ME60维护手册

Bras ME60维护手册2016年12月目 录一、设备配置脚本3二、新设备（用户）开局脚本102.1汇聚/接入交换机开局102.2配置纯Portal拨号业务112.3配置静态IP业务（绑定用户IP）122.4配置静态IP业务（不绑定用户IP）132.5配置Portal拨号业务+固定IP142.6配置Portal拨号业务（绑定用户IP）15三、维护命令163.1.1查看域163.1.2查看域内用户状态173.1.3查看网络联通性173.1.4查看总用户数173.1.5强制某用户下线183.1.6查看地址池占用率183.1.7查用巡检命令18一、 设备配置脚本设备配置较多,仅列出维护相关部分dis cursysname JRZK-ME60配置主机名radius-server group wgyxy radius-server authentication 00 1812 weight 0 radius-server accounting 00 1813 weight 0 radius-server shared-key hwme60 radius-server nas-ip-address radius-server attribute translate undo radius-server user-name domain-included配置深澜Radius#radius-server authorization 00 shared-key hwme60授权深澜Radius对Bras进行操作（用户欠费踢下线）#acl number 6000 rule 20 permit tcp source user-group portal destination-port eq www rule 25 permit tcp source user-group portal destination-port eq 8080 rule 30 permit tcp source user-group portal destination-port eq 801 rule 35 permit tcp source user-group portal destination-port eq 802 rule 40 permit tcp source user-group portal destination-port eq 803 rule 45 permit tcp source user-group portal destination-port eq 804 rule 50 permit tcp source user-group portal destination-port eq 443开放深澜Portal端口#acl number 6001 rule 5 permit ip source user-group portal destination ip-address 00 0 rule 10 permit ip source user-group portal destination ip-address 0 rule 15 permit ip source ip-address 00 0 destination user-group portal rule 20 permit ip source ip-address 0 destination user-group portal rule 25 permit ip source ip-address 55 destination user-group portal rule 30 permit ip source user-group portal destination ip-address 55 rule 35 permit ip source ip-address 55 destination user-group portal rule 40 permit ip source user-group portal destination ip-address 55 rule 45 permit ip source ip-address 55 destination user-group portal rule 50 permit ip source user-group portal destination ip-address 55 rule 55 permit ip source ip-address 8 destination user-group portal rule 60 permit ip source user-group portal destination ip-address 8 rule 65 permit ip source ip-address 0 destination user-group portal rule 70 permit ip source user-group portal destination ip-address 0在未通过认证的情况下，可以免费访问的业务：自服务、DNS、内网资源等。#acl number 6002 rule 30 permit ip source user-group portal destination ip-address any rule 35 permit ip source ip-address any destination user-group portal#ip pool 3jiao_ap_dong bas local gateway section 0 54 excluded-ip-address dns-server 8 9 定义3教东区的AP地址池，其中1作为网关，2-9从地址池中排除。其他业务地址池不再阐述# ip pool 3jiao_ap_xi bas local gateway section 0 54 excluded-ip-address dns-server 8 9 #ip pool guanli bas local 定义设备管理地址池 gateway 54 section 0 53 excluded-ip-address 53# ip pool portal bas local 定义学生寝室Portal地址池。 gateway section 0 54 excluded-ip-address 00 dns-server 8 9 #aaa local-user huawei password irreversible-cipher $1a$:a(TQ#WC2$z(,t;r*N%-AG$h2S-G6:/
w;:V4$3Vq6YO$ local-user huawei service-type telnet local-user huawei level 15 local-user huawei state block fail-times 3 interval 5 authentication-scheme default0 authentication-scheme default1 authentication-scheme default authentication-mode local radius authentication-scheme pppoe authentication-mode none authentication-scheme radius # authorization-scheme default # accounting-scheme default0 accounting-scheme default1 accounting-scheme pppoe accounting-mode none accounting-scheme jrzk accounting-scheme radius accounting interim interval 10定义每10分钟向Radius上传一次计费报文。 # domain default0 ip-pool qinshi-1 dns primary-ip 8 dns second-ip 9 user-group portal web-server 00 web-server url 00/index_3.html web-server url-parameter定义认证前域，用来为学生分配IP地址，并推送Portal页面 domain default1 domain default_admindomain portal authentication-scheme radius accounting-scheme radius radius-server group wgyxy 定义认证域，学生通过Portal输入用户名及密码后，会由认证域进行身份认证。 domain guanli authentication-scheme pppoe accounting-scheme pppoe ip-pool guanli 定义用于设备管理的域，该域中定义的都是交换机的管理地址。 #interface Eth-Trunk1 description to-HW-S12708 20G mode user-termination load-balance packet-all下联寝室网核心8614#interface Eth-Trunk1.1Eth1.1用于终结Portal拨号业务。 description portal_bohao user-vlan 101 148 qinq 2111 2114终结用户vlan：内层vlan101-148外层vlan 2111-2114 user-vlan 101 148 qinq 2141 user-vlan 101 148 qinq 2171 user-vlan 101 148 qinq 2211 2213 user-vlan 201 248 qinq 2213 user-vlan 101 148 qinq 2240 user-vlan 201 248 qinq 2240 user-vlan 301 348 qinq 2240 user-vlan 101 148 qinq 2321 2324 user-vlan 101 148 qinq 2341 user-vlan 101 148 qinq 2371 user-vlan 101 148 qinq 2421 2425 user-vlan 101 148 qinq 2441 user-vlan 101 148 qinq 2471 user-vlan 101 148 qinq 2511 2518 user-vlan 101 148 qinq 2520 user-vlan 101 148 qinq 2540 user-vlan 201 248 qinq 2540 user-vlan 101 148 qinq 2542 user-vlan 101 148 qinq 2561 user-vlan 101 148 qinq 2611 2614 user-vlan 101 148 qinq 2641 user-vlan 101 148 qinq 2711 2713 user-vlan 101 148 qinq 2741 2742 user-vlan 101 148 qinq 2810 user-vlan 201 248 qinq 2810 user-vlan 101 148 qinq 2821 2822 user-vlan 101 148 qinq 2830 user-vlan 201 248 qinq 2830 user-vlan 101 148 qinq 2840 user-vlan 201 248 qinq 2840 user-vlan 101 148 qinq 2851 user-vlan 101 148 qinq 2861 2862 user-vlan 101 148 qinq 2870 user-vlan 201 248 qinq 2870 bas # access-type layer2-subscriber default-domain authentication portal authentication-method web arp-trigger#interface Eth-Trunk1.2 Eth1.2做交换设备管理用.机tal description device_management user-vlan 2000 user-vlan 2000 qinq 2111 2114 user-vlan 2000 qinq 2141 user-vlan 2000 qinq 2171 user-vlan 2000 qinq 2211 2213 user-vlan 2000 qinq 2240 2243 user-vlan 2000 qinq 2321 2324 user-vlan 2000 qinq 2341 user-vlan 2000 qinq 2371 user-vlan 2000 qinq 2421 2425 user-vlan 2000 qinq 2441 user-vlan 2000 qinq 2471 user-vlan 2000 qinq 2511 2518 user-vlan 2000 qinq 2520 user-vlan 2000 qinq 2540 user-vlan 2000 qinq 2542 user-vlan 2000 qinq 2561 user-vlan 2000 qinq 2611 2614 user-vlan 2000 qinq 2641 user-vlan 2000 qinq 2711 2713 user-vlan 2000 qinq 2741 2742 user-vlan 2000 qinq 2810 user-vlan 2000 qinq 2821 2822 user-vlan 2000 qinq 2830 user-vlan 2000 qinq 2840 user-vlan 2000 qinq 2851 user-vlan 2000 qinq 2861 2862 user-vlan 2000 qinq 2870 bas # access-type layer2-subscriber default-domain authentication guanli authentication-method bind arp-proxy ip-trigger arp-trigger其他子接口可根据子接口描述确定业务！#interface Eth-Trunk2 portswitch description to-USG9000-FW 20G port link-type trunk port trunk allow-pass vlan 105 4000上联USG防火墙#interface GigabitEthernet1/0/0 undo shutdown eth-trunk 1#interface GigabitEthernet1/0/1 undo shutdown eth-trunk 1#interface GigabitEthernet1/0/2 undo shutdown eth-trunk 2#interface GigabitEthernet1/0/3 undo shutdown eth-trunk 2#interface GigabitEthernet1/0/4 description to_powercache undo shutdown ip address #下联PowerCache#interface GigabitEthernet1/0/9 negotiation auto description to-H3C12508 undo shutdown ip address 6 下联H3C12508,用于榜文办公网,图书馆,实验室.#ip route-static Vlanif4000 description uplink-USG9000-FW默认出口路由为FWip route-static 由于一些3教是以3层链路接到Bras的，因此需向下回指静态路由ip route-static ip route-static ip route-static ip route-static ip route-static ip route-static ip route-static ip route-static ip route-static ip route-static ip route-static ip route-static ip route-static ip route-static ip route-static ip route-static ip route-static ip route-static ip route-static ip route-static ip route-static ip route-static ip route-static ip route-static ip route-static ip route-static ip route-static 9 55 7 description to-ATMip route-static 55 7 description to-ATM去往学校ATM#static-user 54 54 gateway 54 interface Eth-Trunk1.2 vlan 2000 domain-name guanli detect定义静态IP交换机的管理地址, 以本条命令为例, 将eth1.2接口从vlan 2000上来的用户，允许其静态配置成54，网关54。针对固定IP用户，配置原理也是一样。static-user 1 1 gateway 54 interface Eth-Trunk1.2 vlan 2000 qinq 2111 domain-name guanli detectstatic-user 2 2 gateway 54 interface Eth-Trunk1.2 vlan 2000 qinq 2112 domain-name guanli detect static-user 3 3 gateway 54 interface Eth-Trunk1.2 vlan 2000 qinq 2113 domain-name guanli detect static-user 4 4 gateway 54 interface Eth-Trunk1.2 vlan 2000 qinq 2114 domain-name guanli detect static-user 1 1 gateway 54 interface Eth-Trunk1.2 vlan 2000 qinq 2141 domain-name guanli detect static-user 54 54 gateway 54 interface Eth-Trunk1.2 vlan 2000 domain-name guanli detect static-user 1 1 gateway 54 interface Eth-Trunk1.2 vlan 2000 qinq 2211 domain-name guanli detect static-user 2 2 gateway 54 interface Eth-Trunk1.2 vlan 2000 qinq 2212 domain-name guanli detect static-user 3 4 gateway 54 interface Eth-Trunk1.2 vlan 2000 qinq 2213 domain-name guanli detect static-user 1 3 gateway 54 interface Eth-Trunk1.2 vlan 2000 qinq 2240 domain-name guanli detect static-user 54 54 gateway 54 interface Eth-Trunk1.2 vlan 2000 domain-name guanli detect static-user 1 1 gateway 54 interface Eth-Trunk1.2 vlan 2000 qinq 2321 domain-name guanli detect static-user 2 2 gateway 54 interface Eth-Trunk1.2 vlan 2000 qinq 2322 domain-name guanli detect static-user 3 3 gateway 54 interface Eth-Trunk1.2 vlan 2000 qinq 2323 domain-name guanli detect static-user 4 4 gateway 54 interface Eth-Trunk1.2 vlan 2000 qinq 2324 domain-name guanli detect static-user 1 1 gateway 54 interface Eth-Trunk1.2 vlan 2000 qinq 2341 domain-name guanli detect static-user 1 1 gateway 54 interface Eth-Trunk1.2 vlan 2000 qinq 2371 domain-name guanli detect static-user 53 54 gateway 54 interface Eth-Trunk1.2 vlan 2000 domain-name guanli detect# web-auth-server 00 port 50100 key simple hwme60配置Portal服务器二、 新设备（用户）开局脚本2.1 汇聚/接入交换机开局场景：假定新建一套中区11号楼的汇聚和接入交换机，其外层VLAN为1011，内层管理地址为11，内层1xx为一楼交换机，2xx为二楼交换机，依次类推。1.定义一个管理IP地址池：ip pool guanli-zhongqu-11 bas local gateway 54 section 0 53 excluded-ip-address 53固定IP用户必须将地址从地址池中移除。2.在管理域中加入此地址池：aaadomain guanli ip-pool guanli-zhongqu-11 3.在Bras口上终结此VLANinterface Eth-Trunk1.2user-vlan 11汇聚设备的管理vlan是不带外层标签的user-vlan 11 qinq 1011楼层交换机经过汇聚设备会打上2层标签4.定义静态IP用户（交换机）static-user 52 gateway 54 interface Eth-Trunk1.2 vlan 11 qinq 1011 domain-name guanli 如果是设备的管理IP，建议放到guanli这个域中。detectstatic-user 53 53 gateway 54 interface Eth-Trunk1.2 vlan 11 domain-name guanli detect2.2 配置纯Portal拨号业务场景：假定新建一套中区11号楼的汇聚和接入交换机，其外层VLAN为1011，内层1xx为一楼交换机，2xx为二楼交换机，依次类推。如果此Portal业务需要为其新分配段IP，则需要执行以下1-3的操作，如果与现有业务相同，可直接进行第3步。1.定义一个管理IP地址池：ip pool new-yewu bas local gateway section 0 542.在新建的域中加入此地址池：aaadomain new-yewu0 ip-pool new-yewu dns primary-ip 3 user-group portal web-server web-server url /index_3.html web-server url-parameter domain new-yewu authentication-scheme radius accounting-scheme radius value-added-service account-type radius jrzk radius-server group jrzk user-group inside3.在Bras口上终结此VLANinterface Eth-Trunk1.x需新建一个子接口user-vlan 101 148 qinq 1001user-vlan 201 248 qinq 1011bas # access-type layer2-subscriber default-domain pre-authentication new-yewu0 authentication new-yewu authentication-method web arp-trigger注意：以上为新业务的配置方法，如果是现有业务，以寝室Portal为例，仅需要执行第3步，见下：interface Eth-Trunk1.1user-vlan 101 148 qinq 1001user-vlan 201 248 qinq 10112.3 配置静态IP业务（绑定用户IP）场景：某个实验室的主机IP地址手动配置为/24，网关为，对其中部分主机要求地址绑定（如某台主机只能配置成00）。1.定义一个IP地址池：ip pool lab1 bas local gateway section 0 53 excluded-ip-address 532.在新建域中加入此地址池：aaadomain lab1 ip-pool lab1 3.在Bras口上终结此VLANinterface Eth-Trunk1.xuser-vlan 2016假设用户vlan为2016bas access-type layer2-subscriber default-domain authentication lab1 authentication-method bind arp-proxy ip-trigger arp-trigger #4.定义静态IP用户static-user 54 gateway interface Eth-Trunk1.x vlan 2016 domain-name lab1 detect将/24子网与用户vlan绑定。static-user 00 00 gateway interface Eth-Trunk1.x mac-address xxxx.xxxx.xxxx domain-name guanli detect为单个用户绑定IP，如果用户有唯一的vlan，可以基于vlan，如果与其他主机共用同一个vlan，可以基于mac地址绑定。2.4 配置静态IP业务（不绑定用户IP）场景：某个实验室的主机IP地址手动配置为/24，网关为。1.为子网新建子接口：interface Eth-Trunk1.2016 vlan-type dot1q 2016假设其VLAN为2016ip address 2.5 配置Portal拨号业务+固定IP场景：某个办公室，两个领导需要固定IP（免认证拨号），其余员工为Portal认证上网。IP段为/24，网关为，领导IP为00和00.Portal拨号业务配置方法与2.2小节相同，不再重复。本节在已配置Portal拨号业务的基础上，增加固定IP功能。1.修改原有IP地址池：ip pool office bas local gateway section 0 54 excluded-ip-address 00 excluded-ip-address 00将两个领导的IP从地址池中排除。2.新建一个名为guding的域：aaaauthentication-scheme pppoe authentication-mode none