2024年1月31日发(作者：以暄婷)
华为数通设备组网常用功能及配置【VLANDHCPSTPRIPOSPF静态默认路由NATACLIPSEC】网络图如下：设备配置如下：ISP配置（用一台路由器模拟运营商网络）[V200R003C00]#sysnameISP#snmp-agentlocal-engineid800007DB00snmp-agent#clocktimezoneChina-Standard-Timeminus08:00:00##dropillegal-macalarm#setcpu-usagethreshold80restore75#aaaauthentication-schemedefaultauthorization-schemedefaultaccounting-schemedefaultdomaindefaultdomaindefault_admin
local-useradminpasswordcipher%$%$84DZ}e#<0`8bmE3Uw}%$%$local-useradminservice-typehttp#firewallzoneLocalpriority15#interfaceGigabitEthernet0/0/0#interfaceGigabitEthernet0/0/1ipaddress202.96.11.254255.255.255.0#interfaceGigabitEthernet0/0/2ipaddress116.18.22.253255.255.255.0#interfaceNULL0#user-interfacecon0authentication-modepassworduser-interfacevty04user-interfacevty1620#wlanac#Return出口路由器R1配置[V200R003C00]#sysnameR1#snmp-agentlocal-engineid800007DB00snmp-agent#clocktimezoneChina-Standard-Timeminus08:00:00#portallocal-serverloadflash:/#dropillegal-macalarm#wlanac-globalcarrieridotheracid0#setcpu-usagethreshold80restore75#aclnumber3000rule1denyipsource192.168.0.00.0.255.255destination172.16.0.00.0.255.255rule5permitipsource192.168.0.00.0.255.255aclnumber3100rule5permitipsource192.168.0.00.0.255.255destination172.16.0.00.0.255.255#
ipsecproposal1espauthentication-algorithmsha2-256espencryption-algorithm3des#ikeproposal1encryption-algorithm3des-cbcdhgroup2authentication-algorithmmd5#ikepeerR2v2pre-shared-keysimplehuawei@123ike-proposal1remote-address116.18.22.1#ipsecpolicyp01isakmpsecurityacl3100ike-peerR2proposal1#aaaauthentication-schemedefaultauthorization-schemedefaultaccounting-schemedefaultdomaindefaultdomaindefault_adminlocal-useradminpasswordcipher%$%$84DZ}e#<0`8bmE3Uw}%$%$local-useradminservice-typehttp#firewallzoneLocalpriority15#interfaceGigabitEthernet0/0/0ipaddress192.168.30.1255.255.255.0#interfaceGigabitEthernet0/0/1ipaddress202.96.11.1255.255.255.0ipsecpolicyp0natoutbound3000#interfaceGigabitEthernet0/0/2#interfaceNULL0#rip1version2network192.168.30.0#iproute-static0.0.0.00.0.0.0202.96.11.254#
user-interfacecon0authentication-modepassworduser-interfacevty04user-interfacevty1620#wlanac#Return三层交换机SW1配置#sysnameSW1#vlanbatch102030#stpinstance0rootprimary#clusterenablentdpenablendpenable#dropillegal-macalarm#dhcpenable#diffservdomaindefault#drop-profiledefault#ippoolvlan10gateway-list192.168.10.254network192.168.10.0mask255.255.255.0excluded-ip-address192.168.10.250192.168.10.253leaseday0hour10minute0dns-list202.96.134.133202.96.128.86#ippoolvlan20gateway-list192.168.20.254network192.168.20.0mask255.255.255.0excluded-ip-address192.168.20.250192.168.20.253leaseday0hour10minute0dns-list202.96.134.133202.96.128.86#aaaauthentication-schemedefaultauthorization-schemedefaultaccounting-schemedefaultdomaindefaultdomaindefault_admin
local-useradminpasswordsimpleadminlocal-useradminservice-typehttp#interfaceVlanif1#interfaceVlanif10ipaddress192.168.10.254255.255.255.0dhcpselectglobal#interfaceVlanif20ipaddress192.168.20.254255.255.255.0dhcpselectglobal#interfaceVlanif30ipaddress192.168.30.254255.255.255.0#interfaceMEth0/0/1#interfaceGigabitEthernet0/0/1portlink-typetrunkporttrunkallow-passvlan10#interfaceGigabitEthernet0/0/2portlink-typetrunkporttrunkallow-passvlan20#interfaceGigabitEthernet0/0/3portlink-typeaccessportdefaultvlan30#interfaceGigabitEthernet0/0/4#interfaceGigabitEthernet0/0/5#interfaceGigabitEthernet0/0/6#interfaceGigabitEthernet0/0/7#interfaceGigabitEthernet0/0/8#interfaceGigabitEthernet0/0/9#interfaceGigabitEthernet0/0/10#interfaceGigabitEthernet0/0/11#interfaceGigabitEthernet0/0/12#interfaceGigabitEthernet0/0/13
#interfaceGigabitEthernet0/0/14#interfaceGigabitEthernet0/0/15#interfaceGigabitEthernet0/0/16#interfaceGigabitEthernet0/0/17#interfaceGigabitEthernet0/0/18#interfaceGigabitEthernet0/0/19#interfaceGigabitEthernet0/0/20#interfaceGigabitEthernet0/0/21#interfaceGigabitEthernet0/0/22#interfaceGigabitEthernet0/0/23#interfaceGigabitEthernet0/0/24#interfaceNULL0#rip1version2network192.168.10.0network192.168.20.0network192.168.30.0#iproute-static0.0.0.00.0.0.0192.168.30.1#user-interfacecon0user-interfacevty04#return接入交换机L1配置#sysnameL1#vlanbatch10#clusterenablentdpenablendpenable#dropillegal-macalarm
#dhcpenable#dhcpsnoopingenableipv4arpdhcp-snooping-detectenable#diffservdomaindefault#drop-profiledefault#aaaauthentication-schemedefaultauthorization-schemedefaultaccounting-schemedefaultdomaindefaultdomaindefault_adminlocal-useradminpasswordsimpleadminlocal-useradminservice-typehttp#interfaceVlanif1#interfaceMEth0/0/1#interfaceEthernet0/0/1portlink-typeaccessportdefaultvlan10stpedged-portenabledhcpsnoopingenable#interfaceEthernet0/0/2#interfaceEthernet0/0/3#interfaceEthernet0/0/4#interfaceEthernet0/0/5#interfaceEthernet0/0/6#interfaceEthernet0/0/7#interfaceEthernet0/0/8#interfaceEthernet0/0/9#interfaceEthernet0/0/10#interfaceEthernet0/0/11#
interfaceEthernet0/0/12#interfaceEthernet0/0/13#interfaceEthernet0/0/14#interfaceEthernet0/0/15#interfaceEthernet0/0/16#interfaceEthernet0/0/17#interfaceEthernet0/0/18#interfaceEthernet0/0/19#interfaceEthernet0/0/20#interfaceEthernet0/0/21#interfaceEthernet0/0/22#interfaceGigabitEthernet0/0/1portlink-typetrunkporttrunkallow-passvlan10dhcpsnoopingtrusted#interfaceGigabitEthernet0/0/2#interfaceNULL0#user-interfacecon0user-interfacevty04#return接入交换机L2配置#sysnameL2#vlanbatch20#clusterenablentdpenablendpenable#dropillegal-macalarm#dhcpenable
#dhcpsnoopingenableipv4arpdhcp-snooping-detectenable#diffservdomaindefault#drop-profiledefault#aaaauthentication-schemedefaultauthorization-schemedefaultaccounting-schemedefaultdomaindefaultdomaindefault_adminlocal-useradminpasswordsimpleadminlocal-useradminservice-typehttp#interfaceVlanif1#interfaceMEth0/0/1#interfaceEthernet0/0/1portlink-typeaccessportdefaultvlan20stpedged-portenabledhcpsnoopingenable#interfaceEthernet0/0/2#interfaceEthernet0/0/3#interfaceEthernet0/0/4#interfaceEthernet0/0/5#interfaceEthernet0/0/6#interfaceEthernet0/0/7#interfaceEthernet0/0/8#interfaceEthernet0/0/9#interfaceEthernet0/0/10#interfaceEthernet0/0/11#interfaceEthernet0/0/12#
interfaceEthernet0/0/13#interfaceEthernet0/0/14#interfaceEthernet0/0/15#interfaceEthernet0/0/16#interfaceEthernet0/0/17#interfaceEthernet0/0/18#interfaceEthernet0/0/19#interfaceEthernet0/0/20#interfaceEthernet0/0/21#interfaceEthernet0/0/22#interfaceGigabitEthernet0/0/1portlink-typetrunkporttrunkallow-passvlan20dhcpsnoopingtrusted#interfaceGigabitEthernet0/0/2#interfaceNULL0#user-interfacecon0user-interfacevty04#return出口路由器R2配置[V200R003C00]#sysnameR2#snmp-agentlocal-engineid800007DB00snmp-agent#clocktimezoneChina-Standard-Timeminus08:00:00#portallocal-serverloadflash:/#dropillegal-macalarm#wlanac-globalcarrieridotheracid0
#setcpu-usagethreshold80restore75#aclnumber3000rule5denyipsource172.16.0.00.0.255.255destination192.168.0.00.0.255.255rule10permitipsource172.16.0.00.0.255.255aclnumber3100rule5permitipsource172.16.0.00.0.255.255destination192.168.0.00.0.255.255#ipsecproposal1espauthentication-algorithmsha2-256espencryption-algorithm3des#ikeproposal1encryption-algorithm3des-cbcdhgroup2authentication-algorithmmd5#ikepeerR1v2pre-shared-keysimplehuawei@123ike-proposal1remote-address202.96.11.1#ipsecpolicyp01isakmpsecurityacl3100ike-peerR1proposal1#aaaauthentication-schemedefaultauthorization-schemedefaultaccounting-schemedefaultdomaindefaultdomaindefault_adminlocal-useradminpasswordcipher%$%$84DZ}e#<0`8bmE3Uw}%$%$local-useradminservice-typehttp#firewallzoneLocalpriority15#interfaceGigabitEthernet0/0/0ipaddress172.16.3.1255.255.255.0#interfaceGigabitEthernet0/0/1ipaddress116.18.22.1255.255.255.0ipsecpolicyp0natoutbound3000#interfaceGigabitEthernet0/0/2
#interfaceNULL0#ospf1area0.0.0.0network172.16.3.00.0.0.255#iproute-static0.0.0.00.0.0.0116.18.22.253#user-interfacecon0authentication-modepassworduser-interfacevty04user-interfacevty1620#wlanac#Return三层交换机SW2配置#sysnameSW2#vlanbatch102030#stpinstance0rootprimary#clusterenablentdpenablendpenable#dropillegal-macalarm#dhcpenable#diffservdomaindefault#drop-profiledefault#aaaauthentication-schemedefaultauthorization-schemedefaultaccounting-schemedefaultdomaindefaultdomaindefault_adminlocal-useradminpasswordsimpleadminlocal-useradminservice-typehttp#interfaceVlanif1#
interfaceVlanif10ipaddress172.16.1.254255.255.255.0dhcpselectinterfacedhcpserverleaseday0hour10minute0dhcpserverdns-list202.96.134.133202.96.128.86#interfaceVlanif20ipaddress172.16.2.254255.255.255.0dhcpselectinterfacedhcpserverleaseday0hour10minute0dhcpserverdns-list202.96.134.133202.96.128.86#interfaceVlanif30ipaddress172.16.3.254255.255.255.0#interfaceMEth0/0/1#interfaceGigabitEthernet0/0/1portlink-typetrunkporttrunkallow-passvlan10#interfaceGigabitEthernet0/0/2portlink-typetrunkporttrunkallow-passvlan20#interfaceGigabitEthernet0/0/3portlink-typeaccessportdefaultvlan30#interfaceGigabitEthernet0/0/4#interfaceGigabitEthernet0/0/5#interfaceGigabitEthernet0/0/6#interfaceGigabitEthernet0/0/7#interfaceGigabitEthernet0/0/8#interfaceGigabitEthernet0/0/9#interfaceGigabitEthernet0/0/10#interfaceGigabitEthernet0/0/11#interfaceGigabitEthernet0/0/12#interfaceGigabitEthernet0/0/13#
interfaceGigabitEthernet0/0/14#interfaceGigabitEthernet0/0/15#interfaceGigabitEthernet0/0/16#interfaceGigabitEthernet0/0/17#interfaceGigabitEthernet0/0/18#interfaceGigabitEthernet0/0/19#interfaceGigabitEthernet0/0/20#interfaceGigabitEthernet0/0/21#interfaceGigabitEthernet0/0/22#interfaceGigabitEthernet0/0/23#interfaceGigabitEthernet0/0/24#interfaceNULL0#ospf1area0.0.0.0network172.16.0.00.0.255.255#iproute-static0.0.0.00.0.0.0172.16.3.1#user-interfacecon0user-interfacevty04#return接入交换机L3配置#sysnameL3#vlanbatch10#clusterenablentdpenablendpenable#dropillegal-macalarm#dhcpenable#
dhcpsnoopingenableipv4arpdhcp-snooping-detectenable#diffservdomaindefault#drop-profiledefault#aaaauthentication-schemedefaultauthorization-schemedefaultaccounting-schemedefaultdomaindefaultdomaindefault_adminlocal-useradminpasswordsimpleadminlocal-useradminservice-typehttp#interfaceVlanif1#interfaceMEth0/0/1#interfaceEthernet0/0/1portlink-typeaccessportdefaultvlan10stpedged-portenabledhcpsnoopingenable#interfaceEthernet0/0/2#interfaceEthernet0/0/3#interfaceEthernet0/0/4#interfaceEthernet0/0/5#interfaceEthernet0/0/6#interfaceEthernet0/0/7#interfaceEthernet0/0/8#interfaceEthernet0/0/9#interfaceEthernet0/0/10#interfaceEthernet0/0/11#interfaceEthernet0/0/12#interfaceEthernet0/0/13
#interfaceEthernet0/0/14#interfaceEthernet0/0/15#interfaceEthernet0/0/16#interfaceEthernet0/0/17#interfaceEthernet0/0/18#interfaceEthernet0/0/19#interfaceEthernet0/0/20#interfaceEthernet0/0/21#interfaceEthernet0/0/22#interfaceGigabitEthernet0/0/1portlink-typetrunkporttrunkallow-passvlan10dhcpsnoopingtrusted#interfaceGigabitEthernet0/0/2#interfaceNULL0#user-interfacecon0user-interfacevty04#return接入交换机L4配置#sysnameL4#vlanbatch20#clusterenablentdpenablendpenable#dropillegal-macalarm#dhcpenable#dhcpsnoopingenableipv4arpdhcp-snooping-detectenable
#diffservdomaindefault#drop-profiledefault#aaaauthentication-schemedefaultauthorization-schemedefaultaccounting-schemedefaultdomaindefaultdomaindefault_adminlocal-useradminpasswordsimpleadminlocal-useradminservice-typehttp#interfaceVlanif1#interfaceMEth0/0/1#interfaceEthernet0/0/1portlink-typeaccessportdefaultvlan20stpedged-portenabledhcpsnoopingenable#interfaceEthernet0/0/2#interfaceEthernet0/0/3#interfaceEthernet0/0/4#interfaceEthernet0/0/5#interfaceEthernet0/0/6#interfaceEthernet0/0/7#interfaceEthernet0/0/8#interfaceEthernet0/0/9#interfaceEthernet0/0/10#interfaceEthernet0/0/11#interfaceEthernet0/0/12#interfaceEthernet0/0/13#interfaceEthernet0/0/14
#interfaceEthernet0/0/15#interfaceEthernet0/0/16#interfaceEthernet0/0/17#interfaceEthernet0/0/18#interfaceEthernet0/0/19#interfaceEthernet0/0/20#interfaceEthernet0/0/21#interfaceEthernet0/0/22#interfaceGigabitEthernet0/0/1portlink-typetrunkporttrunkallow-passvlan20dhcpsnoopingtrusted#interfaceGigabitEthernet0/0/2#interfaceNULL0#user-interfacecon0user-interfacevty04#return网络验证：1、PC1ping公网IP2、PC4ping公网IP
3、PC1pingPC4（VPN通讯）4、ipsec通讯数据抓包
2024年1月31日发(作者：以暄婷)
华为数通设备组网常用功能及配置【VLANDHCPSTPRIPOSPF静态默认路由NATACLIPSEC】网络图如下：设备配置如下：ISP配置（用一台路由器模拟运营商网络）[V200R003C00]#sysnameISP#snmp-agentlocal-engineid800007DB00snmp-agent#clocktimezoneChina-Standard-Timeminus08:00:00##dropillegal-macalarm#setcpu-usagethreshold80restore75#aaaauthentication-schemedefaultauthorization-schemedefaultaccounting-schemedefaultdomaindefaultdomaindefault_admin
local-useradminpasswordcipher%$%$84DZ}e#<0`8bmE3Uw}%$%$local-useradminservice-typehttp#firewallzoneLocalpriority15#interfaceGigabitEthernet0/0/0#interfaceGigabitEthernet0/0/1ipaddress202.96.11.254255.255.255.0#interfaceGigabitEthernet0/0/2ipaddress116.18.22.253255.255.255.0#interfaceNULL0#user-interfacecon0authentication-modepassworduser-interfacevty04user-interfacevty1620#wlanac#Return出口路由器R1配置[V200R003C00]#sysnameR1#snmp-agentlocal-engineid800007DB00snmp-agent#clocktimezoneChina-Standard-Timeminus08:00:00#portallocal-serverloadflash:/#dropillegal-macalarm#wlanac-globalcarrieridotheracid0#setcpu-usagethreshold80restore75#aclnumber3000rule1denyipsource192.168.0.00.0.255.255destination172.16.0.00.0.255.255rule5permitipsource192.168.0.00.0.255.255aclnumber3100rule5permitipsource192.168.0.00.0.255.255destination172.16.0.00.0.255.255#
ipsecproposal1espauthentication-algorithmsha2-256espencryption-algorithm3des#ikeproposal1encryption-algorithm3des-cbcdhgroup2authentication-algorithmmd5#ikepeerR2v2pre-shared-keysimplehuawei@123ike-proposal1remote-address116.18.22.1#ipsecpolicyp01isakmpsecurityacl3100ike-peerR2proposal1#aaaauthentication-schemedefaultauthorization-schemedefaultaccounting-schemedefaultdomaindefaultdomaindefault_adminlocal-useradminpasswordcipher%$%$84DZ}e#<0`8bmE3Uw}%$%$local-useradminservice-typehttp#firewallzoneLocalpriority15#interfaceGigabitEthernet0/0/0ipaddress192.168.30.1255.255.255.0#interfaceGigabitEthernet0/0/1ipaddress202.96.11.1255.255.255.0ipsecpolicyp0natoutbound3000#interfaceGigabitEthernet0/0/2#interfaceNULL0#rip1version2network192.168.30.0#iproute-static0.0.0.00.0.0.0202.96.11.254#
user-interfacecon0authentication-modepassworduser-interfacevty04user-interfacevty1620#wlanac#Return三层交换机SW1配置#sysnameSW1#vlanbatch102030#stpinstance0rootprimary#clusterenablentdpenablendpenable#dropillegal-macalarm#dhcpenable#diffservdomaindefault#drop-profiledefault#ippoolvlan10gateway-list192.168.10.254network192.168.10.0mask255.255.255.0excluded-ip-address192.168.10.250192.168.10.253leaseday0hour10minute0dns-list202.96.134.133202.96.128.86#ippoolvlan20gateway-list192.168.20.254network192.168.20.0mask255.255.255.0excluded-ip-address192.168.20.250192.168.20.253leaseday0hour10minute0dns-list202.96.134.133202.96.128.86#aaaauthentication-schemedefaultauthorization-schemedefaultaccounting-schemedefaultdomaindefaultdomaindefault_admin
local-useradminpasswordsimpleadminlocal-useradminservice-typehttp#interfaceVlanif1#interfaceVlanif10ipaddress192.168.10.254255.255.255.0dhcpselectglobal#interfaceVlanif20ipaddress192.168.20.254255.255.255.0dhcpselectglobal#interfaceVlanif30ipaddress192.168.30.254255.255.255.0#interfaceMEth0/0/1#interfaceGigabitEthernet0/0/1portlink-typetrunkporttrunkallow-passvlan10#interfaceGigabitEthernet0/0/2portlink-typetrunkporttrunkallow-passvlan20#interfaceGigabitEthernet0/0/3portlink-typeaccessportdefaultvlan30#interfaceGigabitEthernet0/0/4#interfaceGigabitEthernet0/0/5#interfaceGigabitEthernet0/0/6#interfaceGigabitEthernet0/0/7#interfaceGigabitEthernet0/0/8#interfaceGigabitEthernet0/0/9#interfaceGigabitEthernet0/0/10#interfaceGigabitEthernet0/0/11#interfaceGigabitEthernet0/0/12#interfaceGigabitEthernet0/0/13
#interfaceGigabitEthernet0/0/14#interfaceGigabitEthernet0/0/15#interfaceGigabitEthernet0/0/16#interfaceGigabitEthernet0/0/17#interfaceGigabitEthernet0/0/18#interfaceGigabitEthernet0/0/19#interfaceGigabitEthernet0/0/20#interfaceGigabitEthernet0/0/21#interfaceGigabitEthernet0/0/22#interfaceGigabitEthernet0/0/23#interfaceGigabitEthernet0/0/24#interfaceNULL0#rip1version2network192.168.10.0network192.168.20.0network192.168.30.0#iproute-static0.0.0.00.0.0.0192.168.30.1#user-interfacecon0user-interfacevty04#return接入交换机L1配置#sysnameL1#vlanbatch10#clusterenablentdpenablendpenable#dropillegal-macalarm
#dhcpenable#dhcpsnoopingenableipv4arpdhcp-snooping-detectenable#diffservdomaindefault#drop-profiledefault#aaaauthentication-schemedefaultauthorization-schemedefaultaccounting-schemedefaultdomaindefaultdomaindefault_adminlocal-useradminpasswordsimpleadminlocal-useradminservice-typehttp#interfaceVlanif1#interfaceMEth0/0/1#interfaceEthernet0/0/1portlink-typeaccessportdefaultvlan10stpedged-portenabledhcpsnoopingenable#interfaceEthernet0/0/2#interfaceEthernet0/0/3#interfaceEthernet0/0/4#interfaceEthernet0/0/5#interfaceEthernet0/0/6#interfaceEthernet0/0/7#interfaceEthernet0/0/8#interfaceEthernet0/0/9#interfaceEthernet0/0/10#interfaceEthernet0/0/11#
interfaceEthernet0/0/12#interfaceEthernet0/0/13#interfaceEthernet0/0/14#interfaceEthernet0/0/15#interfaceEthernet0/0/16#interfaceEthernet0/0/17#interfaceEthernet0/0/18#interfaceEthernet0/0/19#interfaceEthernet0/0/20#interfaceEthernet0/0/21#interfaceEthernet0/0/22#interfaceGigabitEthernet0/0/1portlink-typetrunkporttrunkallow-passvlan10dhcpsnoopingtrusted#interfaceGigabitEthernet0/0/2#interfaceNULL0#user-interfacecon0user-interfacevty04#return接入交换机L2配置#sysnameL2#vlanbatch20#clusterenablentdpenablendpenable#dropillegal-macalarm#dhcpenable
#dhcpsnoopingenableipv4arpdhcp-snooping-detectenable#diffservdomaindefault#drop-profiledefault#aaaauthentication-schemedefaultauthorization-schemedefaultaccounting-schemedefaultdomaindefaultdomaindefault_adminlocal-useradminpasswordsimpleadminlocal-useradminservice-typehttp#interfaceVlanif1#interfaceMEth0/0/1#interfaceEthernet0/0/1portlink-typeaccessportdefaultvlan20stpedged-portenabledhcpsnoopingenable#interfaceEthernet0/0/2#interfaceEthernet0/0/3#interfaceEthernet0/0/4#interfaceEthernet0/0/5#interfaceEthernet0/0/6#interfaceEthernet0/0/7#interfaceEthernet0/0/8#interfaceEthernet0/0/9#interfaceEthernet0/0/10#interfaceEthernet0/0/11#interfaceEthernet0/0/12#
interfaceEthernet0/0/13#interfaceEthernet0/0/14#interfaceEthernet0/0/15#interfaceEthernet0/0/16#interfaceEthernet0/0/17#interfaceEthernet0/0/18#interfaceEthernet0/0/19#interfaceEthernet0/0/20#interfaceEthernet0/0/21#interfaceEthernet0/0/22#interfaceGigabitEthernet0/0/1portlink-typetrunkporttrunkallow-passvlan20dhcpsnoopingtrusted#interfaceGigabitEthernet0/0/2#interfaceNULL0#user-interfacecon0user-interfacevty04#return出口路由器R2配置[V200R003C00]#sysnameR2#snmp-agentlocal-engineid800007DB00snmp-agent#clocktimezoneChina-Standard-Timeminus08:00:00#portallocal-serverloadflash:/#dropillegal-macalarm#wlanac-globalcarrieridotheracid0
#setcpu-usagethreshold80restore75#aclnumber3000rule5denyipsource172.16.0.00.0.255.255destination192.168.0.00.0.255.255rule10permitipsource172.16.0.00.0.255.255aclnumber3100rule5permitipsource172.16.0.00.0.255.255destination192.168.0.00.0.255.255#ipsecproposal1espauthentication-algorithmsha2-256espencryption-algorithm3des#ikeproposal1encryption-algorithm3des-cbcdhgroup2authentication-algorithmmd5#ikepeerR1v2pre-shared-keysimplehuawei@123ike-proposal1remote-address202.96.11.1#ipsecpolicyp01isakmpsecurityacl3100ike-peerR1proposal1#aaaauthentication-schemedefaultauthorization-schemedefaultaccounting-schemedefaultdomaindefaultdomaindefault_adminlocal-useradminpasswordcipher%$%$84DZ}e#<0`8bmE3Uw}%$%$local-useradminservice-typehttp#firewallzoneLocalpriority15#interfaceGigabitEthernet0/0/0ipaddress172.16.3.1255.255.255.0#interfaceGigabitEthernet0/0/1ipaddress116.18.22.1255.255.255.0ipsecpolicyp0natoutbound3000#interfaceGigabitEthernet0/0/2
#interfaceNULL0#ospf1area0.0.0.0network172.16.3.00.0.0.255#iproute-static0.0.0.00.0.0.0116.18.22.253#user-interfacecon0authentication-modepassworduser-interfacevty04user-interfacevty1620#wlanac#Return三层交换机SW2配置#sysnameSW2#vlanbatch102030#stpinstance0rootprimary#clusterenablentdpenablendpenable#dropillegal-macalarm#dhcpenable#diffservdomaindefault#drop-profiledefault#aaaauthentication-schemedefaultauthorization-schemedefaultaccounting-schemedefaultdomaindefaultdomaindefault_adminlocal-useradminpasswordsimpleadminlocal-useradminservice-typehttp#interfaceVlanif1#
interfaceVlanif10ipaddress172.16.1.254255.255.255.0dhcpselectinterfacedhcpserverleaseday0hour10minute0dhcpserverdns-list202.96.134.133202.96.128.86#interfaceVlanif20ipaddress172.16.2.254255.255.255.0dhcpselectinterfacedhcpserverleaseday0hour10minute0dhcpserverdns-list202.96.134.133202.96.128.86#interfaceVlanif30ipaddress172.16.3.254255.255.255.0#interfaceMEth0/0/1#interfaceGigabitEthernet0/0/1portlink-typetrunkporttrunkallow-passvlan10#interfaceGigabitEthernet0/0/2portlink-typetrunkporttrunkallow-passvlan20#interfaceGigabitEthernet0/0/3portlink-typeaccessportdefaultvlan30#interfaceGigabitEthernet0/0/4#interfaceGigabitEthernet0/0/5#interfaceGigabitEthernet0/0/6#interfaceGigabitEthernet0/0/7#interfaceGigabitEthernet0/0/8#interfaceGigabitEthernet0/0/9#interfaceGigabitEthernet0/0/10#interfaceGigabitEthernet0/0/11#interfaceGigabitEthernet0/0/12#interfaceGigabitEthernet0/0/13#
interfaceGigabitEthernet0/0/14#interfaceGigabitEthernet0/0/15#interfaceGigabitEthernet0/0/16#interfaceGigabitEthernet0/0/17#interfaceGigabitEthernet0/0/18#interfaceGigabitEthernet0/0/19#interfaceGigabitEthernet0/0/20#interfaceGigabitEthernet0/0/21#interfaceGigabitEthernet0/0/22#interfaceGigabitEthernet0/0/23#interfaceGigabitEthernet0/0/24#interfaceNULL0#ospf1area0.0.0.0network172.16.0.00.0.255.255#iproute-static0.0.0.00.0.0.0172.16.3.1#user-interfacecon0user-interfacevty04#return接入交换机L3配置#sysnameL3#vlanbatch10#clusterenablentdpenablendpenable#dropillegal-macalarm#dhcpenable#
dhcpsnoopingenableipv4arpdhcp-snooping-detectenable#diffservdomaindefault#drop-profiledefault#aaaauthentication-schemedefaultauthorization-schemedefaultaccounting-schemedefaultdomaindefaultdomaindefault_adminlocal-useradminpasswordsimpleadminlocal-useradminservice-typehttp#interfaceVlanif1#interfaceMEth0/0/1#interfaceEthernet0/0/1portlink-typeaccessportdefaultvlan10stpedged-portenabledhcpsnoopingenable#interfaceEthernet0/0/2#interfaceEthernet0/0/3#interfaceEthernet0/0/4#interfaceEthernet0/0/5#interfaceEthernet0/0/6#interfaceEthernet0/0/7#interfaceEthernet0/0/8#interfaceEthernet0/0/9#interfaceEthernet0/0/10#interfaceEthernet0/0/11#interfaceEthernet0/0/12#interfaceEthernet0/0/13
#interfaceEthernet0/0/14#interfaceEthernet0/0/15#interfaceEthernet0/0/16#interfaceEthernet0/0/17#interfaceEthernet0/0/18#interfaceEthernet0/0/19#interfaceEthernet0/0/20#interfaceEthernet0/0/21#interfaceEthernet0/0/22#interfaceGigabitEthernet0/0/1portlink-typetrunkporttrunkallow-passvlan10dhcpsnoopingtrusted#interfaceGigabitEthernet0/0/2#interfaceNULL0#user-interfacecon0user-interfacevty04#return接入交换机L4配置#sysnameL4#vlanbatch20#clusterenablentdpenablendpenable#dropillegal-macalarm#dhcpenable#dhcpsnoopingenableipv4arpdhcp-snooping-detectenable
#diffservdomaindefault#drop-profiledefault#aaaauthentication-schemedefaultauthorization-schemedefaultaccounting-schemedefaultdomaindefaultdomaindefault_adminlocal-useradminpasswordsimpleadminlocal-useradminservice-typehttp#interfaceVlanif1#interfaceMEth0/0/1#interfaceEthernet0/0/1portlink-typeaccessportdefaultvlan20stpedged-portenabledhcpsnoopingenable#interfaceEthernet0/0/2#interfaceEthernet0/0/3#interfaceEthernet0/0/4#interfaceEthernet0/0/5#interfaceEthernet0/0/6#interfaceEthernet0/0/7#interfaceEthernet0/0/8#interfaceEthernet0/0/9#interfaceEthernet0/0/10#interfaceEthernet0/0/11#interfaceEthernet0/0/12#interfaceEthernet0/0/13#interfaceEthernet0/0/14
#interfaceEthernet0/0/15#interfaceEthernet0/0/16#interfaceEthernet0/0/17#interfaceEthernet0/0/18#interfaceEthernet0/0/19#interfaceEthernet0/0/20#interfaceEthernet0/0/21#interfaceEthernet0/0/22#interfaceGigabitEthernet0/0/1portlink-typetrunkporttrunkallow-passvlan20dhcpsnoopingtrusted#interfaceGigabitEthernet0/0/2#interfaceNULL0#user-interfacecon0user-interfacevty04#return网络验证：1、PC1ping公网IP2、PC4ping公网IP
3、PC1pingPC4（VPN通讯）4、ipsec通讯数据抓包