3、acl命令格式:基本/高级ACL 支持:acl [ ipv6 ] acl-number { inbound | outbound }undo acl [ ipv6 ] acl-number { inbound | outbound }二层ACL 支持:acl acl-number inboundundo acl acl-number inbound功能:acl 命令用来引用访问控制列表(ACL),2000~2999:基本ACL 编号;3000~ 3999:高级ACL 编号;4000~4999:二层ACL 编号。

应用实例:<Sysname> system-view[Sysname] acl number 2001[Sysname-acl-basic-2001] rule permit source 192.168.1.26 0<Sysname> system-view[Sysname] acl number 3001[Sysname-acl-adv-3001] rule permit tcp destination 192.168.1.41 04、DHCP命令格式:(1)配置基于接口地址池的DHCP[R1]dhcp enable开启DHCP功能[R1-GigabitEthernet0/0/2]dhcp select interface开启接口的DHCP服务功能[R1-GigabitEthernet0/0/2]dhcp server lease day 2配置IP地址租用有效期限为2天,默认为1天,超过租期后该地址将会重新分配[R1-GigabitEthernet0/0/2]dhcp server excluded-ip-address 192.168.3.251 192.168.3.253配置不参与自动分配的IP地址[R1-GigabitEthernet0/0/2]dhcp server dns-list 8.8.8.8指定接口地址池下的DNS服务器(2)配置基于全局地址池的DHCP[R2]dhcp enable开启DHCP功能[R2]ip pool huawei1创建一个全局地址池,地址池名称为huawei1[R3-ip-pool-huawei1]network 192.168.4.0动态分配的地址范围192.168.4.0,如果不指定掩码,则默认使用自然掩码[R3-ip-pool-huawei1]lease day 2全局地址池下的地址租期[R3-ip-pool-huawei1]gateway-list 192.168.4.254配置DHCP客户端的网关地址[R3-ip-pool-huawei1]excluded-ip-address 192.168.4.250 192.168.4.253 [R3-ip-pool-huawei1]dns-list 8.8.8.8[R3]interface GigabitEthernet 0/0/0[R3-GigabitEthernet0/0/0]dhcp select global开启接口DHCP功能,指定接口采用全局地址池为客户端分配IP地址5、Eth-Trunk命令格式:[S1]interface Eth-Trunk 1配置链路聚合,创建Eth-Trunk 1[S1-Eth-Trunk1]mode manual load-balance指定为手工负载分担模式[S1]interface GigabitEthernet 0/0/1[S1-GigabitEthernet0/0/1]eth-trunk 1加入到Eth-Trunk 1接口[S1]interface GigabitEthernet 0/0/2[S1-GigabitEthernet0/0/2]eth-trunk 1加入到Eth-Trunk 1接口6、GVRP命令格式:[S1]gvrp在交换机上启用GVRP[S1]interface GigabitEthernet 0/0/1[S1-GigabitEthernet0/0/1]gvrp在接口上启用GVRP[S3]interface GigabitEthernet 0/0/1[S3-GigabitEthernet0/0/1]gvrp registration fixed 在接口下将GVRP的注册模式修改为Fixed模式[S2]interface GigabitEthernet 0/0/1[S2-GigabitEthernet0/0/1]gvrp registration forbidden 在接口下将GVRP的注册模式修改为Forbidden模式7、IPV6命令格式:[R1]ipv6全局开启IPv6功能[R1]int g 0/0/0[R1-GigabitEthernet0/0/0]ipv6 enable接口下开启IPv6功能[R1-GigabitEthernet0/0/0]ipv6 address auto link-local接口上配置自动生成链路本地地址[r1-GigabitEthernet0/0/0]ipv6 address 2001:3:fd:: 64 eui-64配置EUI-64地址[R1]int g 0/0/0[R1-GigabitEthernet0/0/0]ipv6 enable接口下开启IPv6功能[r1-GigabitEthernet0/0/0]ipv6 add 2031:0:130f::1 64在接口上手工静态配置全球单播地址8、NAT命令格式:[R1]int g 0/0/0[R1-GigabitEthernet0/0/0]nat static global 202.169.10.5 inside 172.16.1.1静态NAT[r1]int g 0/0/1[r1-GigabitEthernet0/0/1]nat server protocol tcp global current-interface www inside 192.168.1.1 www静态PAT,使用当前接口IP作NAT映射[R1]nat address-group 1 202.169.10.50 202.169.10.60配置NAT地址池[R1]acl 2001[R1-acl-basic-2001]rule 5 permit source 172.16.1.0 0.0.0.255配置访问控制列表[R1]int g 0/0/0[R1-GigabitEthernet0/0/0]nat outbound 2001 address-group 1 配置NAT Outbound [R1]acl 2001[R1-acl-basic-2001]rule 5 permit source 172.16.1.0 0.0.0.255 [R1]int g 0/0/0[R1-GigabitEthernet0/0/0]nat outbound 2001配置NAT Easy – IP,使用接口的IP地址作为NAT9、OSPF命令格式:[Huawei]ospf 11代表进程号,如果没有注明,则默认为进程1[Huawei-ospf-1]area 0区域ID,配置为区域0[Huawei-ospf-1-area-0.0.0.0]network 1.1.1.0 0.0.0.255精确区配所通告的网段10、PAP,CHAP命令格式:R1]interface Serial 1/0/0[R1-Serial1/0/0]ppp authentication-mode pap配置PPP的PAP认证,配置本端的PPP协议验证方式为PAP[R2]interface Serial 1/0/0[R2-Serial1/0/0]ppp pap local-user huawei password cipher hello 配置发送账户huawei密码hello到认证方[R1]interface Serial 1/0/0[R1-Serial1/0/0]ppp authentication-mode chap配置PPP的CHAP认证,配置本端的PPP协议验证方式为CHAP [R1]aaa[R1-aaa]local-user huawei password cipher hello[R1-aaa]local-user R1 service-type ppp新建对端被认证方所使用的用户名为huawei密码为hello[R2-Serial1/0/0]ppp chap user huawei[R2-Serial1/0/0]ppp chap password cipher hello进入接口模式下配置发送账户huawei密码hello到认证方11、RIP命令格式:[R1]rip使用RIP命令开启协议进程,默认进程号是1[R1-rip-1]network 10.0.0.0配置通告的网段[R1-rip-1]version 2配置RIP运行的版本为214、STP命令格式:[S1]stp enable交换机启用STP[S1]stp mode stp将交换机的STP模式更改为普通生成树STP [S1]stp priority 0配置S1为根交换机[S2]stp priority 4096配置S2 根网桥优先级为4096[S1]stp region-configuration配置MSTP,进入MST域视图[S1-mst-region]region-name huawei配置MST域名[S1-mst-region]revision-level 1配置MSTP的修订级别为1[S1-mst-region]instance 1 vlan 10指定VLAN 10映射到MSTI1[S1-mst-region]instance 2 vlan 20指定VLAN 20映射到MSTI2[S1-mst-region]active region-configuration激活MST域配置15、Telnet命令格式:[Huawei]user-interface vty 0 4进入VTY 0到4接口[Huawei-ui-vty0-4]authentication-mode passwordPlease configure the login password (maximum length 16):Huawei 配置TELNET密码为huawei[Huawei-ui-vty0-4]user privilege level 1用户级别为1(监控级)16、VRRP命令格式:[R2-Ethernet1/0/1]vrrp vrid 1 virtual-ip 172.16.1.254创建VRRP备份组,备份组号为1,虚拟IP为172.16.1.254[R2-Ethernet1/0/1]vrrp vrid 1 priority 120配置优先级为120[R2]interface Ethernet 1/0/1[R2-Ethernet1/0/1]vrrp vrid 2 preempt-mode disable配置虚拟组2中的抢占模式为非抢占方式,默认为抢占模式[R2]interface Ethernet 1/0/1[R2-Ethernet1/0/1]vrrp vrid 1 track interface GigabitEthernet 0/0/0 reduced 50 配置监视上行接口,如此接口断掉,裁减优先级50[R3]interface Ethernet 1/0/1[R3-Ethernet1/0/1]vrrp vrid 1 authentication-mode md5 huawei对VRRP虚拟组1配置接口认证,认证方式为MD5,密码为huawei17、帧中继命令格式:[r1]int s 1/0/0[r1-Serial1/0/0] ip address 10.0.123.1 255.255.255.0配置IP地址与子网掩码[r1-Serial1/0/0]link-protocol fr使用动态映射,配置链路层协议为FR[r1-Serial1/0/0]fr inarp运行帧中继逆向地址解析功能自动生成地址映射表,默认开启18、单臂路由命令格式:[R1]interface GigabitEthernet0/0/1.1[R1-GigabitEthernet0/0/1.1] ip address 192.168.1.254 255.255.255.0[R1-GigabitEthernet0/0/1.1] dot1q termination vid 10配置子接口对一层tag报文的终结功能,VID为10[R1-GigabitEthernet0/0/1.1] arp broadcast enable开启子接口的ARP广播功能,如果不配置改命令,将会导致该子接口无法主动发送ARP广播报文,以及向外转发IP报文19、VLAN命令格式:[S1]vlan 10[S1-vlan10]vlan 20一次创建单个VLAN[S1-vlan10]description abc描述或者名称的意思[S2]vlan batch 30 40同时创建多个VLAN[S1]display vlan查看VLAN相关信息20、AAA命令格式[Huawei]aaa进入AAA视图[Huawei-aaa]local-user huawei password cipher hello使用local-user命令创建本地用户和用户口令,并以密文方式显示用户口令,huawei为用户名,hello为密码。