中兴接口配置是模块化的一 VRF和接口配置2.1 VRF配置!vrfip vrf NET-managedescription NET-managerd 1:1address-family ipv4$!/vrf2.2 接口配置!if-intfinterface cgei-0/1/0/1description TO-Leaf01ip address X.X.14.125 255.255.255.252no shutdownswitch attribute disable$interface cgei-0/1/0/2description TO-Leaf02ip address X.X.14.149 255.255.255.252no shutdownswitch attribute disable$interface cgei-0/1/0/13description NO-USE$interface cgei-0/1/0/14description NO-USE$interface mgmt_eth //带外管理接口默认属于vrf NET-manageip address X.X.37.11 255.255.255.0$二 ISIS路由协议配置!isisrouter isis 1area 86.0757system-id 0100.3703.0011is-type level-2-onlymetric-style widefast-flood 15lsp-refresh-time 32768max-lsp-lifetime 65535lsp-gen-interval 1 10 20 level-2spf-interval 1 100 100 level-2prefix-priority critical tag 100 level-2interface loopback11ip router isiscircuit-type level-2-onlytag 20$interface xlgei-0/2/0/1ip router isiscircuit-type level-2-onlynetwork point-to-point$interface xlgei-0/2/0/2ip router isiscircuit-type level-2-onlynetwork point-to-point$三 BGP路由协议配置!bgprouter bgp 64722synchronization disablebgp router-id X.X.30.11neighbor evpn peer-groupneighbor evpn remote-as 64722neighbor evpn activate disableneighbor evpn update-source loopback11neighbor evpn fall-over bfd interval 500 min-rx 500 multiplier 3neighbor X.X.30.13 remote-as 64722neighbor X.X.30.13 peer-group evpnneighbor X.X.30.14 remote-as 64722neighbor X.X.30.14 peer-group evpnneighbor X.X.30.15 remote-as 64723neighbor X.X.30.15 activate disableneighbor X.X.30.15 ebgp-multihop ttl 3neighbor X.X.30.15 update-source loopback11neighbor X.X.30.15 fall-over bfd interval 500 min-rx 500 multiplier 3neighbor X.X.30.19 remote-as 64722neighbor X.X.30.19 peer-group evpn$address-family l2vpn evpnneighbor evpn activateneighbor evpn route-reflector-clientneighbor X.X.30.15 activateneighbor X.X.30.15 next-hop-unchanged$四 静态路由配置!staticip route vrf mng 0.0.0.0 0.0.0.0 X.X.37.254 name For_Managementip route vrf mng X.X.36.0 255.255.254.0 X.X.37.254 name For_Management!/static五 NTP配置!ntpntp enablentp server vrf mng X.X.37.254 priority 1ntp source interface mgmt_eth!/ntp六 日志配置!alarmlogging file default almlogaccept on$logging file default cmdlogbuffer 1000$logging file default netclogaccept on$logging file default snmplogaccept on$logging file default srvlogaccept oninterval 10$logging snmpaccept onmatch cmdlog$syslog level warningssyslog-server facility local4syslog-server host vrf mng X.X.170.134 fport 5000 alarmlog cmdlog debugmsg servicelog braslog natlog netconflogsyslog-server host vrf mng X.X.170.135 fport 5000 alarmlog cmdlog debugmsg servicelog braslog natlog netconflog!/alarm七 snmp配置!snmpsnmp-server community encrypted admin123 view AllView ro ipv4-access-list 2000snmp-server enable inform snmpsnmp-server enable inform bgpsnmp-server enable inform interfacesnmp-server enable inform aclsnmp-server enable inform isissnmp-server enable inform systemsnmp-server enable trap ping-tracesnmp-server enable trap gmsnmp-server host vrf mng X.X.170.134 trap version 2c encrypted c9feff80ae160235f32e4f76720c59c5bbac9a3ea0ad0bfa92c8fe8c75670567udp-port 162 snmp bgp mac ospf stp ppp arp rmon udld cfm efm lacp mc-elam tcp sctp stalarm cps interface acl fib pim isis rip msdpaps config am um system ldp pwe3 vpn mpls-oam ptp tunnel-te radius dhcp bfdsnmp-server host vrf mng X.X.170.134 trap version 2c encrypted c9feff80ae160235f32e4f76720c59c5bbac9a3ea0ad0bfa92c8fe8c75670567udp-port 162 ippool ntp ssm sqa ipsec cgn vrrp ftp_tftp ping-trace gmsnmp-server host vrf mng X.X.170.135 trap version 2c encrypted c9feff80ae160235f32e4f76720c59c5bbac9a3ea0ad0bfa92c8fe8c75670567udp-port 162 snmp bgp mac ospf stp ppp arp rmon udld cfm efm lacp mc-elam tcp sctp stalarm cps interface acl fib pim isis rip msdpaps config am um system ldp pwe3 vpn mpls-oam ptp tunnel-te radius dhcp bfdsnmp-server host vrf mng X.X.170.135 trap version 2c encrypted c9feff80ae160235f32e4f76720c59c5bbac9a3ea0ad0bfa92c8fe8c75670567udp-port 162 ippool ntp ssm sqa ipsec cgn vrrp ftp_tftp ping-trace gmsnmp-server trap-source interface mgmt_ethsnmp-server version v2c enablesnmp-server version v3 enable!/snmp八 ssh和telnet配置8.1 ACL配置!ipv4-aclipv4-access-list 2001rule 10 permit 192.168.0.0 0.0.7.255rule 15 permit 192.168.8.0 0.0.7.255rule 20 permit 192.168.120.0 0.0.0.255rule 1000 deny any$ipv4-access-list 2000rule 10 permit 10.249.170.134 0.0.0.0rule 20 permit 10.249.170.135 0.0.0.0rule 30 permit 10.249.170.6 0.0.0.0rule 1000 deny any$!/ipv4-acl8.2 设备登录用户配置!system-usersystem-userauthorization-template 1bind aaa-authorization-template 2019local-privilege-level 15$authorization-template 2bind aaa-authorization-template 2019local-privilege-level 5$authentication-template 1bind aaa-authentication-template 2019$user-name COC_monitorbind authentication-template 1bind authorization-template 2password encrypted d8dcd6017947bbfd1ed5ab7ad148be2fcaba46d82bcab5a97f3a855ec45fff29$user-name COC_operatorbind authentication-template 1bind authorization-template 1password encrypted bda2cd0e6ef30d139d8b6516ca1aca68256bc4ab2cd50b4f7dd54ac21069d365$user-name openstackadminbind authentication-template 1bind authorization-template 1password encrypted bda2cd0e6ef30d139d8b6516ca1aca68256bc4ab2cd50b4f7dd54ac21069d365$user-name yundiao_readbind authentication-template 1bind authorization-template 2password encrypted 98fbe5d15da875e0b72f439496fdec30697dabbfed669640a5a2aa6832af355e$$!/system-user8.3 ssh配置!sshssh server access-class ipv4 2001ssh server enable!/ssh4.telnet配置!telnetline console absolute-timeout 30line console idle-timeout 10line telnet server disableline telnet absolute-timeout 30line telnet idle-timeout 10line telnet access-class ipv4 Loginline telnet max-link 10!/telnet
中兴交换机配置总结
中兴接口配置是模块化的一 VRF和接口配置2.1 VRF配置!vrfip vrf NET-managedescription NET-managerd 1:1address-family ipv4$!/vrf2.2 接口配置!if-intfinterface cgei-0/1/0/1description TO-Leaf01ip address X.X.14.125 255.255.255.252no shutdownswitch attribute disable$interface cgei-0/1/0/2description TO-Leaf02ip address X.X.14.149 255.255.255.252no shutdownswitch attribute disable$interface cgei-0/1/0/13description NO-USE$interface cgei-0/1/0/14description NO-USE$interface mgmt_eth //带外管理接口默认属于vrf NET-manageip address X.X.37.11 255.255.255.0$二 ISIS路由协议配置!isisrouter isis 1area 86.0757system-id 0100.3703.0011is-type level-2-onlymetric-style widefast-flood 15lsp-refresh-time 32768max-lsp-lifetime 65535lsp-gen-interval 1 10 20 level-2spf-interval 1 100 100 level-2prefix-priority critical tag 100 level-2interface loopback11ip router isiscircuit-type level-2-onlytag 20$interface xlgei-0/2/0/1ip router isiscircuit-type level-2-onlynetwork point-to-point$interface xlgei-0/2/0/2ip router isiscircuit-type level-2-onlynetwork point-to-point$三 BGP路由协议配置!bgprouter bgp 64722synchronization disablebgp router-id X.X.30.11neighbor evpn peer-groupneighbor evpn remote-as 64722neighbor evpn activate disableneighbor evpn update-source loopback11neighbor evpn fall-over bfd interval 500 min-rx 500 multiplier 3neighbor X.X.30.13 remote-as 64722neighbor X.X.30.13 peer-group evpnneighbor X.X.30.14 remote-as 64722neighbor X.X.30.14 peer-group evpnneighbor X.X.30.15 remote-as 64723neighbor X.X.30.15 activate disableneighbor X.X.30.15 ebgp-multihop ttl 3neighbor X.X.30.15 update-source loopback11neighbor X.X.30.15 fall-over bfd interval 500 min-rx 500 multiplier 3neighbor X.X.30.19 remote-as 64722neighbor X.X.30.19 peer-group evpn$address-family l2vpn evpnneighbor evpn activateneighbor evpn route-reflector-clientneighbor X.X.30.15 activateneighbor X.X.30.15 next-hop-unchanged$四 静态路由配置!staticip route vrf mng 0.0.0.0 0.0.0.0 X.X.37.254 name For_Managementip route vrf mng X.X.36.0 255.255.254.0 X.X.37.254 name For_Management!/static五 NTP配置!ntpntp enablentp server vrf mng X.X.37.254 priority 1ntp source interface mgmt_eth!/ntp六 日志配置!alarmlogging file default almlogaccept on$logging file default cmdlogbuffer 1000$logging file default netclogaccept on$logging file default snmplogaccept on$logging file default srvlogaccept oninterval 10$logging snmpaccept onmatch cmdlog$syslog level warningssyslog-server facility local4syslog-server host vrf mng X.X.170.134 fport 5000 alarmlog cmdlog debugmsg servicelog braslog natlog netconflogsyslog-server host vrf mng X.X.170.135 fport 5000 alarmlog cmdlog debugmsg servicelog braslog natlog netconflog!/alarm七 snmp配置!snmpsnmp-server community encrypted admin123 view AllView ro ipv4-access-list 2000snmp-server enable inform snmpsnmp-server enable inform bgpsnmp-server enable inform interfacesnmp-server enable inform aclsnmp-server enable inform isissnmp-server enable inform systemsnmp-server enable trap ping-tracesnmp-server enable trap gmsnmp-server host vrf mng X.X.170.134 trap version 2c encrypted c9feff80ae160235f32e4f76720c59c5bbac9a3ea0ad0bfa92c8fe8c75670567udp-port 162 snmp bgp mac ospf stp ppp arp rmon udld cfm efm lacp mc-elam tcp sctp stalarm cps interface acl fib pim isis rip msdpaps config am um system ldp pwe3 vpn mpls-oam ptp tunnel-te radius dhcp bfdsnmp-server host vrf mng X.X.170.134 trap version 2c encrypted c9feff80ae160235f32e4f76720c59c5bbac9a3ea0ad0bfa92c8fe8c75670567udp-port 162 ippool ntp ssm sqa ipsec cgn vrrp ftp_tftp ping-trace gmsnmp-server host vrf mng X.X.170.135 trap version 2c encrypted c9feff80ae160235f32e4f76720c59c5bbac9a3ea0ad0bfa92c8fe8c75670567udp-port 162 snmp bgp mac ospf stp ppp arp rmon udld cfm efm lacp mc-elam tcp sctp stalarm cps interface acl fib pim isis rip msdpaps config am um system ldp pwe3 vpn mpls-oam ptp tunnel-te radius dhcp bfdsnmp-server host vrf mng X.X.170.135 trap version 2c encrypted c9feff80ae160235f32e4f76720c59c5bbac9a3ea0ad0bfa92c8fe8c75670567udp-port 162 ippool ntp ssm sqa ipsec cgn vrrp ftp_tftp ping-trace gmsnmp-server trap-source interface mgmt_ethsnmp-server version v2c enablesnmp-server version v3 enable!/snmp八 ssh和telnet配置8.1 ACL配置!ipv4-aclipv4-access-list 2001rule 10 permit 192.168.0.0 0.0.7.255rule 15 permit 192.168.8.0 0.0.7.255rule 20 permit 192.168.120.0 0.0.0.255rule 1000 deny any$ipv4-access-list 2000rule 10 permit 10.249.170.134 0.0.0.0rule 20 permit 10.249.170.135 0.0.0.0rule 30 permit 10.249.170.6 0.0.0.0rule 1000 deny any$!/ipv4-acl8.2 设备登录用户配置!system-usersystem-userauthorization-template 1bind aaa-authorization-template 2019local-privilege-level 15$authorization-template 2bind aaa-authorization-template 2019local-privilege-level 5$authentication-template 1bind aaa-authentication-template 2019$user-name COC_monitorbind authentication-template 1bind authorization-template 2password encrypted d8dcd6017947bbfd1ed5ab7ad148be2fcaba46d82bcab5a97f3a855ec45fff29$user-name COC_operatorbind authentication-template 1bind authorization-template 1password encrypted bda2cd0e6ef30d139d8b6516ca1aca68256bc4ab2cd50b4f7dd54ac21069d365$user-name openstackadminbind authentication-template 1bind authorization-template 1password encrypted bda2cd0e6ef30d139d8b6516ca1aca68256bc4ab2cd50b4f7dd54ac21069d365$user-name yundiao_readbind authentication-template 1bind authorization-template 2password encrypted 98fbe5d15da875e0b72f439496fdec30697dabbfed669640a5a2aa6832af355e$$!/system-user8.3 ssh配置!sshssh server access-class ipv4 2001ssh server enable!/ssh4.telnet配置!telnetline console absolute-timeout 30line console idle-timeout 10line telnet server disableline telnet absolute-timeout 30line telnet idle-timeout 10line telnet access-class ipv4 Loginline telnet max-link 10!/telnet
