华为S5700系列交换机,是我们项目中用的较多的一款,其中24与48口应用较多。现在将华为交换机的一些常用配置整理一下,进行记录。如有错误,请指正。
允许华为交换机能telnet,设置密码为Admin@123
telnet server en
#
aaa
authentication-scheme default
authorization-scheme default
accounting-scheme default
domain default
domain default_admin
local-user huawei password cipher Admin@123
local-user huawei privilege level 15
local-user huawei service-type telnet terminal
local-user admin password cipher Admin@123
local-user admin service-type http
#
user-interface con 0
authentication-mode password
set authentication password cipher Admin@123
user-interface vty 0 4
protocol inbound telnet
authentication-mode aaa
user-interface vty 16 20
#
为交换机划分VLAN1001,VLAN1002,
设置vlan1001,接口IP地址为172.16.1.254(即网关地址),子网掩码为255.255.255.0
将g0/0/1~g0/0/24配置为vlan1001
防止arp攻击
vlan 1001
interface vlan 1001
ip addr 172.16.1.254 24
arp anti-attack gateway-duplicate enable
arp anti-attack rate-limit enable
arp-miss anti-attack rate-limit enable
port-group group1
group-member g0/0/1 to g0/0/24
port link-type access
port default vlan 1001
loopback-detect enable
arp anti-attack rate-limit enable
arp-miss anti-attack rate-limit enable
quit
将25~44端口划分为Trunk端口
port-group group2
group-member g0/0/25 to g0/0/44
port link-type trunk
port trunk allow-pass vlan 2 to 4094
loopback-detect enable
quit
将45、46创建链路聚合1,使用RJ45
将47、48创建链路聚合2,使用光纤
clear configuration inte g0/0/45
clear configuration inte g0/0/46
clear configuration inte g0/0/47
clear configuration inte g0/0/48
interface Eth-Trunk1
port link-type trunk
port trunk allow-pass vlan 2 to 4094
mode lacp
interface Eth-Trunk2
port link-type trunk
port trunk allow-pass vlan 2 to 4094
mode lacp
interface GigabitEthernet0/0/45
eth-trunk 1
interface GigabitEthernet0/0/46
eth-trunk 1
interface GigabitEthernet0/0/47
eth-trunk 2
combo-port fiber
interface GigabitEthernet0/0/48
eth-trunk 2
combo-port fiber
【说明】每个端口可能需要执行undo shutdown以激活端口。
原配置如下:
interface GigabitEthernet0/0/17
port link-type access
port default vlan 128
将g0/0/17端口配置为Trunk端口命令
undo port default vlan
undo port link-type
port link-type trunk
port trunk allow-pass vlan all
原配置如下
interface GigabitEthernet0/0/11
port link-type trunk
port trunk allow-pass vlan 2 to 4094
将g0/0/11端口配置为VLAN140命令
undo port trunk allow-pass vlan all
port trunk allow-pass vlan 1
port link-type access
port default vlan 140
(1)vlan2002的网关地址是172.18.92.254,DHCP地址池中排除172.18.92.200~252、172.18.92.253、DHCP的地址租约是1小时、DNS的地址是172.18.96.1
vlan batch 2001 to 2003
ip pool vlan2002
gateway-list 172.18.92.254
network 172.18.92.0 mask 255.255.255.0
excluded-ip-address 172.18.92.200 172.18.92.253
lease day 0 hour 1 minute 0
dns-list 172.18.96.1
#
interface Vlanif2002
ip address 172.18.92.254 255.255.255.0
dhcp select global
#
如果网络中有WDS(Windows部署服务),如果要为各个VLAN,允许从交换机通过DHCP获得IP地址,并且能从使用其他VLAN中的WDS部署系统(网络拓扑如图所示),则华为交换机DHCP可以进行如下的配置。
本示例配置了VLAN2001~VLAN2006,其中服务器属于VLAN2006,为VLAN2001~2006配置DHCP,并且允许这些VLAN中的计算机,能使用172.18.96.1的WDS安装、部署系统。其中172.18.96.1是Windows Server 2016 数据中心版。
sysname HW5700
#
vlan batch 2001 to 2006
#
ip pool vlan2001
gateway-list 172.18.91.254
network 172.18.91.0 mask 255.255.255.0
dns-list 172.18.96.1
next-server 172.18.96.1
option 66 ip-address 172.18.96.1
option 67 ascii Boot\x86\wdsnbp.com
bootfile Boot\wdsnbp.com
#
interface Vlanif2001
description 1_JiFang
ip address 172.18.91.254 255.255.255.0
dhcp select global
#
#
interface Vlanif2006
description Server
ip address 172.18.96.254 255.255.255.0
dhcp select global
#
【说明】:在交换机上指定DHCP中继(DHCP服务器是Windows Server中的DHCP)这是在早期华为或华三交换机上的配置,具体那个型号我记不清了,现在这些配置我基本上已经不用了,只是在这收集整理一下。
#
dhcp enable
#
dhcp server group dhcpgroup1
dhcp-server 172.30.5.3 0
dhcp-server 172.30.5.15 1
#
interface Vlanif2052
ip address 172.28.52.254 255.255.255.0
dhcp select relay
dhcp relay server-select dhcpgroup1
#
以下是摘录的华为官方帮助文档内容
# 在接口下使能DHCP中继功能。
[SwitchA] dhcp enable //使能DHCP服务,缺省未使能
[SwitchA] interface vlanif 100
[SwitchA-Vlanif100] ip address 10.10.20.1 24
[SwitchA-Vlanif100] dhcp select relay //使能DHCP中继功能,缺省未使能
[SwitchA-Vlanif100] dhcp relay server-ip 192.168.20.2 //配置DHCP中继代理的DHCP服务器的IP地址
[SwitchA-Vlanif100] quit
ip route-static 0.0.0.0 0.0.0.0 172.18.96.253
ip route-static 172.18.0.0 255.255.0.0 172.18.96.251
ip route-static 172.30.30.0 255.255.255.0 172.18.96.250
本文出自 “王春海的博客” 博客,谢绝转载!
原文地址:http://wangchunhai.blog.51cto.com/225186/1959724