华为交换机配置脚本大全（iStack / CSS / 基础配置 / 业务特性）

normanhere

1022人浏览 · 2026-01-24 18:57:08

normanhere · 2026-01-24 18:57:08 发布

华为交换机配置脚本大全（iStack / CSS / 基础配置 / 业务特性）

整理日期：2026-07-09
适用场景：盒式设备堆叠（iStack）、框式设备集群（CSS）、基础网络配置、安全与业务特性配置。
说明：本文命令均来自华为企业技术支持文档与现网实践，文中 // 后为原文档注释，供理解参考。部分命令因版本差异（如 V200R002/V200R003 前后）略有不同，请以设备实际版本为准。

一、盒式设备 iStack 堆叠配置
二、华为新款交换机堆叠配置（堆叠助手）
三、框式设备 CSS 集群配置
四、华为 S5735 最新软件版本堆叠
五、基础配置（时间/AAA/管理/远程登录/日志/NTP/SNMP 等）
六、系统升级操作（FTP 方式）
七、COMBO 接口与三层口配置
八、二层端口隔离
九、MAC 地址黑洞
十、端口聚合（静态 / 动态 LACP）
十一、VLAN、ACCESS、TRUNK 口配置
十二、静态 ARP 表项
十三、DHCP 服务器与 DHCP Relay
十四、策略路由（PBR）
十五、ARP 防网关冲突
十六、DHCP Snooping
十七、端口安全（Port Security）
十八、端口镜像（本地 / VLAN / 远程）
十九、关闭非华为认证光模块告警

一、盒式设备 iStack 堆叠配置

参考文档：https://support.huawei.com/enterprise/zh/doc/EDOC1000069491/5e798e3e#ZH-CN_TASK_0177090980
关键点：堆叠口需要交叉连接；2 台设备做 MAD 检测时使用 mad detect direct，并需在被检测端口关闭 STP 和 LLDP。

1.1 配置 SwitchA（主交换机）

# 配置SwitchA的业务口GigabitEthernet0/0/27、GigabitEthernet0/0/28为物理成员端口，并加入到相应的逻辑堆叠端口。
system-view
sysname SwitchA
interface stack-port 0/1
 port interface gigabitethernet 0/0/27 enable
 quit
interface stack-port 0/2
 port interface gigabitethernet 0/0/28 enable
 quit
stack slot 0 priority 200
save

1.2 配置 SwitchB

# 配置SwitchB的业务口GigabitEthernet0/0/27、GigabitEthernet0/0/28为物理成员端口，并加入到相应的逻辑堆叠端口。
system-view
sysname SwitchB
interface stack-port 0/1
 port interface gigabitethernet 0/0/27 enable
 quit
interface stack-port 0/2
 port interface gigabitethernet 0/0/28 enable
 quit
stack slot 0 renumber 1
save

1.3 配置 SwitchC

# 配置SwitchC的业务口GigabitEthernet0/0/27、GigabitEthernet0/0/28为物理成员端口，并加入到相应的逻辑堆叠端口。
system-view
sysname SwitchC
interface stack-port 0/1
 port interface gigabitethernet 0/0/27 enable
 quit
interface stack-port 0/2
 port interface gigabitethernet 0/0/28 enable
 quit
stack slot 0 renumber 2
save

1.4 连线上电顺序（保证堆叠主备可控）

为保证堆叠组建成功，建议按以下顺序连线上电（若希望某台为主，先为其上电；以下顺序以 SwitchA 为主）：

为 SwitchA、SwitchB、SwitchC 下电；
连接 SwitchA 与 SwitchB 之间的堆叠线缆；
先为 SwitchA 上电，SwitchA 启动后再为 SwitchB 上电；
检查 SwitchA 与 SwitchB 堆叠是否成功（见步骤 4 检查方法）；
类似地，连接 SwitchC 与 SwitchB、SwitchA 之间的堆叠线缆，再为 SwitchC 上电；
检查三台设备堆叠是否成功。

1.5 关闭 ZTP 并验证

# 关闭ZTP
undo ztp enable
#
undo ztp domain-type registration-center domain register.naas.huawei.com
#
system-view
display stack

1.6 配置跨设备 Eth-Trunk（堆叠系统侧）

# 在堆叠系统创建Eth-Trunk，并将上行物理端口设置为Eth-Trunk成员接口。
[Stack] interface eth-trunk 10
[Stack-Eth-Trunk10] trunkport gigabitethernet 0/0/5
[Stack-Eth-Trunk10] trunkport gigabitethernet 1/0/5
[Stack-Eth-Trunk10] trunkport gigabitethernet 2/0/5
[Stack-Eth-Trunk10] quit

1.7 配置代理设备 SwitchD

# 在SwitchD上创建Eth-Trunk，并将与Stack相连的端口设置为Eth-Trunk成员接口。
<HUAWEI> system-view
[HUAWEI] sysname SwitchD
[SwitchD] interface eth-trunk 10
[SwitchD-Eth-Trunk10] trunkport gigabitethernet 0/0/1
[SwitchD-Eth-Trunk10] trunkport gigabitethernet 0/0/2
[SwitchD-Eth-Trunk10] trunkport gigabitethernet 0/0/3
[SwitchD-Eth-Trunk10] quit

1.8 配置代理方式多主检测（MAD）

# 在堆叠系统上，配置跨设备Eth-Trunk的代理方式多主检测功能。
[Stack] interface eth-trunk 10
[Stack-Eth-Trunk10] mad detect mode relay
[Stack-Eth-Trunk10] return

# 在代理设备SwitchD上，配置Eth-Trunk的代理功能。
[SwitchD] interface eth-trunk 10
[SwitchD-Eth-Trunk10] mad relay
[SwitchD-Eth-Trunk10] return

display mad verbose

二、华为新款交换机堆叠配置（堆叠助手）

参考文档：https://support.huawei.com/enterprise/zh/doc/EDOC1100301659/e89fb326

system-view
interface stack-port 1/1
 port member-group interface GE 1/0/25
 quit
stack
 stack member 1 renumber 2
 stack member 1 priority 200         # 默认100，可选
 stack member 1 description Master   # 可选
 stack authentication-mode hmac-sha256 password Admin@123.   # 可选
dis stack configuration
dis stack topology

三、框式设备 CSS 集群配置

参考文档：https://support.huawei.com/enterprise/zh/doc/EDOC1000069491/7c9e33a7
注意：框式 CSS 需先升级系统和补丁，再配置集群连接方式、集群 ID 及集群优先级。

3.1 配置 SwitchA（集群优先级 100，ID 缺省为 1）

# 在SwitchA上配置集群。集群连接方式为业务口集群，集群优先级为100，集群ID采用缺省值1（不需配置）。
system-view
sysname SwitchA
set css mode lpu
set css priority 100

3.2 配置 SwitchB（集群 ID 2，优先级 10）

# 在SwitchB上配置集群。集群连接方式为业务口集群，集群ID为2，集群优先级为10。
system-view
sysname SwitchB
set css mode lpu
set css id 2
set css priority 10

display css status saved

3.3 配置集群物理成员端口

# 配置SwitchA的业务口XGE1/0/1～XGE1/0/2为集群物理成员端口并加入集群端口1，XGE2/0/1～XGE2/0/2为集群物理成员端口并加入集群端口2。
[SwitchA] interface css-port 1
[SwitchA-css-port1] port interface xgigabitethernet 1/0/1 to xgigabitethernet 1/0/2 enable
[SwitchA-css-port1] quit
[SwitchA] interface css-port 2
[SwitchA-css-port2] port interface xgigabitethernet 2/0/1 to xgigabitethernet 2/0/2 enable
[SwitchA-css-port2] quit

# 配置SwitchB的业务口XGE1/0/1～XGE1/0/2为集群物理成员端口并加入集群端口1，XGE2/0/1～XGE2/0/2为集群物理成员端口并加入集群端口2。
[SwitchB] interface css-port 1
[SwitchB-css-port1] port interface xgigabitethernet 1/0/1 to xgigabitethernet 1/0/2 enable
[SwitchB-css-port1] quit
[SwitchB] interface css-port 2
[SwitchB-css-port2] port interface xgigabitethernet 2/0/1 to xgigabitethernet 2/0/2 enable
[SwitchB-css-port2] quit

display css css-port saved

3.4 使能 CSS 并重启

# 使能SwitchA的集群功能并重新启动SwitchA。
[SwitchA] css enable
Warning: The CSS configuration will take effect only after the system is rebooted. The next CSS mode is LPU. Reboot now? [Y/N]:y

# 使能SwitchB的集群功能并重新启动SwitchB。
[SwitchB] css enable
Warning: The CSS configuration will take effect only after the system is rebooted. The next CSS mode is LPU. Reboot now? [Y/N]:y

3.5 配置代理方式多主检测（MAD）

# 配置多主检测功能（代理方式，将SwitchC作为代理设备）。命令行格式以V200R003C00及之后版本为例。
# 在集群系统上配置Eth-Trunk接口的代理方式多主检测功能。
<CSS> system-view
[CSS] interface eth-trunk 20
[CSS-Eth-Trunk20] mad detect mode relay        # V200R002C00版本命令行格式为 dual-active detect mode relay
[CSS-Eth-Trunk20] quit
[CSS] quit

# 配置代理设备SwitchC的代理功能。
[SwitchC] interface eth-trunk 20
[SwitchC-Eth-Trunk20] mad relay                 # V200R002C00版本命令行格式为 dual-active relay
[SwitchC-Eth-Trunk20] quit
[SwitchC] quit

四、华为 S5735 最新软件版本堆叠

# >>> 机房交换机1 (将成为 Member 1 / 主交换机) <<<
<HUAWEI> set ztp disable
<HUAWEI> system-view
[HUAWEI] interface stack-port 1/1
[HUAWEI-stack-port0/1] port member-group interface GE 0/0/25
[HUAWEI-stack-port0/1] quit
[HUAWEI] interface stack-port 1/2
[HUAWEI-stack-port0/2] port member-group interface GE 0/0/26
[HUAWEI-stack-port0/2] quit
[HUAWEI] stack
[HUAWEI] stack member all priority 200
[HUAWEI] save

# >>> 机房交换机2 (将成为 Member 2) <<<
<HUAWEI> set ztp disable
<HUAWEI> system-view
[HUAWEI] interface stack-port 1/1
[HUAWEI-stack-port0/1] port member-group interface GE 0/0/25
[HUAWEI-stack-port0/1] quit
[HUAWEI] interface stack-port 1/2
[HUAWEI-stack-port0/2] port member-group interface GE 0/0/26
[HUAWEI-stack-port0/2] quit
[HUAWEI] stack
[HUAWEI] stack member 1 renumber 2
[HUAWEI] save
[HUAWEI] reboot
# 保存后重启, 连接堆叠线缆

组建堆叠步骤：

连接堆叠线缆（交叉连接）；
先为机房交换机 1 上电，待启动完成后再为机房交换机 2 上电；
检查堆叠状态：display stack；
堆叠组建成功后，以下配置均在堆叠系统上执行。

五、基础配置（时间/AAA/管理/远程登录/日志/NTP/SNMP 等）

5.1 时间、时区、主机名

# 基础配置 配置时间 时区 主机名
<HUAWEI> clock timezone BJ add 08:00:00    //BJ为设置的时区名称，08:00:00表示当地时间是在系统默认UTC时区基础上加8
<HUAWEI> clock datetime 10:10:00 2014-07-26    //设置当前时间和日期，请先确认时区以保证本地时间正确
<HUAWEI> system-view
[HUAWEI] sysname Switch

5.2 Web/HTTPS 服务

# 产生密钥对
[Switch] rsa local-key-pair create
# 打开HTTPS服务
[Switch] http secure-server enable   //缺省情况下，设备的HTTPS IPv4服务功能已开启，HTTPS IPv6服务功能为关闭状态
[Switch] http server-source -i Ethernet0/0/0    //缺省情况下，未指定HTTP服务器端的源接口和IPv6源地址

# 部分新交换机
web-manager enable port 8443
web-manager http forward enable
web-manager server-source all-interface

5.3 创建管理员账户（AAA）

# 创建管理员 指定登录方式和权限
[Switch] aaa
[Switch] aaa
[Switch-aaa] local-aaa-user user-name complexity-check disable   //关闭用户名强制检查策略
[Switch-aaa] local-aaa-user password policy administrator
[Switch-aaa-lupp-admin] undo password alert original      //关闭用户首次登录需要强制修改密码
[Switch-aaa-lupp-admin] password complexity two-of-kinds  //修改密码策略为2种类及以上
[Switch-aaa] local-user admin123 password irreversible-cipher Huawei@6789    //V200R003之前版本不支持irreversible-cipher，仅支持cipher关键字
[Switch-aaa] local-user admin123 privilege level 15    //部分交换机是3，配置用户级别为15级
Warning: This operation may affect online users, are you sure to change the user privilege level ?[Y/N]y
[Switch-aaa] local-user admin123 service-type telnet terminal stelnet https
[Switch-aaa] quit

5.4 管理 VLAN 与管理口

# 创建管理VLAN
[Switch] vlan 10
[Switch-vlan10] description MGMT
[Switch-vlan10] interface vlanif 10    //配置VLANIF10作为管理接口
[Switch-Vlanif10] ip address 10.1.1.1 24
[Switch-Vlanif10] quit

# 管理口接管理PC
[Switch] interface gigabitethernet 0/0/10
[Switch-GigabitEthernet0/0/10] description TO_MGMT_PC
[Switch-GigabitEthernet0/0/10] port link-type access
[Switch-GigabitEthernet0/0/10] port default vlan 10
[Switch-GigabitEthernet0/0/10] quit

# 设置ACL仅允许管理PC远程访问
[Switch] acl 2008
[Switch-acl-basic-2008] rule permit source 10.1.1.2 0
[Switch-acl-basic-2008] quit

5.5 SSH / Telnet / VTY / Console

# 打开SSH服务
[Switch] stelnet server enable
[Switch] ssh server-source -i Vlanif 10
# 指定SSH登录用户
[Switch] ssh user admin123 authentication-type password
[Switch] ssh user admin123 service-type stelnet

# 打开Telnet服务
[Switch] telnet server enable
[Switch] telnet server-source -i Vlanif 10

# 设置远程登录端口，认证方式，登录权限，ACL和超时时间
[Switch] user-interface vty 0 4
[Switch-ui-vty0-4] protocol inbound all
[Switch-ui-vty0-4] acl 2008 inbound
[Switch-ui-vty0-4] user privilege level 15
[Switch-ui-vty0-4] authentication-mode aaa
[Switch-ui-vty0-4] quit

# 设置console口登录方式为本地用户名密码
[Switch] user-interface console 0
[Switch-ui-console0] authentication-mode aaa
[Switch-ui-console0] quit

5.6 日志服务器（Loghost）

# 定义Log服务器 记录时间戳和日志等级
[Switch] info-center enable
[Switch] info-center timestamp log date precision-time millisecond                  # log日志日期格式精确到毫秒
[Switch] info-center timestamp trap date precision-time millisecond                 # trap日期格式精确到毫秒
[Switch] info-center timestamp debugging date precision-time millisecond            # debug输出时间格式精确到毫秒
[Switch] info-center loghost source Vlanif4
[Switch] info-center loghost 1.1.1.1 facility local2 level debugging local-time    # 定义日志服务器IP和等级为debugging
Warning: There is security risk as this operation enables a non secure syslog protocol.
info-center loghost source vlanif 2

5.7 DNS 与 NTP

# 定义DNS（主要用于NTP解析域名，若NTP直接指定URL则不必配置DNS）
[Switch] dns server 114.114.114.114
[Switch] dns server 223.5.5.5
[Switch] dns resolve

# 打开NTP客户端，指定2个NTP时间服务器（若上面配置了DNS则这里可使用URL）
[Switch] undo ntp disable
[Switch] ntp source-interface Vlanif4
[Switch] ntp unicast-server 202.112.29.82
[Switch] ntp unicast-server 202.120.2.101

5.8 LLDP、MSTP、SNMP

# 打开LLDP
[Switch] lldp enable
[Switch] lldp management-address bind interface Vlanif4

# 配置MSTP（核心交换机指定为STP根，数据中心建议打开BPDU保护）
[Switch] stp mode mstp
[Switch] stp region-configuration
[Switch-mst-region] region-name wangsu
[Switch-mst-region] active region-configuration
[Switch-mst-region] quit
[Switch] stp root primary
[Switch] stp enable
[Switch] stp bpdu-protection

# 配置SNMP V2 / V3
[Switch] snmp-agent
[Switch] snmp-agent mib-view included iso-view iso
[Switch] snmp-agent community read cipher Admin@huawei mib-view iso-view    # SNMP v2c只读团体关键字
[Switch] snmp-agent sys-info version v2c v3
[Switch] snmp-agent protocal source-interface vlan 100    # 必须配置，否则业务不通
Warning: SNMPv1/SNMPv2c is not secure, and SNMPv3 in either authentication or privacy mode is recommended.
[Switch] snmp-agent group v3 managev3group privacy read-view iso-view    # 创建只读组managev3group
[Switch] snmp-agent usm-user v3 admin group managev3group
[Switch] snmp-agent usm-user v3 admin authentication-mode md5
Please configure the authentication password (8-255)
Enter Password:
Confirm Password:
Warning: The algorithm is insecure. Using a security algorithm is recommended.
[Switch] snmp-agent usm-user v3 admin privacy-mode des56
Please configure the privacy password (8-255)
Enter Password:
Confirm Password:
Warning: The privacy and authentication passwords are the same, which is insecure. It is recommended that the privacy and authentication passwords be different.
Warning: DES56 is less secure, and it is recommended to use AES128 or higher.

# 配置snmp-agent trap
[Switch] snmp-agent trap enable
[Switch] undo snmp-agent trap enable feature-name snmp trap-name authenticationfailure
[Switch] snmp-agent trap source Vlanif4
[Switch] snmp-agent target-host trap address udp-domain 1.1.1.1 params securityname Admin@huawei v3 privacy

5.9 边缘端口、静态路由、聚合口

# 配置边缘端口
[Switch] int 10 1/0/7
[Switch-10GE1/0/7] stp edged-port enable
[Switch-10GE1/0/7] int range 10 1/0/10 to 10 1/0/48
[Switch-port-group] stp edged-port enable
[Switch-port-group] quit
[Switch] ip route-static 0.0.0.0 0.0.0.0 192.168.5.1

# 创建聚合口将端口放入聚合口
[S12700E-8] interface Eth-Trunk1
[S12700E-8-Eth-Trunk1] trunkport gigabitethernet 1/1/0/46
[S12700E-8-Eth-Trunk1] trunkport gigabitethernet 2/1/0/46
[S12700E-8-Eth-Trunk1] port link-type access
[S12700E-8-Eth-Trunk1] port default vlan 1202
[S12700E-8-Eth-Trunk1] quit
[S12700E-8] interface Eth-Trunk2
[S12700E-8-Eth-Trunk2] trunkport gigabitethernet 1/1/0/47
[S12700E-8-Eth-Trunk2] trunkport gigabitethernet 2/1/0/47
[S12700E-8-Eth-Trunk2] port link-type access
[S12700E-8-Eth-Trunk2] port default vlan 1203
[S12700E-8-Eth-Trunk2] quit

六、系统升级操作（FTP 方式）

PC 作为 FTP 服务器，需提前将新版本系统文件和补丁放到 FTP 根目录。
企业用户获取路径：登录 http://support.huawei.com/e → 搜索交换机型号 → “软件” → “版本及补丁”（.cc）/“VR 版本公共补丁”（.pat）。

6.1 配置管理 IP 并加载版本

<HUAWEI> system-view
[HUAWEI] interface vlanif 1
[HUAWEI-vlanif1] ip address 10.10.1.1 24    # 确保与PC处于同一网段
[HUAWEI-vlanif1] quit

<HUAWEI> ftp 10.10.1.2    # 终端PC的IP地址
[ftp] get S5720-HI-V200R010C00SPC600.cc    # 加载系统软件
[ftp] get S5720-HI-V200R010SPH013.pat       # 加载补丁文件

6.2 校验文件并指定启动文件

<HUAWEI> dir flash:    # 查看加载文件大小是否和PC端一致，不一致需删除重新加载
Directory of flash:/
  Idx  Attr     Size(Byte)  Date        Time       FileName
    0  -rw-    106,395,444  Jul 22 2017 23:44:18   S5720-HI-V200R010C00SPC600.cc
    1  -rw-          84210  Jun 28 2017 05:16:29   S5720-HI-V200R010SPH013.pat
    2  drw-              -  Jan 01 2017 00:00:44   dhcp
    3  drw-              -  Dec 03 2013 09:22:27   user
    4  -rw-         13,432  Jan 01 2017 00:00:45   default_ca.cer

<HUAWEI> startup system-software S5720-HI-V200R010C00SPC600.cc
<HUAWEI> startup patch S5720-HI-V200R010SPH013.pat

6.3 双主控框式设备（备用主控板）

# 若设备为双主控框式，在用户视图使用以下命令设置备用主控板使用的系统软件和补丁：
copy S5720-HI-V200R010C00SPC600.cc slave#flash:
startup system-software S5720-HI-V200R010C00SPC600.cc slave-board
startup patch S5720-HI-V200R010SPH013.pat slave-board

6.4 重启并验证

<HUAWEI> display startup    # 查看当前运行版本是否为升级目标版本
<HUAWEI> reboot fast
System will reboot! Continue?[Y/N]: y

<HUAWEI> display startup            # 查看 Next startup system software 是否为目标版本
<HUAWEI> display patch-information  # 查看补丁名、版本及状态（State 应为 Running）
<HUAWEI> check version              # 查看是否有需升级的软件，有则可执行 upgrade all
<HUAWEI> display device             # 查看部件在位(Online)、注册(Register)及运行状态(Status)

七、COMBO 接口与三层口配置

# COMBO接口选择
<HUAWEI> system-view
[HUAWEI] sysname Switch
[Switch] interface gigabitethernet 1/0/4
[Switch-GigabitEthernet1/0/4] combo-port copper   # 缺省Combo接口为auto，修改为电口模式
[Switch-GigabitEthernet1/0/4] quit

# 配置三层口
interface GigabitEthernet1/0/1
 undo portswitch
 ip address 10.10.1.1 255.255.255.0
undo portswitch batch gigabitethernet 1/0/2 to 1/0/4

八、二层端口隔离

思路：设备缺省端口隔离为二层隔离三层互通，只需将接口加入隔离组即可实现隔离组内二层数据隔离。

<HUAWEI> system-view
[HUAWEI] sysname Switch
[Switch] vlan 10
[Switch-vlan10] quit
[Switch] interface gigabitethernet 1/0/1
[Switch-GigabitEthernet1/0/1] port link-type access
[Switch-GigabitEthernet1/0/1] port default vlan 10
[Switch-GigabitEthernet1/0/1] port-isolate enable   # 缺省加入隔离组1，模式为二层隔离三层互通；可在系统视图执行 port-isolate mode all 改为二层三层都隔离
[Switch-GigabitEthernet1/0/1] quit

[Switch] interface gigabitethernet 1/0/2
[Switch-GigabitEthernet1/0/2] port link-type access
[Switch-GigabitEthernet1/0/2] port default vlan 10
[Switch-GigabitEthernet1/0/2] port-isolate enable
[Switch-GigabitEthernet1/0/2] quit

[Switch] interface gigabitethernet 1/0/3
[Switch-GigabitEthernet1/0/3] port link-type access
[Switch-GigabitEthernet1/0/3] port default vlan 10
[Switch-GigabitEthernet1/0/3] quit

验证结果：PC1 与 PC2 二层不通；PC1 与 PC3、PC2 与 PC3 可互通。

九、MAC 地址黑洞

<HUAWEI> system-view
[HUAWEI] sysname Switch
[Switch] vlan 3
[Switch-vlan3] quit
[Switch] mac-address blackhole xxxx-xxxx-xxx5 vlan 3   # 配置MAC在VLAN 3广播域内为黑洞MAC地址

十、端口聚合（静态 / 动态 LACP）

10.1 静态聚合

vlan batch 10 20
#
interface Eth-Trunk1
 port link-type trunk
 port trunk allow-pass vlan 10 20
 load-balance src-dst-mac
#
interface GigabitEthernet1/0/1
 eth-trunk 1
#
interface GigabitEthernet1/0/2
 eth-trunk 1
#
interface GigabitEthernet1/0/3
 eth-trunk 1

10.2 动态聚合（LACP）

vlan batch 10 20
#
lacp priority 100
#
interface Eth-Trunk1
 port link-type trunk
 port trunk allow-pass vlan 10 20
 mode lacp
 max active-linknumber 2
#
interface GigabitEthernet1/0/1
 eth-trunk 1
 lacp priority 100
#
interface GigabitEthernet1/0/2
 eth-trunk 1
 lacp priority 100

十一、VLAN、ACCESS、TRUNK 口配置

<HUAWEI> system-view
[HUAWEI] sysname SwitchA
[SwitchA] vlan batch 2 3   # 批量创建VLAN 2和VLAN 3
[SwitchA] interface gigabitethernet 1/0/1
[SwitchA-GigabitEthernet1/0/1] port link-type access
[SwitchA-GigabitEthernet1/0/1] port default vlan 2
[SwitchA-GigabitEthernet1/0/1] quit
[SwitchA] interface gigabitethernet 1/0/2
[SwitchA-GigabitEthernet1/0/2] port link-type access
[SwitchA-GigabitEthernet1/0/2] port default vlan 3
[SwitchA-GigabitEthernet1/0/2] quit

# SwitchB的配置与SwitchA类似，不再赘述
[SwitchA] interface gigabitethernet 1/0/3
[SwitchA-GigabitEthernet1/0/3] port link-type trunk
[SwitchA-GigabitEthernet1/0/3] port trunk allow-pass vlan 2 3

十二、静态 ARP 表项

[Switch] arp static 10.164.1.1 00e0-fc01-0001 vid 10 interface gigabitethernet 1/0/1    # 为总裁办公室主机配置静态ARP
[Switch] arp static 10.164.10.1 00e0-fc02-1234 interface gigabitethernet 1/0/2           # 为文件备份服务器配置静态ARP

十三、DHCP 服务器与 DHCP Relay

13.1 DHCP 服务器

[Switch] vlan batch 10
[Switch] interface gigabitethernet 1/0/1
[Switch-GigabitEthernet1/0/1] port link-type hybrid
[Switch-GigabitEthernet1/0/1] port hybrid pvid vlan 10
[Switch-GigabitEthernet1/0/1] port hybrid untagged vlan 10
[Switch-GigabitEthernet1/0/1] quit
[Switch] interface vlanif 10
[Switch-Vlanif10] ip address 10.1.1.1 25
[Switch-Vlanif10] quit

[Switch] ip pool pool1
[Switch-ip-pool-pool1] network 10.1.1.0 mask 255.255.255.128
[Switch-ip-pool-pool1] dns-list 10.1.2.3
[Switch-ip-pool-pool1] gateway-list 10.1.1.1
[Switch-ip-pool-pool1] lease day 10
[Switch-ip-pool-pool1] excluded-ip-address 192.168.1.100
[Switch-ip-pool-pool1] quit

[Switch] interface vlanif 10
[Switch-Vlanif10] dhcp select global
[Switch-Vlanif10] quit

13.2 DHCP Relay

[SwitchA] dhcp enable   # 使能DHCP服务，缺省未使能
[SwitchA] interface vlanif 100
[SwitchA-Vlanif100] ip address 10.10.20.1 24
[SwitchA-Vlanif100] dhcp select relay   # 使能DHCP中继功能
[SwitchA-Vlanif100] dhcp relay server-ip 192.168.20.2   # 配置DHCP中继代理的服务器IP
[SwitchA-Vlanif100] quit

十四、策略路由（PBR）

场景：内网多个网段访问外网时根据源网段重定向到不同下一跳；内网互访流量不做重定向。

# 匹配内网两个网段互访的数据流（不做重定向）
[Switch] acl 3000
[Switch-acl-adv-3000] rule permit ip source 192.168.1.0 0.0.0.255 destination 192.168.2.0 0.0.0.255
[Switch-acl-adv-3000] rule permit ip source 192.168.2.0 0.0.0.255 destination 192.168.1.0 0.0.0.255
[Switch-acl-adv-3000] quit

[Switch] acl 3001   # 匹配192.168.1.0/24
[Switch-acl-adv-3001] rule permit ip source 192.168.1.0 0.0.0.255
[Switch-acl-adv-3001] quit
[Switch] acl 3002   # 匹配192.168.2.0/24
[Switch-acl-adv-3002] rule permit ip source 192.168.2.0 0.0.0.255
[Switch-acl-adv-3002] quit

# 配置流分类
[Switch] traffic classifier c0 operator or
[Switch-classifier-c0] if-match acl 3000
[Switch-classifier-c0] quit
[Switch] traffic classifier c1 operator or
[Switch-classifier-c1] if-match acl 3001
[Switch-classifier-c1] quit
[Switch] traffic classifier c2 operator or
[Switch-classifier-c2] if-match acl 3002
[Switch-classifier-c2] quit

# 配置流行为
[Switch] traffic behavior b0
[Switch-behavior-b0] permit
[Switch-behavior-b0] quit
[Switch] traffic behavior b1
[Switch-behavior-b1] redirect ip-nexthop 10.1.20.1
[Switch-behavior-b1] quit
[Switch] traffic behavior b2
[Switch-behavior-b2] redirect ip-nexthop 10.1.30.1
[Switch-behavior-b2] quit

# 配置流策略并应用
[Switch] traffic policy p1
[Switch-trafficpolicy-p1] classifier c0 behavior b0
[Switch-trafficpolicy-p1] classifier c1 behavior b1
[Switch-trafficpolicy-p1] classifier c2 behavior b2
[Switch-trafficpolicy-p1] quit
[Switch] interface gigabitethernet 1/0/3
[Switch-GigabitEthernet1/0/3] traffic-policy p1 inbound
[Switch-GigabitEthernet1/0/3] return

十五、ARP 防网关冲突

[Switch] arp anti-attack gateway-duplicate enable

十六、DHCP Snooping

[SwitchA] dhcp enable
[SwitchA] dhcp snooping enable ipv4   # 仅处理DHCPv4报文，节约CPU
[SwitchA] interface gigabitethernet 0/0/2
[SwitchA-GigabitEthernet0/0/2] dhcp snooping enable
[SwitchA-GigabitEthernet0/0/2] quit
[SwitchA] interface gigabitethernet 0/0/3
[SwitchA-GigabitEthernet0/0/3] dhcp snooping enable
[SwitchA-GigabitEthernet0/0/3] quit
[SwitchA] interface gigabitethernet 0/0/1
[SwitchA-GigabitEthernet0/0/1] dhcp snooping trusted   # 配置为信任接口，仅处理该接口收到的服务器响应
[SwitchA-GigabitEthernet0/0/1] quit

十七、端口安全（Port Security）

[Switch] interface gigabitethernet 1/0/1
[Switch-GigabitEthernet1/0/1] port-security enable        # 使能端口安全
[Switch-GigabitEthernet1/0/1] port-security mac-address sticky   # 使能sticky MAC
[Switch-GigabitEthernet1/0/1] port-security max-mac-num 1   # 使能后默认限制数为1

十八、端口镜像（本地 / VLAN / 远程）

18.1 本地 M:N 端口镜像

<HUAWEI> system-view
[HUAWEI] sysname Switch
[Switch] observe-port 1 interface-range gigabitethernet 1/0/4 gigabitethernet 1/0/5   # 批量配置观察端口
[Switch] interface gigabitethernet 1/0/1
[Switch-GigabitEthernet1/0/1] port-mirroring to observe-port 1 both
[Switch-GigabitEthernet1/0/1] quit
[Switch] interface gigabitethernet 1/0/2
[Switch-GigabitEthernet1/0/2] port-mirroring to observe-port 1 both
[Switch-GigabitEthernet1/0/2] quit
[Switch] interface gigabitethernet 1/0/3
[Switch-GigabitEthernet1/0/3] port-mirroring to observe-port 1 both
[Switch-GigabitEthernet1/0/3] return

18.2 VLAN 镜像

[Switch] observe-port 1 interface gigabitethernet 0/0/4   # 配置GE0/0/4为观察端口
[Switch] vlan 10
[Switch-vlan10] mirroring to observe-port 1 inbound   # VLAN10内所有接口入方向报文镜像到观察端口1
[Switch-vlan10] return

18.3 远程镜像

<HUAWEI> system-view
[HUAWEI] sysname SwitchB
[SwitchB] vlan 20
[SwitchB-vlan20] mac-address learning disable   # 关闭该VLAN的MAC地址学习
[SwitchB-vlan20] quit
[SwitchB] interface gigabitethernet 0/0/1
[SwitchB-GigabitEthernet0/0/1] port link-type access
[SwitchB-GigabitEthernet0/0/1] port default vlan 20
[SwitchB-GigabitEthernet0/0/1] quit
[SwitchB] interface gigabitethernet 0/0/4
[SwitchB-GigabitEthernet0/0/4] port link-type trunk
[SwitchB-GigabitEthernet0/0/4] port trunk allow-pass vlan 20
[SwitchB-GigabitEthernet0/0/4] return

[SwitchA] observe-port 1 interface gigabitethernet 0/0/4 vlan 20   # 配置二层远程观察端口，绑定VLAN20
[SwitchA] vlan 10
[SwitchA-vlan10] mirroring to observe-port 1 inbound
[SwitchA-vlan10] return