#01设备信息
#02工勘图片
#03线缆清单
#04机柜入柜图
#05组网架构图
#06连线规划
#061标签
#07布线规划
#08设备信息

!Software Version V200R019C10SPC500
# 设备主机名配置
sysname IM-CDC-BMC3-S5755-E05-40U
# 日志信息中心配置
info-center source default channel 2 trap level warning
info-center loghost source Vlanif2244
# 批量创建业务VLAN
vlan batch 2233 2244
# 启用BPDU保护，防止边缘端口网络震荡
stp bpdu-protection
# 创建各类终端认证模板
authentication-profile name default_authen_profile
authentication-profile name dot1x_authen_profile
authentication-profile name dot1xmac_authen_profile
authentication-profile name mac_authen_profile
authentication-profile name multi_authen_profile
authentication-profile name portal_authen_profile
# 创建QoS差分服务域
diffserv domain default
# 创建RADIUS认证模板
radius-server template default
# 配置PKI域并关闭证书校验
pki realm default
 certificate-check none
# 创建免认证规则模板、Portal接入模板
free-rule-template name default_free_rule
portal-access-profile name portal_access_profile
# VLAN描述信息配置
vlan 2233
 description Other-Server-MGMT
vlan 2244
 description Scloud-Server-MGMT
# AAA认证授权计费整体配置
aaa
# 配置本地、RADIUS两种认证方案
 authentication-scheme default
  authentication-mode local
 authentication-scheme radius
  authentication-mode radius
# 配置本地授权、不计费策略
 authorization-scheme default
  authorization-mode local
 accounting-scheme default
  accounting-mode none
# 管理员密码策略配置（永不过期、无历史密码限制）
 local-aaa-user password policy administrator
  password history record number 0
 undo password alert original
  password expire 0
# 默认域绑定远程RADIUS认证
 domain default
  authentication-scheme radius
  accounting-scheme default
 radius-server default
# 管理域绑定本地认证
 domain default_admin
  authentication-scheme default
  accounting-scheme default
# 创建最高权限本地管理员账号
 local-user admin password irreversible-cipher ******
 local-user admin privilege level 15
 local-user admin service-type terminal ssh http
# NTP服务配置（禁用服务端、指定源接口）
ntp-service server disable
ntp-service ipv6 server disable
ntp-service source-interface Vlanif2244
# 三层VLAN接口IP配置
interface Vlanif2244
 ip address 10.81.131.12 255.255.254.0
# 设备管理网口IP配置
interface MEth0/0/1
 ip address 192.168.1.253 255.255.255.0
# 链路聚合组Eth-Trunk1配置
interface Eth-Trunk1
 port link-type trunk
 undo port trunk allow-pass vlan 1
 port trunk allow-pass vlan 2300 2244
# 0/0/1-0/0/9端口配置：接入VLAN2244、终端防护策略
interface GigabitEthernet0/0/1
 port link-type access
 port default vlan 2244
 loopback-detect enable
 stp edged-port enable
 storm-control broadcast min-rate percent 5 max-rate percent 5
 storm-control multicast min-rate percent 1 max-rate percent 1
 storm-control unicast min-rate 1 max-rate 1
interface GigabitEthernet0/0/2
 port link-type access
 port default vlan 2244
 loopback-detect enable
 stp edged-port enable
 storm-control broadcast min-rate percent 5 max-rate percent 5
 storm-control multicast min-rate percent 1 max-rate percent 1
 storm-control unicast min-rate 1 max-rate 1
interface GigabitEthernet0/0/3
 port link-type access
 port default vlan 2244
 loopback-detect enable
 stp edged-port enable
 storm-control broadcast min-rate percent 5 max-rate percent 5
 storm-control multicast min-rate percent 1 max-rate percent 1
 storm-control unicast min-rate 1 max-rate 1
interface GigabitEthernet0/0/4
 port link-type access
 port default vlan 2244
 loopback-detect enable
 stp edged-port enable
 storm-control broadcast min-rate percent 5 max-rate percent 5
 storm-control multicast min-rate percent 1 max-rate percent 1
 storm-control unicast min-rate 1 max-rate 1
interface GigabitEthernet0/0/5
 port link-type access
 port default vlan 2244
 loopback-detect enable
 stp edged-port enable
 storm-control broadcast min-rate percent 5 max-rate percent 5
 storm-control multicast min-rate percent 1 max-rate percent 1
 storm-control unicast min-rate 1 max-rate 1
interface GigabitEthernet0/0/6
 port link-type access
 port default vlan 2244
 loopback-detect enable
 stp edged-port enable
 storm-control broadcast min-rate percent 5 max-rate percent 5
 storm-control multicast min-rate percent 1 max-rate percent 1
 storm-control unicast min-rate 1 max-rate 1
interface GigabitEthernet0/0/7
 port link-type access
 port default vlan 2244
 loopback-detect enable
 stp edged-port enable
 storm-control broadcast min-rate percent 5 max-rate percent 5
 storm-control multicast min-rate percent 1 max-rate percent 1
 storm-control unicast min-rate 1 max-rate 1
interface GigabitEthernet0/0/8
 port link-type access
 port default vlan 2244
 loopback-detect enable
 stp edged-port enable
 storm-control broadcast min-rate percent 5 max-rate percent 5
 storm-control multicast min-rate percent 1 max-rate percent 1
 storm-control unicast min-rate 1 max-rate 1
interface GigabitEthernet0/0/9
 port link-type access
 port default vlan 2244
 loopback-detect enable
 stp edged-port enable
 storm-control broadcast min-rate percent 5 max-rate percent 5
 storm-control multicast min-rate percent 1 max-rate percent 1
 storm-control unicast min-rate 1 max-rate 1
# 0/0/10-0/0/14端口配置：接入VLAN2233、终端防护策略
interface GigabitEthernet0/0/10
 port link-type access
 port default vlan 2233
 loopback-detect enable
 stp edged-port enable
 storm-control multicast min-rate percent 1 max-rate percent 1
 storm-control unicast min-rate 1 max-rate 1
interface GigabitEthernet0/0/11
 port link-type access
 port default vlan 2233
 loopback-detect enable
 stp edged-port enable
 storm-control multicast min-rate percent 1 max-rate percent 1
 storm-control unicast min-rate 1 max-rate 1
interface GigabitEthernet0/0/12
 port link-type access
 port default vlan 2233
 loopback-detect enable
 stp edged-port enable
 storm-control multicast min-rate percent 1 max-rate percent 1
 storm-control unicast min-rate 1 max-rate 1
interface GigabitEthernet0/0/13
 port link-type access
 port default vlan 2233
 loopback-detect enable
 stp edged-port enable
 storm-control multicast min-rate percent 1 max-rate percent 1
 storm-control unicast min-rate 1 max-rate 1
interface GigabitEthernet0/0/14
 port link-type access
 port default vlan 2233
 loopback-detect enable
 stp edged-port enable
 storm-control multicast min-rate percent 1 max-rate percent 1
 storm-control unicast min-rate 1 max-rate 1
# 0/0/15-0/0/24 端口未启用，无配置
interface GigabitEthernet0/0/15
interface GigabitEthernet0/0/16
interface GigabitEthernet0/0/17
interface GigabitEthernet0/0/18
interface GigabitEthernet0/0/19
interface GigabitEthernet0/0/20
interface GigabitEthernet0/0/21
interface GigabitEthernet0/0/22
interface GigabitEthernet0/0/23
interface GigabitEthernet0/0/24
# 万兆口加入链路聚合组
interface XGigabitEthernet0/0/1
 eth-trunk 1
interface XGigabitEthernet0/0/2
 eth-trunk 1
# 万兆口0/0/3-0/0/4未启用，无配置
interface XGigabitEthernet0/0/3
interface XGigabitEthernet0/0/4
# 空接口（路由黑洞用途）
interface NULL0
# 安全加固：禁止ICMP时间戳请求
undo icmp name timestamp-request receive
# 配置默认静态路由
ip route-static 0.0.0.0 0.0.0.0 10.81.131.254
# SNMP网管监控配置
snmp-agent
snmp-agent local-engineid 800007DB03843E926433C0
snmp-agent community complexity-check disable
snmp-agent sys-info version v2c v3
snmp-agent trap source Vlanif2244
snmp-agent trap enable
snmp-agent protocol source-interface Vlanif2244
# SSH远程登录安全配置
stelnet server enable
ssh user admin
ssh user admin authentication-type password
ssh user admin service-type stelnet
ssh client first-time enable
ssh server cipher aes256_ctr aes128_ctr
ssh server hmac sha2_256
ssh client cipher aes256_ctr aes128_ctr
ssh client hmac sha2_256
ssh server dh-exchange min-len 2048
# LLDP邻居发现配置
lldp management-address 10.81.131.12
# 登录用户界面配置
user-interface con 0
 authentication-mode aaa
user-interface vty 0 4
 authentication-mode aaa
 user privilege level 15
 idle-timeout 5 0
user-interface vty 16 20
# 创建802.1X、MAC接入模板
dot1x-access-profile name dot1x_access_profile
mac-access-profile name mac_access_profile
# 启用设备可编程功能
ops
# 退回用户视图
return