H3C-MSR路由器配置

《H3C-MSR路由器配置》由会员分享，可在线阅读，更多相关《H3C-MSR路由器配置（5页珍藏版）》请在装配图网上搜索。

1、配置telnet登录telnetserverenable创建本地账号与密码local-useradminpasswordsimplehnjb8013user-interfacevty04authentication-modeschemauser-rolelevel-15配置WAN口地址system-viewH3CinterfaceGigabitEthernet0/0H3C-GigabitEthernet0/0ipaddress119.57.73.67255.255.255.248/IP地址和掩码配置运营商分配的地址H3C-GigabitEthernet0/0quit2）设置内网网关H3Cint

2、erfaceGigabitEthernet0/1H3C-GigabitEthernet0/1ipaddress192.168.1.124/内网网关IP地址H3C-GigabitEthernet0/1quit设置DHCPsystem-viewH3Cdhcpserverip-pool1H3C-dhcp-pool-1network192.168.1.0mask255.255.255.0H3C-dhcp-pool-1gateway-list192.168.1.1H3C-dhcp-pool-1addressrange192.168.1.2192.168.1.200地址池H3C-dhcp-pool-1地址

3、dns-list202.106.0.20114.114.114.114/具体的运营商DNSH3C-dhcp-pool-1quit4）在WAN接口配置NAT，实现内网地址上网进行源地址转换。H3CinterfaceGigabitEthernet0/0H3C-GigabitEthernet0/0natoutbound5）配置默认路由H3Ciproute-static0.0.0.00.0.0.0119.57.73.65/下一跳地址配置运营商分配的网关地址Nat一对一NATsystem-viewH3Cnatstaticoutbound192.168.1.248119.57.73.70H3Cinterf

4、aceGigabitEthernet0/0H3C-GigabitEthernet0/0ipaddress119.57.73.70255.255.255.248subH3C-GigabitEthernet0/0natstaticenableH3C-GigabitEthernet0/0quitNAT端口映射system-viewH3CinterfaceGigabitEthernet0/011进入设备公网接口H3C-GigabitEthernet0/0natserverprotocoltcpglobal119.57.73.675366inside192.168.1.675366natserverpr

5、otocoltcpglobal119.57.73.675367inside192.168.1.675367natserverprotocoltcpglobal119.57.73.678081inside192.168.1.2448081natserverprotocoltcpglobal119.57.73.678123inside192.168.1.2508443natserverprotocoltcpglobal119.57.73.6733890inside192.168.1.883389L2TPoveripsec1. 开启L2TP功能。system-viewH3Cl2tpenable配置本

6、地用户名和密码，可配置多个用户H3Clocal-userhnjbclassnetwork/配置拨号用户名Newlocaluseradded./配置拨号密码H3C-luser-network-hnjbpasswordsimplehnjb8013H3C-luser-network-hnjbservice-typepppH3C-luser-network-hnjbquitH3CdomainsystemH3C-isp-systemauthenticationppplocal/配置PPP用户的认证方式为本地认证H3C-isp-systemquitH3Cippool1010.1.1.1010.1.1.10

7、0/配置为拨入终端分配的IP地址范围创建虚拟模板接口H3CintefaceVirtual-Template0H3C-Virtual-TemplateOpppauthentication-modechap/配置本端PPP协议对终端的验证方式为CHAPH3C-Virtual-TemplateOremoteaddresspool10/在虚模板视图下指定为用户分配IP的地址池H3C-Virtual-Template0ipaddress10.1.1.124H3C-Virtual-Template0pppipcpdns219.141.140.10114.114.114.114配置DNSH3C-Virtua

8、l-Template0quit创建并配置L2TP组H3CI2tp-group1modelnsH3C-l2tp1undotunnelauthentication/取消L2TP隧道验证功能，因为很多终端系统不支持隧道验证功能。H3C-l2tp1allowl2tpvirtual-template0H3C-l2tp1quit配置IPsec功能H3CikekeychainkeychainiH3C-ike-keychain-keychain1pre-shared-keyaddress0.0.0.00.0.0.0keysimplehnjb2017/配置预共享密钥123456。H3C-ike-keychain

9、-keychain1quit配置IKE对等体H3CikeproH3C-ike-prokeychainkeychain1H3C-ike-prolocal-identityaddress119.57.73.67/指定标识本端身份的IP地址。H3C-ike-promatchremoteidentityaddress0.0.0.00.0.0.0/指定对端身份FQDN名称。H3C-ike-proproposal123456H3C-ike-proquit配置IPsec安全提议H3Cipsectransform-settran1H3C-ipsec-transform-set-tran1espencrypti

10、on-algorithmdes-cbcH3C-ipsec-transform-set-tran1espauthentication-algorithmmd5H3C-ipsec-transform-set-tran1quit配置IPSec安全策略模板H3Cipsecpolicy-templatemsr1H3C-ipsec-policy-template-msr-1ike-pro/引用之前配置的IKE对等体H3C-ipsec-policy-template-msr-1transform-setIPsec安全提议/引用之前配置的H3C-ipsec-policy-template-msr-1quit创

11、建IPSec安全策略并引用安全策略模板H3Cipsecpolicy1231isakmptemplate在公网接口上应用IPsec安全策略。H3CinterfaceGigabitEthernet0/0H3C-GigabitEthernet0/0ipsecapplypolicyikeproposal1encryption-algorithmaes-cbc-128dhgroup2authentication-algorithmmd5ikeproposal2encryption-algorithm3des-cbcdhgroup2authentication-algorithmmd5ikeproposa

12、l3encryption-algorithm3des-cbcdhgroup2ikeproposal4encryption-algorithmaes-cbc-256msr123dhgroup2ikeproposal5dhgroup2ikeproposal6encryption-algorithmaes-cbc-192dhgroup2ipsectransform-set1encapsulation-modetransportespencryption-algorithm3des-cbcespauthentication-algorithmmd5ipsectransform-set2encapsul

13、ation-modetransportespencryption-algorithmaes-cbc-128espauthentication-algorithmsha1ipsectransform-set3encapsulation-modetransportespencryption-algorithmaes-cbc-256espauthentication-algorithmsha1ipsectransform-set4encapsulation-modetransportespencryption-algorithmdes-cbcespauthentication-algorithmsha1ipsectransform-set5encapsulation-modetransportespencryption-algorithm3des-cbcespauthentication-algorithmshalipsectransform-set6encapsulation-modetransportespencryption-algorithmaes-cbc-192espauthentication-algorithmsha1