銀行網(wǎng)絡應急預案XXXX

銀行網(wǎng)絡應急方案XX股份網(wǎng)絡與平安效勞部2021年2月名目TOC\o"1-3"\h\z\u一、銀行網(wǎng)絡結(jié)構(gòu)拓撲PAGEREF_Toc316893996\h3二、骨干網(wǎng)通信故障PAGEREF_Toc316893997\h31.故障處理人員PAGEREF_Toc316893998\h32.電信、聯(lián)通網(wǎng)絡通信故障PAGEREF_Toc316893999\h33.通信故障恢復PAGEREF_Toc316894000\h34.到總行路由器故障PAGEREF_Toc316894001\h45.路由器故障處理PAGEREF_Toc316894002\h4三、核心交換機故障應急PAGEREF_Toc316894003\h51.一臺4506交換機故障應急PAGEREF_Toc316894004\h52.當核心交換同時癱瘓在20分鐘內(nèi)保證業(yè)務正常運作PAGEREF_Toc316894005\h7四、第三方外聯(lián)區(qū)網(wǎng)絡應急PAGEREF_Toc316894006\h191.第三方業(yè)務銀聯(lián)區(qū)網(wǎng)絡應急PAGEREF_Toc316894007\h192.其它第三方業(yè)務區(qū)網(wǎng)絡應急PAGEREF_Toc316894008\h46五、聯(lián)系方式：PAGEREF_Toc316894009\h56銀行網(wǎng)絡結(jié)構(gòu)拓撲骨干網(wǎng)通信故障故障處理人員參與人：XX、XX、XX電信、聯(lián)通網(wǎng)絡通信故障依據(jù)到總行的兩臺cisco7206路由器的日志以及實際登陸設備使用showintATM4/0.1、ping對端地址、showiproute、showlog，查瞧上述相關(guān)設備和線路是否有反復重起、誤碼率高、異常路由、錯誤連接等情況即可確認故障。通信故障恢復恢復步驟：1〕重啟故障新路相連路由器，瞧是否能夠自動恢復2)斷電重起無法解決故障的，停止使用故障設備和線路，防止其礙事網(wǎng)絡其他局部。3)如系線路故障通知各有關(guān)方面〔逐項比立處理〕：●如為中國電信線路故障，向31000000報修，并通知分行辦公室相關(guān)人員?！袢鐬橹袊?lián)通線路故障，向XXXX報修，并通知分行辦公室相關(guān)人員。到總行路由器故障查瞧日志，檢查設備故障前的異常日志信息；登陸路由器使用showlog，showipintbrie,showprocesscpuhis,showiproute,ping對端地址等命令來確認故障。路由器故障處理一旦發(fā)現(xiàn)到總行7206路由器故障可按以下步驟來處理：●聯(lián)系XX公司，并啟動原廠商保修效勞備件更換程序?！褚驗閮膳_7206路由器是互為備份的，一臺發(fā)生故障不礙事實際業(yè)務，不調(diào)用庫房備件和集成商備件更換，等待原廠商備件到達?！耜P(guān)于能夠在線插拔的接口模塊、有standby的引擎和電源，優(yōu)先使用在線更換方式。在線更換的具體操作流程如下：a)用筆記本電腦連接在網(wǎng)絡設備的Console上，啟動Console監(jiān)控和記錄；b)預備好存檔的系統(tǒng)配置，備用。如有可能，同時保持當前系統(tǒng)配置；c)對故障模塊上連接的線纜做好標記，小心拔下；d)做好平安接地，拔下故障模塊；e)檢查設備和模塊狀態(tài)，確認是否礙事整個設備或其他模塊正常運行，standby模塊是否正常接管；f)做好平安接地，插上更換的備件模塊；g)檢查設備和模塊狀態(tài)，確認是否能夠正常識不新模塊，是否礙事其他模塊運行；h)按原樣插上線纜；i)檢查線纜連接狀態(tài)正常；j)確認備件更換成功。l關(guān)于機箱、不能在線插拔的接口模塊、或者沒有standby的引擎和電源，采納下電更換方式。下電更換的具體操作流程如下：a)預備好存檔的系統(tǒng)配置，備用。如有可能，同時保持當前系統(tǒng)配置；b)預備好原先使用的系統(tǒng)軟件，備用；c)故障設備下電；d)對需要拔除的線纜做好標記，小心拔下。要是機箱或引擎更換，需拔除所有連接線纜；e)更換備件；f)用筆記本電腦連接在網(wǎng)絡設備的Console上，啟動Console監(jiān)控和記錄；g)設備上電；h)檢查系統(tǒng)自檢情況，確認無硬件故障；i)安裝系統(tǒng)軟件；j)恢復系統(tǒng)配置；k)冷啟動，確認軟硬件正常工作；l)按原樣插上其他線纜；m)檢查線纜連接狀態(tài)正常；n)確認備件更換成功。核心交換機故障應急一臺4506交換機故障應急查瞧日志，檢查設備故障前的異常日志信息；登陸交換機使用showlog，showipintbrie,showprocesscpuhis,showiproute,ping對端地址，showvlanbrie,showvtpstat,showprocessmem,showmodul,showdiag,showipeigrpnei,showcdpnei等一系列命令來查尋、確認故障。因為兩臺4506核心交換機完全是熱備的雙機，因此一臺發(fā)生故障并不礙事業(yè)務運行。關(guān)于配置咨詢題要制定正確的更改配置足本，備份當前配置以后實施更改；關(guān)于線路咨詢題的要制作新網(wǎng)線，替換故障的網(wǎng)線；關(guān)于硬件咨詢題要練習XX公司，申請硬件故障維修。關(guān)于能夠在線插拔的接口模塊、有standby的引擎和電源，優(yōu)先使用在線更換方式。在線更換的具體操作流程如下：a)用筆記本電腦連接在網(wǎng)絡設備的Console上，啟動Console監(jiān)控和記錄；b)預備好存檔的系統(tǒng)配置，備用。如有可能，同時保持當前系統(tǒng)配置；c)對故障模塊上連接的線纜做好標記，小心拔下；d)做好平安接地，拔下故障模塊；e)檢查設備和模塊狀態(tài)，確認是否礙事整個設備或其他模塊正常運行，standby模塊是否正常接管；f)做好平安接地，插上更換的備件模塊；g)檢查設備和模塊狀態(tài)，確認是否能夠正常識不新模塊，是否礙事其他模塊運行；h)按原樣插上線纜；i)檢查線纜連接狀態(tài)正常；j)確認備件更換成功。l關(guān)于機箱、不能在線插拔的接口模塊、或者沒有standby的引擎和電源，采納下電更換方式。下電更換的具體操作流程如下：a)預備好存檔的系統(tǒng)配置，備用。如有可能，同時保持當前系統(tǒng)配置；b)預備好原先使用的系統(tǒng)軟件，備用；c)故障設備下電；d)對需要拔除的線纜做好標記，小心拔下。要是機箱或引擎更換，需拔除所有連接線纜；e)更換備件；f)用筆記本電腦連接在網(wǎng)絡設備的Console上，啟動Console監(jiān)控和記錄；g)設備上電；h)檢查系統(tǒng)自檢情況，確認無硬件故障；i)安裝系統(tǒng)軟件；j)恢復系統(tǒng)配置；k)冷啟動，確認軟硬件正常工作；l)關(guān)于交換機要將VTP設置為Client模式，首先連接上行線纜，確認VTP復制正確；m)按原樣插上其他線纜；n)檢查線纜連接狀態(tài)正常；o)確認備件更換成功。當核心交換同時癱瘓在20分鐘內(nèi)保證業(yè)務正常運作現(xiàn)有2臺備用的cisco3550，在兩臺核心cisco4506同事癱瘓后，將其作為核心交換來保證業(yè)務的正常運作，同時維持原有的網(wǎng)絡拓撲及網(wǎng)絡核心的平安策略和qos。3550核心交換配置定義設備命名hostnameproduction設備軟件版本使用支持動態(tài)路由協(xié)議的IOS：c3550-i5k2l1a.binVlan定義1defaultactiveFa0/1,Fa0/2,Fa0/35,Fa0/36Fa0/37,Fa0/38,Fa0/39,Fa0/40Fa0/41,Fa0/42,Fa0/43,Fa0/44Fa0/45,Fa0/46,Fa0/47,Fa0/482vlan0002activeFa0/10,Fa0/21,Fa0/25,Fa0/34Gi0/1,Gi0/23vlan0003activeFa0/5,Fa0/8,Fa0/11,Fa0/12Fa0/17,Fa0/19,Fa0/20,Fa0/22Fa0/28,Fa0/29,Fa0/30,Fa0/324vlan0004activeFa0/13,Fa0/18,Fa0/275vlan0005activeFa0/76vlan0006active10vlan0010activeFa0/4,Fa0/6,Fa0/1420vlan0020active30vlan0030active40vlan0040active50VLAN0050active60VLAN0060active63vlan0063active128vlan0128activeFa0/3,Fa0/24,Fa0/26,Fa0/31Fa0/33195vlan195activeFa0/16,Fa0/23196vlan196active255VLAN0255activeFa0/9,Fa0/15Ip地址分配及hsrpinterfaceVlan1noipaddressnoipredirectsshutdownstandby10priority100standby10preempt!interfaceVlan2ipaccess-group101innoipredirectsstandby20priority150standby20preempt!interfaceVlan3ipaccess-group101innoipredirectsstandby30priority150standby30preempt!interfaceVlan4noipredirectsstandby40priority150standby40preempt!interfaceVlan5noipredirectsstandby50priority150standby50preempt!interfaceVlan6noipaddressnoipredirectsshutdownstandby60priority150standby60preempt!interfaceVlan10ipaddressipaccess-group103innoipredirectsstandby100i.1standby100timers515standby100priority200standby100preemptstandby100trackVlan1050!interfaceVlan20noipaddressnoipredirectsstandby110timers515standby110priority150standby110preemptstandby110trackVlan2050!interfaceVlan30noipaddressipaccess-group101innoipredirectsshutdownstandby120timers515standby120priority200standby120preemptstandby120trackVlan3050!interfaceVlan40noipaddressipaccess-group101innoipredirectsshutdownstandby130timers515standby130priority150standby130preemptstandby130trackVlan4050!interfaceVlan50ipaddressiphelper-address.10noipredirectsstandby150i.1standby150timers515standby150priority150standby150preemptstandby150trackVlan150!interfaceVlan63noipaddressnoipredirects!interfaceVlan128ipaccess-group101innoipredirectsstandby160timers515standby160priority150standby160preemptstandby160trackVlan12850!interfaceVlan150noipaddressshutdown!interfaceVlan195noipredirectsstandby195priority150standby195preempt!interfaceVlan196noipaddressnoipredirectsshutdownstandby196priority100standby196preempt!interfaceVlan255noipredirectsstandby255priority200standby255preempt路由策略routereigrp20redistributestaticnetworknoauto-summarynoeigrplog-neighbor-changesiprouteiprouteiprouteinterfaceVlan2ipaccess-group101ininterfaceVlan3ipaccess-group101ininterfaceVlan30noipaddressipaccess-group101ininterfaceVlan40noipaddressipaccess-group101ininterfaceVlan128ipaccess-group101inaccess-list101permitiphostaccess-list101permitiphostaccess-list101denyiaccess-list101denyiaccess-list101denyiaccess-list101permitipanyanyinterfaceVlan10ipaddressipaccess-group103inaccess-list103permitiphostaccess-list103permitiphostaccess-list103permitiphostaccess-list103permitiphostaccess-list103permitiphostaccess-list103permitiphostaccess-list103permitiphostaccess-list103permitiphostaccess-list103permitiphostaccess-list103permitiaccess-list103permitiaccess-list103permitiaccess-list103permitiaccess-list103permitiaccess-list103permitiaccess-list103permitiaccess-list103permitiaccess-list103permitiaccess-list103permitiaccess-list103permitiaccess-list103permitiphostaccess-list103permitiphostaccess-list103denyiaccess-list103denyiaccess-list103denyiaccess-list103permitipanyanyQos作為核心交換機無需在此配置qos平安策略aaanew-modelaaaauthenticationloginspdb-acsgrouptacacs+enableaaaaccountingexecspdb-acsstart-stopgrouptacacs+aaaaccountingcommands0spdb-acsstart-stopgrouptacacs+aaaaccountingcommands1spdb-acsstart-stopgrouptacacs+aaaaccountingcommands2spdb-acsstart-stopgrouptacacs+aaaaccountingcommands3spdb-acsstart-stopgrouptacacs+aaaaccountingcommands4spdb-acsstart-stopgrouptacacs+aaaaccountingcommands5spdb-acsstart-stopgrouptacacs+aaaaccountingcommands6spdb-acsstart-stopgrouptacacs+aaaaccountingcommands7spdb-acsstart-stopgrouptacacs+aaaaccountingcommands8spdb-acsstart-stopgrouptacacs+aaaaccountingcommands9spdb-acsstart-stopgrouptacacs+aaaaccountingcommands10spdb-acsstart-stopgrouptacacs+aaaaccountingcommands11spdb-acsstart-stopgrouptacacs+aaaaccountingcommands12spdb-acsstart-stopgrouptacacs+aaaaccountingcommands13spdb-acsstart-stopgrouptacacs+aaaaccountingcommands14spdb-acsstart-stopgrouptacacs+aaaaccountingcommands15spdb-acsstart-stopgrouptacacs+iptacacssource-interfaceLoopback0tacacs-serverkeys9y8loggingtrapdebuggingloggingsource-interfaceLoopback0linevty04exec-timeout50accountingcommands0spdb-acsaccountingcommands1spdb-acsaccountingcommands2spdb-acsaccountingcommands3spdb-acsaccountingcommands4spdb-acsaccountingcommands5spdb-acsaccountingcommands6spdb-acsaccountingcommands7spdb-acsaccountingcommands8spdb-acsaccountingcommands9spdb-acsaccountingcommands10spdb-acsaccountingcommands11spdb-acsaccountingcommands12spdb-acsaccountingcommands13spdb-acsaccountingcommands14spdb-acsaccountingcommands15spdb-acsaccountingexecspdb-acsloginauthenticationspdb-acs網(wǎng)管配置access-list10permit6snmp-servercommunitypublicROsnmp-servercommunityreadRO10snmp-servertrap-sourceLoopback0snmp-serverenabletrapssnmpauthenticationwarmstartsnmp-serverenabletrapsconfigsnmp-serverenabletrapsentitysnmp-serverenabletrapsrtrsnmp-serverenabletrapsvtpsnmp-serverhostpublicsnmp-serverhostread其他配置servicetimestampsdebugdatetimelocaltimeshow-timezoneservicetimestampslogdatetimelocaltimeshow-timezoneservicepassword-encryptionnoipdomain-lookupipcefload-sharingalgorithmoriginalclocktimezoneBJT8ntpsourceLoopback0ntpservmonitorsession1sourcevlan1,10,192rxmonitorsession1destinationinterfaceFa0/5網(wǎng)絡實施前期預備一、8條交叉線〔2條做trunk，6條連向樓層交換機〕二、將樓層交換機的fa0/47和48口空出來，并做好相應的配置實施步驟第一步：兩臺3550上架并加電啟用〔估量3分鐘〕第二步：將連接hp小機的光纖接口連到3550上〔估量1分鐘〕cisco4506主的gigabit1/1對應3550主的gigabit0/1cisco4506主的gigabit2/2對應3550主的gigabit0/2cisco4506備的gigabit1/1對應3550主的gigabit0/1cisco4506備的gigabit2/2對應3550主的gigabit0/2第三步：將現(xiàn)成的交叉線在3550主備之間互連做ether－channel(估量1分鐘)3550主的fa0/47對應3550備的fa0/473550主的fa0/48對應3550備的fa0/48第四步：將連在cisco4506上所有的電口都挪向3550上〔估量5分鐘〕cisco4506主的fa2/3對應3550主的fa0/3cisco4506主的fa2/4對應3550主的fa0/4以此類推cisco4506主的fa2/34對應3550主的fa0/34cisco4506備的fa2/3對應3550備的fa0/3cisco4506備的fa2/4對應3550備的fa0/4以此類推cisco4506備的fa2/34對應3550備的fa0/34第五步：3臺樓層交換機與3550之間的互連〔估量3分鐘〕3550主的fa0/41對應的fa0/473550主的fa0/43對應的fa0/473550主的fa0/45對應的fa0/473550備的fa0/41對應的fa0/483550備的fa0/43對應的fa0/483550備的fa0/45對應的fa0/48第三方外聯(lián)區(qū)網(wǎng)絡應急第三方業(yè)務銀聯(lián)區(qū)網(wǎng)絡應急線路故障：發(fā)生故障時，登陸ASA防火墻、交換機、路由器通過showlog,showipintbrie,showinterface,ping,showiproute,showroute等命令來確認相關(guān)接口在故障發(fā)生前和發(fā)生時的狀態(tài)，尋出咨詢題線路。要是是內(nèi)部網(wǎng)絡線路，在線更換的具體操作流程如下：a)用筆記本電腦連接在網(wǎng)絡設備的Console上，啟動Console監(jiān)控和記錄；b)預備好存檔的系統(tǒng)配置，備用。如有可能，同時保持當前系統(tǒng)配置；c)對故障模塊上連接的線纜做好標記，小心拔下；d)做好平安接地，插上更換的新網(wǎng)線e)檢查線纜連接狀態(tài)正常；f)確認線纜更換成功。要是是外部線纜，那么確認故障后，由XX打保修，聯(lián)系聯(lián)通、移動公司人員前來維修。設備故障：由于銀聯(lián)區(qū)所有的設備根基上雙機熱備，因此一臺發(fā)生故障并不礙事業(yè)務運行。關(guān)于配置咨詢題要制定正確的更改配置足本，備份當前配置以后實施更改；關(guān)于硬件咨詢題要練習XX公司，申請硬件故障維修。兩臺設備故障：使用1臺ASA5540防火墻備份ASA防火墻的配置、使用1臺cisco1841路由器備份連接銀聯(lián)方路由器的配置，任意1臺交換機無需配置用來備份銀聯(lián)區(qū)交換機。ASA防火墻配置：spdbsyasa#shrun:Saved:ASAVersion8.2(1)!hostnamespdbsyasaenablepassword2KFQnbNIdI.2KYOUencryptedpasswd2KFQnbNIdI.2KYOUencryptednames!interfaceGigabitEthernet0/0speed100duplexfullnameifoutsidesecurity-level0ipaddress!interfaceGigabitEthernet0/1nameifinsidesecurity-level100ipaddress!interfaceGigabitEthernet0/2nameifdmzsecurity-level50ipaddress!interfaceGigabitEthernet0/3descriptionLANFailoverInterface!interfaceManagement0/0shutdownnonameifnosecurity-levelnoipaddress!ftpmodepassiveaccess-listIPP_PATextendedpermitiphosthostaccess-listIPP_PATextendedpermitiphosthostaccess-listIPP_PATextendedpermitiphosthostaccess-listIPP_PATextendedpermitiphosthostaccess-listIPP_PATextendedpermitiphosthostaccess-listIPP_PATextendedpermitiphosthostaccess-listOUTSIDE_INextendedpermiticmpanyanyaccess-listOUTSIDE_INextendedpermittcphosthosteq21428access-listOUTSIDE_INextendedpermittcphosteq21428hostaccess-listOUTSIDE_INextendedpermittcphosthosteq23428access-listOUTSIDE_INextendedpermittcphosteq23428hostaccess-listOUTSIDE_INextendedpermittcphosthosteq21428access-listOUTSIDE_INextendedpermittcphosteq21428hostaccess-listOUTSIDE_INextendedpermittcphosthosteq23428access-listOUTSIDE_INextendedpermittcphosteq23428hostaccess-listOUTSIDE_INextendedpermittcphosteq6060hostaccess-listOUTSIDE_INextendedpermitudpeqsnmptrapaccess-listOUTSIDE_INextendedpermitudpeqsyslogaccess-listOUTSIDE_INextendedpermitudphosteqradiusaccess-listOUTSIDE_INextendedpermitudphosteqradius-acctaccess-listOUTSIDE_INextendedpermitudphosteq1812access-listOUTSIDE_INextendedpermitudphosteq1813access-listOUTSIDE_INextendedpermittcphosteqtacacsaccess-listOUTSIDE_INextendedpermitudphosteqradiusaccess-listOUTSIDE_INextendedpermitudphosteqradius-acctaccess-listOUTSIDE_INextendedpermitudphosteq1812access-listOUTSIDE_INextendedpermitudphosteq1813access-listOUTSIDE_INextendedpermittcphosteqtacacsaccess-listOUTSIDE_INextendedpermitudphostaccess-listOUTSIDE_INextendedpermittcphostaccess-listINSIDE_OUTextendedpermiticmpanyanyaccess-listINSIDE_OUTextendedpermittcphosthosteq21428access-listINSIDE_OUTextendedpermittcphosteq21428hostaccess-listINSIDE_OUTextendedpermittcphosthosteq23428access-listINSIDE_OUTextendedpermittcphosteq23428hostaccess-listINSIDE_OUTextendedpermittcphosthosteq21428access-listINSIDE_OUTextendedpermittcphosteq21428hostaccess-listINSIDE_OUTextendedpermittcphosthosteq23428access-listINSIDE_OUTextendedpermittcphosteq23428hostaccess-listINSIDE_OUTextendedpermittcphosthosteq21428access-listINSIDE_OUTextendedpermittcphosteq21428hostaccess-listINSIDE_OUTextendedpermittcphosthosteq23428access-listINSIDE_OUTextendedpermittcphosteq23428hostaccess-listINSIDE_OUTextendedpermittcphosthosteq21428access-listINSIDE_OUTextendedpermittcphosteq21428hostaccess-listINSIDE_OUTextendedpermittcphosthosteq23428access-listINSIDE_OUTextendedpermittcphosteq23428hostaccess-listINSIDE_OUTextendedpermittcphosthosteq21428access-listINSIDE_OUTextendedpermittcphosteq21428hostaccess-listINSIDE_OUTextendedpermittcphosthosteq23428access-listINSIDE_OUTextendedpermittcphosteq23428hostaccess-listINSIDE_OUTextendedpermittcphosthosteq21428access-listINSIDE_OUTextendedpermittcphosteq21428hostaccess-listINSIDE_OUTextendedpermittcphosthosteq23428access-listINSIDE_OUTextendedpermittcphosteq23428hostaccess-listINSIDE_OUTextendedpermittcphosthosteq6060access-listINSIDE_OUTextendedpermitipanyaccess-listINSIDE_OUTextendedpermitiphostanyaccess-listINSIDE_OUTextendedpermitiphostanyaccess-listINSIDE_OUTextendedpermitudphostanyeqntpaccess-listINSIDE_OUTextendedpermitudphostanyeqntppagerlines24mtuoutside1500mtuinside1500mtudmz1500failoverfailoverlanunitprimaryfailoverlaninterfacefailoverlanGigabitEthernet0/3failoverpolltimeunitmsec500holdtime5icmpunreachablerate-limit1burst-size1noasdmhistoryenablearptimeout14400nat(inside)2access-listIPP_PATstatic(inside,outside)tcp2142821428netmaskstatic(inside,outside)tcp2342823428netmaskstatic(inside,outside)tcptelnettelnetnetmaskstatic(outside,inside)netmaskstatic(outside,inside)netmaskstatic(inside,outside)netmaskstatic(outside,inside)netmaskstatic(inside,outside)netmaskstatic(inside,outside)netmaskstatic(inside,outside)netmaskstatic(inside,outside)netmaskstatic(inside,outside)netmaskstatic(inside,outside)netmaskstatic(inside,outside)netmaskstatic(inside,outside)netmaskstatic(inside,outside)netmaskaccess-groupOUTSIDE_INininterfaceoutsideaccess-groupINSIDE_OUTininterfaceinsiderouteoutside1routeoutside1routeinside.01routeoutside1routeinside1routeoutside1timeoutxlate3:00:00timeoutconn1:00:00half-closed0:10:00udp0:02:00icmp0:00:02timeoutsunrpc0:10:00h3230:05:00h2251:00:00mgcp0:05:00mgcp-pat0:05:00timeoutsip0:30:00sip_media0:02:00sip-invite0:03:00sip-disconnect0:02:00timeoutsip-provisional-media0:02:00uauth0:05:00absolutetimeouttcp-proxy-reassembly0:01:00dynamic-access-policy-recordDfltAccessPolicyaaa-serverTACACS+protocoltacacs+aaa-serverRADIUSprotocolradiusaaa-serverspdb-acsprotocoltacacs+keys9y8keys9y9aaaauthenticationsshconsolespdb-acssnmp-serverhostinsidecommunityreadsnmp-serverhostinsidepollcommunityreadsnmp-serverhostinsidepollcommunityreadsnmp-serverhostinsidepollcommunityreadsnmp-serverhostinsidepollcommunityreadnosnmp-serverlocationnosnmp-servercontactsnmp-servercommunity*****snmp-serverenabletrapssnmpauthenticationlinkuplinkdowncoldstartsnmp-serverenabletrapssyslogcryptoipsecsecurity-associationlifetimeseconds28800cryptoipsecsecurity-associationlifetimekilobytes4608000telnetinsidetelnetinsidetelnettimeout5sshtimeout5consoletimeout0threat-detectionbasic-threatthreat-detectionstatisticsaccess-listnothreat-detectionstatisticstcp-intercept!class-mapinspection_defaultmatchdefault-inspection-traffic!!policy-maptypeinspectdnspreset_dns_mapparametersmessage-lengthmaximum512policy-mapglobal_policyclassinspection_defaultinspectdnspreset_dns_mapinspectftpinspecth323h225inspecth323rasinspectnetbiosinspectrshinspectrtspinspectskinnyinspectesmtpinspectsqlnetinspectsunrpcinspecttftpinspectsipinspectxdmcp!service-policyglobal_policyglobalprompthostnamecontextCryptochecksum:b0171b7af7453023bce0c7ebfafb273e:end

spdbsyasa#路由器配置：R1#shrunBuildingconfiguration...Currentconfiguration:4554bytes!servicetimestampsdebugdatetimemsecservicetimestampslogdatetimemsecnoservicepassword-encryption!hostnameR1!boot-start-markerboot-end-marker!loggingmessage-countersyslogenablepasswordcisco!aaanew-model!!aaaauthenticationloginspdb-acsgrouptacacs+enableaaaaccountingexecspdb-acsaction-typestart-stopgrouptacacs+!aaaaccountingcommands0spdb-acsaction-typestart-stopgrouptacacs+!aaaaccountingcommands1spdb-acsaction-typestart-stopgrouptacacs+!aaaaccountingcommands2spdb-acsaction-typestart-stopgrouptacacs+!aaaaccountingcommands3spdb-acsaction-typestart-stopgrouptacacs+!aaaaccountingcommands4spdb-acsaction-typestart-stopgrouptacacs+!aaaaccountingcommands5spdb-acsaction-typestart-stopgrouptacacs+!aaaaccountingcommands6spdb-acsaction-typestart-stopgrouptacacs+!aaaaccountingcommands7spdb-acsaction-typestart-stopgrouptacacs+!aaaaccountingcommands8spdb-acsaction-typestart-stopgrouptacacs+!aaaaccountingcommands9spdb-acsaction-typestart-stopgrouptacacs+!aaaaccountingcommands10spdb-acsaction-typestart-stopgrouptacacs+!aaaaccountingcommands11spdb-acsaction-typestart-stopgrouptacacs+!aaaaccountingcommands12spdb-acsaction-typestart-stopgrouptacacs+!aaaaccountingcommands13spdb-acsaction-typestart-stopgrouptacacs+!aaaaccountingcommands14spdb-acsaction-typestart-stopgrouptacacs+!aaaaccountingcommands15spdb-acsaction-typestart-stopgrouptacacs+!!!aaasession-idcommondot11syslogipsource-route!!!!ipcefnoipdomainlookupnoipv6cef!multilinkbundle-nameauthenticated!!!!!!!!!!!!!!!!!!!!!!voice-card0!!!!!archivelogconfighidekeys!!!!!!track1ipsla1reachability!!!!interfaceLoopback0!interfaceFastEthernet0/0noipaddressshutdownduplexautospeedauto!interfaceFastEthernet0/1noipaddressshutdownduplexautospeedauto!interfaceFastEthernet0/3/0!interfaceFastEthernet0/3/1!interfaceFastEthernet0/3/2!interfaceFastEthernet0/3/3!interfaceSerial0/1/0descriptiontoYinlianipnatinsideipvirtual-reassemblyencapsulationpppnoshutdownclockrate2000000!interfaceSerial0/1/1noipaddressshutdownclockrate2000000!interfaceVlan1ipaddresssecondaryipnatoutsideipvirtual-reassemblystandby184priority105standby184preemptstandby184track1decrement10!ipforward-protocolndiproutenoipservernoipsecure-server!!ipnatoutsidesourcelist105poolyinlianpoolipnatoutsidesourcelist106poolpospool!ipsla1icmp-echosource-interfaceSerial0/1/0frequency5ipslaschedule1lifeforeverstart-timenow!!!!!tacacs-serverkeys9y8!control-plane!!!!!!!!!!linecon0exec-timeout00loggingsynchronouslineaux0linevty04exec-timeout00passwordciscoaccountingcommands0spdb-acsaccountingcommands1spdb-acsaccountingcommands2spdb-acsaccountingcommands3spdb-acsaccountingcommands4spdb-acsaccountingcommands5spdb-acsaccountingcommands6spdb-acsaccountingcommands7spdb-acsaccountingcommands8spdb-acsaccountingcommands9spdb-acsaccountingcommands10spdb-acsaccountingcommands11spdb-acsaccountingcommands12spdb-acsaccountingcommands13spdb-acsaccountingcommands14spdb-acsaccountingcommands15spdb-acsaccountingexecspdb-acsloggingsynchronousloginauthenticationspdb-acs!schedulerallocate200001000ntpsourceLoopback0endR1#R2#shrunBuildingconfiguration...Currentconfiguration:4533bytes!servicetimestampsdebugdatetimemsecservicetimestampslogdatetimemsecnoservicepassword-encryption!hostnameR2!boot-start-markerboot-end-marker!loggingmessage-countersyslogenablepasswordcisco!aaanew-model!!aaaauthenticationloginspdb-acsgrouptacacs+enableaaaaccountingexecspdb-acsaction-typestart-stopgrouptacacs+!aaaaccountingcommands0spdb-acsaction-typestart-stopgrouptacacs+!aaaaccountingcommands1spdb-acsaction-typestart-stopgrouptacacs+!aaaaccountingcommands2spdb-acsaction-typestart-stopgrouptacacs+!aaaaccountingcommands3spdb-acsaction-typestart-stopgrouptacacs+!aaaaccountingcommands4spdb-acsaction-typestart-stopgrouptacacs+!aaaaccountingcommands5spdb-acsaction-typestart-stopgrouptacacs+!aaaaccountingcommands6spdb-acsaction-typestart-stopgrouptacacs+!aaaaccountingcommands7spdb-acsaction-typestart-stopgrouptacacs+!aaaaccountingcommands8spdb-acsaction-typestart-stopgrouptacacs+!aaaaccountingcommands9spdb-acsaction-typestart-stopgrouptacacs+!aaaaccountingcommands10spdb-acsaction-typestart-stopgrouptacacs+!aaaaccountingcommands11spdb-acsaction-typestart-stopgrouptacacs+!aaaaccountingcommands12spdb-acsaction-typestart-stopgrouptacacs+!aaaaccountingcommands13spdb-acsaction-typestart-stopgrouptacacs+!aaaaccountingcommands14spdb-acsaction-typestart-stopgrouptacacs+!aaaaccountingcommands15spdb-acsaction-typestart-stopgrouptacacs+!!!aaasession-idcommonclocktimezoneBJT8dot11syslogipsource-route!!!!ipcefnoipdomainlookupnoipv6cef!multilinkbundle-nameauthenticated!!!!!!!!!!!!!!!!!!!!!!voice-card0!!!!!archivelogconfighidekeys!!!!!!!!!interfaceLoopback0!interfaceFastEthernet0/0noipaddressduplexautospeedauto!interfaceFastEthernet0/1noipaddressshutdownduplexautospeedauto!interfaceFastEthernet0/3/0!interfaceFastEthernet0/3/1!interfaceFastEthernet0/3/2!interfaceFastEthernet0/3/3!interfaceSerial0/1/0ipnatinsideipvirtual-reassemblyencapsulationpppnofair-queueclockrate2000000!interfaceSerial0/1/1noipaddressshutdownclockrate2000000!interfaceVlan1ipaddresssecondaryipnatoutsideipvirtual-reassemblystandby184preempt!ipforward-protocolndiproutenoipservernoipsecure-server!!ipnatoutsidesourcelist105poolyinlianpoolipnatoutsidesourcelist106poolpospool!!!!!!tacacs-serverkeys9y8!control-plane!!!!!!!!!!linecon0lineaux0linevty04exec-timeout00accountingcommands0spdb-acsaccountingcommands1spdb-acsaccountingcommands2spdb-acsaccountingcommands3spdb-acsaccountingcommands4spdb-acsaccountingcommands5spdb-acsaccountingcommands6spdb-acsaccountingcommands7spdb-acsaccountingcommands8spdb-acsaccountingcommands9spdb-acsaccountingcommands10spdb-acsaccountingcommands11spdb-acsaccountingcommands12spdb-acsaccountingcommands13spdb-acsaccountingcommands14spdb-acsaccountingcommands15spdb-acsaccountingexecspdb-acsloginauthenticationspdb-acslinevty515exec-timeout00password70518160B235F575041accountingcommands0spdb-acsaccountingcommands1spdb-acsaccountingcommands2spdb-acsaccountingcommands3spdb-acsaccountingcommands4spdb-acsaccountingexecspdb-acsloginauthenticationspdb-acs!schedulerallocate200001000ntpsourceLoopback0endR2#實施步驟：因為設備型號根基上和原有設備完全一致，因此直截了當將備機按照原樣接上即可。其它第三方業(yè)務區(qū)網(wǎng)絡應急其它第三方業(yè)務設備根基上單體設備，沒有熱備，要是設備出現(xiàn)故障，采納配置型號完全一致的備機進行替換PIX防火墻配置：pix515E#showrun:Saved:PIXVersion6.2(2)nameifethernet0outsidesecurity0nameifethernet1insidesecurity100nameifethernet2intf2security10hostnamepix515EclocktimezoneBJT8fixupprotocolftp21fixupprotocol80fixupprotocolh323h2251720fixupprotocolh323ras1718-1719fixupprotocolils389fixupprotocolrsh514fixupprotocolrtsp554fixupprotocolsmtp25fixupprotocolsqlnet1521fixupprotocolsip5060fixupprotocolskinny2000namesaccess-listpermit_allpermitipanyanyaccess-listno_natdenyiphostanyaccess-listno_natdenyiphostanyaccess-listno_natdenyiphostanyaccess-listno_natdenyiphostanyaccess-listno_natdenyiphostanyaccess-listno_natdenyiphostanyaccess-listno_natdenyiphosthostaccess-listno_natdenyiphosthostaccess-listno_natdenyiphosthostaccess-listno_natpermitipanyaccess-listno_natpermiti.0access-listno_natpermiti.0access-listno_natpermiti.0access-listno_natpermiti.0access-listno_natpermiti.0access-listno_natpermiti.0access-listno_natpermiti.0access-listtodianhuapermitipanyhostaccess-listtodianhuapermitipanyhostaccess-listacl_insidepermitiphostanyaccess-listacl_insidepermitiphostanyaccess-listacl_insidedenyudpanyanyeqtftpaccess-listacl_insidedenytcpanyanyeq135access-listacl_insidedenyudpanyanyeq135access-listacl_insidedenytcpanyanyeq137access-listacl_insidedenyudpanyanyeqnetbios-nsaccess-listacl_insidedenytcpanyanyeq138access-listacl_insidedenyudpanyanyeqnetbios-dgmaccess-listacl_insidedenytcpanyanyeqnetbios-ssnaccess-listacl_insidedenyudpanyanyeq139access-listacl_insidedenytcpanyanyeq445access-listacl_insidedenytcpanyanyeq593access-listacl_insidedenytcpanyanyeq4444access-listacl_insidedenytcpanyanyeq9995access-listacl_insidedenytcpanyanyeq9996access-listacl_insidepermitipanyanyaccess-listacl_insidepermiticmpanyanyaccess-listyinlianpermitiphostanyaccess-listyinlianpermitiphostanyaccess-listyinlianpermitiphostanypagerlines24loggingonloggingtimestamploggingstandbyloggingbufferedcriticallogging