原创：华三杯2018山东省赛决赛样题试做

自己刚学的时候，花了一周试着做的，好多地方遗漏，大佬请尽情指教（怼我）

关键字： #新华三 #路由交换 #H3CSE #联科云 #组网 #学生组

样题:

试做答案：

（打对号的表示已完成或确定做的没错，其他不确定）
1、/IRF堆叠/ √
//多台相同设备堆叠成一个虚拟设备
“//”该符号表注释.//配置前先不连线
[IRF1] system-view //进入系统视图
[IRF1] sysname IRF1 //改设备名字
[IRF1] irf member 1 priority 10 //修改irf成员1优先级 为 10，默认1，值越大越优先
[IRF1] irf domain 10 //修改domain值，域编号，一个IRF对应一个IRF域
[IRF1] int range Ten-GigabitEthernet 1/0/50 to Ten-GigabitEthernet 1/0/51 //批量选取接口
[IRF1] shutdown //掉电，关闭
[IRF1] quit //退出当前视图
[IRF1] irf-port 1/1 //创建堆叠接口1/1
[IRF1-irf-port1/1] port group int Ten-Gi 1/0/50 //堆叠接口组绑定1/0/50接口
[IRF1-irf-port1/1] port group int Ten-Gi 1/0/51 //堆叠接口组绑定1/0/51接口
[IRF1-irf-port1/1] quit //退出当前视图
[IRF1-irf-port1/1] save //保存配置
[IRF1] int range Ten-GigabitEthernet 1/0/50 to Ten-GigabitEthernet 1/0/51 //选取接口范围
[IRF1] undo shutdown //上电，开启接口
[IRF1] quit //退出当前视图
[IRF1] save //保存配置
[IRF1] quit
reboot //用户视图重启
[IRF1] irf-port-configuration active //激活配置的IRF

[IRF2] system-view
[IRF2] sysname IRF2
[IRF2] irf member 1 renumber 2//成员重编号
[IRF2] irf domain 10
[IRF2] save
[IRF2] quit
[IRF2] int range Ten-Gi 2/0/50 to Ten-Gi2/0/51
[IRF2] shutdown
[IRF2] quit
[IRF2] irf-port 2/2 //堆叠接口号互相对应，
1(member id)/1(接口号)，对应2/2
[IRF2] port group interface Ten-Gi 2/0/50
[IRF2] port group interface Ten-Gi 2/0/51
[IRF2] int range Ten-Gi 1/0/50 to Ten-Gi1/0/51
[IRF2] undo shutdown
[IRF2] quit
[IRF2] save
[IRF2] quit
reboot //重启设备
[IRF2] irf-port-configuration active
//最后插网线,插完线，IRF2一般会重启，等待重启完毕，用以下命令验证irf
[IRF1] dis irf //出现所有member
[IRF1] dis int brief //出现所有memeber1，2的所有interface
[IRF2] dis irf
[IRF2] dis int brief

2. (1) 设VLAN
   //配置合理，链路上不允许不必要的数据流通过
   [IRF1] vlan 10
   [IRF1] name RD
   [IRF1] port Gi 1/0/1 to Gi 1/0/4
   [IRF1] vlan 20
   [IRF1] name Sales
   [IRF1] port Gi 1/0/5 to Gi 1/0/8
   [IRF1] vlan 30
   [IRF1] name Supply
   [IRF1] port Gi 1/0/9 to Gi 1/0/12
   [IRF1] vlan 40
   [IRF1] name Service
   [IRF1] port Gi 1/0/13 to Gi 1/0/16
   [IRF1] save

[IRF2] vlan 10
[IRF2] name RD
[IRF2] port Gi 2/0/1 to Gi 2/0/4
[IRF2] vlan 20
[IRF2] name Sales
[IRF2] port Gi 2/0/5 to Gi 2/0/8
[IRF2] vlan 30
[IRF2] name Supply
[IRF2] port Gi 2/0/9 to Gi 2/0/12
[IRF2] vlan 40
[IRF2] name Service
[IRF2] port Gi 2/0/13 to Gi 2/0/16
[IRF2] save

[S1] vlan 10
[S1] name RD
[S1] vlan 20
[S1] name Sales
[S1] vlan 30
[S1] name Supply
[S1] vlan 40
[S1] name Service

[S2] vlan 10
[S2] name RD
[S2] vlan 20
[S2] name Sales
[S2] vlan 30
[S2] name Supply
[S2] vlan 40
[S2] name Service
(2) *链路聚合
[IRF1] int Bridge-Aggregation 1//创建二层聚合端口组 1
[IRF1] quit
[IRF1] int gi 1/0/24 //进接口
[IRF1] port link-aggregation group 1 //（接口视图）加入组
[IRF1] port link-type trunk //连接类型TRUNK
[IRF1] port trunk permit vlan 10 20
//TRUNK允许VLAN 10 20 通过
[IRF1] quit

[IRF1] int Bridge-Aggregation 2 //创建二层聚合端口组 2
[IRF1] quit
[IRF1] int gi 1/0/23 //进接口
[IRF1] port link-aggregation group 2
[IRF1] port link-type trunk
[IRF1] port trunk permit vlan 30 40
[IRF1] save
//为了保险分开配，没堆叠成功也不影响这
//并且第9题要限制各VLAN数据转发路径
[IRF2] int Bridge-Aggregation 1
[IRF2] quit
[IRF2] int gi 2/0/24
[IRF2] port link-aggregation group 1
[IRF2] port link-type trunk
[IRF2] port trunk permit vlan 10 20
[IRF2] quit
[IRF2] int Bridge-Aggregation 2
[IRF2] quit
[IRF2] int gi 2/0/23
[IRF2] port link-aggregation group 2
[IRF2] port link-type trunk
[IRF2] port trunk permit vlan 30 40
[IRF2] save

[S1] sysname S1
[S1] int Bridge-Aggregation 1
[S1] quit
[S1] int range gi 1/0/23 to int gi 1/0/24
[S1] port link-aggregation group 1
[S1] port link-type trunk
[S1] port trunk permit vlan 10 20
[S1] save

[S2] sysname S2
[S2] int Bridge-Aggregation 2
[S2] quit
[S2] int range gi 2/0/23 to int gi 2/0/24
[S2] port link-aggregation group 2
[S2] port link-type trunk
[S2] port trunk permit vlan 30 40
[S2] save

[S1] int gi 1/0/11 /设TRUNK口/
[S1] port link-type trunk
[S1] port trunk permit vlan 10 20 30 40
[S2] int gi 1/0/1
[S1] port link-mode route /改成三层模式/
[S1] quit
[S1] save

[S2] int gi 1/0/11
[S2] port link-type trunk/设TRUNK口/
[S2] port trunk permit vlan 10 20 30 40
[S2] int gi 1/0/1
[S2] port link-mode route /改成三层模式/
[S2] quit
[S2] save

3./配IP地址/
[S1] int vlan 10 //三层虚接口
[S1] ip address 192.168.10.252 24
[S1] int vlan 20
[S1] ip address 192.168.20.252 24
[S1] int vlan 30
[S1] ip address 192.168.30.252 24
[S1] int vlan 40
[S1] ip address 192.168.40.252 24
[S1] int GigabitEthernet 1/0/1
[S1] ip address 10.0.0.5 30
[S1] int GigabitEthernet 1/0/10 //？
[S1] port link-mode route
/1/0/10为啥配IP？我是改的三层模式配的
[S1] ip address 10.0.0.1 30
[S1] int loop 0
[S1] ip address 9.9.9.201 32
[S1] save

[S2] int vlan 10
[S2] ip address 192.168.10.253 24
[S2] int vlan 20
[S2] ip address 192.168.20.253 24
[S2] int vlan 30
[S2] ip address 192.168.30.253 24
[S2] int vlan 40
[S2] ip address 192.168.40.253 24
[S2] int GigabitEthernet 1/0/1
[S2] ip address 10.0.0.9 30
[S2] int GigabitEthernet 1/0/10
[S2] port link-mode route
/1/0/10为啥配IP？我是改的三层模式配的[S2] ip address 10.0.0.2 30
[S2] int loop 0
[S2] ip address 9.9.9.202 32
[S2] qu
[S2] save

[FW] sys
[FW] sysname FW
[FW] int GigabitEthernet 1/0/0
[FW] ip address 10.0.0.13 30
[FW] int GigabitEthernet 1/0/1
[FW] ip address 10.0.0.6 30
[FW] int GigabitEthernet 1/0/0
[FW] ip address 10.0.0.10 30
[FW] int loop 0
[FW] ip address 9.9.9.1 32

[R1] system-view
[R1] sysname R1
[R1] int GigabitEthernet 0/0
[R1] ip address 10.0.0.14 30
[R1] int loop 0
[R1] ip address 9.9.9.2 32
[R1] int loop 100
[R1] ip address 172.16.100.254 24
[R1]
4、/给总部三层设备配OSPF协议/ √
防火墙
[FW] sys
[FW； login] admin
[FW:password] admin
[FW] router id 9.9.9.1 //全局声明
[FW] ospf 10 //配process-id
[FW] area 0 //区域
[FW-ospf-10-area-0.0.0.0] network 10.0.0.12 0.0.0.3 //反掩码
[FW-ospf-10-area-0.0.0.0] network 10.0.0.4 0.0.0.3
[FW-ospf-10-area-0.0.0.0] network 10.0.0.8 0.0.0.3
[FW-ospf-10-area-0.0.0.0] network 9.9.9.1 0.0.0.0
/*要求：业务网段中不出现协议报文
修改接口网络类型，加快OSPF收敛速度。方法：配P2P */
[FW] int gi 1/0/1 //进接口
[FW] ospf 10 area 0 //使能OSPF
[FW]ospf network-type p2p/改接口网络类型
[FW] int gi 1/0/2 //进接口
[FW] ospf 10 area 0
[FW]ospf network-type p2p/改接口网络类型
[FW] silent-interface Gi 1/0/0
//静默接口，不走OSPF报文
[FW] qu
[FW] qu
[FW] save

[S1] sys
[S1] router id 9.9.9.201
[S1] ospf 10
[S1] area 0
[S1] network 9.9.9.201 0.0.0.0
[S1] network 10.0.0.0 0.0.0.3
[S1] network 10.0.0.4 0.0.0.3
[S1] network 192.168.10.0 0.0.0.255
[S1] network 192.168.20.0 0.0.0.255
[S1] network 192.168.30.0 0.0.0.255
[S1] network 192.168.40.0 0.0.0.255
[S1] int gi 1/0/1//进接口
[S1] ospf 10 area 0 //使能OSPF
[S1] ospf network-type p2p/改接口网络类型
[S1] int gi 1/0/10//进接口
[S1] ospf 10 area 0
[S1] ospf network-type p2p/改接口网络类型
[S1] qu
[S1] qu
[S1] save

[S2] system-view
[S2] router id 9.9.9.202
[S2] ospf 10
[S2] area 0
[S2] network 10.0.0.0 0.0.0.3
[S2] network 10.0.0.8 0.0.0.3
[S2] network 9.9.9.202 0.0.0.0
[S2] network 192.168.10.0 0.0.0.255
[S2] network 192.168.20.0 0.0.0.255
[S2] network 192.168.30.0 0.0.0.255
[S2] network 192.168.40.0 0.0.0.255
[S2] int gi 1/0/1//进接口
[S2] ospf 10 area 0
[S2]ospf network-type p2p/改接口网络类型
[S2] int gi 1/0/10//进接口
[S2] ospf 10 area 0
[S2]ospf network-type p2p/改接口网络类型
[S2] qu
[S2] qu
[S2] save
[S2] reboot
5. IPv4 BGP 路由部署√
分部为 AS200，总部为 AS100； √
总部内 FW与S1、S2 需要以 LoopBack0 为源地址使用对等体组as100建立 IBGP 连接；√
总部与分部用物理接口建立EBGP连接；√
配置BGP 的下一跳（NEXT_HOP）属性，以避免路由黑洞；√
总部和分部的所有业务流必须通过 network 命令来发布；√
通过配置 BGP 路由优先级值为 80（EBGP）、100（IBGP）、130（本地 BGP），从而避免路由环路。√
分部向总部发布缺省路由。最终，要求全网路由互通。√
/配总部防火墙/
[FW] bgp 100//启动BGP
[FW] router id 9.9.9.1 //配全局ROUTER-ID
[FW] peer 9.9.9.201 as-number 100
//配置对等体
[FW] peer 9.9.9.202 as-number 100
//创IPV4对等体并指定AS号
[FW] peer 9.9.9.201 connect-int Loop 0
//指定物理接口
[FW] peer 9.9.9.202 connect-int Loop 0
//指定接口
[FW] peer 10.0.0.14 as-number 200 //配EBGP
[FW] peer 10.0.0.14 connect-int gi 0/0//因为要求的是用物理接口,一般是直连接口
[FW] group as100 internal //建内部对等体组
[FW] peer as100 connect-int loop 0
[FW] group as200 external //建外部对等体组
[FW] peer as200 as-number 200
[FW] peer as200 connect-int gi 0/0
[FW] peer 10.0.0.14 group as200 as-num 200
[FW] peer 9.9.9.201 group as100 as-num 100 //向组中添加IPV4 BGP对等体
[FW] peer 9.9.9.202 group as100 as-num 100 //向组中添加IPV4 BGP对等体
[FW] address-family ipv4 unicast//创建并进入BGP IPV4单播实例视图
[FW] peer 9.9.9.201 enable//使能对等体
[FW] peer 9.9.9.202 enable//使能对等体
[FW] peer 10.0.0.14 enable
//使能外部对等体
[FW] peer 9.9.9.2 next-hop-local //仅向EBGP
[FW] preference 80 100 130 //改优先级
外部EX 内部IN 本地LO
[FW] peer as100 enable //使能组中对等体交换IPV4单播数据能力
[FW] peer as200 enable
[FW] network 9.9.9.1 32 //一般不宣告自己
[FW] network 10.0.0.12 30//宣告直连网段
[FW] network 10.0.0.8 30
[FW] network 10.0.0.4 30
[FW] import-route ospf 10//引入OSPF路由
[FW] import-route direct //引入直连路由
[FW] improt-route bgp
[FW] default-route imported //引入缺省路由
[FW] qu
[FW] qu
[FW] save

[S1] bgp 100
[S1] router id 9.9.9.201
[S1] peer 9.9.9.1 as-number 100
[S1] peer 9.9.9.1 connect-int Loop 0
[S1] address-family ipv4 unicast
[S1] peer 9.9.9.1 enable
[S1] peer 9.9.9.1 next-hop-local
[S1] import-route ospf 10//引入OSPF路由
[S1] import-route direct //引入直连路由
[S1] preference 80 100 130
[S1] quit
[S1] save

[S2] bgp 100
[S2] router id 9.9.9.202
[S2] peer 9.9.9.1 as-number 100
[S2] peer 9.9.9.1 connect-int Loop 0
[S2] address-family ipv4 unicast
[S2] peer 9.9.9.1 enable
[S2] peer 9.9.9.1 next-hop-local
[S2] import-route ospf 10//引入OSPF路由
[S2] import-route direct //引入直连路由
[S2] preference 80 100 130
[S2] quit
[S2] save
/配分部路由器R1的EBGP/
//需要建立外部对等体组吗//、、
[R1] bgp 200
[R1] router-id 9.9.9.2
[R1] peer 10.0.0.13 as-number 100
[R1] peer 10.0.0.13 connect-int gi 0/0
//要求的物理端口
[R1] address-family ipv4 unicast
[R1] peer 10.0.0.13 enable
[R1] peer 10.0.0.13 next-hop-local
[R1] preference 80 100 130
[R1] network 10.0.0.14 30 //宣告网段
[R1] network 172.16.100.0 24
[R1] network 9.9.9.2 32 //自身宣告
[R1] peer 10.0.0.13 default-route-advertise
//分部向总部发送缺省路由
[R1]
[R1] quit
[R1] save
[R1]

6、防火墙安全域配置 √
[FW] sys /创建安全域/
[FW] security-zone name trust //可信
[FW] import int gi 1/0/1 //绑定接口
[FW] import int gi 1/0/2
[FW] quit //退到系统试图
[FW] security-zone name untrust //不可信
[FW] import int gi 1/0/0 //绑定接口
[FW] quit //退到系统试图
[FW] acl advanced 3100 /建高级acl列表/
[FW] rule peimit ip source any destination any
//允许所有IP流量
[FW] zone-pair security source trust destination untrust /建域间实例/
[FW] packet-filter 3100 /调用ACL过滤/
[FW] quit
[FW] zone-pair security source untrust destination trust
[FW] packet-filter 3100
[FW] save
检查方法：ping //dis acl 3100
7、路由优化部署
[S1]sys
[S1]
[S1] acl basic 2001 //对应vlan10 ,20
[S1] rule permit source 192.168.0.0 0.0.224.255 //?
[S1] rule permit source 10.0.0.0 0.0.0.3
[S1] acl basic 2002 //对应vlan30 ,40
[S1] rule deny source 192.168.0.0 0.0.192.255 //?
[S1]
[S1] route-policy 12100 permit node 10
//允许VLAN 10和20的数据流向
[S1] if-match ip address acl 2001
[S1] apply local-preference 100
[S1] route-policy 12100 pemit node 20
//拒绝VLAN 30和40的数据流向
[S1] if-match ip address acl 2002
[S1] apply local-preference 200
[S1]
[S1]
[S2]sys
[S2]
[S2] acl basic 2001 //对应vlan10 ,20
[S2] rule deny source 192.168.0.0 0.0.224.255
[S2] acl basic 2002 //对应vlan30 ,40
[S2] rule permit source 192.168.0.0 0.0.192.255
[S2] rule permit source 10.0.0.0 0.0.0.3
[S2] route-policy 12100 peimit node 30
//允许VLAN 30和40的数据流向
[S2] if-match address acl 2001
[S2] apply local-preference 200
//改高优先级做主
[S2] route-policy 12100 permit node 40
//拒绝VLAN 10和20的数据流向
[S2] if-match address acl 2002
[S2] apply local-preference 100
//改低优先级备份
[S2]

8、IPV6路由配置？
[S1] ipv6
[S1] int vlan 10
[S1] ipv6 address 2001:172:10::252/64
[S1] int vlan 20
[S1] ipv6 address 2001:172:20::252/64
[S1] int vlan 30
[S1] ipv6 address 2001:172:30::252/64
[S1] int vlan 40
[S1] ipv6 address 2001:172:40::252/64
[S1]
/IPV6 OSPF配置/
[S1] ospfv3 100
[S1] router-id 9.9.9.201
[S1] area 0.0.0.0
[S1]
[S1] interface gi 1/0/1
[S1] ipv6 address FE80:11::1 link-local
[S1] ospfv3 100 area 0.0.0.0
[S1] interface gi 1/0/10
[S1] ipv6 address FE80:10::2 link-local
[S1] ospfv3 100 area 0.0.0.0
[S1]
[S1]
[S1]

[S2] ospfv3 100
[S2] router-id 9.9.9.202
[S2] area 0.0.0.0
[S2]
[S2] ipv6
[S2] interface gi 1/0/1
[S2] ipv6 address FE80:12::1 link-local
[S2] ospfv3 100 area 0.0.0.0
[S2] interface gi 1/0/10
[S2] ipv6 address FE80:10::1 link-local
[S2] ospfv3 100 area 0.0.0.0
[S2]
[S2]
[S2]
[S2]
[S2]
[S2]
[S2]
[S2]

[FW] ospfv3 100
[FW] router-id 9.9.9.1
[FW] area 0.0.0.0
[FW]
[FW] ipv6
[FW] interface gi 1/0/1
[FW] ipv6 address FE80:11::2 link-local
[FW] ospfv3 100 area 0.0.0.0
[FW] interface gi 1/0/2
[FW] ipv6 address FE80:12::2 link-local
[FW] ospfv3 100 area 0.0.0.0
[FW]
[FW]
[FW]
[FW]
[FW]
[FW]

/IPV6防火墙 域间策略/
[FW] sys /创建安全域/
[FW] security-zone name trust //可信
[FW] import int gi 1/0/1 //绑定接口
[FW] import int gi 1/0/2
[FW] quit //退到系统试图
[FW] security-zone name untrust //不可信
[FW] import int gi 1/0/0 //绑定接口
[FW] quit //退到系统试图
[FW] acl ipv6 advanced 3100 /建高级acl列表/
[FW] rule peimit ipv6 source any destination any
//允许所有IP流量
[FW] zone-pair security source trust destination untrust /建域间实例/
[FW] packet-filter ipv6 3100
/调用ipv6 ACL过滤/
[FW] quit
[FW] zone-pair security source untrust destination trust
[FW] packet-filter ipv6 3100
[FW] save
检查方法：ping //dis ipv6 acl 3100

9./MSTP及VRRP配置/ √
/MSTP/
[S1] stp mode mstp //可选
[S1] stp region-configuration //进MST域视图
[S1] region-name H3C //配置域名
[S1] instance 1 vlan 10 20 //实例1
[S1] instance 2 vlan 30 40 //实例2
[S1] revision-level 0
//配MSTP修订级别,默认0 !
[S1] active region-configuration
//激活MST域配置
[S1] quit //退到系统视图
[S1] stp instance 1 root primary
//设SW1为instance1的根桥
[S1] stp instance 2 root secondary
//设SW1为instance2的备份根桥
[S1] stp global enable
//全局使能生成树协议!

[S1] save

[S2] stp mode mstp
[S2] stp region-configuration
[S2] region-name H3C
[S2] instance 1 vlan 10 20
[S2] instance 2 vlan 30 40
[S2] revision-level 0
//配MSTP修订级别,默认0 !
[S2] active region-configuration
[S2] quit
[S2] stp instance 2 root primary
//设SW2为instance2的根桥
[S2] stp instance 1 root secondary
//设SW2为instance1的备份根桥
[S2] stp global enable // !
[S2] save

[IRF] stp mode mstp
[IRF] stp region-configuration
[IRF] region-name H3C
[IRF] instance 1 vlan 10 20
[IRF] instance 2 vlan 30 40
[IRF] revision-level 0 //配MSTP修订级别 !
[IRF] save
[IRF] active region-configuration
[IRF] quit
[IRF] stp global enable //全局使能 !
[IRF] save
当网络拓扑稳定后，通过使用
display stp brief
命令可以查看各设备上生成树的简要信息
display stp region-configuration
Dis stp int < >
Dis stp down-port
Dis stp root
Dsi stp instance
Dsi stp bpdu-statistics

/配置VRRP/
[S1] int gi 1/0/1
[S1] vrrp vrid 10 virtual-ip 192.168.10.254
//设虚拟网关地址
[S1] vrrp vrid 10 priority 150 //高等级做主
[S1] vrrp vrid 20 virtual-ip 192.168.20.254
[S1] vrrp vrid 20 priority 150
[S1] vrrp vrid 30 virtual-ip 192.168.30.254
[S1] vrrp vrid 30 priority 120 //低等级备份
[S1] vrrp vrid 40 virtual-ip 192.168.40.254
[S1] vrrp vrid 40 priority 120
[S1] save

[S2] int gi 1/0/1
[S2] vrrp vrid 10 virtual-ip 192.168.10.254
[S2] vrrp vrid 10 priority 120 //低等级备份
[S2] vrrp vrid 20 virtual-ip 192.168.20.254
[S2] vrrp vrid 20 priority 120
[S2] vrrp vrid 30 virtual-ip 192.168.30.254
[S2] vrrp vrid 30 priority 150//高等级做主
[S2] vrrp vrid 40 virtual-ip 192.168.40.254
[S2] vrrp vrid 40 priority 150
[S2] save