H3C路由器配置

1、整体配置过程与解释：<H3C>sys 进入到系统视图sysname XXX / 修改路由器名字H3Cip https enable #配置httpslocal-user admin #创建用户adminpassword simple admin#密码admin service-type https #服务型httpsauthorization-attribute user-role level-15 #把权限给角色15quit#退回上级模式telnet server enable#配置telnet 服务local-user admin #配置telnet 用户名password s

2、imple admin888 #配置明文密码为admin888server-type telnet #配置用户telnet 服务类型authorization-attribute user-role level-3 #配置用户级别 quituser interface vty 0 4 #线程模式authorization-mode scheme #用户名+密码quit先配 LoopBack 地址再配置ospfxian BBBint LoopBack 10xian BBB-LoopBack10ip address x.x.x.x x.x.x.x /ip 地址 #router id

3、 配置路由id先配 LoopBack 地址再配置ospfxian BBBint LoopBack 10xian BBB-LoopBack10ip address x.x.x.x x.x.x.x /ip 地址ospf 1 #进程号1area 0 #骨干区域network 55 network 55VLAN 10 /创建VLANint vlan 10 ip add 24/配置 VLAN 10 的 IP地址int g0/7 port link-type access #交换机模式 #ospf 1 area

4、 import route direct / 引入直连路由network 55 network 55interface Vlan-interface1ip address 04 interface GigabitEthernet0/5port link-mode route/ 设置接口为路由模式ip address 5 #interface GigabitEthernet0/7port link-mode

5、 route / 设置接口为路由模式ip address 5 H3Cip route-static /配置静态目的网段（多个目的路由需配多条）和下一条的出口地址H3Cip route-static /配置缺省路由只需配和下一跳ip route-static 24 preferencce 60/设置优先级为60，数字越小越优先#ip http enableH3C-os

6、pf-1import-route direct /ospf 加入直连H3C-ospf-1import-route static /ospf 加入静态路由#ospf 1 area network 55#ip unreachables enable 显示跟踪ip ttl-expires enable 显示跟踪#ip route-static 24 ip route-static 24 ip route-static 24 10.44.

7、171.6#双链路路由器设置：#市路由器：acl advanced 3300 /创建访问控制列表ACL 3300rule 0 permit ip destination 22 0 / 配置允许目的ip 地址或网段（反掩码）访问#acl advanced 3333 /创建访问控制列表ACL 3333rule 0 permit ip destination 55 /配置允许目的ip 网段或固定地址（反掩码）#policy-based-route xxx permit node 1/ 创建策略路xxx，节点1if-match acl 300

8、0/ 如果是 ACL 3000apply next-hop 1/ 指定下一跳ip 地址路由器#policy-based-route xxx permit node 11/ 创建策略路xxx，节点11if-match acl 3333/如果是 ACL3333apply next-hop / 指定下一跳ip 地址路由器在内网口应用策略路由interface GigabitEthernet0/5 port link-mode routeip address 6 ip policy-based-route xx

9、x#acl advanced 3500 /创建 ACL 3500rule 1 permit ip destination 22 0/ 允许指定目的地址通过，反掩码rule 11 deny ip destination 55 /拒绝目的网段通过，反掩码#在外网接口应用上网策略（ outbound 是出， inbound 是进）interface GigabitEthernet0/10port link-mode routeip address 0 packet-filter 3500 ou

10、tbound# 县路由器：acl advanced 3300 /创建 ACL 3300访问rule 0 permit ip source 22 0 / 配置允许源ip 固定地址，反掩码rule 11 deny ip source 55 /拒绝目的网段通过，反掩码 #acl advanced 3333 /创建 ACL 3333访问rule 0 permit ip source 55 /配置允许源ip 段地址，反掩码#policy-based-route xxx permit node 1/ 创建策略

11、路xxx，节点1if-match acl 3300/如果是 ACL 3300apply next-hop 1/ 指定下一跳ip 地址路由器#policy-based-route xxx permit node 11/ 创建策略路xxx，节点11if-match acl 3333/如果是 ACL 3333apply next-hop / 指定下一跳ip 地址路由器在内网口应用策略路由H3Cinterface Vlan-interface 1 ip address H3C-Vlan-interface1i

12、p policy-based-route xxx quit #在外网接口应用上网策略（ outbound 是出， inbound 是进）interface GigabitEthernet0/10 port link-mode routeip address 0 packet-filter 3300 outbound #市 A 静态配置 ：<shi AAA>dis cutelnet server enable#router id # ospf 1 import-route direc import-route static

13、 area network 55#ip unreachables enable ip ttl-expires enable#policy-based-route xxx permit node 1if-match acl 3300 apply next-hop 0 #policy-based-route xxx permit node 11if-match acl 3333 apply next-hop #interface GigabitEthernet0/1 port link-mode ro

14、uteip address #interface GigabitEthernet0/3 port link-mode routeip address #interface GigabitEthernet0/5port link-mode routeip address 6 ip policy-based-route xxx#interface GigabitEthernet0/10 port link-mode routeip address

15、1 packet-filter 3300 outbound #ip route-static 24 、ip route-static 24 0#acl advanced 3300rule 1 permit ip destination 22 0rule 11 deny ip destination 55#acl advanced 3333rule 11 permit ip destination

16、 55#local-user admin class manage service-type telnet http httpsauthorization-attribute user-role level-12authorization-attribute user-role level-15authorization-attribute user-role network-operator#ip http enableip https enable#县 B 动态 ospf<xian BBB>dis cu#telnet server enabl

17、e#router id 0#ospf 1area network 55network 55network 55# ip unreachables enable ip ttl-expires enable#policy-based-route yyy permit node 1if-match acl 3300 apply next-hop 1#policy-based-route yyy permit node 11if-matc

18、h acl 3333 apply next-hop #interface Vlan-interface1ip address ip policy-based-route yyy#interface GigabitEthernet0/3 port link-mode routeip address ospf cost 2#interface GigabitEthernet0/11 port link-mode routeip address 0 255

19、.255.255.0 packet-filter 3300 outbound #acl advanced 3300rule 1 permit ip source 22 0rule 11 deny ip source 55#acl advanced 3333rule 11 permit ip source 55#local-user admin class manageservice-type telnet http httpsauthorization-attribute user-role le

20、vel-15authorization-attribute user-role network-operator#ip http enable ip https enable#县A静态<xian AAA>dis cu#telnet server enable#ip unreachables enabl ip ttl-expires enable#policy-based-route xxx permit node 1if-match acl 3300 apply next-hop 1#policy-based-route xxx permit node 2if-match acl 3333 apply next-hop #interface Vlan-interface1ip address ip policy-based-route xxx#interface GigabitEther