H3C路由器+三层交换机NAT共享上网.doc

H3C路由器+三层交换机NAT共享上网配置MSR 20-21 配置disp curr#version 5.20, Release 1205, Standard#sysname H3C#super password level 3 cipher G/&,*9)%QNAOJR+IZST1!#firewall enable#domain default enable system#dns resolvedns server 66dns server 6dns server 33#telnet server enable#dialer flow-interval 60dialer-rule 1 ip permit#vlan 1#radius scheme systemserver-type extendedprimary authentication 1645primary accounting 1646user-name-format without-domain#domain systemaccess-limit disablestate activeidle-cut disableself-service-url disable#traffic classifier bt operator andif-match protocol bittorrent#traffic behavior 64Kcar cir 64 cbs 4000 ebs 0 green pass red discardtraffic behavior 64k#qos policy kill-btclassifier bt behavior 64K#local-user userlevel 3local-user telnetpassword cipher email=GO3ZRV/6HX_%XPA3ZF1/email!service-type telnet terminallevel 3#acl number 2000rule 0 permit source 55rule 5 deny#acl number 3001rule 0 deny udp destination-port eq tftprule 1 deny tcp destination-port eq 135rule 2 deny udp destination-port eq 135rule 3 deny udp destination-port eq netbios-nsrule 4 deny udp destination-port eq netbios-dgmrule 5 deny tcp destination-port eq 139rule 6 deny udp destination-port eq netbios-ssnrule 7 deny tcp destination-port eq 445rule 8 deny udp destination-port eq 445rule 9 deny tcp destination-port eq 539rule 10 deny udp destination-port eq 539rule 11 deny udp destination-port eq 593rule 12 deny tcp destination-port eq 593rule 13 deny udp destination-port eq 1434rule 14 deny udp destination-port eq 1433rule 15 deny tcp destination-port eq 4444rule 16 deny tcp destination-port eq 9996rule 17 deny tcp destination-port eq 5554rule 18 deny udp destination-port eq 9996rule 19 deny udp destination-port eq 5554rule 20 deny tcp destination-port eq 137rule 21 deny tcp destination-port eq 138rule 22 deny tcp destination-port eq 1025rule 23 deny udp destination-port eq 1025rule 24 deny tcp destination-port eq 9995rule 25 deny udp destination-port eq 9995rule 26 deny tcp destination-port eq 1068rule 27 deny udp destination-port eq 1068rule 28 deny tcp destination-port eq 1023rule 29 deny udp destination-port eq 1023rule 141 deny udp source-port eq bootpsrule 160 permit icmp icmp-type echorule 161 permit icmp icmp-type echo-replyrule 162 permit icmp icmp-type ttl-exceededrule 165 deny icmprule 200 deny tcp destination-port eq wwwrule 202 deny tcp destination-port eq ftprule 204 deny tcp destination-port eq 3389rule 205 permit tcp destination-port eq telnetacl number 3002rule 0 deny udp destination-port eq tftprule 1 deny tcp destination-port eq 135rule 2 deny udp destination-port eq 135rule 3 deny udp destination-port eq netbios-nsrule 4 deny udp destination-port eq netbios-dgmrule 5 deny tcp destination-port eq 139rule 6 deny udp destination-port eq netbios-ssnrule 7 deny tcp destination-port eq 445rule 8 deny udp destination-port eq 445rule 9 deny tcp destination-port eq 539rule 10 deny udp destination-port eq 539rule 11 deny udp destination-port eq 593rule 12 deny tcp destination-port eq 593rule 13 deny udp destination-port eq 1434rule 14 deny udp destination-port eq 1433rule 15 deny tcp destination-port eq 4444rule 16 deny tcp destination-port eq 9996rule 17 deny tcp destination-port eq 5554rule 18 deny udp destination-port eq 9996rule 19 deny udp destination-port eq 5554rule 20 deny tcp destination-port eq 137rule 21 deny tcp destination-port eq 138rule 22 deny tcp destination-port eq 1025rule 23 deny udp destination-port eq 1025rule 24 deny tcp destination-port eq 9995rule 25 deny udp destination-port eq 9995rule 26 deny tcp destination-port eq 1068rule 27 deny udp destination-port eq 1068rule 28 deny tcp destination-port eq 1023rule 29 deny udp destination-port eq 1023rule 30 permit tcp destination-port eq telnetrule 141 deny udp source-port eq bootpsrule 160 permit icmp icmp-type echorule 161 permit icmp icmp-type echo-replyrule 162 permit icmp icmp-type ttl-exceededrule 165 deny icmprule 170 permit ip source 2 0rule 171 permit ip source 3 0rule 172 permit ip source 8 0rule 173 permit ip source 0rule 174 permit ip source 9 0rule 175 permit ip source 2 0rule 177 permit ip source 5 0rule 178 permit ip source 7 0rule 179 permit ip source 4 0rule 180 permit ip source 1 0rule 181 permit ip source 3 0rule 182 permit ip source 2 0rule 183 permit ip source 4 0rule 184 permit ip source 6 0rule 185 permit ip source 9 0rule 186 permit ip source 74 0rule 187 permit ip source 53 0rule 188 permit ip source 6 0rule 189 permit ip source 1 0rule 190 permit ip source 1 0rule 191 permit ip source 4 0rule 192 permit ip source 0 0rule 193 permit ip source 5 0rule 194 permit ip source 6 0rule 195 permit ip source 1 0rule 196 permit ip source 8 0rule 197 permit ip source 2 0rule 198 permit ip source 7 0rule 199 permit ip source 10 0rule 200 permit ip source 2 0rule 201 permit ip source 00 0rule 202 permit ip source 9 0rule 203 permit ip source 0 0rule 204 permit ip source 8 0rule 205 permit ip source 3 0rule 206 permit ip source 2 0rule 207 permit ip source 2 0rule 208 permit ip source 7 0rule 209 permit ip source 70 0rule 210 permit ip source 44 0rule 211 permit ip source 43 0rule 212 permit ip source 0rule 213 permit ip source 88 0rule 214 permit ip source 1 0rule 215 permit ip source 0 0rule 216 permit ip source 3 0rule 217 permit ip source 7 0rule 218 permit ip source 0rule 219 permit ip source 4 0rule 1000 deny ip#interface Aux0async mode flowlink-protocol ppp#interface Dialer0nat outbound 2000firewall packet-filter 3001 inboundlink-protocol pppppp chap user xxxppp chap password cipher JBa(VNaE:+7Q=QMAF41!ppp pap local-user xxx password cipher JBa(VNaE:+7Q=QMAF41!ppp ipcp dns admit-anytimer hold 0shutdownip address ppp-negotiatetcp mss 1024dialer user onedialer-group 1dialer bundle 1dialer timer idle 0#interface Dialer1nat outbound 2000link-protocol pppppp chap user xxxppp chap password cipher 4P6A.RLAC1KQ=QMAF41!ppp pap local-user xxx password cipher 4P6A.RLAC1KQ=QMAF41!timer hold 0ip address ppp-negotiatetcp mss 1024dialer user twodialer-group 1dialer bundle 2dialer timer idle 0#interface Ethernet0/0port link-mode routepppoe-client dial-bundle-number 1qos apply policy kill-bt inboundqos apply policy kill-bt outboundstandby interface Dialer1standby bandwidth 2000dar protocol-statistic flow-interval 5#interface Ethernet0/1port link-mode routepppoe-client dial-bundle-number 2qos apply policy kill-bt inboundqos apply policy kill-bt outboundstandby interface Dialer0standby bandwidth 2000dar protocol-statistic flow-interval 5#interface NULL0#interface Vlan-interface1ip address firewall packet-filter 3002 inbound#interface Ethernet0/2port link-mode bridge#interface Ethernet0/3port link-mode bridge#interface Ethernet0/4port link-mode bridge#interface Ethernet0/5port link-mode bridge#interface Ethernet0/6port link-mode bridge#interface Ethernet0/7port link-mode bridge#interface Ethernet0/8port link-mode bridge#interface Ethernet0/9port link-mode bridge#ip route-static Dialer0ip route-static Dialer1 preference 80#dhcp server detect#arp source-suppression enablearp static 7 0050-ba69-7510arp static 10 0011-2feb-c14farp static 6 0011-2f0f-8781arp static 3 0050-ba26-748barp static 5 000e-a639-c159arp static 44 0005-5de1-c57farp static 8 0011-d82b-4d65arp static 2 0013-8fc1-4768arp static 7 000e-a69a-ac3carp static 1 5254-ab59-2d38arp static 5 0011-d82b-4d8darp static 4 0013-8fc1-479darp static 1 0000-e8a4-1a27arp static 7 0013-8fb2-a30barp static 9 000e-a617-c920arp static 2 0013-8fab-b404arp static 1 0011-2f0c-2719arp static 2 000e-a68a-96d3arp static 4 000e-a68a-9568arp static 2 0005-5d04-4b51arp static 3 0011-d89e-6c91arp static 0 000e-a63c-6991arp static 2 0005-5d73-6259arp static 9 000c-7635-1f11arp static 00 000a-eb07-34a1arp static 0 0005-5de1-ce2earp static 53 0011-2f04-71a4arp static 2 0013-d41c-8488arp static 8 0005-5d66-8d4farp static 70 0005-5d67-88bcarp static 6 0040-0547-0822arp static 3 0013-20b1-7ea5arp static 79 000e-a638-fba4arp static 000e-7f26-4194arp static 9 000e-a6b0-a72aarp static 8 0050-ba1a-ac9darp static 60 000c-6e57-7005arp static 0 0009-6bbf-b847arp static 000e-7f25-a0a0arp static 2 0050-ba26-79e1arp static 37 0011-2f1b-5193arp static 40 0000-b4c9-dad3arp static 61 000e-a639-c1baarp static 43 0005-5d66-8e8barp static 6 00ae-2801-062barp static 66 0005-5d05-3fecarp static 000e-a69e-e3cearp static 2 000e-a6c8-4220arp static 11 000e-a691-9a89arp static 14 0000-e8a3-b33earp static 1 0011-d89e-6dd8arp static 54 000e-a672-cff8arp static 56 000e-a639-c161arp static 74 000e-a617-ab21arp static 50 0005-5dff-b72carp static 6 0005-5de1-c56carp static 192.168.0.