Configuration Files
S1720&S2700&S3700&S5700&S6700&S7700&S9700 Series Switches
Core switch configuration file # sysname CORE # vlan batch 100 # interface Vlanif100 ip address 10.10.100.4 255.255.255.0 # interface Eth-Trunk3 port link-type trunk port trunk allow-pass vlan 100 mode lacp # interface Eth-Trunk4 port link-type trunk port trunk allow-pass vlan 100 mode lacp # interface GigabitEthernet0/0/3 eth-trunk 3 # interface GigabitEthernet0/0/4 eth-trunk 4 # interface GigabitEthernet1/0/3 eth-trunk 3 # interface GigabitEthernet1/0/4 eth-trunk 4 # ospf 1 router-id 10.3.3.3 area 0.0.0.0 network 10.10.100.0 0.0.0.255 network 10.10.10.0 0.0.0.255 network 10.10.20.0 0.0.0.255 network 10.10.30.0 0.0.0.255 # ip route-static 0.0.0.0 0.0.0.0 10.10.100.1 # return Issue 06 (2016-03-16) Huawei Proprietary and Confidential Copyright © Huawei Technologies Co., Ltd. 21 l RouterA configuration file # sysname RouterA # acl number 3000 rule 5 deny ip source 10.10.10.0 0.0.0.255 destination 10.10.200.0 0.0.0.255 rule 10 deny ip source 10.10.20.0 0.0.0.255 destination 10.10.200.0 0.0.0.255 rule 15 permit ip source 10.10.10.0 0.0.0.255 acl number 3001 rule 5 permit ip source 10.10.10.0 0.0.0.255 destination 10.10.200.0 0.0.0.255 rule 10 permit ip source 10.10.20.0 0.0.0.255 destination 10.10.200.0 0.0.0.255 # ipsec proposal tran1 esp authentication-algorithm sha2-256 esp encryption-algorithm aes-128 # ike proposal 5 encryption-algorithm aes-cbc-128 # ike peer vpn v1 pre-shared-key cipher "@J*U2S*(7F,YWX*NZ55OA!! ike-proposal 5 dpd type periodic dpd idle-time 10 remote-address 203.10.1.2 # ipsec policy ipsec_vpn 10 isakmp security acl 3001 ike-peer vpn proposal tran1 # interface Eth-Trunk1 undo portswitch mode lacp-static # interface Eth-Trunk1.100 dot1q termination vid 100 ip address 10.10.100.2 255.255.255.0 vrrp vrid 1 virtual-ip 10.10.100.1 vrrp vrid 1 priority 120 vrrp vrid 1 track interface GigabitEthernet1/0/0 reduced 40 arp broadcast enable # interface GigabitEthernet1/0/0 ip address 202.10.1.2 255.255.255.0 ipsec policy ipsec_vpn nat server protocol tcp global 202.10.100.3 www inside 10.10.30.2 8080 nat outbound 3000 # interface GigabitEthernet2/0/0 eth-trunk 1 # interface GigabitEthernet2/0/1 eth-trunk 1 # ospf 1 router-id 10.1.1.1 area 0.0.0.0 network 10.10.100.0 0.0.0.255 # ip route-static 0.0.0.0 0.0.0.0 202.10.1.1 # return l RouterB configuration file # sysname RouterB Issue 06 (2016-03-16) Huawei Proprietary and Confidential Copyright © Huawei Technologies Co., Ltd. 22 # acl number 3000 rule 5 deny ip source 10.10.10.0 0.0.0.255 destination 10.10.200.0 0.0.0.255 rule 10 deny ip source 10.10.20.0 0.0.0.255 destination 10.10.200.0 0.0.0.255 rule 15 permit ip source 10.10.10.0 0.0.0.255 acl number 3001 rule 5 permit ip source 10.10.10.0 0.0.0.255 destination 10.10.200.0 0.0.0.255 rule 10 permit ip source 10.10.20.0 0.0.0.255 destination 10.10.200.0 0.0.0.255 # ipsec proposal tran1 esp authentication-algorithm sha2-256 esp encryption-algorithm aes-128 # ike proposal 5 encryption-algorithm aes-cbc-128 # ike peer vpn v1 pre-shared-key cipher "@J*U2S*(7F,YWX*NZ55OA!! ike-proposal 5 dpd type periodic dpd idle-time 10 remote-address 203.10.1.2 # ipsec policy ipsec_vpn 10 isakmp security acl 3001 ike-peer vpn proposal tran1 # interface Eth-Trunk1 undo portswitch mode lacp-static # interface Eth-Trunk1.100 dot1q termination vid 100 ip address 10.10.100.3 255.255.255.0 vrrp vrid 1 virtual-ip 10.10.100.1 arp broadcast enable # interface GigabitEthernet1/0/0 ip address 202.10.2.2 255.255.255.0 ipsec policy ipsec_vpn nat server protocol tcp global 202.10.100.3 www inside 10.10.30.2 8080 nat outbound 3000 # interface GigabitEthernet2/0/0 eth-trunk 1 # interface GigabitEthernet2/0/1 eth-trunk 1 # ospf 1 router-id 10.2.2.2 area 0.0.0.0 network 10.10.100.0 0.0.0.255 # ip route-static 0.0.0.0 0.0.0.0 202.10.2.1 # return l Configuration file of the branch egress router RouterC # sysname RouterC # acl number 3000 rule 5 deny ip source 10.10.200.0 0.0.0.255 destination 10.10.10.0 0.0.0.255 rule 10 deny ip source 10.10.200.0 0.0.0.255 destination 10.10.20.0 0.0.0.255 rule 15 permit ip source 10.10.200.0 0.0.0.255 Issue 06 (2016-03-16) Huawei Proprietary and Confidential Copyright © Huawei Technologies Co., Ltd. 23 acl number 3001 rule 5 permit ip source 10.10.200.0 0.0.0.255 destination 10.10.10.0 0.0.0.255 rule 10 permit ip source 10.10.200.0 0.0.0.255 destination 10.10.20.0 0.0.0.255 # ipsec proposal tran1 esp authentication-algorithm sha2-256 esp encryption-algorithm aes-128 # ike proposal 5 encryption-algorithm aes-cbc-128 # ike peer vpnr1 v1 pre-shared-key cipher "@J*U2S*(7F,YWX*NZ55OA!! ike-proposal 5 dpd type periodic dpd idle-time 10 remote-address 202.10.1.2 # ike peer vpnr2 v1 pre-shared-key cipher "@J*U2S*(7F,YWX*NZ55OA!! ike-proposal 5 dpd type periodic dpd idle-time 10 remote-address 202.10.2.2 # ipsec policy ipsec_vpn 10 isakmp security acl 3001 ike-peer vpnr1 proposal tran1 # ipsec policy ipsec_vpn 20 isakmp security acl 3001 ike-peer vpnr2 proposal tran1 # interface GigabitEthernet1/0/0 ip address 203.10.1.2 255.255.255.0 ipsec policy ipsec_vpn nat outbound 3000 # ip route-static 0.0.0.0 0.0.0.0 203.10.1.1 # return l Configuration file of the headquarters carrier router RouterD # sysname RouterD # interface GigabitEthernet1/0/0 ip address 202.10.1.1 255.255.255.0 # interface GigabitEthernet2/0/0 ip address 202.10.2.1 255.255.255.0 # ip route-static 202.10.100.0 255.255.255.0 202.10.1.2 preference 40 ip route-static 202.10.100.0 255.255.255.0 202.10.2.2 # return l Configuration file of the branch carrier router RouterE # sysname RouterE # interface GigabitEthernet1/0/0 ip address 203.10.1.1 255.255.255.0 # return











