Cisco3560配置（生产环境）

2653885

　　version 12.2
　　no service pad
　　service timestamps debug uptime
　　service timestamps log datetime localtime
　　service password-encryption
　　service sequence-numbers
　　!
　　hostname qngy-zx-3560
　　!
　　no logging exception
　　no logging buffered
　　logging rate-limit all 2 except debugging
　　no logging console
　　enable secret 5 $1$ozUD$Qw/SVu16l6mVvXY82mtwV12
　　!
　　no aaa new-model
　　clock timezone beijing 8
　　system mtu routing 1500
　　ip subnet-zero
　　no ip source-route
　　ip routing
　　ip domain-list 192.168.100.100
　　ip name-server 192.168.100.100
　　ip dhcp smart-relay
　　!
　　ip dhcp snooping vlan 53-55
　　no ip dhcp snooping information option
　　ip dhcp snooping
　　ip arp inspection vlan 53-55
　　ip arp inspection filter kefu vlan  5,505
　　ip arp inspection filter vlan54 vlan  54
　　ip arp inspection filter vlan55 vlan  55
　　no ip igmp snooping
　　ipv6 unicast-routing
　　!
　　mls qos
　　!
　　!
　　!
　　!
　　!
　　no errdisable detect cause arp-inspection
　　errdisable recovery cause dhcp-rate-limit
　　errdisable recovery cause arp-inspection
　　errdisable recovery interval 30
　　port-channel load-balance dst-mac
　　!
　　!
　　!
　　spanning-tree mode pvst
　　spanning-tree extend system-id
　　spanning-tree vlan 1,5,53-55,602 priority 24576
　　!
　　!
　　vlan access-map buildD 10
　　action drop
　　match ip address bad_port
　　vlan access-map buildD 20
　　action forward
　　match ip address match_all
　　!
　　vlan filter buildD vlan-list 54-55
　　vlan internal allocation policy ascending
　　!
　　!

　　class-map match-all>　　match access-group name limitudp
　　!
　　!
　　policy-map policylimitudp

　　class>　　police 100000 8000 exceed-action drop
　　!
　　!
　　!
　　!
　　interface Port-channel1
　　description link to build D
　　switchport trunk encapsulation dot1q
　　switchport trunk allowed vlan 55,602
　　switchport mode trunk
　　ip arp inspection limit none
　　!
　　interface Port-channel2
　　description link to build 123
　　switchport trunk encapsulation isl
　　switchport mode trunk
　　ip arp inspection limit none
　　!
　　interface Port-channel3
　　description Link To QngyBungalow
　　switchport trunk encapsulation dot1q
　　switchport trunk allowed vlan 1-252,254-4094
　　switchport mode trunk
　　ip arp inspection limit none
　　!
　　interface GigabitEthernet0/1
　　switchport trunk encapsulation dot1q
　　switchport trunk allowed vlan 55,602
　　switchport mode trunk
　　ipv6 traffic-filter ACCESS_PORT in
　　channel-group 1 mode on
　　service-policy input policylimitudp
　　!
　　interface GigabitEthernet0/2
　　switchport trunk encapsulation dot1q
　　switchport trunk allowed vlan 55,602
　　switchport mode trunk
　　ipv6 traffic-filter ACCESS_PORT in
　　channel-group 1 mode on
　　service-policy input policylimitudp
　　!
　　interface GigabitEthernet0/3
　　description link to build A
　　switchport trunk encapsulation dot1q
　　switchport trunk allowed vlan 54,602
　　switchport mode trunk
　　ip arp inspection limit none
　　ipv6 traffic-filter ACCESS_PORT in
　　service-policy input policylimitudp
　　!
　　interface GigabitEthernet0/4
　　description link to build C
　　switchport trunk encapsulation dot1q
　　switchport trunk allowed vlan 54,602
　　switchport mode trunk
　　ip arp inspection limit none
　　ipv6 traffic-filter ACCESS_PORT in
　　service-policy input policylimitudp
　　!
　　interface GigabitEthernet0/5
　　switchport trunk encapsulation isl
　　switchport mode trunk
　　ipv6 traffic-filter ACCESS_PORT in
　　channel-group 2 mode on
　　service-policy input policylimitudp
　　!
　　interface GigabitEthernet0/6
　　switchport trunk encapsulation isl
　　switchport mode trunk
　　ipv6 traffic-filter ACCESS_PORT in
　　channel-group 2 mode on
　　service-policy input policylimitudp
　　!
　　interface GigabitEthernet0/7
　　description link to B4
　　switchport trunk encapsulation dot1q
　　switchport trunk allowed vlan 54,602
　　switchport mode trunk
　　ip arp inspection limit rate 500 burst interval 15
　　ipv6 traffic-filter ACCESS_PORT in
　　service-policy input policylimitudp
　　!
　　interface GigabitEthernet0/8
　　description link to B4
　　switchport trunk encapsulation dot1q
　　switchport trunk allowed vlan 54,602
　　switchport mode trunk
　　ip arp inspection limit rate 500 burst interval 15
　　ipv6 traffic-filter ACCESS_PORT in
　　service-policy input policylimitudp
　　!
　　interface GigabitEthernet0/9
　　description link to B4
　　switchport trunk encapsulation dot1q
　　switchport trunk allowed vlan 54,602
　　switchport mode trunk
　　ip arp inspection limit rate 500 burst interval 15
　　ipv6 traffic-filter ACCESS_PORT in
　　service-policy input policylimitudp
　　!
　　interface GigabitEthernet0/10
　　description link to B4
　　switchport trunk encapsulation dot1q
　　switchport trunk allowed vlan 54,602
　　switchport mode trunk
　　ip arp inspection limit rate 500 burst interval 15
　　ipv6 traffic-filter ACCESS_PORT in
　　service-policy input policylimitudp
　　!
　　interface GigabitEthernet0/11
　　description link to B7
　　switchport trunk encapsulation dot1q
　　switchport trunk allowed vlan 54,602
　　switchport mode trunk
　　ip arp inspection limit rate 500 burst interval 15
　　ipv6 traffic-filter ACCESS_PORT in
　　service-policy input policylimitudp
　　!
　　interface GigabitEthernet0/12
　　description link to B7
　　switchport trunk encapsulation dot1q
　　switchport trunk allowed vlan 54,602
　　switchport mode trunk
　　ip arp inspection limit rate 500 burst interval 15
　　ipv6 traffic-filter ACCESS_PORT in
　　service-policy input policylimitudp
　　!
　　interface GigabitEthernet0/13
　　description link to B7
　　switchport trunk encapsulation dot1q
　　switchport trunk allowed vlan 54,602
　　switchport mode trunk
　　ip arp inspection limit rate 500 burst interval 15
　　ipv6 traffic-filter ACCESS_PORT in
　　service-policy input policylimitudp
　　!
　　interface GigabitEthernet0/14
　　description link to B7
　　switchport trunk encapsulation dot1q
　　switchport trunk allowed vlan 54,602
　　switchport mode trunk
　　ip arp inspection limit rate 500 burst interval 15
　　ipv6 traffic-filter ACCESS_PORT in
　　service-policy input policylimitudp
　　!
　　interface GigabitEthernet0/15
　　description link to B7
　　switchport trunk encapsulation dot1q
　　switchport trunk allowed vlan 53-55
　　switchport mode trunk
　　ip arp inspection limit rate 500 burst interval 15
　　shutdown
　　ipv6 traffic-filter ACCESS_PORT in
　　service-policy input policylimitudp
　　!
　　interface GigabitEthernet0/16
　　description link to B10
　　switchport trunk encapsulation dot1q
　　switchport trunk allowed vlan 54,602
　　switchport mode trunk
　　ip arp inspection limit rate 500 burst interval 15
　　ipv6 traffic-filter ACCESS_PORT in
　　service-policy input policylimitudp
　　!
　　interface GigabitEthernet0/17
　　description link to B10
　　switchport trunk encapsulation dot1q
　　switchport trunk allowed vlan 54,602
　　switchport mode trunk
　　ip arp inspection limit rate 500 burst interval 15
　　ipv6 traffic-filter ACCESS_PORT in
　　service-policy input policylimitudp
　　!
　　interface GigabitEthernet0/18
　　description link to B10
　　switchport trunk encapsulation dot1q
　　switchport trunk allowed vlan 54,602
　　switchport mode trunk
　　ip arp inspection limit rate 500 burst interval 15
　　ipv6 traffic-filter ACCESS_PORT in
　　service-policy input policylimitudp
　　!
　　interface GigabitEthernet0/19
　　description link to B10
　　switchport trunk encapsulation dot1q
　　switchport trunk allowed vlan 54,602
　　switchport mode trunk
　　ip arp inspection limit rate 500 burst interval 15
　　ipv6 traffic-filter ACCESS_PORT in
　　service-policy input policylimitudp
　　!
　　interface GigabitEthernet0/20
　　description link to B10
　　switchport trunk encapsulation dot1q
　　switchport trunk allowed vlan 54,602
　　switchport mode trunk
　　ip arp inspection limit rate 500 burst interval 15
　　ipv6 traffic-filter ACCESS_PORT in
　　service-policy input policylimitudp
　　!
　　interface GigabitEthernet0/21
　　description link to B13
　　switchport trunk encapsulation dot1q
　　switchport trunk allowed vlan 54,602
　　switchport mode trunk
　　ip arp inspection limit rate 500 burst interval 15
　　ipv6 traffic-filter ACCESS_PORT in
　　service-policy input policylimitudp
　　!
　　interface GigabitEthernet0/22
　　description link to B13
　　switchport trunk encapsulation dot1q
　　switchport trunk allowed vlan 54,602
　　switchport mode trunk
　　ip arp inspection limit rate 500 burst interval 15
　　ipv6 traffic-filter ACCESS_PORT in
　　service-policy input policylimitudp
　　!
　　interface GigabitEthernet0/23
　　description link to B13
　　switchport trunk encapsulation dot1q
　　switchport trunk allowed vlan 54,602
　　switchport mode trunk
　　ip arp inspection limit rate 500 burst interval 15
　　ipv6 traffic-filter ACCESS_PORT in
　　service-policy input policylimitudp
　　!
　　interface GigabitEthernet0/24
　　description link to B13
　　switchport trunk encapsulation dot1q
　　switchport trunk allowed vlan 54,602
　　switchport mode trunk
　　ip arp inspection limit rate 500 burst interval 15
　　ipv6 traffic-filter ACCESS_PORT in
　　service-policy input policylimitudp
　　!
　　interface GigabitEthernet0/25
　　description link to B13
　　switchport trunk encapsulation dot1q
　　switchport trunk allowed vlan 54,602
　　switchport mode trunk
　　ip arp inspection limit rate 500 burst interval 15
　　ipv6 traffic-filter ACCESS_PORT in
　　service-policy input policylimitudp
　　!
　　interface GigabitEthernet0/26
　　description link to B13
　　switchport trunk encapsulation dot1q
　　switchport trunk allowed vlan 54,602
　　switchport mode trunk
　　ip arp inspection limit rate 500 burst interval 15
　　ipv6 traffic-filter ACCESS_PORT in
　　service-policy input policylimitudp
　　!
　　interface GigabitEthernet0/27
　　switchport trunk encapsulation dot1q
　　switchport trunk allowed vlan 54,602
　　switchport mode trunk
　　ip arp inspection limit rate 500 burst interval 15
　　ipv6 traffic-filter ACCESS_PORT in
　　service-policy input policylimitudp
　　!
　　interface GigabitEthernet0/28
　　switchport trunk encapsulation dot1q
　　switchport trunk allowed vlan 54,602
　　switchport mode trunk
　　ip arp inspection limit rate 500 burst interval 15
　　ipv6 traffic-filter ACCESS_PORT in
　　service-policy input policylimitudp
　　!
　　interface GigabitEthernet0/29
　　switchport trunk encapsulation dot1q
　　switchport trunk allowed vlan 54,602
　　switchport mode trunk
　　ip arp inspection limit rate 500 burst interval 15
　　ipv6 traffic-filter ACCESS_PORT in
　　service-policy input policylimitudp
　　!
　　interface GigabitEthernet0/30
　　switchport trunk encapsulation dot1q
　　switchport trunk allowed vlan 54,602
　　switchport mode trunk
　　ip arp inspection limit rate 500 burst interval 15
　　ipv6 traffic-filter ACCESS_PORT in
　　service-policy input policylimitudp
　　!
　　interface GigabitEthernet0/31
　　switchport trunk encapsulation dot1q
　　switchport trunk allowed vlan 1-252,254-4094
　　switchport mode trunk
　　ip arp inspection limit none
　　ipv6 traffic-filter ACCESS_PORT in
　　channel-group 3 mode on
　　!
　　interface GigabitEthernet0/32
　　switchport trunk encapsulation dot1q
　　switchport trunk allowed vlan 1-252,254-4094
　　switchport mode trunk
　　ip arp inspection limit none
　　ipv6 traffic-filter ACCESS_PORT in
　　channel-group 3 mode on
　　!
　　interface GigabitEthernet0/33
　　switchport trunk encapsulation dot1q
　　ip arp inspection trust
　　shutdown
　　spanning-tree portfast
　　!
　　interface GigabitEthernet0/34
　　switchport access vlan 253
　　switchport mode access
　　ipv6 traffic-filter ACCESS_PORT in
　　!
　　interface GigabitEthernet0/35
　　switchport trunk allowed vlan 1-252,254-4094
　　shutdown
　　ipv6 traffic-filter ACCESS_PORT in
　　!
　　interface GigabitEthernet0/36
　　switchport trunk allowed vlan 1-252,254-4094
　　shutdown
　　ipv6 traffic-filter ACCESS_PORT in
　　!
　　interface GigabitEthernet0/37
　　switchport trunk encapsulation dot1q
　　switchport mode trunk
　　!
　　interface GigabitEthernet0/38
　　switchport trunk allowed vlan 1-252,254-4094
　　shutdown
　　ipv6 traffic-filter ACCESS_PORT in
　　!
　　interface GigabitEthernet0/39
　　switchport trunk allowed vlan 1-252,254-4094
　　shutdown
　　ipv6 traffic-filter ACCESS_PORT in
　　!
　　interface GigabitEthernet0/40
　　switchport trunk allowed vlan 1-252,254-4094
　　shutdown
　　ipv6 traffic-filter ACCESS_PORT in
　　!
　　interface GigabitEthernet0/41
　　switchport trunk allowed vlan 1-252,254-4094
　　shutdown
　　ipv6 traffic-filter ACCESS_PORT in
　　!
　　interface GigabitEthernet0/42
　　switchport trunk allowed vlan 1-252,254-4094
　　shutdown
　　ipv6 traffic-filter ACCESS_PORT in
　　!
　　interface GigabitEthernet0/43
　　switchport trunk allowed vlan 1-252,254-4094
　　switchport mode access
　　shutdown
　　ipv6 traffic-filter ACCESS_PORT in
　　!
　　interface GigabitEthernet0/44
　　switchport trunk encapsulation dot1q
　　switchport trunk allowed vlan 1-252,254-4094
　　switchport mode trunk
　　shutdown
　　ipv6 traffic-filter ACCESS_PORT in
　　!
　　interface GigabitEthernet0/45
　　switchport trunk allowed vlan 1-252,254-4094
　　switchport mode access
　　shutdown
　　ipv6 traffic-filter ACCESS_PORT in
　　!
　　interface GigabitEthernet0/46
　　switchport access vlan 54
　　switchport mode access
　　ipv6 traffic-filter ACCESS_PORT in
　　!
　　interface GigabitEthernet0/47
　　switchport trunk encapsulation dot1q
　　switchport trunk allowed vlan 1-252,254-4094
　　switchport mode trunk
　　ip arp inspection trust
　　ipv6 traffic-filter ACCESS_PORT in
　　spanning-tree bpdufilter enable
　　!
　　interface GigabitEthernet0/48
　　switchport access vlan 54
　　switchport mode access
　　ipv6 traffic-filter ACCESS_PORT in
　　!
　　interface GigabitEthernet0/49
　　description link to Build F (6506)
　　switchport trunk encapsulation dot1q
　　switchport mode trunk
　　ip arp inspection trust
　　spanning-tree bpdufilter enable
　　ip dhcp snooping trust
　　!
　　interface GigabitEthernet0/50
　　shutdown
　　flowcontrol receive on
　　service-policy input policylimitudp
　　!
　　interface GigabitEthernet0/51
　　shutdown
　　!
　　interface GigabitEthernet0/52
　　shutdown
　　!
　　interface Vlan1
　　ip address 192.168.100.78 255.255.255.128
　　no ip proxy-arp
　　ipv6 address 1001:CC0:2020:1::7/64
　　ipv6 enable
　　ipv6 nd ra suppress
　　ipv6 ospf 1 area 0
　　!
　　interface Vlan5
　　no ip address
　　ip helper-address 192.168.100.77
　　no ip redirects
　　no ip unreachables
　　no ip proxy-arp
　　!
　　interface Vlan53
　　ip address 192.168.31.254 255.255.255.0 secondary
　　ip address 192.168.15.254 255.255.255.0
　　ip helper-address 192.168.100.77
　　no ip proxy-arp
　　ipv6 address 1001:CC0:2020:2020::1/64
　　ipv6 enable
　　ipv6 nd router-preference High
　　ipv6 ospf 1 area 0
　　!
　　interface Vlan54
　　ip address 192.168.209.254 255.255.255.0 secondary
　　ip address 192.168.11.254 255.255.252.0
　　ip helper-address 192.168.100.77
　　no ip redirects
　　no ip unreachables
　　no ip proxy-arp
　　ipv6 address 1001:CC0:2020:2021::1/64
　　ipv6 enable
　　ipv6 nd router-preference High
　　ipv6 ospf 1 area 0
　　!
　　interface Vlan55
　　ip address 192.168.14.254 255.255.255.0
　　ip helper-address 192.168.100.77
　　no ip redirects
　　no ip unreachables
　　no ip proxy-arp
　　ipv6 address 1001:CC0:2020:2022::1/64
　　ipv6 enable
　　ipv6 nd router-preference High
　　ipv6 ospf 1 area 0
　　!
　　interface Vlan501
　　no ip address
　　!
　　interface Vlan602
　　no ip address
　　!
　　no ip http server
　　ip http access-class 10
　　ip http secure-server
　　!
　　!
　　ip access-list extended bad_port
　　deny   ip host 192.168.8.2 host 192.168.0.10
　　deny   ip host 192.168.0.10 host 192.168.8.2
　　deny   ip host 192.168.8.3 host 192.168.0.10
　　deny   ip host 192.168.0.10 host 192.168.8.3
　　deny   ip host 192.168.8.1 host 192.168.0.10
　　deny   ip host 192.168.0.10 host 192.168.8.1
　　permit tcp any any eq 445
　　permit tcp any any eq 139
　　permit tcp any any eq 135
　　permit udp any any eq netbios-dgm
　　permit udp any any eq 445
　　permit udp any any eq 135
　　permit udp any any eq netbios-ns
　　ip access-list extended limitudp
　　deny   udp 192.168.100.0 0.0.0.255 any
　　deny   udp 192.168.10.0 0.0.0.255 any
　　deny   udp 192.168.1.0 0.0.0.255 any
　　deny   udp any any eq domain bootpc bootps
　　deny   udp 192.168.200.0 0.0.0.255 any
　　ip access-list extended match_all
　　permit ip any any
　　!
　　ip source binding 0050.C225.99B1 vlan 54 192.168.8.2 interface Gi0/48
　　logging 192.168.100.45
　　access-list 2 permit 10.0.0.2
　　access-list 2 permit 192.168.203.36
　　access-list 2 permit 192.168.100.0 0.0.0.255
　　access-list 10 permit 192.168.100.0 0.0.0.255
　　!
　　arp access-list vlan54
　　permit ip host 192.168.11.250 mac host 0014.970f.5a08
　　permit ip host 192.168.11.249 mac host 0014.970f.5a07
　　permit ip host 192.168.11.248 mac host 0014.970f.5a36
　　permit ip host 192.168.1.245 mac any
　　permit ip host 192.168.1.246 mac any
　　arp access-list vlan55
　　permit ip host 192.168.14.200 mac host 0010.5cb2.3a8c
　　permit ip host 192.168.14.249 mac host 0014.970f.5a04
　　permit ip host 192.168.14.1 mac host 0050.c225.99b5
　　arp 192.168.10.139 00bc.5c1d.4820 ARPA
　　arp 192.168.11.244 8080.d24d.0bf4 ARPA
　　arp 192.168.14.253 0040.63f7.62ef ARPA
　　arp 192.168.14.1 0050.c225.99b5 ARPA
　　arp 192.168.8.3 0050.c225.9a07 ARPA
　　arp 192.168.8.2 0050.c225.99b1 ARPA
　　arp 192.168.8.1 0050.c225.998f ARPA
　　ipv6 router ospf 1
　　log-adjacency-changes
　　!
　　!
　　snmp-server community rcode RO 2
　　snmp-server community public RO
　　snmp-server enable traps snmp authentication linkdown linkup coldstart warmstart
　　snmp-server enable traps tty
　　snmp-server enable traps cluster
　　snmp-server enable traps entity
　　snmp-server enable traps cpu threshold
　　snmp-server enable traps vtp
　　snmp-server enable traps vlancreate
　　snmp-server enable traps vlandelete
　　snmp-server enable traps flash insertion removal
　　snmp-server enable traps port-security
　　snmp-server enable traps envmon fan shutdown supply temperature status
　　snmp-server enable traps config-copy
　　snmp-server enable traps config
　　snmp-server enable traps hsrp
　　snmp-server enable traps bridge newroot topologychange
　　snmp-server enable traps stpx inconsistency root-inconsistency loop-inconsistency
　　snmp-server enable traps syslog
　　snmp-server enable traps vlan-membership
　　!
　　ipv6 access-list ACCESS_PORT
　　remark Block all traffic DHCP server -> client
　　deny udp any eq 547 any eq 546
　　remark Block Router Advertisements
　　deny icmp any any router-advertisement
　　permit ipv6 any any
　　!
　　ipv6 access-list vty
　　permit ipv6 1001:CC0:2020:1::/64 1001:CC0:2020:1::/64
　　permit ipv6 1001:CC0:2020:1001::/64 1001:CC0:2020:1::/64
　　!
　　control-plane
　　!
　　!
　　line con 0
　　password 7 060506324F415A4C5347020A1F173D24362C1
　　login
　　line vty 0 4
　　access-class 10 in
　　password 7 104D000A0618415E5A543A2A373B243A30172
　　ipv6 access-class vty in
　　login
　　line vty 5 15
　　access-class 10 in
　　password 7 104D000A0618415E5A543A2A373B243A30174
　　ipv6 access-class vty in
　　login
　　!
　　!
　　monitor session 1 source vlan 54
　　monitor session 1 destination interface Gi0/47
　　mac-address-table static 14cf.9274.00eb vlan 53 drop
　　ntp clock-period 36029575
　　ntp server 192.168.100.45 prefer
　　end