华为交换机基本配置命令一、单交换机VLAN划分命令命令解释system进入系统视图system-view进入系统视图quit退到系统视图undo vlan 20删除vlan20sysname交换机命名disp vlan显示vlanvlan 20创建vlan(也可进入vlan20)port el/0/1 to el/0/5把端口1-5放入VLAN20中5700系列单个端口放入VLAN☐[Huawei]intg0/0/1[Huawei]port link-type access(注：接口类型access,hybrid、trunk)[Huawei]port default vlan 10批量端口放入VLAN□Huawei]port-group1Huawei-port-group-1]group-member ethernet G0/0/1 to ethernet G0/0/20Huawei-port-group-1]port hybrid untagged vlan 3删除group(组)vlan200内的15端口☐Huawei]intg0/0/15Huawei-GigabitEthernet0/0/15]undo port hybrid untagged vlan 200通过group端口限速设置□Huawei]Port-group2Huawei]qos lr outbound cir 2000 cbs 20000disp vlan 20显示vlan里的端口20int el/0/24进入端口24undo port el/0/10表示删除当前VLAN端口10disp curr显示当前配置eturn返回Save保存info-center source DS channel0 log state off trap state off通过关闭日志信息命令改变DS模块来实现（关闭配置后的确认信息显示）info-center source DS channel 0 log state on trap state on通过打开日志信息命令改变DS模块来实现（打开配置后的确认信息显示）二、配置交换机支持TELNEsystem进入系统视图sysname交换机命名int vlan 1ip address192.168.3.100255.255.255.0配置IP地址user-int vty 0 4进入虚拟终端authentication-mode password (aut password)设置口令模式set authentication password simple 222 (set aut pass sim 222)设置口令user privilege level 3(use priv lev 3)配置用户级别disp current-configuration (disp cur)查看当前配置disp ip int查看交换机VLAN IP配置删除配置必须退到用户模式reset saved-configuration(reset saved)删除配置Reboot重启交换机三、跨交换机LAN的通讯vlan10建立VLAN10int el/0/5进入端口5port access vlan 10把端口5加入vlan10vlan20建立VLAN20int el/0/15进入端口15port access vlan20把端口15加入VLAN20int el/0/24进入端口24port1ink-type trunk把24端口设为TRUNK端口port trunk permit vlan all同上在SW2上：vlan10建立VLAN10inte1/0/20进入端口20port access vlan10把端口20放入VLAN10int el/,0/24进入端口24port link-type trunk把24端口设为TRUNK端口port trunk permit vlan all(port trunk permit vlan 10只能为vlan 10使用)24端口为所有VLAN使用disp int el/,0/24查看端口24是否为TRUNKundo port trunk permit vlan all删除该句四、路由的配置命令system进入系统模式sysname命名int el/0进入端口ip address192.168.3.100255.255.255.0设置IPundo shutdown打开端口disp ip int el/,0查看IP接口情况disp ip int brief查看IP接口情况user-int vty04进入口令模式authentication-mode password(auth pass)进入口令模式set authentication password simple22237设置口令user privilege level3进入3级特权save保存配置reset saved-configuration删除配置（用户模式下运行）undo shutdown配置远程登陆密码int el/4ip route192.168.3.0(目标网段)255.255.255.0192.168.12.1（下-跳：下-路由器的接口)静态路由ip route0.0.0.00.0.0.0192.168.12.1默认路由disp ip rout显示路由列表华3CAR-18E1/0 (lan1-lan4)E2/0(wan0)E3/0(WAN1)路由器连接使用直通线。wan0接wan0或wanl接wanl计算机的网关应设为路由器的接口地址。五、三层交换机配置VLAN-VLAN通讯sw1(三层交换机)：system进入视图sysname命名vlan10建立VLAN10vlan20建立VLAN20int el/0/20进入端口20port access vlan10把端口20放入LAN10int el/0/24进入24端口port link-type trunk把24端口设为TRUNK端口port trunk permit vlan all(port trunk permit vlan10只能为vlan 10使用)24端口为所有VLAN使用sw2:vlan 10int el/0/5port access vlan 10int el/0/24port link-type trunk把24端口设为TRUNK端口port trunk permit vlan all(port trunk permit vlan 10只能为vlan 10使用)24端口为所有VLAN使用sw1(三层交换机)：int vlan10创建虚拟接口VLAN 10ip address192.168.10.254255.255.255.0设置虚拟接口LAN10的地址int vlan20创建虚拟接口VLAN20ip address192.168.20.254255.255.255.0设置虚拟接口IP VLAN20的地址注意：v1an10里的计算机的网关设为192.168.10.254vlan20里的计算机的网关设为192.168.20.254六、动态路由RIPR1:int el/0进入el/0端口ip address192.168.3.1255.255.255.0设置IPinte2/0进入e2/0端口ip adress192.168.5.1255.255.255.0设置IPrip设置动态路由network192.168.5.0定义IPnetwork192.168.3.0定义IPdisp ip rout查看路由接口R2:int el/0进入el/0端口ip address192.168.4.1255.255.255.0设置IPinte2/0进入e2/0端口ip adress192.168.5.2255.255.255.0设置IPrip设置动态路由network192.168.5.0定义IPnetwork192.168.4.0定义IPdisp ip rout查看路由接口(注意：两台PC机的网关设置PC1IP:192.168.3.1PC2IP:192.168.4.1)七、P访问列表int el/0ip address192.168.3.1255.255.255.0int e2/0ip address192.168.1.1255.255.255.0int e3/0ip address192.168.2.1255.255.255.0ac1 number2001(2001-2999属于基本的访问列表)rule1 deny source192.168.1.00.0.0.255(拒绝地址192.168.1.0网段的数据通过)rule2 permit source192.168.3.00.0.0.255(允许地址192.168.3.0网段的数据通过)以下是把访问控制列表在接口下应用：firewall enablefirewall default permitint e3/0firewall packet-filter 2001 outbounddisp acl2001显示信息undo acl number2001删除2001控制列表扩展访问控制列表acl number 3001rule deny tcp source 192.168.3.0 0.0.0.255 destination 192.168.2.0 0.0.0.255destination-port eq ftp必须在r-acl-adv-3001下才能执行rule permit ip source an destination any (rule permit ip)int e3/0firewall enable开启防火墙firewall packet-filter 3001 inbound必须在端口E3/0下才能执行八、命令的标准访问IP列表（三层交换机）：允许A组机器访问服务器内资料，不允许访问B组机器（服务器没有限制）sysvlan 10name servervlan 20name teachervlan 30name studentint el/0/5port access vlan 10int el/0/10port access vlan 20int el/0/15port access vlan 30int vlan 10ip address192.168.10.1255.255.255.0undo shint vlan 20ip address192.168.20.1255.255.255.0int vlan 30ip address192.168.30.1255.255.255.0acl number 2001rule1 deny source192.168.30.00.0.0.255rule 2 permit source anydisp acl2001查看2001列表int el/0/10port access vlan 20packet-filter outbound ip-group 2001 rule 1出口九、允许A机器访问B机器的TP但不允许访问WWW,C机器没有任何限制。vlan 10vlan 20vlan 30int el/0/5port access vlan 10inte1/0/10port access vlan 20int el/0/15port access vlan 30int vlan 10ip address192.168.10.1255.255.255.0undo shint vlan 20ip address192.168.20.1255.255.255.0int vlan 30ip address192.168.30.1255.255.255.0acl number 3001rule1 deny tcp source192.168.30.00.0.0.255 destination192.168.10.00.0.0.255destination-port eq wwwint el/0/15packet-filter inbound ip-group 3001 rule 1进口十、NAT地址转换（单一静态一对一地址转换）R1:syssysname R1int el/0ip address192.168.3.1255.255.255.0int e2/0ip address192.1.1.1255.255.255.0R2:syssysname R2int e2/0ip address192.1.1.2255.255.255.0int el/0ip address10.80.1.1255.255.255.0回到R1:nat static192.168.3.1192.1.1.1int e2/0nat outbound staticip route0.0.0.00.0.0.0192.1.1.2十一、NAT内部整网段地址转换R1:syssysname R1int el/0ip address192.168.3.1255.255.255.0