问

MSR830-6EI VLAN无法互访

VLAN

2023-12-22提问

0关注
0收藏，393浏览

守丶护

守丶护零段

粉丝：0人关注：0人

问题描述：

路由器的2个LAN口配置了2个vlan 但是VLAN之间不能互访

组网及组网描述：

#
version 7.1.064, Release 6728P25
#
sysname H3C
#
clock timezone Beijing add 08:00:00
clock protocol ntp
#
wlan global-configuration
#
undo resource-monitor output syslog snmp-notification netconf-event
#
qos carl 1 source-ip-address object-group connlimitObjGrp_47106 per-address shared-bandwidth
qos carl 2 destination-ip-address object-group connlimitObjGrp_47106 per-address shared-bandwidth
#
security-zone intra-zone default permit
#
security-policy disable
#
ip pool l2tp1 192.168.10.10 192.168.10.15
#
dialer-group 89 rule ip permit
#
ip load-sharing mode per-flow src-ip global
#
dhcp enable
dhcp server always-broadcast
#
dns proxy enable
#
system-working-mode standard
password-recovery enable
#
vlan 1
#
vlan 10
#
object-group ip address 192.168.0.120
0 network host address 192.168.0.120
#
object-group ip address connlimitObjGrp_47106
0 network range 192.168.0.2 192.168.0.255
0 network exclude 192.168.0.130
0 network exclude 192.168.0.102
#
dhcp server ip-pool lan1
gateway-list 192.168.0.1
network 192.168.0.0 mask 255.255.255.0
address range 192.168.0.100 192.168.0.254
dns-list 192.168.0.1
forbidden-ip-range 192.168.0.1 192.168.0.1
#
dhcp server ip-pool vlan-interface10
gateway-list 192.168.100.1
network 192.168.100.0 mask 255.255.255.0
address range 192.168.100.100 192.168.100.254
dns-list 202.98.0.68 202.98.5.68
forbidden-ip-range 192.168.100.1 192.168.100.1
#
ddns policy WAN0(GE0)
url ***.***
username needle
password cipher $c$3$ZOEm9qJBY/7H4/DW05cvarNmFs2oPDVQiX6M
interval 0 0 1
#
nqa entry ge0/1 1
type icmp-echo
destination ip 8.8.8.8
frequency 10000
out interface GigabitEthernet0/1
probe timeout 1000
reaction 1 checked-element probe-fail threshold-type consecutive 5 action-type trigger-only
#
nqa schedule ge0/1 1 start-time now lifetime forever
#
apn-profile profile69
apn dynamic
#
interface Dialer0
#
interface Dialer2
#
interface Dialer3
#
interface Dialer4
#
interface Dialer5
#
interface Dialer6
#
interface Dialer7
#
interface Dialer8
#
interface Dialer1023
#
interface Virtual-Template1
ppp authentication-mode chap
remote address pool l2tp1
ppp account-statistics enable
ip address 192.168.10.1 255.255.255.0
#
interface NULL0
#
interface Vlan-interface1
description LAN-interface
ip address 192.168.0.1 255.255.255.0
tcp mss 1280
ip subscriber l2-connected enable
ip subscriber initiator dhcp enable
ip subscriber initiator unclassified-ip enable
ip subscriber dhcp domain ipoeenabledomain
ip subscriber unclassified-ip domain ipoeenabledomain
#
interface Vlan-interface10
description LAN-interface
ip address 192.168.100.1 255.255.255.0
tcp mss 1280
#
interface GigabitEthernet0/0
port link-mode route
description Single_Line1
ip address 192.168.1.200 255.255.255.0
dns server 114.114.114.114
dns server 202.98.0.68
tcp mss 1280
qos car inbound carl 2 cir 400000 cbs 25000000 ebs 0 green pass red discard yellow pass
qos car outbound carl 1 cir 400000 cbs 25000000 ebs 0 green pass red discard yellow pass
nat outbound
nat server protocol tcp global current-interface 1935 inside 192.168.0.253 1935 description RTMP
nat server protocol udp global current-interface 5000 5005 inside 192.168.0.102 5000 5005 description SRT2
nat server protocol udp global current-interface 9000 9005 inside 192.168.0.199 9000 9005 description SRT
attack-defense apply policy AtkInterface2
ddns apply policy WAN0(GE0) fqdn ***.***
#
interface GigabitEthernet0/1
port link-mode route
#
interface GigabitEthernet0/2
port link-mode bridge
port link-type trunk
port trunk permit vlan 1
#
interface GigabitEthernet0/3
port link-mode bridge
port link-type trunk
port trunk permit vlan 1
#
interface GigabitEthernet0/4
port link-mode bridge
port link-type trunk
undo port trunk permit vlan 1
port trunk permit vlan 10
port trunk pvid vlan 10
#
interface GigabitEthernet0/5
port link-mode bridge
port link-type trunk
undo port trunk permit vlan 1
port trunk permit vlan 10
port trunk pvid vlan 10
#
object-policy ip Any-Any
rule 65533 inspect 8048_url_profile_global disable
rule 65534 pass
#
security-zone name Local
#
security-zone name Trust
#
security-zone name DMZ
#
security-zone name Untrust
#
security-zone name Management
#
zone-pair security source Any destination Any
object-policy apply ip Any-Any
#
zone-pair security source Local destination Trust
packet-filter name SWXWSGL
#
zone-pair security source Local destination Untrust
packet-filter name SWXWSGL
#
zone-pair security source Trust destination Local
packet-filter name SWXWSGL
#
zone-pair security source Untrust destination Local
packet-filter name SWXWSGL
#
scheduler logfile size 16
#
line class console
user-role network-admin
#
line class tty
user-role network-operator
#
line class vty
user-role network-operator
#
line con 0
user-role network-admin
#
line vty 0 63
authentication-mode scheme
user-role network-operator
#
ip route-static 0.0.0.0 0 GigabitEthernet0/0 192.168.1.1
ip route-static 8.8.8.8 32 GigabitEthernet0/0 192.168.1.1
#
info-center loghost 127.0.0.1 port 3301
info-center source CFGLOG loghost level informational
#
performance-management
#
ntp-service enable
ntp-service unicast-server ***.***
ntp-service unicast-server ***.***
ntp-service unicast-server ***.***
ntp-service unicast-server ***.***
ntp-service unicast-server ***.***
ntp-service unicast-server ***.***
ntp-service unicast-server ***.***
#
acl basic name connlimitAcl_47106_ip
rule 65534 permit source object-group connlimitObjGrp_47106
#
acl advanced name SWXWSGL
rule 1 permit ip
#
acl advanced name connlimitAcl_47106_tcp
rule 65534 permit tcp source object-group connlimitObjGrp_47106
#
acl advanced name connlimitAcl_47106_udp
rule 65534 permit udp source object-group connlimitObjGrp_47106
#
acl mac 4999
rule 5 permit
#
password-control enable
undo password-control aging enable
undo password-control history enable
password-control length 6
password-control login-attempt 3 exceed lock-time 10
password-control update-interval 0
password-control login idle-time 0
#
domain ipoeenabledomain
authorization-attribute idle-cut 5 1
authentication ipoe none
authorization ipoe none
accounting ipoe none
#
domain system
#
domain default enable system
#
role name level-0
description Predefined level-0 role
#
role name level-1
description Predefined level-1 role
#
role name level-2
description Predefined level-2 role
#
role name level-3
description Predefined level-3 role
#
role name level-4
description Predefined level-4 role
#
role name level-5
description Predefined level-5 role
#
role name level-6
description Predefined level-6 role
#
role name level-7
description Predefined level-7 role
#
role name level-8
description Predefined level-8 role
#
role name level-9
description Predefined level-9 role
#
role name level-10
description Predefined level-10 role
#
role name level-11
description Predefined level-11 role
#
role name level-12
description Predefined level-12 role
#
role name level-13
description Predefined level-13 role
#
role name level-14
description Predefined level-14 role
#
user-group system
#
local-user admin class manage
service-type telnet http https
authorization-attribute user-role network-admin
#
local-user tmrm class network
password cipher $c$3$v6zu1KLMFWUNZWOUY2EODWPA7h7PO5UqtSx+6gg5Hg==
service-type ppp
authorization-attribute user-role network-operator
#
security-enhanced level 1
#
session statistics enable
#
connection-limit apply global policy 32
#
connection-limit policy 32
limit 1 acl name connlimitAcl_47106_tcp per-source amount 2000 1999
limit 2 acl name connlimitAcl_47106_udp per-source amount 2000 1999
limit 3 acl name connlimitAcl_47106_ip per-source amount 2000 1999
#
l2tp-group 1 mode lns
allow l2tp virtual-template 1
tunnel name TMRM
tunnel password cipher $c$3$Zhh/8kXs9i1WSqDSXk7RUPQiR0HCjbQwa01N
#
l2tp enable
#
ip http enable
ip https enable
web new-style
#
attack-defense policy AtkInterface2
scan detect level high action logging
syn-flood detect non-specific
syn-flood action logging drop
udp-flood detect non-specific
udp-flood action logging drop
icmp-flood detect non-specific
icmp-flood action logging drop
signature detect smurf action drop logging
signature detect large-icmp action drop logging
signature detect large-icmpv6 action drop logging
signature detect tcp-invalid-flags action drop logging
signature detect tcp-null-flag action drop logging
signature detect tcp-all-flags action drop logging
signature detect tcp-syn-fin action drop logging
signature detect tcp-fin-only action drop logging
signature detect land action drop logging
signature detect winnuke action drop logging
signature detect fraggle action drop logging
signature detect ip-option record-route action drop logging
signature detect ip-option strict-source-routing action drop logging
signature detect icmp-type destination-unreachable action drop logging
signature detect icmp-type redirect action drop logging
#
url-filter category custom severity 65535
#
wlan ap-group default-group
vlan 1
#
traffic-policy
rule 1 name web_AppTraffRank
application app http
#
dac log-collect service dpi traffic enable
dac traffic-statistic application enable
#
dac storage service dpi traffic limit hold-time 1
dac storage service traffic limit hold-time 1
#
cloud-management server domain cloudnet.h3c.com
#
return