ENSP配置命令总结

一、物理层（Physical Layer）

1. 接口基本配置

interface GigabitEthernet 0/0/1
  speed {10 | 100 | 1000 | auto}      # 设置接口速率
  duplex {half | full | auto}         # 设置双工模式
  flow-control                        # 启用流量控制
  port link-type {access | trunk}     # 设置端口类型
  undo shutdown                       # 激活接口
  description TO_CORE_SWITCH           # 设置接口描述
  negotiation auto                    # 启用自协商
  mtu 9216                            # 设置最大传输单元
  loopback {internal | remote}        # 配置环回测试

2. 物理状态查看

display interface GigabitEthernet 0/0/1    # 查看接口详细状态
display interface brief                    # 查看所有接口摘要
display transceiver interface GigabitEthernet 0/0/1  # 查看光模块信息
display counters interface GigabitEthernet 0/0/1  # 查看接口统计信息
display interface status                   # 查看接口状态摘要
display interface description              # 查看接口描述信息

3. 接口高级配置

interface GigabitEthernet 0/0/1
  port-security enable                 # 启用端口安全
  port-security max-mac-count 5        # 最大MAC地址学习数
  port-security protect-action {shutdown | restrict | protect}  # MAC地址限制动作
  port-security mac-address sticky      # 启用Sticky MAC
  storm-control broadcast pps 1000      # 广播风暴控制
  storm-control multicast pps 500       # 组播风暴控制
  storm-control unknown-unicast pps 300  # 未知单播风暴控制

4. 接口诊断命令

reset counters interface GigabitEthernet 0/0/1  # 重置接口统计计数器
test transceiver loopback GigabitEthernet 0/0/1  # 测试光模块环回
display error-down interface GigabitEthernet 0/0/1 # 查看接口错误关闭原因
display interface trap log GigabitEthernet 0/0/1  # 查看接口告警日志

二、数据链路层（Data Link Layer）

1. VLAN配置

# 创建VLAN
vlan batch 10 20 30                   # 批量创建VLAN
# 接口VLAN配置
interface GigabitEthernet 0/0/1
  port link-type access
  port default vlan 10
interface GigabitEthernet 0/0/2
  port link-type trunk
  port trunk allow-pass vlan 10 20 30
  port trunk pvid vlan 10
# 混合模式配置
interface GigabitEthernet 0/0/3
  port link-type hybrid
  port hybrid tagged vlan 10 20
  port hybrid untagged vlan 30

2. QinQ配置

基本QinQ

# 创建外层VLAN
vlan batch 100 200
# 配置QinQ接口
interface GigabitEthernet 0/0/1
  port link-type dot1q-tunnel
  port default vlan 100
# 配置核心网接口
interface GigabitEthernet 0/0/2
  port link-type trunk
  port trunk allow-pass vlan 100 200

灵活QinQ

# 启用VLAN转换
qinq vlan-translation enable

# 配置灵活QinQ
interface GigabitEthernet 0/0/1
  port link-type hybrid
  port hybrid tagged vlan 10 20
  port hybrid untagged vlan 100
  qinq vlan-translation enable
  qinq vlan 10 translate-to vlan 100

3. 生成树协议（STP/RSTP/MSTP）

# MSTP配置示例
stp mode mstp                         # 设置MSTP模式
stp region-configuration              # 进入MSTP区域配置
  region-name ENSP                    # 区域名称
  instance 1 vlan 10                  # 实例1映射VLAN 10
  instance 2 vlan 20                  # 实例2映射VLAN 20
  active region-configuration         # 激活配置

# STP高级配置
interface GigabitEthernet 0/0/1
  stp edged-port enable               # 配置边缘端口
  stp bpdu-protection                 # 启用BPDU保护
  stp root-protection                 # 启用根保护
  stp loop-protection                 # 启用环路保护
  stp tc-protection                   # 启用拓扑变化保护
  stp port-priority 64                # 设置端口优先级
  stp cost 100                        # 设置端口路径开销

4. 链路层协议（PPP/HDLC）

# PPP配置示例
interface Serial 0/0/0
  link-protocol ppp                   # 设置PPP协议
  ppp authentication-mode chap        # CHAP认证
  ppp chap user admin
  ppp chap password cipher Admin@123
  ppp pap local-user admin password cipher Admin@123  # PAP认证
  ppp ipcp dns request                # 请求DNS服务器地址
  ppp ipcp address accept             # 接受IP地址分配

5. LACP动态聚合

# 配置LACP模式聚合
interface Eth-Trunk 1
  mode lacp-static                # 静态LACP模式
  max active-linknumber 4         # 最大活动链路数
  min active-linknumber 2         # 最小活动链路数
  lacp preempt enable             # 启用LACP抢占
  lacp period fast                # 快速LACP协商周期

interface GigabitEthernet 0/0/1
  eth-trunk 1                     # 加入Eth-Trunk
  lacp priority 100               # 设置接口LACP优先级

# 查看聚合状态
display eth-trunk brief
display lacp statistics interface Eth-Trunk 1

三、网络层（Network Layer）

1. IP地址配置

interface GigabitEthernet 0/0/1
  ip address 192.168.1.1 255.255.255.0  # 配置IPv4地址
  ipv6 enable                             # 启用IPv6
  ipv6 address 2001:db8:1::1/64          # 配置IPv6地址
  ipv6 address auto-config                # 启用无状态自动配置
  ip dhcp-snooping trust                  # 配置DHCP侦听信任端口

2. 静态路由

# 基本静态路由
ip route-static 10.0.0.0 255.0.0.0 192.168.1.254    # 单一路由
ip route-static 0.0.0.0 0.0.0.0 192.168.1.254        # 默认路由
# 浮动静态路由
ip route-static 10.0.0.0 255.0.0.0 192.168.2.1 preference 100
# 负载分担静态路由
ip route-static 10.0.0.0 255.0.0.0 192.168.1.254
ip route-static 10.0.0.0 255.0.0.0 192.168.2.254
# 基于策略的静态路由
route-policy STATIC-POLICY permit node 10
  if-match ip-prefix STATIC-ROUTE
  apply preference 80
ip route-static 10.0.0.0 255.0.0.0 192.168.1.254 route-policy STATIC-POLICY

3. 动态路由协议

OSPFv3配置

ipv6 router ospf 1
  router-id 1.1.1.1
  area 0.0.0.0
    network 2001:db8:1::0/64
    authentication-mode md5 1 cipher OSPFv3@123  # OSPFv3认证
# OSPF高级配置
ospf 1
  silent-interface GigabitEthernet 0/0/1        # 静默接口
  default-route-advertise always metric 100     # 发布默认路由
  ase-filter 10.0.0.0 255.0.0.0 export deny    # 过滤外部路由

RIPng配置

ipv6 router rip RIPNG
  network 2001:db8:1::0/64
  timer update 30 expire 180 garbage-collect 120  # 设置RIP计时器
  authentication-mode simple text RIPNG@123      # RIPng认证

BGP配置

bgp 65001
  router-id 1.1.1.1
  peer 10.0.0.2 as-number 65002
  peer-group EBGP
    as-number 65002
    connect-interface LoopBack0
  peer 10.0.0.2 inherit peer-group EBGP
  ipv4-family unicast
    peer 10.0.0.2 enable
    import-route ospf 1
    route-policy BGP-POLICY export peer 10.0.0.2  # 应用路由策略

# BGP高级配置
route-policy BGP-POLICY permit node 10
  if-match ip-prefix CUSTOM-ROUTES
  apply community 100:100 additive               # 添加团体属性

4. MPLS基础配置

# 全局配置
mpls lsr-id 1.1.1.1
mpls
  mpls ldp
# 接口配置
interface GigabitEthernet 0/0/1
  mpls
  mpls ldp
# LDP参数配置
mpls ldp
  timer hold 90                               # 设置保持计时器
  timer hello 10                              # 设置Hello计时器
  advertise-route-id-extension                # 发布路由ID扩展

5. IPv6静态路由

ipv6 route-static 2001:db8:2::/64 2001:db8:1::2          # IPv6单播静态路由
ipv6 route-static ::/0 2001:db8:1::1                     # IPv6默认路由
ipv6 route-static 2001:db8:3::/64 Null0                  # IPv6黑洞路由

四、传输层（Transport Layer）

1. TCP/UDP过滤

# 创建高级ACL
acl number 3000
  rule 10 permit tcp source 192.168.1.0 0.0.0.255 destination 10.0.0.0 0.0.0.255 destination-port eq 80  # 允许HTTP
  rule 20 permit udp source 192.168.1.0 0.0.0.255 destination 10.0.0.0 0.0.0.255 destination-port eq 53  # 允许DNS
  rule 30 deny ip source any destination any  # 拒绝其他

# 应用ACL到接口
interface GigabitEthernet 0/0/1
  traffic-filter inbound acl 3000

2. 端口镜像

# 配置本地端口镜像
observe-port 1 interface GigabitEthernet 0/0/2  # 观察端口
interface GigabitEthernet 0/0/1
  mirror to observe-port 1 both                 # 镜像入方向和出方向

# 流镜像配置
traffic-mirror session 1
  mirror-source interface GigabitEthernet 0/0/1 both
  mirror-destination interface GigabitEthernet 0/0/2

3. 流镜像配置

# 基于ACL的流镜像
acl number 3000
  rule 10 permit ip source 192.168.1.0 0.0.0.255 destination 10.0.0.0 0.0.0.255

observe-port 1 interface GigabitEthernet 0/0/2
interface GigabitEthernet 0/0/1
  traffic-mirror inbound acl 3000 observe-port 1

4. 会话管理

display tcp status                        # 查看TCP会话状态
display udp statistics                    # 查看UDP统计信息
display session table all                 # 查看所有会话表项
reset session all                         # 清除所有会话

五、会话层（Session Layer）

1. Telnet/SSH配置

# SSH配置
stelnet server enable                     # 启用SSH服务
rsa local-key-pair create                 # 生成RSA密钥对
user-interface vty 0 4
  authentication-mode aaa
  protocol inbound ssh
  idle-timeout 30 0                       # 设置空闲超时时间
  history-command max-size 50             # 设置命令历史记录大小

2. GRE隧道配置

# 配置GRE隧道
interface Tunnel0/0/0
  ip address 10.0.0.1 255.255.255.0
  tunnel-protocol gre
  source GigabitEthernet 0/0/1        # 源接口
  destination 192.168.2.1             # 目的IP
  gre key 12345                       # 配置GRE密钥
  keepalive                           # 启用Keepalive机制

# GRE over IPsec配置
ipsec policy GRE-IPSEC 10 isakmp
  security acl 3001
  proposal PROPOSAL1
  sa duration time-based 3600

interface Tunnel0/0/0
  ipsec policy GRE-IPSEC

六、表示层（Presentation Layer）

1. 数据加密

# SSL VPN配置
ssl  enable
ssl  profile default
  server-certificate default
  authentication-mode aaa
  gateway-interface GigabitEthernet 0/0/1
  client-ip-pool 192.168.200.0 255.255.255.0  # 客户端IP地址池
  dns-server 8.8.8.8 114.114.114.114           # DNS服务器配置

2. 文件传输

# TFTP服务配置
tftp-server enable
tftp-server directory flash:/tftp/
tftp-server timeout 5                       # 设置超时时间
tftp-server max-thread 10                   # 设置最大线程数

# SCP服务配置
scp server enable
user-interface vty 0 4
  protocol inbound scp

3. SSL证书配置

# 生成自签名证书
ssl certificate create self-signed
  common-name ENSP-SW
  organization-unit Network
  organization Huawei
  locality Shenzhen
  state Guangdong
  country CN
  validity 365                            # 证书有效期

# 导入证书
ssl certificate import pem certificate-file cert.pem private-key-file key.pem

七、应用层（Application Layer）

1. DHCP服务

dhcp enable

# 创建地址池
ip pool VLAN10
  network 192.168.1.0 mask 255.255.255.0
  gateway-list 192.168.1.1
  dns-list 8.8.8.8 114.114.114.114
  lease day 3                             # 租期3天
  excluded-ip-address 192.168.1.1 192.168.1.10  # 排除地址
  option 43 sub-option 3 ip-address 192.168.1.1  # 配置Option 43

# 接口应用DHCP
interface GigabitEthernet 0/0/1
  dhcp select global                      # 使用全局地址池

2. DNS服务

dns resolve
dns server 8.8.8.8
dns server 114.114.114.114

# 静态域名映射
ip host www.example.com 192.168.1.100
ip host ftp.example.com 192.168.1.101

# DNS缓存配置
dns cache-size 1000                      # 设置DNS缓存大小
dns timeout 5                            # 设置DNS超时时间

3. SNMP配置

# SNMPv3配置
snmp-agent
snmp-agent sys-info version v3
snmp-agent sys-info contact [email protected]
snmp-agent sys-info location DataCenter

# 创建SNMPv3组
snmp-agent group v3 network-group privacy read-view network-view write-view network-view notify-view network-view

# 创建SNMPv3用户
snmp-agent usm-user v3 admin network-group authentication-mode sha authentication-password Admin@123 privacy-mode aes128 privacy-password Privacy@123

# 创建MIB视图
snmp-agent view network-view included .1.3.6.1

4. HTTP服务

http server enable                        # 启用HTTP服务
http secure-server enable                 # 启用HTTPS服务
http server port 8080                     # 修改HTTP端口
http server timeout 120                   # 设置HTTP超时时间
http server max-connections 1000          # 设置最大连接数

八、高级特性

1. ACL与QoS

# 基于时间段的ACL
time-range work-time
  periodic weekdays 09:00 to 18:00

acl number 3000
  rule 10 permit tcp source 192.168.1.0 0.0.0.255 destination 10.0.0.0 0.0.0.255 time-range work-time

# QoS配置
traffic classifier VIDEO
  if-match acl 3000
  if-match packet-length greater-than 1000

traffic behavior VIDEO
  bandwidth cir 102400
  remark dscp ef
  car cir 80000 pir 100000               # 配置CAR限速

qos policy VIDEO-POLICY
  classifier VIDEO behavior VIDEO

2. NAT配置

# 静态NAT
nat static global 202.100.1.1 inside 192.168.1.10

# 动态NAT
acl number 2000
  rule 10 permit source 192.168.1.0 0.0.0.255
nat address-group 1
  address 202.100.1.100 202.100.1.110
interface GigabitEthernet 0/0/2
  nat outbound 2000 address-group 1

# NAPT配置
interface GigabitEthernet 0/0/2
  nat outbound 2000 address-group 1 no-pat  # 禁用端口地址转换

3. 冗余协议（VRRP）

# VRRP配置
interface Vlanif 10
  ip address 192.168.1.254 255.255.255.0
  vrrp vrid 1 virtual-ip 192.168.1.254
  vrrp vrid 1 priority 200
  vrrp vrid 1 preempt-mode timer delay 60
  vrrp vrid 1 track interface GigabitEthernet 0/0/1 reduced 30  # 跟踪接口状态

4. 防火墙配置

# 创建安全区域
firewall zone trust
  add interface GigabitEthernet 0/0/1               # 信任区域
firewall zone untrust
  add interface GigabitEthernet 0/0/2               # 非信任区域
firewall zone dmz
  add interface GigabitEthernet 0/0/3               # DMZ区域

# 配置安全策略
security-policy
  rule name trust-to-untrust
    source-zone trust
    destination-zone untrust
    source-address 192.168.1.0 0.0.0.255
    service icmp
    service tcp destination-port 80 443
    action permit

  rule name untrust-to-dmz
    source-zone untrust
    destination-zone dmz
    service tcp destination-port 80 443 22
    action permit

九、故障排除命令

1. 连通性测试

ping 192.168.1.1                          # 基本ping测试
ping -c 100 -s 1472 192.168.1.1          # 高级ping测试（100次，1472字节）
tracert 192.168.1.1                       # 路由跟踪
traceroute 192.168.1.1 verbose            # 详细路由跟踪
telnet 192.168.1.1 23                     # Telnet测试
ssh 192.168.1.1                           # SSH测试

2. 路由表查看

display ip routing-table                  # 查看IP路由表
display ip routing-table protocol ospf    # 查看OSPF路由
display bgp routing-table                 # 查看BGP路由
display route-policy                      # 查看路由策略
display ip prefix-list                    # 查看IP前缀列表

3. ARP表查看

display arp                               # 查看ARP表
display arp interface GigabitEthernet 0/0/1  # 查看特定接口ARP表
display arp all                           # 查看所有VLAN的ARP表
reset arp all                             # 清除所有ARP表项

4. 协议状态查看

display ospf peer                         # 查看OSPF邻居
display bgp peer                          # 查看BGP邻居
display pppoe-client session              # 查看PPPoE会话
display mpls ldp session                  # 查看MPLS LDP会话
display vlan brief                        # 查看VLAN摘要
display stp brief                         # 查看STP摘要

十、综合应用示例

企业网络典型配置

# 三层交换机配置示例
sysname CORE_SWITCH

# VLAN配置
vlan batch 10 20 30
interface GigabitEthernet 0/0/1
  port link-type trunk
  port trunk allow-pass vlan 10 20 30

# 路由配置
ospf 1 router-id 10.1.1.1
  area 0.0.0.0
    network 10.1.1.0 0.0.0.255
    network 192.168.10.0 0.0.0.255

# VLANIF接口配置
interface Vlanif 10
  ip address 192.168.10.1 255.255.255.0
interface Vlanif 20
  ip address 192.168.20.1 255.255.255.0

# 防火墙配置
acl number 3000
  rule 10 permit ip source 192.168.10.0 0.0.0.255 destination 10.0.0.0 0.0.0.255
interface GigabitEthernet 0/0/1
  firewall packet-filter 3000 inbound

广域网接入配置

# 配置PPPoe客户端
interface Dialer0
  link-protocol ppp
  ppp chap user broadband
  ppp chap password cipher Broad@123
  ip address ppp-negotiate
  dialer user broadband
  dialer-group 1

# 配置默认路由指向拨号接口
ip route-static 0.0.0.0 0.0.0.0 Dialer0

# 配置NAT实现内网访问外网
acl number 2000
  rule 10 permit source 192.168.1.0 0.0.0.255
interface Dialer0
  nat outbound 2000

无线控制器配置

# 配置CAPWAP隧道
interface Vlanif 100
  ip address 192.168.100.1 255.255.255.0
capwap source interface Vlanif 100

# 配置WLAN AC
wlan ac
  reg-zone cn
  ap-group default
    radio 0
      channel 1 6 11
      max-power 20
    radio 1
      channel 36 40 44 48
      max-power 20

# 创建WLAN服务
wlan service-template 1 crypto
  ssid WLAN-TEST
  security wpa2-psk aes pass-phrase Password@123
  service-template enable