eNSP华为路由器、交换机、防火墙常用命令大全VRP系统直接复制可用视图说明Huawei 用户视图查看、保存、重启[Huawei] 系统视图全局配置[Huawei‑GigabitEthernet0/0/0] 接口视图一、通用基础命令路由/交换/防火墙全部适用system-view # 进入系统视图 缩写 syssysname R1 # 修改设备名称undo info-center enable # 关闭不断弹出日志提示quit # 返回上一级视图 缩写 qsave # 保存配置用户视图执行display current-configuration # 查看当前运行配置 缩写 dis curdisplay saved-configuration # 查看已保存配置display version # 查看VRP版本display interface brief # 快速查看所有接口状态与IPdisplay ip interface brief # 查看三层接口IPdisplay this # 查看当前视图配置reset saved-configuration # 清空保存配置重启生效reboot # 重启设备用户视图language-mode Chinese # 切换中文提示? # 命令帮助tab # 命令补全接口通用命令interface GigabitEthernet 0/0/0 # 进入千兆接口 int g0/0/0ip address 192.168.1.1 24 # 配置IP掩码24等价255.255.255.0shutdown # 关闭接口undo shutdown # 开启接口默认部分设备接口关闭description To‑SW1 # 接口备注名称二、交换机S3700/S5700专属命令VLAN配置vlan 10 # 创建单个VLAN10vlan batch 10 20 30 # 批量创建vlan10、20、30undo vlan 10 # 删除VLAN# Access口接电脑终端int g0/0/1port link-type accessport default vlan 10# Trunk口交换机之间互联int g0/0/2port link-type trunkport trunk allow-pass vlan 10 20port trunk allow-pass vlan all # 放行所有vlan实验用生产禁止# Hybrid口较少用port link-type hybriddisplay vlan # 查看vlan信息display port vlan # 查看端口vlan划分display mac-address # 查看MAC地址表三层交换机VLANIFSVI网关接口interface Vlanif 10ip address 192.168.10.254 24undo shutdownSTP生成树stp mode rstpstp priority 4096display stp brief链路聚合Eth‑Trunkinterface Eth‑Trunk 1trunkport GigabitEthernet 0/0/3 to 0/0/4三、路由器AR2220/AR3260路由相关命令静态路由ip route-static 192.168.2.0 255.255.255.0 12.1.1.2ip route-static 0.0.0.0 0.0.0.0 12.1.1.2 # 默认路由display ip routing-table # 查看路由表 dis ip roOSPF动态路由最常用ospf 1 router‑id 1.1.1.1area 0network 192.168.1.0 0.0.0.255display ospf peer brief # 查看OSPF邻居display ospf lsdb # 查看链路状态数据库RIPrip 1version 2network 192.168.1.0ACL访问控制列表路由器、三层交换机通用acl number 2000 # 基础ACL仅源IPrule permit source 192.168.1.0 0.0.0.255rule deny source anyacl number 3000 # 高级ACL源目的端口rule permit tcp source 192.168.1.0 0.0.0.255 destination 192.168.2.1 0 eq 80rule deny ip# 接口下发ACLint g0/0/0packet‑filter 3000 inbounddisplay acl allNAT路由器PATacl 2000rule permit source 192.168.1.0 0.0.0.255int g0/0/0nat outbound 2000DHCP服务器路由器/三层交换机dhcp enableip pool VLAN10network 192.168.10.0 mask 255.255.255.0gateway‑list 192.168.10.254dns‑list 223.5.5.5lease day 7int Vlanif 10dhcp select globalVRRP网关冗余interface Vlanif10vrrp vrid 10 virtual‑ip 192.168.10.254vrrp vrid 10 priority 120display vrrp brief四、防火墙 USG6000VeNSP模拟器防火墙重点默认账号admin初始密码Admin123首次登录强制改密码防火墙核心接口IP 加入安全区域 安全策略放行流量默认域之间全部阻断必须手动放通策略基础配置system‑viewsysname FWundo info‑center enable# 接口配置划入安全域int GigabitEthernet 0/0/0ip address 192.168.1.1 24service‑manage ping permit # 允许ping该接口zone trust # 内网‑信任区域quitint GigabitEthernet 0/0/1ip address 202.100.1.1 24service‑manage ping permitzone untrust # 外网‑非信任区域quitint GigabitEthernet 0/0/2ip address 172.16.1.1 24zone dmz # 服务器区安全策略新版USG策略命令eNSP版本security‑policyrule name trust‑to‑untrustsource‑zone trustdestination‑zone untrustsource‑address 192.168.1.0 mask 255.255.255.0destination‑address anyservice anyaction permitquitdisplay security‑policy all # 查看安全策略display session table # 查看会话表排错必看防火墙NAT源NAT上网PATnat‑policyrule name nat‑internetsource‑zone trustdestination‑zone untrustsource‑address 192.168.1.0 24action nat easy‑ip防火墙静态路由ip route‑static 0.0.0.0 0.0.0.0 202.100.1.2display ip routing‑table防火墙开启Web管理https 8443端口web‑manager enableint g0/0/0service‑manage https permit#浏览器访问 https://192.168.0.1:8443查看与排错命令防火墙display zone # 查看安全域display firewall session table # 会话表display nat session all五、远程管理命令Telnet / SSH# Telnet明文实验用telnet server enableuser‑interface vty 0 4authentication‑mode passwordset authentication password simple Huawei123# SSH加密推荐stelnet server enablersa local‑key‑pair createaaalocal‑user admin password simple Admin123local‑user admin service‑type sshlocal‑user admin privilege‑level 3六、常用排错命令汇总ping 192.168.1.1tracert 8.8.8.8display arpdisplay logbufferdisplay cpu‑usage