更换公司核心路由器案例配置---1.console初始配置-2.用户配置-3.telnet登录配置-4.NAT端口映射配置-5.内网服务器配置-6.链路聚合配置-7.DHCP和DNS配置

一、场景

        因公司核心路由器老旧，运行不稳定，对旧路由器进行更换，要在路由器上实现以下功能。（现实案例中，给公司新换的是华为AR6140-S路由器）

        1.模拟新机console初始配置；
        2.用户配置；
        3.模拟通过telnet登录配置；
        4.接口IP地址配置；
        5.静态路由配置；
        6.NAT端口映射内网访问互联网配置；
        7.内网服务器配置；
        8.链路聚合配置；
        9.DHCP和DNS配置。 

 二、拓扑图

三、实现console连接

        用CLT线连接PC和R路由器。

        点击“连接”按钮，命令行显示<Huawei>，说明连接成功。

        通过console连接开始配置命令。

四、实现telnet连接

        具体操作请看：http://t.csdn.cn/3JwG2

五、代码段

clock timezone BJ add 08:00:00 
system-view
sysname R
user-interface console 0
#authentication-mode password
set authentication password cipher 112233
quit

aaa
local-user test-r password cipher 112233
local-user test-r privilege level 15
local-user test-r service-type telnet http ssh
quit

user-interface vty 0 4
authentication-mode aaa
quit

ip route-static 0.0.0.0 0 10.10.10.254
nat alg ftp enable 
acl 2000
rule 5 permit source 192.168.1.0 0.0.0.255
rule 6 permit source 192.168.2.0 0.0.0.255
rule 7 permit source 192.168.3.0 0.0.0.255
quit
interface GigabitEthernet 4/0/2
ip address 10.10.10.1 24
nat outbound 2000
nat server protocol tcp global current-interface 8886 inside 192.168.1.252 80
nat server protocol tcp global current-interface 2166 inside 192.168.1.252 21
quit

interface Eth-Trunk 1
undo portswitch
mode lacp-static
trunkport GigabitEthernet 4/0/0 0/0/1
ip address 192.168.1.254 24
dhcp enable
ip pool dmzpool
network 192.168.1.0 mask 24
gateway-list 192.168.1.254
lease day 1 hour 12 minute 30
excluded-ip-address 192.168.1.201 192.168.1.253
dns-list 61.128.114.166 61.128.114.133
quit
interface Eth-Trunk 1
dhcp select global
quit

interface GigabitEthernet 0/0/2
ip address 192.168.2.254 24
dhcp enable
ip pool workpool
network 192.168.2.0 mask 24
gateway-list 192.168.2.254
lease day 1 hour 12 minute 30
dns-list 61.128.114.166 61.128.114.133
quit
interface GigabitEthernet 0/0/2
dhcp select global
quit

interface GigabitEthernet 0/0/0
ip address 192.168.3.254 24
dhcp enable
ip pool publicpool
network 192.168.3.0 mask 24
gateway-list 192.168.3.254
lease day 1 hour 12 minute 30
dns-list 61.128.114.166 61.128.114.133
quit
interface GigabitEthernet 0/0/0
dhcp select global
quit

interface GigabitEthernet 4/0/3
ip address 192.168.6.254 24
quit



system-view
sysname SW1
lacp priority 100
interface Eth-Trunk 1
mode lacp-static
port link-type access 
port default vlan 1
trunkport GigabitEthernet 0/0/4 0/0/1


system-view 
sysname ISP
interface GigabitEthernet 0/0/0
ip address 10.10.10.254 24
interface GigabitEthernet 0/0/1
ip address 1.1.1.254 24

六、代码解释

<Huawei>clock timezone BJ add 08:00:00   //配置系统时区
<Huawei>system-view  //进入系统试图
[Huawei]sysname R  //配置设备名称

-----------------------------------------------------------------------------------------
#配置用户以Console口登录设备时要通过密码验证
[R]user-interface console 0
[R-ui-console0]authentication-mode password  //配置Console口登录的用户验证方式为密码验证
[R-ui-console0]set authentication password cipher 112233  //配置Console口登录密码为112233
[R-ui-console0]quit

-----------------------------------------------------------------------------------------
#创建本地aaa用户
[R]aaa
[R-aaa]local-user test-r password cipher 112233  //创建本地用户，用户名为test-r，密文密码为112233
[R-aaa]local-user test-r privilege level 15  //配置本地用户test-r的优先级为15，数值越高，权限越大
[R-aaa]local-user test-r service-type telnet http ssh  //配置本地用户test-r的接入方式为Telnet、http和ssh
[R-aaa]quit

-----------------------------------------------------------------------------------------
#VTY用户接口配置
[R]user-interface vty 0 4  //进入VTY0～VTY4用户界面视图
[R-ui-vty0-4]authentication-mode aaa  //配置VTY类型用户界面的验证方式为AAA
[R-ui-vty0-4]quit

-----------------------------------------------------------------------------------------
[R]ip route-static 0.0.0.0 0 10.10.10.254  //默认路由配置

-----------------------------------------------------------------------------------------
#NAT转换和访问控制列表相关配置
[R]nat alg ftp enable  //开启FTP协议NAT ALG功能
[R]acl 2000  //创建访问控制列表2000
[R-acl-basic-2000]rule 5 permit source 192.168.1.0 0.0.0.255 //允许192.168.1.0/24网段流量通行
[R-acl-basic-2000]rule 6 permit source 192.168.2.0 0.0.0.255 //允许192.168.2.0/24网段流量通行
[R-acl-basic-2000]rule 7 permit source 192.168.3.0 0.0.0.255 //允许192.168.3.0/24网段流量通行
[R-acl-basic-2000]quit

-----------------------------------------------------------------------------------------
#接口IP地址、NAT转换和内网服务器配置
[R]interface GigabitEthernet 4/0/2
[R-GigabitEthernet4/0/2]ip address 10.10.10.1 24 //配置接口IP地址
[R-GigabitEthernet4/0/2]nat outbound 2000 //接口GE4/0/2可以使用acl 2000地址池进行地址转换
[R-GigabitEthernet4/0/2]nat server protocol tcp global current-interface 8886 inside 192.168.1.252 80
//配置web服务器静态映射，内网web服务器IP地址192.168.1.252端口80映射到当前公网接口IP地址和8886端口
[R-GigabitEthernet4/0/2]nat server protocol tcp global current-interface 2166 inside 192.168.1.252 21
//配置ftp服务器静态映射，内网ftp服务器IP地址192.168.1.252端口21映射到当前公网端口IP地址和2166端口
[R-GigabitEthernet4/0/2]quit

-----------------------------------------------------------------------------------------
#链路聚合和DHCP相关配置
[R]interface Eth-Trunk 1  //创建聚合链路接口1
[R-Eth-Trunk1]undo portswitch //将二层网络接口转换成三次网络接口
[R-Eth-Trunk1]mode lacp-static //设置聚合链路2为静态LACP模式
[R-Eth-Trunk1]trunkport GigabitEthernet 4/0/0 0/0/1 //将物理接口GE4/0/0和GE0/0/1添加到聚合链路1的接口中
[R-Eth-Trunk1]ip address 192.168.1.254 24 //配置接口IP地址
[R-Eth-Trunk1]dhcp enable //开启DHCP服务
[R]ip pool dmzpool //创建地址池dmzpool
[R-ip-pool-dmzpool]network 192.168.1.0 mask 24 //全局地址池dmzpool可分配的网段IP地址
[R-ip-pool-dmzpool]gateway-list 192.168.1.254 //配置全局地址池dmzpool的网关地址
[R-ip-pool-dmzpool]lease day 1 hour 12 minute 30 //租期设置为1天12小时30分钟
[R-ip-pool-dmzpool]excluded-ip-address 192.168.1.201 192.168.1.253 //dmzpool地址池不包括1.1.1.101到1.1.1.253这些地址
[R-ip-pool-dmzpool]dns-list 61.128.114.166 61.128.114.133 //配置全局地址池dmzpool的DNS服务器地址
[R-ip-pool-dmzpool]quit
[R]interface Eth-Trunk 1
[R-Eth-Trunk1]dhcp select global //关联接口和全局地址池
[R-Eth-Trunk1]quit

-----------------------------------------------------------------------------------------
[R]interface GigabitEthernet 0/0/2
[R-GigabitEthernet0/0/2]ip address 192.168.2.254 24
[R-GigabitEthernet0/0/2]dhcp enable
[R]ip pool workpool
[R-ip-pool-workpool]network 192.168.2.0 mask 24
[R-ip-pool-workpool]gateway-list 192.168.2.254
[R-ip-pool-workpool]lease day 1 hour 12 minute 30
[R-ip-pool-workpool]dns-list 61.128.114.166 61.128.114.133
[R-ip-pool-workpool]quit
[R]interface GigabitEthernet 0/0/2
[R-GigabitEthernet0/0/2]dhcp select global
[R-GigabitEthernet0/0/2]quit

-----------------------------------------------------------------------------------------
[R]interface GigabitEthernet 0/0/0
[R-GigabitEthernet0/0/0]ip address 192.168.3.254 24
[R-GigabitEthernet0/0/0]dhcp enable
[R]ip pool publicpool
[R-ip-pool-publicpool]network 192.168.3.0 mask 24
[R-ip-pool-publicpool]gateway-list 192.168.3.254
[R-ip-pool-publicpool]lease day 1 hour 12 minute 30
[R-ip-pool-publicpool]dns-list 61.128.114.166 61.128.114.133
[R-ip-pool-publicpool]quit
[R]interface GigabitEthernet 0/0/0
[R-GigabitEthernet0/0/0]dhcp select global
[R-GigabitEthernet0/0/0]quit

-----------------------------------------------------------------------------------------
[R]interface GigabitEthernet 4/0/3
[R-GigabitEthernet4/0/3]ip address 192.168.6.254 24
[R-GigabitEthernet4/0/3]quit

七、测试验证

        其他PC终端配置和PC1一样。 

        内网和外网都能正常访问web服务器。

---

        物理机上ping路由器，测试通信正常。

        成功telnet登录路由器R，可以查看和配置命令。

学习笔记，不对之处，欢迎交流指正！