设为首页 收藏本站

运维网

查看: 1470|回复: 4

[经验分享] Cisco3560配置(生产环境)

[复制链接]

尚未签到

发表于 2018-4-10 15:14:38 | 显示全部楼层 |阅读模式
version 12.2
no service pad
service timestamps debug uptime
service timestamps log datetime localtime
service password-encryption
service sequence-numbers
!
hostname qngy-zx-3560
!
no logging exception
no logging buffered
logging rate-limit all 2 except debugging
no logging console
enable secret 5 $1$ozUD$Qw/SVu16l6mVvXY82mtwV12
!
no aaa new-model
clock timezone beijing 8
system mtu routing 1500
ip subnet-zero
no ip source-route
ip routing
ip domain-list 192.168.100.100
ip name-server 192.168.100.100
ip dhcp smart-relay
!
ip dhcp snooping vlan 53-55
no ip dhcp snooping information option
ip dhcp snooping
ip arp inspection vlan 53-55
ip arp inspection filter kefu vlan  5,505
ip arp inspection filter vlan54 vlan  54
ip arp inspection filter vlan55 vlan  55
no ip igmp snooping
ipv6 unicast-routing
!
mls qos
!
!
!
!
!
no errdisable detect cause arp-inspection
errdisable recovery cause dhcp-rate-limit
errdisable recovery cause arp-inspection
errdisable recovery interval 30
port-channel load-balance dst-mac
!
!
!
spanning-tree mode pvst
spanning-tree extend system-id
spanning-tree vlan 1,5,53-55,602 priority 24576
!
!
vlan access-map buildD 10
action drop
match ip address bad_port
vlan access-map buildD 20
action forward
match ip address match_all
!
vlan filter buildD vlan-list 54-55
vlan internal allocation policy ascending
!
!
class-map match-all classlimitudp
match access-group name limitudp
!
!
policy-map policylimitudp
class classlimitudp
police 100000 8000 exceed-action drop
!
!
!
!
interface Port-channel1
description link to build D
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 55,602
switchport mode trunk
ip arp inspection limit none
!
interface Port-channel2
description link to build 123
switchport trunk encapsulation isl
switchport mode trunk
ip arp inspection limit none
!
interface Port-channel3
description Link To QngyBungalow
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 1-252,254-4094
switchport mode trunk
ip arp inspection limit none
!
interface GigabitEthernet0/1
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 55,602
switchport mode trunk
ipv6 traffic-filter ACCESS_PORT in
channel-group 1 mode on
service-policy input policylimitudp
!
interface GigabitEthernet0/2
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 55,602
switchport mode trunk
ipv6 traffic-filter ACCESS_PORT in
channel-group 1 mode on
service-policy input policylimitudp
!
interface GigabitEthernet0/3
description link to build A
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 54,602
switchport mode trunk
ip arp inspection limit none
ipv6 traffic-filter ACCESS_PORT in
service-policy input policylimitudp
!
interface GigabitEthernet0/4
description link to build C
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 54,602
switchport mode trunk
ip arp inspection limit none
ipv6 traffic-filter ACCESS_PORT in
service-policy input policylimitudp
!
interface GigabitEthernet0/5
switchport trunk encapsulation isl
switchport mode trunk
ipv6 traffic-filter ACCESS_PORT in
channel-group 2 mode on
service-policy input policylimitudp
!
interface GigabitEthernet0/6
switchport trunk encapsulation isl
switchport mode trunk
ipv6 traffic-filter ACCESS_PORT in
channel-group 2 mode on
service-policy input policylimitudp
!
interface GigabitEthernet0/7
description link to B4
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 54,602
switchport mode trunk
ip arp inspection limit rate 500 burst interval 15
ipv6 traffic-filter ACCESS_PORT in
service-policy input policylimitudp
!
interface GigabitEthernet0/8
description link to B4
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 54,602
switchport mode trunk
ip arp inspection limit rate 500 burst interval 15
ipv6 traffic-filter ACCESS_PORT in
service-policy input policylimitudp
!
interface GigabitEthernet0/9
description link to B4
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 54,602
switchport mode trunk
ip arp inspection limit rate 500 burst interval 15
ipv6 traffic-filter ACCESS_PORT in
service-policy input policylimitudp
!
interface GigabitEthernet0/10
description link to B4
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 54,602
switchport mode trunk
ip arp inspection limit rate 500 burst interval 15
ipv6 traffic-filter ACCESS_PORT in
service-policy input policylimitudp
!
interface GigabitEthernet0/11
description link to B7
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 54,602
switchport mode trunk
ip arp inspection limit rate 500 burst interval 15
ipv6 traffic-filter ACCESS_PORT in
service-policy input policylimitudp
!
interface GigabitEthernet0/12
description link to B7
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 54,602
switchport mode trunk
ip arp inspection limit rate 500 burst interval 15
ipv6 traffic-filter ACCESS_PORT in
service-policy input policylimitudp
!
interface GigabitEthernet0/13
description link to B7
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 54,602
switchport mode trunk
ip arp inspection limit rate 500 burst interval 15
ipv6 traffic-filter ACCESS_PORT in
service-policy input policylimitudp
!
interface GigabitEthernet0/14
description link to B7
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 54,602
switchport mode trunk
ip arp inspection limit rate 500 burst interval 15
ipv6 traffic-filter ACCESS_PORT in
service-policy input policylimitudp
!
interface GigabitEthernet0/15
description link to B7
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 53-55
switchport mode trunk
ip arp inspection limit rate 500 burst interval 15
shutdown
ipv6 traffic-filter ACCESS_PORT in
service-policy input policylimitudp
!
interface GigabitEthernet0/16
description link to B10
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 54,602
switchport mode trunk
ip arp inspection limit rate 500 burst interval 15
ipv6 traffic-filter ACCESS_PORT in
service-policy input policylimitudp
!
interface GigabitEthernet0/17
description link to B10
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 54,602
switchport mode trunk
ip arp inspection limit rate 500 burst interval 15
ipv6 traffic-filter ACCESS_PORT in
service-policy input policylimitudp
!
interface GigabitEthernet0/18
description link to B10
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 54,602
switchport mode trunk
ip arp inspection limit rate 500 burst interval 15
ipv6 traffic-filter ACCESS_PORT in
service-policy input policylimitudp
!
interface GigabitEthernet0/19
description link to B10
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 54,602
switchport mode trunk
ip arp inspection limit rate 500 burst interval 15
ipv6 traffic-filter ACCESS_PORT in
service-policy input policylimitudp
!
interface GigabitEthernet0/20
description link to B10
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 54,602
switchport mode trunk
ip arp inspection limit rate 500 burst interval 15
ipv6 traffic-filter ACCESS_PORT in
service-policy input policylimitudp
!
interface GigabitEthernet0/21
description link to B13
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 54,602
switchport mode trunk
ip arp inspection limit rate 500 burst interval 15
ipv6 traffic-filter ACCESS_PORT in
service-policy input policylimitudp
!
interface GigabitEthernet0/22
description link to B13
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 54,602
switchport mode trunk
ip arp inspection limit rate 500 burst interval 15
ipv6 traffic-filter ACCESS_PORT in
service-policy input policylimitudp
!
interface GigabitEthernet0/23
description link to B13
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 54,602
switchport mode trunk
ip arp inspection limit rate 500 burst interval 15
ipv6 traffic-filter ACCESS_PORT in
service-policy input policylimitudp
!
interface GigabitEthernet0/24
description link to B13
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 54,602
switchport mode trunk
ip arp inspection limit rate 500 burst interval 15
ipv6 traffic-filter ACCESS_PORT in
service-policy input policylimitudp
!
interface GigabitEthernet0/25
description link to B13
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 54,602
switchport mode trunk
ip arp inspection limit rate 500 burst interval 15
ipv6 traffic-filter ACCESS_PORT in
service-policy input policylimitudp
!
interface GigabitEthernet0/26
description link to B13
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 54,602
switchport mode trunk
ip arp inspection limit rate 500 burst interval 15
ipv6 traffic-filter ACCESS_PORT in
service-policy input policylimitudp
!
interface GigabitEthernet0/27
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 54,602
switchport mode trunk
ip arp inspection limit rate 500 burst interval 15
ipv6 traffic-filter ACCESS_PORT in
service-policy input policylimitudp
!
interface GigabitEthernet0/28
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 54,602
switchport mode trunk
ip arp inspection limit rate 500 burst interval 15
ipv6 traffic-filter ACCESS_PORT in
service-policy input policylimitudp
!
interface GigabitEthernet0/29
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 54,602
switchport mode trunk
ip arp inspection limit rate 500 burst interval 15
ipv6 traffic-filter ACCESS_PORT in
service-policy input policylimitudp
!
interface GigabitEthernet0/30
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 54,602
switchport mode trunk
ip arp inspection limit rate 500 burst interval 15
ipv6 traffic-filter ACCESS_PORT in
service-policy input policylimitudp
!
interface GigabitEthernet0/31
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 1-252,254-4094
switchport mode trunk
ip arp inspection limit none
ipv6 traffic-filter ACCESS_PORT in
channel-group 3 mode on
!
interface GigabitEthernet0/32
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 1-252,254-4094
switchport mode trunk
ip arp inspection limit none
ipv6 traffic-filter ACCESS_PORT in
channel-group 3 mode on
!
interface GigabitEthernet0/33
switchport trunk encapsulation dot1q
ip arp inspection trust
shutdown
spanning-tree portfast
!
interface GigabitEthernet0/34
switchport access vlan 253
switchport mode access
ipv6 traffic-filter ACCESS_PORT in
!
interface GigabitEthernet0/35
switchport trunk allowed vlan 1-252,254-4094
shutdown
ipv6 traffic-filter ACCESS_PORT in
!
interface GigabitEthernet0/36
switchport trunk allowed vlan 1-252,254-4094
shutdown
ipv6 traffic-filter ACCESS_PORT in
!
interface GigabitEthernet0/37
switchport trunk encapsulation dot1q
switchport mode trunk
!
interface GigabitEthernet0/38
switchport trunk allowed vlan 1-252,254-4094
shutdown
ipv6 traffic-filter ACCESS_PORT in
!
interface GigabitEthernet0/39
switchport trunk allowed vlan 1-252,254-4094
shutdown
ipv6 traffic-filter ACCESS_PORT in
!
interface GigabitEthernet0/40
switchport trunk allowed vlan 1-252,254-4094
shutdown
ipv6 traffic-filter ACCESS_PORT in
!
interface GigabitEthernet0/41
switchport trunk allowed vlan 1-252,254-4094
shutdown
ipv6 traffic-filter ACCESS_PORT in
!
interface GigabitEthernet0/42
switchport trunk allowed vlan 1-252,254-4094
shutdown
ipv6 traffic-filter ACCESS_PORT in
!
interface GigabitEthernet0/43
switchport trunk allowed vlan 1-252,254-4094
switchport mode access
shutdown
ipv6 traffic-filter ACCESS_PORT in
!
interface GigabitEthernet0/44
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 1-252,254-4094
switchport mode trunk
shutdown
ipv6 traffic-filter ACCESS_PORT in
!
interface GigabitEthernet0/45
switchport trunk allowed vlan 1-252,254-4094
switchport mode access
shutdown
ipv6 traffic-filter ACCESS_PORT in
!
interface GigabitEthernet0/46
switchport access vlan 54
switchport mode access
ipv6 traffic-filter ACCESS_PORT in
!
interface GigabitEthernet0/47
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 1-252,254-4094
switchport mode trunk
ip arp inspection trust
ipv6 traffic-filter ACCESS_PORT in
spanning-tree bpdufilter enable
!
interface GigabitEthernet0/48
switchport access vlan 54
switchport mode access
ipv6 traffic-filter ACCESS_PORT in
!
interface GigabitEthernet0/49
description link to Build F (6506)
switchport trunk encapsulation dot1q
switchport mode trunk
ip arp inspection trust
spanning-tree bpdufilter enable
ip dhcp snooping trust
!
interface GigabitEthernet0/50
shutdown
flowcontrol receive on
service-policy input policylimitudp
!
interface GigabitEthernet0/51
shutdown
!
interface GigabitEthernet0/52
shutdown
!
interface Vlan1
ip address 192.168.100.78 255.255.255.128
no ip proxy-arp
ipv6 address 1001:CC0:2020:1::7/64
ipv6 enable
ipv6 nd ra suppress
ipv6 ospf 1 area 0
!
interface Vlan5
no ip address
ip helper-address 192.168.100.77
no ip redirects
no ip unreachables
no ip proxy-arp
!
interface Vlan53
ip address 192.168.31.254 255.255.255.0 secondary
ip address 192.168.15.254 255.255.255.0
ip helper-address 192.168.100.77
no ip proxy-arp
ipv6 address 1001:CC0:2020:2020::1/64
ipv6 enable
ipv6 nd router-preference High
ipv6 ospf 1 area 0
!
interface Vlan54
ip address 192.168.209.254 255.255.255.0 secondary
ip address 192.168.11.254 255.255.252.0
ip helper-address 192.168.100.77
no ip redirects
no ip unreachables
no ip proxy-arp
ipv6 address 1001:CC0:2020:2021::1/64
ipv6 enable
ipv6 nd router-preference High
ipv6 ospf 1 area 0
!
interface Vlan55
ip address 192.168.14.254 255.255.255.0
ip helper-address 192.168.100.77
no ip redirects
no ip unreachables
no ip proxy-arp
ipv6 address 1001:CC0:2020:2022::1/64
ipv6 enable
ipv6 nd router-preference High
ipv6 ospf 1 area 0
!
interface Vlan501
no ip address
!
interface Vlan602
no ip address
!
no ip http server
ip http access-class 10
ip http secure-server
!
!
ip access-list extended bad_port
deny   ip host 192.168.8.2 host 192.168.0.10
deny   ip host 192.168.0.10 host 192.168.8.2
deny   ip host 192.168.8.3 host 192.168.0.10
deny   ip host 192.168.0.10 host 192.168.8.3
deny   ip host 192.168.8.1 host 192.168.0.10
deny   ip host 192.168.0.10 host 192.168.8.1
permit tcp any any eq 445
permit tcp any any eq 139
permit tcp any any eq 135
permit udp any any eq netbios-dgm
permit udp any any eq 445
permit udp any any eq 135
permit udp any any eq netbios-ns
ip access-list extended limitudp
deny   udp 192.168.100.0 0.0.0.255 any
deny   udp 192.168.10.0 0.0.0.255 any
deny   udp 192.168.1.0 0.0.0.255 any
deny   udp any any eq domain bootpc bootps
deny   udp 192.168.200.0 0.0.0.255 any
ip access-list extended match_all
permit ip any any
!
ip source binding 0050.C225.99B1 vlan 54 192.168.8.2 interface Gi0/48
logging 192.168.100.45
access-list 2 permit 10.0.0.2
access-list 2 permit 192.168.203.36
access-list 2 permit 192.168.100.0 0.0.0.255
access-list 10 permit 192.168.100.0 0.0.0.255
!
arp access-list vlan54
permit ip host 192.168.11.250 mac host 0014.970f.5a08
permit ip host 192.168.11.249 mac host 0014.970f.5a07
permit ip host 192.168.11.248 mac host 0014.970f.5a36
permit ip host 192.168.1.245 mac any
permit ip host 192.168.1.246 mac any
arp access-list vlan55
permit ip host 192.168.14.200 mac host 0010.5cb2.3a8c
permit ip host 192.168.14.249 mac host 0014.970f.5a04
permit ip host 192.168.14.1 mac host 0050.c225.99b5
arp 192.168.10.139 00bc.5c1d.4820 ARPA
arp 192.168.11.244 8080.d24d.0bf4 ARPA
arp 192.168.14.253 0040.63f7.62ef ARPA
arp 192.168.14.1 0050.c225.99b5 ARPA
arp 192.168.8.3 0050.c225.9a07 ARPA
arp 192.168.8.2 0050.c225.99b1 ARPA
arp 192.168.8.1 0050.c225.998f ARPA
ipv6 router ospf 1
log-adjacency-changes
!
!
snmp-server community rcode RO 2
snmp-server community public RO
snmp-server enable traps snmp authentication linkdown linkup coldstart warmstart
snmp-server enable traps tty
snmp-server enable traps cluster
snmp-server enable traps entity
snmp-server enable traps cpu threshold
snmp-server enable traps vtp
snmp-server enable traps vlancreate
snmp-server enable traps vlandelete
snmp-server enable traps flash insertion removal
snmp-server enable traps port-security
snmp-server enable traps envmon fan shutdown supply temperature status
snmp-server enable traps config-copy
snmp-server enable traps config
snmp-server enable traps hsrp
snmp-server enable traps bridge newroot topologychange
snmp-server enable traps stpx inconsistency root-inconsistency loop-inconsistency
snmp-server enable traps syslog
snmp-server enable traps vlan-membership
!
ipv6 access-list ACCESS_PORT
remark Block all traffic DHCP server -> client
deny udp any eq 547 any eq 546
remark Block Router Advertisements
deny icmp any any router-advertisement
permit ipv6 any any
!
ipv6 access-list vty
permit ipv6 1001:CC0:2020:1::/64 1001:CC0:2020:1::/64
permit ipv6 1001:CC0:2020:1001::/64 1001:CC0:2020:1::/64
!
control-plane
!
!
line con 0
password 7 060506324F415A4C5347020A1F173D24362C1
login
line vty 0 4
access-class 10 in
password 7 104D000A0618415E5A543A2A373B243A30172
ipv6 access-class vty in
login
line vty 5 15
access-class 10 in
password 7 104D000A0618415E5A543A2A373B243A30174
ipv6 access-class vty in
login
!
!
monitor session 1 source vlan 54
monitor session 1 destination interface Gi0/47
mac-address-table static 14cf.9274.00eb vlan 53 drop
ntp clock-period 36029575
ntp server 192.168.100.45 prefer
end

运维网声明 1、欢迎大家加入本站运维交流群:群①:263444886群②:197202523群③:485755530群④:201730672群⑤:202807635运维网交流群⑥:281548029
2、本站所有主题由该帖子作者发表,该帖子作者与运维网享有帖子相关版权
3、其他单位或个人使用、转载或引用本文时必须注明原文的出处
4、如本帖侵犯到任何版权问题,请立即告知本站,本站将及时予与删除并致以最深的歉意
5、运维网 - 服务您的运维操作管理专家!
6、联系人Email:admin@yunvn.com 网址:www.iyunv.com

点击关注更多内容
累计签到:82 天
连续签到:2 天
发表于 2018-4-11 16:37:08 | 显示全部楼层
主要的部分能略注解一下,就完美了

运维网声明 1、欢迎大家加入本站运维交流群:群①:263444886群②:197202523群③:485755530群④:201730672群⑤:202807635运维网交流群⑥:281548029
2、本站所有主题由该帖子作者发表,该帖子作者与运维网享有帖子相关版权
3、其他单位或个人使用、转载或引用本文时必须注明原文的出处
4、如本帖侵犯到任何版权问题,请立即告知本站,本站将及时予与删除并致以最深的歉意
5、运维网 - 服务您的运维操作管理专家!
6、联系人Email:admin@yunvn.com 网址:www.iyunv.com

回复 支持 反对

使用道具 举报

累计签到:245 天
连续签到:1 天
发表于 2018-4-21 15:44:02 | 显示全部楼层
谢谢楼主分享

运维网声明 1、欢迎大家加入本站运维交流群:群①:263444886群②:197202523群③:485755530群④:201730672群⑤:202807635运维网交流群⑥:281548029
2、本站所有主题由该帖子作者发表,该帖子作者与运维网享有帖子相关版权
3、其他单位或个人使用、转载或引用本文时必须注明原文的出处
4、如本帖侵犯到任何版权问题,请立即告知本站,本站将及时予与删除并致以最深的歉意
5、运维网 - 服务您的运维操作管理专家!
6、联系人Email:admin@yunvn.com 网址:www.iyunv.com

回复 支持 反对

使用道具 举报

您需要登录后才可以回帖 登录 | 立即注册  

本版积分规则  允许回帖邮件提醒楼主

扫码加入运维网微信交流群X

扫码加入运维网微信交流群

扫描二维码加入运维网微信交流群,最新一手资源尽在官方微信交流群!快快加入我们吧...

扫描微信二维码查看详情

客服 E-mail:kefu@yunvn.com

本站由青云提供云计算服务

运维网--中国最专业的运维工程师交流社区

京ICP备14039699号-1 Copyright © 2012-2018

使用手机软件扫描微信二维码

关注我们可获取更多热点资讯

Good good study day day up !


提醒:禁止发布任何违反国家法律、法规的言论与图片等内容;本站内容均来自个人观点与网络等信息,非本站认同之观点.


独家合作伙伴: 青云cloud

快速回复 返回顶部 返回列表