H3C路由器配置.doc

.整体配置过程与解释：sys 进入到系统视图 sysname XXX / 修改路由器名字H3Cip https enable #配置https local-user admin #创建用户adminpassword simple admin#密码admin service-type https #服务型httpsauthorization-attribute user-role level-15 #把权限给角色15 quit#退回上级模式telnet server enable#配置telnet服务 local-user admin #配置telnet 用户名password simple admin888 #配置明文密码为admin888 server-type telnet #配置用户telnet服务类型authorization-attribute user-role level-3 #配置用户级别quituser interface vty 0 4 #线程模式 authorization-mode scheme #用户名+密码quit先配LoopBack 地址再配置ospfxian BBBint LoopBack 10 xian BBB-LoopBack10ip address x.x.x.x x.x.x.x /ip地址#router id 配置路由id先配LoopBack 地址再配置ospfxian BBBint LoopBack 10 xian BBB-LoopBack10ip address x.x.x.x x.x.x.x /ip地址ospf 1 #进程号1area 0 #骨干区域 network 55 network 55VLAN 10 /创建VLANint vlan 10 ip add 24/配置VLAN 10 的IP地址int g0/7 port link-type access #交换机模式#ospf 1 area import route direct /引入直连路由 network 55 network 55interface Vlan-interface1 ip address 04 interface GigabitEthernet0/5 port link-mode route/设置接口为路由模式 ip address 5 #interface GigabitEthernet0/7 port link-mode route /设置接口为路由模式 ip address 5 H3Cip route-static /配置静态目的网段(多个目的路由需配多条)和下一条的出口地址H3Cip route-static /配置缺省路由只需配和下一跳 ip route-static 24 preferencce 60/设置优先级为60，数字越小越优先# ip http enableH3C-ospf-1import-route direct /ospf加入直连H3C-ospf-1import-route static /ospf加入静态路由#ospf 1 area network 55# ip unreachables enable 显示跟踪 ip ttl-expires enable 显示跟踪#ip route-static 24 ip route-static 24 ip route-static 24 #双链路路由器设置：#市路由器：acl advanced 3300 /创建访问控制列表ACL 3300 rule 0 permit ip destination 22 0 /配置允许目的 ip地址或网段（反掩码）访问#acl advanced 3333 /创建访问控制列表ACL 3333rule 0 permit ip destination 55 /配置允许目的ip网段或固定地址（反掩码）#policy-based-route xxx permit node 1 /创建策略路xxx，节点1 if-match acl 3000 /如果是ACL 3000 apply next-hop 1 /指定下一跳ip地址路由器#policy-based-route xxx permit node 11 /创建策略路xxx，节点11 if-match acl 3333 /如果是ACL3333 apply next-hop /指定下一跳ip地址路由器在内网口应用策略路由interface GigabitEthernet0/5 port link-mode route ip address 6 ip policy-based-route xxx#acl advanced 3500 /创建ACL 3500 rule 1 permit ip destination 22 0 /允许指定目的地址通过，反掩码 rule 11 deny ip destination 55 /拒绝目的网段通过，反掩码#在外网接口应用上网策略 （outbound是出，inbound是进） interface GigabitEthernet0/10 port link-mode route ip address 0 packet-filter 3500 outbound# 县路由器：acl advanced 3300 /创建ACL 3300访问 rule 0 permit ip source 22 0 /配置允许源ip固定地址，反掩码rule 11 deny ip source 55 /拒绝目的网段通过，反掩码#acl advanced 3333 /创建ACL 3333访问 rule 0 permit ip source 55 /配置允许源ip段地址，反掩码#policy-based-route xxx permit node 1 /创建策略路xxx，节点1 if-match acl 3300 /如果是ACL 3300 apply next-hop 1 /指定下一跳ip地址路由器#policy-based-route xxx permit node 11 /创建策略路xxx，节点11 if-match acl 3333 /如果是ACL 3333 apply next-hop /指定下一跳ip地址路由器在内网口应用策略路由H3Cinterface Vlan-interface 1 ip address H3C-Vlan-interface1ip policy-based-route xxx quit#在外网接口应用上网策略 （outbound是出，inbound是进） interface GigabitEthernet0/10 port link-mode route ip address 0 packet-filter 3300 outbound# 市A静态配置：dis cutelnet server enable#router id # ospf 1 import-route direc import-route static area network 55# ip unreachables enable ip ttl-expires enable#policy-based-route xxx permit node 1 if-match acl 3300 apply next-hop 0#policy-based-route xxx permit node 11 if-match acl 3333 apply next-hop #interface GigabitEthernet0/1 port link-mode route ip address #interface GigabitEthernet0/3 port link-mode route ip address #interface GigabitEthernet0/5 port link-mode route ip address 6 ip policy-based-route xxx#interface GigabitEthernet0/10 port link-mode route ip address 1 packet-filter 3300 outbound# ip route-static 24 、ip route-static 24 0#acl advanced 3300 rule 1 permit ip destination 22 0 rule 11 deny ip destination 55#acl advanced 3333 rule 11 permit ip destination 55#local-user admin class manage service-type telnet http https authorization-attribute user-role level-12 authorization-attribute user-role level-15 authorization-attribute user-role network-operator# ip http enable ip https enable#县B动态ospfdis cu# telnet server enable# router id 0#ospf 1 area network 55 network 55 network 55# ip unreachables enable ip ttl-expires enable#policy-based-route yyy permit node 1 if-match acl 3300 apply next-hop 1#policy-based-route yyy permit node 11 if-match acl 3333 apply next-hop #interface Vlan-interface1 ip address ip policy-based-route yyy#interface GigabitEthernet0/3 port link-mode route ip address ospf cost 2#interface GigabitEthernet0/11 port link-mode route ip address 0 packet-filter 3300 outbound#acl advanced 3300 rule 1 permit ip source 22 0 rule 11 deny ip source 55#acl advanced 3333 rule 11 permit ip source 55#local-user admin class manage service-type telnet http https authorization-attribute user-role level-15 authorization-attribute user-role network-operator# ip http enable ip https enable#县A静态dis cu#telnet server enable# ip unreachables enabl ip ttl-expires enable#policy-based-route xxx permit node 1 if-match acl 3300 apply next-hop 1#policy-based-route xxx permit node 2 if-match acl 3333 apply next-hop #interface Vlan-interface1 ip address ip policy-based-route xxx#interface GigabitEthernet0/3 port lin