Cisco 2950 一公司标准配置
如下�橐慌_�称�I的CISCO2950J交�Q�C��逝渲�
1.
清空vlan ,
清空配置文件，然後重新��樱�
Switch#delete flash:vlan.dat ---
�h除
vlan
Switch#erase startup-config ---
清除配置文件
Switch#reload ---
重新��咏�Q�C
2.
重新配置交�Q�C
配置交�Q�C名�Q、密�a（
enable
、
secret
）
Switch(config)#hostname A-F 5-2-01 -A ---
把交�Q�C命名成
A-F5-2-01-A
A-F 5-2-01 -A(config)#enable password switch ---
�O置
enable
密�a��
switch
A-F 5-2-01 -A(config)#enable secret cisco ---
�O置
secret
密�a��
cisco
3.
配置vlan(
有�煞N方法配置vlan)
a.
�M配置模式配置
A-F 5-2-01 -A#conf t
A-F 5-2-01 -A(config)#vlan 455 ---
新增
vlan455
A-F 5-2-01 -A(config-vlan)#vlan 456 ---
新增
vlan456
A-F 5-2-01 -A(config-vlan)#vlan 457 ---
新增
vlan457
A-F 5-2-01 -A(config-vlan)#vlan 458 ---
新增
vlan458
b.
�M
vlan database
配置（此模式下不可以用
end
退出，只能用
exit
退出）
A-F 5-2-01 -A#vlan database ---
�M入
vlan database
模式
A-F 5-2-01 -A(vlan)#vlan 465
VLAN 465 added:
Name: VLAN0465
默�J名�Q��
vlan+0+vlan
名�Q
A-F 5-2-01 -A(vlan)#vlan 466 ---
新增
vlan465
VLAN 466 added:
Name: VLAN0466 ---vlan
系�y默�J名�Q��
VLAN0466
A-F 5-2-01 -A(vlan)#vlan 467 name 467 ---vlan
取名��
467
VLAN 467 added:
Name: 467
A-F 5-2-01 -A(vlan)#
A-F 5-2-01 -A(vlan)#end ---end
退出�箦e�`，此模式下只能用
exit
退出
^
% Invalid input detected at '^' marker.
A-F 5-2-01 -A(vlan)#exit ---exit
退出正常
APPLY completed.
Exiting....
A-F 5-2-01 -A#
4.
配置管理IP
、缺省�W�P、配置vty
、console
�B接、添加登入�~�
A-F 5-2-01 -A(config)#interface vlan 455
A-F 5-2-01 -A(config-if)#ip address 192.168.1.1. 255.255.255.0 ---
配置管理
IP
A-F 5-2-01 -A(config)#ip default-gateway 192.168. 1.250---
配置缺省�W�P
A-F 5-2-01 -A(config)#line ?
<0-16> First Line number
console Primary terminal line
vty Virtual terminal
A-F 5-2-01 -A(config)#line vty 0 4
---
配置
VTY
，�共可以同�r通�^
5
���B接
A-F 5-2-01 -A(config-line)#password switch
---
配置�B接密�a
switch
A-F 5-2-01 -A(config-line)#login
---
一定得配
login
否�t前面配
vty
�o效
A-F 5-2-01 -A#conf t
A-F 5-2-01 -A(config)#line console 0
---
配
console
�B接，此�勿配密�a
A-F 5-2-01 -A(config-line)#logging synchronous
A-F 5-2-01 -A(config-line)# end
A-F 5-2-01 -A#conf t
Enter configuration commands, one per line. End with CNTL/Z.
A-F 5-2-01 -A(config)#usern
A-F 5-2-01 -A(config)#username echo pr
A-F 5-2-01 -A(config)#username echo privilege 15 pass
A-F 5-2-01 -A(config)#username echo privilege 15 password echo
---
配置登��~�，�嘞�
15
�，最高
(
service password encryption
�~�加密命令
，
可配可不配
，
配了密�a
show
看不到
)
A-F 5-2-01 -A#
5.
配置主端口、配置主端口允�S通�^的vlan
、配置端口描述
A-F 5-2-01 -A#conf t
A-F 5-2-01 -A(config)#interface gi0/1
---
�M入千兆
1
端口
A-F 5-2-01 -A(config-if)#switchport mode trunk
---
配置
trunk
模式，此模式可�B交�Q�C
A-F 5-2-01 -A(config-if)#no shutdown
---
�_�⒍丝�
A-F 5-2-01 -A(config-if)#exit
A-F 5-2-01 -A(config)#interface gi0/2
---
�M入千兆
2
端口
A-F 5-2-01 -A(config-if)#switchport mode trunk
A-F 5-2-01 -A(config-if)#no shutdown
A-F 5-2-01 -A(config)#interface range gi0/1 -2
---
同�r�M入
2
��千兆口
A-F 5-2-01 -A(config-if-range)#switchport trunk allowed vlan 455,456
------
允�S
vlan 455,456
通�^
A-F 5-2-01 -A(config-if-range)#switchport trunk allow vlan add 465,466
------
增加
vlan 465,466
通�^，一定要加
add
，否�t是替代不是增加
A-F 5-2-01 -A(config-if-range)#end
A-F 5-2-01 -A#conf t
A-F 5-2-01 -A(config)#interface gi0/1
A-F 5-2-01 -A(config-if)#description connect to 4506
---
配置端口描述
A-F 5-2-01 -A(config-if)#exit
A-F 5-2-01 -A(config)#interface gi0/2
A-F 5-2-01 -A(config-if)#description connect to 4506
---
配置端口描述
A-F 5-2-01 -A(config-if)#exit
A-F 5-2-01 -A(config)#interface range fa0/1 �C 2
---
同�r配置
1-2
�端口
A-F 5-2-01 -A(config-if-range)#switchport mode trunk
A-F 5-2-01 -A(config-if-range)#no shutdown
A-F 5-2-01 -A(config-if-range)exit
A-F 5-2-01 -A(config)#interface range fa0/3
A-F 5-2-01 -A(config-if)#switchport mode access
A-F 5-2-01 -A(config-if)#no shutdown
A-F 5-2-01 -A(config)#interface fa0/1
A-F 5-2-01 -A(config-if)#description connect to A-F5-2-01-B
---
端口描述
A-F 5-2-01 -A(config-if)#interface fa0/2
----
此模式下可直接��
1
端口跳到
2
端口�M行配置
A-F 5-2-01 -A(config-if)#description connect to A-F5-2-01-C
A-F 5-2-01 -A(config-if)#interface fa0/3
A-F 5-2-01 -A(config-if)#description connect to A-F5-2-01-D
A-F 5-2-01 -A#
6.
配置普通端口assess
模式，把普通端口加入vlan
A-F 5-2-01 -A#conf t
A-F 5-2-01 -A(config)#interface range fastEthernet0/4 �C 24
---
同�r配置
4-24
�端口
A-F 5-2-01 -A(config-if-range)#switchport mode access
A-F 5-2-01 -A(config-if-range)#end
A-F 5-2-01 -A#conf t
A-F 5-2-01 -A(config)#interface range fa0/3
A-F 5-2-01 -A(config-if)#switchport access vlan 465
---
把
1-3
端口加入
vlan465
A-F 5-2-01 -A(config-if-range)#interface range fa0/4 -24
A-F 5-2-01 -A(config-if-range)#switchport access vlan 456
---
把
4-24
端口加入
vlan456
A-F 5-2-01 -A(config-if-range)#end
A-F 5-2-01 -A#
7.
配置�V播�L暴，多播�L暴，配置
A-F 5-2-01 -A#conf t
A-F 5-2-01 -A(config)#interface range fa0/2 �C 24
A-F 5-2-01 -A(config-if-range)#storm-control bro
A-F 5-2-01 -A(config-if-range)#storm-control broadcast level 2
---
配置�V播�L暴
A-F 5-2-01 -A(config-if-range)#storm-control multicast level 2
---
配置多播�L暴
A-F 5-2-01 -A(config-if-range)#storm-control action shutdown
---
超�^限制自��
down
掉
A-F 5-2-01 -A(config-if-range)#end
A-F 5-2-01 -A#conf t
A-F 5-2-01 -A(config)#interface range fastEthernet0/4 �C 24
A-F 5-2-01 -A(config-if-range)#spanning-tree portfast
---
配置
spantree
A-F 5-2-01 -A(config-if-range)#spanning-tree bpduguard enable
---
配置
spantree
A-F 5-2-01 -A (config-if-range)#end
8.
配置允�S���MAC
地址通�^端口
A-F 5-2-01 -A#conf t
A-F 5-2-01 -A(config)#interface range fa0/4 -24
A-F 5-2-01 -A(config-if-range)#switchport port-security
---
先�⒂�
port-security
A-F 5-2-01 -A(config-if-range)#switchport port-security maximum 2
------
配置允�S
2
��
MAC
地址通�^，默�J�橐��
9.
配置802.1X
�f�h
A-F 5-2-01 -A#conf t
Enter configuration commands, one per line. End with CNTL/Z.
A-F 5-2-01 -A(config-if-range)#dot1x port-control auto
---
配置成自��
A-F 5-2-01 -A(config-if-range)#dot1x timeout tx-period 15
---
配置�B接
15s
A-F 5-2-01 -A(config-if-range)#dot1x timeout server-timeout 30
A-F 5-2-01 -A(config-if-range)#end
A-F 5-2-01 -A#wr
A-F 5-2-01 -A#show running-config
Building configuration...
Current configuration : 8524 bytes
!
version 12.1
no service pad
service timestamps debug uptime
service timestamps log uptime
no service password-encryption
!
hostname A-F 5-2-01 -A
!
enable secret 5 $1$ 0A 9M $TeUTsDGC2MeDZnH8S 6l 7C /
---
加密了的
secret
密�a
enable password switch
---enable
密�a
!
username XXX
privilege 15 password 0
XXX
---
登入�~�及密�a
ip subnet-zero
!
!
spanning-tree mode pvst
no spanning-tree optimize bpdu transmission
spanning-tree extend system-id
!
!
!
!
interface FastEthernet0/1
---
�B接
cisco
交�Q�C
(
�V播、多播�L暴在下�咏�Q�C端口上�O置
)
description connect to A-F 5-2-01 -B
switchport mode trunk
storm-control action shutdown
!
interface FastEthernet0/2
description connect to A-F 5-2-01 -C
---
�B接
asus 2024B
交�Q�C
switchport mode trunk
storm-control broadcast level 2.00
storm-control multicast level 2.00
storm-control action shutdown
!
interface FastEthernet0/3
---
�B接
hub ,
此端口�O置成
access
模式，
description connect to A-F 5-2-01 -D
switchport access vlan 465
---
假如
465
是
VIP
，�t下面
hub
下端口都是
VIP
switchport mode access
storm-control broadcast level 2.00
storm-control multicast level 2.00
storm-control action shutdown
!
interface FastEthernet0/4
switchport access vlan 456
switchport mode access
---
端口所�模式，此模式不可接交�Q�C，可接
HUB
switchport port-security
---
�⒂�
port-security
，默�J不�⒂�
switchport port-security maximum 2
---
允�S通�^
2
��
MAC
地址
storm-control broadcast level 2.00
---
配置�V播�L暴
storm-control multicast level 2.00
---
配置多播�L暴
storm-control action shutdown
---
超�^上面的限制自��
down
掉
dot1x port-control auto
---802.1X
�f�h
dot1x timeout tx-period 15
spanning-tree portfast
---
配置
spanning-tree
�f�h
spanning-tree bpduguard enable
!
……
!
interface FastEthernet0/24
switchport access vlan 456
switchport mode access
switchport port-security
switchport port-security maximum 2
storm-control broadcast level 2.00
storm-control multicast level 2.00
storm-control action shutdown
dot1x port-control auto
dot1x timeout tx-period 15
spanning-tree portfast
spanning-tree bpduguard enable
!
interface GigabitEthernet0/1
description connect to 4506
switchport trunk allowed vlan 455,456,465,466
switchport mode trunk
!
interface GigabitEthernet0/2
description connect to 4506
switchport trunk allowed vlan 455,456,465,466
switchport mode trunk
!
interface Vlan1
no ip address
no ip route-cache
shutdown
!
interface Vlan455
ip address 192.168.1.1 255.255.255.0
---
管理
IP
no ip route-cache
!
ip default-gateway192.168.1.250
---
�W�P
ip http server
!
line con 0
--- console
�B接
logging synchronous
login
line vty 0 4
---vty
�B接
password switch
---vty
�B接密�a
login
line vty 5 15
login
!
!
end