H3C MSR路由器常见应用场景配置指导

1、MSR常见应用场景配置指导(内部服务器访问典型配置篇)适用产品： H3C MSR20、MSR30、MSR50 各系列的所有产品适应版本：2008.8.15日之后正式发布的版本。绝大部分配置也适用之前发布的版本。使用方法：根据实际应用场景，在本文配置指导基础上，做定制化修改后使用。实际组网中可能存在特殊要求，建议由专业人员或在专业人员指导下操作。本文以MSR2010 产品， 2008.8.15日ESS 1710软件版本为案例（1710以后的版本同样支持）。H3C Comware Platform SoftwareComware Software, Version 5.20, ESS 1710Co

2、mware Platform Software Version COMWAREV500R002B58D001SP01H3C MSR2010 Software Version V300R003B01D004SP01Copyright (c) 2004-2008 Hangzhou H3C Tech. Co., Ltd. All rights reserved.Compiled Aug 15 2008 13:57:11, RELEASE SOFTWARE1.1 内部服务器访问目前大部分企业会在内部网络搭建各种应用服务器，如：WWW、数据库和邮件服务器等，通过在网关设备上启用NAT内部服务器映射功能，

3、可以使外网用户访问企业内部的服务器。但是这种配置下常常会碰到一个问题，外网PC可以正常地访问内部服务器，但是内部PC却无法通过域名或者公网地址访问内部服务器，这是由于网关设备没有启用NAT内部地址转换功能导致的。典型组网如下：配置需求如下：1、 MSR采用单条以太网线路接入Internet；2、 内部存在WWW和SMTP服务器，要求外部PC可以通过访问域名访问内部服务器；3、 内部可以通过域名或者公网地址访问内部服务器；典型配置如下：dis cur#version 5.20, ESS 1711#sysname H3C#ipsec cpu-backup enable#nat aging-time

4、 tcp 300nat aging-time udp 180nat aging-time pptp 300nat aging-time ftp-ctrl 300#domain default enable system#telnet server enable#qos carl 1 source-ip-address range to 54 per-addressqos carl 2 destination-ip-address range to 54 per-address#acl number 30

5、01 name WANDefendrule 0 deny udp destination-port eq tftprule 1 deny tcp destination-port eq 4444rule 2 deny tcp destination-port eq 135rule 3 deny udp destination-port eq 135rule 4 deny udp destination-port eq netbios-nsrule 5 deny udp destination-port eq netbios-dgmrule 6 deny tcp destination-port

6、 eq 139rule 7 deny udp destination-port eq netbios-ssnrule 8 deny tcp destination-port eq 445rule 9 deny udp destination-port eq 445rule 10 deny udp destination-port eq 593rule 11 deny tcp destination-port eq 593rule 12 deny tcp destination-port eq 5554rule 13 deny tcp destination-port eq 9995rule 1

7、4 deny tcp destination-port eq 9996rule 15 deny udp destination-port eq 1434rule 16 deny tcp destination-port eq 1068rule 17 deny tcp destination-port eq 5800rule 18 deny tcp destination-port eq 5900rule 19 deny tcp destination-port eq 10080rule 22 deny tcp destination-port eq 3208rule 23 deny tcp d

8、estination-port eq 1871rule 24 deny tcp destination-port eq 4510rule 25 deny udp destination-port eq 4334rule 26 deny tcp destination-port eq 4331rule 27 deny tcp destination-port eq 4557rule 28 deny udp destination-port eq 4444rule 29 deny udp destination-port eq 1314rule 30 deny tcp destination-po

9、rt eq 6969rule 31 deny tcp destination-port eq 137rule 32 deny tcp destination-port eq 389rule 33 deny tcp destination-port eq 138rule 34 deny udp destination-port eq 136rule 35 deny tcp destination-port eq 1025rule 36 deny tcp destination-port eq 6129rule 37 deny tcp destination-port eq 1029rule 38

10、 deny tcp destination-port eq 20168rule 39 deny tcp destination-port eq 4899rule 40 deny tcp destination-port eq 45576rule 41 deny tcp destination-port eq 1433rule 42 deny tcp destination-port eq 1434rule 43 deny udp destination-port eq 1433rule 200 permit icmp icmp-type echorule 201 permit icmp icm

11、p-type echo-replyrule 202 permit icmp icmp-type ttl-exceededrule 210 deny icmprule 300 permit udp source-port eq dnsrule 310 permit tcp destination-port eq telnetrule 1000 permit ip destination 55rule 2000 deny ipacl number 3003 name LANDefendrule 0 deny udp destination-port eq tf

12、tprule 1 deny tcp destination-port eq 4444rule 2 deny tcp destination-port eq 135rule 3 deny udp destination-port eq 135rule 4 deny udp destination-port eq netbios-nsrule 5 deny udp destination-port eq netbios-dgmrule 6 deny tcp destination-port eq 139rule 7 deny udp destination-port eq netbios-ssnr

13、ule 8 deny tcp destination-port eq 445rule 9 deny udp destination-port eq 445rule 10 deny udp destination-port eq 593rule 11 deny tcp destination-port eq 593rule 12 deny tcp destination-port eq 5554rule 13 deny tcp destination-port eq 9995rule 14 deny tcp destination-port eq 9996rule 15 deny udp des

14、tination-port eq 1434rule 16 deny tcp destination-port eq 1068rule 17 deny tcp destination-port eq 5800rule 18 deny tcp destination-port eq 5900rule 19 deny tcp destination-port eq 10080rule 22 deny tcp destination-port eq 3208rule 23 deny tcp destination-port eq 1871rule 24 deny tcp destination-por

15、t eq 4510rule 25 deny udp destination-port eq 4334rule 26 deny tcp destination-port eq 4331rule 27 deny tcp destination-port eq 4557rule 28 deny udp destination-port eq 4444rule 29 deny udp destination-port eq 1314rule 30 deny tcp destination-port eq 6969rule 31 deny tcp destination-port eq 137rule

16、32 deny tcp destination-port eq 389rule 33 deny tcp destination-port eq 138rule 34 deny udp destination-port eq 136rule 35 deny tcp destination-port eq 1025rule 36 deny tcp destination-port eq 6129rule 37 deny tcp destination-port eq 1029rule 38 deny tcp destination-port eq 20168rule 39 deny tcp des

17、tination-port eq 4899rule 40 deny tcp destination-port eq 45576rule 41 deny tcp destination-port eq 1433rule 42 deny tcp destination-port eq 1434rule 43 deny udp destination-port eq 1433rule 200 permit icmp icmp-type echorule 201 permit icmp icmp-type echo-replyrule 202 permit icmp icmp-type ttl-exc

18、eededrule 210 deny icmprule 1000 permit ip source 55rule 1001 permit udp destination-port eq bootpsrule 2000 deny ipacl number 3200rule 0 permit ip source 55 destination 55rule 1000 deny ip#vlan 1#domain systemaccess-limit disablestate activei

19、dle-cut disableself-service-url disable#user-group system#local-user adminpassword cipher .USE=B,53Q=QMAF41!authorization-attribute level 3service-type telnet#interface Aux0async mode flowlink-protocol ppp#interface Ethernet0/0port link-mode routefirewall packet-filter 3001 inboundnat outboundnat se

20、rver protocol tcp global www inside wwwnat server protocol tcp global smtp inside smtpip address #interface NULL0#interface Vlan-interface1ip address qos car inbound carl 1 cir 512 cbs 32000 ebs 0 green pass

21、red discardqos car outbound carl 2 cir 1024 cbs 64000 ebs 0 green pass red discardnat outbound 3200firewall packet-filter 3003 inbound#interface Ethernet0/1port link-mode bridge#interface Ethernet0/2port link-mode bridge#interface Ethernet0/3port link-mode bridge#interface Ethernet0/4port link-mode

22、bridge#ip route-static ip route-static NULL0ip route-static NULL0ip route-static NULL0ip route-static NULL0ip route-static NULL0#arp anti-attack valid-check enabl

23、earp anti-attack source-mac filterarp anti-attack source-mac threshold 20arp static 0088-0088-0088 1 Ethernet0/4arp static 0088-0088-0089 1 Ethernet0/4arp static 0088-0088-008a 1 Ethernet0/4arp static 0088-0088-008b 1 Ethernet0/4arp static

24、0088-0088-008c 1 Ethernet0/4#load xml-configuration#user-interface aux 0user-interface vty 0 4authentication-mode scheme#MSR常见应用场景配置指导(双出口组网典型配置篇)适用产品： H3C MSR20、MSR30、MSR50 各系列的所有产品适应版本：2008.8.15日之后正式发布的版本。绝大部分配置也适用之前发布的版本。使用方法：根据实际应用场景，在本文配置指导基础上，做定制化修改后使用。实际组网中可能存在特殊要求，建议由专业人员或在专业人员指导下操作。本文以MSR20

25、10 产品， 2008.8.15日ESS 1710软件版本为案例（1710以后的版本同样支持）。H3C Comware Platform SoftwareComware Software, Version 5.20, ESS 1710Comware Platform Software Version COMWAREV500R002B58D001SP01H3C MSR2010 Software Version V300R003B01D004SP01Copyright (c) 2004-2008 Hangzhou H3C Tech. Co., Ltd. All rights reserved.Co

26、mpiled Aug 15 2008 13:57:11, RELEASE SOFTWARE1.1 双出口组网典型配置用户为了同时实现负载分担和链路备份，一般会选择双WAN接入的组网方式。当两条链路都正常的情况下为负载分担，当任意一条链路出现故障时，所有流量可以转发到另外一条链路进行转发，实现动态备份。下面就两种常见的组网给出配置实例。1.1.1 MSR5006双以太网链路接入网络拓扑图如图3所示，MSR5006有两条到同一运营商的链路，G1/0网络地址为/30，G2/0网络地址为/30。正常工作时流量分别从两个接口发出，当任意一条链路出现故障时，流量全部转移

27、到另外一条链路发送。配置需求如下：1、 对内网主机进行限速，上行限制512kbps，下行限制1024kbps；2、 启用防火墙对攻击报文进行过虑；3、 启动ARP防攻击功能和ARP绑定功能，防止ARP欺骗攻击；4、 优化NAT表项老化时间；5、 启用自动侦测功能，检测WAN链路状态；6、 启用基于用户负载分担功能，对流量进行负载分担； 图4 双以太网链路接入拓扑图H3Cdis cur#sysname H3C#firewall packet-filter enable#nat aging-time tcp 300nat aging-time udp 180nat aging-time pptp

28、300nat aging-time ftp-ctrl 300#ip user-based-sharing enableip user-based-sharing route #qos carl 1 source-ip-address range to 54 per-addressqos carl 2 destination-ip-address range to 54 per-address#radius scheme system#domain system#local-

29、user adminpassword cipher .USE=B,53Q=QMAF41!service-type telnetlevel 3#detect-group 1detect-list 1 ip address nexthop #detect-group 2detect-list 1 ip address nexthop #acl number 3000rule 0 permit ip source 55rule 1000 deny ipacl number 3001 na

30、me WAN1Defendrule 0 deny udp destination-port eq tftprule 1 deny tcp destination-port eq 4444rule 2 deny tcp destination-port eq 135rule 3 deny udp destination-port eq 135rule 4 deny udp destination-port eq netbios-nsrule 5 deny udp destination-port eq netbios-dgmrule 6 deny tcp destination-port eq

31、139rule 7 deny udp destination-port eq netbios-ssnrule 8 deny tcp destination-port eq 445rule 9 deny udp destination-port eq 445rule 10 deny udp destination-port eq 593rule 11 deny tcp destination-port eq 593rule 12 deny tcp destination-port eq 5554rule 13 deny tcp destination-port eq 9995rule 14 de

32、ny tcp destination-port eq 9996rule 15 deny udp destination-port eq 1434rule 16 deny tcp destination-port eq 1068rule 17 deny tcp destination-port eq 5800rule 18 deny tcp destination-port eq 5900rule 19 deny tcp destination-port eq 10080rule 22 deny tcp destination-port eq 3208rule 23 deny tcp desti

33、nation-port eq 1871rule 24 deny tcp destination-port eq 4510rule 25 deny udp destination-port eq 4334rule 26 deny tcp destination-port eq 4331rule 27 deny tcp destination-port eq 4557rule 28 deny udp destination-port eq 4444rule 29 deny udp destination-port eq 1314rule 30 deny tcp destination-port e

34、q 6969rule 31 deny tcp destination-port eq 137rule 32 deny tcp destination-port eq 389rule 33 deny tcp destination-port eq 138rule 34 deny udp destination-port eq 136rule 35 deny tcp destination-port eq 1025rule 36 deny tcp destination-port eq 6129rule 37 deny tcp destination-port eq 1029rule 38 den

35、y tcp destination-port eq 20168rule 39 deny tcp destination-port eq 4899rule 40 deny tcp destination-port eq 45576rule 41 deny tcp destination-port eq 1433rule 42 deny tcp destination-port eq 1434rule 43 deny udp destination-port eq 1433rule 200 permit icmp icmp-type echorule 201 permit icmp icmp-ty

36、pe echo-replyrule 202 permit icmp icmp-type ttl-exceededrule 210 deny icmprule 300 permit udp source-port eq dnsrule 310 permit tcp destination-port eq telnetrule 1000 permit ip destination 55rule 2000 deny ipacl number 3002 name WAN2Defendrule 0 deny udp destination-port eq tftpr

37、ule 1 deny tcp destination-port eq 4444rule 2 deny tcp destination-port eq 135rule 3 deny udp destination-port eq 135rule 4 deny udp destination-port eq netbios-nsrule 5 deny udp destination-port eq netbios-dgmrule 6 deny tcp destination-port eq 139rule 7 deny udp destination-port eq netbios-ssnrule

38、 8 deny tcp destination-port eq 445rule 9 deny udp destination-port eq 445rule 10 deny udp destination-port eq 593rule 11 deny tcp destination-port eq 593rule 12 deny tcp destination-port eq 5554rule 13 deny tcp destination-port eq 9995rule 14 deny tcp destination-port eq 9996rule 15 deny udp destin

39、ation-port eq 1434rule 16 deny tcp destination-port eq 1068rule 17 deny tcp destination-port eq 5800rule 18 deny tcp destination-port eq 5900rule 19 deny tcp destination-port eq 10080rule 22 deny tcp destination-port eq 3208rule 23 deny tcp destination-port eq 1871rule 24 deny tcp destination-port e

40、q 4510rule 25 deny udp destination-port eq 4334rule 26 deny tcp destination-port eq 4331rule 27 deny tcp destination-port eq 4557rule 28 deny udp destination-port eq 4444rule 29 deny udp destination-port eq 1314rule 30 deny tcp destination-port eq 6969rule 31 deny tcp destination-port eq 137rule 32

41、deny tcp destination-port eq 389rule 33 deny tcp destination-port eq 138rule 34 deny udp destination-port eq 136rule 35 deny tcp destination-port eq 1025rule 36 deny tcp destination-port eq 6129rule 37 deny tcp destination-port eq 1029rule 38 deny tcp destination-port eq 20168rule 39 deny tcp destin

42、ation-port eq 4899rule 40 deny tcp destination-port eq 45576rule 41 deny tcp destination-port eq 1433rule 42 deny tcp destination-port eq 1434rule 43 deny udp destination-port eq 1433rule 200 permit icmp icmp-type echorule 201 permit icmp icmp-type echo-replyrule 202 permit icmp icmp-type ttl-exceed

43、edrule 210 deny icmprule 300 permit udp source-port eq dnsrule 310 permit tcp destination-port eq telnetrule 1000 permit ip destination 55rule 2000 deny ipacl number 3003 name LANDefendrule 0 deny udp destination-port eq tftprule 1 deny tcp destination-port eq 4444rule 2 deny tcp

44、destination-port eq 135rule 3 deny udp destination-port eq 135rule 4 deny udp destination-port eq netbios-nsrule 5 deny udp destination-port eq netbios-dgmrule 6 deny tcp destination-port eq 139rule 7 deny udp destination-port eq netbios-ssnrule 8 deny tcp destination-port eq 445rule 9 deny udp dest

45、ination-port eq 445rule 10 deny udp destination-port eq 593rule 11 deny tcp destination-port eq 593rule 12 deny tcp destination-port eq 5554rule 13 deny tcp destination-port eq 9995rule 14 deny tcp destination-port eq 996rule 15 deny udp destination-port eq 1434rule 16 deny tcp destination-port eq 1

46、068rule 17 deny tcp destination-port eq 5800rule 18 deny tcp destination-port eq 5900rule 19 deny tcp destination-port eq 10080rule 22 deny tcp destination-port eq 3208rule 23 deny tcp destination-port eq 1871rule 24 deny tcp destination-port eq 4510rule 25 deny udp destination-port eq 4334rule 26 d

47、eny tcp destination-port eq 4331rule 27 deny tcp destination-port eq 4557rule 28 deny udp destination-port eq 4444rule 29 deny udp destination-port eq 1314rule 30 deny tcp destination-port eq 6969rule 31 deny tcp destination-port eq 137rule 32 deny tcp destination-port eq 389rule 33 deny tcp destina

48、tion-port eq 138rule 34 deny udp destination-port eq 136rule 35 deny tcp destination-port eq 1025rule 36 deny tcp destination-port eq 6129rule 37 deny tcp destination-port eq 1029rule 38 deny tcp destination-port eq 20168rule 39 deny tcp destination-port eq 4899rule 40 deny tcp destination-port eq 4

49、5576rule 41 deny tcp destination-port eq 1433rule 42 deny tcp destination-port eq 1434rule 43 deny udp destination-port eq 1433rule 200 permit icmp icmp-type echorule 201 permit icmp icmp-type echo-replyrule 202 permit icmp icmp-type ttl-exceededrule 210 deny icmprule 1000 permit ip source 192.168.1

50、.0 55rule 1001 permit udp destination-port eq bootpsrule 2000 deny ip#interface Aux0async mode flow#interface GigabitEthernet1/0ip address 52firewall packet-filter 3001 inboundnat outbound 3000#interface GigabitEthernet2/0ip address 52firewall pac

51、ket-filter 3002 inboundnat outbound 3000#interface GigabitEthernet3/0ip address firewall packet-filter 3003 inboundqos car inbound carl 1 cir cbs 32000 ebs 0 green pass red discardqos car outbound carl 2 cir cbs 64000 ebs 0 green pass red discard#interface GigabitEthernet4/0

52、#interface NULL0#firewall zone localset priority 100#firewall zone trustset priority 85#firewall zone untrustset priority 5#firewall zone DMZset priority 50#ip route-static preference 60 detect-group 1ip route-static preference 60 detect-group 2ip

53、route-static NULL 0 preference 60ip route-static NULL 0 preference 60ip route-static NULL 0 preference 60ip route-static NULL 0 preference 60ip route-static NULL 0 preference 60#user-inte

54、rface con 0user-interface aux 0user-interface vty 0 4authentication-mode scheme#returnH3C 1.1.2 MSR20/30/50双以太网链路接入网络拓扑图如图4所示，MSR2010有两条到同一运营商的链路，E0/0网络地址为/30，E0/1网络地址为/30。正常工作时流量分别从两个接口发出，当任意一条链路出现故障时，流量全部转移到另外一条链路发送。配置需求如下：1、 对内网主机进行限速，上行限制512kbps，下行限制1024kbps；2、 启用防火墙对攻击报文进行过虑；3、 启动ARP防攻击功能和ARP绑定功能，防止ARP欺骗攻击；4、 优化NAT表项老化时间；5、 启用自动侦测功能对WAN连接状态进行检测；6、 启动策略路由功能，对流量进行负载分担； 图5 双以太网链路接入拓扑图H3Cdis cur#version 5.20, ESS 1711#sysname H3C#ipsec cpu-backup enable#firewall enable#nat aging-time tcp 300nat aging-time udp 180nat aging-time pptp 300n