第一部分: 机房交换机堆叠配置 (Core Stack)

设备: HUAWEI S5735-L24T4S-A-V2 x 2
堆叠配置 (堆叠组建前, 在各交换机上单独执行)
堆叠线缆连接方式 (交叉连接):
机房交换机1 GE1/0/25 <—> 机房交换机2 GE1/0/26
#机房交换机1 GE1/0/26 <—> 机房交换机2 GE1/0/25
机房交换机1 (将成为 Member 1 / 主交换机)

<HUAWEI> set ztp disable
<HUAWEI> system-view
[HUAWEI] interface stack-port 1/1
[HUAWEI-stack-port0/1] port member-group interface GE 1/0/25
[HUAWEI-stack-port0/1] quit
[HUAWEI] interface stack-port 1/2
[HUAWEI-stack-port0/2] port member-group interface GE 1/0/26 
[HUAWEI-stack-port0/2] quit
[HUAWEI] stack 
[HUAWEI] stack member all priority 200
[HUAWEI] save

机房交换机2 (将成为 Member 2)

<HUAWEI> set ztp disable
<HUAWEI> system-view
[HUAWEI] interface stack-port 1/1
[HUAWEI-stack-port0/1] port member-group interface GE 1/0/25 
[HUAWEI-stack-port0/1] quit
[HUAWEI] interface stack-port 1/2
[HUAWEI-stack-port0/2] port member-group interface GE 1/0/26 
[HUAWEI-stack-port0/2] quit
[HUAWEI] stack 
[HUAWEI] stack member 1 renumber 2
[HUAWEI] save
[HUAWEI] reboot

务必关闭ztp配置
保存后重启, 连接堆叠线缆

#组建堆叠步骤:

  1. 连接堆叠线缆 (交叉连接)
  2. 先机房交换机1上电, 待启动完成后再为机房交换2机上电
  3. 检查堆叠状态: display stack
  4. 堆叠组建成功后, 以下配置均在堆叠系统上执行

system-view
interface GE 1/0/1
mad detect mode direct

配置直连方式多主检测 基础配置 (堆叠组建后执行) 但是这样会浪费2个接口，如果交换机支持也可以考虑用lacp relay方式

system-view
sysname DuoChuan-SW-160.254
clock timezone BJ add 08:00:00
clock datetime HH:MM:SS YYYY-MM-DD
transceiver non-certified-alarm disable
rsa local-key-pair create
lldp enable

vlan batch 150 160
vlan 150
 description YeWu
vlan 160
 description MGMT


interface Vlanif150
 ip address 192.168.150.254 255.255.255.0
 description YeWu-Gateway
interface Vlanif160
 ip address 192.168.160.254 255.255.255.0
 description MGMT-Gateway


aaa
 local-aaa-user user-name complexity-check disable
 local-aaa-user password policy administrator
  undo password alert original
  password complexity two-of-kinds
 local-user admin password irreversible-cipher Passw0rd
 local-user admin privilege level 3
 local-user admin service-type telnet terminal http https
 quit

http secure-server enable
http server-source -i Vlanif160

telnet server enable
telnet server-source -i Vlanif160
#建议关闭telnet

user-interface vty 0 4
 authentication-mode aaa
 user privilege level 3
 protocol inbound all
 idle-timeout 30 0
 quit

user-interface console 0
 authentication-mode password
 set authentication password cipher Passw0rd
 idle-timeout 30 0
 quit

undo ntp-service disable
ntp-service source-interface Vlanif160
ntp-service unicast-server 202.112.29.82
ntp-service unicast-server 202.120.2.101

dns server 223.5.5.5
dns server 114.114.114.114
dns resolve

lldp management-address bind interface Vlanif160

arp anti-attack gateway-duplicate enable

undo mac-address flapping detection
mac-address update arp enable
undo arp anti-attack entry-check send-ack enable
undo arp anti-attack rate-limit source-ip
undo arp anti-attack rate-limit source-mac
undo arp anti-attack rate-limit destination-ip
#上述部分是优化无线终端漫游时快速更新arp表用的

 info-center enable
 info-center timestamp log date precision-time millisecond
 info-center loghost source Vlanif160
 info-center loghost <日志服务器IP> facility local2 level debugging

stp mode mstp
stp region-configuration
 region-name DuoChuan
 quit
stp root primary
stp enable
#核心交换机配置root primary 

interface Eth-Trunk1
 description TO-XianChang-Stack
 port link-type trunk
 port trunk allow-pass vlan 150 160
 mode lacp-dynmic
 quit
#实际配置的时候可以使用trunkport ge xxx快速将接口加入聚合组

interface GE 1/0/27
 description TO-XianChang-SW-GE1-0-51
 eth-trunk 1
 quit
interface GE 2/0/27
 description TO-XianChang-SW-GE2-0-51
 eth-trunk 1
 quit
 #接现场接入交换机
 
interface GE 1/0/1
 description TO-AC1
 port link-type trunk
 port trunk allow-pass vlan 160
 quit 
interface GE 2/0/1
 description TO-AC2
 port link-type trunk
 port trunk allow-pass vlan 160
 quit
#这2个口接无线控制器

port-group group-member GE 1/0/1 to GE 1/0/16
port-group group-member GE 1/0/18 to GE 1/0/24
port link-type access
port default vlan 150
stp edged-port enable
quit

port-group group-member GE 2/0/1 to GE 2/0/16
port-group group-member GE 2/0/18 to GE 2/0/24
port link-type access
port default vlan 150
stp edged-port enable
quit

interface GE 1/0/19
 description Server1-Master
interface GE 1/0/20
 description Server2-Master
interface GE 1/0/21
 description Server3-Master
interface GE 2/0/19
 description Server1-Backup
interface GE 2/0/20
 description Server2-Backup
interface GE 2/0/21
 description Server3-Backup
#这些口接终端

interface Eth-Trunk2
 description TO-Uplink-TBD
 undo portswitch
 ip address 10.255.255.1 255.255.255.252
 mode lacp-dynmic
 quit
interface GE 1/0/28
 description TO-Uplink
 eth-trunk 2
 quit
interface GE 2/0/28
 description TO-Uplink
 eth-trunk 2
 quit
#部分交换机不支持三层聚合口上联，需要改为二层聚合口上联
ip route-static 0.0.0.0 0.0.0.0 10.255.255.2

save

display stack
display vlan
display interface brief
display eth-trunk 1
display eth-trunk 2
display mad verbose
display stp brief
display interface Vlanif160
display mac-address flapping

华为无线控制器 AC S9700-S 2台VRRP主备配置
其中2台无线控制器的1口是capwap 管理口，配置VRRP，连核心交换机的Ge1/0/17（主）和Ge2/0/1（备）口，2口是配置同步和心跳口2台设备直连

sysname AC1
#
vrrp recover-delay 60
#
vlan batch 102 150 160
#
dhcp enable
#
dhcp server database enable
dhcp server database recover
#
interface Vlanif 160
 ip address 192.168.160.251 255.255.255.0
 vrrp vrid 1 virtual-ip 192.168.160.253
 admin-vrrp vrid 1
 vrrp vrid 1 priority 120
 vrrp vrid 1 preempt-mode timer delay 1800
 dhcp select interface
 dhcp server excluded-ip-address 192.168.160.250 192.168.160.254
 management-interface 
#这里管理业务复用，采用带内管理
interface Vlanif 102
 ip address 10.23.102.1 255.255.255.0
#这个配置同步和HA接口，两台AC直连
interface GE 0/0/1
 des Mgmt
 port link-type trunk
 undo port trunk allow-pass vlan 1
 port trunk allow-pass vlan 160
#
interface GE 0/0/2
 des HA
 port link-type trunk
 undo port trunk allow-pass vlan 1
 port trunk allow-pass vlan 102
 stp disable
#关闭stp
capwap source ip-address 192.168.160.253
capwap dtls inter-controller control-link encrypt on
capwap dtls inter-controller data-link encrypt
capwap dtls inter-controller psk Passw0rd
capwap dtls psk Passw0rd
#这部分需要交互输入很多密码，按照提示输入
#
hsb-service 0
 service-ip-port local-ip 10.23.102.1 peer-ip 10.23.102.2 local-data-port 10241 peer-data-port 10241
 service-keep-alive detect retransmit 3 interval 6
#
hsb-group 0
 track vrrp vrid 1 interface Vlanif160
 bind-service 0
 hsb enable
#
hsb-service-type access-user hsb-group 0
#
hsb-service-type dhcp hsb-group 0
#
hsb-service-type ap hsb-group 0
#
ip route-static 0.0.0.0 0.0.0.0 192.168.160.254
#
ntp-service unicast-server 202.112.29.82
ntp-service unicast-server 202.120.2.101
#
http secure-server enable
http secure-server server-source -i Vlanif160
ftp server-source -i Vlanif160
ssh server-source -i Vlanif160
#
wlan
temporary-management psk Passw0rd
ap username admin password cipher Passw0rd
ap auth-mode no-auth
 master controller
  master-redundancy track-vrrp vrid 1 interface Vlanif160
  master-redundancy peer-ip ip-address 10.23.102.2 local-ip ip-address 10.23.102.1 psk Passw0rd
#这里不需要提前配置wlan业务，这部分配置通过网页配置完毕后自动同步给备机
return

第二台华为AC S9700-S

#
sysname AC2
#
vrrp recover-delay 60
#
vlan batch 102 150 160
#
dhcp enable
#
dhcp server database enable
dhcp server database recover
#
interface Vlanif 160
 ip address 192.168.160.252 255.255.255.0
 vrrp vrid 1 virtual-ip 192.168.160.253
 admin-vrrp vrid 1
 vrrp vrid 1 priority 100
 dhcp select interface
 dhcp server excluded-ip-address 192.168.160.250 192.168.160.254
#
interface Vlanif 102
 ip address 10.23.102.2 255.255.255.0
#
interface GE 0/0/1
 des Mgmt
 port link-type trunk
 undo port trunk allow-pass vlan 1
 port trunk allow-pass vlan 160
#
interface GE 0/0/2
 des HA
 port link-type trunk
 undo port trunk allow-pass vlan 1
 port trunk allow-pass vlan 102
 stp disable
#
capwap source ip-address 192.168.160.253
capwap dtls inter-controller control-link encrypt on
capwap dtls inter-controller data-link encrypt
capwap dtls inter-controller psk Passw0rd
capwap dtls psk Passw0rd
capwap dtls version1.0 enable
capwap dtls cbc enable
#
hsb-service 0
 service-ip-port local-ip 10.23.102.2 peer-ip 10.23.102.1 local-data-port 10241 peer-data-port 10241
 service-keep-alive detect retransmit 3 interval 6
 quit
#
hsb-group 0
 track vrrp vrid 1 interface Vlanif160
 bind-service 0
 hsb enable
#
hsb-service-type access-user hsb-group 0
#
hsb-service-type dhcp hsb-group 0
#
hsb-service-type ap hsb-group 0
#
ip route-static 0.0.0.0 0.0.0.0 192.168.160.254
#
ntp-service unicast-server 202.112.29.82
ntp-service unicast-server 202.120.2.101
#
http secure-server enable
http secure-server server-source -i Vlanif160
ftp server-source -i Vlanif160
ssh server-source -i Vlanif160
#
wlan
temporary-management psk Passw0rd
ap username admin password cipher Passw0rd
ap auth-mode no-auth
 master controller
  master-redundancy track-vrrp vrid 1 interface Vlanif160
  master-redundancy peer-ip ip-address 10.23.102.1 local-ip ip-address 10.23.102.2 psk Passw0rd
#
return

AC1和2配置完成后，通过电脑网页访问，升级固件，导入授权，AP上线，修改AP上线方式为SN,改为固定IP，修改AP名称，创建无线业务等,主备设备配置会自动同步

# 网络
Logo
DAMO开发者矩阵

DAMO开发者矩阵，由阿里巴巴达摩院和中国互联网协会联合发起，致力于探讨最前沿的技术趋势与应用成果，搭建高质量的交流与分享平台，推动技术创新与产业应用链接，围绕“人工智能与新型计算”构建开放共享的开发者生态。

更多推荐

cover

客服机器人响应变慢又烧钱：并发、重试和用量日志怎么一起排查

avatar DAMO开发者矩阵

养老机器人加速普及：从展厅走进家庭，还需要迈过几道坎？

养老机构是机器人最先落地的场景之一。第三步，长期来看，养老机器人不是替代人类护理员，而是与人力形成协同——机器人承担体力劳动、安全监控、数据采集等标准化工作，人类护理员聚焦情感陪伴、复杂判断和个性化照护。这些设备的核心价值不是取代护理员，而是承担重复性、高风险性的工作——比如24小时巡逻、辅助失能老人翻身移床——让有限的人力资源聚焦在更有温度和更需要专业判断的照护上。多位业内人士在不同场合表达了相

avatar DAMO开发者矩阵
cover

【学习复盘】聊聊近期C语言进阶&ICT VLAN互通学习心得（附代码）

avatar DAMO开发者矩阵