三层网络设备标准化配置

目 录1 网络设备标准化配置11.1 交换机配置11 网络设备标准化配置目的：1. 标准化网络设备配置；2. 提高网络设备管理安全；3. 提高网络设备监管能力，并清晰记录相关日志信息，提高网络问题可查性；1.1 交换机配置网络设备配置模板：-基础服务及生成树配置（无需更改）-ip domain-name no service padservice tcp-keepalives-inservice tcp-keepalives-outservice timestamps debug datetime msec localtime show-timezoneservice timestamps log datetime msec localtime show-timezoneservice password-encryptionclock timezone BJT 8!boot-start-markerboot-end-marker!no ip bootp serverno ip http serverno ip source-routeno ip domain-lookuperrdisable recovery cause bpduguarderrdisable recovery cause link-flap errdisable recovery cause looperrdisable recovery inter 300errdisable recovery cause psecure-violation!spanning-tree mode rapid-pvstspanning-tree loopguard defaultspanning-tree extend system-idspanning-tree vlan 10-300 priority 24576 /*视情况定*/no ip http secure-serverno ip http serverip routing-日志配置（无需更改）-logging trap notificationslogging 10.37.4.102logging console criticallogging buffered 32768 notifications-VTP及SNMP、banner登录及访问控制（无需更改）-access-list 99 permit 10.37.4.102access-list 199 remark /*access-list 199 remark Remote Access authorized serversaccess-list 199 remark */access-list 199 permit tcp 10.0.0.0 0.255.255.255 any logaccess-list 199 deny tcp any any range 0 65535 logaccess-list 199 deny ip any any logline vty 0 15 access-class 199 in transport input telnet ssh/*若IOS不支持SSH可只开启telnet*/exisnmp-server community EnnNWmo$ RO 99snmp-server trap link ietfsnmp-server enable traps configsnmp-server enable traps cpu thresholdsnmp-server ifindex persistsnmp-server enable traps errdisablesnmp-server enable traps syslogsnmp-server host 10.37.4.102 xinaoranqi snmp-server ifindex persist banner motd *This is a private property facility to be accessed and used for ENNinternal systems. Unauthorized Access Prohibited!*!-NTP配置（无需更改）-ntp authentication-key 123 md5 1qazxsw2ntp authenticatentp trusted-key 123ntp server 10.37.254.250 prentp server 10.37.254.249-AAA认证（密码需要更改，其他无需更改）- username admin privilege 15 secret EnNnwps0bWanaaa new-model radius-server host 10.37.8.103 auth-port 1812 acct-port 1813 key 1qazxsw2radius-server host 10.37.8.101 auth-port 1812 acct-port 1813 key 1qazxsw2aaa group server radius OP_AAAserver 10.37.8.101 auth-port 1812 acct-port 1813server 10.37.8.103 auth-port 1812 acct-port 1813 exi!aaa authentication login default group OP_AAA localaaa authorization exec default group OP_AAA local aaa authorization network default group OP_AAA local !-DHCP配置-ip dhcp excluded-address 10.x.x.1 /不用于动态地址分配的地址/ ip dhcp excluded-address 10.x.x.200 10.x.x.254 ! ip dhcp pool VLAN10 /global是pool name， 由用户指定/ network 10.x.x.0 255.255.255.0 /动态分配的地址段/ domain-name /为客户机配置域后缀/ dns-server 10.36.8.40 10.36.8.41 /为客户机配置dns服务器 /netbios-name-server 10.36.8.40 10.36.8.41 /为客户机配置wins服务器 /lease 2 /地址租用期限: 2天/-Interface接口配置（需更改）-interface Gx/xip help-add x.x.x.x /若DHCP不在本设备上，启用此命令指向DHCP服务器 /description connect to LFGDC02_AS07_Po10ip address x.x.x.x x.x.x.x /三层接口配置/ no ip redirects /三层接口配置/ no ip unreachables/三层接口配置/ no ip proxy-arp/三层接口配置/logging event trunk-status/Trunk接口配置/logging event link-status /三层接口或其他设备互联类型接口配置/注：一般三层接口配置信息需根据实际的接口用途而定，命令使用参照以上命令注释。-HSRP三层接口配置（需更改）-interface Gx/xdescription connect to LFGDC02_AS07_Po10ip address x.x.x.x x.x.x.x /三层接口地址配置，用于HSRP的本地物理地址/ no ip redirects no ip unreachablesno ip proxy-arp standby 1 ip x.x.x.x /HSRP组网关地址配置/ standby 1 priority 120/HSRP组本地优先级，默认为100，建议主的配置为120，备用的设置为90/ standby 1 preempt /HSRP故障时网关抢占/standby 1 track GigabitEthernet1/0/12 50 /HSRP跟踪接口，当接口故障时优先级降低50/logging event link-status /三层接口或其他设备互联类型接口配置/注：HSRP组号建议与vlan号一致。设备名称及管理配置源接口信息（需更改）host CNCHBLF1-BWAS01snmp-server trap-source vlan 10snmp-server location CNCHBLF1-BWAS01snmp-server contact LFMANlogging source-interface vlan 10ip radius source-interface vlan 10ntp source vlan 10注：设备命名需按命名标准执行，日志及SNMP的源接口应为设备管理接口，snmp的location及contact值，分别为设备名称及设备所处环境名称，如廊坊园区网等。三层网络设备SNMP配置snmp-server enable traps ospf state-changesnmp-server enable traps ospf errorssnmp-server enable traps ospf retransmitsnmp-server enable traps ospf lsasnmp-server enable traps ospf cisco-specific state-change nssa-trans-changesnmp-server enable traps ospf cisco-specific state-change shamlink interface-oldsnmp-server enable traps ospf cisco-specific state-change shamlink neighborsnmp-server enable traps ospf cisco-specific errorssnmp-server enable traps ospf cisco-specific retransmitsnmp-server enable traps ospf cisco-specific lsa注：三层设备需根据实际启用的路由器而定，此配置模板为OSPF的snmp监控。