【正文】 ator or ifmatch acl 6101traffic classifier wlan_deny operator or ifmatch acl 6102traffic behavior wlan_permittraffic behavior redirect redirecttraffic behavior wlan_deny denytraffic policy limit sharemode classifier iptv behavior iptv classifier help behavior help classifier dial behavior dial classifier wlan_permit behavior wlan_permit classifier redirect behavior redirect classifier wlan_deny behavior wlan_denyaaa redirect enable這里配置ACL規(guī)則的主要目的是限制用戶在認(rèn)證前域獲取了地址之后的上網(wǎng)權(quán)限。配置虛模板[Quidway]interface VirtualTemplate1ppp authenticationmode papppp keepalive interval 30 retransmit 3BAS接口的相關(guān)配置[Quidway] interface pppoeserver bind VirtualTemplate 1 description yuanxinquwlan uservlan 256 1000 qinq 316 bas accesstype layer2subscriber defaultdomain preauthentication wlantestrzq authentication wlantestrzh roamdomain wlantestrzh authenticationmethod ppp webnasporttype //配置接入設(shè)備類型(，主要用于控制無線用戶的鏈路層接入和身份認(rèn)證)ssid CU_Campus //校園WLAN為此SSID，如果是有線接入不配該條命令,如果是公眾則是ChinaUninas logicsysname //增加此命令 MPLS VPN 業(yè)務(wù)【配置描述】：如果設(shè)備啟用MPLS VPN 業(yè)務(wù)功能，參數(shù)配置參照以下要求?！疽?guī)范要求】： 配置RADIUS認(rèn)證 如果采用PPPOE認(rèn)證，配置為全局RADIUS認(rèn)證方式 VPN路由分發(fā) 重分布直連和靜態(tài)路由進(jìn)入BGP； 多節(jié)點(diǎn)共用地址池時(shí)重分布subscribe路由進(jìn)入BGP； 配置地址池的NULL0路由?！九渲檬纠?[Quidway] ip vpninstance BFhaolilaivpn routedistinguisher 65130:373044 vpntarget 65130:373044 exportextmunity vpntarget 65130:373044 importextmunity[Quidway] bgp 65143 ipv4family vpninstance BFhaolilaivpn importroute direct importroute static importroute unrdomain bfhaolilaivpn authenticationscheme default0 accountingscheme default0 vpninstance BFhaolilaivpn userpriority upstream 4 userpriority downstream 4 usergroup bfhaolilaivpn [Quidway] description tohaolilaimplszhongxindian controlvid 3003 dot1qtermination dot1q termination vid 3003 ip binding vpninstance BFhaolilaivpn ip address VPLS業(yè)務(wù)【配置描述】：如果設(shè)備啟用VPLS業(yè)務(wù)功能，參數(shù)配置參照以下要求?！疽?guī)范要求】： 配置VPLS通道 配置使用loopback地址建立vpls通道 配置VPLS VPN實(shí)例 Se800使用單獨(dú)的context；7750使用單獨(dú)的service id【配置示例】:在PE 之間建立遠(yuǎn)端LDP 會(huì)話配置PE1PE1 systemview[PE1] mpls ldp[PE1] mpls ldp remotepeer pe2[PE1mplsldpremotepe2] remoteip [PE1mplsldpremotepe2] undo remoteip pwe3[PE1mplsldpremotepe2] quit配置PE2PE2 systemview[PE2] mpls ldp[PE2] mpls ldp remotepeer pe1[PE2mplsldpremotepe1] remoteip [PE2mplsldpremotepe1] undo remoteip pwe3[PE2mplsldpremotepe1] quit在PE 上使能MPLS L2VPN配置PE1[PE1] mpls l2vpn[PE1l2vpn] quit在PE上配置VSI 配置PE1[PE1] vsi a2 static[PE1vsia2] pwsignal ldp[PE1vsia2] encapsulation ethernet[PE1vsia2ldp] vsiid 2[PE1vsia2ldp] peer 在PE上配置VSI 與接口的綁定 配置PE1[PE1] interface controlvid 2500 qinqtermination localswitch qinq termination pevid 2494 cevid 410 l2 binding vsi a2 arp broadcast enable【配置描述】：如果設(shè)備啟用VRRP功能，參數(shù)配置參照以下要求。【規(guī)范要求】： 配置使用VRRP的虛地址Se800虛地址必須配置為master方的接口網(wǎng)關(guān)地址?！九渲檬纠?ME60A systemview[ME60A] interface gigabitethernet 2/0/0[ME60AGigabitEthernet2/0/0] undo shutdown[ME60AGigabitEthernet2/0/0] ip address 24[ME60AGigabitEthernet2/0/0] vrrp vrid 1 virtualip [ME60AGigabitEthernet2/0/0] vrrp vrid 1 priority 120[ME60AGigabitEthernet2/0/0] vrrp vrid 1 preemptmode timer delay 20[ME60AGigabitEthernet2/0/0] quitME60B systemview[ME60B] interface gigabitethernet 2/0/0[ME60BGigabitEthernet2/0/0] undo shutdown[ME60BGigabitEthernet2/0/0] ip address 24[ME60BGigabitEthernet2/0/0] vrrp vrid 1 virtualip [ME60BGigabitEthernet2/0/0] quit NAT444業(yè)務(wù)【配置描述】：如果設(shè)備啟用普通NAT444業(yè)務(wù)功能，參數(shù)配置參照以下要求?！疽?guī)范要求】：每用戶分配2K端口，單臺(tái)BRAS公網(wǎng)轉(zhuǎn)換地址段采用2*（2+1）=6個(gè)C（支持6*256*32，）；二是公網(wǎng)用戶地址段初期配置4個(gè)C【配置示例】:配置NAT基本功能license active nat sessiontable size 16 slot 10 engine 0 active nat sessiontable size 16 slot 14 engine 0servicelocation 1 location slot 10 engine 0 backup slot 14 engine 0servicelocation 2 location slot 14 engine 0 backup slot 10 engine 0serviceinstancegroup 1 servicelocation 1serviceinstancegroup 2 servicelocation 2acl number 2900rule 5 permit source //NAT前地址每臺(tái)BAS一樣nat instance nat4441 id 1 nat filter mode fullconeportrange 2048 //每用戶分配端口數(shù) serviceinstancegroup 1 nat addressgroup 1 groupid 1 //NAT公網(wǎng)地址池 section 0 mask 22 nat outbound 2900 addressgroup 1nat alg all nat alarm portnumber log enable nat alarm portnumber trap enablenat instance nat4442 id 2 nat filter mode fullconeportrange 2048 //每用戶分配端口數(shù) serviceinstancegroup 2 nat addressgroup 2 groupid 2 //NAT公網(wǎng)地址池 section 0 mask 22 nat outbound 2900 addressgroup 2nat alg all nat alarm portnumber log enable nat alarm portnumber trap enablenat syslog descriptive format 控制私網(wǎng)路由發(fā)布:ip ipprefix plPrivateNAT444Route index 10 permit 16 greaterequal 16 lessequal 32routepolicy unrNAT444 deny node 10 ifmatch ipprefix plPrivateNAT444Routeroutepolicy unrNAT444 permit node 20bgp 65141 ipv4family unicastimportroute unr routepolicy unrNAT444配置引流策略u(píng)sergroup nat4441usergroup nat4442acl number 9001 rule 5 permit ip source usergroup nat4441acl number 9002 rule 5 permit ip source usergroup nat4442traffic classifier nat4441 ifmatch acl 9001traffic classifier nat4442 ifmatch acl 9002traffic behavior nat4441nat bind instance nat4441 car trafficstatistic tarifflevel 5traffic behavior nat4442 nat bind instance nat4442 car trafficstatistic tarifflevel 5traffic policy limit //現(xiàn)網(wǎng)策略，已全局出入方向應(yīng)用classifier nat4441 behavior nat4441classifier nat4442 behavior nat4442配置地址