优兆科技itss审核v3.09.3服务报告管理yw-chp

1、国家药典5 月份阶段内容针对国家药典现有网络环境中两台交换机分别承载不同业务系统工作的状况，两台设备之间路由条目不同，为了保障两台交换机能够更好的协同工作，根据我方建议，将交换机直接的静态路由调整为动态路由，并且将一些路由条目进行删减，实现配置优化。主要调整配置如下：1、在 H3C 和锐捷交换机上分别基于原有互联地址启用 OSPF 动态路由协议，并且将直连和静态都在 OSPF 路由协议中进行重分发，确保两台设备能够相互学习路由表。H3C交换机增加配置为：ospf 1 router-id （启用 OSPF 路由协议配置路由 ID）import-route direct（OSPF 中重分发直连子网

2、）import-route sic（OSPF 中重分发静态路由）area （OSPF 路由区域）network 55（OSPF 路由网段）锐捷交换机增加配置为：router ospf 1（启用 OSPF 路由协议）router-id （配置路由 ID）redistribute connected subnets（OSPF 中重分发直连子网）redistribute sic subnets（OSPF 中重分发静态路由）network 55 area 0（OSPF 路由网段和区域配置）2、将原有的两台设备之间互联的静态路由进行删减，对现有路由表进行合理优化。H3C交换机删除配置为：ip route

3、-sic preference 80锐捷交换机删除配置为：ip route 80ip route 533、配置完成后，进行网络连通性测试。1.1 新交换机配置1.1.1 H3C交换机配置HEXIN7510Edis#cuvlan 1 #vlan 2description to juzhuangwang #vlan 3description to neiwang #ver5.20, Release6605P05#sysname HEXIN7510E#default enablesystem#net server enablevlan #vlan #vlan #vlan #vlan10#lldp e

4、nable20#mirroring-group1 local32 to 37#acfp server enable39#acseiserver enable200#swit #description neiwanghulian #vlan 201 description neiwang #vlan 300 to 302 #vlan 3102-enhancedacl #aclnumber2000number3000rule 1 deny ip source55destination 55rule 2 deny ip source55destination 55rule 3 deny ip sou

5、rcedescription #vlan 311 description #vlan 312 description #vlan 313 description #vlan 777 #vlan 4000wlan-MCCHP-wifi5555destinationCHPrule 4 deny ip source5555 #destinationCHP-workacl number 4000rule 0 permit type 0806#fdescriptionlinkto WANpassword simple Chp!2015*#vlan #authorization-attribuevel 3

6、4001service-type #stp instance 0stp enablenetsystems-limit disable e activeroot primaryacsstp region-configuration region-name chprevi-level 1active region-configuration #erface NULL0#idle-cut disableself-service-urldisable#traffic classifier if-match acl 3000 #c_rdoperator andtraffic behavior filte

7、r deny#qos policy p_rdb_rderface Vlan-erface1ip address 54 #erface Vlan-erface2classifierc_rdbehavior b_rdip address 8 #dhcp #dhcpserverip-pool chperface Vlan-erface3ip address 53 serverip-pool vlan37vrrpvrrp vrrpvrid 1vrid 1 vridvirtual-ip 54preempt-mode timer delay 5network mask gateway-list 54dns

8、-list 81 trackerface Vlan-erface4001 reduced 20#dhcp server ip-pool vlan311network mask gateway-list 54dns-list 0 #dhcp server ip-pool vlan312network mask gateway-list 54dns-list 0 #dhcp server ip-pool vlan313network mask gateway-list 54#erface Vlan-erface10ip address 53 vrrp vrrp vrrpvrrpvridvrid v

9、rid444virtual-ip 54priority 110preempt-mode timer delay 5vrid4 trackerface Vlan-erface4001 reduced 20#erface Vlan-erface20ip address #erfaceVlan-erface32#dns-list 8erfaceVlan-erface33#user-group #local-user#systemerfaceVlan-erface36ip address 53 vrrp vrid 2 virtual-ip 54adminvrrp vrrpvrrpvrid 2vrid

10、2 vridpriority 110preempt-mode timer delay 5erface Vlan-erface312ip address 54 #2 trackerfaceVlan-erface4001 reduced 20erface Vlan-erface313#ip address 54 #erface Vlan-erface37ip address 53 erface Vlan- dhcp select relay#erface777vrrp vrrp vrrpvrrpvrid vridvrid333virtual-ip 54priority 110preempt-mod

11、e timer delay 5erface Vlan-erface4001 description link to FWip address #erface GigabitEthernet0/0/1 description to HUIJU5510port link-type trunkvrid3 trackerfaceVlan-erface4001 reduced 20#erface Vlan-erface39ip address 54 #erface Vlan-erface200port trunk permit vllip address mirroring-group 1 mirror

12、ing-port #erface GigabitEthernet0/0/2 description to F5-2port link-type trunkport trunk permit vll qos apply policy p_rd inboundmirroring-group 1 mirroring-port #erface GigabitEthernet0/0/3 description to F4-5120-1-G1/0/50 port link-type trunkport trunk permit vll qos apply policy p_rd inboundmirror

13、ing-group 1 mirroring-port #erface GigabitEthernet0/0/4 description to F6port link-type trunkport trunk permit vll qos apply policy p_rd inboundmirroring-group 1 mirroring-port #erface GigabitEthernet0/0/5description link to F1-5120 port link-type trunkboth#erface Vlan-erface201ip address 53 vrrpvrr

14、p vrrpvrid 5vrid 5 vridvirtual-ip 54preempt-mode timer delay 55 trackerfaceVlan-erface4001 reduced 20both#erface Vlan-erface30054ipaddress #erface Vlan-erface30154ipaddressboth #erface Vlan-erface30254ipaddress #erface Vlan-erface310bothip address 54 #erface Vlan-erface311ip address 54 #port trunk p

15、ermit vllqos apply policy p_rd inboundmirroring-group 1 mirroring-port#botherface port ac #erface port ac #erface port ac #erface port ac #erface port ac #erface port ac #erface port ac #erface port ac #erface port ac #erface port ac #erface port ac #erface port ac #erface port ac #erface port ac #e

16、rfaceGigabitEthernet8/0/4s vlan 3#erface GigabitEthernet0/0/6 description to F5-1port link-type trunkGigabitEthernet8/0/5s vlan 3port trunk permit vlqos apply policy p_rdlinboundGigabitEthernet8/0/6s vlan 3mirroring-group 1 mirroring-portboth#erface GigabitEthernet0/0/7description to RJS8610-G2/24Gi

17、gabitEthernet8/0/7s vlan 3portportlink-type trunktrunk permit vllGigabitEthernet8/0/8s vlan 3#erface GigabitEthernet0/0/8 description to F6-2port link-type trunkGigabitEthernet8/0/9s vlan 3port trunk permit vlqos apply policy p_rdlinboundGigabitEthernet8/0/10s vlan 3#erface GigabitEthernet0/0/9 desc

18、ription to F4-2port link-type trunkGigabitEthernet8/0/11s vlan 3port trunk permit vlqos apply policy p_rdlinboundGigabitEthernet8/0/12s vlan 3#erfaceGigabitEthernet0/0/10#GigabitEthernet8/0/13s vlan 3erfaceGigabitEthernet0/0/11portportlink-type trunktrunk permit vllGigabitEthernet8/0/14s vlan 3#erfa

19、ceGigabitEthernet0/0/12#GigabitEthernet8/0/15s vlan 3erfaceport acGigabitEthernet8/0/1s vlan 2#GigabitEthernet8/0/16s vlan 3erfaceport acGigabitEthernet8/0/2s vlan 2#GigabitEthernet8/0/17s vlan 3erfaceGigabitEthernet8/0/3description toport acs vlan 3GigabitEthernet8/0/18port acs vlan 3#ip#route-sice

20、rfaceport acGigabitEthernet8/0/19s vlan 3iproute-sic#7erfaceGigabitEthernet8/0/20iproute-sicportportlink-type trunktrunk permit vl #snmp-agent snmp-agent800063A203002389A0DE92l#erfaceport acGigabitEthernet8/0/21s vlan 310local-engineid#snmp-agent snmp-agent snmp-agentsnmp-agentsys-info ver group v1

21、chpgroup v2c chpallerfaceGigabitEthernet8/0/22#erfaceport acGigabitEthernet8/0/23s vlan 4000group v3 yaodian read-viewiso write-view isomirroring-group 1 monitor-portsnmp-agent snmp-agent snmp-agent#mib-view included iso iso usm-user v3 chp chpusm-user v3 yaodian yaodian#erfaceport acGigabitEthernet

22、8/0/24s vlan 4000#dhcp server forbidden-ip 00dhcp server forbidden-ip 30 54dhcp server forbidden-ip 54 dhcp server forbidden-ip 00 53dhcp server forbidden-ip 54 dhcp server forbidden-ip 00 53dhcp server forbidden-ip 54 dhcp server forbidden-ip 00 53dhcp server forbidden-ip 54 dhcp server forbidden-i

23、p 00 53dhcp server detect #dhcp enable #arp sic 51 0002-b641-b1ac#erfaceM-Ethernet0/0/0#erfaceTen-GigabitEthernet2/0/1port port portportlink-type trunk trunk permit vl trunk pvid vlanconnection-model20extendmac-address mac-learning disable#erfaceTen-GigabitEthernet2/0/2#erfaceTen-GigabitEthernet4/0/

24、1port link-type trunkport trunk permit vlan 1 20 200 4000 to4001 #erfaceTen-GigabitEthernet4/0/2#ospf 1 router-id import-route directimport-route sarea icnet cnt source ip 54network 55#loadxml-configurationvlan!vlan!vlan!vlan!vlan!vlan!vlan!5#user- user- usseterface aux 0 1erface vty 0 410rivilege l

25、evelauthentication3password35simpleC* #return36372001.1.2 锐捷交换机配置201ydw-core-2#showrunno!servicepassword-encryptionBuilding configuration.Current configuration:3517bytes!verRGOS10.4(3b7)p1Release(135695)(Thu 2012 -ngcf67) hostname ydw-core-2!redundancyMay1716:21:58CSTauto-syncauto-synctime-periodsta

26、ndard3600switchover timeout 4000!mac-manage-learning dispersiveinstall 2!nfpp!24gt/12sfpenable secret 5 $1$uMQk$480u0yz5CC82Dv7v enable service web-server httpenable service web-server https!vlan!vlan!13!spanning-tree mst revi1name chp spanning-tree mstspanning-treeswitchport ac!s vlan 201erfaceGiga

27、bitEthernet 2/13!erfaceGigabitEthernet 2/14configuration!erfaceGigabitEthernet 2/15!0 priority 4096erfaceGigabitEthernet 2/16!erface GigabitEthernet 2/1erfaceGigabitEthernet 2/17switchport acs vlan 201!erfaceGigabitEthernet 2/18erface GigabitEthernet 2/2!switchport acs vlan 201erfaceGigabitEthernet

28、2/19!erface GigabitEthernet 2/3erfaceGigabitEthernet 2/20switchport acs vlan 201no no ip!switchport ip proxy-arpaddress 8 48!erface GigabitEthernet 2/4switchport acs vlan 201!erfaceGigabitEthernet 2/21erface GigabitEthernet 2/5!switchport acs vlan 201erfaceGigabitEthernet 2/22!erface GigabitEthernet

29、 2/6erfaceGigabitEthernet 2/23switchport acs vlan 201!erfaceGigabitEthernet 2/24erface GigabitEthernet 2/7switchport mode trunk medium-type fiberdescription to H3c7510-G0/0/7!erface VLAN 1 no ip proxy-arpip address 53 !erface VLAN 3 no ip proxy-arpip address 52 switchport acs vlan 201!erface GigabitEthernet 2/8switchport acs vlan 201!erface GigabitEthe