华为AR1220路由器配置参数实际应用实例解说一1.配置参数[GZ]discu[V200R001C00SPC200]//路由器软件版本，可从官方网站下载#sysnameGZ//路由器名字GZftpserverenable//ftp服务开通以便拷贝出配置文件备份#voice#httpserverport1025//httpundohttpserverenable#dropillegal-macalarm#l2tpaging0#vlanbatch1020304050//本路由器设置的VLANID#igmpgloballimit256#multicastrouting-enable//开启组播#dhcpenable//全局下开启DHCP服务然后在各VLAN上开启单独的DHCP#ipvpn-instance1ipv4-family#aclnumber2000rule10permit#aclnumber2001//以太网访问规则列表。rule6permitsource172.23.68.00.0.0.255//允许此网段访问外网rule7permitsource172.23.69.00.0.0.255//允许此网段访问外网rule8permitsource172.23.65.00.0.0.3//允许此网段的前三个IP访问外网rule9deny//不允许其他网段访问外网#aclnumber3000//此规则并未应用rule40permitipsource172.23.65.00.0.0.255destination172.23.69.00.0.0.255#aclnumber3001//定义两个网段主机互不访问，学生不能访问65网段。rule5denyipsource172.23.65.00.0.0.255destination172.23.68.00.0.0.255rule10denyipsource172.23.68.00.0.0.255destination172.23.65.00.0.0.255#aaa//默认视图窗口定义本地登录帐号和密码authentication-schemedefaultauthorization-schemedefaultaccounting-schemedefaultdomaindefaultdomaindefault_adminlocal-useradminpasswordcipher]MQ;4\]B+4Z,YWX*NZ55OA!!local-useradminservice-typetelnetwebhttplocal-userdfwdpasswordcipher'VE5U!@7QCO;V2HX\']\,1!!local-userdfwdprivilegelevel15local-userdfwdservice-typetelnetterminalwebhttplocal-userhuaweipasswordcipherRY,UPVHCMV+Q=^Q`MAF4<1!!//新建用户dfwd密码local-userhuaweiftp-directoryflash://该用户名默认配置指向的ftp路径local-userhuaweiservice-typeftp//该用户采用FTP访问#firewallzonetrust//定义信任区域priority15//定义信任区域下的策略#firewallzoneuntrust//定义不信任区域priority1//定义不信任区域下的策略#firewallinterzonetrustuntrust//配置安全域间firewallenable//该安全域间启用防火墙packet-filter3001inbound//入口执行3001规则packet-filter3001outbound//出口执行3001规则packet-filterdefaultdenyoutbound#interfaceVlanif10ipaddress172.23.65.100255.255.255.0//定义vlan的网关地址和子网掩码pimdm//组播协议需开启的功能igmpenable//组播协议需开启的功能zonetrust//定义VLAN是信任区域#interfaceVlanif20ipaddress172.23.1.1255.255.255.240//定义vlan的网关地址和子网掩码pimdm//组播协议需开启的功能igmpenable//组播协议需开启的功能zonetrust//定义VLAN是信任区域#interfaceVlanif30ipaddress10.10.10.1255.255.255.252//定义vlan的网关地址和子网掩码pimdm//组播协议需开启的功能igmpenable//组播协议需开启的功能zonetrust//定义VLAN是信任区域#interfaceVlanif40ipaddress172.23.68.100255.255.255.0//定义vlan的网关地址和子网掩码pimdm//组播协议需开启的功能igmpenable//组播协议需开启的功能dhcpselectinterface//自动分配该VLAN网关所在的地址段IPdhcpserverexcluded-ip-address172.23.68.201172.23.69.254//定义该段IP不自动分配dhcpserverdns-list61.139.2.69//定义该VLAN所在IP地址段的DNS地址zoneuntrust//定义该VLAN为不信任区域#interfaceVlanif50ipaddress172.23.69.100255.255.255.0//定义vlan的网关地址和子网掩码pimdm//组播协议需开启的功能igmpenable//组播协议需开启的功能dhcpselectinterface//开启本VLAN的DHCP功能并选择端口为定义的网关地址dhcpserverexcluded-ip-address172.23.69.201172.23.69.252//定义手动获取的IP地址段dhcpserverdns-list61.139.2.69//定义该VLAN段IP的DNS#interfaceEthernet0/0/0//物理端端口0portlink-typeaccess//定义该端口类型portdefaultvlan10//定义端口所在VLAN#interfaceEthernet0/0/1//物理端端口1portlink-typeaccess//定义该端口类型portdefaultvlan30/...
