{"id":1044,"date":"2022-03-04T18:30:02","date_gmt":"2022-03-04T10:30:02","guid":{"rendered":"https:\/\/b.yesiyu.top\/?p=1044"},"modified":"2022-03-04T18:52:31","modified_gmt":"2022-03-04T10:52:31","slug":"h3c%e4%ba%a4%e6%8d%a2%e6%9c%ba%e5%b8%b8%e7%94%a8%e9%85%8d%e7%bd%ae","status":"publish","type":"post","link":"https:\/\/b.yesiyu.top\/?p=1044","title":{"rendered":"H3C\u4ea4\u6362\u673a\u5e38\u7528\u914d\u7f6e"},"content":{"rendered":"

H3C\u4ea4\u6362\u673a\u5e38\u7528\u914d\u7f6e
\n\u5806\u53e0\u914d\u7f6e
\nSWB<\/strong><\/p>\n

irf member 1 renumber 2
\nreboot
\nSWA<\/strong><\/p>\n

#\u4f18\u5148\u7ea7\u9ad8\u4e3a\u4e3b\u8bbe\u5907
\nirf member 1 priority 32
\n#\u914d\u7f6e\u524d\u9700\u5148\u5173\u95ed\u7aef\u53e3
\nint rang FortyGigE 1\/0\/53 to FortyGigE 1\/0\/54
\nshutdown
\n#\u628a\u5806\u53e0\u7aef\u53e3\u5212\u5165\u5806\u53e0\u53e3
\nirf-port 1\/1
\nport group interface FortyGigE1\/0\/53
\nport group interface FortyGigE1\/0\/54
\n#\u5f00\u542f\u7aef\u53e3
\nint rang FortyGigE 1\/0\/53 to FortyGigE 1\/0\/54
\nundo shutdown
\n#\u6fc0\u6d3b\u5806\u53e0\u914d\u7f6e
\nirf-port-configuration active
\nsave
\nSWB<\/strong><\/p>\n

int rang FortyGigE 2\/0\/53 to FortyGigE 2\/0\/54
\nshutdown
\n#\u8fd9\u91cc\u914d\u7f6e\u5806\u53e0\u7aef\u53e3\u8981\u4e0eSWA\u533a\u5206\uff0c\u4e0d\u80fd\u914d\u7f6e\u7a0b2\/1
\nirf-port 2\/2
\nport group interface FortyGigE2\/0\/53
\nport group interface FortyGigE2\/0\/54
\nint rang FortyGigE 2\/0\/53 to FortyGigE 2\/0\/54
\nundo shutdown
\nsave
\nirf-port-configuration active
\n#\u914d\u7f6e\u6210\u529fSWB\u4f1a\u81ea\u52a8\u91cd\u542f\u52a0\u5165\u5806\u53e0<\/p>\n

\u98ce\u6247\u914d\u7f6e<\/strong>
\nfan prefer-direction slot 1 port-to-power
\nfan prefer-direction slot 2 port-to-power<\/p>\n

\u8bbe\u5907\u547d\u540d
\nsysname xxx-xxx-xxx<\/p>\n

\u914d\u7f6e\u767b\u5f55\u540d<\/strong>
\n#\u914d\u7f6e\u672c\u5730\u7ba1\u7406\u8d26\u6237
\nlocal-user admin class manage
\n#\u914d\u7f6e\u5bc6\u7801
\npassword \uff08\u56de\u8f66\uff09
\nadmin
\n#\u6307\u5b9a\u7528\u6237\u670d\u52a1\u7c7b\u578b
\nservice-type ssh terminal
\n#\u6307\u5b9a\u7528\u6237\u4f7f\u7528\u89d2\u8272\u6743\u9650level-1
\nauthorization-attribute user-role level-1
\n#\u5220\u9664\u9ed8\u8ba4\u6743\u9650 network-operator
\nundo authorization-attribute user-role network-operator<\/p>\n

#\u914d\u7f6esuper\u5bc6\u7801
\nsuper password role network-admin\uff08\u56de\u8f66\uff09
\nadmin
\n\u6743\u9650\u8865\u5145\u8bf4\u660e<\/p>\n

\u9ed8\u8ba4\u89d2\u8272\u7684\u6743\u9650\u7ea7\u522b\u5982\u4e0b\uff1a<\/p>\n

network-admin\uff1a\u5177\u6709\u6700\u9ad8\u6743\u9650\uff0c\u53ef\u64cd\u4f5c\u7cfb\u7edf\u6240\u6709\u529f\u80fd\u548c\u8d44\u6e90(\u9664\u5b89\u5168\u65e5\u5fd7\u6587\u4ef6\u7ba1\u7406\u76f8\u5173\u547d\u4ee4\u5916)\uff0c\u914d\u7f6e\u6b64\u6743\u9650\u9ed8\u8ba4\u4f1a\u7ed9network-operator\u6743\u9650\u3002
\nnetwork-operator\uff1a\u53ef\u6267\u884c\u7cfb\u7edf\u6240\u6709\u529f\u80fd\u548c\u8d44\u6e90\u7684\u76f8\u5173display\u547d\u4ee4\uff08\u9664\u5b89\u5168\u65e5\u5fd7\u7b49\u67e5\u770b\u547d\u4ee4\u5916\uff0c\u5177\u4f53\u5927\u5bb6\u53ef\u4ee5\u81ea\u884c\u67e5\u770b\uff09\u3002
\nLevel-n(0-15):\u6570\u503c\u8d8a\u5927\uff0c\u6743\u9650\u8d8a\u5927\u3002level-15\u76f8\u5f53\u4e8enetwork-admin\u6743\u9650\u3002
\nsecurity-audit\uff1a\u5b89\u5168\u65e5\u5fd7\u7ba1\u7406\u5458\u6743\u9650\uff0c\u4ec5\u5177\u6709\u5b89\u5168\u65e5\u5fd7\u7684\u8bfb\u3001\u5199\u3001\u6267\u884c\u6743\u9650\u3002<\/p>\n

\u914d\u7f6eSSH AAA\u767b\u5f55<\/strong>
\n\u914d\u7f6eHWTACACS<\/p>\n

radius scheme h3c
\n#\u914d\u7f6e\u4e3b\u8ba4\u8bc1\/\u6388\u6743\u670d\u52a1\u5668\u7684IP \u5730\u5740\u4e3a192.168.1.100
\nprimary authentication 192.168.1.100
\nprimary accounting 192.168.1.100
\n#\u914d\u7f6e\u4e0e\u8ba4\u8bc1\u670d\u52a1\u5668\u4ea4\u4e92\u62a5\u6587\u65f6\u7684\u5171\u4eab\u5bc6\u94a5
\nkey authentication cipher $c$3$BBufRo18awo09z3IxgNBsClQBQwnOAxZ6w==
\n#\u914d\u7f6e\u4e0e\u5ba1\u8ba1\u670d\u52a1\u5668\u4ea4\u4e92\u62a5\u6587\u65f6\u7684\u5171\u4eab\u5bc6\u94a5
\nkey accounting cipher $c$3$f0ULDv1OtVbdXaUOtSMTR8SMbd6h00xIGQ==
\n#\u914d\u7f6e\u5411\u670d\u52a1\u5668\u53d1\u9001\u7684\u7528\u6237\u540d\u4e0d\u643a\u5e26\u57df\u540d
\nuser-name-format without-domain
\n# \u914d\u7f6e\u53d1\u9001RADIUS \u62a5\u6587\u4f7f\u7528\u7684\u6e90\u5730\u5740\u4e3a
\nnas-ip xxx.xxx.xxx.xxx(\u672c\u8bbe\u5907\u5730\u5740\uff09<\/p>\n

\u8865\u5145\uff1a
\n\u4e3a\u4fdd\u8bc1\u8ba4\u8bc1\u548c\u8ba1\u8d39\u62a5\u6587\u53ef\u88ab\u670d\u52a1\u5668\u6b63\u5e38\u63a5\u6536\u5e76\u5904\u7406\uff0c\u63a5\u5165\u8bbe\u5907\u4e0a\u53d1\u9001RADIUS \u62a5\u6587\u4f7f\u7528\u7684\u6e90\u5730\u5740\u5fc5\u987b\u4e0eRADIUS \u670d\u52a1\u5668\u4e0a\u6307\u5b9a\u7684\u63a5\u5165\u8bbe\u5907\u7684IP \u5730\u5740\u4fdd\u6301\u4e00\u81f4\u3002<\/p>\n

\u8bbe\u7f6e\u767b\u5f55\u57df<\/strong><\/p>\n

domain h3c
\n#\u8ba4\u8bc1\u6388\u6743\u987a\u5e8fcams->local
\nauthentication login radius-scheme h3c local
\nauthorization login radius-scheme h3c local
\n#\u5ba1\u8ba1\u65e0
\naccounting default none
\ndomain default enable system h3c<\/p>\n

\u542f\u7528SSH \u670d\u52a1<\/strong><\/p>\n

public-key local create rsa
\n#\u751f\u6210\u5bc6\u94a5
\nssh server enable
\n#\u8bbe\u7f6e\u767b\u5f55\u9650\u5236
\nssh server acl 3999
\n#\u5173\u95ed\u517c\u5bb9SSH1\u7248\u672c
\nundo ssh server compatible-ssh1x enable
\n\u8bbe\u7f6e\u767b\u5f55\u8ba4\u8bc1<\/p>\n

line vty 0 63
\n#\u8bbe\u7f6e\u7528\u6237\u767b\u5f55\u91c7\u7528AAA\u8ba4\u8bc1
\nauthentication-mode scheme
\nuser-role level-1
\n#\u8bbe\u7f6e\u81ea\u52a8\u9000\u51fa\u65f6\u95f45\u5206\u949f
\nidle-timeout 5 0<\/p>\n

line class aux
\nauthentication-mode scheme
\nuser-role level-1<\/p>\n

line class vty
\nauthentication-mode scheme
\nuser-role level-1<\/p>\n

line aux 0 1
\nauthentication-mode scheme
\nuser-role level-1<\/p>\n

\u65f6\u533a\u914d\u7f6e<\/strong>
\nclock timezone beijing add 08:00:00
\nNTP\u670d\u52a1\u5668\u8bbe\u7f6e<\/p>\n

ntp-service enable
\nntp-service unicast-server 192.168.1.1
\nntp-service unicast-server 192.168.1.2
\nntp-service unicast-server 192.168.1.3
\nsnmp\u8bbe\u7f6e
\nsnmp-agent
\nsnmp-agent community read PUBLIC
\nsnmp-agent sys-info version all
\nsnmp-agent target-host trap address udp-domain xxx.xxx.xxx.xxx params securityname PUBLIC v2c<\/p>\n

stp\u76f8\u5173\u8bbe\u7f6e<\/strong><\/p>\n

#\u8bbe\u7f6e\u6839
\nstp enable
\nstp instance 0 root primary<\/p>\n

#\u8bbe\u7f6e\u8fb9\u7f18\u7aef\u53e3
\ninterface GigabitEthernet1\/0\/1
\nstp edged-port enable<\/p>\n

#\u7aef\u53e3\u6839\u4fdd\u62a4
\ninterface GigabitEthernet1\/0\/1
\nstp root-protection
\nDHCP\u8bbe\u7f6e
\ndhcp \u670d\u52a1\u5668\u914d\u7f6e<\/p>\n

#\u542f\u7528dhcp\u670d\u52a1
\ndhcp enable<\/p>\n

int vlan 1
\n#\u9ed8\u8ba4\u662fserver
\ndhcp select server
\nip address 192.168.100.254 255.255.255.0<\/p>\n

#\u914d\u7f6e\u4e0d\u53c2\u4e0e\u81ea\u52a8\u5206\u914d\u7684IP \u5730\u5740
\ndhcp server forbidden-ip 192.168.100.200<\/p>\n

#\u914d\u7f6edhcp\u5730\u5740\u6c60
\ndhcp server ip-pool 1
\n#\u914d\u7f6e\u4e3aDHCP\u5ba2\u6237\u7aef\u5206\u914d\u7684\u7f51\u5173\u5730
\ngateway-list 192.168.100.254
\n#\u5206\u914d\u7f51\u6bb5
\nnetwork 192.168.100.0 mask 255.255.255.0
\n#\u914d\u7f6e\u4e3aDHCP\u5ba2\u6237\u7aef\u5206\u914d\u7684DNS\u670d\u52a1\u5668\u5730\u5740
\ndns-list 8.8.8.8
\ndhcp\u4e2d\u7ee7\u914d\u7f6e<\/p>\n

#\u542f\u7528dhcp\u670d\u52a1
\ndhcp enable<\/p>\n

int vlan 1
\nip address 192.168.100.254 255.255.255.0
\ndhcp select relay
\ndhcp relay server-address xxx.xxx.xxx.xxx
\nTrack\u4e0eNQA\u8054\u52a8
\n\u914d\u7f6eNQA\u6d4b\u8bd5\u7ec4<\/p>\n

\u521b\u5efa\u7ba1\u7406\u5458\u540d\u4e3aadmin \u64cd\u4f5c\u6807\u7b7e\u4e3atest\u7684NQA\u6d4b\u8bd5\u7ec4
\ntype\u4e3a\uff1aicmp-echo
\n\u76ee\u6807\u5730\u5740\uff1a10.88.40.174
\n\u6d4b\u8bd5\u9891\u7387\uff1a1000ms
\n\u914d\u7f6e\u8054\u52a8\u98791\uff1a\u8fde\u7eed\u5931\u8d252\u6b21\u89e6\u53d1\u8054\u52a8<\/p>\n

nqa entry admin test
\ntype icmp-echo
\ndestination ip 10.88.40.174
\nfrequency 1000
\nreaction 1 checked-element probe-fail threshold-type consecutive 2 action-type trigger-only<\/p>\n

\u542f\u52a8\u63a2\u6d4b<\/strong><\/p>\n

nqa schedule admin test start-time now lifetime forever
\n\u521b\u5efa\u4e0eNQA\u6d4b\u8bd5\u7ec4\u4e2d\u6307\u5b9a\u8054\u52a8\u9879\u5173\u8054\u7684Track\u9879<\/p>\n

track 1 nqa entry admin test reaction 1
\n\u5e94\u7528track 1<\/p>\n

#track1\u76d1\u63a7\u76ee\u7684\u5730\u5740\u4e0d\u53ef\u8fbe\u5219\u5c06\u9759\u6001\u8def\u7531\u7f6e\u4e3a\u65e0\u6548
\nip route-static 0.0.0.0 0.0.0.0 10.88.200.38 track 1
\nQOS
\n#\u5b9a\u4e49ACL
\nacl number 3999
\nrule 0 permit ip destination 10.88.1.8 0<\/p>\n

#\u5b9a\u4e49\u7c7b
\ntraffic classifier FTP operator and
\nif-match acl 3999<\/p>\n

#\u5b9a\u4e49\u6d41\u884c\u4e3a
\ntraffic behavior FTP
\ncar cir 64 cbs 4000 ebs 0 green pass red remark-dscp-pass cs1 yellow pass<\/p>\n

#\u5b9a\u4e49\u7b56\u7565
\nqos policy FTP
\nclassifier FTP behavior FTP<\/p>\n

#\u5e94\u7528\u7b56\u7565
\ninterface GigabitEthernet1\/0\/20
\nqos apply policy FTP outbound
\n\u4f18\u5316
\n#\u5173\u95edhttp
\nundo ip http enable<\/p>\n

#\u5173\u95ed\u8bbe\u5907\u7684ICMP\u8d85\u65f6\u62a5\u6587\u7684\u53d1\u9001\u529f\u80fd\u3002
\nundo ip ttl-expires<\/p>\n

#log\u670d\u52a1\u5668\u8bbe\u7f6e
\ninfo-center loghost 10.88.2.153<\/p>\n

\u2014\u2014\u2014\u2014\u2014\u2014\u2014\u2014\u2014\u2014\u2014\u2014\u2014\u2014\u2014\u2014
\n\u7248\u6743\u58f0\u660e\uff1a\u672c\u6587\u4e3aCSDN\u535a\u4e3b\u300ceighteenxu\u300d\u7684\u539f\u521b\u6587\u7ae0\uff0c\u9075\u5faaCC 4.0 BY-SA\u7248\u6743\u534f\u8bae\uff0c\u8f6c\u8f7d\u8bf7\u9644\u4e0a\u539f\u6587\u51fa\u5904\u94fe\u63a5\u53ca\u672c\u58f0\u660e\u3002
\n\u539f\u6587\u94fe\u63a5\uff1ahttps:\/\/blog.csdn.net\/eighteenxu\/article\/details\/80992130<\/p>\n","protected":false},"excerpt":{"rendered":"

H3C\u4ea4\u6362\u673a\u5e38\u7528\u914d\u7f6e \u5806\u53e0\u914d\u7f6e SWB irf member 1 renumber 2 reboot SWA … <\/p>\n

\u7ee7\u7eed\u9605\u8bfb\u201cH3C\u4ea4\u6362\u673a\u5e38\u7528\u914d\u7f6e\u201d<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-1044","post","type-post","status-publish","format-standard","hentry","category-1"],"_links":{"self":[{"href":"https:\/\/b.yesiyu.top\/index.php?rest_route=\/wp\/v2\/posts\/1044","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/b.yesiyu.top\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/b.yesiyu.top\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/b.yesiyu.top\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/b.yesiyu.top\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1044"}],"version-history":[{"count":1,"href":"https:\/\/b.yesiyu.top\/index.php?rest_route=\/wp\/v2\/posts\/1044\/revisions"}],"predecessor-version":[{"id":1045,"href":"https:\/\/b.yesiyu.top\/index.php?rest_route=\/wp\/v2\/posts\/1044\/revisions\/1045"}],"wp:attachment":[{"href":"https:\/\/b.yesiyu.top\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1044"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/b.yesiyu.top\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1044"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/b.yesiyu.top\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1044"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}