【正文】 ay 掩碼 Section 0 dnsserver 配置radius認(rèn)證服務(wù)器[Quidway] radiusserver group wlan radiusserver sharedkey 密鑰 authentication 1645 weight 0 radiusserver sharedkey 密鑰 authentication 1645 weight 0 radiusserver sharedkey 密鑰 accounting 1646 weight 0 radiusserver sharedkey 密鑰 accounting 1646 weight 0 radiusserver sharedkey 密鑰 radiusserver classascar radiusserver source interface LoopBack0共享密鑰是ME60和radius之間進(jìn)行報(bào)文加密交互的重要參數(shù)，兩端一定要設(shè)置的一致，因此在設(shè)置共享密鑰之前需要和radius方面進(jìn)行協(xié)商配置WEB認(rèn)證服務(wù)器[Quidway]webauthserver source interface LoopBack0webauthserver source interface LoopBack0 webauthserver version v2 webauthserver port 50100 key 密鑰建立用戶組[Quidway]usergroup wlanuser配置認(rèn)證、計(jì)費(fèi)方案、認(rèn)證前的域、認(rèn)證域（認(rèn)證前為不認(rèn)證、不計(jì)費(fèi)方式；認(rèn)證后為radius認(rèn)證、radius計(jì)費(fèi)方式）[Quidwayaaa] domain wlantestrzq authenticationscheme default0 accountingscheme none ippool wlanuser usergroup wlantest webserver webserver url webserver mode postdomain wlantestrzh authenticationscheme radius accountingscheme radius ippool wlanuser radiusserver group wlan usergroup dial配置ACL規(guī)則acl number 6101 rule 5 permit tcp source usergroup wlanuser destinationport eq rule 10 permit tcp source usergroup wlanuser destinationport eq 8080acl number 6102 rule 10 permit ip source usergroup wlanuser destination ipaddress anyacl number 6103rule 5 permit ip source usergroup wlantest destination ipaddress 0 //允許訪問web server rule 10 permit ip source usergroup wlantest destination ipaddress 0 // rule 15 permit ip source usergroup wlantest destination ipaddress 0 //允許訪問DNS server rule 20 permit ip source usergroup wlantest destination ipaddress 0 //允許訪問DNS servertraffic classifier wlan_permit operator or ifmatch acl 6103traffic classifier redirect operator or ifmatch acl 6101traffic classifier wlan_deny operator or ifmatch acl 6102traffic behavior wlan_permittraffic behavior redirect redirecttraffic behavior wlan_deny denytraffic policy limit sharemode classifier iptv behavior iptv classifier help behavior help classifier dial behavior dial classifier wlan_permit behavior wlan_permit classifier redirect behavior redirect classifier wlan_deny behavior wlan_denyaaa redirect enable這里配置ACL規(guī)則的主要目的是限制用戶在認(rèn)證前域獲取了地址之后的上網(wǎng)權(quán)限。【配置示例】:ME60A systemview[ME60A] interface gigabitethernet 2/0/0[ME60AGigabitEthernet2/0/0] undo shutdown[ME60AGigabitEthernet2/0/0] ip address 24[ME60AGigabitEthernet2/0/0] vrrp vrid 1 virtualip [ME60AGigabitEthernet2/0/0] vrrp vrid 1 priority 120[ME60AGigabitEthernet2/0/0] vrrp vrid 1 preemptmode timer delay 20[ME60AGigabitEthernet2/0/0] quitME60B systemview[ME60B] interface gigabitethernet 2/0/0[ME60BGigabitEthernet2/0/0] undo shutdown[ME60BGigabitEthernet2/0/0] ip address 24[ME60BGigabitEthernet2/0/0] vrrp vrid 1 virtualip [ME60BGigabitEthernet2/0/0] quit NAT444業(yè)務(wù)【配置描述】：如果設(shè)備啟用普通NAT444業(yè)務(wù)功能，參數(shù)配置參照以下要求。 配置forward 配置PORTAL頁面的URL。CTY表示W(wǎng)LAN位于的接入城市，由4位數(shù)字組成，由各個(gè)地市的長(zhǎng)途區(qū)號(hào)表示, 右對(duì)齊左填零。[Quidway] ip pool pool1 bas local[Quidwayippoolpool1] gateway [Quidwayippoolpool1] section 0 [Quidwayippoolpool1]Dnsserver 配置域?！疽?guī)范要求】： 如果設(shè)備支持，需打開引擎防護(hù)功能?！疽?guī)范要求】： 登錄訪問列表必須配置允許訪問地址列表以實(shí)現(xiàn)只有特定IP地址主機(jī)訪問節(jié)點(diǎn)。Quidway systemview[Quidway] sysname ME60B[ME60B] interface gigabitEthernet 1/0/0[ME60BGigabitEthernet1/0/0] undo shutdown[ME60BGigabitEthernet1/0/0] ip address 24[ME60BGigabitEthernet1/0/0] quit 在ME60A 上使能BFD，并配置與ME60B 之間的BFD Session?！九渲檬纠?bgp 65144 group haxcvpn internal 建立與城域網(wǎng)核心路由器MPiBGP鄰居關(guān)系對(duì)等組 peer haxcvpn password ******** peer haxcvpn connectinterface LoopBack10 peer asnumber 65144 peer group haxcvpn peer description PAXCQYLCISCO12816001 peer asnumber 65144 peer group haxcvpn peer description PAXCXDLCISCO12816001 group haxc internal 建立與城域網(wǎng)核心路由器IPv4 iBGP鄰居關(guān)系對(duì)等組 peer haxc password ****** peer haxc connectinterface LoopBack0 peer asnumber 65144 peer group haxc peer description PAXCQYLCISCO12816001 peer asnumber 65144 peer group haxc peer description PAXCXDLCISCO12816001 ipv4family unicast undo synchronization importroute direct importroute static importroute unr undo peer enable undo peer enable undo peer haxcvpn enable peer haxc enable peer haxc routepolicy setmunity export peer haxc advertisemunity peer enable peer group haxc peer enable peer group haxc ipv4family vpnv4 policy vpntarget peer haxcvpn enable peer haxcvpn advertisemunity peer enable peer group haxcvpn peer enable peer group haxcvpn ipv4family vpninstance mplsvpntest network ipv4family vpninstance mplsvpn_jiudi importroute direct importroute static importroute unr ipv4family vpninstance xc_guotuju importroute direct importroute static importroute unr ipv4family vpninstance mplsvpn_LaoDongJu importroute direct importroute static importroute unr MPLS配置【配置描述】：如果網(wǎng)絡(luò)部署MPLS，相關(guān)參數(shù)參照以下要求。 OSPF鄰居兩端接口的網(wǎng)絡(luò)類型要一致。 如非必要ospf中不引入直連和靜態(tài)，若必須引入，則重發(fā)布靜態(tài)和直連路由時(shí)，建議發(fā)布成TYPE1?！九渲檬纠?Quidway systemview[Quidway] ip routestatic GigabitEthernet1/0/0 description TEXT OSPF配置【配置描述】：OSPF用于在單一自治系統(tǒng)內(nèi)決策路由，如果網(wǎng)絡(luò)規(guī)劃需要配置OSPF，參照以下要求；【規(guī)范要求】： OSPF進(jìn)程號(hào),取值范圍165535，建議取值為100。[Quidway] infocenter source default channel 2 log level warning配置發(fā)送日志信息的源接口?！九渲檬纠?Quidway systemview 進(jìn)入系統(tǒng)視圖[Quidway] acl number 2000 設(shè)定允許訪問地址段rule 5 permit source rule 10 permit source rule 15 permit source 本地允許地址段[Quidway] snmpagent acl 2000[Quidway]snmpagent munity read 字符串 [Quidway] snmpagent sysinfo version V2C [Quidway]ifindex c