface e0/0H3C-ethernet0/0ip address 192.168.1.1 255.255.255.0H3Cdns resolve (开启DNS解析) undo dns resolve (关闭DNS解析)H3Cdisplay brief interface 查看端口信息H3Cdisplay brief interface ethernet/seail 查看E/S口信息H3Cdisplay history-command 查看历史命令Debug命令 debug是设备调试，排错中非常重要也非常有效的手段。过程: 无论使用console配置、还是使用远程telnet，都只需要输入: terminal monitor terminal debugging此处以调试链路层协议ppp数据包为例debugging ppp alldebugging ppp pap/chap packetdebugging ospf packetdebugging telnetdebugging nat packetdebugging ip packet注意1.特权模式下debug;可以从display debug看出现在有哪些调试开关是打开的2.关闭调试信息:Routerundo debug all,或者ctrl+d亦可2.telnet禁止用户TELNET到中低端路由器有哪些配置方法1）禁止部分用户telnet：可以通过配置ACL扩展访问列表，deny源是用户主机、目的是路由器、端口是23的tcp类型报文进入。2)禁止全部用户telnet：配置login telnet命令，但不配置任何类型是exec的用户。这样telnet用户登录时会被要求进行验证，但由于没有配置任何用户名，因此不可能验证通过。 (1)基于vtyH3Cinterface e0/0H3C-ethernet0/0ip address 192.168.1.1 255.255.255.0 quitH3Cuser-interface vty 0 4H3C-ui-vty0-4authentication-mode password(none/password/scheme) set authentication password simple/cipher wnt user privilege level 0/1/2/3 quitH3Ctelnet server enable(按Ctrl+键，挂起telnet)(按Ctrl+K键，断开telnet)H3Cdisplay users all 显示每个用户界面连接情况 display tcp status 显示当前建立的所有TCP链接情况(2)基于用户H3Csuper password simple/cipher wntH3Cinterface e0/0H3C-ethernet0/0ip address 192.168.1.1 255.255.255.0 quitH3Clocal-user tom(username)H3C-luser-tompassword simple/cipher wnt service-type telnet level 0/1/2/3 quitH3Cuser-interface vty 0 4H3C-ui-vty0-4authentication-mode scheme quitH3Ctelnet server enabletelnet 192.168.1.2(3)基于端口H3Cuser-interface vty 0 4H3C-ui-vty0-4authentication-mode none 登录验证不需要密码 authentication-mode password 登录验证需要密码 set authentication password cipher/simple wnt user privilege level 0-3 quitH3Ctelnet server enable 开启telnet功能 telnet client source ip 192.168.1.2(客户端ip) telnet client source interface e0/s0(连接客户端的本地端口)quitH3Ctelnet server enabletelnet 192.168.1.2Cisco路由器常用配置命令汇总启动接口，分配IP地址： routerrouter enablerouter#router# configure terminalrouter(config)#router(config)# interface Type Portrouter(config-if)# no shutdownrouter(config-if)# ip address IP-Address Subnet-Maskrouter(config-if)# z配置RIP路由协议：30秒更新一次router(config)# router riprouter(config-if)# network Network-Number router(config-if)# z配置IGRP路由协议：90秒更新一次router(config)# router igrp AS-Number router(config-if)# network Network-Number router(config-if)# z配置Novell IPX路由协议：Novell RIP 60秒更新一次router(config)# ipx routing node addressrouter(config)# ipx maximum-paths Paths router(config)# interface Type Portrouter(config-if)# ipx network Network-Number encapsulation encapsulation-type secondary router(config-if)# z配置DDR：router(config)# dialer-list Group-Number protocol Protocol-Type permit list ACL-Numberrouter(config)# interface bri 0router(config-if)# dialer-group Group-Numberrouter(config-if)# dialer map Protocol-Type Next-Hop-Address name Hostname Telphone-Numberrouter(config-if)# z配置ISDN：router(config)# isdn swith-type Swith-Type router(config-if)# z配置Frame Relay：router(config-if)# encapsulation frame-relay cisco | ietf router(config-if)# frame-relay lmi-type ansi | cisco | q933a router(config-if)# bandwidth kilobitsrouter(config-if)# frame-relay invers-arp Protocol dlci router(config-if)# z配置标准ACL：router(config)# access-list Access-List-Number permit | deny source source-mask router(config)# interface Type Portrouter(config-if)# ip access-group Access-List-Number in | out router(config-if)# z配置扩展ACL：router(config)# access-list Access-List-Number permit | deny Protocol | Protocol-Number source source-wildcard Source-Port destination destination-wildcard Destination-Port established router(config)# interface Type Portrouter(config-if)# ip access-group Access-List-Number in | out router(config-if)# zH3C sysname AR2830AR2830super passwordsuper password level user-level simple | cipher passwordundo super password level user-level user-level 1 - 3simple 明文cipher 密文H3C super password level 3 simple zbrlocal-user password-display-modelocal-user password-display-mode cipher-force | autoundo local-user password-display-modecipher-force 强制方式，即所有接入用户的密码显示方式必须采用密文方式auto 自动方式，即接入用户的密码显示方式可以由用户通过password命令来设置H3C local-user password-display-mode cipher-forceradius scheme systemradius schemeradius-scheme-nameundo radius scheme radius-scheme-nameRADIUS 方案名，为不超过32个字符的字符串，且不能包括/ : ? 缺省情况下，系统中已创建一个名为system的RADIUS方案，其各项属性均为缺省值，该方案不能删除。可以用display radius命令来查看缺省 RADIUS 方案system 的设置。H3C radius scheme h3cH3C-radius-h3cip vpn-instance vpn-instance-nameundo ip vpn-instance vpn-instance-nameip vpn-instance 命令用来创建一个VPN实例，undo ip vpn-instance 命令用来删除指定的vpn实例。H3C ip vpn-instance vpn1H3C-vpn-vpn1local-user user-nameundo local-user user-name | alluser-name 本地用户名，为不超过80个字符的字符串，字符串中不能包括/ : ? 等字符，并且出现的次数不能多于1次，纯用户名(以前的部分，即用户表示符)不能超过55个字符。用户名不区分大小写，输入UserA和usera，系统视为同一个用户。用户名不能以P开头。all 所有用户display local-userH3C local-user h3c1H3C-luser-h3c1password simple | cipher password | sha-256 shapasswordundo passwordsimple 表示密码用明文cipher 表示密码用密文sha-256 表示密码为sha-256摘要simple password 长度为1-48个字符的字符串cipher 长度为1-48个字符的字符串当采用 local-user password-display-mode cipher-force 命令后，即使用户通过password命令指定密码显示方式为明文显示后。也不起作用。H3C-luser-h3c1 password simple 20040422service-typeservice-type dvpn | telnet | ssh | terminal | p