H3C新华三 mstp+vrrp双机热备实用配置

一、JRSW1

<H3C>system-view
[H3C]sysname jrsw1


配置vlan

[jrsw1]vlan 10 20 //创建vlan
[jrsw1]interface range GigabitEthernet 1/0/47 toGigabitEthernet 1/0/48 //进入接口范围视图
[jrsw1-if-range]port link-type trunk //配置端口链路类型为trunk
[jrsw1-if-range]port trunk permit vlan 10 20 //配置trunk放行的vlan
[jrsw1-if-range]undo port trunk permit vlan 1 //取消trunk默认放行vlan1
[jrsw1-if-range]interface gigabitethernet 1/0/1
[jrsw1-GigabitEthernet1/0/1]port link-type access //配置端口链路类型为access
[jrsw1-GigabitEthernet1/0/1]port access vlan 10 //配置access默认vlan
[jrsw1-GigabitEthernet1/0/1]quit
[jrsw1-GigabitEthernet1/0/2]port link-type access
[jrsw1-GigabitEthernet1/0/2]port access vlan 20
[jrsw1-GigabitEthernet1/0/2]quit

配置多生成树

[jrsw1]stp mode mstp //配置生成树模式为多生成树
[jrsw1]stp region-configuration //进入生成树区域配置
[jrsw1-mst-region]region-name vrrp //配置区域名称
[jrsw1-mst-region]revision-level 1 //修订级别为1
[jrsw1-mst-region]instance 10 vlan 10 //配置实例10映射vlan10
[jrsw1-mst-region]instance 20 vlan 20 //配置实例20映射vlan20
[jrsw1-mst-region]active region-configuration //激活区域配置
[jrsw1-mst-region]quit
[jrsw1]stp global enable //开启全局生成树

二、JRSW2

<H3C>system-view
[H3C]sysname jrsw2
[jrsw2]vlan 10 20
[jrsw2]interface range gigabitethernet 1/0/47 togigabitethernet 1/0/48
[jrsw2-if-range]port link-type trunk
[jrsw2-if-range]port trunk permit vlan 10 20
[jrsw2-if-range]undo port trunk permit vlan 1
[jrsw2-if-range]interface gigabitethernet 1/0/1
[jrsw2-GigabitEthernet1/0/1]port link-type access
[jrsw2-GigabitEthernet1/0/1]port access vlan 20
[jrsw2-GigabitEthernet1/0/1]interface gigabitethernet1/0/2
[jrsw2-GigabitEthernet1/0/2]port link-type access
[jrsw2-GigabitEthernet1/0/2]port access vlan 10
[jrsw2-GigabitEthernet1/0/2]quit
[jrsw2]stp mode mstp
[jrsw2]stp region-configuration
[jrsw2-mst-region]region-name vrrp
[jrsw2-mst-region]revision-level 1
[jrsw2-mst-region]instance 10 vlan 10
[jrsw2-mst-region]instance 20 vlan 20
[jrsw2-mst-region]active region-configuration
[jrsw2-mst-region]quit
[jrsw2]stp global enable

三、HJSW1

创建VLAN划分接口

[hjsw1]vlan 10
[hjsw1-vlan10]vlan 20
[hjsw1-vlan20]vlan 100
[hjsw1-vlan100]quit
[hjsw1]interface range gigabitethernet 1/0/3 togigabitethernet 1/0/4
[hjsw1-if-range]port link-type trunk
[hjsw1-if-range]port trunk permit vlan 10 20
[hjsw1-if-range]undo port trunk permit vlan 1
[hjsw1-if-range]quit
[hjsw1]interface gigabitethernet 1/0/48
[hjsw1-GigabitEthernet1/0/48]port link-type access
[hjsw1-GigabitEthernet1/0/48]port access vlan 100
[hjsw1-GigabitEthernet1/0/48]quit

创建二层链路聚合接口1

[hjsw1]lacp system-priority 100 //配置交换机链路聚合控制协议的优先级为100；越小优先级越高，默认为32768。
[hjsw1]interface bridge-aggregation 1 //创建二层桥聚合接口
[hjsw1-Bridge-Aggregation1]link-aggregation modedynamic //链路聚合模式为动态
[hjsw1-Bridge-Aggregation1]link-aggregationselected-port maximum 2  //配置链路聚合最大限度

选择两个端口

[hjsw1-Bridge-Aggregation1]quit

接口加入聚合接口

[hjsw1]interface range GigabitEthernet 1/0/10 toGigabitEthernet 1/0/12
[hjsw1-if-range]port link-aggregation group 1 //端口加入链路聚合组
[hjsw1-if-range]quit
[hjsw1]interface range gigabitethernet 1/0/10 togigabitethernet 1/0/11
[hjsw1-if-range]link-aggregation port-priority 100 //配置链路聚合端口优先级为100
[hjsw1-if-range]quit

配置聚合口为Trunk口，并配置放行VLAN

[hjsw1]interface bridge-aggregation 1 //进入二层桥聚合接口
[hjsw1-Bridge-Aggregation1]port link-type trunk 
[hjsw1-Bridge-Aggregation1]port trunk permit vlan 1020
[hjsw1-Bridge-Aggregation1]undo port trunk permit vlan1
[hjsw1-Bridge-Aggregation1]quit

配置上行接口

[hjsw1]interface vlan-interface 100 //进入逻辑三层接口vlanif100
[hjsw1-Vlan-interface100]ip address 172.16.100.2 24 //配置接口地址

创建Track项1，监视上行接口的物理状态

[hjsw1]track 1 interface vlan-interface 100 //配置对上行vlanif100接口进行跟踪
[hjsw1-track-1]quit

创建vrrp组10，配置HJSW1在备份组1中的优先级为110

[hjsw1]interface vlan-interface 10
[hjsw1-Vlan-interface10]ip address 192.168.10.2 24
[hjsw1-Vlan-interface10]vrrp vrid 10 virtual-ip192.168.10.1 //接口加入vrrp并配置虚拟网关地址
[hjsw1-Vlan-interface10]vrrp vrid 10 priority 110 //配置vrrp的优先级（默认100）数值大为master

配置vrrp备份组1监视track项1的状态，当Track项上行down掉时，HJSW1在备份组中的优先级降低20；使得HJSW2的优先组高于1，成为新Master。
[hjsw1-Vlan-interface10]vrrp vrid 10 track 1 weightreduced 20 //配置当上行链路down掉时，将vrrp优先级降低20，即110-20=90，低于对端100，即对端成为master

[hjsw1-Vlan-interface10]quit

创建vrrp组20

[hjsw1]interface vlan-interface 20
[hjsw1-Vlan-interface20]ip address 192.168.20.2 24
[hjsw1-Vlan-interface20]vrrp vrid 20 virtual-ip 192.168.20.1
[hjsw1-Vlan-interface20]quit

配置MSTP

[hjsw1]stp mode mstp
[hjsw1]stp region-configuration
[hjsw1-mst-region]region-name vrrp
[hjsw1-mst-region]revision-level 1
[hjsw1-mst-region]instance 10 vlan 10
[hjsw1-mst-region]instance 20 vlan 20
[hjsw1-mst-region]active region-configuration
[hjsw1-mst-region]quit
[hjsw1]stp instance 10 root primary
[hjsw1]stp instance 20 root secondary
[hjsw1]stp global enable

在上行口关闭STP功能

[hjsw1]interface gigabitethernet 1/0/48
[hjsw1-GigabitEthernet1/0/48]undo stp enable
[hjsw1-GigabitEthernet1/0/48]quit

配置OSPF发布网段路由

[hjsw1]ospf
[hjsw1-ospf-1]area 0
[hjsw1-ospf-1-area-0.0.0.0]network 172.16.100.00.0.0.255
[hjsw1-ospf-1-area-0.0.0.0]network 192.168.10.00.0.0.255
[hjsw1-ospf-1-area-0.0.0.0]network 192.168.20.00.0.0.255
[hjsw1-ospf-1-area-0.0.0.0]network 101.101.101.1010.0.0.255
[hjsw1-ospf-1-area-0.0.0.0]quit
[hjsw1-ospf-1]quit  

配置默认路由

[hjsw1]ip route-static 0.0.0.0 0.0.0.0 172.16.100.1

配置DHCP中继

[hjsw1]dhcp enable //开启dhcp功能
[hjsw1]interface vlan-interface 10
[hjsw1-Vlan-interface10]dhcp select relay //接口选择dhcp中继
[hjsw1-Vlan-interface10]dhcp relay server-address172.16.100.1 //配置中继dhcp的服务地址
[hjsw1-Vlan-interface10]interface vlan-interface 20
[hjsw1-Vlan-interface20]dhcp select relay
[hjsw1-Vlan-interface20]dhcp relay server-address172.16.100.1
[hjsw1-Vlan-interface20]quit

配置环回口作为管理地址及配置管理功能

[hjsw1]telnet server enable //开启telnet远程
[hjsw1-LoopBack0]ip address 101.101.101.101 32
[hjsw1-LoopBack0]quit
[hjsw1]user-interface vty 0 4 //进入vty用户视图
[hjsw1-line-vty0-4]authentication-mode scheme //配置身份认证模式为计划（AAA）
[hjsw1-line-vty0-4]quit
[hjsw1]local-user zurkj //创建本地用户
[hjsw1-luser-manage-zurkj]password simple Aleadmin1234 //配置用户密码（简单）
[hjsw1-luser-manage-zurkj]authorization-attributeuser-role network-admin //配置授权属性 用户角色为网络管理员（level 15）

[hjsw1-luser-manage-zurkj]service-type telnet terminal //配置服务类型为telnet及终端（console）
[hjsw1-luser-manage-zurkj]quit
[hjsw1]user-interface console 0 //进入console
[hjsw1-line-console0]authentication-mode scheme
[hjsw1-line-console0]quit

配置登录设备头部信息

[hjsw1]header login "Welcome to ipgzj.com"
[hjsw1]header shell "Welcome to zurkj.com"

开启telnet远程服务

[hjsw1]telnet server enable

四、HJSW2

创建VLAN划分接口

<H3C>system-view
[H3C]sysname hjsw2
[hjsw2]vlan 10
[hjsw2-vlan10]vlan 20
[hjsw2-vlan20]vlan 101
[hjsw2-vlan101]quit
[hjsw2]interface range gigabitethernet 1/0/3 togigabitethernet 1/0/4
[hjsw2-if-range]port link-type trunk
[hjsw2-if-range]port trunk permit vlan 10 20
[hjsw2-if-range]undo port trunk permit vlan 1
[hjsw2-if-range]interface gigabitethernet 1/0/48
[hjsw2-GigabitEthernet1/0/48]port link-type trunk
[hjsw2-GigabitEthernet1/0/48]port trunk pvid vlan 101
[hjsw2-GigabitEthernet1/0/48]port trunk permit vlan101
[hjsw2-GigabitEthernet1/0/48]undo port trunk permitvlan 1
[hjsw2-GigabitEthernet1/0/48]undo stp enable
[hjsw2-GigabitEthernet1/0/48]quit

创建二层链路聚合接口1

[hjsw2]interface bridge-aggregation 1
[hjsw2-Bridge-Aggregation1]link-aggregation modedynamic
[hjsw2-Bridge-Aggregation1]link-aggregationselected-port maximum 2

接口加入聚合接口

[hjsw2-Bridge-Aggregation1]interface rangegigabitethernet 1/0/10 to gigabitethernet 1/0/12
[hjsw2-if-range]port link-aggregation group 1
[hjsw2-if-range]quit

配置聚合口为Trunk口，并配置放行VLAN

[hjsw2]interface Bridge-Aggregation 1
[hjsw2-Bridge-Aggregation1]port link-type trunk
[hjsw2-Bridge-Aggregation1]port trunk permit vlan 1020
[hjsw2-Bridge-Aggregation1]undo port trunk permit vlan1
[hjsw2-Bridge-Aggregation1]quit

配置上行接口

[hjsw2]interface vlan-interface 101
[hjsw2-Vlan-interface101]ip address 172.16.101.2 24
[hjsw2-Vlan-interface101]quit

创建Track项1，监视上行接口的物理状态

[hjsw2]track 1 interface vlan-interface 101
[hjsw2-track-1]quit

创建vrrp组10，配置HJSW2在备份组10中的优先级为默认100

[hjsw2]interface vlan-interface 10
[hjsw2-Vlan-interface10]ip address 192.168.10.3 24
[hjsw2-Vlan-interface10]vrrp vrid 10 virtual-ip192.168.10.1
[hjsw2-Vlan-interface10]quit

创建vrrp组20，配置HJSW2在备份组20中的优先级为110

[hjsw2]interface vlan-interface 20
[hjsw2-Vlan-interface20]ip address 192.168.20.3 24
[hjsw2-Vlan-interface20]vrrp vrid 20 virtual-ip192.168.20.1
[hjsw2-Vlan-interface20]vrrp vrid 20 priority 110

配置vrrp备份组20监视track项1的状态，当Track项上行down掉时，HJSW2在备份组中的优先级降低20；使得HJSW2的优先组高于HJSW1，成为新Master。

[hjsw2-Vlan-interface20]vrrp vrid 20 track 1 weightreduced 20
[hjsw2-Vlan-interface20]quit

配置MSTP

[hjsw2]stp mode mstp
[hjsw2]stp region-configuration
[hjsw2-mst-region]region-name vrrp
[hjsw2-mst-region]revision-level 1
[hjsw2-mst-region]instance 10 vlan 10
[hjsw2-mst-region]instance 20 vlan 20
[hjsw2-mst-region]active region-configuration
[hjsw2]stp instance 10 root secondary
[hjsw2]stp instance 20 root primary
[hjsw2]stp global enable

在上行口关闭STP功能

[hjsw2]interface GigabitEthernet 1/0/48
[hjsw2-GigabitEthernet1/0/48]undo stp enable
[hjsw2-GigabitEthernet1/0/48]quit

配置OSPF发布网段路由

[hjsw2]ospf 1
[hjsw2-ospf-1]area 0
[hjsw2-ospf-1-area-0.0.0.0]network 192.168.10.00.0.0.255
[hjsw2-ospf-1-area-0.0.0.0]network 192.168.20.00.0.0.255
[hjsw2-ospf-1-area-0.0.0.0]network 172.16.101.00.0.0.255
[hjsw2-ospf-1-area-0.0.0.0]network 102.102.102.1020.0.0.0
[hjsw2-ospf-1-area-0.0.0.0]quit
[hjsw2-ospf-1]quit

配置默认路由

[hjsw2]ip route-static 0.0.0.0 0.0.0.0 172.16.101.1

配置DHCP中继

[hjsw2]dhcp enable
[hjsw2]interface vlan-interface 10
[hjsw2-Vlan-interface10]dhcp select relay
[hjsw2-Vlan-interface10]dhcp relay server-address 172.16.101.1
[hjsw2-Vlan-interface10]interface vlan-interface 20
[hjsw2-Vlan-interface20]dhcp select relay
[hjsw2-Vlan-interface20]dhcp relay server-address172.16.101.1
[hjsw2-Vlan-interface20]quit

配置环回口作为管理地址及配置管理功能

[hjsw2]interface loopback 0
[hjsw2-LoopBack0]ip address 102.102.102.102 32
[hjsw2-LoopBack0]quit
[hjsw2]user-interface vty 0 4
[hjsw2-line-vty0-4]authentication-mode scheme
[hjsw2-line-vty0-4]quit
[hjsw2]user-interface console 0
[hjsw2-line-console0]authentication-mode scheme
[hjsw2-line-console0]quit
[hjsw2]local-user zurkj
[hjsw2-luser-manage-zurkj]password simple Admin1234
[hjsw2-luser-manage-zurkj]service-type telnet terminal
[hjsw2-luser-manage-zurkj]authorization-attributeuser-role network-admin
[hjsw2-luser-manage-zurkj]quit

配置登录设备头部信息

[hjsw2]header login "Welcome to ipgzj.com"
[hjsw2]header shell "Welcome to zurkj.com"

开启telnet远程服务

[hjsw2]telnet server enable

五、R1

基本配置

<H3C>system-view
[H3C]sysname r1
[r1]interface gigabitethernet 0/0
[r1-GigabitEthernet0/0]ip address 172.16.100.1 24
[r1-GigabitEthernet0/0]interface gigabitethernet 0/1
[r1-GigabitEthernet0/1]ip address 172.16.101.1 24
[r1-GigabitEthernet0/1]quit
[r1]interface gigabitethernet 0/2
[r1-GigabitEthernet0/2]ip address 200.1.1.2 24
[r1-GigabitEthernet0/2]quit
[r1]interface LoopBack 0
[r1-LoopBack0]ip address 100.100.100.100 32
[r1-LoopBack0]quit

配置DHCP服务

[r1]dhcp enable
[r1]dhcp server ip-pool vlan10
[r1-dhcp-pool-vlan10]network 192.168.10.0 mask255.255.255.0
[r1-dhcp-pool-vlan10]dns-list 114.114.114.114 8.8.8.8
[r1-dhcp-pool-vlan10]expired day 2 hour 2 minute 2second 2
[r1-dhcp-pool-vlan10]forbidden-ip-range 192.168.10.200192.168.10.254
[r1-dhcp-pool-vlan10]quit
[r1]dhcp server ip-pool vlan20
[r1-dhcp-pool-vlan20]gateway-list 192.168.20.1
[r1-dhcp-pool-vlan20]network 192.168.20.0 mask255.255.255.0
[r1-dhcp-pool-vlan20]dns-list 114.114.114.114 8.8.8.8
[r1-dhcp-pool-vlan20]expired day 2 hour 2 minute 2second 2
[r1-dhcp-pool-vlan20]forbidden-ip-range 192.168.20.200192.168.20.254
[r1-dhcp-pool-vlan20]quit

接口应用DHCP

[r1]interface GigabitEthernet 0/0
[r1-GigabitEthernet0/0]dhcp select server
[r1-GigabitEthernet0/0]interface gigabitethernet 0/1
[r1-GigabitEthernet0/1]dhcp select server
[r1-GigabitEthernet0/1]quit

配置OSPF

[r1]ospf 1
[r1-ospf-1]area 0
[r1-ospf-1-area-0.0.0.0]network 172.16.100.0 0.0.0.255
[r1-ospf-1-area-0.0.0.0]network 172.16.200.0 0.0.0.255
[r1-ospf-1-area-0.0.0.0]network 100.100.100.100 0.0.0.0
[r1-ospf-1-area-0.0.0.0]quit
[r1-ospf-1]quit

配置默认路由

[r1]ip route-static 0.0.0.0 0.0.0.0 200.1.1.2
[r1]nat address-group 1
[r1-address-group-1]address 200.1.1.10 200.1.1.20
[r1-address-group-1]quit

配置NAT转换

[r1]acl number 2000
[r1-acl-ipv4-basic-2000]step 20
[r1-acl-ipv4-basic-2000]rule 20  permit source any
[r1]interface gigabitethernet 0/2
[r1-GigabitEthernet0/2]nat outbound address-group 1
[r1-GigabitEthernet0/2]quit

配置设备管理用户

[r1]user-interface vty 0 4
[r1-line-vty0-4]authentication-mode scheme
[r1-line-vty0-4]quit
[r1]user-interface console 0
[r1-line-console0]authentication-mode scheme
[r1-line-console0]quit
[r1]local-user zurkj
[r1-luser-manage-zurkj]password simple Admin1234
[r1-luser-manage-zurkj]service-type telnet terminal
[r1-luser-manage-zurkj]authorization-attributeuser-role network-admin
[r1-luser-manage-zurkj]quit

打开远程服务

[r1]telnet server enable

六、Network

<H3C>system-view
[H3C]sysname network
[network]interface gigabitethernet 0/0
[network-GigabitEthernet0/0]ip address 200.1.1.1 24
[network-GigabitEthernet0/0]interface loopback 0
[network-LoopBack0]ip address 200.200.200.200 32
[network-LoopBack0]quit