维护基础手册专业资料.doc

Bras ME60维护手册

12月

目 录

一、设备配备脚本 3
二、新设备（顾客）开局脚本 10
2.1 汇聚/接入互换机开局 10
2.2 配备纯Portal拨号业务 11
2.3 配备静态IP业务（绑定顾客IP） 12
2.4 配备静态IP业务（不绑定顾客IP） 13
2.5 配备Portal拨号业务+固定IP 14
2.6 配备Portal拨号业务（绑定顾客IP） 15
三、维护命令 16
3.1.1 查看域 16
3.1.2 查看域内顾客状态 17
3.1.3 查看网络联通性 17
3.1.4 查看总顾客数 17
3.1.5 强制某顾客下线 18
3.1.6 查看地址池占用率 18
3.1.7 查用巡检命令 18

一、 设备配备脚本
设备配备较多,仅列出维护有关某些

dis cur
sysname JRZK-ME60配备主机名

radius-server group wgyxy
radius-server authentication 192.168.100.100 1812 weight 0
radius-server accounting 192.168.100.100 1813 weight 0
radius-server shared-key hwme60
radius-server nas-ip-address 192.168.100.1
radius-server attribute translate
undo radius-server user-name domain-included配备深澜Radius

#
radius-server authorization 192.168.100.100 shared-key hwme60授权深澜Radius对Bras进行操作（顾客欠费踢下线）

#
#
acl number 6000
rule 20 permit tcp source user-group portal destination-port eq www
rule 25 permit tcp source user-group portal destination-port eq 8080
rule 30 permit tcp source user-group portal destination-port eq 801
rule 35 permit tcp source user-group portal destination-port eq 802
rule 40 permit tcp source user-group portal destination-port eq 803
rule 45 permit tcp source user-group portal destination-port eq 804
rule 50 permit tcp source user-group portal destination-port eq 443开放深澜Portal端口

#
acl number 6001
rule 5 permit ip source user-group portal destination ip-address 192.168.100.100 0
rule 10 permit ip source user-group portal destination ip-address 127.0.0.1 0
rule 15 permit ip source ip-address 192.168.100.100 0 destination user-group portal
rule 20 permit ip source ip-address 127.0.0.1 0 destination user-group portal
rule 25 permit ip source ip-address 10.10.10.0 0.0.1.255 destination user-group portal
rule 30 permit ip source user-group portal destination ip-address 10.10.10.0 0.0.1.255
rule 35 permit ip source ip-address 10.19.0.0 0.0.0.255 destination user-group portal
rule 40 permit ip source user-group portal destination ip-address 10.19.0.0 0.0.0.255
rule 45 permit ip source ip-address 10.3.1.0 0.0.0.255 destination user-group portal
rule 50 permit ip source user-group portal destination ip-address 10.3.1.0 0.0.0.255
rule 55 permit ip source ip-address 202.97.224.68 0.00.1 destination user-group portal
rule 60 permit ip source user-group portal destination ip-address 202.97.224.68 0.0.0.1
rule 65 permit ip source ip-address 101.7.8.9 0 destination user-group portal
rule 70 permit ip source user-group portal destination ip-address 101.7.8.9 0在未通过认证状况下，可以免费访问业务：自服务、DNS、内网资源等。

#
acl number 6002
rule 30 permit ip source user-group portal destination ip-address any
rule 35 permit ip source ip-address any destination user-group portal
#
#
ip pool 3jiao_ap_dong bas local
gateway 10.10.31.1 255.255.255.0
section 0 10.10.31.2 10.10.31.254
excluded-ip-address 10.10.31.2 10.10.31.9
dns-server 202.97.224.68 202.97.224.69 定义3教东区AP地址池，其中1作为网关，2-9从地址池中排除。其她业务地址池不再阐述

#
ip pool 3jiao_ap_xi bas local
gateway 10.10.30.1 255.255.255.0
section 0 1010.30.2 10.10.30.254
excluded-ip-address 10.10.30.2 10.10.30.9
dns-server 202.97.224.68 202.97.224.69
#
ip pool guanli bas local 定义设备管理地址池

gateway 10.11.255.254 255.255.0.0
section 0 10.11.0.1 10.11.255.253
excluded-ip-address 10.11.0.1 10.11.255.253
#
ip pool portal bas local 定义学生寝室Portal地址池。

gateway 10.50.0.1 255.255.0.0
section 0 10.50.0.2 10.50.255.254
excluded-ip-address 10.50.100.100
dns-server 202.97.224.68 202.97.224.69
#
#
aaa

local-user huawei password irreversible-cipher $1a$:a(TQ#Wuthentication-scheme default
authentication-mode local radius
authentication-scheme pppoe
authentication-mode none
authentication-scheme radius
#
authorization-scheme default
#
accounting-scheme default0
accounting-scheme default1
accounting-scheme pppoe
accounting-mode none
accounting-scheme jrzk
accounting-scheme radius
accounting interim interval 10定义每10分钟向Radius上传一次计费报文。

#
domain default0
ip-pool qinshi-1
dns primary-ip 202.97.224.68
dns second-ip 202.97.224.69
user-group portal
web-server 192.168.100.100
web-server url
web-server url-parameter定义认证前域，用来为学生分派IP地址，并推送Portal页面

domain default1
domain default_admin
domain portal
authentication-scheme radius
accounting-scheme radius
radius-server group wgyxy 定义认证域，学生通过Portal输入顾客名及密码后，会由认证域进行身份认证。

domain guanli
authentication-scheme pppoe
accounting-scheme pppoe
ip-pool guanli 定义用于设备管理域，该域中定义都是互换机管理地址。

#
interface Eth-Trunk1
description to-HW-S12708 [20G]
mode user-termination
load-balance packet-all下联寝室网核心8614

#
interface Eth-Trunk1.1Eth1.1用于终结Portal拨号业务。

description portal_bohao
user-vlan 101 148 qinq 2111 2114终结顾客vlan：
内层vlan101-148
外层vlan 2111-2114

user-vlan 101 148 qinq 2141
user-vlan 101 148 qinq 2171
user-vlan 101 148 qinq 2211 2213
user-vlan 201 248 qinq 2213
user-vlan 101 148 qinq 2240
user-vlan 201 248 qinq 2240
user-vlan 301 348 qinq 2240
user-vlan 101 148 qinq 2321 2324
user-vlan 101 148 qinq 2341
user-vlan 101 148 qinq 2371
user-vlan 101 148 qinq 2421 2425
user-vlan 101 148 qinq 2441
user-vlan 101 148 qinq 2471
user-vlan 101 148 qinq 2511 2518
user-vlan 101 148 qinq 2520
user-vlan 101 148 qinq 2540
user-vlan 201 248 qinq 2540
user-vlan 101 148 qinq 2542
user-vlan 101 148 qinq 2561

user-vlan 101 148 qinq 2611 2614
user-vlan 101 148 qinq 2641
user-vlan 101 148 qinq 2711 2713
user-vlan 101 148 qinq 2741 2742
user-vlan 101 148 qinq 2810
user-vlan 201 248 qinq 2810
user-vlan 101 148 qinq 2821 2822
user-vlan 101 148 qinq 2830
user-vlan 201 248 qinq 2830
user-vlan 101 148 qinq 2840
user-vlan 201 248 qinq 2840
user-vlan 101 148 qinq 2851
user-vlan 101 148 qinq 2861 2862
user-vlan 101 148 qinq 2870
user-vlan 201 248 qinq 2870
bas
#
access-type layer2-subscriber default-domain authentication portal
authentication-method web
arp-trigger
#
#
interface Eth-Trunk1.2 Eth1.2做互换设备管理用.机tal

description device_management
user-vlan
user-vlan qinq 2111 2114
user-vlan qinq 2141
user-vlan qinq 2171
user-vlan qinq 2211 2213
user-vlan qinq 2240 2243
user-vlan qinq 2321 2324
user-vlan qinq 2341
user-vlan qinq 2371
user-vlan qinq 2421 2425
user-vlan qinq 2441
user-vlan qinq 2471
user-vlan qinq 2511 2518
user-vlan qinq 2520
user-vlan qinq 2540
user-vlan qinq 2542
user-vlan qinq 2561
user-vlan qinq 2611 2614
user-vlan qinq 2641
user-vlan qinq 2711 2713
user-vlan qinq 2741 2742
user-vlan qinq 2810
user-vlan qinq 2821 2822
user-vlan qinq 2830
user-vlan qinq 2840
user-vlan qinq 2851
user-vlan qinq 2861 2862
user-vlan qinq 2870
bas
#
access-type layer2-subscriber default-domain authentication guanli
authentication-method bind
arp-proxy
ip-trigger
arp-trigger

其她子接口可依照子接口描述拟定业务！
#
#
interface Eth-Trunk2
portswitch
description to-USG9000-FW [20G]
port link-type trunk
port trunk allow-pass vlan 105 4000上联USG防火墙

#
interface GigabitEthernet1/0/0
undo shutdown
eth-trunk 1
#
interface GigabitEthernet1/0/1
undo shutdown
eth-trunk 1
#
interface GigabitEthernet1/0/2
undo shutdown
eth-trunk 2
#
interface GigabitEthernet1/0/3
undo shutdown
eth-trunk 2
#
interface GigabitEthernet1/0/4
description to_powercache
undo shutdown
ip address 10.100.99.1 255.255.255.0 #下联PowerCache

#
interface GigabitEthernet1/0/9
negotiation auto
description to-H3C12508
undo shutdown
ip address 172.16.6.66 255.255.255.0下联H3C12508,用于榜文办公网,图书馆,实验室.

#
#
ip route-static 0.0.0.0 0.0.0.0 Vlanif4000 172.31.0.1 description uplink-USG9000-FW默认出口路由为FW

ip route-static 10.5.0.0 255.255.252.0 172.28.2.2由于某些3教是以3层链路接到Bras，因而需向下回指静态路由

ip route-static 10.10.1.0 255.255.255.0 172.28.2.2
ip route-static 10.10.2.0 255.255.255.0 172.28.2.2
ip route-static 10.10.3.0 255.255.255.0 172.28.2.2
ip route-static 10.10.4.0 255.255.255.0 172.28.2.2
ip route-static 10.10.5.0 255.255.255.0 172.28.2.2
ip route-static 10.10.6.0 255.255.255.0 172.28.1.2
ip route-static 10.10.7.0 255.255.255.0 172.28.1.2
ip route-static 10.10.8.0 255.255.255.0 172.28.2.2
ip route-static 10.10.9.0 255.255.255.0 172.28.2.2
ip route-static 10.10.11.0 255255.255.0 172.28.1.2
ip route-static 10.10.12.0 255.255.255.0 172.28.1.2
ip route-static 10.10.13.0 255.255.255.0 172.28.1.2
ip route-static 10.10.14.0 255.255.255.0 172.28.2.2
ip route-static 10.10.15.0 255.255.255.0 172.28.1.2
ip route-static 10.10.16.0 255.255.255.0 172.28.1.2
ip route-static 10.10.17.0 255.255.255.0 172.28.1.2
ip route-static 10.10.18.0 255.255.255.0 172.28.2.2
ip route-static 10.10.19.0 255.255.255.0 172.28.1.2
ip route-static 10.10.20.0 255.255.255.0 172.28.1.2
ip route-static 10.10.21.0 255.255.255.0 172.28.1.2
ip route-static 10.10.32.0 255.255.255.0 172.281.2
ip route-static 10.17.0.0 255.255.255.0 172.28.1.2
ip route-static 10.20.0.0 255.255.255.0 172.28.1.2
ip route-static 10.22.0.0 255.255.255.0 172.28.1.2
ip route-static 10.23.0.0 255.255.255.0 172.28.2.2
ip route-static 10.25.25.0 255.255.255.0 172.28.2.2
ip route-static 172.20.1.99 255.255.255.255 192.168.100.97 description to-ATM
ip route-static 172.20.2.2 255.255.255.255 192.168.100.97 description to-ATM去往学校ATM

#
#
static-user 10.11.0.254 10.11.0.254 gateway 10.11.255.254 interface Eth-Trunk1.2 vlan domain-name guanli detect定义静态IP互换机管理地址，以本条命令为例，将eth1.2接口从vlan 上来顾客，容许其静态配备成10.11.0.254，网关10.11.255.254。
针对固定IP顾客，配备原理也是同样。

static-user 10.11.1.11 10.11.1.11 gateway 10.11.255.254 interface Eth-Trunk1.2 vlan qinq 2111 domain-name guanli detect
static-user 10.11.1.12 10.11.1.12 gateway 10.11.255.254 interface Eth-Trunk1.2 vlan qinq 2112 domain-name guanli detect
static-user 10.11.1.13 10.11.1.13 gateway 10.11.255.254 interface Eth-Trunk1.2 vlan qinq 2113 domain-name guanli detect
static-user 10.11.1.14 10.11.1.14 gateway 10.11.255.254 interface Eth-Trunk1.2 vlan qinq 2114 domain-name guanli detect
static-user 10.11.1.41 10.11.1.41 gateway 10.11.255.254 interface Eth-Trunk1.2 vlan qinq 2141 domain-name guanli detect
static-user 10.11.1.254 10.11.1.254 gateway 10.11.255.254 interface Eth-Trunk1.2 vlan domain-name guanli detect
static-user 10.11.2.11 10.11.2.11 gateway 10.11.255.254 interface Eth-Trunk1.2 vlan qinq 2211 domain-name guanli detect
static-user 10.11.2.12 10.11.2.12 gateway 10.11.255.254 interface Eth-Trunk1.2 vlan qinq 2212 domain-name guanli detect
static-user 10.11.2.13 10.11.2.14 gateway 10.11.255.254 interface Eth-Trunk1.2 vlan qinq 2213 domain-name guanli detect
static-user 10.11.2.41 10.11.2.43 gateway 10.11.255.254 interface Eth-Trunk1.2 vlan qinq 2240 domain-name guanli detect
static-user 10.11.2.254 10.11.2.254 gateway 10.11.255.254 interface Eth-Trunk1.2 vlan domain-name guanli detect
static-user 10.11.3.21 10.11.3.21 gateway 10.11.255.254 interface Eth-Trunk1.2 vlan qinq 2321 domain-name guanli detect
static-user 10.11.3.22 10.11.3.22 gateway 10.11.255.254 interface Eth-Trunk1.2 vlan qinq 2322 domain-name guanli detect
static-user 10.11.3.23 10.11.3.23 gateway 10.11.255.254 interface Eth-Trunk1.2 vlan qinq 2323 domain-name guanli detect
static-user 10.11.3.24 10.11.3.24 gateway 10.11.255.254 interface Eth-Trunk1.2 vlan qinq 2324 domain-name guanli detect
static-user 10.11.3.41 10.11.3.41 gateway 10.11.255.254 interface Eth-Trunk1.2 vlan qinq 2341 domain-name guanli detect
static-user 10.11.3.71 10.11.3.71 gateway 10.11.255.254 interface Eth-Trunk1.2 vlan qinq 2371 domain-name guanli detect
static-user 10.11.3.253 10.11.3.254 gateway 10.11.255.254 interface Eth-Trunk1.2 vlan domain-name guanli detect
#
web-auth-server 192.168.100.100 port 50100 key simple hwme60配备Portal服务器

二、 新设备（顾客）开局脚本
2.1 汇聚/接入互换机开局
场景：假定新建一套中区11号楼汇聚和接入互换机，其外层VLAN为1011，内层管理地址为11，内层1xx为一楼互换机，2xx为二楼互换机，依次类推。

1.定义一种管理IP地址池：
ip pool guanli-zhongqu-11 bas local
gateway 10.0.11.254 255.255.255.0
section 0 10.0.11.1 10.0.11.253
excluded-ip-address 10.0.11.1 10.0.11.253固定IP顾客必要将地址从地址池中移除。

2.在管理域中加入此地址池：
aaa
domain guanli
ip-pool guanli-zhongqu-11

3.在Bras口上终结此VLAN
interface Eth-Trunk1.2
user-vlan 11汇聚设备管理vlan是不带外层标签

user-vlan 11 qinq 1011楼层互换机通过汇聚设备会打上2层标签

4.定义静态IP顾客（互换机）
static-user 10.0.11.1 10.0.11.252 gateway 10.0.11.254 interface Eth-Trunk1.2 vlan 11 qinq 1011 domain-name guanli 如果是设备管理IP，建议放到guanli这个域中。
detect
static-user 10.0.11.253 10.0.11.253 gateway 10.0.11.254 interface Eth-Trunk1.2 vlan 11 domain-name guanli detect

2.2 配备纯Portal拨号业务
场景：假定新建一套中区11号楼汇聚和接入互换机，其外层VLAN为1011，内层1xx为一楼互换机，2xx为二楼互换机，依次类推。如果此Portal业务需要为其新分派段IP，则需要执行如下1-3操作，如果与既有业务相似，可直接进行第3步。

1.定义一种管理IP地址池：
ip pool new-yewu bas local
gateway 10.2.0.1 255.255.255.0
section 0 10.2.0.1 10.2.255.254

2.在新建域中加入此地址池：
aaa
domain new-yewu0
ip-pool new-yewu
dns primary-ip 172.16.17.23
user-group portal
web-server 172.16.6.6
web-server url
web-server url-parameter
domain new-yewu
authentication-scheme radius
accounting-scheme radius
value-added-service account-type radius jrzk
radius-server group jrzk
user-group inside

3.在Bras口上终结此VLAN
interface Eth-Trunk1.x需新建一种子接口

user-vlan 101 148 qinq 1001
user-vlan 201 248 qinq 1011
bas
#
access-type layer2-subscriber default-domain pre-authentication n