ne40e开局

undo shutdown
ip address 218.6.32.53 255.255.255.252
interface GigabitEthernet2/0/0
mtu 1600
description TO LY-XL-LC-NE5000e-C-1.MAN GE17/0/3
undo shutdown
ntp-service unicast-server 218.6.33.8
5、 SYSLOG目的服务器配置
info-center loghost source LoopBack0
info-center loghost 61.154.52.25
info-center loghost 61.154.52.26
好多数通工程师开局的时候都是从老设备上扒脚本，然后按照需要修改，现在福利来了，完整的NE40E&NE80E开局规范全部送上。
工具/原料
清醒的头脑和一台不蓝屏抽风的笔记本
操作前记得跪拜华为设备，毕竟有时候设备抽风会令人崩溃的
方法/步骤
1、 配置设备命名：
Sysname LY-XL-SZ-NE40e-A-1.MAN *按实际规划配置
import-route unr type 1
area 0.0.0.0
network 10.200.0.92 0.0.0.3
9、 配置itv用户域ly_iptv
Itv用户域配置：配置认证、授权、计费方式为none：
aaa
authentication-scheme ly_iptv
6、 SNMP网管配置
snmp-agent
snmp-agent community write 319,lynms acl 2000
snmp-agent community read lynms,319 acl 2000
snmp-agent sys-info version all
rule 1 permit source 218.6.33.8 0
rule 10 deny
ntp-service source-interface LoopBack0
ntp-service access peer 2001
ntp-service unicast-server 218.6.33.7
rule 30 permit udp destination-port range 135 netbios-ssn
rule 35 permit tcp destination-port eq 445
rule 40 permit udp destination-port eq 445
rule 45 permit tcp destination-port eq 539
rule 75 permit source 61.131.121.79 0
rule 80 permit source 61.131.121.86 0
rule 85 permit source 61.131.121.88 0
rule 90 permit source 61.131.121.93 0
authentication-mode none
authorization-scheme ly_iptv
authorization-mode none
accounting-scheme ly_iptv
accounting-mode none
10、配置病毒防护规范
Acl number 3000
rule 15 permit tcp destination-port eq 4444
rule 20 permit udp destination-port eq 8998
rule 25 permit tcp destination-port range 135 139
snmp-agent target-host trap address udp-domain 61.154.52.25 params securityname lydx v2c
snmp-agent target-host trap address udp-domain 61.154.52.26 params securityname lydx v2c
rule 90 permit tcp source-port eq 2745
rule 95 permit tcp source-port eq 6667
rule 100 permit tcp source-port eq 8866
rule 105 permit tcp source-port eq 31337
domain ly_iptv
authentication-scheme ly_iptv
authorization-scheme ly_iptv
accounting-scheme ly_iptv
dhcp relay address 10.200.0.93 gateway 117.31.174.129 255.255.255.192 *注意dhcp relay地址是下一跳的接口地址
rule 95 permit source 172.31.0.45 0
rule 200 deny
*在服务器端生成本地密钥对
rsa local-key-pair create * (1024) 注意修改长度1024
*使能ssh服务
stelnet server enable
traffic classifier anti_virus
if-match acl 3000
rule 35 permit source 172.31.0.8 0
rule 40 permit source 172.31.0.9 0
rule 45 permit source 202.101.113.40 0
rule 50 permit source 61.131.121.66 0
2、 配置设备loopback地址：
interface LoopBack0
description For-Chinanet
ip address 218.6.33.241 32 *按规划配置
interface LoopBack1
description For-Mplsvpn
rule 70 permit udp destination-port eq 1433
rule 75 permit udp destination-port eq 1434
rule 80 permit tcp source-port eq 3127
rule 85 permit tcp source-port eq 3176
全局配置过滤策略：
ip ip-prefix iptv_permit index 10 permit 117.31.174.128 26 *配置放行本地iptv unr路由。
ospf 2
filter-policy ip-prefix iptv_permit export unr *引用策略
rule 50 permit udp destination-port eq 539
rule 55 permit tcp destination-port eq 593
rule 60 permit udp destination-port eq 593
rule 65 permit udp destination-port range 995 999
interface GigabitEthernet1/0/2
description to LY-XL-ZHDL-S8505-A-3.IDC GE4/1/19
undo shutdown
8、 启用ospf（注意必须联系网操中心数据组配合开通）
router id 218.6.33.241
ssh user fjnms
ssh user fjnms authentication-type password
ssh user fjnms service-type stelnet
aaa
local-user huawei800 password cipher huawei,800
user-interface vty 0 4
acl 2000 inbound
authentication-mode aaa
protocol inbound ssh
4、 NTP时钟同步设置
acl number 2001
rule 0 permit source 218.6.33.7 0
ip address 218.6.33.243 32 *按规划配置
3、 Ssh远程配置用户名密码：
Acl number 2000
rule 25 permit source 61.154.52.25 0
rule 26 permit source 61.154.52.26 0
rule 30 permit source 172.31.0.3 0
新建用户名为huawei800,fjnms的SSH 用户，且认证方式为password。
ssh user huawei800
ssh user huawei800 authentication-type password
ssh user huawei800 service-type stelnet
snmp-agent trap enable standard
7、 配置上行端口接口地址 （正常需开通4条上行中继，具体按规划）