H3C 7500做DHCP Realy、策略路由、Qos典型配置案例

思考的牛

1、图中间为分公司S1，左下方为分公司S2，左上方为总公司S1、S2；

2、总公司通过互联网2M带宽连接到S1；

3、总公司S2通过10M带宽连到分公司S2，最终连接分公司S1；

4、分公司S1和分公司S2中间只有2芯单模光缆，同时要传输总公司10M线路业务和分公司S1和分公司S2的用户业务；

5、分公司所有用户通过2M线路和10M线路与总公司通讯，要求全部从总公司DHCP server 1地址服务器获得ip；

6、要求2M和10M线路做流量分担，qos优先保证视频会议流；

7、以下是分公司是S1和分公司S2的配置文档



version 5.20, Release 6105

#

sysname 分公司S1

#

dhcp relay server-group 1 ip ××.20.1.21   （DHCP中继服务器号设置）

#

domain default enable system

#

ip host 集团 172.21.254.18

#

router id 172.21.254.18

#

telnet server enable

#

switch-mode standard

#

vlan 1

#

vlan 2

description ManagerVlan

#

vlan 820

description TO-SX_S1（连接总公司S1）

#

vlan 854

description TO-分公司S2

#

vlan 1360

#

vlan 1370

#

vlan 1380

#

vlan 1390

#

vlan 1400

#

vlan 1410

#

domain system

access-limit disable

state active

idle-cut disable

self-service-url disable

#

traffic classifier 2 operator and       （策略路由）

if-match acl 3002

traffic classifier 1 operator and

if-match acl 3001

#

traffic behavior 2

filter permit

traffic behavior 1

filter deny

#

qos policy 1

classifier 1 behavior 1

classifier 2 behavior 2

#

local-user whb

password cipher B"#@O$+^='^TDGQB,DATQ1!!

service-type telnet

level 3

local-user zzp

password cipher N`C55QK<`=/Q=^Q`MAF4<1!!

service-type telnet

level 3

#

acl number 3001 name virus  安全策略

rule 0 deny tcp source-port eq 3127

rule 1 deny tcp source-port eq 1025

rule 2 deny tcp source-port eq 5554

rule 3 deny tcp source-port eq 9996

rule 4 deny tcp source-port eq 1068

rule 5 deny tcp source-port eq 135

rule 6 deny udp source-port eq 135

rule 7 deny tcp source-port eq 137

rule 8 deny udp source-port eq netbios-ns

rule 9 deny tcp source-port eq 138

rule 10 deny udp source-port eq netbios-dgm

rule 11 deny tcp source-port eq 139

rule 12 deny udp source-port eq netbios-ssn

rule 13 deny tcp source-port eq 593

rule 14 deny tcp source-port eq 4444

rule 15 deny tcp source-port eq 5800

rule 16 deny tcp source-port eq 5900

rule 18 deny tcp source-port eq 8998

rule 19 deny tcp source-port eq 445

rule 20 deny udp source-port eq 445

rule 21 deny udp source-port eq 1434

rule 30 deny tcp destination-port eq 3127

rule 31 deny tcp destination-port eq 1025

rule 32 deny tcp destination-port eq 5554

rule 33 deny tcp destination-port eq 9996

rule 34 deny tcp destination-port eq 1068

rule 35 deny tcp destination-port eq 135

rule 36 deny udp destination-port eq 135

rule 37 deny tcp destination-port eq 137

rule 38 deny udp destination-port eq netbios-ns

rule 39 deny tcp destination-port eq 138

rule 40 deny udp destination-port eq netbios-dgm

rule 41 deny tcp destination-port eq 139

rule 42 deny udp destination-port eq netbios-ssn

rule 43 deny tcp destination-port eq 593

rule 44 deny tcp destination-port eq 4444

rule 45 deny tcp destination-port eq 5800

rule 46 deny tcp destination-port eq 5900

rule 48 deny tcp destination-port eq 8998

rule 49 deny tcp destination-port eq 445

rule 50 deny udp destination-port eq 445

rule 51 deny udp destination-port eq 1434

acl number 3002 name vido&erp  （视频会议ip地址）

rule 0 permit ip source ××.20.140.1 0 precedence network

rule 1 permit ip destination 0.0.0.0 255.255.255.0 precedence internet

#               

interface NULL0

#

interface LoopBack0

ip address 172.21.254.18 255.255.255.255

#

interface Vlan-interface2   

description ManagerVlan

ip address 172.21.252.190 255.255.255.224

#

interface Vlan-interface820     （连接总公司S1）

description TO-SX_S1

ip address 172.21.246.42 255.255.255.252

ospf cost 50

#

interface Vlan-interface854     （通过分公司S2连接总公司S2，这里是物理连接到分公司S2）

description TO-SX_S2

ip address 172.21.246.94 255.255.255.252

dhcp select relay                              （DHCP中继设置）

#

interface Vlan-interface1360     （DHCP中继设置，要在每个用户VLAN启用DHCP中继）

ip address 192.168.136.254 255.255.255.0

dhcp select relay

dhcp relay server-select 1

#

interface Vlan-interface1370

ip address 192.168.137.254 255.255.255.0

dhcp select relay

dhcp relay server-select 1

#

interface Vlan-interface1380

ip address 192.168.138.254 255.255.255.0

dhcp select relay

dhcp relay server-select 1

#

interface Vlan-interface1390

description CaiWu

ip address 192.168.139.254 255.255.255.0

dhcp select relay

dhcp relay server-select 1

#

interface Vlan-interface1400

ip address 192.168.140.254 255.255.255.0

dhcp select relay

dhcp relay server-select 1

#

interface Ethernet4/0/1

port link-type trunk

port trunk permit vlan 1 to 2 1360 to 1400

speed 100

duplex full

description erqichejian

#

interface Ethernet4/0/2

port link-type trunk

port trunk permit vlan 1 to 2 1360 to 1400

speed 100

duplex full

description erqichejian

#

interface Ethernet4/0/3

port link-type trunk

port trunk permit vlan 1 to 2 1360 to 1400

speed 100

duplex full

description erqichejian

#

interface Ethernet4/0/4

port link-type trunk

port trunk permit vlan 1 to 2 1360 to 1400

speed 100

duplex full

description erqichejian

#

interface Ethernet4/0/5

port link-type trunk

port trunk permit vlan 1 to 2 1360 to 1400

speed 100

duplex full

description erqichejian

#

interface Ethernet4/0/6

port link-type trunk

port trunk permit vlan 1 to 2 1360 to 1400

speed 100

duplex full

description erqichejian

#

interface Ethernet4/0/7

port link-type trunk

port trunk permit vlan 1 to 2 1360 to 1400

speed 100

duplex full   

description erqichejian

#

interface Ethernet4/0/8

port link-type trunk

port trunk permit vlan 1 to 2 1360 to 1400

speed 100

duplex full

description erqichejian

#

interface Ethernet4/0/9

port link-type trunk

port trunk permit vlan 1 to 2 1360 to 1400

speed 100

duplex full

description erqichejian

#

interface Ethernet4/0/10

port link-type trunk

port trunk permit vlan 1 to 2 1360 to 1400

speed 100

duplex full

description erqichejian

#               

interface Ethernet4/0/11

port link-type trunk

port trunk permit vlan 1 to 2 1360 to 1400

speed 100

duplex full

description erqichejian

#

interface Ethernet4/0/12

port link-type trunk

port trunk permit vlan 1 to 2 1360 to 1400

speed 100

duplex full

description erqichejian

#

interface Ethernet4/0/13

port link-type trunk

port trunk permit vlan 1 to 2 1360 to 1400

speed 100

duplex full

description erqichejian

#

interface Ethernet4/0/14

port link-type trunk

port trunk permit vlan 1 to 2 1360 to 1400

speed 100

duplex full

description erqichejian

#

interface Ethernet4/0/15

port link-type trunk

port trunk permit vlan 1 to 2 1360 to 1400

speed 100

duplex full

description erqichejian

#

interface Ethernet4/0/16

port link-type trunk

port trunk permit vlan 1 to 2 1360 to 1400

speed 100

duplex full

description erqichejian

#

interface Ethernet4/0/17

#

#

interface GigabitEthernet2/0/1

port link-type trunk

port trunk permit vlan 1 to 2 820 850 854 1360 1370 1380 1390 1400 1410

description TO-分公司S2

#

interface GigabitEthernet2/0/2

port link-type trunk

port trunk permit vlan all

description TO-分公司S3

#

interface GigabitEthernet2/0/3

port link-type trunk

port trunk permit vlan all

description TO-分公司JR1

#

interface GigabitEthernet2/0/4

description TO-分公司JR2

#

#

interface GigabitEthernet3/0/1

port link-type trunk

port trunk permit vlan all

#

interface GigabitEthernet3/0/2

#

interface GigabitEthernet3/0/3

port access vlan 820

description TO-SX_S1

qos apply policy 1 inbound                 （QOS应用）

qos apply policy 1 outbound

#

interface GigabitEthernet3/0/4

#

#

interface GigabitEthernet3/0/23

port access vlan 1360

#

interface GigabitEthernet3/0/24

port access vlan 1360

#

interface M-Ethernet0/0/0

#

ospf 1

area 0.0.0.3

  network 192.168.136.0 0.0.0.255

  network 192.168.137.0 0.0.0.255

  network 192.168.138.0 0.0.0.255

  network 192.168.139.0 0.0.0.255

  network 192.168.140.0 0.0.0.255

  network 172.21.246.40 0.0.0.3

  network 172.21.246.92 0.0.0.3

  network 172.21.254.18 0.0.0.0

  network 172.21.246.48 0.0.0.7

  network 172.21.246.104 0.0.0.3

  nssa

#

snmp-agent

snmp-agent local-engineid 800063A203000FE26B8280

snmp-agent community read public

snmp-agent community write private

snmp-agent sys-info version all

#

dhcp enable

#

user-interface aux 0

user-interface vty 0 4

authentication-mode scheme

set authentication password cipher N`C55QK<`=/Q=^Q`MAF4<1!!

#

Return



sysname 分公司S2

#

local-server nas-ip 127.0.0.1 key h3c

#

domain default enable system

#

ip host 分公司S2 172.21.254.19

#

dhcp-server 1 ip  192.168.1.21

#

router id 172.21.254.19

#

temperature-limit 0 10 70

#

poe power max-value 2400

#

radius scheme system

primary authentication 127.0.0.1 1645

primary accounting 127.0.0.1 1646

user-name-format without-domain

#

domain icu

vlan-assignment-mode integer

access-limit disable

state active

idle-cut disable

self-service-url disable

messenger time disable

domain system

vlan-assignment-mode integer

access-limit disable

state active

idle-cut disable

self-service-url disable

messenger time disable

#

local-user whb

password cipher B"#@O$+^='^TDGQB,DATQ1!!

service-type telnet terminal

level 3

local-user zzp

password cipher N`C55QK<`=/Q=^Q`MAF4<1!!

service-type telnet

level 3

#

stp TC-protection enable

#

acl number 3001

rule 0 deny tcp source-port eq 3127

rule 1 deny tcp source-port eq 1025

rule 2 deny tcp source-port eq 5554

rule 3 deny tcp source-port eq 9996

rule 4 deny tcp source-port eq 1068

rule 5 deny tcp source-port eq 135

rule 6 deny udp source-port eq 135

rule 7 deny tcp source-port eq 137

rule 8 deny udp source-port eq netbios-ns

rule 9 deny tcp source-port eq 138

rule 10 deny udp source-port eq netbios-dgm

rule 11 deny tcp source-port eq 139

rule 12 deny udp source-port eq netbios-ssn

rule 13 deny tcp source-port eq 593

rule 14 deny tcp source-port eq 4444

rule 15 deny tcp source-port eq 5800

rule 16 deny tcp source-port eq 5900

rule 18 deny tcp source-port eq 8998

rule 19 deny tcp source-port eq 445

rule 20 deny udp source-port eq 445

rule 21 deny udp source-port eq 1434

rule 30 deny tcp destination-port eq 3127

rule 31 deny tcp destination-port eq 1025

rule 32 deny tcp destination-port eq 5554

rule 33 deny tcp destination-port eq 9996

rule 34 deny tcp destination-port eq 1068

rule 35 deny tcp destination-port eq 135

rule 36 deny udp destination-port eq 135

rule 37 deny tcp destination-port eq 137

rule 38 deny udp destination-port eq netbios-ns

rule 39 deny tcp destination-port eq 138

rule 40 deny udp destination-port eq netbios-dgm

rule 41 deny tcp destination-port eq 139

rule 42 deny udp destination-port eq netbios-ssn

rule 43 deny tcp destination-port eq 593

rule 44 deny tcp destination-port eq 4444

rule 45 deny tcp destination-port eq 5800

rule 46 deny tcp destination-port eq 5900

rule 48 deny tcp destination-port eq 8998

rule 49 deny tcp destination-port eq 445

rule 50 deny udp destination-port eq 445

rule 51 deny udp destination-port eq 1434

acl number 3002

rule 0 permit ip source 192.168.140.1 0

rule 1 permit ip destination 0.0.0.0 255.255.255.0

#

vlan 1

#

vlan 2

#

vlan 850

description TO-SX_S2

#

vlan 854

description TO-分公司S1

#

vlan 1360

#

vlan 1370

#

vlan 1380

#

vlan 1390

#

vlan 1400

#

vlan 1410

#

interface Vlan-interface2

description ManagerVlan

ip address 172.21.252.206 255.255.255.240

#

interface Vlan-interface850

description TO-SX_S2

ip address 172.21.246.106 255.255.255.252

ospf cost 10

#

interface Vlan-interface854

description TO-分公司S1

ip address 172.21.246.93 255.255.255.252

dhcp-server 1

#

interface Vlan-interface1410

ip address 192.168.141.254 255.255.255.0

dhcp-server 1

#

interface Aux0/0/0

#

interface M-Ethernet0/0/0

#

interface GigabitEthernet0/0/1

description TO-SX_S2

port access vlan 850

qos

packet-filter inbound ip-group 3001 rule 0 system-index 1

packet-filter inbound ip-group 3001 rule 1 system-index 2

packet-filter inbound ip-group 3001 rule 2 system-index 3

packet-filter inbound ip-group 3001 rule 3 system-index 4

packet-filter inbound ip-group 3001 rule 4 system-index 5

packet-filter inbound ip-group 3001 rule 5 system-index 6

packet-filter inbound ip-group 3001 rule 6 system-index 7

packet-filter inbound ip-group 3001 rule 7 system-index 8

packet-filter inbound ip-group 3001 rule 8 system-index 9

packet-filter inbound ip-group 3001 rule 9 system-index 10

packet-filter inbound ip-group 3001 rule 10 system-index 11

packet-filter inbound ip-group 3001 rule 11 system-index 12

packet-filter inbound ip-group 3001 rule 12 system-index 13

packet-filter inbound ip-group 3001 rule 13 system-index 14

packet-filter inbound ip-group 3001 rule 14 system-index 15

packet-filter inbound ip-group 3001 rule 15 system-index 16

packet-filter inbound ip-group 3001 rule 16 system-index 17

packet-filter inbound ip-group 3001 rule 18 system-index 18

packet-filter inbound ip-group 3001 rule 19 system-index 19

packet-filter inbound ip-group 3001 rule 20 system-index 20

packet-filter inbound ip-group 3001 rule 21 system-index 21

packet-filter inbound ip-group 3001 rule 30 system-index 22

packet-filter inbound ip-group 3001 rule 31 system-index 23

packet-filter inbound ip-group 3001 rule 32 system-index 24

packet-filter inbound ip-group 3001 rule 33 system-index 25

packet-filter inbound ip-group 3001 rule 34 system-index 26

packet-filter inbound ip-group 3001 rule 35 system-index 27

packet-filter inbound ip-group 3001 rule 36 system-index 28

packet-filter inbound ip-group 3001 rule 37 system-index 29

packet-filter inbound ip-group 3001 rule 38 system-index 30

packet-filter inbound ip-group 3001 rule 39 system-index 31

packet-filter inbound ip-group 3001 rule 40 system-index 32

packet-filter inbound ip-group 3001 rule 41 system-index 33

packet-filter inbound ip-group 3001 rule 42 system-index 34

packet-filter inbound ip-group 3001 rule 43 system-index 35

packet-filter inbound ip-group 3001 rule 44 system-index 36

packet-filter inbound ip-group 3001 rule 45 system-index 37

packet-filter inbound ip-group 3001 rule 46 system-index 38

packet-filter inbound ip-group 3001 rule 48 system-index 39

packet-filter inbound ip-group 3001 rule 49 system-index 40

packet-filter inbound ip-group 3001 rule 50 system-index 41

packet-filter inbound ip-group 3001 rule 51 system-index 42

traffic-priority inbound ip-group 3002 rule 0 system-index 43 ip-precedence net

work

traffic-priority inbound ip-group 3002 rule 1 system-index 44 ip-precedence int

ernet

#

interface GigabitEthernet0/0/2

#

interface GigabitEthernet0/0/3

#

interface GigabitEthernet0/0/4

#

interface GigabitEthernet0/0/5

#

interface GigabitEthernet0/0/6

description TO-分公司S1

port link-type trunk

port trunk permit vlan 1 to 2 820 850 854 1360 1370 1380 1390 1400 1410

#

interface GigabitEthernet0/0/7

description TO-分公司JR5

port link-type trunk

port trunk permit vlan 1 to 853 855 to 4094

#

interface GigabitEthernet0/0/8

#

interface GigabitEthernet0/0/9

#

interface GigabitEthernet0/0/10

#

#

interface NULL0

#

interface LoopBack0

ip address 172.21.254.19 255.255.255.255

#

ospf 1

area 0.0.0.3

  network 192.168.141.0 0.0.0.255

  network 172.21.246.92 0.0.0.3

  network 172.21.246.104 0.0.0.3

  network 172.21.252.192 0.0.0.15

  network 172.21.254.19 0.0.0.0

  nssa

#

snmp-agent

snmp-agent local-engineid 800063A2000FE26B3E006877

snmp-agent community read public

snmp-agent community write private

snmp-agent sys-info version all

#

user-interface aux 0

authentication-mode scheme

user-interface vty 0 4

authentication-mode scheme

#

Return

我是菜鸟

好资料，学习了

IT民工

感谢分享。