ME60维护手册.doc

Bras ME60维护手册

2016年12月

目 录

一、设备配置脚本 3
二、新设备（用户）开局脚本 10
2.1 汇聚/接入交换机开局 10
2.2 配置纯Portal拨号业务 11
2.3 配置静态IP业务（绑定用户IP） 12
2.4 配置静态IP业务（不绑定用户IP） 13
2.5 配置Portal拨号业务+固定IP 14
2.6 配置Portal拨号业务（绑定用户IP） 15
三、维护命令 16
3.1.1 查看域 16
3.1.2 查看域内用户状态 17
3.1.3 查看网络联通性 17
3.1.4 查看总用户数 17
3.1.5 强制某用户下线 18
3.1.6 查看地址池占用率 18
3.1.7 查用巡检命令 18

一、 设备配置脚本
设备配置较多,仅列出维护相关部分

<WGYXY_ME60>dis cur
sysname JRZK-ME60配置主机名

radius-server group wgyxy
radius-server authentication 192.168.100.100 1812 weight 0
radius-server accounting 192.168.100.100 1813 weight 0
radius-server shared-key hwme60
radius-server nas-ip-address 192.168.100.1
radius-server attribute translate
undo radius-server user-name domain-included配置深澜Radius

#
radius-server authorization 192.168.100.100 shared-key hwme60授权深澜Radius对Bras进行操作（用户欠费踢下线）

#
#
acl number 6000
rule 20 permit tcp source user-group portal destination-port eq www
rule 25 permit tcp source user-group portal destination-port eq 8080
rule 30 permit tcp source user-group portal destination-port eq 801
rule 35 permit tcp source user-group portal destination-port eq 802
rule 40 permit tcp source user-group portal destination-port eq 803
rule 45 permit tcp source user-group portal destination-port eq 804
rule 50 permit tcp source user-group portal destination-port eq 443开放深澜Portal端口

#
acl number 6001
rule 5 permit ip source user-group portal destination ip-address 192.168.100.100 0
rule 10 permit ip source user-group portal destination ip-address 127.0.0.1 0
rule 15 permit ip source ip-address 192.168.100.100 0 destination user-group portal
rule 20 permit ip source ip-address 127.0.0.1 0 destination user-group portal
rule 25 permit ip source ip-address 10.10.10.0 0.0.1.255 destination user-group portal
rule 30 permit ip source user-group portal destination ip-address 10.10.10.0 0.0.1.255
rule 35 permit ip source ip-address 10.19.0.0 0.0.0.255 destination user-group portal
rule 40 permit ip source user-group portal destination ip-address 10.19.0.0 0.0.0.255
rule 45 permit ip source ip-address 10.3.1.0 0.0.0.255 destination user-group portal
rule 50 permit ip source user-group portal destination ip-address 10.3.1.0 0.0.0.255
rule 55 permit ip source ip-address 202.97.224.68 0.0.0.1 destination user-group portal
rule 60 permit ip source user-group portal destination ip-address 202.97.224.68 0.0.0.1
rule 65 permit ip source ip-address 101.7.8.9 0 destination user-group portal
rule 70 permit ip source user-group portal destination ip-address 101.7.8.9 0在未通过认证的情况下，可以免费访问的业务：自服务、DNS、内网资源等。

#
acl number 6002
rule 30 permit ip source user-group portal destination ip-address any
rule 35 permit ip source ip-address any destination user-group portal
#
#
ip pool 3jiao_ap_dong bas local
gateway 10.10.31.1 255.255.255.0
section 0 10.10.31.2 10.10.31.254
excluded-ip-address 10.10.31.2 10.10.31.9
dns-server 202.97.224.68 202.97.224.69 定义3教东区的AP地址池，其中1作为网关，2-9从地址池中排除。其他业务地址池不再阐述

#
ip pool 3jiao_ap_xi bas local
gateway 10.10.30.1 255.255.255.0
section 0 10.10.30.2 10.10.30.254
excluded-ip-address 10.10.30.2 10.10.30.9
dns-server 202.97.224.68 202.97.224.69
#
ip pool guanli bas local 定义设备管理地址池

gateway 10.11.255.254 255.255.0.0
section 0 10.11.0.1 10.11.255.253
excluded-ip-address 10.11.0.1 10.11.255.253
#
ip pool portal bas local 定义学生寝室Portal地址池。

gateway 10.50.0.1 255.255.0.0
section 0 10.50.0.2 10.50.255.254
excluded-ip-address 10.50.100.100
dns-server 202.97.224.68 202.97.224.69
#
#
aaa
local-user huawei password irreversible-cipher $1a$:a(TQ#W<C2$^z(<,t<;r*N%-AG$h2S-G6:/&^#1w;:V4$3Vq6YO$
local-user huawei service-type telnet
local-user huawei level 15
local-user huawei state block fail-times 3 interval 5
authentication-scheme default0
authentication-scheme default1
authentication-scheme default
authentication-mode local radius
authentication-scheme pppoe
authentication-mode none
authentication-scheme radius
#
authorization-scheme default
#
accounting-scheme default0
accounting-scheme default1
accounting-scheme pppoe
accounting-mode none
accounting-scheme jrzk
accounting-scheme radius
accounting interim interval 10定义每10分钟向Radius上传一次计费报文。

#
domain default0
ip-pool qinshi-1
dns primary-ip 202.97.224.68
dns second-ip 202.97.224.69
user-group portal
web-server 192.168.100.100
web-server url http://192.168.100.100/index_3.html
web-server url-parameter定义认证前域，用来为学生分配IP地址，并推送Portal页面

domain default1
domain default_admin
domain portal
authentication-scheme radius
accounting-scheme radius
radius-server group wgyxy 定义认证域，学生通过Portal输入用户名及密码后，会由认证域进行身份认证。

domain guanli
authentication-scheme pppoe
accounting-scheme pppoe
ip-pool guanli 定义用于设备管理的域，该域中定义的都是交换机的管理地址。

#
interface Eth-Trunk1
description to-HW-S12708 [20G]
mode user-termination
load-balance packet-all下联寝室网核心8614

#
interface Eth-Trunk1.1Eth1.1用于终结Portal拨号业务。

description portal_bohao
user-vlan 101 148 qinq 2111 2114终结用户vlan：
内层vlan101-148
外层vlan 2111-2114

user-vlan 101 148 qinq 2141
user-vlan 101 148 qinq 2171
user-vlan 101 148 qinq 2211 2213
user-vlan 201 248 qinq 2213
user-vlan 101 148 qinq 2240
user-vlan 201 248 qinq 2240
user-vlan 301 348 qinq 2240
user-vlan 101 148 qinq 2321 2324
user-vlan 101 148 qinq 2341
user-vlan 101 148 qinq 2371
user-vlan 101 148 qinq 2421 2425
user-vlan 101 148 qinq 2441
user-vlan 101 148 qinq 2471
user-vlan 101 148 qinq 2511 2518
user-vlan 101 148 qinq 2520
user-vlan 101 148 qinq 2540
user-vlan 201 248 qinq 2540
user-vlan 101 148 qinq 2542
user-vlan 101 148 qinq 2561
user-vlan 101 148 qinq 2611 2614
user-vlan 101 148 qinq 2641
user-vlan 101 148 qinq 2711 2713
user-vlan 101 148 qinq 2741 2742
user-vlan 101 148 qinq 2810
user-vlan 201 248 qinq 2810
user-vlan 101 148 qinq 2821 2822
user-vlan 101 148 qinq 2830
user-vlan 201 248 qinq 2830
user-vlan 101 148 qinq 2840
user-vlan 201 248 qinq 2840
user-vlan 101 148 qinq 2851
user-vlan 101 148 qinq 2861 2862
user-vlan 101 148 qinq 2870
user-vlan 201 248 qinq 2870
bas
#
access-type layer2-subscriber default-domain authentication portal
authentication-method web
arp-trigger
#
#
interface Eth-Trunk1.2 Eth1.2做交换设备管理用.机tal

description device_management
user-vlan 2000
user-vlan 2000 qinq 2111 2114
user-vlan 2000 qinq 2141
user-vlan 2000 qinq 2171
user-vlan 2000 qinq 2211 2213
user-vlan 2000 qinq 2240 2243
user-vlan 2000 qinq 2321 2324
user-vlan 2000 qinq 2341
user-vlan 2000 qinq 2371
user-vlan 2000 qinq 2421 2425
user-vlan 2000 qinq 2441
user-vlan 2000 qinq 2471
user-vlan 2000 qinq 2511 2518
user-vlan 2000 qinq 2520
user-vlan 2000 qinq 2540
user-vlan 2000 qinq 2542
user-vlan 2000 qinq 2561
user-vlan 2000 qinq 2611 2614
user-vlan 2000 qinq 2641
user-vlan 2000 qinq 2711 2713
user-vlan 2000 qinq 2741 2742
user-vlan 2000 qinq 2810
user-vlan 2000 qinq 2821 2822
user-vlan 2000 qinq 2830
user-vlan 2000 qinq 2840
user-vlan 2000 qinq 2851
user-vlan 2000 qinq 2861 2862
user-vlan 2000 qinq 2870
bas
#
access-type layer2-subscriber default-domain authentication guanli
authentication-method bind
arp-proxy
ip-trigger
arp-trigger

其他子接口可根据子接口描述确定业务！
#
#
interface Eth-Trunk2
portswitch
description to-USG9000-FW [20G]
port link-type trunk
port trunk allow-pass vlan 105 4000上联USG防火墙

#
interface GigabitEthernet1/0/0
undo shutdown
eth-trunk 1
#
interface GigabitEthernet1/0/1
undo shutdown
eth-trunk 1
#
interface GigabitEthernet1/0/2
undo shutdown
eth-trunk 2
#
interface GigabitEthernet1/0/3
undo shutdown
eth-trunk 2
#
interface GigabitEthernet1/0/4
description to_powercache
undo shutdown
ip address 10.100.99.1 255.255.255.0 #下联PowerCache

#
interface GigabitEthernet1/0/9
negotiation auto
description to-H3C12508
undo shutdown
ip address 172.16.6.66 255.255.255.0下联H3C12508,用于榜文办公网,图书馆,实验室.

#
#
ip route-static 0.0.0.0 0.0.0.0 Vlanif4000 172.31.0.1 description uplink-USG9000-FW默认出口路由为FW

ip route-static 10.5.0.0 255.255.252.0 172.28.2.2由于一些3教是以3层链路接到Bras的，因此需向下回指静态路由

ip route-static 10.10.1.0 255.255.255.0 172.28.2.2
ip route-static 10.10.2.0 255.255.255.0 172.28.2.2
ip route-static 10.10.3.0 255.255.255.0 172.28.2.2
ip route-static 10.10.4.0 255.255.255.0 172.28.2.2
ip route-static 10.10.5.0 255.255.255.0 172.28.2.2
ip route-static 10.10.6.0 255.255.255.0 172.28.1.2
ip route-static 10.10.7.0 255.255.255.0 172.28.1.2
ip route-static 10.10.8.0 255.255.255.0 172.28.2.2
ip route-static 10.10.9.0 255.255.255.0 172.28.2.2
ip route-static 10.10.11.0 255.255.255.0 172.28.1.2
ip route-static 10.10.12.0 255.255.255.0 172.28.1.2
ip route-static 10.10.13.0 255.255.255.0 172.28.1.2
ip route-static 10.10.14.0 255.255.255.0 172.28.2.2
ip route-static 10.10.15.0 255.255.255.0 172.28.1.2
ip route-static 10.10.16.0 255.255.255.0 172.28.1.2
ip route-static 10.10.17.0 255.255.255.0 172.28.1.2
ip route-static 10.10.18.0 255.255.255.0 172.28.2.2
ip route-static 10.10.19.0 255.255.255.0 172.28.1.2
ip route-static 10.10.20.0 255.255.255.0 172.28.1.2
ip route-static 10.10.21.0 255.255.255.0 172.28.1.2
ip route-static 10.10.32.0 255.255.255.0 172.28.1.2
ip route-static 10.17.0.0 255.255.255.0 172.28.1.2
ip route-static 10.20.0.0 255.255.255.0 172.28.1.2
ip route-static 10.22.0.0 255.255.255.0 172.28.1.2
ip route-static 10.23.0.0 255.255.255.0 172.28.2.2
ip route-static 10.25.25.0 255.255.255.0 172.28.2.2
ip route-static 172.20.1.99 255.255.255.255 192.168.100.97 description to-ATM
ip route-static 172.20.2.2 255.255.255.255 192.168.100.97 description to-ATM去往学校ATM

#
#
static-user 10.11.0.254 10.11.0.254 gateway 10.11.255.254 interface Eth-Trunk1.2 vlan 2000 domain-name guanli detect定义静态IP交换机的管理地址, 以本条命令为例, 将eth1.2接口从vlan 2000上来的用户，允许其静态配置成10.11.0.254，网关10.11.255.254。
针对固定IP用户，配置原理也是一样。

static-user 10.11.1.11 10.11.1.11 gateway 10.11.255.254 interface Eth-Trunk1.2 vlan 2000 qinq 2111 domain-name guanli detect
static-user 10.11.1.12 10.11.1.12 gateway 10.11.255.254 interface Eth-Trunk1.2 vlan 2000 qinq 2112 domain-name guanli detect
static-user 10.11.1.13 10.11.1.13 gateway 10.11.255.254 interface Eth-Trunk1.2 vlan 2000 qinq 2113 domain-name guanli detect
static-user 10.11.1.14 10.11.1.14 gateway 10.11.255.254 interface Eth-Trunk1.2 vlan 2000 qinq 2114 domain-name guanli detect
static-user 10.11.1.41 10.11.1.41 gateway 10.11.255.254 interface Eth-Trunk1.2 vlan 2000 qinq 2141 domain-name guanli detect
static-user 10.11.1.254 10.11.1.254 gateway 10.11.255.254 interface Eth-Trunk1.2 vlan 2000 domain-name guanli detect
static-user 10.11.2.11 10.11.2.11 gateway 10.11.255.254 interface Eth-Trunk1.2 vlan 2000 qinq 2211 domain-name guanli detect
static-user 10.11.2.12 10.11.2.12 gateway 10.11.255.254 interface Eth-Trunk1.2 vlan 2000 qinq 2212 domain-name guanli detect
static-user 10.11.2.13 10.11.2.14 gateway 10.11.255.254 interface Eth-Trunk1.2 vlan 2000 qinq 2213 domain-name guanli detect
static-user 10.11.2.41 10.11.2.43 gateway 10.11.255.254 interface Eth-Trunk1.2 vlan 2000 qinq 2240 domain-name guanli detect
static-user 10.11.2.254 10.11.2.254 gateway 10.11.255.254 interface Eth-Trunk1.2 vlan 2000 domain-name guanli detect
static-user 10.11.3.21 10.11.3.21 gateway 10.11.255.254 interface Eth-Trunk1.2 vlan 2000 qinq 2321 domain-name guanli detect
static-user 10.11.3.22 10.11.3.22 gateway 10.11.255.254 interface Eth-Trunk1.2 vlan 2000 qinq 2322 domain-name guanli detect
static-user 10.11.3.23 10.11.3.23 gateway 10.11.255.254 interface Eth-Trunk1.2 vlan 2000 qinq 2323 domain-name guanli detect
static-user 10.11.3.24 10.11.3.24 gateway 10.11.255.254 interface Eth-Trunk1.2 vlan 2000 qinq 2324 domain-name guanli detect
static-user 10.11.3.41 10.11.3.41 gateway 10.11.255.254 interface Eth-Trunk1.2 vlan 2000 qinq 2341 domain-name guanli detect
static-user 10.11.3.71 10.11.3.71 gateway 10.11.255.254 interface Eth-Trunk1.2 vlan 2000 qinq 2371 domain-name guanli detect
static-user 10.11.3.253 10.11.3.254 gateway 10.11.255.254 interface Eth-Trunk1.2 vlan 2000 domain-name guanli detect
#
web-auth-server 192.168.100.100 port 50100 key simple hwme60配置Portal服务器

二、 新设备（用户）开局脚本
2.1 汇聚/接入交换机开局
场景：假定新建一套中区11号楼的汇聚和接入交换机，其外层VLAN为1011，内层管理地址为11，内层1xx为一楼交换机，2xx为二楼交换机，依次类推。

1.定义一个管理IP地址池：
ip pool guanli-zhongqu-11 bas local
gateway 10.0.11.254 255.255.255.0
section 0 10.0.11.1 10.0.11.253
excluded-ip-address 10.0.11.1 10.0.11.253固定IP用户必须将地址从地址池中移除。

2.在管理域中加入此地址池：
aaa
domain guanli
ip-pool guanli-zhongqu-11

3.在Bras口上终结此VLAN
interface Eth-Trunk1.2
user-vlan 11汇聚设备的管理vlan是不带外层标签的

user-vlan 11 qinq 1011楼层交换机经过汇聚设备会打上2层标签

4.定义静态IP用户（交换机）
static-user 10.0.11.1 10.0.11.252 gateway 10.0.11.254 interface Eth-Trunk1.2 vlan 11 qinq 1011 domain-name guanli 如果是设备的管理IP，建议放到guanli这个域中。
detect
static-user 10.0.11.253 10.0.11.253 gateway 10.0.11.254 interface Eth-Trunk1.2 vlan 11 domain-name guanli detect

2.2 配置纯Portal拨号业务
场景：假定新建一套中区11号楼的汇聚和接入交换机，其外层VLAN为1011，内层1xx为一楼交换机，2xx为二楼交换机，依次类推。如果此Portal业务需要为其新分配段IP，则需要执行以下1-3的操作，如果与现有业务相同，可直接进行第3步。

1.定义一个管理IP地址池：
ip pool new-yewu bas local
gateway 10.2.0.1 255.255.255.0
section 0 10.2.0.1 10.2.255.254

2.在新建的域中加入此地址池：
aaa
domain new-yewu0
ip-pool new-yewu
dns primary-ip 172.16.17.23
user-group portal
web-server 172.16.6.6
web-server url http://172.16.6.6/index_3.html
web-server url-parameter
domain new-yewu
authentication-scheme radius
accounting-scheme radius
v