(思科)網(wǎng)絡(luò)設(shè)備巡檢報(bào)告模板V1.1-2014.10.8.docx

XXXXXXXXX公司網(wǎng)絡(luò)巡檢報(bào)告Network Health Check ServiceVersion 1.XXXX有限公司巡檢人員日期2010年X月X日網(wǎng)絡(luò)巡檢項(xiàng)目一、 網(wǎng)絡(luò)拓?fù)?、拓?fù)浞治?、拓?fù)浣ㄗh二、 網(wǎng)絡(luò)帶寬、鏈路類型、鏈路信息三、 網(wǎng)絡(luò)設(shè)備信息、設(shè)備品牌、設(shè)備型號(hào)、設(shè)備放置、設(shè)備性能參數(shù)、設(shè)備內(nèi)存大小、設(shè)備槽位、設(shè)備序列號(hào)、設(shè)備購買年限、設(shè)備保修狀態(tài)、設(shè)備備件狀況、設(shè)備標(biāo)簽完善程度四、 網(wǎng)絡(luò)設(shè)備軟件版本信息、當(dāng)前IOS版本信息、最新IOS版本信息、設(shè)備持續(xù)運(yùn)行時(shí)間、設(shè)備IOS備份情況、設(shè)備CPU利用率、設(shè)備內(nèi)存利用率、設(shè)備模塊運(yùn)行狀態(tài)、設(shè)備風(fēng)扇及電源狀況、設(shè)備端口數(shù)量、設(shè)備端口類別、設(shè)備端口類型、設(shè)備運(yùn)行機(jī)箱溫度五、 設(shè)備連通性、冗余協(xié)議運(yùn)行狀態(tài)、VLAN信息、以太通道信息、路由協(xié)議、鄰居關(guān)系、交換協(xié)議、生成樹STP協(xié)議、NAT連接數(shù)狀態(tài)、FLASH信息、設(shè)備配置信息分析、多余配置信息分析、配置精簡(jiǎn)建議、IOS安全建議、防火墻信息、防火墻策略、防火墻DMZ區(qū)檢查、防火墻Xlate狀態(tài)、應(yīng)用業(yè)務(wù)、IP地址使用狀況六、 簡(jiǎn)單機(jī)房環(huán)境檢查檢查指導(dǎo)一、 檢查設(shè)備IOS軟件版本編號(hào)：C-A-01檢查項(xiàng)目：cisco設(shè)備IOS軟件版本檢查命令：CISCO#show version檢查期待結(jié)果：同合同備注：主要顯示IOS的版本、路由器持續(xù)運(yùn)行的時(shí)間約、最近一次重啟動(dòng)的原因、路由器主存的大小、共享存儲(chǔ)器的大小、閃存的大小、IOS映像的文件名，以及路由器IOS從何處啟動(dòng)等信息。show version命令顯示了路由器的許多非常有用的信息檢查范例：（由于現(xiàn)實(shí)內(nèi)容過多，這里只截取部分）可把實(shí)際配置貼此處Cisco Internetwork Operating System Software IOS (tm) s72033_rp Software (s72033_rp-IPSERVICESK9_WAN-M), Version 12.2(18)SXF15, RELEASE SOFTWARE (fc1)Technical Support: /techsupportCopyright (c) 1986-2008 by cisco Systems, Inc.Compiled Sat 30-Aug-08 00:00 by kellythwImage text-base: 0x40101040, data-base: 0x42DD04B0檢查結(jié)果：正常 不正常二、 檢查設(shè)備持續(xù)運(yùn)行時(shí)間編號(hào)：C-A-02檢查項(xiàng)目：cisco設(shè)備持續(xù)運(yùn)行時(shí)間檢查命令：CISCO#show version檢查期待結(jié)果：一般情況下網(wǎng)絡(luò)設(shè)備在網(wǎng)絡(luò)上線后不會(huì)中斷。備注：如果設(shè)備uptime時(shí)間比較短，一定在利用show version命令查看設(shè)備最近一次重啟動(dòng)的時(shí)間和原因，便于分析各種潛在風(fēng)險(xiǎn)。檢查范例：（由于現(xiàn)實(shí)內(nèi)容過多，這里只截取部分）ksy_c6509_1 uptime is 1 year, 22 weeks, 4 days, 17 hours, 2 minutesTime since ksy_c6509_1 switched to active is 1 year, 22 weeks, 4 days, 17 hours, 1 minuteSystem returned to ROM by reload at 08:57:57 PST Tue Feb 5 2008 (SP by reload)System restarted at 12:19:06 UTC Wed Oct 15 2008System image file is sup-bootdisk:/s72033-ipservicesk9_wan-mz.122-18.SXF15.bin檢查結(jié)果：正常 不正常三、 設(shè)備CPU利用率情況檢查編號(hào)：C-A-03檢查項(xiàng)目：cisco設(shè)備CPU利用率情況檢查 檢查命令：CISCO#show processes cpu CISCO#show processes cpu history檢查期待結(jié)果：CPU利用率平均值50%；最大值2M ,Free memory 2*largest(b), i/o free memory 2M備注：show memory顯示了存儲(chǔ)器的一般信息，它表明系統(tǒng)可用的內(nèi)存。同時(shí)它還顯示內(nèi)存中有沒有碎片,內(nèi)存碎片表明內(nèi)存被劃分為了許多不連續(xù)的塊。它將導(dǎo)致內(nèi)存的利用率降低，嚴(yán)重時(shí)可能產(chǎn)生內(nèi)存錯(cuò)誤從而也嚴(yán)重影響路由器的性能。 如下例,此時(shí)我們有足夠多的可用內(nèi)存（317.2兆），但是其中最大的塊為226.5兆。說明連續(xù)內(nèi)存中還有足夠大的可用塊。路由器中存在一定數(shù)量的內(nèi)存碎片是正常的。雖然并沒有一個(gè)很嚴(yán)格的界限來劃分內(nèi)存碎片的可接受程度，但是可用塊的大小至少應(yīng)該不小于可用內(nèi)存的一半。否則,有可能導(dǎo)致嚴(yán)重的內(nèi)存分配問題。這些問題有時(shí)表現(xiàn)為一個(gè)或多個(gè)接口間歇性的丟失報(bào)文,此例中可用塊226.5大于可用內(nèi)存312兆字節(jié)的一半156兆，內(nèi)存處于正常狀態(tài)。檢查范例：（由于現(xiàn)實(shí)內(nèi)容過多，這里只截取部分）ksy_c6509_1#show memory summary Head Total(b) Used(b) Free(b) Lowest(b) Largest(b)Processor 44B0B830 391038928 73832336 317206592 305248408 226509608 I/O 8000000 67108864 10418792 56690072 45613312 56614072檢查結(jié)果：正常 不正常五、 設(shè)備系統(tǒng)模塊運(yùn)行狀況檢查編號(hào)：C-A-05檢查項(xiàng)目：cisco設(shè)備模塊運(yùn)行狀況檢查 檢查命令：CISCO#show module檢查期待結(jié)果:所有模塊運(yùn)行OK備注：此命令還可以看到設(shè)備各個(gè)模塊的SN號(hào)及各個(gè)設(shè)備模塊的型號(hào)。檢查范例：（由于現(xiàn)實(shí)內(nèi)容過多，這里只截取部分）ksy_c6509_1#show module Mod Ports Card Type Model Serial No.- - - - - 1 48 CEF720 48 port 10/100/1000mb Ethernet WS-X6748-GE-TX SAL1213KCUP 2 24 CEF720 24 port 1000mb SFP WS-X6724-SFP SLA11509Y03 3 6 Firewall Module WS-SVC-FWM-1 SAD121703WP 5 2 Supervisor Engine 720 (Active) WS-SUP720-3B JAF1201AHHRMod MAC addresses Hw Fw Sw Status- - - - - - 1 001e.4a9f.e320 to 001e.4a9f.e34f 2.7 12.2(14r)S5 12.2(18)SXF1 Ok 2 001d.a27d.7eb8 to 001d.a27d.7ecf 3.1 12.2(18r)S1 12.2(18)SXF1 Ok 3 001f.9e53.4076 to 001f.9e53.407d 4.2 7.2(1) 4.0(2) Ok 5 001b.d50d.aa34 to 001b.d50d.aa37 5.6 8.5(2) 12.2(18)SXF1 OkMod Sub-Module Model Serial Hw Status - - - - - - 1 Centralized Forwarding Card WS-F6700-CFC SAL1213K3XH 4.0 Ok 2 Centralized Forwarding Card WS-F6700-CFC SAL11455X9M 4.0 Ok 5 Policy Feature Card 3 WS-F6K-PFC3B JAF1202AKTB 2.3 Ok 5 MSFC3 Daughterboard WS-SUP720 JAF1202ACCD 3.1 Ok檢查結(jié)果：正常 不正常六、 設(shè)備電源及風(fēng)扇檢查編號(hào)：C-A-06檢查項(xiàng)目：cisco設(shè)備系統(tǒng)電源及風(fēng)扇檢查 檢查命令： CISCO#show environment status Cisco#show power Cisco# show power status fan-tray Cisco#show environment all檢查期待結(jié)果:電源及風(fēng)扇運(yùn)行正常備注:對(duì)于思科的交換機(jī)與路由器命令可能會(huì)不大相同，此外命令show power還能看到電源的冗余狀態(tài)（對(duì)于有兩個(gè)或兩個(gè)以上電源的設(shè)備），電源冗余狀態(tài)有兩種模式： redundant（冗余）與combined（組合）。根據(jù)用戶實(shí)際網(wǎng)絡(luò)環(huán)境與設(shè)備負(fù)載模塊的數(shù)量決定電源模式。檢查范例：（由于現(xiàn)實(shí)內(nèi)容過多，這里只截取部分）ksy_c6509_2#show environment statusfan-tray 1: fan-tray 1 type: WS-C6509-E-FAN fan-tray 1 mode: Restricted-power fan-tray 1 fan-fail: OKpower-supply 1: power-supply 1 fan-fail: OK power-supply 1 power-input: AC high power-supply 1 power-output-mode: high power-supply 1 power-output-fail: OK檢查結(jié)果：正常 不正常七、 設(shè)備運(yùn)行溫度檢查編號(hào)：C-A-07檢查項(xiàng)目：cisco設(shè)備運(yùn)行檢查 檢查命令：CISCO#show environment status檢查期待結(jié)果: 設(shè)備內(nèi)部各部分工作溫度小于45攝氏度檢查范例：（由于現(xiàn)實(shí)內(nèi)容過多，這里只截取部分）ksy_c6509_2#show environment temperature all VTT 1 outlet temperature: 28C VTT 2 outlet temperature: 30C VTT 3 outlet temperature: 26C檢查結(jié)果：正常 不正常八、 設(shè)備系統(tǒng)LOG日志檢查編號(hào)：C-A-08檢查項(xiàng)目：cisco設(shè)備系統(tǒng)LOG日志檢查 檢查命令：CISCO#show logging備注: 如果有SYSLOG日志服務(wù)器可以更好的分析日志的時(shí)間及錯(cuò)誤級(jí)別。檢查范例：（由于現(xiàn)實(shí)內(nèi)容過多，這里只截取部分）ksy_c6509_2# show loggingLog Buffer (8192 bytes):NDBY-6-STATECHANGE: Vlan140 Group 140 state Active - Init2w6d: %STANDBY-6-STATECHANGE: Vlan150 Group 150 state Active - Init2w6d: %STANDBY-6-STATECHANGE: Vlan251 Group 210 state Active - Init2w6d: %STANDBY-6-STATECHANGE: Vlan100 Group 100 state Standby - Active有無異常日志：有 沒有九、 設(shè)備冗余協(xié)議檢查編號(hào)：C-B-01檢查項(xiàng)目：HSRP、VRRP、GLBP熱備協(xié)議檢查檢查命令：CISCO#show standby brief Cisco#show standby all Cisco# show standby (以HSRP協(xié)議為例，其他協(xié)議原理基本上差不多)檢查期待結(jié)果:主備用狀態(tài)正常備注: 檢查范例：（由于現(xiàn)實(shí)內(nèi)容過多，這里只截取部分）ksy_c6509_2#show standby brief P indicates configured to preempt. |Interface Grp Prio P State Active addr Standby addr Group addr Vl1 1 100 P Standby 52 local 54Vl2 2 100 P Standby 52 local 54Vl3 3 100 P Standby 52 local 54ksy_c6509_2#show standby Vlan1 - Group 1 Local state is Standby, priority 100, may preempt Hellotime 3 sec, holdtime 10 sec Next hello sent in 1.695 Virtual IP address is 54 configured Active router is 52, priority 120 expires in 8.104 Standby router is local 63 state changes, last state change 1w3d IP redundancy name is hsrp-Vl1-1 (default)檢查結(jié)果：正常 不正常十、 VLAN狀態(tài)檢查編號(hào)：C-B-02檢查項(xiàng)目：VLAN狀態(tài)檢查檢查命令：CISCO#show vlan檢查期待結(jié)果: Vlan名稱、標(biāo)示符合設(shè)計(jì)要求，vlan里所含端口符合設(shè)計(jì)檢查范例：（由于現(xiàn)實(shí)內(nèi)容過多，這里只截取部分）ksy_c6509_2#show vlanVLAN Name Status Ports- - - -1 default active Gi1/7, Gi1/8, Gi1/34, Gi1/42, Gi1/46, Gi2/8 Gi2/9, Gi2/10, Gi2/11, Gi2/12, Gi2/13 Gi2/14, Gi2/15, Gi2/16, Gi2/17, Gi2/18 Gi2/19, Gi2/20, Gi2/21, Gi2/222 VLAN0002 active Gi1/1, Gi1/2, Gi1/19, Gi1/20, Gi1/23 Gi1/24, Gi1/25, Gi1/26, Gi1/27, Gi1/28 Gi1/403 VLAN0003 active Gi1/3, Gi1/44 VLAN0004 active Gi1/5, Gi1/6檢查結(jié)果：正常 不正常十一、 EtherChannel檢查編號(hào)：C-B-03檢查項(xiàng)目：EtherChannel檢查檢查命令：CISCO#show etherchannel port-channel檢查期待結(jié)果: 顯示正確的etherchannel數(shù)量及每個(gè)etherchannel 包含應(yīng)有的端口備注: show etherchannel port-channel 顯示本交換機(jī)中含有的portchannl的情況,具體查看每個(gè)portchannel的狀態(tài)使用show int port-channel n檢查范例：（由于現(xiàn)實(shí)內(nèi)容過多，這里只截取部分）ksy_c6509_2#show etherchannel port-channel Channel-group listing: -Group: 1 - Port-channels in the group: -Port-channel: Po1Ports in the Port-channel: Index Load Port EC state No of bits-+-+-+-+- 1 55 Gi5/1 On 4 0 AA Gi5/2 On 4檢查結(jié)果：正常 不正常十二、 trunk檢查編號(hào)：C-B-04檢查項(xiàng)目：trunk檢查檢查命令：CISCO#show interface trunk檢查期待結(jié)果: trunk正常備注:命令顯示trunk信息,其中port是指參與trunk的端口,應(yīng)與設(shè)計(jì)相符,mode應(yīng)為on模式,status 狀態(tài)為trunking, 同時(shí)對(duì)于每個(gè)trunk端口,正在trunking的vlan應(yīng)與設(shè)計(jì)相符檢查范例：（由于現(xiàn)實(shí)內(nèi)容過多，這里只截取部分）ksy_c6509_2#show interfaces trunk Port Mode Encapsulation Status Native vlanGi2/1 on 802.1q trunking 1Gi2/2 on 802.1q trunking 1Gi2/3 on 802.1q trunking 1Gi2/4 on 802.1q trunking 1Gi2/5 on 802.1q trunking 1Gi2/6 on 802.1q trunking 1Gi2/7 on 802.1q trunking 1Po1 on 802.1q trunking 1Port Vlans allowed on trunkGi2/1 1-4094Gi2/2 1-4094Gi2/3 1-4094Gi2/4 1-4094Gi2/5 1-4094Gi2/6 1-4094Gi2/7 1-4094Po1 1-4094Port Vlans allowed and active in management domainGi2/1 1-15,20,100-112,120,130-132,140,150,251,253-254,430Gi2/2 1-15,20,100-112,120,130-132,140,150,251,253-254,430Po1 1-15,20,100-112,120,130-132,140,150,251,253-254,430檢查結(jié)果：正常 不正常十三、 路由狀況檢查編號(hào)：C-B-05檢查項(xiàng)目：路由狀況檢查檢查命令：CISCO#show ip route 6509_1#show ip route summary檢查期待結(jié)果:路由表應(yīng)包含正確的路由信息備注: 對(duì)于企業(yè)一般都是交換網(wǎng)，一條默認(rèn)路由指出，只是注意VLAN信息與此直連路由是否相符。檢查范例：（由于現(xiàn)實(shí)內(nèi)容過多，這里只截取部分）ksy_c6509_2# show ip route Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2 ia - IS-IS inter area, * - candidate default, U - per-user static route o - ODR, P - periodic downloaded static routeGateway of last resort is to network C /24 is directly connected, Vlan106C /24 is directly connected, Vlan107C /24 is directly connected, Vlan105C /24 is directly connected, Vlan11C /24 is directly connected, Vlan100C /24 is directly connected, Vlan101S* /0 1/0 via ksy_c6509_2# show ip route summary IP routing table name is Default-IP-Routing-Table(0)Route Source Networks Subnets Overhead Memory (bytes)connected 30 0 1920 4800static 1 0 64 160rip 0 0 0 0Total 31 0 1984 4960Removing Queue Size 0檢查結(jié)果：正常 不正常十四、 生成樹STP檢查編號(hào)：C-B-06檢查項(xiàng)目：生成樹STP檢查檢查命令：CISCO#show spanning-tree brief 6509_1#show span sum CISCO#show spanning-tree inte (可看具體VLAN或端口號(hào))檢查期待結(jié)果: 跟節(jié)點(diǎn),端口forwarding和blocking狀態(tài)符合設(shè)計(jì)備注: 注意根網(wǎng)橋的位置及優(yōu)先級(jí)，最好采用命令spanning-tree vlan X root primary 設(shè)置根網(wǎng)橋，并相應(yīng)設(shè)定備份根網(wǎng)橋，維護(hù)STP樹的穩(wěn)定。檢查范例：（由于現(xiàn)實(shí)內(nèi)容過多，這里只截取部分）ksy_c6509_2#show spanning-tree brief MST0 Spanning tree enabled protocol mstp Root ID Priority 32768 Address 0004.dc04.1c9e Cost 20001 Port 1665 (Port-channel1) Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec Bridge ID Priority 32768 (priority 32768 sys-id-ext 0) Address 001f.9d32.b000 Hello Time 2 sec Max Age 20 sec Forward Delay 15 secInterface Role Sts Cost Prio.Nbr Type- - - - - -Gi1/2 Desg FWD 20000 128.2 P2p Gi1/19 Desg FWD 2000000 128.19 P2p Gi1/20 Desg FWD 200000 128.20 P2p Gi1/21 Desg FWD 20000 128.21 P2p Bound(STP) Gi1/23 Desg FWD 20000 128.23 P2p Gi1/24 Desg FWD 200000 128.24 P2p Gi1/27 Desg FWD 20000 128.27 P2p檢查結(jié)果：正常 不正常十五、 接口狀態(tài)檢查編號(hào)：C-B-07檢查項(xiàng)目：接口狀態(tài)檢查檢查命令：CISCO#show interface (可加具體端口號(hào)或VLAN)CISCO#show interface sum檢查期待結(jié)果: 接口運(yùn)行正常,無過多的錯(cuò)誤,廣播及沖突包, 顯示工作的端口為UP狀態(tài)；端口沖突、錯(cuò)誤等非信息小于1/10000。端口名稱正確；端口雙工狀態(tài)正常。 備注: 檢查范例：（由于現(xiàn)實(shí)內(nèi)容過多，這里只截取部分）ksy_c6509_2#show interfacesGigabitEthernet2/1 is up, line protocol is up (connected) Hardware is C6k 1000Mb 802.3, address is 001e.1357.a3f4 (bia 001e.1357.a3f4) Description: connect jiulouhexin86 12#10#(1,2)-12#5#(11,12) MTU 1500 bytes, BW 1000000 Kbit, DLY 10 usec, reliability 255/255, txload 1/255, rxload 1/255 Encapsulation ARPA, loopback not set Keepalive set (10 sec) Full-duplex, 1000Mb/s, media type is LHinput flow-control is off, output flow-control is on Output queue: 0/40 (size/max) 5 minute input rate 15000 bits/sec, 20 packets/sec 5 minute output rate 0 bits/sec, 0 packets/sec 2333773918 packets input, 227488494191 bytes, 0 no buffer Received 2321784115 broadcasts (1793469168 multicasts) 0 runts, 0 giants, 0 throttles 1 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored 0 watchdog, 0 multicast, 0 pause input 0 input packets with dribble condition detected 3133137472 packets output, 306700001183 bytes, 0 underruns 0 output errors, 0 collisions, 6 interface resets 0 babbles, 0 late collision, 0 deferred 0 lost carrier, 0 no carrier, 0 PAUSE output 0 output buffer failures, 0 output buffers swapped out檢查結(jié)果：正常 不正常十六、 NAT檢查編號(hào)：C-B-08檢查項(xiàng)目： NAT配置及NAT連接數(shù)狀態(tài)檢查命令：router#show running-config (看NAT具體配置)router#show ip nat translations（看NAT轉(zhuǎn)換情況）router#show ip nat statistics(看NAT連接數(shù)情況)檢查期待結(jié)果:NAT配置正常，連接裝換情況正常，連接數(shù)沒有太多丟失情況。備注: 由于P2P等并發(fā)連接特別多，如果網(wǎng)絡(luò)環(huán)境中發(fā)現(xiàn)NAT連接數(shù)丟失情況比較大，而又沒有流量控制設(shè)備，建議在NAT設(shè)備上做NAT連接數(shù)限制，每個(gè)用戶限制100個(gè)連接，防止網(wǎng)絡(luò)中連接數(shù)過多，超出路由器承載能力。檢查范例：（由于現(xiàn)實(shí)內(nèi)容過多，這里只截取部分）router#show ip nat statistics Total active translations: 3540 (19 static, 3521 dynamic; 3532 extended)Outside interfaces: GigabitEthernet0/1Inside interfaces: GigabitEthernet0/0Hits: 3708991098 Misses: 325753312CEF Translated packets: 3926956344, CEF Punted packets: 228979536Expired translations: 351641902Dynamic mappings:- Inside SourceId: 1 access-list nat11 pool 11 refcount 0 pool 11: netmask start 1 end 1 type generic, total addresses 1, allocated 0 (0%), misses 4398Id: 2 access-list natlist pool 1 refcount 3529 pool 1: netmask start end type generic, total addresses 2, allocated 2 (100%), misses 123322Id: 3 access-list vlanother pool 3 refcount 0 pool 3: netmask start end type generic, total addresses 1, allocated 0 (0%), misses 178876Queued Packets: 196檢查結(jié)果：正常 不正常十七、 防火墻檢查編號(hào)：C-B-09檢查項(xiàng)目：防火墻擺放位置、防火墻策略應(yīng)用、防火墻failover狀態(tài)（如果有）、xlate狀態(tài)、防火墻硬件性能參數(shù)、DMZ區(qū)是否正常、地址映射是否正常檢查命令：PIX#show failover PIX#show run PIX#show xlate(查看NTA連接數(shù)情況)檢查期待結(jié)果: 防火墻策略符合設(shè)計(jì)、NAT正常、failover功能正常備注:一般情況下，防火墻應(yīng)放置在網(wǎng)絡(luò)企業(yè)目前PIX防火墻的安全訪問策略主要是通過ACL控制列表來實(shí)現(xiàn)，管道應(yīng)用很少。注意思科PIX設(shè)備默認(rèn)允許高優(yōu)先級(jí)區(qū)域訪問低優(yōu)先級(jí)區(qū)域，特別注意網(wǎng)絡(luò)中ACL應(yīng)用permit ip any any這樣允許所有的語句，禁止使用這種語句。檢查結(jié)果：正常 不正常十八、 其他維護(hù)信息檢查編號(hào)：C-B-10檢查項(xiàng)目：CDP、NTP協(xié)議、其他