问

MER5200下部分无线终端无法上网

ARP攻击防御

2020-11-03提问

0关注
1收藏，1714浏览

zhiliao_tFHOH

zhiliao_tFHOH 零段

粉丝：0人关注：0人

问题描述：

网络运行一段时间后，会有部分无线终端无法上网，故障现象是可以拿到正确的IP地址，但是ping网关或者DNS都不通，通过重启路由器或者汇聚交换机都可以解决，但是2-3天后故障会反复出现。在网关的ARP攻击防御页面，可以看到无法上网的终端MAC同时在几个vlan接口下有IP地址，手动删除ARP列表无效。

求大神指点

组网及组网描述：

网关配置如下：

#
version 7.1.064, Release 0809P27
#
memory-threshold usage 80
#
sysname MER5200
#
clock timezone Beijing add 08:00:00
clock protocol ntp
#
telnet server enable
telnet server port 8123
telnet server ipv6 port 8123
#
qos carl 1 source-ip-address object-group connlimitObjGrp_63000 per-address
qos carl 2 destination-ip-address object-group connlimitObjGrp_63000 per-address
qos carl 3 source-ip-address object-group connlimitObjGrp_49348 per-address
qos carl 4 destination-ip-address object-group connlimitObjGrp_49348 per-address
#
security-zone intra-zone default permit
#
track 1022 nqa entry ge0/1 1 reaction 1
#
track 1023 nqa entry ge0/0 1 reaction 1
#
dialer-group 2 rule ip permit
#
ip load-sharing mode per-flow src-ip global
#
bandwidth-based-sharing
#
dhcp enable
dhcp server always-broadcast
dhcp server mini-ap ip-pool vlan-interface20
#
dns proxy enable
#
lldp global enable
#
password-recovery enable
#
vlan 1
#
vlan 10
#
vlan 20
#
vlan 100
#
object-group ip address connlimitObjGrp_49348
0 network range 172.168.1.1 172.168.3.254
#
object-group ip address connlimitObjGrp_63000
0 network range 192.168.64.1 192.168.67.253
#
object-group ip address dstgroup174150
1004 network host address 0.0.0.0
#
object-group ip address dstgroup174160
1004 network host address 0.0.0.0
#
object-group ip address dstgroup174161
1004 network host address 0.0.0.0
#
object-group ip address srcgroup174150
1004 network range 192.168.64.1 192.168.67.253
#
object-group ip address srcgroup174160
1004 network range 172.168.1.1 172.168.3.254
#
object-group ip address srcgroup174161
1004 network range 172.168.0.1 172.168.0.253
#
dhcp server ip-pool vlan-interface10
gateway-list 192.168.67.254
network 192.168.64.0 mask 255.255.252.0
address range 192.168.64.1 192.168.67.240
dns-list 61.139.2.69 218.6.200.139
expired day 0 hour 2
forbidden-ip-range 192.168.67.254 192.168.67.254
#
dhcp server ip-pool vlan-interface20
gateway-list 172.168.0.254
network 172.168.0.0 mask 255.255.252.0
address range 172.168.1.1 172.168.3.254
dns-list 61.139.2.69 218.6.200.139
expired day 0 hour 2
forbidden-ip-range 172.168.0.250 172.168.0.250
forbidden-ip-range 172.168.1.250 172.168.1.250
option 43 hex 8007000001aca800fe
option 60 ascii H3C
#
policy-based-route pbr17415 permit node 0
if-match acl name acl174150
apply output-interface GigabitEthernet0/0
#
policy-based-route pbr17416 permit node 0
if-match acl name acl174160
apply output-interface GigabitEthernet0/1
#
policy-based-route pbr17416 permit node 1
if-match acl name acl174161
apply output-interface GigabitEthernet0/1
#
nqa entry ge0/0 1
type icmp-echo
destination ip 61.139.2.69
frequency 3000
out interface GigabitEthernet0/0
probe timeout 1000
reaction 1 checked-element probe-fail threshold-type consecutive 5 action-type trigger-only
#
nqa entry ge0/1 1
type icmp-echo
destination ip 61.139.2.69
frequency 5000
out interface GigabitEthernet0/1
probe timeout 1000
reaction 1 checked-element probe-fail threshold-type consecutive 5 action-type trigger-only
#
nqa schedule ge0/0 1 start-time now lifetime forever
nqa schedule ge0/1 1 start-time now lifetime forever
#
controller Cellular0/0
#
interface Dialer0
mtu 1492
#
interface Dialer1
mtu 1492
#
interface NULL0
#
interface Vlan-interface1
description LAN-interface
ip address 192.168.100.1 255.255.255.0
tcp mss 1280
packet-filter name WebHttpHttps17413 inbound
packet-filter name WebPing17413 inbound
packet-filter name WebTelnet17413 inbound
undo dhcp select server
ip subscriber l2-connected enable
ip subscriber initiator dhcp enable
ip subscriber initiator unclassified-ip enable
ip subscriber dhcp domain ipoeenabledomain
ip subscriber unclassified-ip domain ipoeenabledomain
#
interface Vlan-interface10
description LAN-interface
ip address 192.168.67.254 255.255.252.0
tcp mss 1280
packet-filter name WebHttpHttps17415 inbound
ip policy-based-route pbr17415
ip subscriber l2-connected enable
ip subscriber initiator dhcp enable
ip subscriber initiator unclassified-ip enable
ip subscriber dhcp domain ipoeenabledomain
ip subscriber unclassified-ip domain ipoeenabledomain
#
interface Vlan-interface20
description LAN-interface
ip address 172.168.0.254 255.255.252.0
tcp mss 1280
packet-filter name WebHttpHttps17416 inbound
ip policy-based-route pbr17416
ip subscriber l2-connected enable
ip subscriber initiator dhcp enable
ip subscriber initiator unclassified-ip enable
ip subscriber dhcp domain ipoeenabledomain
ip subscriber unclassified-ip domain ipoeenabledomain
#
interface Vlan-interface100
description LAN-interface
ip address 10.10.10.1 255.255.255.128
undo dhcp select server
ip subscriber l2-connected enable
ip subscriber initiator dhcp enable
ip subscriber initiator unclassified-ip enable
ip subscriber dhcp domain ipoeenabledomain
ip subscriber unclassified-ip domain ipoeenabledomain
#
interface GigabitEthernet0/0
port link-mode route
description Double_Line1
bandwidth 95000
combo enable copper
ip address 171.221.240.203 255.255.255.0
dns server 61.139.2.69
dns server 218.6.200.139
tcp mss 1280
ip last-hop hold
packet-filter name WebPing3 inbound
qos car inbound carl 2 cir 10240 cbs 640000 ebs 0 green pass red discard yellow pass
qos car outbound carl 1 cir 2048 cbs 128000 ebs 0 green pass red discard yellow pass
nat outbound
nat server protocol tcp global current-interface 8124 inside 10.10.10.2 23 description S5120-telnet
#
interface GigabitEthernet0/1
port link-mode route
description Double_Line2
bandwidth 750000
ip address 192.168.1.3 255.255.255.0
dns server 61.139.2.69
dns server 218.6.200.139
tcp mss 1280
ip last-hop hold
packet-filter name WebPing4 inbound
packet-filter name WebTelnet4 inbound
packet-filter name WebHttpHttps4 inbound
qos car inbound carl 4 cir 20480 cbs 1280000 ebs 0 green pass red discard yellow pass
qos car outbound carl 3 cir 2048 cbs 128000 ebs 0 green pass red discard yellow pass
nat outbound
#
interface GigabitEthernet0/2
port link-mode bridge
port link-type trunk
undo port trunk permit vlan 1
port trunk permit vlan 100
port trunk pvid vlan 100
#
interface GigabitEthernet0/3
port link-mode bridge
port link-type trunk
undo port trunk permit vlan 1
port trunk permit vlan 100
port trunk pvid vlan 100
#
interface GigabitEthernet0/4
port link-mode bridge
port link-type trunk
undo port trunk permit vlan 1
port trunk permit vlan 100
port trunk pvid vlan 100
#
interface GigabitEthernet0/5
port link-mode bridge
port link-type trunk
undo port trunk permit vlan 1
port trunk permit vlan 10 20 30 100
#
object-policy ip Any-Any
rule 65533 inspect 8048_url_profile_global disable
rule 65534 pass
#
security-zone name Local
#
security-zone name Trust
#
security-zone name DMZ
#
security-zone name Untrust
#
security-zone name Management
#
zone-pair security source Any destination Any
object-policy apply ip Any-Any
#
zone-pair security source Local destination Trust
packet-filter name SWXWSGL
#
zone-pair security source Local destination Untrust
packet-filter name SWXWSGL
#
zone-pair security source Trust destination Local
packet-filter name SWXWSGL
#
zone-pair security source Untrust destination Local
packet-filter name SWXWSGL
#
scheduler logfile size 16
#
line class console
user-role network-admin
#
line class tty
user-role network-operator
#
line class vty
user-role network-operator
#
line con 0
user-role network-admin
#
line vty 0 63
authentication-mode scheme
user-role network-operator
#
ip route-static 0.0.0.0 0 GigabitEthernet0/0 171.221.240.1 track 1023
ip route-static 0.0.0.0 0 GigabitEthernet0/1 192.168.1.1 track 1022
ip route-static 61.139.2.69 32 GigabitEthernet0/0 171.221.240.1 description NqaTrack
ip route-static 61.139.2.69 32 GigabitEthernet0/1 192.168.1.1 preference 61 description NqaTrack
#
time-range tr174150 00:00 to 24:00 daily
time-range tr174160 00:00 to 24:00 daily
time-range tr174161 00:00 to 24:00 daily
#
ntp-service enable
ntp-service unicast-server ***.***
ntp-service unicast-server ***.***
ntp-service unicast-server ***.***
ntp-service unicast-server ***.***
ntp-service unicast-server ***.***
ntp-service unicast-server ***.***
ntp-service unicast-server ***.***
#
acl basic name connlimitAcl_49348_ip
rule 65534 permit source object-group connlimitObjGrp_49348
#
acl basic name connlimitAcl_63000_ip
rule 65534 permit source object-group connlimitObjGrp_63000
#
acl advanced name SWXWSGL
rule 1 permit ip
#
acl advanced name WebHttpHttps4
rule 65533 deny tcp destination-port eq 9088
rule 65534 deny tcp destination-port eq 443
#
acl advanced name WebHttpHttps17413
rule 65533 deny tcp destination-port eq www
rule 65534 deny tcp destination-port eq 443
#
acl advanced name WebHttpHttps17415
rule 65533 permit tcp destination-port eq 9088
rule 65534 permit tcp destination-port eq 443
#
acl advanced name WebHttpHttps17416
rule 65533 permit tcp destination-port eq 9088
rule 65534 permit tcp destination-port eq 443
#
acl advanced name WebPing3
rule 1 deny icmp icmp-type echo
#
acl advanced name WebPing4
rule 1 deny icmp icmp-type echo
#
acl advanced name WebPing5
rule 1 deny icmp icmp-type echo
#
acl advanced name WebPing6
rule 1 deny icmp icmp-type echo
#
acl advanced name WebPing17413
rule 1 deny icmp icmp-type echo
#
acl advanced name WebTelnet4
rule 65533 deny tcp destination-port eq 8123
#
acl advanced name WebTelnet17413
rule 65533 deny tcp destination-port eq 8123
#
acl advanced name acl174150
rule 1 permit ip source object-group srcgroup174150 destination object-group dstgroup174150 time-range tr174150
rule 1 comment WIFI
#
acl advanced name acl174160
rule 1 permit ip source object-group srcgroup174160 destination object-group dstgroup174160 time-range tr174160
rule 1 comment --
#
acl advanced name acl174161
rule 1 permit ip source object-group srcgroup174161 destination object-group dstgroup174161 time-range tr174161
rule 1 comment --
#
password-control enable
undo password-control aging enable
undo password-control history enable
password-control length 6
password-control login-attempt 3 exceed lock-time 10
password-control update-interval 0
password-control login idle-time 0
#
domain ipoeenabledomain
authentication ipoe none
authorization ipoe none
accounting ipoe none
#
domain system
#
domain default enable system
#
role name level-0
description Predefined level-0 role
#
role name level-1
description Predefined level-1 role
#
role name level-2
description Predefined level-2 role
#
role name level-3
description Predefined level-3 role
#
role name level-4
description Predefined level-4 role
#
role name level-5
description Predefined level-5 role
#
role name level-6
description Predefined level-6 role
#
role name level-7
description Predefined level-7 role
#
role name level-8
description Predefined level-8 role
#
role name level-9
description Predefined level-9 role
#
role name level-10
description Predefined level-10 role
#
role name level-11
description Predefined level-11 role
#
role name level-12
description Predefined level-12 role
#
role name level-13
description Predefined level-13 role
#
role name level-14
description Predefined level-14 role
#
user-group system
#
local-user admin class manage
service-type ssh telnet terminal http https
authorization-attribute user-role network-admin
#
session statistics enable
#
connection-limit apply global policy 32
#
connection-limit policy 32
limit 1 acl name connlimitAcl_63000_ip per-source amount 300 299
limit 2 acl name connlimitAcl_49348_ip per-source amount 300 299
#
portal free-rule 0 source mac 9017-c8a7-0624
portal free-rule 0 description test
#
ip http port 9088
ip http enable
ip https enable
#
url-filter category custom severity 65535
#
uapp-control
policy name AuditLog audit
source-zone trust
destination-zone untrust
rule 1 any behavior any bhcontent any keyword equal any action permit audit-logging
#
dac storage service audit limit hold-time 1
dac storage service traffic limit hold-time 1
#
cloud-management server domain oasis.h3c.com
#
return

S5120V2配置如下：

version 7.1.070, Release 6308P01
#
sysname CoreSW
#
clock timezone utc add 08:00:00
clock protocol none
#
telnet server enable
#
irf mac-address persistent timer
irf auto-update enable
undo irf link-delay
irf member 1 priority 1
#
dhcp snooping enable
#
dns server 61.139.2.69
#
mirroring-group 1 local

#
lldp global enable
#
password-recovery enable
#
vlan 1
#
vlan 10
#
vlan 20
#
vlan 100
#
interface NULL0
#
interface Vlan-interface1
ip address dhcp-alloc
dhcp client identifier ascii a4fa7664ffc9-VLAN0001
#
interface Vlan-interface10
dhcp server apply ip-pool vlan10
dhcp client-detect
#
interface Vlan-interface100
ip address 10.10.10.2 255.255.255.128
#
interface GigabitEthernet1/0/1
port link-type trunk
undo port trunk permit vlan 1
port trunk permit vlan 10 20 100
mirroring-group 1 mirroring-port both
#
interface GigabitEthernet1/0/2
port link-type trunk
undo port trunk permit vlan 1
port trunk permit vlan 10 20 100
mirroring-group 1 mirroring-port inbound
#
interface GigabitEthernet1/0/3
port link-type trunk
undo port trunk permit vlan 1
port trunk permit vlan 10 20 100
mirroring-group 1 mirroring-port inbound
#
interface GigabitEthernet1/0/4
port link-type trunk
undo port trunk permit vlan 1
port trunk permit vlan 10 20 100
mirroring-group 1 mirroring-port inbound
#
interface GigabitEthernet1/0/5
port link-type trunk
undo port trunk permit vlan 1
port trunk permit vlan 10 20 100
mirroring-group 1 mirroring-port inbound
#
interface GigabitEthernet1/0/6
port link-type trunk
undo port trunk permit vlan 1
port trunk permit vlan 10 20 100
#
interface GigabitEthernet1/0/7
port link-type trunk
undo port trunk permit vlan 1
port trunk permit vlan 10 20 100
#
interface GigabitEthernet1/0/8
port link-type trunk
undo port trunk permit vlan 1
port trunk permit vlan 10 20 100
#
interface GigabitEthernet1/0/9
port access vlan 20
loopback-detection enable vlan 1 to 4094
#
interface GigabitEthernet1/0/10
port access vlan 20
loopback-detection enable vlan 1 to 4094
#
interface GigabitEthernet1/0/11
port access vlan 20
loopback-detection enable vlan 1 to 4094
#
interface GigabitEthernet1/0/12
port access vlan 20
loopback-detection enable vlan 1 to 4094
#
interface GigabitEthernet1/0/13
port access vlan 20
loopback-detection enable vlan 1 to 4094
#
interface GigabitEthernet1/0/14
port access vlan 20
loopback-detection enable vlan 1 to 4094
#
interface GigabitEthernet1/0/15
port access vlan 20
loopback-detection enable vlan 1 to 4094
#
interface GigabitEthernet1/0/16
port access vlan 20
loopback-detection enable vlan 1 to 4094
#
interface GigabitEthernet1/0/17
port access vlan 20
loopback-detection enable vlan 1 to 4094
#
interface GigabitEthernet1/0/18
port access vlan 20
loopback-detection enable vlan 1 to 4094
#
interface GigabitEthernet1/0/19
port access vlan 20
loopback-detection enable vlan 1 to 4094
#
interface GigabitEthernet1/0/20
port access vlan 20
loopback-detection enable vlan 1 to 4094
#
interface GigabitEthernet1/0/21
loopback-detection enable vlan 1 to 4094
#
interface GigabitEthernet1/0/22
loopback-detection enable vlan 1 to 4094
#
interface GigabitEthernet1/0/23
port access vlan 10
mirroring-group 1 monitor-port
loopback-detection enable vlan 1 to 4094
#
interface GigabitEthernet1/0/24
port link-type trunk
undo port trunk permit vlan 1
port trunk permit vlan 10 20 100
dhcp snooping trust
#
interface GigabitEthernet1/0/25
#
interface GigabitEthernet1/0/26
#
interface GigabitEthernet1/0/27
#
interface GigabitEthernet1/0/28
#
scheduler logfile size 16
#
line class aux
user-role network-admin
#
line class vty
user-role network-operator
#
line aux 0
authentication-mode scheme
user-role network-admin
#
line vty 0
authentication-mode scheme
user-role level-15
user-role network-admin
user-role network-operator
protocol inbound telnet
#
line vty 1 63
user-role network-operator
#
ip route-static 0.0.0.0 0 10.10.10.1
#
ntp-service enable
ntp-service unicast-server ***.***
#
radius scheme system
user-name-format without-domain
#
domain system
#

domain default enable system