设备类型：
1. 交换机（Switch）
– 二层交换机：基于MAC地址转发
– 三层交换机：支持路由功能
– 核心交换机：高性能、高可靠
– 接入交换机：终端接入

2. 路由器（Router）
– 企业级路由器：高性能路由
– 边缘路由器：连接ISP
– 核心路由器：骨干网络

3. 防火墙（Firewall）
– 传统防火墙：包过滤
– 下一代防火墙：应用层防护
– Web应用防火墙：Web安全

4. 负载均衡器
– 硬件负载均衡：F5、A10
– 软件负载均衡：Nginx、HAProxy

# FGedu网络架构
网络拓扑：
Internet
|
边界路由器
|
核心防火墙
|
┌───────────┼───────────┐
| | |
核心交换机 核心交换机 核心交换机
| | |
┌───┴───┐ ┌───┴───┐ ┌───┴───┐
| | | | | |
接入SW 接入SW 接入SW 接入SW 接入SW 接入SW
| | | | | |
服务器 服务器 服务器 服务器 服务器 服务器

# 设备品牌选型
设备类型 推荐品牌 特点
——– ——– —-
核心交换机 华为、华三、思科 高性能、高可靠
接入交换机 华为、华三、锐捷 性价比高
路由器 华为、思科、Juniper 稳定可靠
防火墙 深信服、华为、天融信 安全防护强
负载均衡 F5、A10、深信服 性能优异

# 1. 基础配置
< Huawei > system-view
[Huawei] sysname FGedu-Core-SW01
[FGedu-Core-SW01]

# 配置管理IP
[FGedu-Core-SW01] interface Vlanif 1
[FGedu-Core-SW01-Vlanif1] ip address 192.168.1.1 255.255.255.0
[FGedu-Core-SW01-Vlanif1] quit

# 配置默认网关
[FGedu-Core-SW01] ip route-static 0.0.0.0 0.0.0.0 192.168.1.254

# 配置远程登录
[FGedu-Core-SW01] user-interface vty 0 4
[FGedu-Core-SW01-ui-vty0-4] authentication-mode aaa
[FGedu-Core-SW01-ui-vty0-4] protocol inbound ssh
[FGedu-Core-SW01-ui-vty0-4] quit

# 创建管理用户
[FGedu-Core-SW01] aaa
[FGedu-Core-SW01-aaa] local-user fgedu_admin password cipher Fgedu@Admin123
[FGedu-Core-SW01-aaa] local-user fgedu_admin service-type ssh
[FGedu-Core-SW01-aaa] local-user fgedu_admin privilege level 15
[FGedu-Core-SW01-aaa] quit

# 启用SSH
[FGedu-Core-SW01] stelnet server enable
[FGedu-Core-SW01] ssh user fgedu_admin authentication-type password
[FGedu-Core-SW01] ssh user fgedu_admin service-type stelnet

# 2. VLAN配置
# 创建VLAN
[FGedu-Core-SW01] vlan batch 10 20 30 100 200
[FGedu-Core-SW01] vlan 10
[FGedu-Core-SW01-vlan10] description FGedu-Server-Network
[FGedu-Core-SW01-vlan10] quit

[FGedu-Core-SW01] vlan 20
[FGedu-Core-SW01-vlan20] description FGedu-App-Network
[FGedu-Core-SW01-vlan20] quit

# 配置VLAN接口IP
[FGedu-Core-SW01] interface Vlanif 10
[FGedu-Core-SW01-Vlanif10] ip address 10.0.10.1 255.255.255.0
[FGedu-Core-SW01-Vlanif10] quit

[FGedu-Core-SW01] interface Vlanif 20
[FGedu-Core-SW01-Vlanif20] ip address 10.0.20.1 255.255.255.0
[FGedu-Core-SW01-Vlanif20] quit

# 3. 端口配置
# 配置接入端口
[FGedu-Core-SW01] interface GigabitEthernet 0/0/1
[FGedu-Core-SW01-GigabitEthernet0/0/1] port link-type access
[FGedu-Core-SW01-GigabitEthernet0/0/1] port default vlan 10
[FGedu-Core-SW01-GigabitEthernet0/0/1] description FGedu-Server01
[FGedu-Core-SW01-GigabitEthernet0/0/1] quit

# 配置Trunk端口
[FGedu-Core-SW01] interface GigabitEthernet 0/0/24
[FGedu-Core-SW01-GigabitEthernet0/0/24] port link-type trunk
[FGedu-Core-SW01-GigabitEthernet0/0/24] port trunk allow-pass vlan 10 20 30
[FGedu-Core-SW01-GigabitEthernet0/0/24] description To-FGedu-Access-SW01
[FGedu-Core-SW01-GigabitEthernet0/0/24] quit

# 配置端口聚合
[FGedu-Core-SW01] interface Eth-Trunk 1
[FGedu-Core-SW01-Eth-Trunk1] description To-FGedu-Core-SW02
[FGedu-Core-SW01-Eth-Trunk1] port link-type trunk
[FGedu-Core-SW01-Eth-Trunk1] port trunk allow-pass vlan all
[FGedu-Core-SW01-Eth-Trunk1] mode lacp-static
[FGedu-Core-SW01-Eth-Trunk1] quit

[FGedu-Core-SW01] interface GigabitEthernet 0/0/23
[FGedu-Core-SW01-GigabitEthernet0/0/23] eth-trunk 1
[FGedu-Core-SW01-GigabitEthernet0/0/23] quit

[FGedu-Core-SW01] interface GigabitEthernet 0/0/24
[FGedu-Core-SW01-GigabitEthernet0/0/24] eth-trunk 1
[FGedu-Core-SW01-GigabitEthernet0/0/24] quit

# 4. 查看配置
[FGedu-Core-SW01] display current-configuration
#
sysname FGedu-Core-SW01
#
vlan batch 10 20 30 100 200
#
interface Vlanif1
ip address 192.168.1.1 255.255.255.0
#
interface Vlanif10
ip address 10.0.10.1 255.255.255.0
#
interface Vlanif20
ip address 10.0.20.1 255.255.255.0
#
interface GigabitEthernet0/0/1
port link-type access
port default vlan 10
description FGedu-Server01
#
interface GigabitEthernet0/0/24
port link-type trunk
port trunk allow-pass vlan 10 20 30
description To-FGedu-Access-SW01
#

# 查看VLAN
[FGedu-Core-SW01] display vlan
The total number of vlans is : 5
U: Up; D: Down; TG: Tagged; UT: Untagged;
MP: Vlan-mapping; ST: Vlan-stacking;
#: Protocol-transparent-vlan; *: Management-vlan;

VID Type Ports
——————————————————————————–
1 common UT:GE0/0/1(U) GE0/0/2(D) GE0/0/3(D)
10 common UT:GE0/0/1(U)
20 common
30 common
100 common

# 查看端口状态
[FGedu-Core-SW01] display interface brief
PHY: Physical
*down: administratively down
^down: standby
(l): loopback
(s): spoofing
(b): BFD down
(d): Dampening Suppressed
InUti/OutUti: input utility/output utility
Interface PHY Protocol InUti OutUti inErrors outErrors
GigabitEthernet0/0/1 up up 0.01% 0.01% 0 0
GigabitEthernet0/0/2 down down 0% 0% 0 0
GigabitEthernet0/0/3 down down 0% 0% 0 0

# 1. 基础配置
< Huawei > system-view
[Huawei] sysname FGedu-Edge-Router01
[FGedu-Edge-Router01]

# 配置接口
[FGedu-Edge-Router01] interface GigabitEthernet 0/0/0
[FGedu-Edge-Router01-GigabitEthernet0/0/0] ip address 202.100.1.2 255.255.255.252
[FGedu-Edge-Router01-GigabitEthernet0/0/0] description To-ISP
[FGedu-Edge-Router01-GigabitEthernet0/0/0] quit

[FGedu-Edge-Router01] interface GigabitEthernet 0/0/1
[FGedu-Edge-Router01-GigabitEthernet0/0/1] ip address 192.168.1.254 255.255.255.0
[FGedu-Edge-Router01-GigabitEthernet0/0/1] description To-Core-SW
[FGedu-Edge-Router01-GigabitEthernet0/0/1] quit

# 2. 静态路由配置
# 默认路由
[FGedu-Edge-Router01] ip route-static 0.0.0.0 0.0.0.0 202.100.1.1

# 内网路由
[FGedu-Edge-Router01] ip route-static 10.0.0.0 255.255.0.0 192.168.1.1

# 查看路由表
[FGedu-Edge-Router01] display ip routing-table
Route Flags: R – relay, D – download to fib
——————————————————————————
Routing Tables: Public
Destinations : 15 Routes : 15

Destination/Mask Proto Pre Cost Flags NextHop Interface

0.0.0.0/0 Static 60 0 RD 202.100.1.1 GE0/0/0
10.0.0.0/16 Static 60 0 RD 192.168.1.1 GE0/0/1
192.168.1.0/24 Direct 0 0 D 192.168.1.254 GE0/0/1
202.100.1.0/30 Direct 0 0 D 202.100.1.2 GE0/0/0

# 3. NAT配置
# 配置NAT地址池
[FGedu-Edge-Router01] nat address-group 1 202.100.1.2 202.100.1.2

# 配置ACL
[FGedu-Edge-Router01] acl number 2000
[FGedu-Edge-Router01-acl-basic-2000] rule 5 permit source 10.0.0.0 0.0.255.255
[FGedu-Edge-Router01-acl-basic-2000] rule 10 permit source 192.168.0.0 0.0.255.255
[FGedu-Edge-Router01-acl-basic-2000] quit

# 应用NAT
[FGedu-Edge-Router01] interface GigabitEthernet 0/0/0
[FGedu-Edge-Router01-GigabitEthernet0/0/0] nat outbound 2000 address-group 1
[FGedu-Edge-Router01-GigabitEthernet0/0/0] quit

# 端口映射
[FGedu-Edge-Router01] interface GigabitEthernet 0/0/0
[FGedu-Edge-Router01-GigabitEthernet0/0/0] nat server protocol tcp global 202.100.1.2 80 inside 10.0.10.10 80
[FGedu-Edge-Router01-GigabitEthernet0/0/0] nat server protocol tcp global 202.100.1.2 443 inside 10.0.10.11 443
[FGedu-Edge-Router01-GigabitEthernet0/0/0] quit

# 4. OSPF动态路由配置
[FGedu-Edge-Router01] ospf 1 router-id 1.1.1.1
[FGedu-Edge-Router01-ospf-1] area 0
[FGedu-Edge-Router01-ospf-1-area-0.0.0.0] network 192.168.1.0 0.0.0.255
[FGedu-Edge-Router01-ospf-1-area-0.0.0.0] network 10.0.0.0 0.0.255.255
[FGedu-Edge-Router01-ospf-1-area-0.0.0.0] quit
[FGedu-Edge-Router01-ospf-1] quit

# 查看OSPF邻居
[FGedu-Edge-Router01] display ospf peer brief

OSPF Process 1 with Router ID 1.1.1.1
Peer Brief Information

—————————————————
Area: 0.0.0.0
Router ID Address Pri Dead-Time State Interface
2.2.2.2 192.168.1.1 1 38 Full GE0/0/1

# 5. BGP配置
[FGedu-Edge-Router01] bgp 65001
[FGedu-Edge-Router01-bgp] router-id 1.1.1.1
[FGedu-Edge-Router01-bgp] peer 202.100.1.1 as-number 65000
[FGedu-Edge-Router01-bgp] ipv4-family unicast
[FGedu-Edge-Router01-bgp-af-ipv4] network 10.0.0.0 255.255.0.0
[FGedu-Edge-Router01-bgp-af-ipv4] peer 202.100.1.1 enable
[FGedu-Edge-Router01-bgp-af-ipv4] quit
[FGedu-Edge-Router01-bgp] quit

# 查看BGP邻居
[FGedu-Edge-Router01] display bgp peer

BGP local router ID : 1.1.1.1
Local AS number : 65001
Total number of peers : 1
Peers in established state : 1

Peer V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State PrefRcv
202.100.1.1 4 65000 125 130 10 0 0 00:15:23 Established 5

# 1. 接口配置
# 配置外网接口
interface eth0
description To-Internet
ip address 202.100.1.2 255.255.255.252
zone untrust
exit

# 配置内网接口
interface eth1
description To-Core-SW
ip address 192.168.1.254 255.255.255.0
zone trust
exit

# 配置DMZ接口
interface eth2
description DMZ
ip address 10.0.100.1 255.255.255.0
zone dmz
exit

# 2. 安全区域配置
zone trust
priority 85
add interface eth1
exit

zone untrust
priority 5
add interface eth0
exit

zone dmz
priority 50
add interface eth2
exit

# 3. 安全策略配置
# 允许内网访问外网
policy from trust to untrust
policy_id 1
source any
destination any
service any
action permit
logging on
exit
exit

# 允许外网访问DMZ的Web服务
policy from untrust to dmz
policy_id 2
source any
destination 10.0.100.10
service http https
action permit
logging on
exit
exit

# 禁止其他访问
policy from untrust to trust
policy_id 3
source any
destination any
service any
action deny
logging on
exit
exit

# 4. NAT配置
# SNAT配置
nat source
rule 1
source 10.0.0.0 255.255.0.0
destination any
service any
translate-to 202.100.1.2
exit
exit

# DNAT配置
nat destination
rule 1
source any
destination 202.100.1.2
service http
translate-to 10.0.100.10 80
exit
rule 2
source any
destination 202.100.1.2
service https
translate-to 10.0.100.11 443
exit
exit

# 5. IPS配置
ips
enable
signature-set all
action default
severity high medium
exit

# 6. 防病毒配置
antivirus
enable
protocol http ftp smtp pop3 imap
action block
exit

# 7. 查看配置
show running-config
!
interface eth0
description To-Internet
ip address 202.100.1.2 255.255.255.252
zone untrust
!
interface eth1
description To-Core-SW
ip address 192.168.1.254 255.255.255.0
zone trust
!
zone trust
priority 85
add interface eth1
!
zone untrust
priority 5
add interface eth0
!

# 查看会话
show session
Session Total: 1250

Source Destination Protocol State Timeout
192.168.1.100 8.8.8.8 ICMP ESTABLISHED 28
10.0.10.10 202.100.1.1 TCP ESTABLISHED 3600

# 1. 华为设备SNMP配置
[FGedu-Core-SW01] snmp-agent
[FGedu-Core-SW01] snmp-agent sys-info version v2c v3
[FGedu-Core-SW01] snmp-agent community read Fgedu@Read123
[FGedu-Core-SW01] snmp-agent community write Fgedu@Write123
[FGedu-Core-SW01] snmp-agent sys-info contact fgedu-admin@fgedu.net.cn
[FGedu-Core-SW01] snmp-agent sys-info location FGedu-IDC-Room-A01
[FGedu-Core-SW01] snmp-agent trap enable
[FGedu-Core-SW01] snmp-agent target-host trap address udp-domain 192.168.1.100 params securityname Fgedu@Read123 v2c

# 2. 监控脚本
#!/bin/bash
# 文件名: network_monitor.sh

DEVICES=(
“192.168.1.1:FGedu-Core-SW01”
“192.168.1.2:FGedu-Core-SW02”
“192.168.1.254:FGedu-Edge-Router01″
)

COMMUNITY=”Fgedu@Read123”

check_device() {
local ip=$1
local name=$2

# 检查设备可达性
ping -c 1 -W 2 $ip > /dev/null 2>&1
if [ $? -ne 0 ]; then
echo “CRITICAL: $name ($ip) 不可达”
return 1
fi

# 获取CPU使用率
cpu=$(snmpwalk -v2c -c $COMMUNITY $ip 1.3.6.1.4.1.2011.6.1.2.1.1.2 | awk -F’INTEGER: ‘ ‘{print $2}’)

# 获取内存使用率
mem=$(snmpwalk -v2c -c $COMMUNITY $ip 1.3.6.1.4.1.2011.6.1.2.1.1.3 | awk -F’INTEGER: ‘ ‘{print $2}’)

# 获取接口状态
interfaces=$(snmpwalk -v2c -c $COMMUNITY $ip 1.3.6.1.2.1.2.2.1.8 | grep -c “up(1)”)

echo “OK: $name ($ip) CPU: ${cpu}% Memory: ${mem}% Interfaces Up: $interfaces”
}

echo “=== 网络设备监控 ===”
echo “时间: $(date ‘+%Y-%m-%d %H:%M:%S’)”

for device in “${DEVICES[@]}”; do
IFS=’:’ read -r ip name <<< "$device" check_device $ip $name done $ chmod +x network_monitor.sh $ ./network_monitor.sh === 网络设备监控 === 时间: 2026-04-03 10:00:00 OK: FGedu-Core-SW01 (192.168.1.1) CPU: 15% Memory: 35% Interfaces Up: 24 OK: FGedu-Core-SW02 (192.168.1.2) CPU: 12% Memory: 32% Interfaces Up: 24 OK: FGedu-Edge-Router01 (192.168.1.254) CPU: 8% Memory: 28% Interfaces Up: 4 # 3. Prometheus监控配置 # prometheus.yml scrape_configs: - job_name: 'network-devices' static_configs: - targets: - '192.168.1.1' # FGedu-Core-SW01 - '192.168.1.2' # FGedu-Core-SW02 - '192.168.1.254' # FGedu-Edge-Router01 metrics_path: /snmp params: module: [if_mib] relabel_configs: - source_labels: [__address__] target_label: __param_target - source_labels: [__param_target] target_label: instance - target_label: __address__ replacement: snmp-exporter:9116

# 1. 连通性测试
# Ping测试
[FGedu-Core-SW01] ping 192.168.1.254
PING 192.168.1.254: 56 data bytes, press CTRL_C to break
Reply from 192.168.1.254: bytes=56 Sequence=1 ttl=255 time=1 ms
Reply from 192.168.1.254: bytes=56 Sequence=2 ttl=255 time=1 ms
Reply from 192.168.1.254: bytes=56 Sequence=3 ttl=255 time=1 ms
— 192.168.1.254 ping statistics —
3 packet(s) transmitted
3 packet(s) received
0.00% packet loss
round-trip min/avg/max = 1/1/1 ms

# Traceroute测试
[FGedu-Core-SW01] tracert 8.8.8.8
traceroute to 8.8.8.8(8.8.8.8), max hops: 30 ,packet length: 40,press CTRL_C to break
1 192.168.1.254 1 ms 1 ms 1 ms
2 202.100.1.1 2 ms 2 ms 2 ms
3 * * *
4 8.8.8.8 5 ms 5 ms 5 ms

# 2. 接口故障排查
# 查看接口状态
[FGedu-Core-SW01] display interface GigabitEthernet 0/0/1
GigabitEthernet0/0/1 current state : UP
Line protocol current state : UP
Description:FGedu-Server01
Switch Port, PVID : 10, TPID : 8100(Hex), The Maximum Frame Length is 9216
IP Sending Frames’ Format is PKTFMT_ETHNT_2, Hardware address is 00e0-fc12-3456
Last physical up time : 2026-04-03 09:00:00
Last physical down time : 2026-04-03 08:55:00
Current system time: 2026-04-03 10:00:00
Port Mode: COMMON FIBER
Speed : 1000,Loopback: NONE
Duplex: FULL,Negotiation: ENABLE
Mdi : AUTO

# 查看错误统计
[FGedu-Core-SW01] display interface GigabitEthernet 0/0/1 | include error
Input: 12345 packets, 1234567 bytes
0 broadcasts, 0 multicasts
0 errors, 0 drops
Output: 23456 packets, 2345678 bytes
0 broadcasts, 0 multicasts
0 errors, 0 drops

# 3. VLAN故障排查
# 查看VLAN状态
[FGedu-Core-SW01] display vlan 10
U: Up; D: Down; TG: Tagged; UT: Untagged;
MP: Vlan-mapping; ST: Vlan-stacking;
#: Protocol-transparent-vlan; *: Management-vlan;

VID Type Ports
——————————————————————————–
10 common UT:GE0/0/1(U) GE0/0/2(U) GE0/0/3(U)

# 查看MAC地址表
[FGedu-Core-SW01] display mac-address vlan 10
MAC Address VLAN/VSI Learned-From Type
——————————————————————————–
00e0-fc12-3456 10/- GE0/0/1 dynamic
00e0-fc12-3457 10/- GE0/0/2 dynamic
00e0-fc12-3458 10/- GE0/0/3 dynamic
——————————————————————————–
Total items displayed = 3

# 4. 路由故障排查
# 查看路由表
[FGedu-Edge-Router01] display ip routing-table 10.0.10.0
Route Flags: R – relay, D – download to fib
——————————————————————————
Routing Table : Public
Summary Count : 1

Destination/Mask Proto Pre Cost Flags NextHop Interface

10.0.10.0/24 Static 60 0 RD 192.168.1.1 GE0/0/1

# 查看ARP表
[FGedu-Edge-Router01] display arp
IP ADDRESS MAC ADDRESS EXPIRE(M) TYPE INTERFACE VPN-INSTANCE
VLAN/CEVLAN
192.168.1.1 00e0-fc12-3456 20 Dynamic GE0/0/1
202.100.1.1 00e0-fc12-3457 20 Dynamic GE0/0/0
——————————————————————————
Total:2 Dynamic:2 Static:0 Interface:0

# 5. 故障排查脚本
#!/bin/bash
# 文件名: network_troubleshoot.sh

TARGET=”8.8.8.8″

echo “=== 网络故障排查 ===”

# 1. 检查本地连接
echo -e “\n1. 检查本地网络接口:”
ip addr show | grep -E “inet |UP”

# 2. 检查路由
echo -e “\n2. 检查路由表:”
ip route show

# 3. 检查DNS
echo -e “\n3. 检查DNS解析:”
nslookup fgedu.net.cn

# 4. 检查连通性
echo -e “\n4. 检查连通性:”
ping -c 3 $TARGET

# 5. 检查路径
echo -e “\n5. 检查网络路径:”
traceroute $TARGET

# 6. 检查端口
echo -e “\n6. 检查端口连接:”
netstat -tuln | grep -E “:80|:443|:22”

$ chmod +x network_troubleshoot.sh
$ ./network_troubleshoot.sh
=== 网络故障排查 ===

1. 检查本地网络接口:
2: eth0: mtu 1500 qdisc mq state UP group default qlen 1000
inet 192.168.1.100/24 brd 192.168.1.255 scope global eth0

2. 检查路由表:
default via 192.168.1.254 dev eth0
10.0.0.0/16 via 192.168.1.1 dev eth0
192.168.1.0/24 dev eth0 proto kernel scope link src 192.168.1.100

3. 检查DNS解析:
Server: 192.168.1.1
Address: 192.168.1.1#53

Non-authoritative answer:
Name: fgedu.net.cn
Address: 202.100.1.10

4. 检查连通性:
PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data.
64 bytes from 8.8.8.8: icmp_seq=1 ttl=117 time=5.21 ms
64 bytes from 8.8.8.8: icmp_seq=2 ttl=117 time=5.18 ms
64 bytes from 8.8.8.8: icmp_seq=3 ttl=117 time=5.15 ms

5. 检查网络路径:
traceroute to 8.8.8.8 (8.8.8.8), 30 hops max, 60 byte packets
1 192.168.1.254 (192.168.1.254) 0.521 ms 0.498 ms 0.475 ms
2 202.100.1.1 (202.100.1.1) 2.123 ms 2.098 ms 2.075 ms
3 * * *
4 8.8.8.8 (8.8.8.8) 5.210 ms 5.185 ms 5.162 ms

6. 检查端口连接:
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN
tcp 0 0 0.0.0.0:80 0.0.0.0:* LISTEN
tcp 0 0 0.0.0.0:443 0.0.0.0:* LISTEN