中小企业型方案
要求：
某企业，专线接入，有华为路由器一台，三层交换机一台，二层交换机若干；
1、要求划几个 VLAN，为不同部门。
2、所有主机能够通过路由器上网。
设计思路：
1、路由器配置比较简单，主要做 NAT 转换和 ACL 控制哪些主机能
上外网；
2、三层交换机，划分 VLAN，实现内部 VLAN 间路由，可直接接终
端或二层交换机
3、二层交换相接终端。。
设计时，关于防病毒 ACL 列表、VLAN 间互联隔离技术等问题此处
未讨论。感兴趣的朋友，我们可以另起篇章进行讨论。
本设计以华为产品为例，思科产品配置原理相同，只是命令行不同而
已。欢迎有志之士把它翻译成思科的配置。
基实也可以不要三层交换机，直接在路由器上做单臂也可以。。只是
不适合复杂的网络和发展。。
配置：
一、路由器配置
version , Release 1205P02, Basic
#
给路由器命名
sysname HUAWE-ROUTE
#
domain default enable system
#
vlan 1
#
radius scheme system
server-type extended
primary authentication 1645
primary accounting 1646
user-name-format without-domain
#
domain system
access-limit disable
state active
idle-cut disable
self-service-url disable
#
定义 ACL 列表，允许所有 IP 访问外网，这里你可以指定允许某些或禁止某些主机上网。
acl number 2000
rule 0 permit
#
interface Aux0
async mode flow
link-protocol ppp
#
接专线的接口，配置运营商分配的 IP
interface Ethernet0/0
nat outbound 2000
duplex full
speed 100
ip address
#
接局域网三层交换机的地址
interface Ethernet0/1
DESC TO—SWitch
duplex full
speed 100
ip address
#
interface NULL0
#
至公网默认路由
ip route-static
至三层交换机回程路由
ip route-static
#
user-interface con 0
user-interface aux 0
未设置 TELNET 登陆密码，这样外网的人登陆不了，当然你也登陆不了。哈安全吧。（如果想 TEL
NET，需要设置密码和 ACL 禁止外网的人登陆）
user-interface vty 0 4
#
Return
二、三层交换配置
#
给交换机命名
sysname hwswich
#
设备 SUPER 密码
super password level 3 cipher ;1>$VGEA)N2C+1!!
#
radius scheme system
server-type huawei
primary authentication 1645
primary accounting 1646
user-name-format without-domain
domain system
radius-scheme system
access-limit disable
state active
vlan-assignment-mode integer
idle-cut disable
self-service-url disable
messenger time disable
domain default enable system
#
local-server nas-ip key huawei
建立业务 VLAN 及与路由器互联口 VLAN
vlan 5
desc to-router
#
vlan 10
desc bumen1
#
vlan 20
desc bumen2
#
分别给 SVI 接口设计 IP 地址，即所属 VLAN PC 终端的网关
#
interface Vlan-interface 5
DESC to-router
ip address
interface Vlan-interface 10
ip address
#
interface Vlan-interface 20
ip address
#
与二层交换机互联接口
interface Ethernet0/1
duplex full
speed 100
port link-type trunk
port trunk permit vlan 10 20
#
接普通终端的接口
interface Ethernet0/2
port access vlan 10
#
interface Ethernet0/3
port access vlan 20
#
interface Ethernet0/4
shutdown
#
interface Ethernet0/5
#
interface Ethernet0/6
shutdown
#
interface Ethernet0/7
shutdown
#
interface Ethernet0/8
shutdown
#
interface Ethernet0/9
shutdown
#
interface Ethernet0/10
shutdown
#
interface Ethernet0/11
shutdown
#
interface Ethernet0/12
shutdown
#
interface Ethernet0/13
shutdown
#
interface Ethernet0/14
shutdown
#
interface Ethernet0/15
shutdown
#
interface Ethernet0/16
shutdown
#
interface Ethernet0/17
shutdown
#
interface Ethernet0/18
shutdown
#
interface Ethernet0/19
shutdown
#
interface Ethernet0/20
shutdown
#
interface Ethernet0/21
shutdown
#
interface Ethernet0/22
shutdown
#
interface Ethernet0/23
shutdown
#
与路由器互联接口
interface Ethernet0/24
desc to-router
duplex full
speed 100
port access vlan 5
#
SNMP 网关配置，可以不要
snmp-agent
snmp-agent local-engineid 800007DB000FE23F864D6877
snmp-agent community read public
snmp-agent sys-info contact HuaWei_Hotline 4008302118or8008302118
snmp-agent sys-info location BeiJing China
snmp-agent sys-info version all
#
设置默认路由
ip route-static
user-interface aux 0
设置 TELNET 登陆密码
user-interface vty 0 4
authentication-mode password
set authentication password cipher CZP'5O+PV9=FQ!!
#
return
三、二层交换机配置
#
sysname L1-1
#
#
radius scheme system
server-type huawei
primary authentication 1645
primary accounting 1646
user-name-format without-domain
domain system
radius-scheme system
access-limit disable
state active
idle-cut disable
self-service-url disable
messenger time disable
domain default enable system
#
local-server nas-ip key huawei
#
interface Aux0/0
#
vlan 1
#
vlan 10
#
vlan 20
#
#
interface Ethernet0/1
port access vlan 10
#
interface Ethernet0/2
port access vlan 10
#
interface Ethernet0/3
port access vlan 10
#
interface Ethernet0/4
port access vlan 10
#
interface Ethernet0/5
port access vlan 10
#
interface Ethernet0/6
port access vlan 10
#
interface Ethernet0/7
port access vlan 10
#
interface Ethernet0/8
port access vlan 10
#
interface Ethernet0/9
port access vlan 10
#
interface Ethernet0/10
port access vlan 10
#
interface Ethernet0/11
port access vlan 10
#
interface Ethernet0/12
port access vlan 20
#
interface Ethernet0/13
port access vlan 20
#
interface Ethernet0/14
port access vlan 20
#
interface Ethernet0/15
port access vlan 20
#
interface Ethernet0/16
port access vlan 20
#
interface Ethernet0/17
port access vlan 20
#
interface Ethernet0/18
port access vlan 20
#
interface Ethernet0/19
port access vlan 20
#
interface Ethernet0/20
port access vlan 20
#
interface Ethernet0/21
port access vlan 20
#
interface Ethernet0/22
port access vlan 20
#
interface Ethernet0/23
port access vlan 20
#
interface Ethernet0/24
duplex full
speed 100
port link-type trunk
port trunk permit vlan 10 20
#
user-interface aux 0
user-interface vty 0 4
#
return
