Extreme設(shè)備常用配置手冊(cè)

1.用戶(hù)名和密碼配置createaccount[admin|user]<username>{encrypted}{<password>}configureaccountadminport配置configports<portlist>autooff{speed[10|100|1000]}duplex[half|full]autooffVlan配置無(wú)論是核心還是接入層，都要先創(chuàng)建三個(gè)Vian,并且將所有歸于DefaultVian的端口刪除：configvlandefaultdelportallcreatevianServercreatevianUsercreatevianManger定義802.1q標(biāo)記configvianServertag10configvianUsertag20configvianMangertag30設(shè)定Vian網(wǎng)關(guān)地址：configvianServeripa192.168.41.1/24configvianUseripa192.168.40.1/24configvianMangeripa192.168.*.*/24Enabieipforwarding啟用ip路由轉(zhuǎn)發(fā)，即vian間路由Trunk配置configvianServeraddport1-3tconfigvianUseraddport1-3tconfigvianmangeraddport1-3tVRRP配置enabievrrpconfigurevrrpaddvianUserVianconfigurevrrpvianUserVianaddmastervrid10192.168.6.254configurevrrpvianUserVianauthenticationsimpie-passwordextremeconfigurevrrpvianUserVianvrid10priority200configurevrrpvianUserVianvrid10advertisement-intervai15configurevrrpvianUserVianvrid10preempt端口鏡像配置enabiemirroringtoport3＃選擇3作為鏡像口configmirroringaddport1＃把端口1的流量發(fā)送到3configmirroringaddport1vlandefault#把1和vlandefault的流量都發(fā)送到3port-channei配置enablesharing<port>grouping<portlist>{port-based|address-based|round-robin}stp配置enablestpdcreatestpd*configurestpd<spanningtreename>addvlan<vlanname>{ports<portlist>[dot1d|emistp|pvst-plus]}configurestpdstpd1priority16384configurevlanmarketingaddports2-3stpdstpd1emistp8.DHCP中繼配置enablebootprelayconfigbootprelayadd<dhcpserverip>9.NAT配置Enablenat＃啟用natStaticNATRuleExampleconfignataddout_vlan_1mapsource192.168.1.12/32to216.52.8.32/32DynamicNATRuleExampleconfignataddout_vlan_1mapsource192.168.1.0/24to216.52.8.1-216.52.8.31PortmapNATRuleExampleconfignataddout_vlan_2mapsource192.168.2.0/25to216.52.8.32/28bothportmapPortmapMin-MaxExampleconfignataddout_vlan_2mapsource192.168.2.128/25to216.52.8.64/28tcpportmap1024-819210.OSPF配置enableospf啟用OSPF進(jìn)程createospfarea<areaidentifier>創(chuàng)建OSPF區(qū)域configureospfrouterid[automatic|<routerid>]配置Routeridconfigureospfaddvlan[<vlanname>|all]area<areaidentifier>{passive}把某個(gè)vlan加到某個(gè)Area中去，相當(dāng)于Cisco中的network的作用configureospfarea<areaidentifier>addrange<ipaddress><mask>[advertise|noadvertise]{type-3|type-7}把某個(gè)網(wǎng)段加到某個(gè)Area中去，相當(dāng)于Cisco中的network的作用configureospfvlan<vlanname>neighboradd<ipaddress>OSPF中路由重發(fā)布配置enableospfexportdirect[cost<metric>[ase-type-1|ase-type-2]{tag<number>}|<routemap>]enableospfexportstatic[cost<metric>[ase-type-1|ase-type-2]{tag<number>}|<routemap>]enableospforiginate-default{always}cost<metric>[ase-type-1|ase-type-2]{tag<number>}enableospforiginate-router-id11.SNMP配置enablesnmpaccessenablesnmptrapscreateaccess-profile<accessprofile>type[ipaddress|vlan]configsnmpaccess-profilereadonly[<access_profile>|none配置snmp的只讀訪問(wèn)歹U表，none是去除configsnmpaccess-profilereadwrite[<access_profile>|none]這是控制讀寫(xiě)控制configsnmpaddtrapreceiver<ipaddress>{port<udp_port>}communityvcommunitystring〉{from<sourceipaddress>}配置snmp接收host和團(tuán)體字符串安全配置disableip-optionloose-source-routedisableip-optionstrict-source-routedisableip-optionrecord-routedisableip-optionrecord-timestampdisableipforwardingbroadcastdisableudp-echo-serverdisableirdpvlan<vlanname>disableicmpredirectdisableweb關(guān)閉web方式訪問(wèn)交換機(jī)enablecpu-dos-protectAccess－Lists配置createaccess-listicmpdestinationsourcecreateaccess-listipdestinationsourceportscreateaccess-listtcpdestinationsourceportscreateaccess-listudpdestinationsourceports默認(rèn)路由配置configiprouteadddefault<gateway>恢復(fù)出廠值，但不包括用戶(hù)改的時(shí)間和用戶(hù)帳號(hào)信息unconfigswitch{all}檢查配置showversionshowconfigshowsessionshowmanagement查看管理信息，以及snmp信息showbannershowportsconfigurationshowospfshowaccess-list{<name>|port<portlist>}showaccess-list-monitorshowospfarea<areaidentifier>showospfareadetailshowospfase-summaryshowospfinterfaces{vlan<vlanname>|area<areaidentifier>}unconfigureospf{vlan<vlanname>|area<areaidentifier>}17.備份和升級(jí)軟件downloadimage[<hostname>|<ipaddress>]<filename>{primary|secondary}uploadimage[<hostname>|<ipaddress>]<filename>{primary|secondary}useimage[primary|secondary]小知識(shí)點(diǎn)：DHCP中繼。bootprelay/dhcprelay用于主機(jī)獲取它的IP地址，但是在一個(gè)高度需要安全的網(wǎng)絡(luò)中需要以更安全的方法配置它，比如通過(guò)udp-forwarding的方法來(lái)配置dhcprelay。disablebootprelay以下是一個(gè)用udp-forwarding代替enablebootrelay的配置例子。createudp-profilebackbonedhcpconfigbackbonedhcpadd67