ME60維護(hù)手冊

1、文檔可能無法思考全面，請瀏覽后下載! Bras ME60維護(hù)手冊2016年12月19 / 21目 錄一、設(shè)備配置腳本3二、新設(shè)備（用戶）開局腳本102.1匯聚/接入交換機(jī)開局102.2配置純Portal撥號業(yè)務(wù)112.3配置靜態(tài)IP業(yè)務(wù)（綁定用戶IP）122.4配置靜態(tài)IP業(yè)務(wù)（不綁定用戶IP）132.5配置Portal撥號業(yè)務(wù)+固定IP142.6配置Portal撥號業(yè)務(wù)（綁定用戶IP）15三、維護(hù)命令163.1.1查看域163.1.2查看域內(nèi)用戶狀態(tài)173.1.3查看網(wǎng)絡(luò)聯(lián)通性173.1.4查看總用戶數(shù)173.1.5強(qiáng)制某用戶下線183.1.6查看地址池占用率183.1.7查用巡檢命令18一

2、、 設(shè)備配置腳本設(shè)備配置較多,僅列出維護(hù)相關(guān)部分<WGYXY_ME60>dis cursysname JRZK-ME60配置主機(jī)名radius-server group wgyxy radius-server authentication 00 1812 weight 0 radius-server accounting 00 1813 weight 0 radius-server shared-key hwme60 radius-server nas-ip-address radius-server

3、attribute translate undo radius-server user-name domain-included配置深瀾Radius#radius-server authorization 00 shared-key hwme60授權(quán)深瀾Radius對Bras進(jìn)行操作（用戶欠費(fèi)踢下線）#acl number 6000 rule 20 permit tcp source user-group portal destination-port eq www rule 25 permit tcp source user-group portal destina

4、tion-port eq 8080 rule 30 permit tcp source user-group portal destination-port eq 801 rule 35 permit tcp source user-group portal destination-port eq 802 rule 40 permit tcp source user-group portal destination-port eq 803 rule 45 permit tcp source user-group portal destination-port eq 804 rule 50 pe

5、rmit tcp source user-group portal destination-port eq 443開放深瀾Portal端口#acl number 6001 rule 5 permit ip source user-group portal destination ip-address 00 0 rule 10 permit ip source user-group portal destination ip-address 0 rule 15 permit ip source ip-address 00 0

6、 destination user-group portal rule 20 permit ip source ip-address 0 destination user-group portal rule 25 permit ip source ip-address 55 destination user-group portal rule 30 permit ip source user-group portal destination ip-address 55 rule 35 permit ip

7、 source ip-address 55 destination user-group portal rule 40 permit ip source user-group portal destination ip-address 55 rule 45 permit ip source ip-address 55 destination user-group portal rule 50 permit ip source user-group portal destination ip-ad

8、dress 55 rule 55 permit ip source ip-address 8 destination user-group portal rule 60 permit ip source user-group portal destination ip-address 8 rule 65 permit ip source ip-address 0 destination user-group portal rule 70 permit ip sou

9、rce user-group portal destination ip-address 0在未通過認(rèn)證的情況下，可以免費(fèi)訪問的業(yè)務(wù)：自服務(wù)、DNS、內(nèi)網(wǎng)資源等。#acl number 6002 rule 30 permit ip source user-group portal destination ip-address any rule 35 permit ip source ip-address any destination user-group portal#ip pool 3jiao_ap_dong bas local gateway 2

10、 section 0 54 excluded-ip-address dns-server 8 9 定義3教東區(qū)的AP地址池，其中1作為網(wǎng)關(guān)，2-9從地址池中排除。其他業(yè)務(wù)地址池不再闡述# ip pool 3jiao_ap_xi bas local gateway section 0 54 excluded-ip-address

11、 dns-server 8 9 #ip pool guanli bas local 定義設(shè)備管理地址池 gateway 54 section 0 53 excluded-ip-address 53# ip pool portal bas local 定義學(xué)生寢室Portal地址池。 gateway section 0 10.50.25

12、5.254 excluded-ip-address 00 dns-server 8 9 #aaa local-user huawei password irreversible-cipher $1a$:a(TQ#W<C2$z(<,t<r*N%-AG$h2S-G6:/&#1w;:V4$3Vq6YO$ local-user huawei service-type telnet local-user huawei level 15 local-user huawei state block fail-ti

13、mes 3 interval 5 authentication-scheme default0 authentication-scheme default1 authentication-scheme default authentication-mode local radius authentication-scheme pppoe authentication-mode none authentication-scheme radius # authorization-scheme default # accounting-scheme default0 accounting-schem

14、e default1 accounting-scheme pppoe accounting-mode none accounting-scheme jrzk accounting-scheme radius accounting interim interval 10定義每10分鐘向Radius上傳一次計(jì)費(fèi)報(bào)文。 # domain default0 ip-pool qinshi-1 dns primary-ip 8 dns second-ip 9 user-group portal web-server 00 web-s

15、erver url 00/index_3.html web-server url-parameter定義認(rèn)證前域，用來為學(xué)生分配IP地址，并推送Portal頁面 domain default1 domain default_admindomain portal authentication-scheme radius accounting-scheme radius radius-server group wgyxy 定義認(rèn)證域，學(xué)生通過Portal輸入用戶名及密碼后，會由認(rèn)證域進(jìn)行身份認(rèn)證。 domain guanli authentication-sc

16、heme pppoe accounting-scheme pppoe ip-pool guanli 定義用于設(shè)備管理的域，該域中定義的都是交換機(jī)的管理地址。 #interface Eth-Trunk1 description to-HW-S12708 20G mode user-termination load-balance packet-all下聯(lián)寢室網(wǎng)核心8614#interface Eth-Trunk1.1Eth1.1用于終結(jié)Portal撥號業(yè)務(wù)。 description portal_bohao user-vlan 101 148 qinq 2111 2114終結(jié)用戶vlan：內(nèi)層v

17、lan101-148外層vlan 2111-2114 user-vlan 101 148 qinq 2141 user-vlan 101 148 qinq 2171 user-vlan 101 148 qinq 2211 2213 user-vlan 201 248 qinq 2213 user-vlan 101 148 qinq 2240 user-vlan 201 248 qinq 2240 user-vlan 301 348 qinq 2240 user-vlan 101 148 qinq 2321 2324 user-vlan 101 148 qinq 2341 user-vlan 1

18、01 148 qinq 2371 user-vlan 101 148 qinq 2421 2425 user-vlan 101 148 qinq 2441 user-vlan 101 148 qinq 2471 user-vlan 101 148 qinq 2511 2518 user-vlan 101 148 qinq 2520 user-vlan 101 148 qinq 2540 user-vlan 201 248 qinq 2540 user-vlan 101 148 qinq 2542 user-vlan 101 148 qinq 2561 user-vlan 101 148 qin

19、q 2611 2614 user-vlan 101 148 qinq 2641 user-vlan 101 148 qinq 2711 2713 user-vlan 101 148 qinq 2741 2742 user-vlan 101 148 qinq 2810 user-vlan 201 248 qinq 2810 user-vlan 101 148 qinq 2821 2822 user-vlan 101 148 qinq 2830 user-vlan 201 248 qinq 2830 user-vlan 101 148 qinq 2840 user-vlan 201 248 qin

20、q 2840 user-vlan 101 148 qinq 2851 user-vlan 101 148 qinq 2861 2862 user-vlan 101 148 qinq 2870 user-vlan 201 248 qinq 2870 bas # access-type layer2-subscriber default-domain authentication portal authentication-method web arp-trigger#interface Eth-Trunk1.2 Eth1.2做交換設(shè)備管理用.機(jī)tal description device_man

21、agement user-vlan 2000 user-vlan 2000 qinq 2111 2114 user-vlan 2000 qinq 2141 user-vlan 2000 qinq 2171 user-vlan 2000 qinq 2211 2213 user-vlan 2000 qinq 2240 2243 user-vlan 2000 qinq 2321 2324 user-vlan 2000 qinq 2341 user-vlan 2000 qinq 2371 user-vlan 2000 qinq 2421 2425 user-vlan 2000 qinq 2441 us

22、er-vlan 2000 qinq 2471 user-vlan 2000 qinq 2511 2518 user-vlan 2000 qinq 2520 user-vlan 2000 qinq 2540 user-vlan 2000 qinq 2542 user-vlan 2000 qinq 2561 user-vlan 2000 qinq 2611 2614 user-vlan 2000 qinq 2641 user-vlan 2000 qinq 2711 2713 user-vlan 2000 qinq 2741 2742 user-vlan 2000 qinq 2810 user-vl

23、an 2000 qinq 2821 2822 user-vlan 2000 qinq 2830 user-vlan 2000 qinq 2840 user-vlan 2000 qinq 2851 user-vlan 2000 qinq 2861 2862 user-vlan 2000 qinq 2870 bas # access-type layer2-subscriber default-domain authentication guanli authentication-method bind arp-proxy ip-trigger arp-trigger其他子接口可根據(jù)子接口描述確定

24、業(yè)務(wù)！#interface Eth-Trunk2 portswitch description to-USG9000-FW 20G port link-type trunk port trunk allow-pass vlan 105 4000上聯(lián)USG防火墻#interface GigabitEthernet1/0/0 undo shutdown eth-trunk 1#interface GigabitEthernet1/0/1 undo shutdown eth-trunk 1#interface GigabitEthernet1/0/2 undo shutdown eth-trunk

25、2#interface GigabitEthernet1/0/3 undo shutdown eth-trunk 2#interface GigabitEthernet1/0/4 description to_powercache undo shutdown ip address #下聯(lián)PowerCache#interface GigabitEthernet1/0/9 negotiation auto description to-H3C12508 undo shutdown ip address 6 255.255.25

26、5.0下聯(lián)H3C12508,用于榜文辦公網(wǎng),圖書館,實(shí)驗(yàn)室.#ip route-static Vlanif4000 description uplink-USG9000-FW默認(rèn)出口路由為FWip route-static 由于一些3教是以3層鏈路接到Bras的，因此需向下回指靜態(tài)路由ip route-static ip route-static 172.28.

27、2.2ip route-static ip route-static ip route-static ip route-static ip route-static ip route-static 172.28.

28、2.2ip route-static ip route-static ip route-static ip route-static ip route-static ip route-static 17

29、ip route-static ip route-static ip route-static ip route-static ip route-static ip route-static 255.255.25

30、5.0 ip route-static ip route-static ip route-static ip route-static ip route-static ip route-static 255.255.

31、255.0 ip route-static 9 55 7 description to-ATMip route-static 55 7 description to-ATM去往學(xué)校ATM#static-user 54 54 gateway 54 interface Eth-Trunk1.2 vlan 2000 domain-name guanli detect定義靜態(tài)IP交

32、換機(jī)的管理地址, 以本條命令為例, 將eth1.2接口從vlan 2000上來的用戶，允許其靜態(tài)配置成54，網(wǎng)關(guān)54。針對固定IP用戶，配置原理也是一樣。static-user 1 1 gateway 54 interface Eth-Trunk1.2 vlan 2000 qinq 2111 domain-name guanli detectstatic-user 2 2 gateway 54 interface Eth-Trunk1.2

33、vlan 2000 qinq 2112 domain-name guanli detect static-user 3 3 gateway 54 interface Eth-Trunk1.2 vlan 2000 qinq 2113 domain-name guanli detect static-user 4 4 gateway 54 interface Eth-Trunk1.2 vlan 2000 qinq 2114 domain-name guanli detect stat

34、ic-user 1 1 gateway 54 interface Eth-Trunk1.2 vlan 2000 qinq 2141 domain-name guanli detect static-user 54 54 gateway 54 interface Eth-Trunk1.2 vlan 2000 domain-name guanli detect static-user 1 1 gateway 54 interf

35、ace Eth-Trunk1.2 vlan 2000 qinq 2211 domain-name guanli detect static-user 2 2 gateway 54 interface Eth-Trunk1.2 vlan 2000 qinq 2212 domain-name guanli detect static-user 3 4 gateway 54 interface Eth-Trunk1.2 vlan 2000 qinq 2213 domain-name g

36、uanli detect static-user 1 3 gateway 54 interface Eth-Trunk1.2 vlan 2000 qinq 2240 domain-name guanli detect static-user 54 54 gateway 54 interface Eth-Trunk1.2 vlan 2000 domain-name guanli detect static-user 1 1 gateway 10.

37、11.255.254 interface Eth-Trunk1.2 vlan 2000 qinq 2321 domain-name guanli detect static-user 2 2 gateway 54 interface Eth-Trunk1.2 vlan 2000 qinq 2322 domain-name guanli detect static-user 3 3 gateway 54 interface Eth-Trunk1.2 vlan 2000 qinq 2

38、323 domain-name guanli detect static-user 4 4 gateway 54 interface Eth-Trunk1.2 vlan 2000 qinq 2324 domain-name guanli detect static-user 1 1 gateway 54 interface Eth-Trunk1.2 vlan 2000 qinq 2341 domain-name guanli detect static-user 10.11.3.

39、71 1 gateway 54 interface Eth-Trunk1.2 vlan 2000 qinq 2371 domain-name guanli detect static-user 53 54 gateway 54 interface Eth-Trunk1.2 vlan 2000 domain-name guanli detect# web-auth-server 00 port 50100 key simple hwme60配置Portal服務(wù)器二、 新設(shè)備

40、（用戶）開局腳本2.1 匯聚/接入交換機(jī)開局場景：假定新建一套中區(qū)11號樓的匯聚和接入交換機(jī)，其外層VLAN為1011，內(nèi)層管理地址為11，內(nèi)層1xx為一樓交換機(jī)，2xx為二樓交換機(jī)，依次類推。1.定義一個管理IP地址池：ip pool guanli-zhongqu-11 bas local gateway 54 section 0 53 excluded-ip-address 53固定IP用戶必須將地址從地址池中移除。2.在管理域中加入此地址池：aaadomain gua

41、nli ip-pool guanli-zhongqu-11 3.在Bras口上終結(jié)此VLANinterface Eth-Trunk1.2user-vlan 11匯聚設(shè)備的管理vlan是不帶外層標(biāo)簽的user-vlan 11 qinq 1011樓層交換機(jī)經(jīng)過匯聚設(shè)備會打上2層標(biāo)簽4.定義靜態(tài)IP用戶（交換機(jī)）static-user 52 gateway 54 interface Eth-Trunk1.2 vlan 11 qinq 1011 domain-name guanli 如果是設(shè)備的管理IP，建議放到guanli這個域中。detect

42、static-user 53 53 gateway 54 interface Eth-Trunk1.2 vlan 11 domain-name guanli detect2.2 配置純Portal撥號業(yè)務(wù)場景：假定新建一套中區(qū)11號樓的匯聚和接入交換機(jī)，其外層VLAN為1011，內(nèi)層1xx為一樓交換機(jī)，2xx為二樓交換機(jī)，依次類推。如果此Portal業(yè)務(wù)需要為其新分配段IP，則需要執(zhí)行以下1-3的操作，如果與現(xiàn)有業(yè)務(wù)相同，可直接進(jìn)行第3步。1.定義一個管理IP地址池：ip pool new-yewu bas local gateway 10

43、.2.0.1 section 0 542.在新建的域中加入此地址池：aaadomain new-yewu0 ip-pool new-yewu dns primary-ip 3 user-group portal web-server web-server url /index_3.html web-server url-parameter domain new-yewu authentication-scheme radius accounting-sc

44、heme radius value-added-service account-type radius jrzk radius-server group jrzk user-group inside3.在Bras口上終結(jié)此VLANinterface Eth-Trunk1.x需新建一個子接口user-vlan 101 148 qinq 1001user-vlan 201 248 qinq 1011bas # access-type layer2-subscriber default-domain pre-authentication new-yewu0 authentication new-ye

45、wu authentication-method web arp-trigger注意：以上為新業(yè)務(wù)的配置方法，如果是現(xiàn)有業(yè)務(wù)，以寢室Portal為例，僅需要執(zhí)行第3步，見下：interface Eth-Trunk1.1user-vlan 101 148 qinq 1001user-vlan 201 248 qinq 10112.3 配置靜態(tài)IP業(yè)務(wù)（綁定用戶IP）場景：某個實(shí)驗(yàn)室的主機(jī)IP地址手動配置為/24，網(wǎng)關(guān)為，對其中部分主機(jī)要求地址綁定（如某臺主機(jī)只能配置成00）。1.定義一個IP地址池：ip pool lab1 bas lo

46、cal gateway section 0 53 excluded-ip-address 532.在新建域中加入此地址池：aaadomain lab1 ip-pool lab1 3.在Bras口上終結(jié)此VLANinterface Eth-Trunk1.xuser-vlan 2016假設(shè)用戶vlan為2016bas access-type layer2-subscriber default-domain authentication lab1 authentica

47、tion-method bind arp-proxy ip-trigger arp-trigger #4.定義靜態(tài)IP用戶static-user 54 gateway interface Eth-Trunk1.x vlan 2016 domain-name lab1 detect將/24子網(wǎng)與用戶vlan綁定。static-user 00 00 gateway interface Eth-Trunk1.x mac-address xxxx.xxxx.

48、xxxx domain-name guanli detect為單個用戶綁定IP，如果用戶有唯一的vlan，可以基于vlan，如果與其他主機(jī)共用同一個vlan，可以基于mac地址綁定。2.4 配置靜態(tài)IP業(yè)務(wù)（不綁定用戶IP）場景：某個實(shí)驗(yàn)室的主機(jī)IP地址手動配置為/24，網(wǎng)關(guān)為。1.為子網(wǎng)新建子接口：interface Eth-Trunk1.2016 vlan-type dot1q 2016假設(shè)其VLAN為2016ip address 配置Portal撥號業(yè)務(wù)+固定IP場景：某個辦公室，兩個領(lǐng)導(dǎo)需要固定IP

49、（免認(rèn)證撥號），其余員工為Portal認(rèn)證上網(wǎng)。IP段為/24，網(wǎng)關(guān)為，領(lǐng)導(dǎo)IP為00和00.Portal撥號業(yè)務(wù)配置方法與2.2小節(jié)相同，不再重復(fù)。本節(jié)在已配置Portal撥號業(yè)務(wù)的基礎(chǔ)上，增加固定IP功能。1.修改原有IP地址池：ip pool office bas local gateway section 0 54 excluded-ip-address 00 excluded-ip-address 00將兩個領(lǐng)導(dǎo)的IP從地址池中排除。2.新建一個名為guding的域：aaaauthentication-scheme pppoe authentication-mode none accounting-sc