...
| Без форматирования |
|---|
hostname ESR01 object-group service dhcp_server port-range 67 exit object-group service dhcp_client port-range 68 exit object-group service ssh port-range 22 exit object-group service telnet port-range 23 exit object-group service ntp port-range 123 exit object-group network MGMT ip prefix 10.10.2.0/24 ip prefix 172.31.109.0/24 ip prefix 172.16.109.0/28 exit object-group network nat_users ip prefix 100.64.9.0/24 exit radius-server timeout 10 radius-server host 10.10.2.254 key ascii-text testing123 timeout 11 source-address 10.10.2.159 auth-port 31812 acct-port 31813 retransmit 2 dead-interval 10 exit aaa radius-profile PCRF radius-server host 10.10.2.254 exit das-server COA key ascii-text testing123 port 3799 clients object-group MGMT exit aaa das-profile COA das-server COA exit vlan 10,2011 exit no spanning-tree domain lookup enable domain name-server 77.88.8.8 security zone trusted exit security zone untrusted exit security zone user exit security zone gre exit bridge 1 description "UpLink" vlan 10 security-zone untrusted ip firewall disable ip address 10.10.2.159/24 enable exit bridge 2 description "GRE_termination" vlan 20112019 security-zone gre ip firewall disable ip address 172.16.109.1/28 ip address 172.16.109.2/28 enable exit bridge 3 description "AP_MANAGMENT" security-zone trusted ip firewall disable ip address 172.31.109.1/24 ip helper-address 10.10.2.254 ip tcp adjust-mss 1418 protected-ports local enable exit bridge 10 description "AP_SSID1_USERS" security-zone user ip firewall disable ip address 100.64.9.1/24 ip helper-address 10.10.2.254 ip tcp adjust-mss 1418 location data10 protected-ports local enable exit interface gigabitethernet 1/0/1 mode switchport switchport forbidden default-vlan switchport mode trunk switchport trunk native-vlan 10 switchport trunk allowed vlan add 20112019 exit tunnel softgre 1 description "managment" mode management local address 172.16.109.1 default-profile enable exit tunnel softgre 1.1 bridge-group 3 enable exit tunnel softgre 2 description "data" mode data local address 172.16.109.2 default-profile enable exit snmp-server snmp-server system-shutdown snmp-server community "public" ro snmp-server community "private" rw snmp-server host 10.10.2.254 exit snmp-server enable traps config snmp-server enable traps config commit snmp-server enable traps config confirm snmp-server enable traps environment snmp-server enable traps environment fan snmp-server enable traps environment fan-speed-changed snmp-server enable traps environment fan-speed-high snmp-server enable traps environment memory-flash-critical-low snmp-server enable traps environment memory-flash-low snmp-server enable traps environment memory-ram-critical-low snmp-server enable traps environment memory-ram-low snmp-server enable traps environment cpu-load snmp-server enable traps environment cpu-critical-temp snmp-server enable traps environment cpu-overheat-temp snmp-server enable traps environment cpu-supercooling-temp snmp-server enable traps environment board-overheat-temp snmp-server enable traps environment board-supercooling-temp snmp-server enable traps file-operations snmp-server enable traps file-operations successful snmp-server enable traps file-operations failed snmp-server enable traps file-operations canceled snmp-server enable traps interfaces snmp-server enable traps interfaces rx-utilization-high snmp-server enable traps interfaces tx-utilization-high snmp-server enable traps interfaces number-high snmp-server enable traps screen snmp-server enable traps screen dest-limit snmp-server enable traps screen source-limit snmp-server enable traps screen icmp-threshold snmp-server enable traps screen udp-threshold snmp-server enable traps screen syn-flood snmp-server enable traps screen land snmp-server enable traps screen winnuke snmp-server enable traps screen icmp-frag snmp-server enable traps screen udp-frag snmp-server enable traps screen icmp-large snmp-server enable traps screen syn-frag snmp-server enable traps screen unknown-proto snmp-server enable traps screen ip-frag snmp-server enable traps screen port-scan snmp-server enable traps screen ip-sweep snmp-server enable traps screen syn-fin snmp-server enable traps screen fin-no-ack snmp-server enable traps screen no-flag snmp-server enable traps screen spoofing snmp-server enable traps screen reserved snmp-server enable traps screen quench snmp-server enable traps screen echo-request snmp-server enable traps screen time-exceeded snmp-server enable traps screen unreachable snmp-server enable traps screen tcp-all-flags snmp-server enable traps entity snmp-server enable traps entity config-change snmp-server enable traps entity-sensor snmp-server enable traps entity-sensor threshold snmp-server enable traps envmon snmp-server enable traps envmon fan snmp-server enable traps envmon shutdown snmp-server enable traps envmon temperature snmp-server enable traps flash snmp-server enable traps flash insertion snmp-server enable traps flash removal snmp-server enable traps snmp snmp-server enable traps snmp authentication snmp-server enable traps snmp coldstart snmp-server enable traps snmp linkdown snmp-server enable traps snmp linkup snmp-server enable traps syslog security zone-pair gre self rule 1 action permit match protocol gre enable exit rule 2 action permit match protocol icmp enable exit exit security zone-pair trusted self rule 1 action permit match source-address MGMT enable exit exit security zone-pair trusted trusted rule 1 action permit match source-address MGMT enable exit exit security zone-pair trusted user rule 1 action permit enable exit exit security zone-pair trusted gre rule 1 action permit enable exit exit security zone-pair user self rule 1 action permit match protocol udp match source-port dhcp_client match destination-port dhcp_server enable exit exit security zone-pair user trusted rule 1 action permit match protocol udp match source-port dhcp_client match destination-port dhcp_server enable exit exit security zone-pair user untrusted rule 1 action permit enable exit exit security zone-pair untrusted self rule 1 action permit match source-address MGMT enable exit exit security passwords history 0 nat source ruleset nat_ALL to interface bridge 1 rule 1 match source-address nat_users match not destination-address MGMT action source-nat interface enable exit exit exit ip dhcp-relay ip route 0.0.0.0/0 10.10.2.1 ip route 192.168.109.0/24 172.16.109.5 wireless-controller nas-ip-address 10.10.2.159 data-tunnel configuration radius aaa das-profile COA aaa radius-profile PCRF enable exit ip telnet server ip ssh server ntp enable ntp server 10.10.2.254 exit |
DHCP-server
Общая конфигурация:
| Блок кода | ||||||
|---|---|---|---|---|---|---|
| ||||||
default-lease-time 300;
max-lease-time 310;
log-facility local7;
#listening subnet
subnet 10.10.2.0 netmask 255.255.255.0 {}
#Описание классов оборудования, которым будем разрешать получения адреса управления
class "ELTEX-DEVICES" {
match if (
(substring (option vendor-class-identifier, 0, 14)="ELTEX_WEP-12AC") or
(substring (option vendor-class-identifier, 0, 14)="ELTEX_WOP-12AC") or
(substring (option vendor-class-identifier, 0, 14)="ELTX_WEP-12AC") or
(substring (option vendor-class-identifier, 0, 14)="ELTX_WOP-12AC") or
(substring (option vendor-class-identifier, 0, 13)="ELTEX_WEP-2AC") or
(substring (option vendor-class-identifier, 0, 12)="ELTEX_WOP-2L") or
(substring (option vendor-class-identifier, 0, 12)="ELTEX_WEP-2L") or
(substring (option vendor-class-identifier, 0, 12)="ELTEX_WEP-1L")
);
} |
Конфигурация по варианту:
| Без форматирования |
|---|
#------------------------Stend 1------------------------------------------------
#Подсеть первичных адресов ТД в vlan 2009
subnet 192.168.109.0 netmask 255.255.255.0 {
pool {
option routers 192.168.109.1;
range 192.168.109.10 192.168.109.254;
option vendor-encapsulated-options 0B:0C:31:37:32:2E:31:36:2E:31:30:39:2E:31:0C:0C:31:37:32:2E:31:36:2E:31:30:39:2E:32;
allow members of "ELTEX-DEVICES";
}
}
#Подсеть управления ТД в ESR09
subnet 172.31.109.0 netmask 255.255.255.0 {
pool {
option routers 172.31.109.1;
range 172.31.109.10 172.31.109.254;
option vendor-encapsulated-options 0A:0B:31:30:2E:31:30:2E:32:2E:32:35:34;
allow members of "ELTEX-DEVICES";
option domain-name-servers 172.31.109.1;
}
}
#Подсеть пользователей ТД SSID1 ESR-1 (in GRE)
subnet 100.64.9.0 netmask 255.255.255.0 {
pool {
option routers 100.64.9.1;
range 100.64.9.10 100.64.9.254;
option domain-name-servers 100.64.9.1;
}
}
#Подсеть пользователей ТД SSID2 (local switching)
subnet 100.64.109.0 netmask 255.255.255.0 {
pool {
option routers 100.64.109.1;
range 100.64.109.10 100.64.109.254;
option domain-name-servers 100.64.109.1;
}
}
|
...
Пример вывода информации о состоянии SoftGRE туннелей на ESR
Просмотр информации о существующих SoftGRE туннелях:
| Раскрыть |
|---|
esr1000# show tunnels status
Tunnel Admin Link MTU Local IP Remote IP Last change
state state
---------------- ----- ----- ------ ---------------- ---------------- -------------------------
softgre 1 Up Up 1462 10.0.0.1 192.168.100.15 4 days, 21 minutes and 32
seconds
softgre 1.1 Up Up 1458 -- -- 4 days, 21 minutes and 32
seconds
softgre 2 Up Up 1462 10.0.0.2 192.168.100.15 4 days, 21 minutes and 32
seconds
softgre 2.10 Up Up 1458 -- -- 4 days, 21 minutes and 32
seconds
softgre 2.11 Up Up 1458 -- -- 4 days, 21 minutes and 32
seconds
softgre 3 Up Up 1462 10.0.0.1 192.168.100.12 4 days, 21 minutes and 14
seconds
softgre 3.1 Up Up 1458 -- -- 4 days, 21 minutes and 14
seconds
softgre 4 Up Up 1462 10.0.0.2 192.168.100.12 4 days, 21 minutes and 14
seconds
softgre 4.10 Up Up 1458 -- -- 4 days, 21 minutes and 14
seconds
softgre 4.11 Up Up 1458 -- -- 4 days, 21 minutes and 14
seconds |
Просмотр информации об интерфейсах типа "Bridge" и включенных в них SoftGRE туннелях:
| Раскрыть |
|---|
esr1000# show interfaces bridge Bridges Interfaces ---------- -------------------------------------------------------------- bridge 3 softgre 1.1, softgre 3.1 bridge 10 softgre 2.10, softgre 2.11, softgre 4.10, softgre 4.11 |
...