中兴交换机配置总结
中兴接口配置是模块化的，
一 VRF和接口配置
2.1 VRF配置
!<vrf>
ip vrf NET-manage
description NET-manage
rd 1:1
address-family ipv4
$
!</vrf>
2.2 接口配置
!<if-intf>
interface cgei-0/1/0/1
description TO-Leaf01
ip address X.X.14.125 255.255.255.252
no shutdown
switch attribute disable
$
interface cgei-0/1/0/2
description TO-Leaf02
ip address X.X.14.149 255.255.255.252
no shutdown
switch attribute disable
$
interface cgei-0/1/0/13
description NO-USE
$
interface cgei-0/1/0/14
description NO-USE
$
interface mgmt_eth //带外管理接口默认属于vrf NET-manage
ip address X.X.37.11 255.255.255.0
$
二 ISIS路由协议配置
!<isis>
router isis 1
area 86.0757
system-id 0100.3703.0011
is-type level-2-only
metric-style wide
fast-flood 15
lsp-refresh-time 32768
max-lsp-lifetime 65535
lsp-gen-interval 1 10 20 level-2
spf-interval 1 100 100 level-2
prefix-priority critical tag 100 level-2
interface loopback11
ip router isis
circuit-type level-2-only
tag 20
$
interface xlgei-0/2/0/1
ip router isis
circuit-type level-2-only
network point-to-point
$
interface xlgei-0/2/0/2
ip router isis
circuit-type level-2-only
network point-to-point
$
三 BGP路由协议配置
!<bgp>
router bgp 64722
synchronization disable
bgp router-id X.X.30.11
neighbor evpn peer-group
neighbor evpn remote-as 64722
neighbor evpn activate disable
neighbor evpn update-source loopback11
neighbor evpn fall-over bfd interval 500 min-rx 500 multiplier 3
neighbor X.X.30.13 remote-as 64722
neighbor X.X.30.13 peer-group evpn
neighbor X.X.30.14 remote-as 64722
neighbor X.X.30.14 peer-group evpn
neighbor X.X.30.15 remote-as 64723
neighbor X.X.30.15 activate disable
neighbor X.X.30.15 ebgp-multihop ttl 3
neighbor X.X.30.15 update-source loopback11
neighbor X.X.30.15 fall-over bfd interval 500 min-rx 500 multiplier 3
neighbor X.X.30.19 remote-as 64722
neighbor X.X.30.19 peer-group evpn
$
address-family l2vpn evpn
neighbor evpn activate
neighbor evpn route-reflector-client
neighbor X.X.30.15 activate
neighbor X.X.30.15 next-hop-unchanged
$
四 静态路由配置
!<static>
ip route vrf mng 0.0.0.0 0.0.0.0 X.X.37.254 name For_Management
ip route vrf mng X.X.36.0 255.255.254.0 X.X.37.254 name For_Management
!</static>
五 NTP配置
!<ntp>
ntp enable
ntp server vrf mng X.X.37.254 priority 1
ntp source interface mgmt_eth
!</ntp>
六 日志配置
!<alarm>
logging file default almlog
accept on
$
logging file default cmdlog
buffer 1000
$
logging file default netclog
accept on
$
logging file default snmplog
accept on
$
logging file default srvlog
accept on
interval 10
$
logging snmp
accept on
match cmdlog
$
syslog level warnings
syslog-server facility local4
syslog-server host vrf mng X.X.170.134 fport 5000 alarmlog cmdlog debugmsg servicelog braslog natlog netconflog
syslog-server host vrf mng X.X.170.135 fport 5000 alarmlog cmdlog debugmsg servicelog braslog natlog netconflog
!</alarm>
七 snmp配置
!<snmp>
snmp-server community encrypted admin@123 view AllView ro ipv4-access-list 2
000
snmp-server enable inform snmp
snmp-server enable inform bgp
snmp-server enable inform interface
snmp-server enable inform acl
snmp-server enable inform isis
snmp-server enable inform system
snmp-server enable trap ping-trace
snmp-server enable trap gm
snmp-server host vrf mng X.X.170.134 trap version 2c encrypted c9feff80ae160235f32e4f76720c59c5bbac9a3ea0ad0bfa92c8fe8c75670567
udp-port 162 snmp bgp mac ospf stp ppp arp rmon udld cfm efm lacp mc-elam tcp sctp stalarm cps interface acl fib pim isis rip msdp
aps config am um system ldp pwe3 vpn mpls-oam ptp tunnel-te radius dhcp bfd
snmp-server host vrf mng X.X.170.134 trap version 2c encrypted c9feff80ae160235f32e4f76720c59c5bbac9a3ea0ad0bfa92c8fe8c75670567
udp-port 162 ippool ntp ssm sqa ipsec cgn vrrp ftp_tftp ping-trace gm
snmp-server host vrf mng X.X.170.135 trap version 2c encrypted c9feff80ae160235f32e4f76720c59c5bbac9a3ea0ad0bfa92c8fe8c75670567
udp-port 162 snmp bgp mac ospf stp ppp arp rmon udld cfm efm lacp mc-elam tcp sctp stalarm cps interface acl fib pim isis rip msdp
aps config am um system ldp pwe3 vpn mpls-oam ptp tunnel-te radius dhcp bfd
snmp-server host vrf mng X.X.170.135 trap version 2c encrypted c9feff80ae160235f32e4f76720c59c5bbac9a3ea0ad0bfa92c8fe8c75670567
udp-port 162 ippool ntp ssm sqa ipsec cgn vrrp ftp_tftp ping-trace gm
snmp-server trap-source interface mgmt_eth
snmp-server version v2c enable
snmp-server version v3 enable
!</snmp>
八 ssh和telnet配置
8.1 ACL配置
!<ipv4-acl>
ipv4-access-list 2001
rule 10 permit 192.168.0.0 0.0.7.255
rule 15 permit 192.168.8.0 0.0.7.255
rule 20 permit 192.168.120.0 0.0.0.255
rule 1000 deny any
$
ipv4-access-list 2000
rule 10 permit 10.249.170.134 0.0.0.0
rule 20 permit 10.249.170.135 0.0.0.0
rule 30 permit 10.249.170.6 0.0.0.0
rule 1000 deny any
$
!</ipv4-acl>
8.2 设备登录用户配置
!<system-user>
system-user
authorization-template 1
bind aaa-authorization-template 2019
local-privilege-level 15
$
authorization-template 2
bind aaa-authorization-template 2019
local-privilege-level 5
$
authentication-template 1
bind aaa-authentication-template 2019
$
user-name COC_monitor
bind authentication-template 1
bind authorization-template 2
password encrypted d8dcd6017947bbfd1ed5ab7ad148be2fcaba46d82bcab5a97f3a855ec45fff29
$
user-name COC_operator
bind authentication-template 1
bind authorization-template 1
password encrypted bda2cd0e6ef30d139d8b6516ca1aca68256bc4ab2cd50b4f7dd54ac21069d365
$
user-name openstackadmin
bind authentication-template 1
bind authorization-template 1
password encrypted bda2cd0e6ef30d139d8b6516ca1aca68256bc4ab2cd50b4f7dd54ac21069d365
$
user-name yundiao_read
bind authentication-template 1
bind authorization-template 2
password encrypted 98fbe5d15da875e0b72f439496fdec30697dabbfed669640a5a2aa6832af355e
$
$
!</system-user>
8.3 ssh配置
!<ssh>
ssh server access-class ipv4 2001
ssh server enable
!</ssh>
4.telnet配置
!<telnet>
line console absolute-timeout 30
line console idle-timeout 10
line telnet server disable
line telnet absolute-timeout 30
line telnet idle-timeout 10
line telnet access-class ipv4 Login
line telnet max-link 10
!</telnet>