华为设备中小型园区和分支出口综合配置

（一）总部基本配置
1.配置LSW2
[LSW2]vlan batch 10
[LSW2-Ethernet0/0/3]port link-type access
[LSW2-Ethernet0/0/3]port default vlan 10
[LSW2-Ethernet0/0/3]stp edged-port enable
[LSW2-Ethernet0/0/4]port link-type access
[LSW2-Ethernet0/0/4]port default vlan 10
[LSW2-Ethernet0/0/4]stp edged-port enable
[LSW2]int Eth-Trunk 1
[LSW2-Eth-Trunk1]port link-type trunk
[LSW2-Eth-Trunk1]port trunk allow-pass vlan 10
[LSW2-Eth-Trunk1]mode lacp
[LSW2-Ethernet0/0/1]eth-trunk 1
[LSW2-Ethernet0/0/2]eth-trunk 1
[LSW2]stp bpdu-protection
2.配置LSW3
[LSW3]vlan batch 20
[LSW3-Ethernet0/0/3]port link-type access
[LSW3-Ethernet0/0/3]port default vlan 20
[LSW3-Ethernet0/0/3]stp edged-port enable
[LSW3-Ethernet0/0/4]port link-type access
[LSW3-Ethernet0/0/4]port default vlan 20
[LSW3-Ethernet0/0/4]stp edged-port enable
[LSW3]int Eth-Trunk 2
[LSW3-Eth-Trunk2]port link-type trunk
[LSW3-Eth-Trunk2]port trunk allow-pass vlan 20
[LSW3-Eth-Trunk2]mode lacp
[LSW3-Ethernet0/0/1]eth-trunk 2
[LSW3-Ethernet0/0/2]eth-trunk 2
[LSW3]stp bpdu-protection //增强网络稳定性
3.配置LSW1
（1）配置下行接口的所属VLAN及IP地址
[LSW1]vlan batch 10 20 30
[LSW1]int Eth-Trunk 3
[LSW1-Eth-Trunk3]port link-type trunk
[LSW1-Eth-Trunk3]port trunk allow-pass vlan 10
[LSW1-Eth-Trunk3]mode lacp
[LSW1-GigabitEthernet0/0/3]eth-trunk 3
[LSW1-GigabitEthernet0/0/5]eth-trunk 3
[LSW1]int Eth-Trunk 4
[LSW1-Eth-Trunk4]port link-type trunk
[LSW1-Eth-Trunk4]port trunk allow-pass vlan 20
[LSW1-Eth-Trunk4]mode lacp
[LSW1-GigabitEthernet0/0/4]eth-trunk 4
[LSW1-GigabitEthernet0/0/7]port link-type access
[LSW1-GigabitEthernet0/0/7]port default vlan 30
[LSW1-Vlanif10]ip add 10.1.10.3 24
[LSW1-GigabitEthernet0/0/6]eth-trunk 4
[LSW1-Vlanif20]ip add 10.1.20.3 24
[LSW1-Vlanif30]ip add 10.1.30.3 24
（2）配置上行接口
[LSW1]vlan batch 100
[LSW1-GigabitEthernet0/0/1]port link-type access
[LSW1-GigabitEthernet0/0/1]port default vlan 100
[LSW1-GigabitEthernet0/0/2]port link-type access
[LSW1-GigabitEthernet0/0/2]port default vlan 100
[LSW1-Vlanif100]ip add 10.1.100.3 24
4.配置AR1
[AR1-GigabitEthernet0/0/1]ip add 10.1.100.1 24
[AR1-GigabitEthernet0/0/0]ip add 20.1.1.1 24
5.配置AR2
[AR2-GigabitEthernet0/0/1]ip add 10.1.100.2 24
[AR2-GigabitEthernet0/0/0]ip add 20.1.2.1 24
6.配置VRRP，AR1为主，AR2为备
（1）配置AR1
[AR1-GigabitEthernet0/0/1]vrrp vrid 1 virtual-ip 10.1.100.1
[AR1-GigabitEthernet0/0/1]vrrp vrid 1 priority 120
[AR1-GigabitEthernet0/0/1]vrrp vrid 1 track interface GigabitEthernet 0/0/0 redu
ced 40
（2）配置AR2
[AR2-GigabitEthernet0/0/1]vrrp vrid 1 virtual-ip 10.1.100.1
（3）检查

7.配置路由
（1）配置缺省路由
[LSW1]ip route-static 0.0.0.0 0.0.0.0 10.1.100.1
[AR1]ip route-static 0.0.0.0 0.0.0.0 20.1.1.4
[AR2]ip route-static 0.0.0.0 0.0.0.0 20.1.2.4
（2）配置OSPF：AR1和AR2学习用户网段的回程路由
[AR1]ospf 1
[AR1-ospf-1]area 0
[AR1-ospf-1-area-0.0.0.0]network 10.1.100.0 0.0.0.255
[AR2]ospf 1
[AR2-ospf-1]area 0
[AR2-ospf-1-area-0.0.0.0]network 10.1.100.0 0.0.0.255
[LSW1]ospf 1
[LSW1-ospf-1]area 0
[LSW1-ospf-1-area-0.0.0.0]network 10.1.10.0 0.0.0.255
[LSW1-ospf-1-area-0.0.0.0]network 10.1.20.0 0.0.0.255
[LSW1-ospf-1-area-0.0.0.0]network 10.1.30.0 0.0.0.255
[LSW1-ospf-1-area-0.0.0.0]network 10.1.100.0 0.0.0.255

（3）配置外网到内网服务器公网地址的静态路由：AR1优先
[AR4]ip route-static 10.1.30.0 255.255.255.0 20.1.1.1 preference 40
[AR4]ip route-static 10.1.30.0 255.255.255.0 20.1.2.1
（4）当总部出口路由器AR1的上行链路中断的时候会触发两个动作：两台总部出口路由器VRRP主备切换，这个通过VRRP状态联动总部出口路由器上行口状态来实现；和总部出口对接的运营商路由器AR4到达内网服务器的路由进行主备切换，这个通过AR4配置主备路由实现。这两个动作保证了当出口路由器AR1的上行链路中断的时候内网VRRP状态和公网回程主备路由同时切换，保证了来回路径双向可靠性。
8. 部署NAT Outbound
（1）定义需要进行NAT转换的数据流：如果接口上同时配置了IPSec和NAT，则先执行NAT，所以为了避免把IPSec保护的数据流进行NAT转换，需要NAT引用的ACL规则deny掉需要IPSec保护的数据流，即对“IPSec感兴趣的数据流”做NAT豁免
[AR1]acl 3000
[AR1-acl-adv-3000]rule deny ip source 10.1.10.0 0.0.0.255 destination 10.2.1.0 0.0.0.255
[AR1-acl-adv-3000]rule deny ip source 10.1.20.0 0.0.0.255 destination 10.2.1.0 0.0.0.255
[AR1-acl-adv-3000]rule permit ip source 10.1.10.0 0.0.0.255
[AR2]acl 3000
[AR2-acl-adv-3000]rule deny ip source 10.1.10.0 0.0.0.255 destination 10.2.1.0 0.0.0.255
[AR2-acl-adv-3000]rule deny ip source 10.1.20.0 0.0.0.255 destination 10.2.1.0 0.0.0.255
[AR2-acl-adv-3000]rule permit ip source 10.1.10.0 0.0.0.255
（2）在上行口上配置NAT转换
[AR1-GigabitEthernet0/0/0]nat outbound 3000
[AR2-GigabitEthernet0/0/0]nat outbound 3000
（3）检查配置结果

9.部署NAT Server
[AR1-GigabitEthernet0/0/0]nat server protocol tcp global 20.1.1.100 www inside 10.1.30.1 8080
[AR2-GigabitEthernet0/0/0]nat server protocol tcp global 20.1.1.100 www inside 10.1.30.1 8080

（二）分支基本配置
[AR3-GigabitEthernet0/0/1]ip add 10.2.1.2 24
[AR3-GigabitEthernet0/0/0]ip add 20.1.3.2 24
[AR3]ip route-static 0.0.0.0 0.0.0.0 20.1.3.5
[AR3]acl 3000
[AR3-acl-adv-3000]rule deny ip source 10.2.1.0 0.0.0.255 destination 10.1.10.0 0.0.0.255
[AR3-acl-adv-3000]rule deny ip source 10.2.1.0 0.0.0.255 destination 10.1.20.0 0.0.0.255
[AR3-acl-adv-3000]rule permit ip source 10.2.1.0 0.0.0.255
[AR3-GigabitEthernet0/0/0]nat outbound 3000

（三）配置AR4和AR5
1.配置AR4
[AR4-GigabitEthernet0/0/0]ip add 20.1.10.4 24
[AR4-GigabitEthernet0/0/1]ip add 20.1.1.4 24
[AR4-GigabitEthernet0/0/2]ip add 20.1.2.4 24
2.配置AR5
[AR5-GigabitEthernet0/0/1]ip add 20.1.3.5 24
[AR5-GigabitEthernet0/0/0]ip add 20.1.10.5 24
3.配置路由
[AR4]ip route-static 0.0.0.0 0.0.0.0 20.1.10.5
[AR5]ip route-static 0.0.0.0 0.0.0.0 20.1.10.4
（四）部署IPSec VPN，实现总部和分支之间通过Internet实现私网互通，并且数据通信具有安全保护
1.配置ACL，定义需要IPSec保护的数据流
（1）配置AR1
[AR1]acl 3001
[AR1-acl-adv-3001]rule permit ip source 10.1.10.0 0.0.0.255 destination 10.2.1.0 0.0.0.255
[AR1-acl-adv-3001]rule permit ip source 10.1.20.0 0.0.0.255 destination 10.2.1.0 0.0.0.255
（2）配置AR2
[AR2]acl 3001
[AR2-acl-adv-3001]rule permit ip source 10.1.10.0 0.0.0.255 destination 10.2.1.0 0.0.0.255
[AR2-acl-adv-3001]rule permit ip source 10.1.20.0 0.0.0.255 destination 10.2.1.0 0.0.0.255
（3）配置AR3
[AR3]acl 3001
[AR3-acl-adv-3001]rule permit ip source 10.2.1.0 0.0.0.255 destination 10.1.10.0 0.0.0.255
[AR3-acl-adv-3001]rule permit ip source 10.2.1.0 0.0.0.255 destination 10.1.20.0 0.0.0.255
2.配置IPSec安全提议
（1）配置AR1
[AR1]ipsec proposal a1
[AR1-ipsec-proposal-a1]esp authentication-algorithm sha2-256 设置ESP协议采用的认证算法
[AR1-ipsec-proposal-a1]esp encryption-algorithm aes-128 //设置ESP协议采用的加密算法
（2）配置AR2
[AR2]ipsec proposal a1
[AR2-ipsec-proposal-a1]esp authentication-algorithm sha2-256
[AR2-ipsec-proposal-a1]esp encryption-algorithm aes-128
（3）配置AR3
[AR3]ipsec proposal a1
[AR3-ipsec-proposal-a1]esp authentication-algorithm sha2-256
[AR3-ipsec-proposal-a1]esp encryption-algorithm aes-128
3.配置IKE安全提议
（1）配置AR1
[AR1]ike proposal 5
[AR1-ike-proposal-5]encryption-algorithm aes-cbc-128
（2）配置AR2
[AR2]ike proposal 5
[AR2-ike-proposal-5]encryption-algorithm aes-cbc-128
（3）配置AR3
[AR3]ike proposal 5
[AR3-ike-proposal-5]encryption-algorithm aes-cbc-128
4.配置IKE对等体
（1）配置AR1
[AR1]ike peer vpn v1
[AR1-ike-peer-vpn]pre-shared-key cipher abc123
[AR1-ike-peer-vpn]ike-proposal 5
[AR1-ike-peer-vpn]dpd type periodic //配置周期性对等体存活检测
[AR1-ike-peer-vpn]dpd idle-time 10 //设置对等体存活检测空闲时间为10秒
[AR1-ike-peer-vpn]remote-address 20.1.3.2
（2）配置AR2
[AR2]ike peer vpn v1
[AR2-ike-peer-vpn]pre-shared-key cipher abc123
[AR2-ike-peer-vpn]ike-proposal 5
[AR2-ike-peer-vpn]dpd type periodic
[AR2-ike-peer-vpn]dpd idle-time 10
[AR2-ike-peer-vpn]remote-address 20.1.3.2
（3）配置AR3
[AR3]ike peer vpn v1
[AR3-ike-peer-vpn]pre-shared-key cipher abc123
[AR3-ike-peer-vpn]ike-proposal 5
[AR3-ike-peer-vpn]dpd type periodic
[AR3-ike-peer-vpn]dpd idle-time 10
[AR3-ike-peer-vpn]remote-address 20.1.1.1
[AR3]ike peer vpn2 v1
[AR3-ike-peer-vpn2]pre-shared-key cipher abc123
[AR3-ike-peer-vpn2]ike-proposal 5
[AR3-ike-peer-vpn2]dpd type periodic
[AR3-ike-peer-vpn2]dpd idle-time 10
[AR3-ike-peer-vpn2]remote-address 20.1.2.2
5.配置安全策略
（1）配置AR1
[AR1]ipsec policy ipsec_vpn 10 isakmp
[AR1-ipsec-policy-isakmp-ipsec_vpn-10]security acl 3001
[AR1-ipsec-policy-isakmp-ipsec_vpn-10]ike-peer vpn
[AR1-ipsec-policy-isakmp-ipsec_vpn-10]proposal a1
（2）配置AR2
[AR2]ipsec policy ipsec_vpn 10 isakmp
[AR2-ipsec-policy-isakmp-ipsec_vpn-10]security acl 3001
[AR2-ipsec-policy-isakmp-ipsec_vpn-10]ike-peer vpn
[AR2-ipsec-policy-isakmp-ipsec_vpn-10]proposal a1
（3）配置AR3
[AR3]ipsec policy ipsec_vpn 10 isakmp
[AR3-ipsec-policy-isakmp-ipsec_vpn-10]security acl 3001
[AR3-ipsec-policy-isakmp-ipsec_vpn-10]ike-peer vpn
[AR3-ipsec-policy-isakmp-ipsec_vpn-10]proposal a1
[AR3]ipsec policy ipsec_vpn 20 isakmp
[AR3-ipsec-policy-isakmp-ipsec_vpn-20]security acl 3001
[AR3-ipsec-policy-isakmp-ipsec_vpn-20]ike-peer vpn2
[AR3-ipsec-policy-isakmp-ipsec_vpn-20]proposal a1
6.接口上引用安全策略组
[AR1-GigabitEthernet0/0/0]ipsec policy ipsec_vpn
[AR2-GigabitEthernet0/0/0]ipsec policy ipsec_vpn
[AR3-GigabitEthernet0/0/0]ipsec policy ipsec_vpn
7. 检查配置结果

（五）检查配置结果
1.配置总部与分支PC的IP地址

2.测试总部与分支之间的联通性

3.验证总部各部门与公网之间的联通性