Bras ME60维护手册专业资料

BrasME60维护手册

12月

目录

一、设备配备脚本.....................................

二、新设备（顾客）开局脚本..........................

2.1汇聚/接入互换机开局..................................

2.2配备纯Portal拨号业务.................................

2.3配备静态1P业务（绑定顾客【P）............................................

2.4配备静态IP业务（不绑定顾客】P）.......................................

2.5配备Portal拨号业务+固定IP...................................................

2.6配备Portal拨号业务（绑定顾客1P）.....................................

三、维护命令.........................................

3.1.1查看域...............................................

3.1.2杳看域内顾客状态.....................................

3.1.3查看网络联通性.......................................

3.1.4查看总顾客数.........................................

3.1.5强制某顾客下线.......................................

3.1.6查看地址池占用率.....................................

3.1.7查用巡检命令.........................................

一、设备配备脚本

设备配备较多，仅列出维护有关某些

<WGYXY_ME6()>discur

sysnamcJRZK-ME60批注[Al]:配备主机名

radius-servergroupwgyxy

radius-serverauthentication001812weight0

radius-serveraccounting001813weight0

radius-servershared-keyhwine60

radius-servernas-ip-address192.168.1Oil

radius-serverattributetranslate

undoradius-serveruser-namedomain-included批注|A2]:像法深溜Radius

#

rndius-scrvcrauthorization00shared-keyhwmc60批注[A3]：松权深渊Radius对Bras讲行操作（顾客欠

费踢下线）

#

#

aclnumber60(X)

rule20permittepsourceuser-groupportaldestination-porteqwww

rule25permittepsourceuser-groupportaldestination-porteq8080

rule30permittepsourceuser-groupportaldestination-porteq801

rule35pennittepsourceuser-groupportaldestination-porteq802

rule40permittopsourceuser-groupportaldestination-porteq803

rule45permittepsourceuser-groupportaldestination-porteq8(M

rule50permittepsourceuser-groupportaldestination-porteq443批注IA4]:开放深渊Portal端口

#

ippool3jiao_ap_xibaslocal

gateway

section054

cxcludcd-ip-addrcss1O.IO.3O.2

dns-server89

#

ippoolguanlibaslocal批注|A7):定义设备管理地址池

gateway54

secdonO10.1L0.153

cxcludcd-ip-addrcss53

#

ippoolporta)baslocal批注|A8]:定义学生寝室Portal地址池.

gateway

section054

excluded-ip-addrcss10.50.1(X).100

diis-bcivui89

#

#

aaa

local-userhuaweipasswordirreversible-cipher

Sla$:a(TQ#W<C2$Az(<.t<；r*N%-AG$h2S-G6:/&A#lw;:V4$3Vq6YOS

kxral-uscrhuaweiscrvicc-typctelnet

local-userhuaweilevel15

local-userhuaweistateblockfail-times3interval5

auihentication-schemedefauhO

autheinication-scheinedefault!

authentication-schemedefault

authentication-modelocalradius

amhentication-scheinepppoe

aulhcnlication-inodcnone

aulhcntication-schcmcradius

#

authorization-schemedefault

#

accounting-schemedefaultO

accounting-schemedefaultI

accounting-schemepppoc

accounting-modenone

accounting-schemejrzk

accounting-scheineradius

accountinginteriminterval10批注［A9J：定义每ID分钟向Radius上传一次计费报文.

#

duiiiuindefaultO

ip-poolqinshi-l

dnsprimary-ip8

dnssecond-ip9

user-groupportal

web-sen-er00

web-serveruri

web-serverurl-parameter批注［A10］:定义认讪前康，用来为学生分派IP地址,

并推送Portal页面

domaindefaultI

domaindefault_admin

domainportal

authentication-schemeradius

accounting-schemeradius

radius-servergroupwgyxy批注[All):定义认征域,学生通过Portal输入顾客名及

密'码后，公山从征城出仃身份认配，

domainguanli

authentication-schemepppoc

accounting-schcmcpppoc

ip-poolguanli批注IA12]:定义用尸设备管理域，该域中定义都是互

换机管理地址。

#

interfaceE(h-TrunkI

description(O-HW-SI2708|20G|

modeuser-termination

load-balancepacket-all批注[A13]:下联较室网核心8614

#

interfaceEth-Trunkl.l批注(A14J:Elhl.l用于终结Portal拨号业务.

descriptionpor(al_bohao

user-vlan101148qinq21li2114批注[A15]:终结顾客vlan：

内层vlanlOl-148

Ubci-vlaii101148qinq2141外层vlan2111-2114

user-vlan101148qinq2171

user-vlan101148qinq22112213

user-vlan201248qinq2213

user-vlan101148qinq2240

user-vlan201248qinq2240

user-vlan301348qinq2240

user-vlan101148qinq23212324

user-vlan101148qinq2341

user-vlan101148qinq2371

user-vlan101148qinq24212425

user-vlan101148qinq2441

user-vlan101148qinq2471

user-vlan101148qinq25112518

user-vlan101148qinq2520

user-vlan101148qinq2540

user-vlan201248qinq2540

user-vlan101148qinq2542

user-vlan101148qinq2561

user-vlan101148qinq26112614

user-vlan101148qinq2641

user-vlan101148qinq27112713

user-vlan101148qinq27412742

user-vlan101148qinq2810

user-vlan201248qinq2810

user-vlan101148qinq28212822

user-vlan101148qinq2830

usui-vluii201248qinq2830

user-vlan101148qinq2840

user-vlan201248qinq2840

user-vlan101148qinq2851

user-vlan101148qinq28612862

user-vlan101148qinq2870

user-vlan201248qinq2870

bas

#

access-typeIayer2-subscriberdefault-domainauthenticationportal

authentication-methodweb

arp-trigger

#

#

interlaceEth-Trunkl.2批注［A16］：Ethl.2效互换设备管理用.

descriptiondcvicc_managcmcnt

user-vlan

user-vlanqinq21112114

user-vlanqinq2141

user-vlanqinq2171

user-vlanqinq22112213

uscr-vlanqinq22402243

user-vlanqinq23212324

user-vlanqinq2341

user-vlanqinq2371

user-vlanqinq24212425

user-vlanqinq2441

ubui-vlunqinq2471

user-vlanqinq25112518

user-vlanqinq2520

user-vlanqinq2540

user-vlanqinq2542

user-vlanqinq2561

user-vlanqinq26112614

user-vlanqinq2641

user-vlanqinq27112713

user-vlanqinq27412742

user-vlanqinq2810

user-vIanqinq28212822

user-vlanqinq2830

user-vlanqinq2840

uscr-vlanqinq2851

user-vlanqinq28612862

user-vlanqinq2870

bas

#

access-typeIayer2-subscriberdetaull-domainauthenticationguanli

aulhcnlication-methodbind

arp-proxy

ip-trigger

arp-trigger

其她子接口可依照子接口描述拟定业务！

#

#

inierlaccEih-Trunk2

portswitch

descriptionto-USG9000-F\V(20G］

portlink-typetrunk

porttrunkallow-passvlan1054000批注［A17］：上联USG防火墙

#

interlaceGigabitEthernel1/0/0

undoshutdown

eth-trunkI

#

interfaceGigabitEthemet170/1

undoshutdown

e(h-(runk1

#

interfaceGigabitEthemet1/0/2

undoshutdown

eth-trunk2

#

interfaceGigabitEthemet1/0/3

undoshutdown

eth-trunk2

#

interfaceGigabitEthemet1/0/4

description(o_powercache

undoshutdown

ipaddress#批注[A18]:F联PowcK'achc

interfaceGigabitEthemetI/0/9

negotiationauto

description(O-H3CI2508

undoshutdown

ipaddress6批注(A19):卜联H3C1250&用于榜文办公网,图书馆,实

验室.

#

#

iproute-staticVlanif4000descriptionuplink-USG9000-FW批注[A20]:默认出口路由为FW

iproute-static批注[A21]:由于某些3教地以3层琏路接到因

而需向下回指静态路由

iproute-static

iproute-static255.255.255.0

iprouie-static255.255.255,0

iproute-static255.255.255.0

iproute-static255.255.255.0

iproute-static255.255.255.0

iproute-static255.255.255.0

iproute-static255.255.255.0

iproute-static255.255.255.0

iproute-static10.10.11,0255.255.255.0

iproute-static255.255.255.0

iproute-static255.255.255.0

iproute-static255.255.255.0

iproute-siatic255.255.255.0

iproute-static255.255.255.0

iproute-static255.255.255.0)

iproute-static255.255.255.0

ipluulc-Miilic255.255.255.0

iproute-static10.10.20.0255.255.255.0

iproute-static255.255.255.0

iproute-static255.255.255.0

iproute-static255.255.255.0

iproute-static255.255.255.0

iproute-staticIO.22.O.O255.255.255.0

iproute-static255.255.255.0

iproute-static255.255.255.0

iproute-static9255.255.255.2557descriptionto-ATM

iproute-static255.255.255.2557descriptionto-ATM批注队22］：去往学校ATM

#

#

static-user10.11.0,25454gateway54interfaceEth-Trunkl.2vlan

domain-nameguanlidcteci批注[A23]:定义前态IP互换机管理地址，以本条命令

为例，将cth1.2接口从vlan上来顾客，容许其静态配

static-user11gateway54interfaceEth-Trunkl.2vanqinq2111备成54,网关54.

针对固定IP顾客•配备原理也是同样.

domain-nameguanlidetect

static-user22gateway10.11.255.254interfaceEth-Trunk1.2vlanqinq2112

domain-nameguanlidetect

static-user33gateway54interfaceEth-U'runk1.2vlanqinq2113

domain-nameguanlidcteci

static-user44gateway1().11.255.254interfaceEth-Trunkl.2vlanqinq2114

domain-nameguanlidetect

stalic-user11gateway10.11.255.254interfaceEth-Trunk1.2vanqinq2141

domain-nameguanlidetect

static-user5454gateway54interfaceEth-Trunkl.2vlan

domain-nameguanlidetect

blatic-usci1IO.11.2.11gulcway54intuifuccElli-Ttunkl.2vlanqinq22!1

domain-nameguanlidetect

static-user22gateway54interfaceEth-Trunkl.2vanqinq2212

domain-nameguanlidetect

static-user10.1i.2.13iO.l1.2.14gateway10.1i.255.254interfaceEth-Trunk1.2vanqinq2213

domain-nameguanlidcteci

static-user13gateway54interfaceEth-Trunkl.2vanqinq2240

domain-nameguanlidetect

stalic-user5454gateway54interfaceEth-Trunk1.2vlan

domain-nameguanlidetect

static-user11gateway54interfaceEth-Trunk1.2vanqinq2321

domain-nameguanlidetect

static-user22gateway54interfaceEth-Trunk1.2vanqinq2322

domain-nameguanlidetect

static-user33gateway10.11.255.254interfaceEth-Trunki.2vanqinq2323

domain-nameguanlidetect

static-user410.11.3.24gateway54interfaceEth-Trunkl.2vanqinq2324

domain-nameguanlidetect

static-user11gateway54interfaceEth-Trunkl.2vanqinq2341

domain-nameguanlidetect

static-user11gateway10.)1.255.254interfaceEth-Trunkl.2vanqinq2371

domain-nameguanlidetect

static-user5354gateway54interfaceEth-Trunkl.2vlan

domain-nameguanlidetect

#

web-auth-server00port50100keysimplehwme60批注［A24］:配备Petal服务㈱

二、新设备（顾客）开局脚本

2.1汇聚/接入互换机开局

场景：假定新建•套中区11号楼汇聚和接入互换机，其外层VLAN为1011,内层管理地址

为II,内层Ixx为一楼互换机，2xx为二楼互换机，依次类推。

1.定义一种管理IP地址池：

ippoolguanli-zhongqu-11baslocal

gateway54

section053

excluded-ip-address53批注［A25J:固定IP顾客必要将地址从地址池中移除。

2.在管理域中加入此地址池:

aaa

domainguanli

ip-poolguanli-zhongqu-11

3.在Bras口上终结此VLAN

interfaceElh-Trunkl.2

user-vlan11批注|A26]:汇聚设务管理vlan是不带外层标签

user-vlan11qinq1011批注[A27J:楼乂互映机通过汇聚设备会打上2层标签

4.定义静态IP顾客（互换机）

stalic-user52gateway54interfaceEth-Trunkl.2vlan11qinq101i

doinain-nameguanlidetect批注|A2X|:如果是设备管理IP.建议放到guanli这个

域中.

siatic-user5353gateway54interfaceEth-Trurkl.2vlanII

domain-nameguanlidetect

2.2配备纯Portal拨号业务

场景：假定新建一套中区11号楼汇聚和接入互换机，其外层VLAN为1011,内层Ixx为一

楼比换机，2xx为二楼G换机，依次类推。如果此Porlal业务需要为其新分派段1P,则需要

执行如下1-3悚作，如果与既有业务相似，可直接进行笫3步。

1.定义一种管理IP地址池：

ippoolncw-ycwubaslocal

gateway

section054

2.在新建域中加入此地址池：

aaa

domainnew-ycwuO

ip-poolncw-ycwu

dnsprimary-ip3

user-groupportal

web-server

web-serverurl

web-serverurl-parameter

domain[w.cau

authcntication-schcmcradius

accounting-schemeradius

value-added-serviceaccount-typeradiusjrzk

radius-servergroupjrzk

user-groupinside

3.在Bras口上终结此VLAN

interfaceEth-Trunkl.x批注|A291:需新建一种子接口

user-vlan101148qinq1001

user-vlan201248qinq1011

bas

#

access-typelayer2-subscriberdefault-domainpre-authenticationnew-yewuOauthentication

authentication-methodweb

arp-trigger

注意：以上为新业务配备办法，如果是既有业务，以寝室Portal为例，仅需要执行第3步,

见下:

interfaceEth-Trunk1.1

user-vlan101148qinq1001

user-vlan201248qinq1011

2.3配备静态IP业务（绑定顾客IP）

场景：某个实验室主机IP地址手动配番为/24,网关为,对其中某些主

机规定地址绑定（如某台主机只能配备成10.2030.100）,

1.定义一种IP地址池：

ippoollabIbaslocal

gatewayIO.2O.3O.I

section053

excluded-ip-address53

2.在新建域中加入此地址池:

aaa

domain

ip-poollabI

3.在Bias口上终结此VLAN

interfaceEth-Trunkl.x

user-vlan批注[A30]:假设顾咨vlan为

bas

access-typeIayer2-subscriberdefaull-doinainaulhentication

authenticalion-nicthodbind

arp-proxy

ip-trigger

arp-trigger

#

4.定义静态IP顾客

static-user54gatewayinterfaceEth-Trunkl.xvlan

domain-namelabIdetect批注[A31]:将/24子网与映客vlan绑定.

static-user0000gatewayinterfaceElh-Trunklxmac-address

xxxx.xxxx.xxxxdomain-nameguanlidetect批注IA32]:为单个帧客绑定IP.如果顾客有唯一vlan,

可以基于vlan,如果与其她主机共用同一种vlan,可以

基于mac地址绑定，

2.4配备静态IP业务（不绑定顾客IP）

场紧：某个实验室主机IP地址手动配备为/24,网关为。

1.为子网新建子接口：

interfaceEih-TrunkI.

vlan-lypcdollq批注|A33|:假设其VLAN为

ipaddress

2.5配备Portal拨号业务+固定IP

场景：某个办公室，两个领导需要固定IP（免认证拨号），别的员工为Portal认证上网。

IP段为/24,网关为,领导1P为00和10.20.30200.

Portal拨号业务配备办法与2.2小节相以，不再重红。本节在已配备Portal拨号业务基本上,

增长固定1P功能。

1.修改原有IP地址池：

ipp（x）lofficebaslocal

gateway

section054

excluded-ip-address00

excluded-ip-address00批注[A34]:将两个领导IP从地址池中排除.

2.新建一种名为guding域：

aaa

authcntication-schcmcpppoc

authentication-modenone

accounting-scheinepppoe

accounting-inodenone

domainguding

aulhcnlication-schcmcpppoe

accounting-schcmcpppoe批注|A35|:先认证

2.静态绑定领导地址IP：

static-user0000gatewayinterfaceEth-Trunkl.xvlanx

domain-namegudingdetect批注（A361：建议新建一种名为guding域.便于日后维

护。也可以放到guanli这个域中。

static-user0000gatewayinterfaceEth-Trunk1.xvlanx

domain-namegudingdetect批注|A37］：建议新建一种名为guding域,便于日后维

护。也可以放到guanli这个域中。

2.6配备Portal拨号业务（绑定顾客IP）

场景：某个实验室，代理机需要DHCP获取固定IP地址，代理机可通过Ponal认证来控制

学生机与否能上网。

IP段为/24,网关为,代理机IP为10.2030.100.

Portal拨号业务配备办法与2.2小节相似，不再重更。木节在已配冬Portal拨号业务基本匕

简介代理机1P绑定功能。

1.修改原有IP地址池：

ipp（x）lofficehaslocal

gateway

section054

static-bindipnaddress00mac-addressxxxx.xxxx.xxxx批注|A3X|:绑定管理机MAC地址.使其句次自动获取

IP地址都是10.20.3'）.100.

如有多分管理机，需配备多条.

三、维护命令

3.1.1查看域

|ME6()]disdomain

DomainnameStateCARAccess-limitOnlineBODNumRptVSMNum

defaultOActive01525762400

default1Active0152576000

<jcfault_adminActive0152576200

portalActive015257610500

guanliActive0152576IIO00

gudingActive01525761500

liyuguanActive0152576200

waijiaoActive01525761700

zhulouActive01525761200

tiyuguanOActive0152576000

waijiaoOActive0152576500

zhulouOActive0152576400

duomeitiOActive