H3CF1000-ai-90

1.10.1  二层静态聚合配置举例

1. 组网需求

通过将Device A与Device B之间的链路进行聚合，有利于设备间通信链路的相互备份和增加通信带宽。

2. 组网图

图1-5 二层静态聚合配置组网图

‌   

3. 配置步骤

Device B的配置与Device A相似，下面仅以Device A为例。

(1)     配置以太网接口的工作模式

# 使接口GigabitEthernet1/0/1至GigabitEthernet1/0/4工作在二层模式下。    

<DeviceA> system-view

[DeviceA] interface range gigabitethernet 1/0/1 to gigabitethernet 1/0/4

[DeviceA-if-range] port link-mode bridge

[DeviceA-if-range] quit

(2)     配置VLAN

# 创建VLAN 10，并将端口GigabitEthernet1/0/4加入到VLAN 10中。

[DeviceA] vlan 10

[DeviceA-vlan10] port gigabitethernet 1/0/4

[DeviceA-vlan10] quit

(3)     配置二层静态聚合

# 创建二层聚合接口1为Trunk端口，并允许VLAN 1和10的报文通过。

[DeviceA] interface bridge-aggregation 1

[DeviceA-Bridge-Aggregation1] port link-type trunk

[DeviceA-Bridge-Aggregation1] port trunk permit vlan 1 10

[DeviceA-Bridge-Aggregation1] quit

# 将端口GigabitEthernet1/0/1至GigabitEthernet1/0/3加入到聚合组1中。

[DeviceA] interface range gigabitethernet 1/0/1 to gigabitethernet 1/0/3

[DeviceA-if-range] port link-aggregation group 1

[DeviceA-if-range] quit

(4)     配置以太网接口的链路类型

# 配置GigabitEthernet1/0/1至GigabitEthernet1/0/3为Trunk端口，并允许VLAN 1和VLAN 10的报文通过。

[DeviceA] interface range gigabitethernet 1/0/1 to gigabitethernet 1/0/3

[DeviceA-if-range] port link-type trunk

[DeviceA-if-range] port trunk permit vlan 1 10

[DeviceA-if-range] quit

(5)     配置接口加入安全域

# 请根据组网图中规划的信息，将接口加入对应的安全域，具体配置步骤如下。

[DeviceA] security-zone name trust

[Device-security-zone-Trust] import interface gigabitethernet 1/0/4 vlan 10

[Device-security-zone-Trust] quit

[DeviceA] security-zone name untrust

[Device-security-zone-Untrust] import interface bridge-aggregation 1 vlan 1 10

[Device-security-zone-Untrust] quit

(6)     配置安全策略

配置安全策略放行trust与untrust安全域之间的流量，用于设备之间的互通。

# 配置名称为trust-untrust的安全策略，使trust的安全域到untrust的安全域的报文可通。

[DeviceA] security-policy ip

[DeviceA-security-policy-ip] rule name trust-untrust

[DeviceA-security-policy-ip-0-trust-untrust] action pass

[DeviceA-security-policy-ip-0-trust-untrust] source-zone trust

[DeviceA-security-policy-ip-0-trust-untrust] destination-zone untrust

[DeviceA-security-policy-ip-0-trust-untrust] quit

[DeviceA-security-policy-ip] quit

# 配置名称为untrust-trust的安全策略，使untrust的安全域到trust的安全域的报文可通。

[DeviceA] security-policy ip

[DeviceA-security-policy-ip] rule name untrust-trust

[DeviceA-security-policy-ip-1-untrust-trust] action pass

[DeviceA-security-policy-ip-1-untrust-trust] source-zone untrust

[DeviceA-security-policy-ip-1-untrust-trust] destination-zone trust

[DeviceA-security-policy-ip-1-untrust-trust] quit

[DeviceA-security-policy-ip] quit