HCIE-园区网技术汇总

一.网络可靠性

（1）lacp-static 链路聚合

interface Eth-Trunk3
 port link-type trunk
 port trunk allow-pass vlan 100 
 mode lacp-static
 trunkport g0/0/23 
 trunkport g0/0/24

（2）查看链路聚合是否成功

<Huawei>dis eth
Eth-Trunk3's state information is:
Local:
LAG ID: 3                   WorkingMode: STATIC                               
Preempt Delay: Disabled     Hash arithmetic: According to SIP-XOR-DIP         
System Priority: 32768      System ID: 4c1f-cc43-2bec                         
Least Active-linknumber: 1  Max Active-linknumber: 8                          
Operate status: up          Number Of Up Port In Trunk: 2                     
--------------------------------------------------------------------------------
ActorPortName          Status   PortType PortPri PortNo PortKey PortState Weight
//查看到接口Selected 证明链路聚合成功
GigabitEthernet0/0/23  **Selected** 1GE      32768   24     817     10111100  1     
GigabitEthernet0/0/24  **Selected** 1GE      32768   25     817     10111100  1     

Partner:
--------------------------------------------------------------------------------
ActorPortName          SysPri   SystemID        PortPri PortNo PortKey PortState
GigabitEthernet0/0/23  32768    4c1f-cc76-0d0b  32768   24     817     10111100
GigabitEthernet0/0/24  32768    4c1f-cc76-0d0b  32768   25     817     10111100
    

二.DHCP与DHCP中继

（1）DHCP

地址池方式下发地址，接口下发不做赘述

//全局
DHCP enable
vlan 11
#
ip pool vlan11
 gateway-list 10.1.11.254
 network 10.1.11.0 mask 255.255.255.0
#
//本机做dhcp服务器 全局使用地址池模式
interface Vlanif11
 ip address 10.1.11.254 255.255.255.0
 dhcp select global 

（2）DHCP中继

//中继设备
DHCP enable
vlan 11
//地址池使用远端设备的地址池
//远端作为dhcp服务器
interface Vlanif11
 ip address 10.1.11.254 255.255.255.0
 //设置成中继模式
 dhcp select relay
 //远端dhcp地址
 dhcp relay server-ip 10.1.208.253

//远端dhcp设备需要配置
//地址池
ip pool vlan11
 gateway-list 10.1.11.254
 network 10.1.11.0 mask 255.255.255.0
 #
 //使用互联vlan下发全局地址池vlan11对应地址
 //vlan208属于dhcp中继设备与dhcp设备互联vlan
 interface Vlanif208
 ip address 10.1.208.253 255.255.255.252
 dhcp select global

三.园区网多业务划分（基于实例）

概述环境两个汇聚交换机上连核心设备 核心设备进行业务划分 进行三层路由协议
两类业务Employee与Guest （Employee属于区域1，Guest 属于区域2）

（1）汇聚交换机

//汇聚1
ospf 1 router-id 2.2.2.2
//Employee
 area 0.0.0.1
 //内网11.21网段，与核心设备互联网段208网段
  network 10.1.11.254 0.0.0.0
  network 10.1.21.254 0.0.0.0
  network 10.1.208.254 0.0.0.0
#
//汇聚2
ospf 1 router-id 3.3.3.3
//Employee
 area 0.0.0.1
  //内网31.41网段，与核心设备互联网段209网段
  network 10.1.31.254 0.0.0.0
  network 10.1.41.254 0.0.0.0
  network 10.1.209.254 0.0.0.0
#
//核心分为三部分
//核心Employee业务
ospf 1 router-id 1.1.1.1 vpn-instance Employee
//使用vpn实例需要关闭此功能
 vpn-instance-capability simple
 area 0.0.0.1
   //对接汇聚1
  network 10.1.208.253 0.0.0.0
  //对接汇聚2
  network 10.1.209.253 0.0.0.0
  //直连服务器网段
  network 10.1.60.254 0.0.0.0
  //Employee 无线业务网段
  network 10.1.51.254 0.0.0.0
  network 10.1.52.254 0.0.0.0
  network 10.1.53.254 0.0.0.0
  network 10.1.54.254 0.0.0.0
  network 10.1.55.254 0.0.0.0
  //需要对接防火墙网段
  network 10.1.206.1 0.0.0.0
#
//核心Guest业务
ospf 3 router-id 1.1.1.3 vpn-instance Guest
 vpn-instance-capability simple
 area 0.0.0.2
   //Guest无线业务网段
  network 10.1.101.254 0.0.0.0
  network 10.1.102.254 0.0.0.0
  network 10.1.103.254 0.0.0.0
  network 10.1.104.254 0.0.0.0
  network 10.1.105.254 0.0.0.0
  //需要对接防火墙网段
  network 10.1.207.1 0.0.0.0
#
//核心Pulic上网业务
ospf 2 router-id 1.1.1.2
//对接出口路由器ospf
 area 0.0.0.0
  network 10.1.200.2 0.0.0.0
  network 10.1.200.6 0.0.0.0
 area 0.0.0.1
 //对接防火墙区域1
 //Employee 过滤了deny_Guest 
  filter ip-prefix deny_Guest import
  network 10.1.204.1 0.0.0.0
 //对接防火墙区域2
 //Guest 过滤了deny_Employee 
 area 0.0.0.2
  filter ip-prefix deny_Employee import
  network 10.1.205.1 0.0.0.0
#

（2）业务隔离

//前缀列表规则
ip ip-prefix deny_Employee  deny 10.1.11.0 24
ip ip-prefix deny_Employee  deny 10.1.21.0 24
ip ip-prefix deny_Employee  deny 10.1.31.0 24
ip ip-prefix deny_Employee  deny 10.1.41.0 24
ip ip-prefix deny_Employee  deny 10.1.51.0 24
ip ip-prefix deny_Employee  deny 10.1.52.0 24
ip ip-prefix deny_Employee  deny 10.1.53.0 24
ip ip-prefix deny_Employee  deny 10.1.54.0 24
ip ip-prefix deny_Employee  deny 10.1.55.0 24
ip ip-prefix deny_Employee  permit 0.0.0.0 0 less-equal 32
ip ip-prefix deny_Guest  deny 10.1.101.0 24
ip ip-prefix deny_Guest  deny 10.1.102.0 24
ip ip-prefix deny_Guest  deny 10.1.103.0 24
ip ip-prefix deny_Guest  deny 10.1.104.0 24
ip ip-prefix deny_Guest  deny 10.1.105.0 24
ip ip-prefix deny_Guest  permit 0.0.0.0 0 less-equal 32
//引用路由协议区域下
filter ip-prefix deny_Employee import

四.防火墙与核心交换对接

（1）根墙vlan资源分配到虚拟系统

//开启虚拟系统
vsys enable
//204 205对接核心pubilc 206 207对接对应的ospf实例
vlan batch 204 to 207
//分配vlan到虚拟墙
vsys name Guest
 assign vlan 205
 assign vlan 207
vsys name Employee 
 assign vlan 204
 assign vlan 206

（2）根墙需要配置的

//vlanif /Virtual-if口/接口
#
interface Vlanif204
 ip binding vpn-instance Employee
 ip address 10.1.204.2 255.255.255.252
 service-manage ping permit
#
interface Vlanif205
 ip binding vpn-instance Guest
 ip address 10.1.205.2 255.255.255.252
 service-manage ping permit
#
interface Vlanif206
 ip binding vpn-instance Employee
 ip address 10.1.206.2 255.255.255.252
 service-manage ping permit
#
interface Vlanif207
 ip binding vpn-instance Guest
 ip address 10.1.207.2 255.255.255.252
 service-manage ping permit
#
interface Virtual-if1
 ip address 10.1.255.253 255.255.255.255
#
interface Virtual-if2
 ip address 10.1.200.254 255.255.255.255
#
#
interface GigabitEthernet1/0/1
 portswitch
 undo shutdown
 port link-type trunk
 undo port trunk allow-pass vlan 1
 port trunk allow-pass vlan 204 to 205
#
interface GigabitEthernet1/0/2
 portswitch
 undo shutdown
 port link-type trunk
 undo port trunk allow-pass vlan 1
 port trunk allow-pass vlan 206 to 207
//ospf配置
ospf 1 router-id 4.4.4.1 vpn-instance Employee
 vpn-instance-capability simple
 area 0.0.0.1
  network 10.1.204.2 0.0.0.0
  network 10.1.206.2 0.0.0.0
#
ospf 2 router-id 4.4.4.2 vpn-instance Guest
 vpn-instance-capability simple
 area 0.0.0.2
  network 10.1.205.2 0.0.0.0
  network 10.1.207.2 0.0.0.0
#
//虚拟系统互访
ip route-static vpn-instance Employee 10.1.101.0 255.255.255.0 vpn-instance Gues
t
ip route-static vpn-instance Employee 10.1.102.0 255.255.255.0 vpn-instance Gues
t
ip route-static vpn-instance Employee 10.1.103.0 255.255.255.0 vpn-instance Gues
t
ip route-static vpn-instance Employee 10.1.104.0 255.255.255.0 vpn-instance Gues
t
ip route-static vpn-instance Employee 10.1.105.0 255.255.255.0 vpn-instance Gues
t
ip route-static vpn-instance Guest 10.1.60.99 255.255.255.255 vpn-instance Emplo
yee

（3）虚拟墙里配置

//区域划分
//Employee
firewall zone trust
 set priority 85
 add interface Vlanif206
#
firewall zone untrust
 set priority 5
 add interface Virtual-if1
 add interface Vlanif204
#
//Guest
firewall zone trust
 set priority 85
 add interface Vlanif207
#
firewall zone untrust
 set priority 5
 add interface Virtual-if2
 add interface Vlanif205
#
//Guest
//设置地址集和服务集
ip address-set WLAN_Guest type object
 address 0 10.1.101.0 mask 24
 address 1 10.1.102.0 mask 24
 address 2 10.1.103.0 mask 24
 address 3 10.1.104.0 mask 24
 address 4 10.1.105.0 mask 24
//服务集
ip service-set Guest_Service type object 16
 service 0 protocol tcp destination-port 3389
 service 1 protocol icmp
//安全策略
security-policy
 rule name permit_60.99
  source-zone trust
  destination-zone untrust
  source-address address-set WLAN_Guest
  service Guest_Service
  action permit
 rule name deny_other
  source-zone trust
  destination-zone untrust
  source-address address-set WLAN_Guest
  destination-address 10.1.60.0 mask 255.255.255.0
  action deny
 rule name to_internet
  source-zone trust
  destination-zone untrust
  source-address address-set WLAN_Guest
  action permit
///
rule move  2 before 1 //把2放在一前
rule move  1 bottom //放到最下
rule move  2 top //放到最上
安全策略需要调换位置

五.无线ac-ap配置

AP-上线

AC-配置下发地址释放wifi信号

注释：先确保设备上线在进行配置

//AC
//划分vlan
vlan batch 51 to 55 100 to 105
//vlan ac下发vlan地址池
vlan pool Employee
 vlan 51 to 55
vlan pool Guest
 vlan 101 to 105
 //管理vlan 开启capwap隧道
capwap source interface vlanif100
## 五部走
1.安全模板
  security-profile name SE
  security wpa-wpa2 psk pass-phrase Huawei@123
2. ssid模板
  ssid-profile name Guest
  ssid X_Guest
  ssid-profile name Employee
  ssid X_Employee
3.vap模板
 vap-profile name Employee
  forward-mode tunnel
  service-vlan vlan-pool Employee
  ssid-profile Employee
  security-profile SE
4.绑定ap组
ap-group name A
vap-profile Employee wlan 1 radio all
5.上线设备绑定
 ap-id 0(上线设备id)
  ap-group name A

六.出口路由器nat地址转换

(1)Easy Ip

#
acl number 2000  
 rule 5 permit 
#
//出接口
interface GigabitEthernet4/0/2
 ip address 10.255.1.1 255.255.255.0 
 nat outbound 2000

(2)NAPT

//ACL
#
acl number 2000  
 rule 5 permit 
#
//公网申请的地址段
 nat address-group 1 10.255.4.2 10.255.4.100
//出接口
interface GigabitEthernet4/0/3
 ip address 10.255.4.1 255.255.255.0 
 nat outbound 2000 address-group 1

(3)目的地址端口映射

使用场景：外网用户访问企业内网服务器

//出接口
nat server protocol tcp global current-interface 8081 inside 10.1.60.101 www

(4)源地址端口映射

使用场景：多网络出口解决来回路径不一致问题

//目的映射设备的内网用户端口
//先定义acl策略 从外网接口访问内网服务器的浏览 在进行
acl number 3001  
 rule 5 permit tcp destination 10.255.4.1 0 destination-port eq 8081 
#
//出接口
interface GigabitEthernet0/0/1
//内网网段
 ip address 10.1.200.5 255.255.255.252 
 nat outbound 3001