# 交换机优化配置（Cisco示例）
$ cat > /tmp/switch_optimization.txt << 'EOF' ! 交换机性能优化配置 ! 1. 启用快速生成树 spanning-tree mode rapid-pvst spanning-tree portfast default ! 2. 配置端口聚合 interface Port-channel1 description Link Aggregation switchport mode trunk channel-protocol lacp channel-group 1 mode active ! 3. 配置QoS mls qos interface GigabitEthernet0/1 wrr-queue bandwidth 10 20 30 40 wrr-queue cos-map 1 0 1 wrr-queue cos-map 2 2 3 wrr-queue cos-map 3 4 5 wrr-queue cos-map 4 6 7 ! 4. 启用流量控制 flowcontrol receive desired flowcontrol send desired ! 5. 配置端口安全 interface GigabitEthernet0/1 switchport port-security switchport port-security maximum 10 switchport port-security violation restrict ! 6. 优化MAC地址表 mac address-table aging-time 300 ! 7. 启用IGMP Snooping ip igmp snooping ! 8. 配置风暴控制 interface GigabitEthernet0/1 storm-control broadcast level 10.00 storm-control multicast level 20.00 storm-control action shutdown EOF

# 路由器优化配置（Cisco示例）
$ cat > /tmp/router_optimization.txt << 'EOF' ! 路由器性能优化配置 ! 1. 优化路由协议 router ospf 1 router-id 1.1.1.1 auto-cost reference-bandwidth 10000 timers throttle spf 5 100 5000 timers throttle lsa 5 100 5000 timers lsa arrival 10 ! 2. 配置CEF ip cef ip cef accounting per-prefix ! 3. 优化BGP router bgp 65001 bgp router-id 1.1.1.1 bgp always-compare-med bgp bestpath as-path ignore timers bgp 10 30 ! 4. 配置QoS class-map VOICE match ip dscp ef class-map VIDEO match ip dscp af41 policy-map WAN-QOS class VOICE priority 1000 class VIDEO bandwidth 2000 class class-default fair-queue interface GigabitEthernet0/0 service-policy output WAN-QOS ! 5. 启用NetFlow ip flow-export destination 192.168.1.100 2055 ip flow-export version 9 interface GigabitEthernet0/0 ip flow ingress ip flow egress ! 6. 优化ACL ip access-list extended ALLOW-TRAFFIC permit tcp any any established permit icmp any any echo-reply deny ip any any log ! 7. 配置NAT优化 ip nat translation timeout 300 ip nat translation tcp-timeout 3600 ip nat translation udp-timeout 300 ! 8. 启用路由缓存 ip route-cache flow ip route-cache cef EOF

风哥风哥提示：网络设备优化需要根据实际网络架构和业务需求进行合理配置，避免过度优化导致网络不稳定。

7. 负载均衡优化

7.1 负载均衡配置

# Nginx负载均衡配置
$ cat > /etc/nginx/conf.d/load-balancing.conf << 'EOF' # 负载均衡配置 upstream backend { # 负载均衡算法 least_conn; # 后端服务器 server 192.168.1.101:8080 weight=5 max_fails=3 fail_timeout=30s; server 192.168.1.102:8080 weight=5 max_fails=3 fail_timeout=30s; server 192.168.1.103:8080 weight=5 max_fails=3 fail_timeout=30s backup; # 健康检查 check interval=3000 rise=2 fall=3 timeout=1000 type=http; check_http_send "GET /health HTTP/1.0\r\n\r\n"; check_http_expect_alive http_2xx http_3xx; # 长连接 keepalive 32; keepalive_timeout 60s; keepalive_requests 100; } server { listen 80; server_name www.fgedu.net.cn; # 代理配置 location / { proxy_pass http://backend; proxy_http_version 1.1; proxy_set_header Connection ""; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; # 超时配置 proxy_connect_timeout 60s; proxy_send_timeout 60s; proxy_read_timeout 60s; # 缓冲配置 proxy_buffer_size 16k; proxy_buffers 4 64k; proxy_busy_buffers_size 128k; } # 状态监控 location /nginx_status { stub_status on; access_log off; allow 192.168.1.0/24; deny all; } } EOF

# HAProxy负载均衡配置
$ cat > /etc/haproxy/haproxy.cfg << 'EOF' global log /dev/log local0 log /dev/log local1 notice chroot /var/lib/haproxy stats socket /run/haproxy/admin.sock mode 660 level admin stats timeout 30s user haproxy group haproxy daemon maxconn 4000 defaults log global mode http option httplog option dontlognull timeout connect 5000 timeout client 50000 timeout server 50000 retries 3 option redispatch maxconn 3000 frontend http_front bind *:80 acl url_static path_beg -i /static /images /javascript /stylesheets acl url_static path_end -i .jpg .gif .png .css .js use_backend static if url_static default_backend http_back backend static balance roundrobin option httpchk GET /health server static1 192.168.1.101:80 check inter 3000 rise 2 fall 3 server static2 192.168.1.102:80 check inter 3000 rise 2 fall 3 backend http_back balance leastconn option httpchk GET /health option http-server-close option forwardfor except 127.0.0.0/8 option redispatch retries 3 timeout http-request 10s timeout queue 1m timeout connect 10s timeout client 1m timeout server 1m timeout http-keep-alive 10s timeout check 10s maxconn 3000 server app1 192.168.1.101:8080 check inter 3000 rise 2 fall 3 weight 5 server app2 192.168.1.102:8080 check inter 3000 rise 2 fall 3 weight 5 server app3 192.168.1.103:8080 check inter 3000 rise 2 fall 3 weight 5 backup listen stats bind *:8080 stats enable stats uri /stats stats refresh 10s stats auth admin:password stats admin if TRUE EOF

# 网络监控系统配置
$ cat > /usr/local/bin/network_monitoring_system.sh << 'EOF' #!/bin/bash echo "配置网络监控系统..." # 1. 安装监控工具 echo "安装监控工具..." yum install -y net-snmp net-snmp-utils nagios-plugins # 2. 配置SNMP echo "配置SNMP..." cat > /etc/snmp/snmpd.conf << 'SNMP' rocommunity public 192.168.1.0/24 sysLocation "Server Room" sysContact "admin@fgedu.net.cn" sysServices 72 SNMP systemctl start snmpd systemctl enable snmpd # 3. 配置网络监控 echo "配置网络监控..." cat > /etc/nagios/nrpe.cfg << 'NRPE' log_facility=daemon pid_file=/var/run/nrpe/nrpe.pid server_port=5666 nrpe_user=nrpe nrpe_group=nrpe allowed_hosts=192.168.1.100 dont_blame_nrpe=0 debug=0 command_timeout=60 connection_timeout=300 command[check_load]=/usr/lib64/nagios/plugins/check_load -w 15,10,5 -c 30,25,20 command[check_mem]=/usr/lib64/nagios/plugins/check_mem -w 80% -c 90% command[check_disk]=/usr/lib64/nagios/plugins/check_disk -w 20% -c 10% -p / command[check_network]=/usr/lib64/nagios/plugins/check_network -w 1000 -c 5000 NRPE systemctl start nrpe systemctl enable nrpe # 4. 配置流量监控 echo "配置流量监控..." cat > /etc/collectd/collectd.conf << 'COLLECTD' Hostname "server.fgedu.net.cn" FQDNLookup true BaseDir "/var/lib/collectd" PIDFile "/var/run/collectd.pid" PluginDir "/usr/lib64/collectd" TypesDB "/usr/share/collectd/types.db" LoadPlugin interface LoadPlugin network LoadPlugin snmp
Interface “eth0”
IgnoreSelected false

Server “192.168.1.100” “25826”

Type “if_octets”
Table true
Instance “IF-MIB::ifDescr”
Values “IF-MIB::ifInOctets” “IF-MIB::ifOutOctets”

Address “192.168.1.1”
Version 2
Community “public”
Collect “if_octets”


COLLECTD

systemctl start collectd
systemctl enable collectd

echo “网络监控系统配置完成”
EOF

$ chmod +x /usr/local/bin/network_monitoring_system.sh

# 网络告警配置脚本
$ cat > /usr/local/bin/network_alert_config.sh << 'EOF' #!/bin/bash echo "配置网络告警..." # 1. 配置告警规则 echo "配置告警规则..." cat > /etc/nagios/objects/network_alerts.cfg << 'ALERT' define service { use generic-service host_name server.fgedu.net.cn service_description Network Traffic check_command check_network_traffic!eth0!1000!5000 max_check_attempts 3 check_interval 5 retry_interval 1 contact_groups admins notification_interval 30 notification_period 24x7 notification_options w,u,c,r } define service { use generic-service host_name server.fgedu.net.cn service_description Network Latency check_command check_ping!8.8.8.8!100.0,20%!500.0,60% max_check_attempts 3 check_interval 5 retry_interval 1 contact_groups admins notification_interval 30 notification_period 24x7 notification_options w,u,c,r } define service { use generic-service host_name server.fgedu.net.cn service_description Network Errors check_command check_network_errors!eth0!100!500 max_check_attempts 3 check_interval 5 retry_interval 1 contact_groups admins notification_interval 30 notification_period 24x7 notification_options w,u,c,r } ALERT # 2. 配置告警通知 echo "配置告警通知..." cat > /etc/nagios/objects/contacts.cfg << 'CONTACT' define contact { contact_name network-admin alias Network Administrator service_notification_period 24x7 host_notification_period 24x7 service_notification_options w,u,c,r host_notification_options d,u,r service_notification_commands notify-service-by-email host_notification_commands notify-host-by-email email network-admin@fgedu.net.cn } define contactgroup { contactgroup_name admins alias Network Administrators members network-admin } CONTACT # 3. 配置邮件通知 echo "配置邮件通知..." cat > /etc/nagios/objects/commands.cfg << 'COMMAND' define command { command_name notify-host-by-email command_line /usr/bin/printf "%b" "***** Nagios *****\n\nNotification Type: $NOTIFICATIONTYPE$\nHost: $HOSTNAME$\nState: $HOSTSTATE$\nAddress: $HOSTADDRESS$\nInfo: $HOSTOUTPUT$\n\nDate/Time: $LONGDATETIME$\n" | /usr/bin/mail -s "** $NOTIFICATIONTYPE$ Host Alert: $HOSTNAME$ is $HOSTSTATE$ **" $CONTACTEMAIL$ } define command { command_name notify-service-by-email command_line /usr/bin/printf "%b" "***** Nagios *****\n\nNotification Type: $NOTIFICATIONTYPE$\n\nService: $SERVICEDESC$\nHost: $HOSTALIAS$\nAddress: $HOSTADDRESS$\nState: $SERVICESTATE$\n\nDate/Time: $LONGDATETIME$\n\nAdditional Info:\n\n$SERVICEOUTPUT$\n" | /usr/bin/mail -s "** $NOTIFICATIONTYPE$ Service Alert: $HOSTALIAS$/$SERVICEDESC$ is $SERVICESTATE$ **" $CONTACTEMAIL$ } COMMAND echo "网络告警配置完成" EOF $ chmod +x /usr/local/bin/network_alert_config.sh

更多学习教程公众号风哥教程itpux_com

9. 网络故障排查

9.1 网络故障排查流程

# 网络故障排查脚本
$ cat > /usr/local/bin/network_troubleshoot.sh << 'EOF' #!/bin/bash echo "开始网络故障排查..." # 1. 检查网络接口 echo "=== 网络接口检查 ===" ip addr show # 2. 检查路由表 echo -e "\n=== 路由表检查 ===" ip route show # 3. 检查DNS解析 echo -e "\n=== DNS解析检查 ===" nslookup www.fgedu.net.cn # 4. 检查网络连通性 echo -e "\n=== 网络连通性检查 ===" ping -c 5 8.8.8.8 # 5. 检查端口连接 echo -e "\n=== 端口连接检查 ===" netstat -antp | grep LISTEN # 6. 检查防火墙规则 echo -e "\n=== 防火墙规则检查 ===" iptables -L -n -v # 7. 检查网络统计 echo -e "\n=== 网络统计检查 ===" netstat -s | head -30 # 8. 检查ARP表 echo -e "\n=== ARP表检查 ===" ip neigh show # 9. 检查网络错误 echo -e "\n=== 网络错误检查 ===" cat /proc/net/dev | grep -E "eth0|lo" # 10. 检查网络日志 echo -e "\n=== 网络日志检查 ===" tail -20 /var/log/messages | grep -i network echo "网络故障排查完成" EOF $ chmod +x /usr/local/bin/network_troubleshoot.sh