公司架构如下,总部三层交换机为S3600 下面有四个部门,每个部门都是以二层交换机通过光纤的方式连接至 S3600,以下简称部门一部门二部门三部门四 部门一的网段为10.1.0.0 ,部门二的网段为10.3.0.0 部门三的网段为10.4.0.0 部门四的网段为192.168.2.0 现需在部门三新增一个网段为192.168.20.0 ,且更换了新的三层设备,为何新增这个VLAN20 的网段之后 无法通信?S3600的配置我贴在下方。
为什么没法放TXT文件
# sysname s3600 # super password level 3 cipher BJ>:3V;@ZI;Q=^Q`MAF4<1!! # dhcp-server 1 ip 10.0.0.1 dhcp relay information enable # radius scheme system # domain system # local-user h3c password cipher C"RV9X$G#7/Q=^Q`MAF4<1!! service-type ssh telnet level 3 # acl number 3001 rule 199 deny IP source 10.2.0.0 0.0.255.255 rule 200 permit IP source 10.2.0.0 0.0.255.255 destination 10.0.0.0 0.0.0.255 rule 210 permit IP source 10.2.0.0 0.0.255.255 destination 10.2.0.0 0.0.255.255 rule 220 permit IP source 10.2.0.0 0.0.255.255 destination 10.7.0.254 0 rule 230 permit IP source 10.2.1.2 0 rule 240 permit IP source 10.2.20.2 0 rule 250 permit IP source 10.2.15.2 0 rule 260 permit IP source 10.2.20.0 0.0.0.255 acl number 3002 rule 80 permit IP rule 90 deny IP source 10.1.4.0 0.0.0.255 destination 10.0.0.0 0.255.255.255 rule 101 permit IP source 10.1.4.0 0.0.0.255 destination 10.0.0.0 0.0.0.255 rule 110 permit IP source 10.1.4.0 0.0.0.255 destination 10.1.4.0 0.0.0.255 # vlan 1 # vlan 10 # vlan 20 # vlan 110 to 150 # vlan 201 to 220 # vlan 300 # vlan 400 # vlan 500 # vlan 701 # interface Vlan-interface1 ip address 192.168.1.254 255.255.255.0 # interface Vlan-interface10 ip address 10.0.0.254 255.255.255.0 # interface Vlan-interface20 ip address 192.168.10.1 255.255.255.0 # interface Vlan-interface110 ip address 10.1.1.1 255.255.255.0 # interface Vlan-interface120 ip address 10.1.2.1 255.255.255.0 # interface Vlan-interface130 ip address 10.1.3.1 255.255.255.0 # interface Vlan-interface140 ip address 10.1.4.1 255.255.255.0 # interface Vlan-interface150 ip address 10.1.5.1 255.255.255.0 # interface Vlan-interface201 ip address 10.2.1.1 255.255.255.0 # interface Vlan-interface202 ip address 10.2.2.1 255.255.255.0 # interface Vlan-interface203 ip address 10.2.3.1 255.255.255.0 # interface Vlan-interface204 ip address 10.2.4.1 255.255.255.0 # interface Vlan-interface205 ip address 10.2.5.1 255.255.255.0 # interface Vlan-interface206 ip address 10.2.6.1 255.255.255.0 # interface Vlan-interface207 ip address 10.2.7.1 255.255.255.0 # interface Vlan-interface208 ip address 10.2.8.1 255.255.255.0 # interface Vlan-interface209 ip address 10.2.9.1 255.255.255.0 # interface Vlan-interface210 ip address 10.2.10.1 255.255.255.0 # interface Vlan-interface211 ip address 10.2.11.1 255.255.255.0 # interface Vlan-interface212 ip address 10.2.12.1 255.255.255.0 # interface Vlan-interface213 ip address 10.2.13.1 255.255.255.0 # interface Vlan-interface214 ip address 10.2.14.1 255.255.255.0 # interface Vlan-interface215 ip address 10.2.15.1 255.255.255.0 # interface Vlan-interface216 ip address 10.2.16.1 255.255.255.0 # interface Vlan-interface217 ip address 10.2.17.1 255.255.255.0 # interface Vlan-interface218 ip address 10.2.18.1 255.255.255.0 # interface Vlan-interface219 ip address 10.2.19.1 255.255.255.0 # interface Vlan-interface220 ip address 10.2.20.1 255.255.255.0 # interface Vlan-interface300 ip address 10.3.1.1 255.255.255.0 # interface Vlan-interface400 ip address 10.4.1.1 255.255.255.0 # interface Vlan-interface500 ip address 10.5.1.1 255.255.255.0 # interface Vlan-interface701 ip address 10.7.0.1 255.255.255.0 # interface Aux1/0/0 # interface Ethernet1/0/1 # interface Ethernet1/0/2 port link-type trunk port trunk permit vlan 1 20 400 # interface Ethernet1/0/3 port link-type trunk port trunk permit vlan 1 201 to 220 300 packet-filter inbound ip-group 3001 rule 199 packet-filter inbound ip-group 3001 rule 200 packet-filter inbound ip-group 3001 rule 210 packet-filter inbound ip-group 3001 rule 220 packet-filter inbound ip-group 3001 rule 230 packet-filter inbound ip-group 3001 rule 240 packet-filter inbound ip-group 3001 rule 250 packet-filter inbound ip-group 3001 rule 260 # interface Ethernet1/0/4 port link-type trunk port trunk permit vlan 1 500 # interface Ethernet1/0/5 port link-type trunk port trunk permit vlan 1 100 to 150 # interface Ethernet1/0/6 port link-type trunk port trunk permit vlan 1 100 to 150 # interface Ethernet1/0/7 port link-type trunk port trunk permit vlan 1 100 to 150 500 # interface Ethernet1/0/8 port link-type trunk port trunk permit vlan 1 100 to 150 # interface Ethernet1/0/9 # interface Ethernet1/0/10 port access vlan 10 dhcp-snooping trust # interface Ethernet1/0/11 # interface Ethernet1/0/12 # interface Ethernet1/0/13 # interface Ethernet1/0/14 port access vlan 10 # interface Ethernet1/0/15 # interface Ethernet1/0/16 port access vlan 10 # interface Ethernet1/0/17 port access vlan 10 # interface Ethernet1/0/18 # interface Ethernet1/0/19 # interface Ethernet1/0/20 port access vlan 701 # interface Ethernet1/0/21 # interface Ethernet1/0/22 # interface Ethernet1/0/23 # interface Ethernet1/0/24 # interface GigabitEthernet1/1/1 port access vlan 701 # interface GigabitEthernet1/1/2 # interface GigabitEthernet1/1/3 port access vlan 701 # interface GigabitEthernet1/1/4 port access vlan 10 # undo irf-fabric authentication-mode # interface NULL0 # dhcp-snooping # voice vlan mac-address 0001-e300-0000 mask ffff-ff00-0000 # ip route-static 0.0.0.0 0.0.0.0 10.7.0.254 preference 60 ip route-static 10.4.1.0 255.255.255.0 10.4.1.254 preference 60 ip route-static 192.168.2.0 255.255.255.0 192.168.1.8 preference 60 # ssh authentication-type default password-publickey ssh user h3c authentication-type password ssh user h3c service-type stelnet # user-interface aux 0 7 user-interface vty 0 4 authentication-mode scheme user privilege level 3 set authentication password cipher C"RV9X$G#7/Q=^Q`MAF4<1!! # return
(0)
最佳答案
#sysname s3600
#super password level 3 cipher BJ>:3V;@ZI;Q=^Q`MAF4<1!!
#dhcp-server 1 ip 10.0.0.1
dhcp relay information enable
# radius scheme system
# domain system
# local-user h3cpassword cipher C"RV9X$G#7/Q=^Q`MAF4<1!!service-type ssh telnetlevel 3
# acl number 3001
rule 199 deny IP source 10.2.0.0 0.0.255.255
rule 200 permit IP source 10.2.0.0 0.0.255.255 destination 10.0.0.0 0.0.0.255
rule 210 permit IP source 10.2.0.0 0.0.255.255 destination 10.2.0.0 0.0.255.255
rule 220 permit IP source 10.2.0.0 0.0.255.255 destination 10.7.0.254 0
rule 230 permit IP source 10.2.1.2 0
rule 240 permit IP source 10.2.20.2 0
rule 250 permit IP source 10.2.15.2 0
rule 260 permit IP source 10.2.20.0 0.0.0.255 acl number 3002
rule 80 permit IPrule 90 deny IP source 10.1.4.0 0.0.0.255 destination 10.0.0.0 0.255.255.255
rule 101 permit IP source 10.1.4.0 0.0.0.255 destination 10.0.0.0 0.0.0.255
rule 110 permit IP source 10.1.4.0 0.0.0.255 destination 10.1.4.0 0.0.0.255
# vlan 1 # vlan 10 # vlan 20 # vlan 110 to 150 # vlan 201 to 220 # vlan 300 # vlan 400 # vlan 500 # vlan 701
# interface Vlan-interface1
ip address 192.168.1.254 255.255.255.0
# interface Vlan-interface10
ip address 10.0.0.254 255.255.255.0
# interface Vlan-interface20
ip address 192.168.10.1 255.255.255.0
# interface Vlan-interface110
ip address 10.1.1.1 255.255.255.0
# interface Vlan-interface120
ip address 10.1.2.1 255.255.255.0
# interface Vlan-interface130
ip address 10.1.3.1 255.255.255.0
# interface Vlan-interface140
ip address 10.1.4.1 255.255.255.0
# interface Vlan-interface150
ip address 10.1.5.1 255.255.255.0
# interface Vlan-interface201
ip address 10.2.1.1 255.255.255.0
# interface Vlan-interface202
ip address 10.2.2.1 255.255.255.0
# interface Vlan-interface203
ip address 10.2.3.1 255.255.255.0
# interface Vlan-interface204
ip address 10.2.4.1 255.255.255.0
# interface Vlan-interface205
ip address 10.2.5.1 255.255.255.0
# interface Vlan-interface206
ip address 10.2.6.1 255.255.255.0
# interface Vlan-interface207
ip address 10.2.7.1 255.255.255.0
# interface Vlan-interface208
ip address 10.2.8.1 255.255.255.0
# interface Vlan-interface209
ip address 10.2.9.1 255.255.255.0
# interface Vlan-interface210
ip address 10.2.10.1 255.255.255.0
# interface Vlan-interface211
ip address 10.2.11.1 255.255.255.0
# interface Vlan-interface212
ip address 10.2.12.1 255.255.255.0
# interface Vlan-interface213
ip address 10.2.13.1 255.255.255.0
# interface Vlan-interface214
ip address 10.2.14.1 255.255.255.0
# interface Vlan-interface215
ip address 10.2.15.1 255.255.255.0
# interface Vlan-interface216
ip address 10.2.16.1 255.255.255.0
# interface Vlan-interface217
ip address 10.2.17.1 255.255.255.0
# interface Vlan-interface218
ip address 10.2.18.1 255.255.255.0
# interface Vlan-interface219
ip address 10.2.19.1 255.255.255.0
# interface Vlan-interface220
ip address 10.2.20.1 255.255.255.0
# interface Vlan-interface300
ip address 10.3.1.1 255.255.255.0
# interface Vlan-interface400
ip address 10.4.1.1 255.255.255.0
# interface Vlan-interface500
ip address 10.5.1.1 255.255.255.0
# interface Vlan-interface701
ip address 10.7.0.1 255.255.255.0
# interface Aux1/0/0
# interface Ethernet1/0/1
# interface Ethernet1/0/2
port link-type trunk
port trunk permit vlan 1 20 400
# interface Ethernet1/0/3
port link-type trunk
port trunk permit vlan 1 201 to 220 300
packet-filter inbound ip-group 3001 rule 199
packet-filter inbound ip-group 3001 rule 200
packet-filter inbound ip-group 3001 rule 210
packet-filter inbound ip-group 3001 rule 220
packet-filter inbound ip-group 3001 rule 230
packet-filter inbound ip-group 3001 rule 240
packet-filter inbound ip-group 3001 rule 250
packet-filter inbound ip-group 3001 rule 260
# interface Ethernet1/0/4
port link-type trunk
port trunk permit vlan 1 500
# interface Ethernet1/0/5
port link-type trunk
port trunk permit vlan 1 100 to 150
# interface Ethernet1/0/6
port link-type trunk
port trunk permit vlan 1 100 to 150
# interface Ethernet1/0/7
port link-type trunk
port trunk permit vlan 1 100 to 150 500
# interface Ethernet1/0/8
port link-type trunk
port trunk permit vlan 1 100 to 150
# interface Ethernet1/0/9
# interface Ethernet1/0/10
port access vlan 10
dhcp-snooping trust
# interface Ethernet1/0/11
# interface Ethernet1/0/12
# interface Ethernet1/0/13
# interface Ethernet1/0/14
port access vlan 10
# interface Ethernet1/0/15
# interface Ethernet1/0/16
port access vlan 10
# interface Ethernet1/0/17
port access vlan 10
# interface Ethernet1/0/18
# interface Ethernet1/0/19
# interface Ethernet1/0/20
port access vlan 701
# interface Ethernet1/0/21
# interface Ethernet1/0/22
# interface Ethernet1/0/23
# interface Ethernet1/0/24
# interface GigabitEthernet1/1/1
port access vlan 701
# interface GigabitEthernet1/1/2
# interface GigabitEthernet1/1/3
port access vlan 701
# interface GigabitEthernet1/1/4
port access vlan 10
#undo irf-fabric authentication-mode
# interface NULL0
#dhcp-snooping
#voice vlan mac-address 0001-e300-0000 mask ffff-ff00-0000
#ip route-static 0.0.0.0 0.0.0.0 10.7.0.254 preference 60
ip route-static 10.4.1.0 255.255.255.0 10.4.1.254 preference 60
ip route-static 192.168.2.0 255.255.255.0 192.168.1.8 preference 60
#ssh authentication-type default password-publickeyssh user h3c authentication-type passwordssh user h3c service-type stelnet
# user-interface aux 0 7 user-interface vty 0 4authentication-mode schemeuser privilege level 3set authentication password cipher C"RV9X$G#7/Q=^Q`MAF4<1!!
# return
(0)
亲~登录后才可以操作哦!
确定你的邮箱还未认证,请认证邮箱或绑定手机后进行当前操作
举报
×
侵犯我的权益
×
侵犯了我企业的权益
×
抄袭了我的内容
×
原文链接或出处
诽谤我
×
对根叔社区有害的内容
×
不规范转载
×
举报说明
可以私聊我给你配置帮忙看一下吗?