A-CSW-22

最新推荐文章于 2024-09-30 17:57:44 发布

wxq555000

最新推荐文章于 2024-09-30 17:57:44 发布

阅读量1.5k

点赞数 25

文章标签：网络

本文链接：https://blog.csdn.net/wxq555000/article/details/138794698

版权

#设备命名
hostname SHDXYQB4-108-C-05_CSW-RGS6250-01U40

#vlan创建
vlan range 1,201-208,210-299,302-399,500-3999,4093

#M-lag配置
   vap domain 1
   no fast-convergence
   recover up-delay 120 none-vap 60
   data-sync local 1.1.1.6 peer 1.1.1.5
   peer-keepalive local 1.1.1.2 peer 1.1.1.1
   dual-active auto recovery

#peer-link配置(Peer Link接口必须为二层聚合接口。为增强M-LAG设备间数据传输的可靠性，同步数据使用TCP传输，需要在PeerLink链路之上配置一个SVI口，并配置M-LAG主从设备间三层可达，用于设备间同步数据。)
   interface HundredGigabitEthernet 0/55
   description pT:SHDXYQB4-108-C-05-CSW-RGS6250-01U40:10.30.0.21.Hun0/55_M-LAG_PeerLink
   carrier-delay up 2 down 0
   port-group 255 mode active

   interface HundredGigabitEthernet 0/56
   description pT:SHDXYQB4-108-C-05-CSW-RGS6250-01U40:10.30.0.21.Hun0/56_M-LAG_PeerLink
   carrier-delay up 2 down 0
   port-group 255 mode active

   interface AggregatePort 255
   description For_peerlink
   no mac-address-learning
   switchport mode trunk
   peer-link

vlan 4094
name vap

   interface VLAN 4094
   description For_VAP
   ip address 1.1.1.6 255.255.255.252

#peer-keepalive配置(双主检测链路是一条三层通路，用于PeerLink链路故障时检测M-LAG设备的双主状态。为保证检测的实时性，双主检测链路不参与任何转发，建议单独配置一条三层可达的链路作为双主检测链路)
   interface TenGigabitEthernet 0/47
   no switchport
   description pT:SHDXYQB4-108-C-05-CSW-RGS6250-01U40:10.30.0.21.Ten0/47_M-LAG_KeepAlive
   carrier-delay up 2 down 0
   port-group 254 mode active

   interface TenGigabitEthernet 0/48
   no switchport
   description pT:SHDXYQB4-108-C-05-CSW-RGS6250-01U40:10.30.0.21.Ten0/48_M-LAG_KeepAlive
   carrier-delay up 2 down 0
   port-group 254 mode active

   interface AggregatePort 254
   no switchport
   description For_DAD
   ip address 1.1.1.2 255.255.255.252
   vap error-down except

------------------------------------------------------------------------------------------------------------------------------------------
#端口2-46、51-54未使用
   interface TenGigabitEthernet 0/x
   description NO-USE
   shutdown

#uT上行链路
   interface TenGigabitEthernet 0/1
   description uT:SHDXYQB4-108-C-09-BSW-RGS6250-01U31:30.116.194.9.Ten0/6
   carrier-delay up 2 down 0
   port-group 1 mode active

   interface AggregatePort 1
   description uT:SHDXYQB4-108-C-09-BSW-RGS6250-01U31:30.116.194.9.Agg15
   switchport mode trunk
   switchport trunk allowed vlan only 200
   vap 1

#dT下行链路
   interface HundredGigabitEthernet 0/49
   description dT:SHDXYQB4-108-C-04-ASW-RGS6250-M101U37:10.30.0.23.Hun0/50
   carrier-delay up 2 down 0
   port-group 59 mode active

   interface HundredGigabitEthernet 0/50
   description dT:SHDXYQB4-108-C-05-ASW-RGS6250-01U37:10.30.0.24.Hun0/50
   carrier-delay up 2 down 0
   port-group 59 mode active

   interface AggregatePort 59
   description dT:SHDXYQB4-108-C-04_C-05-ASW-RGS6250-01U37:10.30.0.23&24.Agg1
   switchport mode trunk
   switchport trunk allowed vlan only 200-209,300-309,500-3999
   vap 59
---------------------------------------------------------------------------------------
#配置NTP（ntp server 10.30.1.254）
   ntp update-calendar
   ntp server vrf NET-manage 10.30.1.254 source Mgmt 0
   ntp server 10.30.1.254 source Mgmt 0 prefer
   clock timezone beijing +8 0

#按规范配置远程ssh并调用相应的acl
svi acl enable
svi router-acls enable

   ip access-list standard 65
   10 permit 10.30.0.0 0.0.1.255
   1000 deny any

   ip access-list extended 2000
   10 permit ip host 10.10.0.136 any
   15 permit ip host 10.10.0.137 any
   20 permit ip host 10.30.0.0 any
   25 permit ip host 10.10.0.0 any
   1000 deny ip any any
   list-remark FOR_SNMP

   ip access-list extended 2001
   10 permit ip 192.168.0.0 0.0.7.255 any
   15 permit ip 192.168.8.0 0.0.7.255 any
   20 permit ip 192.168.120.0 0.0.0.255 any
   25 permit ip 10.254.181.0 0.0.0.255 any
   30 permit ip 10.252.134.0 0.0.1.255 any
   35 permit ip 10.10.0.0 0.0.0.127 any
   40 permit ip 10.30.0.0 0.0.1.255 any
   45 permit ip 10.243.72.0 0.0.0.255 any
   list-remark For_SSH_Login

#关闭telnet服务、web服务、开启巨帧转发、开启netconf并且最大会话次数为10
   no enable service telnet-server
   no enable service web-server
   enable service ssh-server
   mtu forwarding 9216
   netconf enable
   netconf max-sessions 10

#开启LLDP，指定为管理IP
lldp management-address-tlv 10.30.0.22

#根据规范正确的配置本地登录账户名和密码（COC确认的密码统一使用:shixun@2023）
   service password-encryption
   username COC_monitor password shixun@2023
   username COC_operator privilege 15 password shixun@2023
   username openstackadmin privilege 15 password Pr@ject2018
   username sdnadmin privilege 15 password Pr@ject2018
   username yundiao_read password shixun@2023
   username shixun privilege 15 password shixun@2023

#SNMP配置
   snmp-server view GNCVIEW 1.3.6.1.2.1 include
   snmp-server view GNCVIEW 1.3.6.1.4.1.9 include
   snmp-server view GNCVIEW 1.3.6.1.4.1.4881 include
   snmp-server user yundiao SNMPGROUP v3 encrypted auth sha 0A9F2A9F45240C74EC0D985C3D7A66EF3DD4414D priv aes128 0A9F2A9F45240C74EC0D985C3D7A66EF
   snmp-server group SNMPGROUP v3 priv read defu write de access 2000
   enable service snmp-agent
   snmp-server system-shutdown
   no snmp-server enable version v1
   snmp-server community yundiao*&COC2016 ro 2000
   snmp-server community COC2016 view GNCVIEW ro 65
   snmp-server enable traps
   snmp-server trap-source Mgmt 0
   snmp-server host 10.10.0.136 vrf NET-manage traps version 2c yundiao*&2016
   snmp-server host 10.10.0.137 vrf NET-manage traps version 2c yundiao*&2016
   snmp-server host 10.10.0.137 vrf NET-manage traps version 3 priv yundiao*&2016
   snmp-server host 10.10.0.136 vrf NET-manage traps version 3 priv yundiao*&2016*&2016

#HASH配置
   load-balance-profile ruijie
   ipv4 field src-ip dst-ip protocol l4-src-port l4-dst-port
   ipv6 field src-ip dst-ip protocol l4-src-port l4-dst-port
   hash-disturb 16
   aggregateport member linktrap
   aggregateport load-balance enhanced profile ruijie

#ssh登录限制
   line console 0
   session-timeout 10
   login local
   width 256

   line vty 0 9
   transport input ssh
   access-class 2001 in
   session-timeout 10
   login local
   width 256

#logging配置
   logging userinfo command-log
   logging trap warnings
   logging source interface Mgmt 0
   logging server 10.10.0.136 vrf NET-manage udp-port 5000 level warnings
   logging server 10.10.0.137 vrf NET-manage udp-port 5000 level warnings

---------------------------------------------------------------------------------------

vrf definition DMZ
rd 1:209
route-target both 1:209
address-family ipv4
exit-address-family
address-family ipv6
exit-address-family
!
vrf definition Internet
rd 1:200
route-target both 1:200
address-family ipv4
exit-address-family
address-family ipv6
exit-address-family
!
vrf definition NET-manage
description NET-manage
rd 1:1
route-target both 1:1
address-family ipv4
exit-address-family
address-family ipv6
exit-address-family
!
vrf definition OS_Inside
rd 1:301
route-target both 1:301
address-family ipv4
exit-address-family
address-family ipv6
exit-address-family
!
vrf definition OS_Internet
rd 2:200
route-target both 2:200
address-family ipv4
exit-address-family
address-family ipv6
exit-address-family

vlan 200
name OS_Internet
!
vlan 209
name For_DMZ
!
vlan 300
name OS_storage
!
vlan 301
name OS_inside
!
interface VLAN 200
description to-Internet
ip address 6.6.6.253 255.255.255.0
vrrp 4 ip 6.6.6.254
vrrp mode dual-active
vrrp 4 priority 110
!
interface VLAN 209
description For_DMZ
ip address 100.126.7.253 255.255.248.0
vrrp 3 ip 100.126.7.254
vrrp mode dual-active
vrrp 3 priority 110
!
interface VLAN 300
description For_Storage_Outside
ip address 10.30.11.253 255.255.252.0
vrrp 1 ip 10.30.11.254
vrrp mode dual-active
vrrp 1 priority 110
!
interface VLAN 301
description For_OS_Inside
vrf forwarding OS_Inside
ip address 10.30.7.253 255.255.248.0
vrrp 2 ip 10.30.7.254
vrrp mode dual-active
vrrp 2 priority 110
!
interface Mgmt 0
description For_NetworkManage
vrf forwarding NET-manage
ip address 10.30.0.22 255.255.254.0
!
ip route 0.0.0.0 0.0.0.0 VLAN 200 6.6.6.6 description For_Internet
ip route vrf NET-manage 0.0.0.0 0.0.0.0 10.30.1.254 description For_NET-manage
!