交換機配置mpls案例

#

 version 7.1.075, Release 7951P10

#

 irf link-detect-time 100

#

 clock timezone bj add 08:00:00

#

 sysname Internet_XX_R1

#

 forward-path-detection enable

#

ip vpn-instance vpn-1

 route-distinguisher 65535:1

 vpn-target 65535:1 import-extcommunity

 vpn-target 65535:1 export-extcommunity

#

ip vpn-instance vpn-2

 route-distinguisher 65535:2

 vpn-target 65535:2 import-extcommunity

 vpn-target 65535:2 export-extcommunity

#

 router id 172.18.255.XX

#

ospf 1 router-id 172.18.255.XX

 silent-interface Vlan-interface100

 area 0.0.0.0

  network 172.18.251.XX 0.0.0.7

  network 172.18.255.XX 0.0.0.0

#

ospf 10 router-id 172.18.245.XX vpn-instance vpn-1

 default-route-advertise summary cost 10

 area 0.0.0.0

  network 172.18.11.XX 0.0.0.7

#

 mpls lsr-id 172.18.255.XX

#

 mirroring-group 1 local

#

 lldp global enable

#

 system-working-mode standard

 password-recovery enable

#

vlan 1

#

vlan 99        

#

vlan 100

 description SecManage

#

mpls ldp

#

interface NULL0

#

interface LoopBack1

 ip address 172.18.255.XX 255.255.255.255

#

interface LoopBack10

 description vpn-1 manage

 ip binding vpn-instance vpn-1

 ip address 172.18.245.XX 255.255.255.255

#              

interface FortyGigE3/0/2

 port link-mode route

 shutdown

#

interface FortyGigE3/0/1

 port link-mode bridge

 port access vlan 100

 mirroring-group 1 monitor-port

#

interface GigabitEthernet2/1/1

 port link-mode route

#

interface GigabitEthernet2/1/2

 port link-mode route

 description to Internet_XXXX

 ip binding vpn-instance vpn-1

 ip address 172.18.11.XX 255.255.255.248

#

interface GigabitEthernet2/1/3

 port link-mode route

#

interface GigabitEthernet2/1/4

 port link-mode route

#

interface GigabitEthernet2/1/5

 port link-mode route

#

interface GigabitEthernet2/1/6

 port link-mode route

#

interface GigabitEthernet2/1/7

 port link-mode route

#

interface GigabitEthernet2/1/8

 port link-mode route

#

interface GigabitEthernet2/1/9

 port link-mode route

#

interface GigabitEthernet2/1/10

 port link-mode route

#

interface GigabitEthernet2/1/11

 port link-mode route

#

interface GigabitEthernet2/1/12

 port link-mode route

#

interface GigabitEthernet2/1/13

 port link-mode route

#

interface GigabitEthernet2/1/14

 port link-mode route

#

interface GigabitEthernet2/1/15

 port link-mode route

#

interface GigabitEthernet2/1/16

 port link-mode route

#

interface GigabitEthernet2/1/17

 port link-mode route

#

interface GigabitEthernet2/2/1

 port link-mode route

#

interface GigabitEthernet2/2/2

 port link-mode route

#              

interface GigabitEthernet2/2/3

 port link-mode route

#

interface GigabitEthernet2/2/4

 port link-mode route

#

interface GigabitEthernet2/2/5

 port link-mode route

#

interface GigabitEthernet2/2/6

 port link-mode route

#

interface GigabitEthernet2/2/7

 port link-mode route

#

interface GigabitEthernet2/2/8

 port link-mode route

#

interface GigabitEthernet2/2/9

 port link-mode route

#

interface GigabitEthernet2/2/10

 port link-mode route

#

interface GigabitEthernet2/1/18

 port link-mode bridge

 description to ACG

 port access vlan 100

#

interface GigabitEthernet2/1/19

 port link-mode bridge

 description to IPS

 port access vlan 100

#

interface GigabitEthernet2/1/20

 port link-mode bridge

 description to FW

 port access vlan 100

#

interface M-GigabitEthernet0/0/0

#

interface Ten-GigabitEthernet2/4/1

 port link-mode route

 description to_Internet_Hexin_R1

 ip address 172.18.251.XX 255.255.255.248

 ospf network-type p2p

 mpls enable

 mpls ldp enable

 mirroring-group 1 mirroring-port both

#

interface Ten-GigabitEthernet2/4/2

 port link-mode route

#

interface Ten-GigabitEthernet2/4/3

 port link-mode route

#

interface Ten-GigabitEthernet2/4/4

 port link-mode route

#

bgp 65535

 router-id 172.18.255.XX

 timer keepalive 10 hold 30

 group sddl internal

 peer sddl connect-interface LoopBack1

 peer 172.18.255.1 group sddl

 #

 address-family ipv4 unicast

  peer sddl enable

 #             

 address-family vpnv4

  undo policy vpn-target

  peer sddl enable

 #

 ip vpn-instance vpn-1

  #

  address-family ipv4 unicast

   import-route direct

   import-route ospf 10 med 10 route-policy dishi-sum

#

route-policy dishi-sum permit node 10

 if-match ip address prefix-list dishi-sum

#

 ip prefix-list dishi-sum index 10 permit XX

#

 scheduler logfile size 16

#

line class aux

 user-role network-operator

#

line class console

 user-role network-admin

#              

line class vty

 user-role network-operator

#

line aux 0 1

 authentication-mode scheme

 user-role network-operator

#

line con 0 1

 authentication-mode scheme

 user-role network-admin

#

line vty 0 4

 authentication-mode scheme

 user-role network-admin

 user-role network-operator

#

line vty 5 63

 authentication-mode scheme

 user-role network-operator

#

 snmp-agent

 snmp-agent local-engineid 800063A28030809BB9100000000001

 snmp-agent community write private acl 2050

 snmp-agent community read publc acl 2050

 snmp-agent community read public

 snmp-agent sys-info version v2c

 snmp-agent target-host trap address udp-domain 172.18.250.253 params securityname private

 snmp-agent trap enable arp

 snmp-agent trap enable domain

 snmp-agent trap enable mpls

 snmp-agent trap enable radius

 snmp-agent trap enable syslog

#

 ssh server enable

 ssh user sddl service-type all authentication-type password

 ssh server acl 2000

#

 ntp-service enable

 ntp-service unicast-server 172.18.255.1

#

acl basic 2000

 rule 10 permit source 172.18.250.0 0.0.0.255

 rule 15 permit vpn-instance vpn-1 source 172.18.250.0 0.0.0.255

#

acl basic 2050

 rule 0 permit source 172.18.250.253 0

#

 undo password-control history enable

 password-control aging 30

 password-control length 8

 password-control composition type-number 3 type-length 4

 password-control login-attempt 3 exceed lock-time 30

 password-control login idle-time 0

 undo password-control change-password first-login enable

#

domain name system

#

 domain default enable system

#

role name level-0

 description Predefined level-0 role

#

role name level-1

 description Predefined level-1 role

#

role name level-2

 description Predefined level-2 role

#

role name level-3

 description Predefined level-3 role

#

role name level-4

 description Predefined level-4 role

#

role name level-5

 description Predefined level-5 role

#

role name level-6

 description Predefined level-6 role

#

role name level-7

 description Predefined level-7 role

#

role name level-8

 description Predefined level-8 role

#

role name level-9

 description Predefined level-9 role

#

role name level-10

 description Predefined level-10 role

#              

role name level-11

 description Predefined level-11 role

#

role name level-12

 description Predefined level-12 role

#

role name level-13

 description Predefined level-13 role

#

role name level-14

 description Predefined level-14 role

#

user-group system

#

local-user root class manage

 password hash $h$6$HrS5BEK+AYf1yVGN$i6S3EwbJquJuIgqvlJLVfUFPUqHjodMdROg15iLbAEuxo5p6jxzTwNNJoDerfBWHs+ZAtDNpZ8uM07LiNc38ZA==

 service-type ssh terminal

 authorization-attribute user-role network-admin

#

local-user xj class manage

 password hash $h$6$LcQzdJThUIGoLYG7$oRxbZy0vOB4qVJAt5s2RKhrAExtleOju6fZMht7V6hrQlMG8YXC8l8xa0BALaLjFhJWG+CMfsoZycHaFFAp3qQ==

 service-type ssh terminal

 authorization-attribute user-role level-1

#

return