华为交换机基础配置

1.华为交换机关闭http和https

undo http server enable
undo http secure-server enable

  注：关闭时需先关闭http再关闭https；开启时需先开启https再开启http。

2.华为交换机修改密码：

[CN-HBCR-OA-1-2F419-ASW30-aaa] local-user admin password irreversible-cipher uxin777888
Please enter old password:

3.华为交换机SSH远程配置

rsa local-key-pair create  # 生成RSA密钥对。

aaa
 local-user admin password irreversible-cipher xinghen1216
 local-user admin service-type ssh telnet
# 创建本地用户admin，并设置用户密码、服务类型

stelnet server enable
ssh user admin
ssh user admin authentication-type password
ssh user admin service-type stelnet

user-interface vty 0 4
 authentication-mode aaa
 user privilege level 15
 protocol inbound ssh 

4.华为交换机配置ntp

clock timezone BJ add 8  #配置时区
ntp-service unicast-server 10.1.41.156  #配置时间服务器

dis ntp-service status  #查看ntp状态
 clock status: synchronized 
 clock stratum: 4 
 reference clock ID: 10.1.41.156
 nominal frequency: 100.0000 Hz 
 actual frequency: 100.0000 Hz 
 clock precision: 2^18
 clock offset: 0.0000 ms 
 root delay: 31.18 ms 
 root dispersion: 1.13 ms 
 peer dispersion: 1.95 ms 
 reference time: 02:41:38.856 UTC Nov 2 2021(E52B23E2.DB3ECCC4)
 synchronization state: clock set 

dis ntp-service sessions  #查看ntp会话
 clock source: 10.1.41.156 
 clock stratum: 3 
 clock status: configured, master, sane, valid
 reference clock ID: 203.107.6.88
 reach: 3 
 current poll: 64 
 now: 41 
 offset: -4.3416 ms 
 delay: 4.64 ms 
 disper: 1.01 ms

5.华为交换机配置snmp

snmp-agent sys-info version all  #配置snmp版本
snmp-agent community read cipher uxinsnmp123  #配置snmp只读团体名称
snmp-agent trap enable #开启交换机主动发送trap消息功能
snmp-agent target-host trap address udp-domain 10.1.41.253 params securityname cipher uxinsnmp123  #配置告警主机

6.华为交换机管理员安全配置

  1）举例：口令长度不低于12位，为数字、字母、特殊字符混合组合；密码有效期限为90天；输入密码次数过多后锁定。用户成功登录后10分钟内无任何操作，则断开该登录连接；三权（系统管理员、安全管理员、审计管理员）分开 。  

[CN-HBDHY-OA-1-1F312-DSW01]undo user-interface password complexity-check disable  #开启全局密码复杂度检测，此规则默认开启
[CN-HBDHY-OA-1-1F312-DSW01]set password min-length 12  #配置密码长度最短为12位
[CN-HBDHY-OA-1-1F312-DSW01]aaa
[CN-HBDHY-OA-1-1F312-DSW01-aaa]local-user admin idle-timeout 10  #配置本地管理员admin的闲置超时时间为为10分钟
[CN-HBDHY-OA-1-1F312-DSW01-aaa]user-password complexity-check  #开启本地账号密码复杂度检测
[CN-HBDHY-OA-1-1F312-DSW01-aaa]local-aaa-user wrong-password retry-interval 5 retry-time 5 block-time 5  #本地帐号用户的重试时间间隔为5分钟，本地帐号连续输入错误密码的限制次数为5次，本地帐号锁定时间为5分钟
[CN-HBDHY-OA-1-1F312-DSW01-aaa]local-aaa-user password policy administrator  #进入administrator密码策略视图
[CN-HBDHY-OA-1-1F312-DSW01-aaa-lupp-admin]password expire 90  #配置administrator密码策略的密码失效时间位90天
[CN-HBDHY-OA-1-1F312-DSW01-aaa-lupp-admin]password alert before-expire 30  #配置administrator密码策略的密码过期前30天提醒
[CN-HBDHY-OA-1-1F312-DSW01-aaa-lupp-admin]password history record number 5  #配置administrator密码策略的历史密码记录为5条

  2）登录源IP限制  

acl name sourlimit 2001
 rule 11 permit source 10.1.13.100 0
 rule 12 permit source 10.1.21.131 0
 rule 15 permit source 10.1.41.170 0
 rule 21 permit source 10.16.2.100 0
ssh server acl 2001

  3）管理员三权分开

 local-user admin password irreversible-cipher Abc123123# idle-timeout 10 0
 local-user admin privilege level 15  #系统管理员分配管理级权限，即有全部权限
 local-user admin service-type terminal ssh
 local-user audit password irreversible-cipher Abc123123# idle-timeout 10 0
 local-user audit privilege level 1  #审计管理员分配监控级权限，只有部门查看权限
 local-user audit service-type terminal ssh
 local-user security password irreversible-cipher Abc123123# idle-timeout 10 0
 local-user security privilege level 2  #安全管理员分配配置级权限，有日常配置查看和修改的权限，不能进行FTP、文件下载、故障诊断等
 local-user security service-type terminal ssh

 7.华为交换机syslog配置

  0-7共八个级别，0最高，7最低

    

  1）保存到buffer 

  info-center logbuffer：开启Log信息向Log缓冲区的发送功能，此功能默认开启

  2）保存到syslog服务器  

[CN-HBDHY-OA-1-1F312-DSW01]info-center loghost source Vlanif348
[CN-HBDHY-OA-1-1F312-DSW01]info-center loghost 10.1.33.10 facility local0 

  3）查看syslog配置    

[CN-HBDHY-OA-1-1F312-DSW01]dis info-center 
Information Center:enabled
Log host:
    the interface name of the source address:Vlanif348
    10.1.33.10, channel number 2, channel name loghost,
language English , host facility local0
Console:
    channel number : 0, channel name : console 
Monitor:
    channel number : 1, channel name : monitor 
SNMP Agent:
    channel number : 5, channel name : snmpagent 
Log buffer:
    enabled,max buffer size 1024, current buffer size 512,
current messages 512, channel number : 4, channel name : logbuffer
dropped messages 0, overwritten messages 97581 
Trap buffer:
    enabled,max buffer size 1024, current buffer size 256,
current messages 256, channel number:3, channel name:trapbuffer
dropped messages 0, overwritten messages 219323 
logfile:
    channel number : 9, channel name : channel9, language : English 
Information timestamp setting:
        log - date, trap - date, debug - date millisecond 

 Sent messages = 531626, Received messages = 531626 

 IO Reg messages = 0 IO Sent messages = 0