Detailed explanation of H3C router configuration commands

Detailed explanation of H3C router configuration commands
Detailed explanation of H3C router configuration commands
En enters privileged mode conf enters global configuration mode in s0 Enter serial 0 port configure ip add xxx. xxx. xxx. xxx. xxx. xxx. add the ip address and mask to xxx. China Telecom allocates the enca hdlc/ppp bundled link protocol hdlc or the ppp ip unn e0 exit and returns to the global configuration mode in e0 to enter the Ethernet interface configuration ip add xxx. xxx. xxx. xxx. xxx. xxx. xxx adds the ip address and mask, and China Telecom assigns exit to return to global configuration mode ip route 0.0.0.0 0.0.0.0 s 0 add route table ena password write exit above according to China Telecom ddn leased line application in most cases
Normal user mode enable transfer to privileged user mode exit configuration help system help brief description language mode switch ping Check network host connection and host accessible show system running information telnet remote login function tracert tracking what router privileged user modes have the destination passed #? Clear statistics
Clock management system clock configure enters global configuration mode debug enable debug switch disable return normal user mode download new software and configuration file erase FLASH configuration exec-timeout open EXEC timeout exit switch exit configure first-config settings or clear the first configuration flag help System help brief language mode switch monitor turn on User Screen debug information output switch no turn off debug switch ping Check network host connection and host is up to reboot vro restart setup configure vro parameter show display system running information telnet remote login function tracert trace to the destination router unmonitor disabled user Screen debug information output switch write Save the current configuration parameters to FLASH MEM medium
Global configuration mode aaa-enable enables configuration of AAA (authentication, authorization, and billing) access-list configuration standard access table arp settings static ARP population chat-generate an execution script for modem custom-list create custom queue list dialer-list create dialer-list dram-wait settings DRAM Wait Status
Enable modify ENABLE password exit global configuration mode firewall Configure firewall Status flow-interval set traffic control interval-relay Frame relay global configuration command set ftp-server FTP server help System help Command brief host add host Name and its IP address hostname Modify host name ifquelen change interface queue length interface select configure interface ip Global IP configuration command subset ipx global IPX configuration command subset loghost set log Host IP address logic-channel Configuration logical Channel login starts EXEC login verification modem-timeout set modem timeout Time multi configure multi user Interface multi-user configure multi user Interface natserver set FTP, TELNET, WWW Service IP address no disable some parameter switches priority-list create priority queue list router start route processing settr set time range snmp-server modify SNMP parameter tcp configuration global TCP Parameter timerange start or close in the time zone, if the user is in PPP authentication, add the user vpdn to the system to set VPDN.
Vpdn-group: VPDN group x25 X.25 protocol group Layer
Common commands for H3C Switches
Author: admin Date: 2009-12-19
Font size: medium or large
H3C switch Common commands ################################# ###################################### 3 1, system-view 2, sysname into the system view Mode
Name a device
3. display current-configuration current configuration 4. language-mode Chinese | English/Chinese switch 5. interface Ethernet 1/0/1 Enter Ethernet port view 6. port-type Access | Trunk | Hybrid 7. undo shutdown 8, shutdown 9, and quit enable the Ethernet port to set the port access mode
Disable the Ethernet port
Exit current view mode create VLAN 10 and enter VLAN 10 view mode Add the current port to vlan 10 in Port mode Add the specified port to the current VLAN in vlan mode allow all through
10. vlan 10
11. port access vlan 10 12, port E1/0/2 to E1/0/5
13. port trunk permit vlan all
H3C router ###################################### ######################################## ######## 1. system-view 2. Enter sysname R1 in system view Mode and name the device R1
3. display ip routing-table to display the current route table
4. language-mode Chinese | switch between English and Chinese 5. Switch interface Ethernet 0/0 to Ethernet port view 6. ip address 192.168.1.1 255.255.255.0 7, undo shutdown 8, shutdown 9, and quit to enable Ethernet port configuration IP address and subnet mask
Disable the Ethernet port
Exit current view mode
10. ip route-static 192.168.2.0 255.255.255.0 192.168.12.2 de ion. r2 configures static routes from 11 and ip route-static 0.0.0.0 0.0.0.0 192.168.12.2 de ion. r2 configures the default route H3C S3100 Switch H3C S3600 Switch H3C MSR 20-20 Router ####################### ######################################## ########################## 1. Adjust the display font size of the Super Terminal; 2. Capture the Super Terminal command line for future check; 3. language-mode Chinese | English and Chinese switch; 4. Copy the command to the Super Terminal command line and paste it to the host; 5. Submit Switch to clear the configuration: reset save; reboot; 6. When configuring a vro or vswitch, the power cannot be lost. Before connecting to the test, check the network connectivity and avoid making the lowest-level errors. 7. 192.168.1.1/24 is equivalent to 192.168.1.1 255.255.255.0. When configuring vswitches and vrouters,
192.168.1.1 255.255.255.0 can be written as: 192.168.1.1 24 8, device naming rules: Place Name-device name-series example: PingGu-R-S3600
######################################## ######################################## ################################# Basic configuration of H3C Huawei switch port binding
1. Port + MAC a) the AM command uses the special AM User-bind command to bind the MAC address to the port. For example, [SwitchA] am user-bind mac-address 00e0-fc22-f8d3 interface Ethernet 0/1 configuration Description: because port parameters are used, the port is used as a reference object, in this case, port E0/1 only allows PC1 to access the Internet, while PC machines that use other unbound MAC addresses cannot access the Internet. However, PC1 can use this MAC address to access the Internet on other ports.
B) The mac-address command uses the mac-address static command to bind the MAC address to the port. For example, [SwitchA] mac-address static 00e0-fc22-f8d3 interface Ethernet 0/1 vlan 1 [SwitchA] mac-address max-mac-count 0 configuration Description: Because the port learning function is used, therefore, after the mac address is statically bound, you need to set the mac address of the port to 0 so that other PCs cannot learn the mac address after accessing the port.
2. IP + MAC a) the AM command uses the special AM User-bind command to bind the IP address to the MAC address. For example, [SwitchA] am user-bind ip-address 10.1.1.2 mac-address 00e0-fc22-f8d3 configuration description: The preceding configuration completes global binding of the IP address and MAC address of the PC machine, that is, a PC machine with a different IP address or MAC address cannot access the Internet on any port. Supported models: S3026E/EF/C/G/T, S3026C-PWR, E026/E026T, S3050C, E050, S3526E/C/EF, S5012T/G, S5024G B) arp commands use special arp static commands to bind IP addresses to MAC addresses. For example, [SwitchA] arp static 10.1.1.2 00e0-fc22-f8d3 configuration Description: The above configuration completes global binding of the IP address and MAC address of the PC machine.
3. Port + IP + MAC: use the special AM User-bind command to bind the IP address, MAC address, and port. For example:
[SwitchA] am user-bind ip-address 10.1.1.2 mac-address 00e0-fc22-f8d3 interface Ethernet 0/1 configuration instructions: you can bind the IP address, MAC address, and E0/1 of pc1. Because port parameters are used, the port is used as a reference object, that is, port E0/1 allows only PC1 to access the Internet, however, PCs that use other unbound IP addresses and MAC addresses cannot access the Internet. However, PC1 can use this IP address and MAC address to access the Internet on other ports.
######################################## ######################################## ############# [S2016-E1-Ethernet0/1] mac-address max-mac-count 0; go to the port and run mac max-mac-count 0 (set the number of mac learning ports to 0) [S2016-E1] mac static 0000-9999-8888 int e0/1 vlan 10; bind port 0000-9999-8888 to port e0/1. Only the pc bound to the mac can access the Internet through this port, and E0/1 belongs to vlan 10. OK, however, the order of the above two commands cannot be reversed unless the port is not connected to a pc
######################################## ######################################## ######## Dis vlan display vlan name text specifies the name of the current vlan undo name cancel [h3c] vlan 2 [h3c-vlan2] name test vlan dis users Display User dis startup display start the configuration file information dis user-interface displays information about the user interface dis web users displays information about web users. Header login configuration login verification is to display information header shell undo header
Lock current user interface acl Access Control List acl number inbound/outbound [h3c] user-interface vty 0 4 [h3c-vty0-4] acl 2000 inbound shutdown: disable vlan interface undo shutdown open vlan interface disable vlan1 interface [h3c] interface vlan-interface 1 [h3c-vlan-interface] shutdown vlan-id defined vlan undo valn vlan-id display ip routing-table display ip routing-table protocol static display ip routing-table statistics display ip routing-table verbose view all details of the route table interface vlan-id Entry valn management-vlan-id Definition manage the vlan ID reset ip routing-table statistics protocol all to clear route information for all routing protocols. display garp statistics interface GigabitEthernet 1/0/1 display garp statistics on Ethernet ports display voice vlan status view voice vlan status [h3c-GigabitEthernet1/0/1] broadcast-suppression 20 maximum broadcast traffic allowed 20% of the transmission capability of the port. the excess part is discarded. [h3c-GigabitEthernet1/0/1] broadcast-suppression pps 1000 the maximum number of broadcast packets allowed per second is 1000 of the transmission capability. the excess part is discarded. display interface GigabitEthernet1/0/1 view port information display brief interface GigabitEthernet1/0/1 view port brief configuration information display loopback-detection is used to test whether to enable display transceiver-information interface GigabitEthernet1/0/50 display optical port information duplex auto/full/half [h3c] interface GigabitEthernet1/0/42
[H3c-GigabitEthernet1/0/1] duplux auto set port duplex attribute to self-negotiated port-type access/hybrid/trunk default is access port trunk permit vlan all add trunk buckle to all VLANs reset counters interface gigabitEthernet1/0/1 clear port statistics speed auto 10/100/1000 display port-security view port security configuration information am user-bind mac-addr 00e0-fc00-5101 ip-addr 10.153.1.2 interface GigabitEthernet1/0/1 port ip display arp display am user-bind when binding display arp display port binding configuration information Display mac-address display the mac address learned by the switch display stp display Spanning Tree status and Statistics [h3c-GigabitEthernet1/0/1] stp instance 0 cost 200 set Spanning Tree instance 0 path overhead to 200 stp cost sets the path overhead of the current port on the specified Spanning Tree instance. Instance-id: 0-16 0 table cist value range: 1-200000 display system-guard ip-record: Attack Protection record information. system-guard enable system Attack prevention function display icmp statistics icmp traffic statistics display ip socket display ip statistics display acl all acl number acl-number match-order auto/config acl-number (2000- 2999 is the basic acl 3000-3999 is the number reserved by the advanced acl for the Administrator) rule deny/permit protocal Access Control [h3c] acl number 3000 [h3c-acl-adv-3000] rule permit tcp source 129.0.0 0.0.255.255 destination 202.38.160.0 0.0.255.255 destination-port eq 80 (define advanced acl 3000, allow hosts in the 129.0.0/16 network segment to access port 80 from hosts in the 202.38.160/24 network segment.) rule permit source 211.100.255.0 0.20.255.255
Rule deny cos 3 souce 00de-bbef-adse ffff-fff dest 0011-4301-9912 ffff-ffff (prohibit mac address 00de-bbef-adse from sending to mac address 0011-4301-9912 and priority 802.1 p 3) display qos-interface GigabitEthernet1/0/1 traffic-limit view traffic port speed limit on the port line-rate inbound/outbound target-rate inbound: speed limit on received packets on the port outbound: limits the speed of packets sent from the port. The target-rate limits the packet speed. The unit is kbps. The Gbit/s port inbound range is 1-1000000 outbound range: 20-1000000 undo l. Ine-rate cancel speed limit. [h3c] interface GigabitEthernet1/0/1 [h3c-GigabitEthernet1/0/1] line-rate outbound 128 limit outgoing rate: 128 kbps display arp | include 77 display arp count arp table records display ndp display the detailed configuration of the vswitch port. Display ntdp device-list verbose collect device details display lock display users display cpu display memory display fan display device display power
Router Firewall Configuration Guide
Author: admin Date: 2009-12-02
Font size: medium or large
ICG Firewall Configuration Guide 1 firewall Introduction
On the one hand, the firewall can block unauthorized access from the Internet to the protected network, and on the other hand, it can be used as a permission Control Gateway for accessing the Internet, allows users in the internal network to access the Internet or send and receive E-mails. Reasonable firewall configuration can greatly improve network security and stability. 2 2.1 the basic configuration sequence of the firewall is as follows: first enable the firewall: ipv4: Enter firewall enable ipv6 in the System View: in the system view, enter firewall ipv6 enable and configure the acl number 3000 rule 0 permit ip source 1.0.0.1 0 rule 10 deny ip. Then, apply the firewall interface Ethernet0/1 port-mode route on the interface as needed. firewall packet-filter 3000 inbound ip address 5.0.0.2 255.255.255.0 2.2 basic configuration example: basic configuration steps Firewall Configuration Guide
As mentioned above, after enabling the firewall, You need to configure the acl as required and apply it to the interface. Below are several common configuration methods: the following is an example of et0/1 et0/0:
Intranet and Internet
The Intranet address 192.168.0.2-192.168.1.255 2.2.1 prohibits access to the Internet. For example, disabling access to 100.0.0.1 address acl Configuration: [H3C] acl n 3000 [H3C-acl-adv-3000] rule deny ip destination 100.0.0.1 0 [H3C-acl-adv-3000] rule permit ip port configuration, configure firewall [H3C] int et0/1 [H3C-Ethernet0/1] firewall packet-filter 3000 inbound remarks: 1) If you want to disable a CIDR block, you can configure an appropriate mask. 2) If there are more than one Intranet port, you can configure the mask for each Intranet port, alternatively, you can configure firewall 2.2.2 In the outbound direction of the outer network port to restrict access to certain Internet addresses only. For example, you can only access the acl Configuration of CIDR Block 200.0.0.1/24: [H3C] acl n 3000 [H3C-acl-adv-3000] rule permit ip destination 200.0.0.1 0.0.255 allow access to CIDR Block 200.0.0.1/24 [H3C-acl-adv-3000] rule deny ip port configuration, configure firewall [H3C] int et0/1 [H3C-Ethernet0/1] firewall packet-filter 3000 inbound in the inbound direction of the inner network port remarks: 1) If you want to add other allowed network segments, you need to add the corresponding rule 2) If there are more than one internal network port, you can configure each required Intranet port, or configure the firewall in the outbound direction of the external network port to prohibit access to other network segments and allow other ip addresses to disable 100.0.0.1
2.2.3 only some addresses can access the internet. Purpose: Restrict Internet access. For example, to allow only 192.168.1.0/24 CIDR block access to the internet acl Configuration: [H3C] acl n 3000 [H3C-acl-adv-3000] rule permit ip source 192.168.1.0 0.0.255 Internet [H3C-acl-adv-3000] rule deny ip port configuration, configure firewall [H3C] int et0/1 [H3C-Ethernet0/1] firewall packet-filter 3000 inbound remarks: 1) for more precise control, you can add more refined mask matching to multiple rule entries. 2) If there are more than one Intranet port, you can configure the firewall in each Intranet port or in the outbound direction of the Internet port. 2.2.4 prohibit certain addresses from accessing the Internet: Restrict Internet access. For example, to disable access to the internet acl from the addresses 192.168.0.5 and 192.168.1.59: [H3C] acl n 3000 [H3C-acl-adv-3000] rule deny ip source 192.168.0.5 0 [H3C-acl-adv-3000] rule deny ip source 192.168.1.59 0 [H3C-acl-adv-3000] rule permit ip port configuration, configure firewall [H3C] int et0/1 [H3C-Ethernet0/1] firewall packet-filter 3000 inbound in the inbound direction of the internal network port remarks: 1) If you want to control the network segment, match the CIDR block when setting the rule. 2) If there are more than one internal network port, you can configure the firewall in each required Intranet port or in the outbound direction of the external network port. 2.2.5 prohibit some addresses from accessing the Intranet: place illegal access. For example, disable the Intranet access from the address range 200.0.0.1/24: acl Configuration: [H3C] acl n 3000 [H3C-acl-adv-3000] rule deny ip source 200.0.0.1 0.0.0.255 [H3C-acl-adv-3000] rule permit ip allow access from other addresses prohibited from 200.0.0.1/24 allow access from other addresses prohibited from 192.168.0.5 address 192.168.1.59 address prohibited from other addresses address Access allows access from 192.168.1.0/24
Port configuration, configure firewall [H3C] int et0/0 [H3C-Ethernet0/0] firewall packet-filter 3000 inbound in the inbound direction of the outer network port remarks: if multiple network segments need to be disabled, you need to configure multiple rule 2.2.6 to restrict some Intranet addresses from accessing the Internet. For example, the address segment of 192.168.1.0/24 cannot access the acl Configuration of 200.0.0.1/24: [H3C] acl n 3000 [H3C-acl-adv-3000] rule deny ip source 192.168.1.0 0.0.0.255 destination 200.0.0.1 0.0.0.255 [H3C-acl-adv-3000] rule permit ip port configuration, configure firewall [H3C] int et0/1 [H3C-Ethernet0/1] firewall packet-filter 3000 inbound remarks: if multiple network segments need to be disabled, you need to configure multiple rules 2.2.7 to restrict the use of ICMP packets: Anti-attack. Only ping packets are allowed, and other icmp packets are blocked to prevent attack acl Configuration: [H3C] acl n 3000 [H3C-acl-adv-3000] rule permit icmp-type echo [H3C-acl-adv-3000] rule permit icmp-type echo-reply [H3C-acl-adv-3000] rule permit icmp-type ttl-exceeded [H3C-acl-adv-3000] rule deny icmp port configuration, configure firewall [H3C] int et0/0 [H3C-Ethernet0/0] firewall packet-filter 3000 inbound 2.2.8 to Prohibit Internet access to a port purpose: Attack Protection, restrict application. For example, to disable access to port 300 through the Internet, configure the acl: [H3C] acl n 3000 allows other addresses
[H3C-acl-adv-3000] rule deny tcp destination-port eq 300 port configuration, configure firewall in the outer port inbound [H3C] int et0/0 [H3C-Ethernet0/0] firewall packet-filter 3000 inbound remarks: you can configure a port to not access 2.2.9. Only allow access to a port from the Internet. Purpose: prevent attacks and restrict applications. For example, to allow only Internet access to the ftp port acl Configuration: [H3C] acl n 3000 [H3C-acl-adv-3000] rule permit tcp destination-port eq ftp port configuration, configure firewall in the inbound direction of the outer network port [H3C] int et0/0 [H3C-Ethernet0/0] firewall packet-filter 3000 inbound [H3C-acl-adv-3000] rule deny tcp remarks: you can add an ip address to the application. For example, if a machine on the Intranet is an ftp server, you can configure this address to only open the ftp port. 2.3 Advanced Configuration
2.3.1 using the preceding configuration, you can configure multiple rules in an acl, or configure inbound and outbound rules on one port for matching. through flexible application and combination, implement the required protection and restrictions. 2.3.2 filter out common attacks through the firewall and filter out some common attacks. Below are some common configurations recommended: restrict the NETBIOS protocol Port: [H3C] acl number 3000 [H3C-acl-adv-3000] rule deny udp destination-port eq netbios-ns [H3C-acl-adv-3000] rule deny udp destination-port eq netbios-dgm [H3C-acl-adv-3000] rule deny tcp destination- port eq 139 [H3C-acl-adv-3000] rule deny udp destination-port eq netbios-ssn limits ports used by common viruses: [H3C] acl number 3000
[H3C-acl-adv-3000] rule deny tcp destination-port eq 135 [H3C-acl-adv-3000] rule deny udp destination-port eq 135 [H3C-acl-adv-3000] rule deny tcp destination-port eq 445 [H3C-acl-adv-3000] rule deny udp destination -port eq 445 [H3C-acl-adv-3000] rule deny udp destination-port eq 593 [H3C-acl-adv-3000] rule deny tcp destination-port eq 593 [H3C-acl-adv-3000] rule deny tcp destination-port eq 1433 [H3C-acl-adv-3000] rule deny tcp destination-port eq 1434 [H3C-acl-adv-3000] rule deny tcp destination-port eq 4444 [H3C-acl-adv-3000] rule deny tcp destination-port eq 1025 [H3C-acl-adv-3000] rule deny tcp destination-port eq 1068 [H3C-acl-adv-3000] rule deny tcp destination-port eq 707 [H3C-acl-adv-3000] rule deny tcp destination-port eq 5554 [H3C-acl-adv-3000] rule deny tcp destination-port eq 9996 2.3.3 set the time period
/Worm. blaster/Worm. blaster/Worm. blaster/Worm. blaster/Worm. blaster/Worm. blaster/SQL Slammer/Worm. blaster/Sasser/Nachi blster-D/Sasser
If you want to restrict the firewall to take effect within a certain period of time, you need to configure time-range and add this restriction to the acl's rule. The method is as follows: for example, during working hours, the Internet can only access 100.0.0.1, and other time periods are not limited: [H3C] time-range worktimeam to working-day defines the morning [H3C] time-range worktimepm to working-day defines the afternoon if "Lunch Break" is not required, that can be defined as-acl [H3C] acl n 3000 [H3C-acl-adv-3000] rule permit ip destination 100.0.0.1 0 time-range worktimeam [H3C-acl-adv-3000] rule permit ip destination 100.0.0.1 0 time-range worktimepm [H3C-acl-adv-3000] rule deny ip time-range worktimeam [H3C-acl-adv-3000] rule deny ip time-range worktimepm port configuration, configure Firewall [H3C] int et0/1 in the Inbound direction of the Intranet Port
[H3C-Ethernet0/1] firewall packet-filter 3000 inbound 2.3.1 configuration recommendations
For the most basic applications, the following configuration templates are provided, including blocking common attacks and Intranet and Internet access control. Intranet port: acl number 3101 rule 10 permit icmp-type echo rule 20 permit icmp-type echo-reply rule 30 permit icmp-type ttl-exceeded rule 40 deny icmp
Rule 110 deny tcp destination-port eq 135 rule 120 deny udp destination-port eq 135 rule 130 deny udp destination-port eq netbios-ns rule 140 deny udp destination-port eq netbios-dgm rule 150 deny tcp destination-port eq 139 rule 160 deny udp destination-port eq netbios-ssn rule 170 deny tcp destination-port eq 445 rule 180 deny udp destination-port eq 445 rule 190 deny udp destination-port eq 593 rule 200 deny tcp destination-port eq 593 rule 210 deny tcp destination-port eq 1433 rule 220 deny tcp destination-port eq 1434 rule 230 deny tcp destination- port eq 4444 rule 240 deny tcp destination-port eq 1025 rule 250 deny tcp destination-port eq 1068 rule 260 deny tcp destination-port eq 707 rule 270 deny tcp destination-port eq 5554 rule 280 deny tcp destination-port eq 9996 rule 2000 permit ip source 192.168.0.0 0.0.1.255 rule 3000 deny ip
# Applications under an intranet interface: interface vlan-interface 1 ip address 192.168.0.1 255.255.254.0 firewall packet-filter 3101 inbound Internet port acl number 3102 rule 10 permit icmp-type echo rule 20 permit icmp-type echo-reply rule 30 permit icmp-type ttl-exceeded rule 40 deny icmp
Rule 110 deny tcp destination-port eq 135 rule 120 deny udp destination-port eq 135 rule 130 deny udp destination-port eq netbios-ns rule 140 deny udp destination-port eq netbios-dgm rule 150 deny tcp destination-port eq 139 rule 160 deny udp destination-port eq netbios-ssn rule 170 deny tcp destination-port eq 445 rule 180 deny udp destination-port eq 445 rule 190 deny udp destination-port eq 593 rule 200 deny tcp destination-port eq 593 rule 210 deny tcp destination-port eq 1433 rule 220 deny tcp destination-port eq 1434 rule 230 deny tcp destination- port eq 4444 rule 240 deny tcp destination-port eq 1025 rule 250 deny tcp destination-port eq 1068 rule 260 deny tcp destination-port eq 707 rule 270 deny tcp destination-port eq 5554 rule 280 deny tcp destination-port eq 9996 rule 2000 permit ip destination 192.168.0.0 0.0.1.255 rule 2010 permit tcp destination-port eq 23 rule 3000 deny ip # apply under the WAN Interface: port ethernet 0/0
Ip address 202.198.11.2 255.255.255.0 firewall packet-filter 3102 inbound