溫馨提示×
您好，登錄后才能下訂單哦！
點(diǎn)擊 登錄注冊 即表示同意《億速云用戶服務(wù)條款》
您好，登錄后才能下訂單哦！
一、本地機(jī)房
去年進(jìn)來公司時(shí)，才二十人，到現(xiàn)在發(fā)展到100號人。當(dāng)時(shí)辦公室還是蠻小，至多容納40號人辦公。到了7月份，公司計(jì)劃就要搬遷辦公室。鑒于當(dāng)時(shí)辦公環(huán)境，其實(shí)傻瓜交換機(jī)與路由，加上網(wǎng)線與電話線相互纏繞，跟一個(gè)蜘蛛網(wǎng)似的，掉線，也是常有發(fā)生。當(dāng)超過40號人，去查看路由負(fù)裁，100%，能連上網(wǎng)，但掉包極為嚴(yán)重。鑒于，這種情況，建一個(gè)穩(wěn)定的本地辦公機(jī)房環(huán)境，就非常有必要了。
二、機(jī)器選型
| 序號 | 產(chǎn)品型號 | 描述 | 數(shù)量 |
| 路由器 | |||
| 1 | MSR2600-10-WiNet | H3C MSR 2600-10-WiNet路由器主機(jī) | 1 |
| 上網(wǎng)行為管理 | |||
| 1 | NS-ACG1010+LIS-1 | H3C SecPath ACG1010 應(yīng)用控制網(wǎng)關(guān)主機(jī)(12GE電口),含一年特征庫升級 | 1 |
| 核心交換機(jī) | |||
| 1 | LS-5500-24P-WiNet | H3C S5500-24P-WiNet 以太網(wǎng)交換機(jī)主機(jī)(24GE+4SFP Combo) | 1 |
| 接入POE交換機(jī) | |||
| 1 | LS-5120-28P-POE-WiNet | H3C S5120-28P-POE-WiNet L2以太網(wǎng)交換機(jī)主機(jī),24個(gè)10/100/1000BASE-T,4個(gè)SFP,支持AC110/220V,POE | 1 |
| 無線AC控制器 |
| 1 | EWP-WAC360 | 缺省管理16個(gè)AP，不可擴(kuò)容，最大管理用戶數(shù)512；1xWAN+4xLAN+2xUSB | 1 |
| 無線AP | |||
| 1 | EWP-WAP722-FIT | 內(nèi)置天線，不可外接天線，2.4/5GHz雙頻866M，自帶電源，胖瘦一體，吸頂面板式 | 9 |
| 網(wǎng)絡(luò)機(jī)柜 | |||
| 1 | WD8632-A | 寬深高800*600*1600，標(biāo)配 風(fēng)扇4只，層板2塊 1個(gè)電源排插，黑色 | 1 |
| 48口百兆接入交換 | |||
| 1 | LS-S3110-52TP-SI | H3C S3110-52TP-SI 以太網(wǎng)交換機(jī)主機(jī)(48FE+2GE+2SFP,交流供電) | 4 |
| 非屏蔽48口配線架 | |||
| 1 | 935548 | 索爾超五類非屏蔽48口配線架（滿配） | 8 |
| 電話程控交換機(jī) |
| 1 | WS824-9H | 8外線64分機(jī) 不可擴(kuò)容 | 1 |
| 機(jī)房布線實(shí)施 | |||
| 1 | 機(jī)房布線 | 機(jī)房打線，捋線等工作,150信息點(diǎn) |
三、拓?fù)浣Y(jié)構(gòu)
四、配置步聚
路由器S2600-10
1.1 配置Telnet用戶登錄采用AAA認(rèn)證方式
<H3C-S2600>system-view
開啟Router的Telnet服務(wù)器功能。
telnet server enable
配置Telnet用戶登錄采用AAA認(rèn)證方式。
user-interface vty 0 4 authentication-mode scheme
設(shè)置Telnet用戶和密碼
local-user admin password cipher 填寫密碼 authorization-attribute level 3 service-type telnet terminal service-type web
1.2 撥號1設(shè)置
interface Dialer1 nat outbound 3001 link-protocol ppp ppp chap user 撥號賬號 ppp chap password cipher 密碼 ppp pap local-user 撥號賬號 password cipher 密碼 ip address ppp-negotiate tcp mss 1024 dialer user 賬號 dialer-group 1 dialer bundle 1
1.3 撥號2設(shè)置
interface Dialer2 nat outbound 3002 link-protocol ppp ppp chap user 賬號 ppp chap password cipher 密碼 ppp pap local-user 賬號 password cipher 密碼 ip address ppp-negotiate tcp mss 1024 dialer user 賬號 dialer-group 2 dialer bundle 2
1.4配置ACL
acl number 3001 rule 0 permit ip acl number 3002 rule 0 permit ip source 10.1.9.0 0.0.0.255
1.5創(chuàng)建策略節(jié)點(diǎn)5，并應(yīng)用到G0/2
policy-based-route server permit node 5 if-match acl 3002 apply output-interface GigabitEthernet0/2 policy-based-route server permit node 10
1.6 工作模式設(shè)置為三層模式(Rout），則作為一個(gè)三層以太網(wǎng)接口使用
G0/0接口
interface GigabitEthernet0/0 port link-mode route pppoe-client dial-bundle-number 1
G0/2接口
interface GigabitEthernet0/2 port link-mode route pppoe-client dial-bundle-number 2
1.7配置管理IP地址
interface GigabitEthernet0/1 port link-mode route ip address 10.1.7.1 255.255.255.0 tcp mss 1024 ip policy-based-route server
1.8設(shè)定靜態(tài)路由
ip route-static 0.0.0.0 0.0.0.0 Dialer1 ip route-static 10.1.0.0 255.255.0.0 10.1.7.3
1.9 啟啟DHCP
dhcp enable
1.10 設(shè)定觸發(fā)撥號條件
dialer-rule 1 ip permit dialer-rule 2 ip permit
這條命令用于設(shè)定觸發(fā)撥號的條件，這條命令表示IP包可以
觸發(fā)撥號。后面接口配置模式下的dialer-group命令與這條命令對應(yīng)，用于指定該撥號接口
所使用的觸發(fā)撥號條件。
1.11 查看接口詳情
2.上網(wǎng)行為管理NS-ACG1010
沒有做過多限制，僅用來查看當(dāng)前網(wǎng)帶帶寬情況，這里以配置文件展示了，可以作參考
!config authorized-table admin authorized read all authorized write all ! user administrator admin local secret Hg6MAD7MGTUEcoT9gHG+LhDc6E07QwG71SmiEodL/fQT/YirzsAURqDjk69469y authorized-table admin user administrator admin authorized-address first 0.0.0.0/0 ! ! timezone 57 ! pki ca crl update-period 30 ! ! interface bvi2 ip address 10.1.7.2/24 allow access https allow access http allow access ping allow access telnet ! interface ge0 ip address 192.168.1.1/24 allow access https allow access http allow access ping ! interface ge1 ! interface ge2 bridge-group 2 ! interface ge3 bridge-group 2 ! interface ge4 ! interface ge5 ! interface ge6 ! interface ge7 ! interface ge8 ! interface ge9 ! interface ge10 ! interface ge11 ! !address ! !address6 ! !address-group ! !service ! !service-group ! !schedule-day ! !schedule-week ! !schedule-month ! !schedule-once ! !user ! !user-group ! ! !user-policy ! ! ! ! ! ! ! policy default-action permit policy white-list enable ! snmp community secret 6NSjZ2FJfHqUtCqRXdechDETsW7nP4FFcq1ujxx1HotuCZoZGsn14R7gwFVplw1 write-community secret QuVJ8MPv5S7noa5Lp+C7xY4UnIZD5gm5LCCvi9RLtC2fYqVZdaKQ0rdwLAIf36P ! dhcp ! ! ! ip route 0.0.0.0/0 10.1.7.1 ! !user-param ! user-param recognition threshold 60000 !user-webauth ! !ip session limit ! ! ! ! ! ! qos-profile line 01 limit ingress maxbandwidth ingress 1000 match interface ge0 ! qos-profile channel def_01 parent 01 ! policy6 default-action permit ! ha-config !end
3.核心交換機(jī)LS-5500-24
3.1 配置都在web界面,創(chuàng)建vlan1，vlan2,vlan5,vlan6,vlan7,vlan9,vlan100
3.2配置路由，以及開啟DHCP
3.3 接口設(shè)為Trunk模式
3.4 接口20的設(shè)置
相關(guān)定義
1、Trunk口，Trunk口上可以同時(shí)傳送多個(gè)VLAN的包，一般用于交換機(jī)之間的鏈接。
2、Hybrid口，Hybrid口上可以同時(shí)傳送多個(gè)VLAN的包，一般用于交換機(jī)之間的鏈接或交換機(jī)于服務(wù)器的鏈接。
3、Access口，Access口只能屬于1個(gè)VLAN，一般用于連接計(jì)算機(jī)的端口。
4、Tag和Untag，tag是指vlan的標(biāo)簽，即vlan的id，用于指明數(shù)據(jù)包屬于那個(gè)vlan，untag指數(shù)據(jù)包不屬于任何vlan，沒有vlan標(biāo)記。
5、pvid，即端口vlan id號，是非標(biāo)記端口的vlan id 設(shè)定，當(dāng)非標(biāo)記數(shù)據(jù)包進(jìn)入交換機(jī)，交換機(jī)將檢查vlan設(shè)定并決定是否進(jìn)行轉(zhuǎn)發(fā)。一個(gè)ip包進(jìn)入交換機(jī)端口的時(shí)候，如果沒有帶tag頭，且該端口上配置了pvid，那么，該數(shù)據(jù)包就會(huì)被打上相應(yīng)的tag頭！如果進(jìn)入的ip包已經(jīng)帶有tag頭（vlan數(shù)據(jù)）的話，那么交換機(jī)一般不會(huì)再增加tag頭，即使是端口上配置了pvid號；當(dāng)非標(biāo)記數(shù)據(jù)包進(jìn)入交換機(jī)。
4.接入層交換
4.1 S3110-01
4.1.2 初始配置
sysname H3C-S3110-01 # domain default enable system # ipv6 # telnet server enable # password-recovery enable # domain system access-limit disable state active idle-cut disable self-service-url disable # user-group system group-attribute allow-guest # local-user admin password cipher 密碼 authorization-attribute level 3 service-type telnet terminal service-type web # user-interface aux 0 user-interface vty 0 4 authentication-mode scheme user-interface vty 5 15
4.1.3 創(chuàng)建vlan
vlan 1 # vlan 2 # vlan 5 to 7 # vlan 100 #
4.1.4 配置管理地址
interface Vlan-interface1 ip address 10.1.1.4 255.255.255.0
4.1.5 將當(dāng)前的Access 端口加入到指定的VLAN2中
interface Ethernet1/0/1 port access vlan 2 # interface Ethernet1/0/2 port access vlan 2 # interface Ethernet1/0/3 port access vlan 2 # interface Ethernet1/0/4 port access vlan 2 # interface Ethernet1/0/5 port access vlan 2 # interface Ethernet1/0/6 port access vlan 2 # interface Ethernet1/0/7 port access vlan 2 # interface Ethernet1/0/8 port access vlan 2 # interface Ethernet1/0/9 port access vlan 2 # interface Ethernet1/0/10 port access vlan 2 # interface Ethernet1/0/11 port access vlan 2 # interface Ethernet1/0/12 port access vlan 2 # interface Ethernet1/0/13 port access vlan 2 # interface Ethernet1/0/14 port access vlan 2 # interface Ethernet1/0/15 port access vlan 2 # interface Ethernet1/0/16 port access vlan 2 # interface Ethernet1/0/17 port access vlan 2 # interface Ethernet1/0/18 port access vlan 2 # interface Ethernet1/0/19 port access vlan 2 # interface Ethernet1/0/20 port access vlan 2 # interface Ethernet1/0/21 port access vlan 2 # interface Ethernet1/0/22 port access vlan 2 # interface Ethernet1/0/23 port access vlan 2 # interface Ethernet1/0/24 port access vlan 2 # interface Ethernet1/0/25 port access vlan 2 # interface Ethernet1/0/26 port access vlan 2 # interface Ethernet1/0/27 port access vlan 2 # interface Ethernet1/0/28 port access vlan 2 # interface Ethernet1/0/29 port access vlan 2 # interface Ethernet1/0/30 port access vlan 2 # interface Ethernet1/0/31 port access vlan 2 # interface Ethernet1/0/32 port access vlan 2 # interface Ethernet1/0/33 port access vlan 2 # interface Ethernet1/0/34 port access vlan 2 # interface Ethernet1/0/35 port access vlan 2 # interface Ethernet1/0/36 port access vlan 2 # interface Ethernet1/0/37 port access vlan 2 # interface Ethernet1/0/38 port access vlan 2 # interface Ethernet1/0/39 port access vlan 2 # interface Ethernet1/0/40 port access vlan 2 # interface Ethernet1/0/41 port access vlan 2 # interface Ethernet1/0/42 port access vlan 2 # interface Ethernet1/0/43 port access vlan 2 # interface Ethernet1/0/44 port access vlan 2 # interface Ethernet1/0/45 port access vlan 2 # interface Ethernet1/0/46 port access vlan 2 # interface Ethernet1/0/47 port access vlan 2 # interface Ethernet1/0/48 port access vlan 2
4.1.6 每個(gè)交換機(jī)有4個(gè)級聯(lián)口，而且每個(gè)都以52接口配置trunk模式
interface GigabitEthernet1/0/52 port link-type trunk port trunk permit vlan all
4.1.7 配置靜態(tài)路由
ip route-static 0.0.0.0 0.0.0.0 10.1.1.1
4.2 同樣，另外三個(gè)交換也是同理的配置,不過在S3110-04的配置多了vlan9
# interface Ethernet1/0/6 port access vlan 9 # interface Ethernet1/0/8 port access vlan 9 # interface Ethernet1/0/10 port access vlan 9 # interface Ethernet1/0/12 port access vlan 9 # interface Ethernet1/0/14 port access vlan 9 # interface Ethernet1/0/16 port access vlan 9 # interface Ethernet1/0/18 port access vlan 9 # interface Ethernet1/0/20 port access vlan 9 # interface Ethernet1/0/22 port access vlan 9 # interface Ethernet1/0/24 port access vlan 9 # interface Ethernet1/0/26 port access vlan 9 # interface Ethernet1/0/28 port access vlan 9 # interface Ethernet1/0/30 port access vlan 9 # interface Ethernet1/0/32 port access vlan 9
5.接入POE交換機(jī)LS-5120
5.1 G1/0/24配置trunk模式，以及虛擬子接口1的IP，路由表設(shè)置
5.2 POE設(shè)置
6.無線控制器EWP-WAC360
6.1創(chuàng)建vlan
# vlan 2 # vlan 4 to 7 # vlan 100 #
6.2 設(shè)置登錄用戶與密碼
local-user admin password cipher 密碼 authorization-attribute level 3 service-type telnet terminal service-type web
6.3 射頻速率設(shè)置
wlan rrm dot11a mandatory-rate 6 12 24 dot11a supported-rate 9 18 36 48 54 dot11b mandatory-rate 1 2 dot11b supported-rate 5.5 11 dot11g mandatory-rate 1 2 5.5 11 dot11g supported-rate 6 9 12 18 24 36 48 54
6.4 無線接入服務(wù)，
6.4.1一個(gè)本公司，另一個(gè)是客戶訪問
wlan service-template 2 crypto ssid Company bind WLAN-ESS 2 cipher-suite ccmp security-ie rsn service-template enable
6.4.2 另一個(gè)是客戶訪問
# wlan service-template 3 crypto ssid CompanyVistor bind WLAN-ESS 3 cipher-suite ccmp security-ie rsn service-template enable
6.5接口管理
6.5.1 配置它的管理IP地址
interface Vlan-interface100 ip address 10.1.100.254 255.255.255.0
6.5.1 把G1/0/1接口切換為二層模式，作為一個(gè)二層以太網(wǎng)端口使用，同時(shí)
interface GigabitEthernet1/0/1 port link-mode bridge port link-type trunk port trunk permit vlan all
6.6 創(chuàng)建預(yù)共享密鑰
6.6.1 且允許客戶訪問vlan6
interface WLAN-ESS2 port access vlan 6 port-security port-mode psk port-security tx-key-type 11key port-security preshared-key pass-phrase cipher
6.6.2且允許客戶訪問vlan5
interface WLAN-ESS3 port access vlan 5 port-security port-mode psk port-security tx-key-type 11key port-security preshared-key pass-phrase cipher
6.7 AP設(shè)置，用到序列號
6.7.1 創(chuàng)建AP名稱
wlan ap-group default_group ap ap1 ap ap2 ap ap3 ap ap4 ap ap5 ap ap6 ap ap7 ap ap8 ap ap9 dot11a service-template 1 dot11bg service-template 1 dot11a radio enable dot11bg radio enable
6.7.1 添加AP
6.7.1.1
wlan ap ap2 model WAP722 id 2 serial-id 219801A0Q19154G00032 radio 1 service-template 2 service-template 3 radio enable radio 2 service-template 2 service-template 3 radio enable
6.7.1.2
wlan ap ap3 model WAP722 id 3 serial-id 219801A0Q19154G00025 radio 1 service-template 2 service-template 3 radio enable radio 2 service-template 2 service-template 3 radio enable
6.7.1.3
wlan ap ap4 model WAP722 id 4 serial-id 219801A0Q19154G00052 radio 1 service-template 2 service-template 3 radio enable radio 2 service-template 2 service-template 3 radio enable
6.7.1.4
wlan ap ap5 model WAP722 id 5 serial-id 219801A0Q19154G00338 radio 1 service-template 2 service-template 3 radio enable radio 2 service-template 2 service-template 3 radio enable
6.7.1.5
wlan ap ap6 model WAP722 id 6 serial-id 219801A0Q19154G00110 radio 1 service-template 2 service-template 3 radio enable radio 2 service-template 2 service-template 3 radio enable
6.7.1.6
wlan ap ap7 model WAP722 id 7 serial-id 219801A0Q19154G00195 radio 1 service-template 2 service-template 3 radio enable radio 2 service-template 2 service-template 3 radio enable
6.7.1.7
wlan ap ap8 model WAP722 id 8 serial-id 219801A0Q19154G00080 radio 1 service-template 2 service-template 3 radio enable radio 2 service-template 2 service-template 3 radio enable
6.7.1.8
wlan ap ap9 model WAP722 id 9 serial-id 219801A0Q19154G00038 radio 1 service-template 2 service-template 3 radio enable radio 2 service-template 2 service-template 3 radio enable
6.8 配置靜態(tài)路由
ip route-static 0.0.0.0 0.0.0.0 10.1.100.253
6.9 最后開啟telnet
user-interface con 0 user-interface vty 0 4 authentication-mode scheme user privilege level 3
五、效果圖
機(jī)柜是買小，線道上，都塞滿了，本地服務(wù)器也好幾臺，沒有多余空間，就買了塔式的（本地服務(wù)器都是用來集群測試用的）。這次機(jī)房建設(shè)沒有很好考慮到擴(kuò)展性！吸取教訓(xùn)，為一下次完善機(jī)房做準(zhǔn)備吧！
免責(zé)聲明：本站發(fā)布的內(nèi)容（圖片、視頻和文字）以原創(chuàng)、轉(zhuǎn)載和分享為主，文章觀點(diǎn)不代表本網(wǎng)站立場，如果涉及侵權(quán)請聯(lián)系站長郵箱：is@yisu.com進(jìn)行舉報(bào)，并提供相關(guān)證據(jù)，一經(jīng)查實(shí)，將立刻刪除涉嫌侵權(quán)內(nèi)容。
億速云公眾號
手機(jī)網(wǎng)站二維碼
