H3C路由器配置

1、整體配置過程與解釋：<H3C>sys 進(jìn)入到系統(tǒng)視圖sysname XXX / 修改路由器名字H3Cip https enable #配置httpslocal-user admin #創(chuàng)建用戶adminpassword simple admin#密碼admin service-type https #服務(wù)型httpsauthorization-attribute user-role level-15 #把權(quán)限給角色15quit#退回上級(jí)模式telnet server enable#配置telnet 服務(wù)local-user admin #配置telnet 用戶名password s

2、imple admin888 #配置明文密碼為admin888server-type telnet #配置用戶telnet 服務(wù)類型authorization-attribute user-role level-3 #配置用戶級(jí)別 quituser interface vty 0 4 #線程模式authorization-mode scheme #用戶名+密碼quit先配 LoopBack 地址再配置ospfxian BBBint LoopBack 10xian BBB-LoopBack10ip address x.x.x.x x.x.x.x /ip 地址 #router id

3、 配置路由id先配 LoopBack 地址再配置ospfxian BBBint LoopBack 10xian BBB-LoopBack10ip address x.x.x.x x.x.x.x /ip 地址ospf 1 #進(jìn)程號(hào)1area 0 #骨干區(qū)域network 55 network 55VLAN 10 /創(chuàng)建VLANint vlan 10 ip add 24/配置 VLAN 10 的 IP地址int g0/7 port link-type access #交換機(jī)模式 #ospf 1 area

4、 import route direct / 引入直連路由network 55 network 55interface Vlan-interface1ip address 04 interface GigabitEthernet0/5port link-mode route/ 設(shè)置接口為路由模式ip address 5 #interface GigabitEthernet0/7port link-mode

5、 route / 設(shè)置接口為路由模式ip address 5 H3Cip route-static /配置靜態(tài)目的網(wǎng)段（多個(gè)目的路由需配多條）和下一條的出口地址H3Cip route-static /配置缺省路由只需配和下一跳ip route-static 24 preferencce 60/設(shè)置優(yōu)先級(jí)為60，數(shù)字越小越優(yōu)先#ip http enableH3C-os

6、pf-1import-route direct /ospf 加入直連H3C-ospf-1import-route static /ospf 加入靜態(tài)路由#ospf 1 area network 55#ip unreachables enable 顯示跟蹤ip ttl-expires enable 顯示跟蹤#ip route-static 24 ip route-static 24 ip route-static 24 10.44.

7、171.6#雙鏈路路由器設(shè)置：#市路由器：acl advanced 3300 /創(chuàng)建訪問控制列表ACL 3300rule 0 permit ip destination 22 0 / 配置允許目的ip 地址或網(wǎng)段（反掩碼）訪問#acl advanced 3333 /創(chuàng)建訪問控制列表ACL 3333rule 0 permit ip destination 55 /配置允許目的ip 網(wǎng)段或固定地址（反掩碼）#policy-based-route xxx permit node 1/ 創(chuàng)建策略路xxx，節(jié)點(diǎn)1if-match acl 300

8、0/ 如果是 ACL 3000apply next-hop 1/ 指定下一跳ip 地址路由器#policy-based-route xxx permit node 11/ 創(chuàng)建策略路xxx，節(jié)點(diǎn)11if-match acl 3333/如果是 ACL3333apply next-hop / 指定下一跳ip 地址路由器在內(nèi)網(wǎng)口應(yīng)用策略路由interface GigabitEthernet0/5 port link-mode routeip address 6 ip policy-based-route xx

9、x#acl advanced 3500 /創(chuàng)建 ACL 3500rule 1 permit ip destination 22 0/ 允許指定目的地址通過，反掩碼rule 11 deny ip destination 55 /拒絕目的網(wǎng)段通過，反掩碼#在外網(wǎng)接口應(yīng)用上網(wǎng)策略（ outbound 是出， inbound 是進(jìn)）interface GigabitEthernet0/10port link-mode routeip address 0 packet-filter 3500 ou

10、tbound# 縣路由器：acl advanced 3300 /創(chuàng)建 ACL 3300訪問rule 0 permit ip source 22 0 / 配置允許源ip 固定地址，反掩碼rule 11 deny ip source 55 /拒絕目的網(wǎng)段通過，反掩碼 #acl advanced 3333 /創(chuàng)建 ACL 3333訪問rule 0 permit ip source 55 /配置允許源ip 段地址，反掩碼#policy-based-route xxx permit node 1/ 創(chuàng)建策略

11、路xxx，節(jié)點(diǎn)1if-match acl 3300/如果是 ACL 3300apply next-hop 1/ 指定下一跳ip 地址路由器#policy-based-route xxx permit node 11/ 創(chuàng)建策略路xxx，節(jié)點(diǎn)11if-match acl 3333/如果是 ACL 3333apply next-hop / 指定下一跳ip 地址路由器在內(nèi)網(wǎng)口應(yīng)用策略路由H3Cinterface Vlan-interface 1 ip address H3C-Vlan-interface1i

12、p policy-based-route xxx quit #在外網(wǎng)接口應(yīng)用上網(wǎng)策略（ outbound 是出， inbound 是進(jìn)）interface GigabitEthernet0/10 port link-mode routeip address 0 packet-filter 3300 outbound #市 A 靜態(tài)配置 ：<shi AAA>dis cutelnet server enable#router id # ospf 1 import-route direc import-route static

13、 area network 55#ip unreachables enable ip ttl-expires enable#policy-based-route xxx permit node 1if-match acl 3300 apply next-hop 0 #policy-based-route xxx permit node 11if-match acl 3333 apply next-hop #interface GigabitEthernet0/1 port link-mode ro

14、uteip address #interface GigabitEthernet0/3 port link-mode routeip address #interface GigabitEthernet0/5port link-mode routeip address 6 ip policy-based-route xxx#interface GigabitEthernet0/10 port link-mode routeip address

15、1 packet-filter 3300 outbound #ip route-static 24 、ip route-static 24 0#acl advanced 3300rule 1 permit ip destination 22 0rule 11 deny ip destination 55#acl advanced 3333rule 11 permit ip destination

16、 55#local-user admin class manage service-type telnet http httpsauthorization-attribute user-role level-12authorization-attribute user-role level-15authorization-attribute user-role network-operator#ip http enableip https enable#縣 B 動(dòng)態(tài) ospf<xian BBB>dis cu#telnet server enabl

17、e#router id 0#ospf 1area network 55network 55network 55# ip unreachables enable ip ttl-expires enable#policy-based-route yyy permit node 1if-match acl 3300 apply next-hop 1#policy-based-route yyy permit node 11if-matc

18、h acl 3333 apply next-hop #interface Vlan-interface1ip address ip policy-based-route yyy#interface GigabitEthernet0/3 port link-mode routeip address ospf cost 2#interface GigabitEthernet0/11 port link-mode routeip address 0 255

19、.255.255.0 packet-filter 3300 outbound #acl advanced 3300rule 1 permit ip source 22 0rule 11 deny ip source 55#acl advanced 3333rule 11 permit ip source 55#local-user admin class manageservice-type telnet http httpsauthorization-attribute user-role le

20、vel-15authorization-attribute user-role network-operator#ip http enable ip https enable#縣A靜態(tài)<xian AAA>dis cu#telnet server enable#ip unreachables enabl ip ttl-expires enable#policy-based-route xxx permit node 1if-match acl 3300 apply next-hop 1#policy-based-route xxx permit node 2if-match acl 3333 apply next-hop #interface Vlan-interface1ip address ip policy-based-route xxx#interface GigabitEther