核心交换机划了两个vlan,一个192。168.1.X网段,没有开启dhcp,链接的公司电脑,可以正常访问所有外网,另一个vlan划得192.168.2.X网段,开启了dhcp,链接的是公司无线网络,现在通过无线网络终端只能打开微信应用,别的应用和网页都无法打开,请问我应该怎么办?
路由配置
[H3C]dis cur
#
version 5.20, Release 2514P14
#
sysname H3C
#
domain default enable system
#
dns proxy enable
#
telnet server enable
#
dar p2p signature-file flash:/p2p_default.mtd
#
ndp enable
#
ntdp enable
#
cluster enable
#
port-security enable
#
password-recovery enable
#
vlan 1
#
vlan 50
#
vlan 100
#
domain system
access-limit disable
state active
idle-cut disable
self-service-url disable
#
dhcp server ip-pool vlan1 extended
network ip range 192.168.1.2 192.168.1.254
network mask 255.255.255.0
gateway-list 192.168.1.1
dns-list 192.168.1.1
#
user-group system
group-attribute allow-guest
#
local-user admin
password cipher $c$3$40gC1cxf/wIJNa1ufFPJsjKAof+QP5aV
authorization-attribute level 3
service-type telnet
service-type web
#
cwmp
undo cwmp enable
#
interface Aux0
async mode flow
link-protocol ppp
#
interface Cellular0/0
async mode protocol
link-protocol ppp
tcp mss 1024
#
interface Dialer10
nat outbound
link-protocol ppp
ppp chap user 037107170522
ppp chap password cipher $c$3$AK8LiiItCkiT3z9sUb2xHMvnk12Ek1oQPg==
ppp pap local-user 037107170522 password cipher $c$3$HrkJOin7tLVNqHdTluNUBO02nXsuZupmVg==
ppp ipcp dns admit-any
ppp ipcp dns request
mtu 1492
ip address ppp-negotiate
tcp mss 1024
dialer user username
dialer-group 10
dialer bundle 10
#
interface Dialer11
nat outbound
link-protocol ppp
ppp chap user 037107527957
ppp chap password cipher $c$3$PIdTYjeaZ6UGo5PXHRPNyWeEF++yeQhgmg==
ppp pap local-user 037107527957 password cipher $c$3$XNKfOgofIS2WHJX0HqkgbGjLliheVnyMLA==
ppp ipcp dns admit-any
ppp ipcp dns request
mtu 1492
ip address ppp-negotiate
tcp mss 1024
dialer user username
dialer-group 11
dialer bundle 11
#
interface NULL0
#
interface Vlan-interface1
tcp mss 1024
dhcp server apply ip-pool vlan1
#
interface Vlan-interface50
ip address 192.168.50.1 255.255.255.0
#
interface Vlan-interface100
ip address 192.168.100.2 255.255.255.0
#
interface GigabitEthernet0/0
port link-mode route
nat outbound
pppoe-client dial-bundle-number 11
#
interface GigabitEthernet0/1
port link-mode route
nat outbound
pppoe-client dial-bundle-number 10
#
interface GigabitEthernet0/6
port link-mode route
#
interface GigabitEthernet0/7
port link-mode route
#
interface GigabitEthernet0/8
port link-mode route
#
interface GigabitEthernet0/9
port link-mode route
#
interface GigabitEthernet0/2
port link-mode bridge
port access vlan 100
#
interface GigabitEthernet0/3
port link-mode bridge
port access vlan 50
#
interface GigabitEthernet0/4
port link-mode bridge
#
interface GigabitEthernet0/5
port link-mode bridge
#
ip route-static 0.0.0.0 0.0.0.0 Dialer10
ip route-static 0.0.0.0 0.0.0.0 Dialer11 preference 70
ip route-static 192.168.0.0 255.255.0.0 192.168.100.1
ip route-static 192.168.1.0 255.255.255.0 192.168.100.1
ip route-static 192.168.2.0 255.255.255.0 192.168.100.1
#
dhcp enable
#
dialer-rule 10 ip permit
dialer-rule 11 ip permit
#
nms primary monitor-interface Dialer11
#
load xml-configuration
#
load tr069-configuration
#
user-interface tty 12
user-interface aux 0
user-interface vty 0 4
authentication-mode scheme
#
return
[H3C]
[H3C]
防火墙配置
[H3C]dis cur
#
version 7.1.064, Ess 9504P07
#
sysname H3C
#
context Admin id 1
#
ip vpn-instance management
route-distinguisher 1000000000:1
vpn-target 1000000000:1 import-extcommunity
vpn-target 1000000000:1 export-extcommunity
#
irf mac-address persistent timer
irf auto-update enable
undo irf link-delay
irf member 1 priority 1
#
password-recovery enable
#
vlan 1
#
interface NULL0
#
interface GigabitEthernet1/0/0
port link-mode route
combo enable copper
ip binding vpn-instance management
ip address 192.168.0.1 255.255.255.0
#
interface GigabitEthernet1/0/1
port link-mode route
combo enable copper
#
interface GigabitEthernet1/0/2
port link-mode route
ip binding vpn-instance management
ip address 192.168.1.1 255.255.255.0
#
interface GigabitEthernet1/0/3
port link-mode route
ip address 192.168.100.1 255.255.255.0
#
interface GigabitEthernet1/0/4
port link-mode route
ip address 192.168.200.2 255.255.255.0
#
interface GigabitEthernet1/0/5
port link-mode route
#
interface GigabitEthernet1/0/6
port link-mode route
#
interface GigabitEthernet1/0/7
port link-mode route
#
interface GigabitEthernet1/0/8
port link-mode route
#
interface GigabitEthernet1/0/9
port link-mode route
#
interface GigabitEthernet1/0/10
port link-mode route
#
interface GigabitEthernet1/0/11
port link-mode route
#
object-policy ip Any-Any
rule 0 pass
#
object-policy ip Any-Local
rule 0 pass
#
object-policy ip Any-Trust
rule 0 pass
#
object-policy ip Any-Untrust
rule 0 pass
#
object-policy ip Local-Any
rule 0 pass
#
object-policy ip Local-Local
rule 0 pass
#
object-policy ip Local-Trust
rule 0 pass
#
object-policy ip Local-Untrust
rule 0 pass
#
object-policy ip Trust-Any
rule 0 pass
#
object-policy ip Trust-Local
rule 0 pass
#
object-policy ip Trust-Trust
rule 0 pass
#
object-policy ip Trust-Untrust
rule 0 pass
#
object-policy ip Untrust-Any
rule 0 pass
#
object-policy ip Untrust-Local
rule 0 pass
#
object-policy ip Untrust-Trust
rule 0 pass
#
object-policy ip Untrust-Untrust
rule 0 pass
#
security-zone name Local
#
security-zone name Trust
import interface GigabitEthernet1/0/3
import interface GigabitEthernet1/0/4
#
security-zone name DMZ
#
security-zone name Untrust
#
security-zone name Management
import interface GigabitEthernet1/0/0
import interface GigabitEthernet1/0/2
#
zone-pair security source Any destination Any
object-policy apply ip Any-Any
#
zone-pair security source Any destination Local
object-policy apply ip Any-Local
#
zone-pair security source Any destination Trust
object-policy apply ip Any-Trust
#
zone-pair security source Any destination Untrust
object-policy apply ip Any-Untrust
#
zone-pair security source Local destination Any
object-policy apply ip Local-Any
#
zone-pair security source Local destination Local
object-policy apply ip Local-Local
#
zone-pair security source Local destination Trust
object-policy apply ip Local-Trust
#
zone-pair security source Local destination Untrust
object-policy apply ip Local-Untrust
#
zone-pair security source Trust destination Any
object-policy apply ip Trust-Any
#
zone-pair security source Trust destination Local
object-policy apply ip Trust-Local
#
zone-pair security source Trust destination Trust
object-policy apply ip Trust-Trust
#
zone-pair security source Trust destination Untrust
object-policy apply ip Trust-Untrust
#
zone-pair security source Untrust destination Any
object-policy apply ip Untrust-Any
#
zone-pair security source Untrust destination Local
object-policy apply ip Untrust-Local
#
zone-pair security source Untrust destination Trust
object-policy apply ip Untrust-Trust
#
zone-pair security source Untrust destination Untrust
object-policy apply ip Untrust-Untrust
#
scheduler logfile size 16
#
line class aux
user-role network-operator
#
line class console
user-role network-admin
#
line class vty
user-role network-operator
#
line aux 1
user-role network-operator
#
line con 1
authentication-mode scheme
user-role network-admin
#
line vty 0 63
authentication-mode scheme
user-role network-admin
#
ip route-static 0.0.0.0 0 192.168.100.2
ip route-static 192.168.1.0 24 192.168.200.1
ip route-static 192.168.2.0 24 192.168.200.1
#
ssh server enable
#
domain system
#
aaa session-limit ftp 16
aaa session-limit telnet 16
aaa session-limit ssh 16
domain default enable system
#
role name level-0
description Predefined level-0 role
#
role name level-1
description Predefined level-1 role
#
role name level-2
description Predefined level-2 role
#
role name level-3
description Predefined level-3 role
#
role name level-4
description Predefined level-4 role
#
role name level-5
description Predefined level-5 role
#
role name level-6
description Predefined level-6 role
#
role name level-7
description Predefined level-7 role
#
role name level-8
description Predefined level-8 role
#
role name level-9
description Predefined level-9 role
#
role name level-10
description Predefined level-10 role
#
role name level-11
description Predefined level-11 role
#
role name level-12
description Predefined level-12 role
#
role name level-13
description Predefined level-13 role
#
role name level-14
description Predefined level-14 role
#
user-group system
#
local-user admin class manage
password hash $h$6$yo1Uh+7VWS7gmbpE$5r7CU6V9EPMhISW5rpDupqMmpOPO9yz/OkB9agqUXQREYE4yWTffuUL2HeK/q/IHVMmNv9tp/cNpkUAQlqWq8A==
service-type ssh telnet terminal https
authorization-attribute user-role level-3
authorization-attribute user-role level-15
authorization-attribute user-role network-admin
authorization-attribute user-role network-operator
#
ip https enable
#
ips policy default
#
anti-virus policy default
#
return
[H3C]
[H3C]
核心交换机配置
#
version 5.20.99, Release 2220P10
#
sysname H3C
#
domain default enable system
#
ipv6
#
telnet server enable
#
password-recovery enable
#
vlan 1
#
vlan 10
description 办公接入
#
vlan 20
description 无线
#
vlan 30
#
vlan 100
description 接路由
#
domain system
access-limit disable
state active
idle-cut disable
self-service-url disable
#
dhcp server ip-pool vlan20
network 192.168.2.0 mask 255.255.255.0
gateway-list 192.168.2.254
dns-list 192.168.2.254
expired unlimited
#
user-group system
group-attribute allow-guest
#
local-user admin
password cipher $c$3$oBBBrbM1FDXtTR0dTufy+Bb8bNkswd4S
authorization-attribute level 3
service-type ssh telnet terminal
service-type web
#
stp bpdu-protection
stp enable
#
interface NULL0
#
interface Vlan-interface1
ip address 192.168.0.233 255.255.255.0
undo dhcp select server global-pool
#
interface Vlan-interface10
ipv6 address auto link-local
ip address 192.168.1.254 255.255.255.0
undo dhcp select server global-pool
#
interface Vlan-interface20
ipv6 address auto link-local
ip address 192.168.2.254 255.255.255.0
#
interface Vlan-interface100
ipv6 address auto link-local
ip address 192.168.200.1 255.255.255.0
undo dhcp select server global-pool
#
interface GigabitEthernet1/0/1
port access vlan 10
#
interface GigabitEthernet1/0/2
port access vlan 10
#
interface GigabitEthernet1/0/3
port access vlan 10
#
interface GigabitEthernet1/0/4
port access vlan 10
#
interface GigabitEthernet1/0/5
port access vlan 10
#
interface GigabitEthernet1/0/6
port access vlan 10
#
interface GigabitEthernet1/0/7
port access vlan 10
#
interface GigabitEthernet1/0/8
port access vlan 10
#
interface GigabitEthernet1/0/9
port access vlan 20
dhcp-snooping trust
dhcp-snooping information enable
#
interface GigabitEthernet1/0/10
port access vlan 20
#
interface GigabitEthernet1/0/11
port access vlan 20
#
interface GigabitEthernet1/0/12
port access vlan 20
#
interface GigabitEthernet1/0/13
#
interface GigabitEthernet1/0/14
#
interface GigabitEthernet1/0/15
#
interface GigabitEthernet1/0/16
#
interface GigabitEthernet1/0/17
#
interface GigabitEthernet1/0/18
#
interface GigabitEthernet1/0/19
#
interface GigabitEthernet1/0/20
#
interface GigabitEthernet1/0/21
#
interface GigabitEthernet1/0/22
#
interface GigabitEthernet1/0/23
#
interface GigabitEthernet1/0/24
port access vlan 100
#
interface GigabitEthernet1/0/25
shutdown
#
interface GigabitEthernet1/0/26
shutdown
#
interface GigabitEthernet1/0/27
shutdown
#
interface GigabitEthernet1/0/28
shutdown
#
ip route-static 0.0.0.0 0.0.0.0 192.168.200.2
ip route-static 192.168.100.0 255.255.255.0 192.168.200.2
#
dhcp enable
#
load xml-configuration
#
user-interface aux 0
authentication-mode scheme
user-interface vty 0 15
authentication-mode scheme
#
return
(0)
最佳答案
亲~登录后才可以操作哦!
确定你的邮箱还未认证,请认证邮箱或绑定手机后进行当前操作
举报
×
侵犯我的权益
×
侵犯了我企业的权益
×
抄袭了我的内容
×
原文链接或出处
诽谤我
×
对根叔社区有害的内容
×
不规范转载
×
举报说明
暂无评论