Static Route Configuration
When different network segments need to communicate across segments, static routes can be configured, but the other end must also be configured the same way.
ip route-static 192.168.1.0 24 192.168.2.1 ip route-static [destination network address] [subnet mask] [next-hop address/outbound interface] [priority] [preference] [tag] [description] display ip routing-table //View all routes on the router display ip routing-table protocol static //View static routes only
- In point-to-point (P2P) links, the best and preferred approach is to directly specify the outbound interface
- On such links, the Layer 2 characteristic is that only two devices exist at the two ends of the link, so no Layer 2 addressing is needed (no MAC address or ARP required)
- However, on broadcast links (such as Ethernet), directly specifying the outbound interface may have drawbacks and needs to be used together with the next hop
- The Layer 2 characteristic is that there are multiple devices and multiple peers on the link, requiring Layer 2 addressing (ARP resolves MAC addresses)
- Backup can also be implemented by configuring the priority of floating static routes
Primary route (next hop 10.0.0.2, default priority 60) [Huawei] ip route-static 192.168.4.0 255.255.255.0 10.0.0.2 Backup route (priority 80, takes effect when the primary route fails) [Huawei] ip route-static 192.168.4.0 255.255.255.0 10.0.0.3 preference 80
TCP UDP CDN
TCP characteristics: high reliability, high integrity requirements, latency-insensitive UDP characteristics: high speed, unreliable, latency-sensitive CDN characteristics: local distribution, accelerated access, cost reduction with stable service, high availability
vlan
Layer 2 VLAN
VLAN (Virtual Local Area Network) characteristics: logical partitioning, security isolation, flexible networking.
vlan 1 //Create a VLAN vlan batch 10 to 20 //Create consecutive VLANs vlan batch 10 30 50 //Create non-consecutive VLANs dis vlan //View VLAN information port default vlan 10 //Assign an interface to VLAN 10
- Use Access mode for ports connecting to terminal devices
- Use Trunk mode for ports connecting to the same type of network devices such as switches and routers
- Use Hybrid port mode when flexible control of VLAN ingress/egress is needed
- For VLAN transparent transmission across LANs on carrier backbone networks, use dot1q-tunnel mode, which adds an outer tag to VLANs to avoid VLAN ID conflicts
- VLAN isolation isolates faults, and connectivity connects normal communication
Layer 3 VLAN
A Layer 3 switch has a network layer with routing and forwarding capability, so it can both isolate and communicate.
int vlanif 10 ip add x.x.x.x mask
Router-on-a-Stick
Create sub-interfaces for routing and forwarding.
int g0/0/0.10 //Sub-interface 1 int g0/0/0.20 //Sub-interface 2 dot1q termination vid 10 //Encapsulate the 802.1Q protocol and bind VLAN 10 Ip add 192.168.10.1 24 //Configure the IP of sub-interface 1, which is the gateway for VLAN 10 arp broadcast enable //Enable ARP broadcast; without ARP broadcast, communication is not possible int g0/0/0.20 dot1q termination vid 20 ip add xxxx xx //Gateway for VLAN 20 arp broadcast enable
The function of ARP is to resolve the MAC address corresponding to a given IP.
ACL Control
An ACL is essentially creating an access control rule, and then invoking this rule to use it.
acl name xxxx INTEGER<2000-2999> Basic access-list(add to current using rules) INTEGER<3000-3999> Advanced access-list(add to current using rules) INTEGER<4000-4999> Specify a L2 acl group INTEGER<5000-5999> User defined access-list advance Advanced ACL basic Basic ACL link Link ACL user User ACL
Basic ACL 2000-2999
rule xx number deny / permit source 1.1.1.1 0.0.0.0 //Here 0.0.0.0 is used as the wildcard mask to precisely match a single IP rule xx permit source any //Allow other IP traffic to pass (must be added; otherwise everything is denied by default) (rule + number + permit/deny + source IP)
Advanced ACL 3000-3999
acl 3000 rule 10 deny tcp source 1.1.1.1 0.0.0.255 destination 2.2.2.2 0.0.0.0 destination-port eq 21 //Add rule number 10 to deny the internal network 1.1.1.1/24 from accessing the FTP (port 21) service of the external network 2.2.2.2 rule 20 permit ip source 3.3.3.3 0.0.0.255 destination any //Allow this IP segment to access all external network services
- In this rule, TCP specifies the intercepted protocol (TCP, UDP, ICMP, IP can also be selected)
- destination-port eq 21 matches destination port 21; here eq means equal to, gt means greater than, lt means less than
- The 0.0.0.255 wildcard mask is used to match a target segment within a /24 subnet
Layer 2 ACL 4000-4999
Layer 2 ACLs are used to filter MAC addresses and VLANs.
acl 4000 rule 10 deny source-mac 00e0-fc12-3456 rule 20 permit souce-mac any //Allow other MAC addresses to pass (must be added; otherwise everything is denied by default)
Applying ACLs by Binding to Interfaces
After an ACL is created, it must be bound to a direction of the interface, where the inbound direction is in and the outbound direction is out.
- Follow the rule of placing advanced ACLs close to the destination and basic ACLs close to the source
int g0/0/1 traffic-filter inbound acl 3000 display acl 3000 //Check whether the ACL configuration is normal display traffic-filter int g0/0/1 //Check the ACL application status save //Save to prevent loss after a restart
- inbound filters traffic entering the device through the interface, e.g., the external interface filtering internal outbound traffic
- outbound filters traffic leaving through the device’s outbound interface
ACL Notes
- Rule order: ACL rules are matched from top to bottom, and matching stops as soon as one matches, so precise ACL rules must come first and broad ACL rules after
- Default rule: every ACL ends with an implicit deny-all rule, so you must manually add permit any to allow legitimate traffic other than what the ACL denies
- Direction selection: for example, to deny internal access to external FTP, the ACL can be applied to the router’s internal outbound direction or external inbound direction; prefer the external inbound direction, which reduces the forwarding of unnecessary traffic
- Don’t misconfigure advanced ACLs: if an advanced ACL is applied on the source device side, it may cause other traffic to be incorrectly intercepted; it is recommended to apply it close to the destination device
- ACL—》add rules---》bind to interface
- Basic ACLs control source IPs, advanced ACLs control IP + protocol + port, and Layer 2 ACLs control MAC/VLAN
- Rule order and direction are key to effectiveness; since everything is denied by default, legitimate traffic must be manually allowed
Wildcard Mask Matching Rules
| Binary Bit | Wildcard Mask Meaning | Subnet Mask Meaning |
|---|---|---|
| 0 | Must match exactly (fixed bit) | Network bit (fixed bit) |
| 1 | Can be anything (ignored bit) | Host bit (variable bit) |
It is mainly used to tell the device which bits must be matched precisely and which can be ignored.
Exact Matching
For example: need to precisely match 192.168.1.100
Subnet mask for matching a single IP: 255.255.255.255, all bits are fixed The wildcard mask is: 255.255.255.255 - 255.255.255.255 = 0.0.0.0 The ACL syntax is: source 192.168.1.100 0.0.0.0 This means none of the four IP octets may differ; a complete match is required
Segment Matching
For example: need to match the 192.168.1.0/24 segment, i.e., 192.168.1.100~192.168.1.254
Subnet mask: 255.255.255.0, the first three octets are fixed The wildcard mask is: 255.255.255.255 - 255.255.255.0 = 0.0.0.255 ACL then: source 192.168.1.0 0.0.0.255
Advanced: Fixed Matching of a Segment
For example: need to match the 192.168.0.0/16 segment: 192.168.x.x
Subnet mask: 255.255.0.0 The wildcard mask is: 255.255.255.255 - 255.255.0.0 = 0.0.255.255 ACL then: source 192.168.0.0 0.0.255.255
| Comparison Item | Subnet Mask | Wildcard Mask |
|---|---|---|
| Purpose | Divide network bits / host bits | Tell the ACL which IP bits to match |
| Meaning of 1 | Network bit (fixed) | Ignored bit (anything) |
| Meaning of 0 | Host bit (variable) | Match bit (must be the same) |
| Calculation | Set network bits to 1, host bits to 0 | Set match bits to 0, ignored bits to 1 |
NAT
NAT is Network Address Translation, which translates private internal IPs into public external IPs, allowing multiple internal devices to share one public IP to access the Internet. It also hides internal IPs and saves public IP resources.
- Class A: 10.0.0.0 ~ 10.255.255.255 (subnet mask 255.0.0.0)
- Class B: 172.16.0.0 ~ 172.31.255.255 (subnet mask 255.240.0.0)
- Class C: 192.168.0.0 ~ 192.168.255.255 (subnet mask 255.255.0.0)
These IPs cannot directly access the public network; they must be translated into public IPs via NAT.
Default Route
IP routing-table 0.0.0.0 0.0.0.0 next-hop address Characteristic: when there is no explicitly matching route, it is the fallback path through which data is uniformly forwarded.
NAT Applications
easy IP
acl 2000 rule permit source 192.168.1.0 0.0.0.255 Assume the outbound interface is g0/0/0 int g0/0/0 nat outbound 2000 //Traffic leaving through this interface is automatically NAT-translated, but a route is still missing ip route-static 0.0.0.0 0.0.0.0 external gateway IP //This is the route; NAT only creates the gate When there is no route (directly connected routes, dynamic routes, or other static routes), you need to configure the “route” — that is, the default route tells the device how to reach the external network
The default route is only needed as a fallback when there is no route to the external network in the routing table.
Address Pool NAT
acl 2000 rule permit source 192.168.1.0 0.0.0.255 nat address-group 1 (number) 200.1.1.10 200.1.1.20 //Create address pool 1, 200.1.1.0~200.1.1.20 int g0/0/0 nat outbound 2000 address-group 1 //Addresses leaving through the outbound interface connect to the external network via the NAT address pool
- address-group 1: prepare a batch of public IPs
- acl 2000: prepare a batch of internal IPs
- nat outbound 2000 address-group 1: internal → public, translation complete
nat address-group 1 start IP end IP acl 2000 rule permit source internal network segment wildcard mask interface outbound interface nat outbound 2000 address-group 1
NAT Server
Purpose: let the external network access internal servers, such as cameras, websites, game servers, etc.
int g0/0/0 nat server protocol tcp global 64.1.1.4 www inside 192.168.1.10 www global is the public external IP, inside is the internal network, and www means the web service, i.e., port 80 nat server global 64.1.1.4 inside 192.168.1.10 //Direct translation is also possible without specifying the protocol and port
Static NAT
Purpose: one internal IP permanently corresponds to one public IP, never changing.
nat static global 64.1.1.10 inside 192.168.1.10 Used when an internal server needs a fixed public IP; it cannot change and cannot be shared with others
NAT ALG
Purpose: allow certain special protocols to traverse NAT normally, such as FTP, SIP, etc.
nat alg ftp enable When NAT cannot handle certain protocols, ALG can be used to solve the problem
Viewing NAT Services
dis nat session all NAT Session Table Information: Protocol : UDP(17) SrcAddr Port Vpn : 192.168.1.1 5120 //Source address DestAddr Port Vpn : 64.1.1.10 5120 //Destination address NAT-Info New SrcAddr : 64.1.1.4 //The address pool translated the internal IP into this New SrcPort : 10259 //Port after translation New DestAddr : ---- New DestPort : ---- Finally: internal 192.168.1.1 → NAT → public 64.1.1.4
Telnet
A physical device telnetting into the virtual machines in eNSP.
telnet server enable //Enable the Telnet service user-interface vty 0 4 //Open five connections, 0 1 2 3 4, starting from 0 authentication-mode aaa / password //aaa requires a username and password, while password only requires a password aaa [Huawei-aaa]local-user test password cipher 123456 //Create the password for user test; cipher displays it in encrypted form [Huawei-aaa]local-user test privilege level 15 //Configure the privilege level for user test; among 0-15, the higher the value, the more privileges [Huawei-aaa]local-user test service-type telnet //Configure user test for Telnet access only
- Level 0: can only ping
- Level 1: can only view, cannot modify
- Levels 2-14: can configure, with privileges increasing level by level
- Level 15: has all device privileges
| Level | Privilege Name | Privilege Scope | Typical Executable Operations | Applicable Role |
|---|---|---|---|---|
| 0 | Access | Lowest privilege, basic network diagnostics only | ping, tracert | Temporary testers, guests |
| 1 | Monitoring | Can view device status, cannot configure | display command family (view version, interfaces, logs, etc.) | On-duty staff, monitoring personnel |
| 2 | Configuration | Can perform some basic configuration | Some simple configuration commands | Junior operations staff |
| 3 | Configuration | Can perform more system configuration | Basic system configuration, interface configuration | Operations staff |
| 4 | Management | Can manage most device functions | Routing, ACL, interface configuration, etc. | Intermediate operations staff |
| 5 | Management | Privileges further improved | More system management commands | Intermediate operations staff |
| 6 | Management | Can execute more management operations | Some policy and security-related configuration | Intermediate to senior operations staff |
| 7 | Management | Privileges close to a senior administrator | Most device management commands | Intermediate to senior operations staff |
| 8 | Management | Advanced management privileges | Can configure most security and system functions | Senior operations staff |
| 9 | Management | Higher management privileges | Can configure almost all non-core security items | Senior operations staff |
| 10 | Privileged | Close to the highest privilege | Can configure the vast majority of functions | Project lead, senior engineer |
| 11 | Privileged | High-privilege management | Almost all configuration + some security management | Senior engineer |
| 12 | Privileged | High-privilege management | Can execute most system-level operations | Senior engineer |
| 13 | Privileged | Close to the highest privilege | Can execute system-level and security-level operations | Senior engineer |
| 14 | Privileged | Almost the highest privilege | Everything is executable except a few critical operations | Senior engineer, administrator assistant |
| 15 | Highest privilege | Full control of the device | All commands: configuration, deletion, restart, save, upgrade, file management, etc. | Device administrator, highest-privilege account |
Network Topologies
Star Topology
Characteristic: other nodes are connected together through a central node. Advantages: easy to add devices; data must pass through the center, making relay easy and network monitoring convenient. Disadvantages: the central node is critical; if a problem occurs there, it easily affects the entire network.
Bus Topology
Characteristic: all nodes are connected through a single bus. Obsolete
Ring Topology
Characteristic: all nodes are connected into a ring. Advantages: saves cable. Disadvantages: not easy to expand.
Tree Topology
Characteristic: a hierarchical star structure shaped like a tree. Disadvantage: can quickly connect multiple star networks together, and is easy to expand. Disadvantage: problems with devices at higher levels can easily paralyze the network.
Full Mesh Network
Characteristic: all nodes are connected pairwise by cables. Advantages: high availability and high-efficiency communication. Disadvantages: high cost, not easy to expand.
Partial Mesh Network
Characteristic: based on full mesh, only important nodes are connected pairwise. Advantages: lower cost than full mesh. Disadvantages: lower reliability than full mesh.
Hybrid Network
Characteristic: combines all the network types listed above. Advantages: combines the pros and cons to fill in the gaps, enabling better networking. Disadvantages: relatively complex.
Network Models
OSI Model
- Application layer ——— provides network services to applications
- Presentation layer ——— data formatting, encryption and decryption
- Session layer ——— establishes, maintains, and manages session connections
- Transport layer ——— establishes, maintains, and manages end-to-end connections
- Network layer ——— IP addressing and route selection
- Data link layer ———— controls communication between the network layer and the physical layer
- Physical layer ——— bit stream transmission
TCP/IP Model
In actual application, the upper layers are usually merged while the lower two remain separate, resulting in the TCP/IP model. TCP/IP standard model
- Application layer
- Host-to-host layer
- Internet layer
- Network access layer
TCP/IP peer model
- Application layer
- Transport layer
- Network access layer
- Data link layer
- Physical layer
Common Protocols by Layer
Application Layer
HTTP, Telnet, FTP, SMTP, TFTP
Transport Layer
TCP, UDP
Network Layer
IP, IGMP: the protocol responsible for managing IP multicast group membership. It is used to establish and maintain multicast group membership relationships between IP hosts and other directly adjacent multicast routers. TCMP: based on the IP protocol, it sends control messages in the network and provides feedback on various problems that may occur in the communication environment; with this information, administrators can make diagnoses and take measures to solve them.
Data Link Layer
Ethernet: the Ethernet protocol, a multi-access broadcast-type data link layer protocol and currently the most widely used protocol. PPP: point-to-point, used for WANs. PPPoE: Point-to-Point Protocol over Ethernet, which carries the PPP protocol over Ethernet; a common application is home broadband dial-up Internet access.
If you enjoyed this, leave a comment~