华为AR1220路由器配置全参数实际应用实例解说一.docx
《华为AR1220路由器配置全参数实际应用实例解说一.docx》由会员分享，可在线阅读，更多相关《华为AR1220路由器配置全参数实际应用实例解说一.docx（8页珍藏版）》请在冰豆网上搜索。
华为AR1220路由器配置全参数实际应用实例解说一
华为AR1220路由器配置参数实际应用实例解说一
1.配置参数
[GZ]discu
[V200R001C00SPC200]//路由器软件版本，可从官方网站下载
#
sysnameGZ//路由器名字GZ
ftpserverenable//ftp服务开通以便拷贝出配置文件备份
#
voice
#
httpserverport1025//http
undohttpserverenable
#
dropillegal-macalarm
#
l2tpaging0
#
vlanbatch1020304050//本路由器设置的VLANID
#
igmpgloballimit256
#
multicastrouting-enable//开启组播
#
dhcpenable//全局下开启DHCP服务然后在各VLAN上开启单独的DHCP
#
ipvpn-instance1
ipv4-family
#
aclnumber2000
rule10permit
#
aclnumber2001//以太网访问规则列表。
rule6permitsource172.23.68.00.0.0.255//允许此网段访问外网
rule7permitsource172.23.69.00.0.0.255//允许此网段访问外网
rule8permitsource172.23.65.00.0.0.3//允许此网段的前三个IP访问外网
rule9deny//不允许其他网段访问外网
#
aclnumber3000//此规则并未应用
rule40permitipsource172.23.65.00.0.0.255destination172.23.69.00.0.0.25
5
#
aclnumber3001//定义两个网段主机互不访问，学生不能访问65网段。
rule5denyipsource172.23.65.00.0.0.255destination172.23.68.00.0.0.255
rule10denyipsource172.23.68.00.0.0.255destination172.23.65.00.0.0.255
#
aaa//默认视图窗口定义本地登录帐号和密码
authentication-schemedefault
authorization-schemedefault
accounting-schemedefault
domaindefault
domaindefault_admin
local-useradminpasswordcipher]MQ;4\]B+4Z,YWX*NZ55OA!
!
local-useradminservice-typetelnetwebhttp
local-userdfwdpasswordcipher'VE5U!
@7QCO;V2HX\']\,1!
!
local-userdfwdprivilegelevel15
local-userdfwdservice-typetelnetterminalwebhttp
local-userhuaweipasswordcipherRY,UPVHCMV+Q=^Q`MAF4<1!
!
//新建用户dfwd密码
local-userhuaweiftp-directoryflash:
//该用户名默认配置指向的ftp路径
local-userhuaweiservice-typeftp//该用户采用FTP访问
#
firewallzonetrust//定义信任区域
priority15//定义信任区域下的策略
#
firewallzoneuntrust//定义不信任区域
priority1//定义不信任区域下的策略
#
firewallinterzonetrustuntrust//配置安全域间
firewallenable//该安全域间启用防火墙
packet-filter3001inbound//入口执行3001规则
packet-filter3001outbound//出口执行3001规则
packet-filterdefaultdenyoutbound
#
interfaceVlanif10
ipaddress172.23.65.100255.255.255.0//定义vlan的网关地址和子网掩码
pimdm//组播协议需开启的功能
igmpenable//组播协议需开启的功能
zonetrust//定义VLAN是信任区域
#
interfaceVlanif20
ipaddress172.23.1.1255.255.255.240//定义vlan的网关地址和子网掩码
pimdm//组播协议需开启的功能
igmpenable//组播协议需开启的功能
zonetrust//定义VLAN是信任区域
#
interfaceVlanif30
ipaddress10.10.10.1255.255.255.252//定义vlan的网关地址和子网掩码
pimdm//组播协议需开启的功能
igmpenable//组播协议需开启的功能
zonetrust//定义VLAN是信任区域
#
interfaceVlanif40
ipaddress172.23.68.100255.255.255.0//定义vlan的网关地址和子网掩码
pimdm//组播协议需开启的功能
igmpenable//组播协议需开启的功能
dhcpselectinterface//自动分配该VLAN网关所在的地址段IP
dhcpserverexcluded-ip-address172.23.68.201172.23.69.254//定义该段IP不自动分配
dhcpserverdns-list61.139.2.69//定义该VLAN所在IP地址段的DNS地址
zoneuntrust//定义该VLAN为不信任区域
#
interfaceVlanif50
ipaddress172.23.69.100255.255.255.0//定义vlan的网关地址和子网掩码
pimdm//组播协议需开启的功能
igmpenable//组播协议需开启的功能
dhcpselectinterface//开启本VLAN的DHCP功能并选择端口为定义的网关地址
dhcpserverexcluded-ip-address172.23.69.201172.23.69.252//定义手动获取的IP地址段
dhcpserverdns-list61.139.2.69//定义该VLAN段IP的DNS
#
interfaceEthernet0/0/0//物理端端口0
portlink-typeaccess//定义该端口类型
portdefaultvlan10//定义端口所在VLAN
#
interfaceEthernet0/0/1//物理端端口1
portlink-typeaccess//定义该端口类型
portdefaultvlan30//定义端口所在VLAN
#
interfaceEthernet0/0/2//物理端端口2
portlink-typeaccess//定义该端口类型
portdefaultvlan20//定义端口所在VLAN
qosgtscir6000cbs600000//定义该端口数据缓存带宽范围
#
interfaceEthernet0/0/3//物理端端口3
portlink-typeaccess
portdefaultvlan30
#
interfaceEthernet0/0/4//物理端端口4
portlink-typeaccess//定义该端口类型
portdefaultvlan40//定义端口所在VLAN
#
interfaceEthernet0/0/5//物理端端口5
portlink-typeaccess//定义该端口类型
portdefaultvlan50//定义端口所在VLAN
#
interfaceEthernet0/0/6//物理端端口6
portlink-typeaccess//定义该端口类型
#
interfaceEthernet0/0/7//物理端端口6
portlink-typeaccess//定义该端口类型
portdefaultvlan10//定义端口所在VLAN
#
interfaceGigabitEthernet0/0/0//三层口不在任何一个VLAN中，有映射功能。
ipaddress125.69.71.128255.255.255.0//定义该端口的网关地址和子网掩码
natserverprotocoltcpglobalcurrent-interface10001inside172.23.68.22210001//允许内网IP端口映射到外网
natserverprotocoltcpglobalcurrent-interface10002inside172.23.68.22210002
natserverprotocoltcpglobalcurrent-interface10003inside172.23.68.22210003
natserverprotocoltcpglobalcurrent-interface10004inside172.23.68.22210004
natserverprotocoltcpglobalcurrent-interface10005inside172.23.68.22210005
natserverprotocoltcpglobalcurrent-interface10006inside172.23.68.22210006
natserverprotocoltcpglobalcurrent-interface10007inside172.23.68.22210007
natserverprotocoltcpglobalcurrent-interface10008inside172.23.68.22210008
natserverprotocoltcpglobalcurrent-interface10009inside172.23.68.22210009
natserverprotocoltcpglobalcurrent-interface10010inside172.23.68.22210010
natserverprotocoludpglobalcurrent-interface11001inside172.23.68.22211001
natserverprotocoludpglobalcurrent-interface11002inside172.23.68.22211002
natserverprotocoludpglobalcurrent-interface11003inside172.23.68.22211003
natserverprotocoludpglobalcurrent-interface11004inside172.23.68.22211004
natserverprotocoludpglobalcurrent-interface11005inside172.23.68.22211005
natserverprotocoludpglobalcurrent-interface11006inside172.23.68.22211006
natserverprotocoludpglobalcurrent-interface11007inside172.23.68.22211007
natserverprotocoludpglobalcurrent-interface11008inside172.23.68.22211008
natserverprotocoludpglobalcurrent-interface11009inside172.23.68.22211009
natserverprotocoludpglobalcurrent-interface11010inside172.23.68.22211010
natoutbound2001//在该端口上执行编号为2001的访问规则
#
interfaceGigabitEthernet0/0/1//三层口不在任何一个VLAN中，有映射功能。
ipaddress10.10.10.6255.255.255.252//定义该端口的网关地址和子网掩码
pimdm//组播协议需开启的功能
igmpenable//组播协议需开启的功能
undonegotiationauto//关闭端口自动协商功能
zonetrust//定义该端口是信任区域
#
interfaceCellular0/0/0
link-protocolppp
#
interfaceCellular0/0/1
link-protocolppp
#
interfaceNULL0
#
igmp
#
pim
c-bsrGigabitEthernet0/0/0
c-rpGigabitEthernet0/0/0group-policy2000
c-rpGigabitEthernet0/0/1group-policy2000
#
iproute-static0.0.0.00.0.0.0125.71.213.1//新增静态路由列表，访问外网
iproute-static10.1.187.0255.255.255.010.10.10.2
iproute-static10.102.0.0255.255.0.0172.23.1.2
iproute-static10.110.0.0255.255.0.0172.23.1.2
iproute-static172.23.66.0255.255.255.010.10.10.2
iproute-static172.23.67.0255.255.255.010.10.10.5
iproute-static192.168.14.0255.255.255.0172.23.1.2
iproute-static192.168.18.0255.255.255.0172.23.1.2
iproute-static192.168.20.0255.255.255.0172.23.1.2
#
superpasswordlevel3cipherEO2\:
%&（X.$'CLYaDZ]EJ1!
!
user-interfacecon0
user-interfacevty04
authentication-modeaaa
user-interfacevty1620
#
port-group1
group-memberEthernet0/0/0
group-memberEthernet0/0/1
group-memberEthernet0/0/2
group-memberEthernet0/0/3
group-memberEthernet0/0/4
group-memberEthernet0/0/5
group-memberEthernet0/0/6
group-memberEthernet0/0/7
#
port-groupeth0/0/2
#
Return
升级会员 