【正文】 火墻配置 其他設(shè)備 防火墻基礎(chǔ)配置： sysname SYGMBHF3FW /分部名稱門(mén)店名稱樓層FW securityzone intrazone default permit dhcp enable dhcp server forbiddenip /保留IP 見(jiàn)地址分配表vlan 1vlan 10dhcp server ippool AP gatewaylist network mask /設(shè)備管理地址池 見(jiàn)地址分配表，不分配DNSinterface Vlaninterface10 ip address interface GigabitEthernet1/0/0 port linkmode route ip address nat outbound 3100interface GigabitEthernet1/0/1 port linkmode routeinterface GigabitEthernet1/0/2 port linkmode bridge port linktype trunk undo port trunk permit vlan 1 port trunk permit vlan 10 100 200 300 400interface GigabitEthernet1/0/3 port linkmode bridge port linktype trunk undo port trunk permit vlan 1 port trunk permit vlan 10 100 200 300 400securityzone name Local securityzone name Trust import interface Vlaninterface10 import interface GigabitEthernet1/0/2 vlan 10 import interface GigabitEthernet1/0/3 vlan 10securityzone name DMZsecurityzone name Untrust import interface GigabitEthernet1/0/0 import interface GigabitEthernet1/0/1zonepair security source Any destination Any packetfilter 3000 ip routestatic 0 /出口路由 ip routestatic 21 /回程路由acl number 3000 rule 0 permit ipacl number 3100 rule 0 deny ip source destination /設(shè)備管理網(wǎng)段訪問(wèn)數(shù)據(jù)中心不做nat rule 10 permit ip 端口分配防火墻 端口分配表端口號(hào)用途備注GE0/0/01(備用)互聯(lián)網(wǎng)連接互聯(lián)網(wǎng)GE0/0/23（備用）上網(wǎng)行為管理連接上網(wǎng)行為管理GE0/0/1516（備用）生產(chǎn)網(wǎng)路由器連接生產(chǎn)路由器要點(diǎn)：端口固定；內(nèi)網(wǎng)接口使用bridge模式，啟用vlan；接口加入vlan；區(qū)域間規(guī)格改成允許；區(qū)域內(nèi)規(guī)則改成允許；AP地址的DHCP；公共部分：localuser admin password simple gome0917 servicetype ssh terminal authorizationattribute userrole networkadmin line vty 0 4 authenticationmode schemeprotocol inbound ssh ssh server enable ssh user admin servicetype all authenticationtype passwordssh server enablepublickey local create rsa ysnmpagent munity read gomerdsnmpagent munity write gomewrsnmpagent sysinfo version v2c v3 VPN部分：acl number 3001 description VPN rule 0 permit ip source destination /修改成本地設(shè)備管理地址段 和NAT ACL 3000 對(duì)應(yīng)ipsec transformset 1 esp encryptionalgorithm descbc esp authenticationalgorithm sha1 ike keychain gomepresharedkey address key simple 123456ike proposal 1ike identity fqdn ike profile vpn keychain gome exchangemode aggressive localidentity fqdn sygmsybh match remote identity address proposal 1 ipsec policy vpn 1 isakmp transformset 1 security acl 3001 remoteaddress ikeprofile vpninterface GigabitEthernet1/0/0ipsec apply policy vpnPortal部分：acl number 3101 rule 0 permit tcp source destination destinationport eq 8080nat addressgroup 0address /26位子網(wǎng)門(mén)店使用倒數(shù)第2位地址作為地址池，網(wǎng)關(guān)地址125位子網(wǎng)門(mén)店使用倒數(shù)第25位地址作為地址池， interface GigabitEthernet1/0/0 port linkmode route tcp mss 1400 nat outbound 3101 addressgroup 0 交換機(jī)公共部分：localuser admin password simple gome0917 servicetype ssh terminal authorizationattribute userrole networkadmin line vty 0 4 authenticationmode schemeprotocol inbound ssh ssh server enable ssh user admin servicetype all authenticationtype passwordssh server enablepublickey local create rsa ysnmpagent munity read gomerdsnmpagent munity write gomewrsnmpagent sysinfo version v2c v3 匯聚交換機(jī)sysname SYGMBHF3POE1 /命名規(guī)則 分部名稱門(mén)店名稱樓層設(shè)備類型及編號(hào)vlan 10vlan 100vlan 200vlan 300 vlan 400interface Vlaninterface10 ip address interface GigabitEthernet1/0/1 port linktype trunk undo port trunk permit vlan 1 port trunk permit vlan 10 100 200 300 400 port trunk pvid vlan 10 poe enableinterface GigabitEthernet1/0/2 port linktype trunk undo port trunk permit vlan 1 port trunk permit vlan 10 100 200 300 400 port trunk pvid vlan 10 poe enable interface GigabitEthernet1/0/3 port linktype trunk undo port trunk permit vlan 1 port trunk permit vlan 10 100 200 300 400 port trunk pvid vlan 10 poe enableinterface GigabitEthernet1/0/4 port linktype trunk undo port trunk permit vlan 1 port trunk permit vlan 10 100 200 300 400 port trunk pvid vlan 10 poe enableinterface GigabitEthernet1/0/5 port linktype trunk undo port trunk permit vlan 1 port trunk permit vlan 10 100 200 300 400 port trunk pvid vlan 10 poe enableinterface GigabitEthernet1/0/6 port linktype trunk undo port trunk permit vlan 1 port trunk permit vlan 10 100 200 300 400 port trunk pvid vlan 10 poe enableinterface GigabitEthernet1/0/7 port linktype trunk undo port trunk permit vlan 1 port trunk permit vlan 10 100 200 300 400 port trunk pvid vlan 10 poe enableinterface GigabitEthernet1/0/8 port linktype trunk undo port trunk permit vlan 1 port trunk permit vlan 10 100 200 300 400 port trunk pvid vlan 10 poe enableinterface GigabitEthernet1/0/9 port linktype trunk undo port trunk permit vlan 1 port trunk permit vlan 10 100 200 300 400 port trunk pvid vlan 10 poe enableinterface GigabitEthernet1/0/10 port linktype trunk undo port tr。 完工后接口人檢查，二天內(nèi)反饋到北明接口人李沛或唐鵬（郵件主題注明分部門(mén)店名稱）；連通性檢測(cè)：ping 網(wǎng)關(guān)、防火墻外網(wǎng)口、運(yùn)營(yíng)商IP，百度 上網(wǎng)檢測(cè)：打開(kāi)XXX在線，京東，蘇寧，淘寶，微信，支付寶。綜合布線和AP的吸頂安裝，采取外包給布線公司，則相應(yīng)的工具由其提供，他們提供測(cè)試通過(guò)的線路，并按要求貼標(biāo)簽。如XXX布線公司價(jià)格過(guò)高，則聯(lián)系其他布線公司，說(shuō)明環(huán)境情況，預(yù)估價(jià)格是否合理？并確認(rèn)到場(chǎng)時(shí)間。（3510搭配一個(gè)150W說(shuō)明：每個(gè)到貨的XXX設(shè)備需填寫(xiě)序列號(hào)；沒(méi)有的設(shè)備必須用“零”標(biāo)注；表中的無(wú)線控制器項(xiàng)目組安排專人，對(duì)第一批要實(shí)施的100家門(mén)店，逐一電話聯(lián)系店長(zhǎng)等接口人，確認(rèn)：門(mén)店地址、收貨人、IT經(jīng)理的配合、布線工作配合等，參考《：一期門(mén)店電話確認(rèn)記錄》。如果有更大的需求，需要改造，時(shí)間看改造量。如有超出這幾種的環(huán)境，依據(jù)實(shí)際情況，和IT經(jīng)理協(xié)商溝通，前提安全、美觀、不影響信號(hào)覆蓋、定位。5實(shí)施標(biāo)準(zhǔn)本項(xiàng)目的標(biāo)簽標(biāo)準(zhǔn)如下：位置類型內(nèi)容貼法網(wǎng)線兩頭黃色旗型線纜標(biāo)簽該網(wǎng)線所接設(shè)備的名稱，參考“”靠近水晶頭35CM的地方，順一個(gè)方向粘貼防火墻交換機(jī)服務(wù)器黃色或白色長(zhǎng)條形標(biāo)簽該設(shè)備的命名粘貼在設(shè)備左上部分AP黃色或白色長(zhǎng)條形標(biāo)