华为路由器配置实例

#
sysname GZ //路由器名字GZ
ftpserver enable //ftp 服务开通以便拷贝出配置文件备份
#
voice
#
http server port 1025   //http
undo http server enable
#
drop illegal-mac alarm
#
l2tp aging 0
#
vlan batch 10 20 30 40 50 //本路由器设置的VLAN ID       
#
igmp global limit 256
#
multicast routing-enable //开启组播
#
dhcp enable //全局下开启DHCP服务然后在各VLAN上开启单独的DHCP
#
ipvpn-instance 1
ipv4-family
#
acl number 2000
rule 10 permit
#
acl number 2001 //以太网访问规则列表。
rule6 permit source 172.23.68.0 0.0.0.255 //允许此网段访问外网
rule7 permit source 172.23.69.0 0.0.0.255  //允许此网段访问外网
rule 8 permit source 172.23.65.0 0.0.0.3  //允许此网段的前三个IP访问外网
rule9 deny   //不允许其他网段访问外网




#
acl number 3000 //此规则并未应用
rule 40 permit ip source 172.23.65.00.0.0.255 destination 172.23.69.0 0.0.0.25
5
#
acl number 3001//定义两个网段主机互不访问，学生不能访问65网段。
rule 5 deny ip source 172.23.65.0 0.0.0.255destination 172.23.68.0 0.0.0.255
rule 10 deny ip source 172.23.68.00.0.0.255 destination 172.23.65.0 0.0.0.255
#
aaa //默认视图窗口定义本地登录帐号和密码
authentication-scheme default
authorization-scheme default
accounting-scheme default
domain default
domaindefault_admin
local-user admin password cipher ]MQ;4\]B+4Z,YWX*NZ55OA!!
local-user admin service-type telnet webhttp
local-userdfwd password cipher'VE5U!@7QCO;V2HX\']\,1!!
local-userdfwd privilege level 15
local-userdfwd service-type telnet terminalweb http
local-userhuawei password cipherRY,UPVHCMV+Q=^Q`MAF4<1!! //新建用户dfwd密码
local-user huawei ftp-directory flash: //该用户名默认配置指向的ftp路径
local-user huawei service-type ftp  // 该用户采用FTP访问
#
firewall zone trust //定义信任区域
priority 15 //定义信任区域下的策略
#
firewall zone untrust //定义不信任区域
priority 1 //定义不信任区域下的策略
#
firewall interzone trust untrust //配置安全域间
firewall enable//该安全域间启用防火墙
packet-filter 3001 inbound //入口执行3001规则
packet-filter 3001 outbound //出口执行3001规则
packet-filter default deny outbound
#
interface Vlanif10
ip address 172.23.65.100 255.255.255.0 //定义vlan的网关地址和子网掩码
pimdm //组播协议需开启的功能
igmp enable //组播协议需开启的功能
zonetrust //定义VLAN是信任区域
#
interface Vlanif20 
ip address 172.23.1.1 255.255.255.240  //定义vlan的网关地址和子网掩码
pimdm    //组播协议需开启的功能
igmp enable//组播协议需开启的功能
zonetrust//定义VLAN是信任区域
#
interface Vlanif30
ip address 10.10.10.1 255.255.255.252  //定义vlan的网关地址和子网掩码
pimdm  //组播协议需开启的功能
igmp enable //组播协议需开启的功能
zonetrust  //定义VLAN是信任区域
# 
interface Vlanif40
ip address 172.23.68.100 255.255.255.0 //定义vlan的网关地址和子网掩码
pimdm //组播协议需开启的功能
igmp enable //组播协议需开启的功能
dhcp select interface //自动分配该VLAN网关所在的地址段IP
dhcp server excluded-ip-address172.23.68.201 172.23.69.254 //定义该段IP不自动分配
dhcp server dns-list 61.139.2.69  //定义该VLAN所在IP地址段的DNS地址
zoneuntrust //定义该VLAN为不信任区域
#
interface Vlanif50
ip address 172.23.69.100 255.255.255.0  //定义vlan的网关地址和子网掩码
pimdm //组播协议需开启的功能
igmp enable //组播协议需开启的功能
dhcp select interface //开启本VLAN的DHCP功能并选择端口为定义的网关地址
dhcp server excluded-ip-address172.23.69.201 172.23.69.252 //定义手动获取的IP地址段
dhcp server dns-list 61.139.2.69  //定义该VLAN段IP的DNS
#
interface Ethernet0/0/0 //物理端端口0
portlink-type access //定义该端口类型
portdefault vlan 10 //定义端口所在VLAN
#
interface Ethernet0/0/1  //物理端端口1
portlink-type access  //定义该端口类型
portdefault vlan 30 //定义端口所在VLAN
#
interface Ethernet0/0/2 //物理端端口2
portlink-type access // 定义该端口类型
portdefault vlan 20 //定义端口所在VLAN
qosgtscir 6000 cbs 600000 //定义该端口数据缓存带宽范围
#
interface Ethernet0/0/3 //物理端端口3
port link-type access
port default vlan 30
#
interface Ethernet0/0/4 //物理端端口4
portlink-type access  //定义该端口类型
portdefault vlan 40 //定义端口所在VLAN
#
interface Ethernet0/0/5 //物理端端口5
portlink-type access //定义该端口类型
portdefault vlan 50 //定义端口所在VLAN
#
interface Ethernet0/0/6 //物理端端口6
portlink-type access //定义该端口类型
#
interface Ethernet0/0/7 //物理端端口6
portlink-type access //定义该端口类型
portdefault vlan 10 //定义端口所在VLAN
#
interface GigabitEthernet0/0/0  //三层口不在任何一个VLAN中，有映射功能。
ip address 125.69.71.128 255.255.255.0  //定义该端口的网关地址和子网掩码
nat server protocol tcp globalcurrent-interface 10001 inside 172.23.68.222 10001 //允许内网IP端口映射到外网
nat server protocol tcp globalcurrent-interface 10002 inside 172.23.68.222 10002
nat server protocol tcp globalcurrent-interface 10003 inside 172.23.68.222 10003
nat server protocol tcp globalcurrent-interface 10004 inside 172.23.68.222 10004
nat server protocol tcp globalcurrent-interface 10005 inside 172.23.68.222 10005
nat server protocol tcp globalcurrent-interface 10006 inside 172.23.68.222 10006
nat server protocol tcp globalcurrent-interface 10007 inside 172.23.68.222 10007
nat server protocol tcp globalcurrent-interface 10008 inside 172.23.68.222 10008
nat server protocol tcp globalcurrent-interface 10009 inside 172.23.68.222 10009
nat server protocol tcp globalcurrent-interface 10010 inside 172.23.68.222 10010
nat server protocol udp globalcurrent-interface 11001 inside 172.23.68.222 11001
nat server protocol udp globalcurrent-interface 11002 inside 172.23.68.222 11002
nat server protocol udp globalcurrent-interface 11003 inside 172.23.68.222 11003
nat server protocol udp globalcurrent-interface 11004 inside 172.23.68.222 11004
nat server protocol udp globalcurrent-interface 11005 inside 172.23.68.222 11005
nat server protocol udp globalcurrent-interface 11006 inside 172.23.68.222 11006
nat server protocol udp globalcurrent-interface 11007 inside 172.23.68.222 11007
nat server protocol udp globalcurrent-interface 11008 inside 172.23.68.222 11008
nat server protocol udp globalcurrent-interface 11009 inside 172.23.68.222 11009
nat server protocol udp global current-interface11010 inside 172.23.68.222 11010
nat outbound 2001 //在该端口上执行编号为2001的访问规则
#
interface GigabitEthernet0/0/1   //三层口不在任何一个VLAN中，有映射功能。
ip address 10.10.10.6 255.255.255.252 //定义该端口的网关地址和子网掩码
pimdm   //组播协议需开启的功能
igmp enable //组播协议需开启的功能
undonegotiation auto //关闭端口自动协商功能
zonetrust   //定义该端口是信任区域
#
interface Cellular0/0/0
link-protocolppp
#
interface Cellular0/0/1
link-protocolppp
#
interface NULL0
#
igmp
#
pim
c-bsr GigabitEthernet0/0/0
c-rp GigabitEthernet0/0/0 group-policy 2000
c-rp GigabitEthernet0/0/1 group-policy 2000
#
ip route-static 0.0.0.0 0.0.0.0125.71.213.1  //新增静态路由列表，访问外网
ip route-static 10.1.187.0 255.255.255.010.10.10.2
ip route-static 10.102.0.0 255.255.0.0172.23.1.2
ip route-static 10.110.0.0 255.255.0.0172.23.1.2
ip route-static 172.23.66.0 255.255.255.010.10.10.2
ip route-static 172.23.67.0 255.255.255.010.10.10.5
ip route-static 192.168.14.0 255.255.255.0172.23.1.2
ip route-static 192.168.18.0 255.255.255.0172.23.1.2
ip route-static 192.168.20.0 255.255.255.0172.23.1.2
#
super password level 3 cipherEO2\:%&(X.$'CLYaDZ]EJ1!!
user-interface con 0
user-interfacevty 0 4
authentication-modeaaa
user-interfacevty 16 20
#
port-group 1
group-member Ethernet0/0/0
group-member Ethernet0/0/1
group-member Ethernet0/0/2
group-member Ethernet0/0/3
group-member Ethernet0/0/4
group-member Ethernet0/0/5
group-member Ethernet0/0/6
group-member Ethernet0/0/7
#
port-group eth0/0/2
#
Return