【正文】 ator or ifmatch acl 6101traffic classifier wlan_deny operator or ifmatch acl 6102traffic behavior wlan_permittraffic behavior redirect redirecttraffic behavior wlan_deny denytraffic policy limit sharemode classifier iptv behavior iptv classifier help behavior help classifier dial behavior dial classifier wlan_permit behavior wlan_permit classifier redirect behavior redirect classifier wlan_deny behavior wlan_denyaaa redirect enable這里配置ACL規(guī)則的主要目的是限制用戶在認證前域獲取了地址之后的上網(wǎng)權(quán)限。配置虛模板[Quidway]interface VirtualTemplate1ppp authenticationmode papppp keepalive interval 30 retransmit 3BAS接口的相關(guān)配置[Quidway] interface pppoeserver bind VirtualTemplate 1 description yuanxinquwlan uservlan 256 1000 qinq 316 bas accesstype layer2subscriber defaultdomain preauthentication wlantestrzq authentication wlantestrzh roamdomain wlantestrzh authenticationmethod ppp webnasporttype //配置接入設(shè)備類型(，主要用于控制無線用戶的鏈路層接入和身份認證)ssid CU_Campus //校園WLAN為此SSID，如果是有線接入不配該條命令,如果是公眾則是ChinaUninas logicsysname //增加此命令 MPLS VPN 業(yè)務【配置描述】：如果設(shè)備啟用MPLS VPN 業(yè)務功能，參數(shù)配置參照以下要求?！疽?guī)范要求】： 配置RADIUS認證 如果采用PPPOE認證，配置為全局RADIUS認證方式 VPN路由分發(fā) 重分布直連和靜態(tài)路由進入BGP； 多節(jié)點共用地址池時重分布subscribe路由進入BGP； 配置地址池的NULL0路由?！九渲檬纠?[Quidway] ip vpninstance BFhaolilaivpn routedistinguisher 65130:373044 vpntarget 65130:373044 exportextmunity vpntarget 65130:373044 importextmunity[Quidway] bgp 65143 ipv4family vpninstance BFhaolilaivpn importroute direct importroute static importroute unrdomain bfhaolilaivpn authenticationscheme default0 accountingscheme default0 vpninstance BFhaolilaivpn userpriority upstream 4 userpriority downstream 4 usergroup bfhaolilaivpn [Quidway] description tohaolilaimplszhongxindian controlvid 3003 dot1qtermination dot1q termination vid 3003 ip binding vpninstance BFhaolilaivpn ip address VPLS業(yè)務【配置描述】：如果設(shè)備啟用VPLS業(yè)務功能，參數(shù)配置參照以下要求。【規(guī)范要求】： 配置VPLS通道 配置使用loopback地址建立vpls通道 配置VPLS VPN實例 Se800使用單獨的context；7750使用單獨的service id【配置示例】:在PE 之間建立遠端LDP 會話配置PE1PE1 systemview[PE1] mpls ldp[PE1] mpls ldp remotepeer pe2[PE1mplsldpremotepe2] remoteip [PE1mplsldpremotepe2] undo remoteip pwe3[PE1mplsldpremotepe2] quit配置PE2PE2 systemview[PE2] mpls ldp[PE2] mpls ldp remotepeer pe1[PE2mplsldpremotepe1] remoteip [PE2mplsldpremotepe1] undo remoteip pwe3[PE2mplsldpremotepe1] quit在PE 上使能MPLS L2VPN配置PE1[PE1] mpls l2vpn[PE1l2vpn] quit在PE上配置VSI 配置PE1[PE1] vsi a2 static[PE1vsia2] pwsignal ldp[PE1vsia2] encapsulation ethernet[PE1vsia2ldp] vsiid 2[PE1vsia2ldp] peer 在PE上配置VSI 與接口的綁定 配置PE1[PE1] interface controlvid 2500 qinqtermination localswitch qinq termination pevid 2494 cevid 410 l2 binding vsi a2 arp broadcast enable【配置描述】：如果設(shè)備啟用VRRP功能，參數(shù)配置參照以下要求?！疽?guī)范要求】： 配置使用VRRP的虛地址Se800虛地址必須配置為master方的接口網(wǎng)關(guān)地址?！九渲檬纠?ME60A systemview[ME60A] interface gigabitethernet 2/0/0[ME60AGigabitEthernet2/0/0] undo shutdown[ME60AGigabitEthernet2/0/0] ip address 24[ME60AGigabitEthernet2/0/0] vrrp vrid 1 virtualip [ME60AGigabitEthernet2/0/0] vrrp vrid 1 priority 120[ME60AGigabitEthernet2/0/0] vrrp vrid 1 preemptmode timer delay 20[ME60AGigabitEthernet2/0/0] quitME60B systemview[ME60B] interface gigabitethernet 2/0/0[ME60BGigabitEthernet2/0/0] undo shutdown[ME60BGigabitEthernet2/0/0] ip address 24[ME60BGigabitEthernet2/0/0] vrrp vrid 1 virtualip [ME60BGigabitEthernet2/0/0] quit NAT444業(yè)務【配置描述】：如果設(shè)備啟用普通NAT444業(yè)務功能，參數(shù)配置參照以下要求。【規(guī)范要求】：每用戶分配2K端口，單臺BRAS公網(wǎng)轉(zhuǎn)換地址段采用2*（2+1）=6個C（支持6*256*32，）；二是公網(wǎng)用戶地址段初期配置4個C【配置示例】:配置NAT基本功能license active nat sessiontable size 16 slot 10 engine 0 active nat sessiontable size 16 slot 14 engine 0servicelocation 1 location slot 10 engine 0 backup slot 14 engine 0servicelocation 2 location slot 14 engine 0 backup slot 10 engine 0serviceinstancegroup 1 servicelocation 1serviceinstancegroup 2 servicelocation 2acl number 2900rule 5 permit source //NAT前地址每臺BAS一樣nat instance nat4441 id 1 nat filter mode fullconeportrange 2048 //每用戶分配端口數(shù) serviceinstancegroup 1 nat addressgroup 1 groupid 1 //NAT公網(wǎng)地址池 section 0 mask 22 nat outbound 2900 addressgroup 1nat alg all nat alarm portnumber log enable nat alarm portnumber trap enablenat instance nat4442 id 2 nat filter mode fullconeportrange 2048 //每用戶分配端口數(shù) serviceinstancegroup 2 nat addressgroup 2 groupid 2 //NAT公網(wǎng)地址池 section 0 mask 22 nat outbound 2900 addressgroup 2nat alg all nat alarm portnumber log enable nat alarm portnumber trap enablenat syslog descriptive format 控制私網(wǎng)路由發(fā)布:ip ipprefix plPrivateNAT444Route index 10 permit 16 greaterequal 16 lessequal 32routepolicy unrNAT444 deny node 10 ifmatch ipprefix plPrivateNAT444Routeroutepolicy unrNAT444 permit node 20bgp 65141 ipv4family unicastimportroute unr routepolicy unrNAT444配置引流策略usergroup nat4441usergroup nat4442acl number 9001 rule 5 permit ip source usergroup nat4441acl number 9002 rule 5 permit ip source usergroup nat4442traffic classifier nat4441 ifmatch acl 9001traffic classifier nat4442 ifmatch acl 9002traffic behavior nat4441nat bind instance nat4441 car trafficstatistic tarifflevel 5traffic behavior nat4442 nat bind instance nat4442 car trafficstatistic tarifflevel 5traffic policy limit //現(xiàn)網(wǎng)策略，已全局出入方向應用classifier nat4441 behavior nat4441classifier nat4442 behavior nat4442配置地址