神州數(shù)碼路由交換配置命令(全)WORD版

《神州數(shù)碼路由交換配置命令(全)WORD版》由會(huì)員分享，可在線閱讀，更多相關(guān)《神州數(shù)碼路由交換配置命令(全)WORD版（14頁(yè)珍藏版）》請(qǐng)?jiān)谘b配圖網(wǎng)上搜索。

路由sshaaa authentication login ssh localaaa authentication enable default enableenable password 0 123456 username admin password 0 123456 ip sshd enableip sshd auth-method sship sshd auth-retries 5ip sshd timeout 60TELNETR1_config#aaa authentication login default localR1_config#aaa authentication enable default enable R1_config#enable password 0 ruijieR1_config#line vty 0 4R1_config_line#login authentication defaultR1_config_line#password 0 cisco方法 2，不需要經(jīng)過(guò) 3A 認(rèn)證R1_config#aaa authentication login default noneR1_config#aaa authentication enable default enableR1_config#enable password 0 ciscoR1_config#line vty 0 4R1_config_line#login authentication defaultCHAP 認(rèn)證 單向認(rèn)證，密碼可以不一致R2_config#aaa authentication ppp test localR2_config#username R2 password 0 123456R2_config_s0/2#enc pppR2_config_s0/2#ppp authentication chap testR2_config_s0/2#ppp chap hostname R1R1_config#aaa authentication ppp test localR1_config#username R1 password 0 123456R1_config_s0/1#enc pppR1_config_s0/1#ppp authentication chap testR1_config_s0/1#ppp chap hostname R2pap 認(rèn)證 雙向認(rèn)證，密碼要求一致R2_config#aaa authentication ppp test localR2_config#username R2 password 0 123456R2_config_s0/2#enc pppR2_config_s0/2#ppp authentication pap testR2_config_s0/2#ppp pap sent-username R1 password 123456R1_config#aaa authentication ppp test localR1_config#username R1 password 0 123456R1_config_s0/1#enc pppR1_config_s0/1#ppp authentication pap testR1_config_s0/1#ppp pap sent-username R2 password 123456FRRouter-A_config_s1/1#encapsulation frame-relay ！封裝幀中繼協(xié)議 Router-A_config_s1/1#frame-relay local-dlci 17 ！設(shè)置本地 DLCI 號(hào) Router-A_config_s1/1# frame-relay intf-type dce ！配置 FR 的 DCE Router-A_config_s1/1# frame-relay map 192.168.1.2 pvc 17 broadcast ！配置 DLCI 與對(duì)端 IP 的映射 VrrpInt g0/4vrrp 1 associate 192.168.20.254 255.255.255.0vrrp 1 priority 120 設(shè)置優(yōu)先級(jí)，為主vrrp 1 preempt 開(kāi)啟搶占vrrp 1 track interface Serial0/1 30 追蹤上行接口，防止上行接口 DOWN 了，自動(dòng)降低優(yōu)先級(jí)Int g0/6vrrp 1 associate 192.168.20.254 255.255.255.0vrrp 1 priority 100 設(shè)置優(yōu)先級(jí)，為備，默認(rèn)為 100vrrp 1 preempt 開(kāi)啟搶占vrrp 1 track interface Serial0/2 30 追蹤上行接口，防止上行接口 DOWN 了，自動(dòng)降低優(yōu)先級(jí)RIP 驗(yàn)證，只有 V2 支持驗(yàn)證interface Serial0/2 接口起驗(yàn)證和配密碼ip rip authentication simpleip rip password 123456RIP 改單播router ripnei 192.168.1.1 RIP 定時(shí)器router riptimers update 10 更新時(shí)間timers exipire 30 失效時(shí)間timers hosddown 50 抑制時(shí)間ospfrouter os 1net 192.168.1.0 255.255.255.0 ar 0 不能寫(xiě) 32 位掩碼OSPF 虛鏈路ROUTER OS 2 進(jìn)程起用AR 1 VI 2.2.2.2 對(duì)方 ROUTER-IDOSPF 匯總ROUTER OS 2 進(jìn)程起用ar 0 range 192.168.0.0 255.255.252.0OSPF 驗(yàn)證ROUTER OS 2 明文AR 0 AUTHEN SP 進(jìn)程給需要驗(yàn)證的區(qū)域啟用驗(yàn)證 INT S0/1IP OS passw 123456 接口配置密碼密文router os 2ar 0 authen meint s0/1ip os me 1 md5 123456bgp router bgp 100 no synchronization bgp 全互聯(lián)必須要關(guān)閉同步檢查nei 192.168.12.1 remot 200 與 AS 外部路由建立鄰居 nei 2.2.2.2 remot 100 與 AS 內(nèi)部路由建立鄰居nei 2.2.2.2 up lo0 改更新接口為環(huán)回接口nei 2.2.2.2 next-hop-self 改下一跳為自己net 2.2.2.0 通告路由表里面有的路由ACL路由上面的 ACL 要寫(xiě)子網(wǎng)掩碼,不能寫(xiě)反掩碼?。。。?！基于時(shí)間的 ACLtime-range acl 定義一個(gè)時(shí)間范圍periodic weekdays 09:00 to 12:00periodic weekdays 14:00 to 17:00IP access－list extended time 寫(xiě)一個(gè)基于時(shí)間的 acl，調(diào)用時(shí)間段deny ip 192.168.10.0 255.255.255.0 any time-range aclpermit ip any anyint g0/4 應(yīng)用到接口ip access-group time inint g0/6ip access-group time in靜態(tài) NATip route 0.0.0.0 0.0.0.0 192.168.12.2ip nat inside source static 192.168.10.10 192.168.12.1int g0/6ip nat inints0/1ip nat outNAPTip access-list standard NAT 定義要轉(zhuǎn)換的 IP 網(wǎng)段permit 192.168.10.0 255.255.255.0ip nat pool NAT 192.168.23.10 192.168.23.20 255.255.255.0 創(chuàng)建轉(zhuǎn)換的 IP 地址池ip nat inside source list NAT pool NAT overload 關(guān)聯(lián)要轉(zhuǎn)換的 IP 網(wǎng)段和地址池 ip route default 192.168.23.3 寫(xiě)一條缺省路由，下一跳為出口網(wǎng)關(guān)的下一跳router rip 如果跑路由協(xié)議，要把缺省重分發(fā)到動(dòng)態(tài)路由redistribute static interface Serial0/1 運(yùn)用到內(nèi)網(wǎng)接口 ip nat inside interface Serial0/2 運(yùn)用到外網(wǎng)接口ip nat outsideroute-mapip acce sta acl 定義要匹配的流量per 192.168.20.0 255.255.255.0 route-map SHENMA 10 permit ma ip add acl 調(diào)用 ACLset ip next-hop 192.168.12.1 改下一跳int g0/3ip po route-map SHENMA 定義到原接口DHCP給路由接口分配 IP，不能是 S 口?。?！R1ip dhcpd enableip dhcpd pool 1network 192.168.12.0 255.255.255.0range 192.168.12.10 192.168.12.20R2interface GigaEthernet0/6ip address dhcp給 PC 分配 IP,底層網(wǎng)絡(luò)要起路由互通?。。。?shí)驗(yàn)全網(wǎng)起了 RIP 協(xié)議R1ip dhcpd enableip dhcpd pool 2network 192.168.1.0 255.255.255.0range 192.168.1.10 192.168.1.20default-router 192.168.1.1R2ip dhcpd enable 要開(kāi)啟 DHCP 服務(wù)！interface GigaEthernet0/4ip address 192.168.1.1 255.255.255.0ip helper-address 192.168.12.2 設(shè)置 DHCP 服務(wù)器 IPVPN （GRE）int t0ip add 172.168.10.1 255.255.255.0 給 T0 配 IPt so s0/2 源，路由的出接口t de 192.168.23.3 目的，對(duì)端的出接口 IP，注意，要可達(dá)t key 123456 T0 口密碼，兩端要一致exitip route 192.168.20.0 255.255.255.0 t0 用 T0 口寫(xiě)一條要到達(dá)網(wǎng)段的靜態(tài)路由int t0ip add 172.168.10.3 255.255.255.0t so s0/1t de 192.168.12.1t key 123456exitip route 192.168.10.0 255.255.255.0 t0VPN (IPSEC)R1crypto ipsec transform-set SHENMA 設(shè)置轉(zhuǎn)換集transform-type esp-des esp-md5-hmac 轉(zhuǎn)換集的加密方式ip access-list extended 100 匹配感興趣流permit ip 192.168.10.0 255.255.255.0 192.168.20.0 255.255.255.0crypto map HAN 10 ipsec-isakmp set peer 192.168.23.3 設(shè)置對(duì)等體set transform-set SHENMA 關(guān)聯(lián)轉(zhuǎn)換集 match address 100 關(guān)聯(lián)感興趣流interface Serial0/2 進(jìn)接口調(diào)用crypto map HANR3crypto ipsec transform-set SHENMA 設(shè)置轉(zhuǎn)換集transform-type esp-des esp-md5-hmac 轉(zhuǎn)換集的加密方式,兩端要一致ip access-list extended 100 匹配感興趣流permit ip 192.168.20.0 255.255.255.0 192.168.10.0 255.255.255.0crypto map HAN 10 ipsec-isakmp set peer 192.168.12.1 設(shè)置對(duì)等體set transform-set SHENMA 關(guān)聯(lián)轉(zhuǎn)換集 match address 100 關(guān)聯(lián)感興趣流interface Serial0/1 進(jìn)接口調(diào)用crypto map HAN VPN (IKE)crypto isakmp key SHENMA 192.168.23.3 255.255.255.0 設(shè)置公共用密鑰crypto isakmp policy 10 設(shè)置 IKE 策略hash md5 au preenc desgroup 1lifetime 86400crypto ipsec transform-set SHENMA 設(shè)置轉(zhuǎn)換集transform-type esp-Des esp-Md5-hmacip access-list extended 100 匹配感興趣流permit ip 192.168.10.0 255.255.255.0 192.168.30.0 255.255.255.0crypto map SHENMA 10 ipsec-isakmp 設(shè)置 IPSEC 加密映射set peer 192.168.23.3set transform-set SHENMAmatch address 100int s0/2 調(diào)用到接口crypto map SHENMAQOSint g0/4ip add 192.168.10.1 255.255.255.0no shutint g0/6ip add 192.168.20.1 255.255.255.0no shutint s0/1ip add 192.168.12.1 255.255.255.0phy spe 64000no shutip route 0.0.0.0 0.0.0.0 192.168.12.2 ip access-list ex 1 定義 ACL 抓取流量permit ip 192.168.10.0 255.255.255.0 2.2.2.0 255.255.255.0ip access-list ex 2permit ip 192.168.20.0 255.255.255.0 2.2.2.0 255.255.255.0priority 1 protocol ip high list 1 寫(xiě)一個(gè) IP 協(xié)議的優(yōu)先列表，調(diào)用 ACL 1 里面的地址，級(jí)別為 HIGH priority 1 protocol ip low list 2 寫(xiě)一個(gè) IP 協(xié)議的優(yōu)先列表，調(diào)用 ACL 2 里面的地址，級(jí)別為 LOW int s0/1 進(jìn)接口調(diào)用priority 1 交換banner motd 系統(tǒng)登錄標(biāo)題telnettelnet-server enable 開(kāi)啟 TELNETtelnet-server max-connection 16 最大連接數(shù)sshusername ssh password 0 123456 ssh-server enable 開(kāi)啟 SSHssh-server timeout 60 連接超時(shí)時(shí)間ssh-server max-connection 16 最大連接數(shù)ssh-server authentication-retries 5 重連次數(shù)ssh-server host-key create rsa 創(chuàng)建新的主機(jī)密鑰vrrp1，首先要給所有的 VLAN 配上 IPINT VLAN 10IP ADD 192.168.10.1 255.255.255.0NO SHUT2，創(chuàng)建一個(gè) VRRP 組ROUTER VRRP 10VIRTUAL-IP 192.168.10.254 給虛擬 IPINT VLAN 10 關(guān)聯(lián) VLANPRIORITY 120 給優(yōu)先級(jí)（默認(rèn) 100）ENABLE 激活STPSW1spanning-tree 開(kāi)啟 STPspanning-tree mode mstp 改為 MSTP 模式spanning-tree mst configurtaion 配置域name shenma 域名revision-level 3 修正級(jí)別instance 1 vlan 10;20 在實(shí)例里面關(guān)聯(lián) VLANinstance 2 vlan 30;40 exitspanning-tree mst 1 priority 4096 給實(shí)例配置優(yōu)先級(jí)，越小的級(jí)別越高spanning-tree mst 2 priority 8192SW2spanning-tree 開(kāi)啟 STPspanning-tree mode mstp 改為 MSTP 模式spanning-tree mst configurtaion 配置域name shenma 域名revision-level 3 修正級(jí)別instance 1 vlan 10;20 在實(shí)例里面關(guān)聯(lián) VLANinstance 2 vlan 30;40 exitspanning-tree mst 1 priority 8192 給實(shí)例配置優(yōu)先級(jí)，越小的級(jí)別越高spanning-tree mst 2 priority 4096SW21spanning-tree 開(kāi)啟 STPspanning-tree mode mstp 改為 MSTP 模式spanning-tree mst configurtaion 配置域name shenma 域名revision-level 3 修正級(jí)別instance 1 vlan 10;20 在實(shí)例里面關(guān)聯(lián) VLANinstance 2 vlan 30;40 AM 端口安全am enableint e1/0/1am port am mac-ip-pool 0000.1111.2222 192.168.10.1端口鏡像monitor session 1 source int e1/0/1 bothmonitor session 1 destination int e1/0/15RIPRouter rip Net 192.168.1.0/24Router os 1Net 192.168.1.0 0.0.0.255 ar 0AclFirewall enableIp access-list ex 100Per ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255 單臂路由R1 int g0/5no shutinterface GigaEthernet0/5.1encapsulation dot1Q 100ip address 192.168.10.1 255.255.255.0interface GigaEthernet0/5.2encapsulation dot1Q 200ip address 192.168.20.1 255.255.255.0interface GigaEthernet0/5.3encapsulation dot1Q 300ip address 192.168.30.1 255.255.255.0SW1vlan 100\sw int e1/0/1-2vlan 200sw int e1/0/3-4vlan 300sw int e1/0/5-6int e1/0/20sw mo trsw tr all vlan all端口聚合PORT-GROUP 1 創(chuàng)建一個(gè)組INT E1/0/17-18 聚合端口要設(shè)置為 TRUNK SW MO TR SW TR ALL VLAN ALL PORT-GROUP 1 MO ON 設(shè)置聚合端口的模式為自動(dòng)匹配EXITINT PORT-CHANNAL 1 進(jìn)入聚合端口配置模式，也要設(shè)置為 TRUNKSW MO TR SW TR ALL VLAN ALLEXITdhcpSERV DHCP 開(kāi)啟 DHCP 服務(wù)IP DHCP POOL VLAN10 創(chuàng)建地址池NETW 192.168.10.0 255.255.255.0def 192.168.10.1le 2dns 8.8.8.8ip dhcp ex 192.168.10.1 192.168.10.10 排除地址范圍dhcp 中繼serv dhcpip for udp bootint vlan 10ip he 192.168.12.2dhcp snoopingserv dhcp 開(kāi)啟 DHCP 服務(wù)ip dhcp snooping enable 開(kāi)啟 DHCP SNOOPING 功能ip dhcp snooping binding enable 開(kāi)啟 SNOOPING 綁定功能int e1/0/20 ip dhcp snooping trust 設(shè)置接口為信任接口，一般是與服務(wù)器相連的接口int e1/0/1 ip dhcp snooping binding user-control 設(shè)置端口自動(dòng)綁定獲取 DHCP 的地址設(shè)置端口手動(dòng)綁定 MAC,VLAN,IP,端口信息（全局模式） ip dhcp snooping binding user 00-11-22-33-44-55 address 192.168.22.22 vlan 1 int e1/0/5 ipv66 to 4greipv6 unicast-routing 允許單播路由interface Tunnel0ipv6 enable 開(kāi)啟 IPV6ipv6 address 2001:23::1/64tunnel source 192.168.12.1 本端接口地址tunnel destination 192.168.12.2 對(duì)端接口地址tunnel mode gre ip 隧道模式改為 GREtunnel key 123456 隧道密碼，兩端一致ipv6 route 3::/64 Tunnel0 寫(xiě)一條下一跳為 TUNNEL 0 的 IPV6 靜態(tài)，不能寫(xiě)默認(rèn)靜態(tài) natInternet(config)#ip route 0.0.0.0 0.0.0.0 fa0/1 ipv4 網(wǎng)絡(luò)要可達(dá)NAT-PT(config)#ip route 0.0.0.0 0.0.0.0 fa0/1NAT-PT(config)#ipv6 nat prefix 2001:db8:feed::/96 設(shè)置一個(gè)全局 NAT 前綴，掩碼必須 96 位 NAT-PT(config)#ipv6 nat v4v6 source 10.10.10.2 2001:db8:feed::2 寫(xiě) 4 TO 6 地址轉(zhuǎn)換，需要到達(dá)的地址都要寫(xiě), 不需要與本地同一網(wǎng)段NAT-PT(config)#ipv6 nat v4v6 source 192.168.1.10 2001:db8:feed::3 NAT-PT(config)#ipv6 nat v6v4 source 2001:db8:cafe:ffff::2 10.10.20.5 寫(xiě) 6 to 4 地址轉(zhuǎn)換，需要到達(dá)的地址都要寫(xiě),不需要與本地同一網(wǎng)段int g0/4 調(diào)用到接口，進(jìn)出都要調(diào)用ipv6 natint g0/4ipv6 natpatipv4 網(wǎng)絡(luò)要可達(dá)NAT-PT(config)#ipv6 nat prefix 2001:db8:feed::/96 設(shè)置一個(gè)全局 NAT前綴，掩碼必須 96 位NAT-PT(config)#ipv6 nat v4v6 source 10.10.10.2 2001:db8:feed::2 寫(xiě) 4 TO 6 地址轉(zhuǎn)換，需要到達(dá)的地址都要寫(xiě)NAT-PT(config)#ipv6 nat v4v6 source 192.168.1.10 2001:db8:feed::3 不需要與本地同一網(wǎng)段NAT-PT(config)#ipv6 access-list cafe 把 IPV6 要轉(zhuǎn)換的網(wǎng)段匹配出來(lái)NAT-PT(config-ipv6-acl)#permit ipv6 2001:db8:cafe::/48 anyNAT-PT(config-ipv6-acl)#exitNAT-PT(config)#ipv6 nat v6v4 pool ipv4 10.10.20.5 10.10.20.6 prefix-length 24 寫(xiě)一個(gè) 6 TO 4 的 NAT 地址池,不需要已知網(wǎng)段NAT-PT(config)#ipv6 nat v6v4 source list cafe pool ipv4 overload 把要轉(zhuǎn)換的網(wǎng)段與地址池關(guān)聯(lián) int g0/4ipv6 natint g0/4ipv6 natripingipv6 router rip 100 全局創(chuàng)建 RIP 實(shí)例，名字為 100exitinterface GigaEthernet0/4 ipv6 enable 開(kāi)啟 IPV6ipv6 address 2001::1/64ipv6 rip 100 enable 啟動(dòng)為 100 的實(shí)例 需要宣告的接口要設(shè)置ospfv3ipv6 router ospf 1 全局創(chuàng)建 ospf，進(jìn)程為 1int g0/6ipv6 enableipv6 address 2001::1/64ipv6 ospf 1 area 0 宣告本接口為 area 0需要宣告的接口要設(shè)置