网络设备基础开局配置指南

system-view                          // 进入系统视图
sysname FW01                         // 修改设备名称
undo info-center enable              // 关闭信息中心（可选）

// 配置管理接口（GE0/0/0默认为管理口）
interface GigabitEthernet 0/0/0
 undo shutdown
 ip address 192.168.0.1 255.255.255.0
 service-manage https permit
 service-manage http permit
 service-manage ping permit

// 内网接口（Trust区域）
interface GigabitEthernet 1/0/0
 undo shutdown
 ip address 10.1.1.1 255.255.255.0
 service-manage ping permit

// 外网接口（Untrust区域）
interface GigabitEthernet 1/0/1
 undo shutdown
 ip address 100.1.1.2 255.255.255.0
 service-manage ping permit

// DMZ接口
interface GigabitEthernet 1/0/2
 undo shutdown
 ip address 192.168.1.10 255.255.255.0

firewall zone trust
 add interface GigabitEthernet 1/0/0

firewall zone untrust
 add interface GigabitEthernet 1/0/1

firewall zone dmz
 add interface GigabitEthernet 1/0/2

firewall zone management
 add interface GigabitEthernet 0/0/0

security-policy
 // 允许Trust区域访问Untrust区域（内网访问公网）
 rule name Allow_Trust_to_Untrust
  source-zone trust
  destination-zone untrust
  source-address 172.10.10.0 255.255.255.0
  action permit

 // 允许公网访问DMZ Web服务器
 rule name Allow_Untrust_to_DMZ_Web
  source-zone untrust
  destination-zone dmz
  destination-address 192.168.1.100 255.255.255.255
  service http
  service https
  action permit

 // 允许Trust区域内网互访（ICMP ping）
 rule name Allow_Trust_ICMP
  source-zone trust
  destination-zone trust
  service icmp
  action permit

// 推荐方式：nat-policy
nat-policy
 rule name SNAT_Trust_to_Untrust
  source-zone trust
  destination-zone untrust
  source-address 172.10.10.0 255.255.255.0
  action source-nat easy-ip

nat server protocol tcp global 100.1.1.2 80 inside 172.10.10.20 80
nat server protocol tcp global 100.1.1.2 443 inside 172.10.10.20 443

ip route-static 0.0.0.0 0.0.0.0 100.1.1.1          // 默认路由
ip route-static 172.10.10.0 255.255.255.0 10.1.1.2  // 内网回程路由

system-view                              // 进入系统视图（简写: sys）
sysname SW01                             // 修改设备名称

// 配置Console口认证
user-interface con 0
 authentication-mode password
 set authentication password cipher YourPassword

vlan batch 10 20 30 40                  // 批量创建VLAN
undo vlan 100                            // 删除VLAN
display vlan                            // 查看VLAN

// VLANIF接口配置管理IP
interface Vlanif 10
 ip address 10.1.10.1 255.255.255.0
 description Management-VLAN

interface GigabitEthernet 0/0/1
 port link-type access
 port default vlan 10
 undo shutdown
 description PC-Port

interface GigabitEthernet 0/0/24
 port link-type trunk
 port trunk allow-pass vlan 10 20 30
 undo shutdown
 description Uplink-to-Core

interface GigabitEthernet 0/0/10
 port link-type hybrid
 port hybrid tagged vlan 10 20       // 指定VLAN带Tag通过
 port hybrid untagged vlan 30       // 指定VLAN去Tag通过
 port hybrid pvid vlan 30

interface Vlanif 10
 ip address 192.168.10.1 255.255.255.0

interface Vlanif 20
 ip address 192.168.20.1 255.255.255.0

ip route-static 0.0.0.0 0.0.0.0 10.1.0.2

stp mode rstp                        // 设置为RSTP模式（默认）
stp priority 0                       // 成为根桥（值越小优先级越高）
// 或 stp root primary

// 设置边缘端口（连接终端，不参与STP计算）
interface GigabitEthernet 0/0/1
 stp edged-port enable

display stp brief                    // 查看STP状态

telnet server enable

user-interface vty 0 4
 authentication-mode aaa
 protocol inbound all

aaa
 local-user admin password irreversible-cipher Admin@123
 local-user admin privilege level 15
 local-user admin service-type telnet terminal

<H3C> system-view
[H3C] sysname FW-Core
[FW-Core]

// 配置管理地址
[FW-Core] interface GigabitEthernet 1/0/1
[FW-Core-GigabitEthernet1/0/1] ip address 192.168.1.1 24
[FW-Core-GigabitEthernet1/0/1] undo shutdown

// 配置Telnet/SSH远程登录
[FW-Core] user-interface vty 0 4
[FW-Core-ui-vty0-4] authentication-mode password
[FW-Core-ui-vty0-4] set authentication password cipher Admin@123
[FW-Core-ui-vty0-4] user privilege level 3
[FW-Core-ui-vty0-4] protocol inbound telnet ssh

// 内网接口
[FW-Core] interface GigabitEthernet 1/0/2
[FW-Core-GigabitEthernet1/0/2] ip address 192.168.20.1 24
[FW-Core-GigabitEthernet1/0/2] undo shutdown

// 外网接口
[FW-Core] interface GigabitEthernet 1/0/3
[FW-Core-GigabitEthernet1/0/3] ip address 200.20.20.1 24
[FW-Core-GigabitEthernet1/0/3] undo shutdown

// Trust区域（内网）
[FW-Core] security-zone name Trust
[FW-Core-security-zone-Trust] import interface GigabitEthernet 1/0/2

// Untrust区域（外网）
[FW-Core] security-zone name Untrust
[FW-Core-security-zone-Untrust] import interface GigabitEthernet 1/0/3

// DMZ区域（服务器区）
[FW-Core] security-zone name DMZ
[FW-Core-security-zone-DMZ] import interface GigabitEthernet 1/0/4

// 创建高级ACL
[FW-Core] acl advanced 3000
[FW-Core-acl-adv-3000] rule 10 permit ip source 192.168.20.0 0.0.0.255

// 配置Trust到Untrust的域间策略
[FW-Core] zone-pair security source Trust destination Untrust
[FW-Core-zone-pair-security-Trust-Untrust] packet-filter 3000

// 配置Trust到Local的策略（允许内网管理防火墙）
[FW-Core] zone-pair security source Trust destination Local
[FW-Core-zone-pair-security-Trust-Local] packet-filter 3000

// 设置默认包过滤策略为拒绝
[FW-Core] firewall packet-filter default deny

// 创建ACL匹配内网网段
[FW-Core] acl basic 2000
[FW-Core-acl-basic-2000] rule permit source 192.168.20.0 0.0.0.255

// 使用出接口IP做PAT（最常用）
[FW-Core] interface GigabitEthernet 1/0/3
[FW-Core-GigabitEthernet1/0/3] nat outbound 2000

[FW-Core-GigabitEthernet1/0/3] nat server protocol tcp global 202.100.1.100 80 inside 192.168.1.100 80

ip route-static 0.0.0.0 0.0.0.0 200.20.20.2          // 默认路由
ip route-static 192.168.30.0 24 192.168.20.2          // 回程路由

<H3C> system-view
[H3C] sysname SW-Core

// 配置管理VLAN接口IP
[SW-Core] vlan 20
[SW-Core] interface vlan-interface 20
[SW-Core-Vlan-interface20] ip address 192.168.1.2 24

// 配置Console口密码
[SW-Core] user-interface aux 0
[SW-Core-ui-aux0] authentication-mode password
[SW-Core-ui-aux0] set authentication password cipher 123456

// 配置Telnet远程登录
[SW-Core] user-interface vty 0 4
[SW-Core-ui-vty0-4] authentication-mode password
[SW-Core-ui-vty0-4] set authentication password cipher Admin@123
[SW-Core-ui-vty0-4] user privilege level 3
[SW-Core-ui-vty0-4] protocol inbound telnet

// 创建VLAN并命名
[SW-Core] vlan 10
[SW-Core-vlan10] name Finance

// 批量创建VLAN
[SW-Core] vlan 20 to 30

// 查看VLAN
[SW-Core] display vlan

// 批量端口配置
[SW-Core] interface range GigabitEthernet 1/0/1 to 1/0/10
[SW-Core-if-range] port link-type access
[SW-Core-if-range] port access vlan 10

[SW-Core] interface GigabitEthernet 1/0/24
[SW-Core-GigabitEthernet1/0/24] port link-type trunk
[SW-Core-GigabitEthernet1/0/24] port trunk permit vlan 10 20 30
[SW-Core-GigabitEthernet1/0/24] port trunk pvid vlan 1

[SW-Core] interface GigabitEthernet 1/0/5
[SW-Core-GigabitEthernet1/0/5] port link-type hybrid
[SW-Core-GigabitEthernet1/0/5] port hybrid vlan 10 untagged   // 发送时不带Tag
[SW-Core-GigabitEthernet1/0/5] port hybrid vlan 20 tagged     // 发送时带Tag

[SW-Core] interface vlan-interface 10
[SW-Core-Vlan-interface10] ip address 192.168.10.1 255.255.255.0

[SW-Core] interface vlan-interface 20
[SW-Core-Vlan-interface20] ip address 192.168.20.1 24

[SW-Core] ip route-static 0.0.0.0 0.0.0.0 192.168.1.1

[SW-Core] stp global enable
[SW-Core] stp mode rstp
[SW-Core] stp root primary              // 指定为根桥
// [SW-Core] stp root secondary         // 指定为备份根桥

[SW-Core] display stp brief

// 修改管理端口
RG-WALL # config system global
RG-WALL (global) # set admin-port 1443
RG-WALL (global) # end

// 配置WAN口
RG-WALL # config system interface
RG-WALL (interface) # edit wan1
RG-WALL (wan1) # set ip 172.26.2.15/27
RG-WALL (wan1) # set mode static          // static | dhcp | pppoe
RG-WALL (wan1) # set static up
RG-WALL (wan1) # end

// 配置LAN口（内网接口）
RG-WALL # config system interface
RG-WALL (interface) # edit internal
RG-WALL (internal) # set ip 192.168.1.1/24
RG-WALL (internal) # end

RG-WALL # config firewall policy
RG-WALL (policy) # edit 0                // 0表示新增策略
RG-WALL (0) # set srcintf internal       // 源接口
RG-WALL (0) # set dstintf wan1           // 目的接口
RG-WALL (0) # set srcaddr all            // 源地址
RG-WALL (0) # set dstaddr all            // 目的地址
RG-WALL (0) # set action accept          // accept | deny
RG-WALL (0) # set schedule always
RG-WALL (0) # set service ALL
RG-WALL (0) # set nat enable             // 开启NAT
RG-WALL (0) # end

// 默认路由
RG-WALL # config router static
RG-WALL (static) # edit 0
RG-WALL (0) # set device wan1
RG-WALL (0) # set dst 0.0.0.0 0.0.0.0
RG-WALL (0) # set gateway 172.26.2.1
RG-WALL (0) # set comment "default route"
RG-WALL (0) # end

// 静态路由（特定网段）
RG-WALL # config router static
RG-WALL (static) # edit 1
RG-WALL (1) # set device wan1
RG-WALL (1) # set dst 172.26.0.0 255.255.0.0
RG-WALL (1) # set gateway 172.26.2.1
RG-WALL (1) # end

Switch> enable
Switch# configure terminal
Switch(config)# hostname SW-Core
Switch(config)# enable secret 8888

// 开启管理服务
Switch(config)# enable services telnet-server
Switch(config)# enable services web-server
Switch(config)# enable services snmp-agent

Switch(config)# vlan 10
Switch(config-vlan)# name office
Switch(config-vlan)# exit

Switch(config)# vlan 20
Switch(config-vlan)# name server
Switch(config-vlan)# exit

// 查看VLAN
Switch# show vlan

// 批量配置Access口
Switch(config)# interface range gigabitethernet 0/1-10
Switch(config-if-range)# switchport mode access
Switch(config-if-range)# switchport access vlan 10
Switch(config-if-range)# no shutdown

Switch(config)# interface gigabitethernet 0/24
Switch(config-if)# switchport mode trunk
Switch(config-if)# switchport trunk allowed vlan all
Switch(config-if)# switchport trunk native vlan 1
Switch(config-if)# no shutdown

Switch(config)# interface vlan 10
Switch(config-if)# ip address 192.168.10.1 255.255.255.0
Switch(config-if)# no shutdown

// 默认路由
Switch(config)# ip route 0.0.0.0 0.0.0.0 192.168.10.254

Switch(config)# interface gigabitethernet 0/1
Switch(config-if)# no switchport            // 转为三层模式
Switch(config-if)# ip address 10.1.252.26 255.255.255.252
Switch(config-if)# no shutdown

Switch(config)# spanning-tree                // 开启生成树
Switch(config)# spanning-tree mode rstp      // stp | rstp | mstp
Switch(config)# spanning-tree priority 4096  // 优先级值越小越优先

Switch# show spanning-tree

// 创建Eth-Trunk接口
interface Eth-Trunk 1
 port link-type trunk
 port trunk allow-pass vlan 10 20 99
 mode lacp-static                    // LACP模式（静态协商）
 undo shutdown

// 将物理端口加入Eth-Trunk
interface GigabitEthernet 0/0/23
 eth-trunk 1
 undo shutdown
interface GigabitEthernet 0/0/24
 eth-trunk 1
 undo shutdown

// 可选：配置LACP系统优先级（越小越优先成为主动端）
lacp priority 100
interface Eth-Trunk 1
 lacp system-priority 100
 max active-linknumber 2          // 最大活跃链路数

// 创建聚合接口
[SW-Core] interface bridge-aggregation 1
[SW-Core-Bridge-Aggregation1] port link-type trunk
[SW-Core-Bridge-Aggregation1] port trunk permit vlan 10 20 99
[SW-Core-Bridge-Aggregation1] link-aggregation mode dynamic   // 动态LACP

// 将物理端口加入聚合组
[SW-Core] interface GigabitEthernet 1/0/23
[SW-Core-GigabitEthernet1/0/23] port link-aggregation group 1
[SW-Core] interface GigabitEthernet 1/0/24
[SW-Core-GigabitEthernet1/0/24] port link-aggregation group 1

Switch(config)# interface port-channel 1
Switch(config-if-po1)# switchport mode trunk
Switch(config-if-po1)# switchport trunk allowed vlan all

Switch(config)# interface range gigabitethernet 0/23-24
Switch(config-if-range)# channel-group 1 mode active

// 启用OSPF进程
ospf 1 router-id 10.0.0.2              // 手动指定Router-ID

// 创建区域0（骨干区域）
area 0.0.0.0

// 宣告直连网段（华为用反掩码，华三用正掩码）
// 华为
 network 192.168.10.0 0.0.0.255          // VLAN10网段
 network 192.168.20.0 0.0.0.255          // VLAN20网段
 network 10.0.0.0 0.0.0.255              // 管理网段

// 华三
[SW-Core-ospf-1] area 0.0.0.0
[SW-Core-ospf-1-area-0.0.0.0] network 192.168.10.0 0.0.0.255
[SW-Core-ospf-1-area-0.0.0.0] network 192.168.20.0 0.0.0.255
[SW-Core-ospf-1-area-0.0.0.0] network 10.0.0.0 0.0.0.255

// 静默接口（不发送OSPF报文的接口，如连接终端的VLANIF）
silent-interface Vlanif 10
silent-interface Vlanif 20

// 查看OSPF邻居和路由
display ospf peer
display ospf routing

Switch(config)# router ospf 1
Switch(config-router)# router-id 10.0.0.2
Switch(config-router)# network 192.168.10.0 0.0.0.255 area 0
Switch(config-router)# network 192.168.20.0 0.0.0.255 area 0
Switch(config-router)# passive-interface vlan 10
Switch(config-router)# passive-interface vlan 20

// 场景：禁止VLAN10（办公）访问VLAN20（服务器）的特定服务器
acl number 3001
 rule 10 deny ip source 192.168.10.0 0.0.0.255 destination 192.168.20.100 0
 rule 20 permit ip                     // 允许其他流量

// 在VLANIF接口上应用ACL
interface Vlanif 10
 traffic-filter inbound acl 3001     // 入方向过滤
 traffic-filter outbound acl 3001    // 出方向过滤

// 场景：仅允许VLAN10访问VLAN20的Web服务(80/443)
acl number 3002
 rule 10 permit tcp source 192.168.10.0 0.0.0.255 destination 192.168.20.0 0.0.0.255 destination-port eq 80
 rule 20 permit tcp source 192.168.10.0 0.0.0.255 destination 192.168.20.0 0.0.0.255 destination-port eq 443
 rule 30 deny ip source 192.168.10.0 0.0.0.255 destination 192.168.20.0 0.0.0.255

[SW-Core] acl advanced 3001
[SW-Core-acl-adv-3001] rule 10 deny ip source 192.168.10.0 0.0.0.255 destination 192.168.20.100 0
[SW-Core-acl-adv-3001] rule 20 permit ip

[SW-Core] interface vlan-interface 10
[SW-Core-Vlan-interface10] packet-filter 3001 inbound

Switch(config)# ip access-list extended NO-ACCESS-SERVER
Switch(config-ext-nacl)# deny ip 192.168.10.0 0.0.0.255 host 192.168.20.100
Switch(config-ext-nacl)# permit ip any any

Switch(config)# interface vlan 10
Switch(config-if)# ip access-group NO-ACCESS-SERVER in

// 方式一：本地镜像
observe-port 1 interface GigabitEthernet 0/0/22   // 镜像目的口（接抓包PC）

interface GigabitEthernet 0/0/1                // 被镜像口（需抓包的端口）
 port-mirroring to observe-port 1 both       // both=双向, inbound=入, outbound=出

// 方式二：流镜像（按VLAN/ACL匹配后镜像）
acl number 3000
 rule 10 permit ip source 192.168.10.50 0   // 只镜像特定IP的流量
mirror to observe-port 1
 mirror acl 3000

[SW-Core] mirroring-group 1 local
[SW-Core] mirroring-group 1 mirroring-port GigabitEthernet 1/0/1 both
[SW-Core] mirroring-group 1 monitor-port GigabitEthernet 1/0/22

Switch(config)# monitor session 1 source interface gigabitethernet 0/1 both
Switch(config)# monitor session 1 destination interface gigabitethernet 0/22
Switch(config)# no monitor session 1              // 取消镜像

// 生成RSA密钥对
rsa local-key-pair create

// 开启SSH服务
ssh server enable

// 配置VTY虚拟终端支持SSH
user-interface vty 0 4
 authentication-mode aaa
 protocol inbound ssh
 user privilege level 15

// 创建SSH用户（方式一：密码认证）
aaa
 local-user netadmin
 password cipher YourStrongPass@2026
 service-type ssh telnet terminal
 authorization-attribute level 15

// 创建SSH用户（方式二：密钥认证，更安全）
ssh user netadmin service-type stelnet
ssh user netadmin authentication-type rsa
ssh user netadmin assign rsa-key netadmin-key

Switch(config)# crypto key generate rsa
Switch(config)# ip ssh version 2
Switch(config)# username admin privilege 15 secret YourStrongPass
Switch(config)# line vty 0 4
Switch(config-line)# login local
Switch(config-line)# transport input ssh telnet

dhcp enable

// 创建VLAN 10的DHCP地址池
ip pool vlan10
 network 192.168.10.0 mask 255.255.255.0
 gateway-list 192.168.10.1
 dns-list 223.5.5.5 114.114.114.114
 excluded-ip-address 192.168.10.1 192.168.10.10  // 排除保留地址
 lease day 3                   // 租期3天

// 在VLANIF接口上启用DHCP
interface Vlanif 10
 dhcp select global

// 华为
dhcp enable
interface Vlanif 10
 dhcp select relay
 dhcp relay server-ip 10.1.0.100

// 华三
[SW-Core] dhcp relay enable
[SW-Core] interface vlan-interface 10
[SW-Core-Vlan-interface10] dhcp relay address 10.1.0.100

Switch(config)# service dhcp
Switch(config)# ip helper-address 10.1.0.100

aaa
 // 创建只读用户（权限级别0-5）
 local-user monitor
  password cipher Monitor@123
  service-type telnet ssh
  authorization-attribute level 1

 // 创建运维用户（权限级别6-10）
 local-user opsadmin
  password cipher Ops@123
  service-type telnet ssh
  authorization-attribute level 10

 // 创建管理员用户（权限级别15）
 local-user superadmin
  password cipher Super@123
  service-type telnet ssh http
  authorization-attribute level 15

// 配置RADIUS服务器
[FW-Core] radius scheme radius1
[FW-Core-radius-radius1] primary authentication 192.168.1.100
[FW-Core-radius-radius1] primary accounting 192.168.1.100
[FW-Core-radius-radius1] key authentication cipher RadiusKey@123
[FW-Core-radius-radius1] key accounting cipher RadiusKey@123
[FW-Core-radius-radius1] user-name-format without-domain

// 配置ISP域使用RADIUS认证
[FW-Core] domain default
[FW-Core-isp-default] authentication login radius-scheme radius1
[FW-Core-isp-default] authorization login radius-scheme radius1
[FW-Core-isp-default] accounting login radius-scheme radius1

// 开启信息中心
info-center enable

// 配置日志服务器（Syslog）
info-center loghost 192.168.1.200

// 设置日志级别（emergencies=0, debugging=7）
info-center source default channel loghost level informational

// 配置时间戳
info-center timestamp log date

// 华三额外配置
[FW-Core] info-center loghost 192.168.1.200 port 514
[FW-Core] info-center timestamp log

# ==============================
# 华为S5700核心交换机开局配置
# ==============================

system-view
sysname SW-Core

// --- VLAN创建 ---
vlan batch 10 20 99
vlan 10
 description Office-VLAN
vlan 20
 description Server-VLAN
vlan 99
 description Management-VLAN

// --- VLANIF网关 ---
interface Vlanif 10
 ip address 192.168.10.1 255.255.255.0
 dhcp select relay
 dhcp relay server-ip 192.168.20.100

interface Vlanif 20
 ip address 192.168.20.1 255.255.255.0

interface Vlanif 99
 ip address 10.0.0.2 255.255.255.0

// --- 上联防火墙口（Trunk） ---
interface GigabitEthernet 0/0/24
 port link-type trunk
 port trunk allow-pass vlan 10 20 99
 description To-Firewall

// --- 下联接入交换机口（Trunk） ---
interface GigabitEthernet 0/0/1
 port link-type trunk
 port trunk allow-pass vlan 10 20
 description To-Access-SW1

// --- STP配置（核心为根桥） ---
stp mode rstp
stp root primary
stp priority 0

// --- 默认路由指向防火墙 ---
ip route-static 0.0.0.0 0.0.0.0 10.0.0.1

// --- SSH远程管理 ---
rsa local-key-pair create
ssh server enable
user-interface vty 0 4
 authentication-mode aaa
 protocol inbound ssh
aaa
 local-user admin
  password cipher Admin@2026
  service-type ssh telnet
  authorization-attribute level 15

info-center loghost 192.168.20.10
save

system-view
sysname SW-Access-1F

// --- VLAN ---
vlan batch 10 20

// --- Access端口（1-20口接办公电脑） ---
interface range GigabitEthernet 0/0/1 to GigabitEthernet 0/0/20
 port link-type access
 port default vlan 10
 stp edged-port enable
 undo shutdown

// --- Access端口（21-24口接服务器） ---
interface range GigabitEthernet 0/0/21 to GigabitEthernet 0/0/24
 port link-type access
 port default vlan 20
 undo shutdown

// --- 上联核心（Trunk） ---
interface GigabitEthernet 0/0/26
 port link-type trunk
 port trunk allow-pass vlan 10 20
 undo shutdown

// --- STP ---
stp mode rstp
stp priority 4096

save

# ==============================
# 华为USG6000防火墙开局配置
# ==============================

system-view
sysname FW-Exit

// --- 接口配置 ---
// 内网接口（连接核心交换机）
interface GigabitEthernet 1/0/0
 undo shutdown
 ip address 10.0.0.1 255.255.255.0

// 外网接口（连接运营商）
interface GigabitEthernet 1/0/1
 undo shutdown
 ip address 202.100.1.2 255.255.255.0

// --- 安全区域 ---
firewall zone trust
 add interface GigabitEthernet 1/0/0
firewall zone untrust
 add interface GigabitEthernet 1/0/1
firewall zone local

// --- 安全策略 ---
// 允许内网访问外网
security-policy
 rule name Allow_Office_Internet
  source-zone trust
  destination-zone untrust
  source-address 192.168.10.0 255.255.255.0
  action permit

 rule name Allow_Server_Internet
  source-zone trust
  destination-zone untrust
  source-address 192.168.20.0 255.255.255.0
  action permit

// 允许内网管理防火墙
 rule name Allow_Manage_FW
  source-zone trust
  destination-zone local
  source-address 10.0.0.0 255.255.255.0
  service telnet ssh http https ping
  action permit

// --- NAT（内网上网） ---
nat-policy
 rule name SNAT_All
  source-zone trust
  destination-zone untrust
  source-address 192.168.0.0 255.0.0.0
  action source-nat easy-ip

// --- 端口映射（Web服务器对外发布） ---
nat server protocol tcp global 202.100.1.2 80 inside 192.168.20.10 80
nat server protocol tcp global 202.100.1.2 443 inside 192.168.20.10 443

// --- 路由 ---
ip route-static 0.0.0.0 0.0.0.0 202.100.1.1             // 默认路由
ip route-static 192.168.10.0 255.255.255.0 10.0.0.2          // 回程路由
ip route-static 192.168.20.0 255.255.255.0 10.0.0.2          // 回程路由

save

// === 主设备（Master） ===
interface Vlanif 10
 ip address 192.168.10.2 255.255.255.0     // 物理IP
 vrrp vrid 10 virtual-ip 192.168.10.1       // 虚拟IP（网关）
 vrrp vrid 10 priority 120                   // 优先级（默认100，越大越优先）
 vrrp vrid 10 preempt-mode timer delay 20    // 抢占延迟20秒
 vrrp vrid 10 track interface GigabitEthernet 0/0/24 reduced 30  // 监控上联口，故障时降30优先级

// === 备设备（Backup） ===
interface Vlanif 10
 ip address 192.168.10.3 255.255.255.0
 vrrp vrid 10 virtual-ip 192.168.10.1
 vrrp vrid 10 priority 100                   // 默认优先级，作为Backup
 vrrp vrid 10 preempt-mode timer delay 20

// 验证命令
display vrrp brief

// === 主设备 ===
Switch(config)# interface vlan 10
Switch(config-if)# ip address 192.168.10.2 255.255.255.0
Switch(config-if)# vrrp 10 ip 192.168.10.1
Switch(config-if)# vrrp 10 priority 120
Switch(config-if)# vrrp 10 preempt

// === 备设备 ===
Switch(config-if)# vrrp 10 ip 192.168.10.1
Switch(config-if)# vrrp 10 priority 100

Switch# show vrrp brief

// 主防火墙配置
firewall zone trust
 add interface GigabitEthernet 1/0/0

hrp interface GigabitEthernet 1/0/6      // HA心跳口
hrp enable                                    // 开启HA
hrp role standby                             // 主备模式（主设备自动协商为主）
hrp mirror session enable                    // 会话镜像同步
hrp track interface GigabitEthernet 1/0/1   // 监控业务口

// 备防火墙配置（相同配置，hrp role standby）
// 配置会自动从主设备同步到备设备
display hrp state                             // 查看HA状态

dhcp snooping enable                         // 全局开启

// 上联口（连接合法DHCP服务器或上联设备）设为信任口
interface GigabitEthernet 0/0/24
 dhcp snooping trusted

// 接入口（连接终端）默认不信任
// 可选：限制每个端口学习的最大MAC数
interface GigabitEthernet 0/0/1
 dhcp snooping max-learning-num 5

display dhcp snooping

[SW-Core] dhcp snooping enable
[SW-Core] interface GigabitEthernet 1/0/24
[SW-Core-GigabitEthernet1/0/24] dhcp snooping trust

Switch(config)# ip dhcp snooping
Switch(config)# interface gigabitethernet 0/24
Switch(config-if)# ip dhcp snooping trust

// 需先开启DHCP Snooping
arp anti-attack check user-bind enable       // 全局开启ARP绑定检查

// 在接入端口启用
interface GigabitEthernet 0/0/1
 arp anti-attack check user-bind enable

// 可选：配置ARP严格学习模式
arp learning strict enable

interface GigabitEthernet 0/0/5
 port-security enable                          // 开启端口安全
 port-security max-mac-num 2                   // 最大学习2个MAC
 port-security protect-action restrict          // 超出后丢弃（restrict）或关闭（shutdown）
 port-security mac-address sticky              // MAC地址粘滞（自动转为静态绑定）

Switch(config)# interface gigabitethernet 0/5
Switch(config-if)# switchport port-security
Switch(config-if)# switchport port-security maximum 2
Switch(config-if)# switchport port-security violation restrict
Switch(config-if)# switchport port-security mac-address sticky

// 方式一：全局开启BPDU保护（边缘端口收到BPDU则自动关闭）
stp bpdu-protection enable

// 方式二：在接口上单独配置
interface GigabitEthernet 0/0/1
 stp edged-port enable
 stp bpdu-protection enable

// 根桥保护（防止接入设备抢占根桥）
stp root-protection

Switch(config)# spanning-tree portfast bpduguard default   // 全局开启
Switch(config-if)# spanning-tree bpduguard enable              // 接口开启
Switch(config-if)# spanning-tree guard root                   // 根桥保护

clock timezone Beijing add 08:00             // 设置时区（东八区）

// 华为
ntp-service unicast-server ntp.aliyun.com        // 阿里云NTP
ntp-service unicast-server cn.ntp.org.cn          // 中国NTP

// 华三
[SW-Core] ntp-service unicast-server ntp.aliyun.com

// 验证
display clock
display ntp-service status

Switch(config)# clock timezone Beijing 8
Switch(config)# ntp server ntp.aliyun.com
Switch(config)# ntp server cn.ntp.org.cn
Switch# show clock

snmp-agent sys-info version v3                // 使用SNMPv3（推荐）
snmp-agent group v3 snmpv3group privacy       // 启用加密
snmp-agent usm-user v3 snmpadmin snmpv3group
snmp-agent usm-user v3 snmpadmin snmpv3group authentication-mode sha AuthPass123 privacy-mode aes128 PrivPass123
snmp-agent target-host trap address udp-domain 192.168.1.200 params securityname snmpadmin v3 privacy
snmp-agent trap enable

1. 物理层检查
   - 接口状态是否 UP？ → display interface brief
   - 线缆是否插好？端口灯是否亮？

2. 数据链路层检查
   - VLAN是否正确？ → display vlan
   - Trunk是否放行VLAN？ → display interface switchport
   - MAC地址是否学习到？ → display mac-address

3. 网络层检查
   - IP地址是否配置？ → display ip interface brief
   - 路由是否可达？ → display ip routing-table
   - ARP是否解析？ → display arp

4. 策略层检查（防火墙）
   - 安全策略是否放行？ → display security-policy all
   - NAT是否配置？ → display nat-policy all
   - 会话表是否有条目？ → display firewall session table

5. 逐段Ping测试
   - PC → 网关 → 核心交换机 → 防火墙内网口 → 防火墙外网口 → 运营商网关 → 公网IP