命令速查表 · 华为 VRP

HCIE-DataCom 全协议配置 / 验证 / 排错命令一页流 · 按 Ctrl+P 可打印随身 · 【C】=配置 【V】=查看验证

#【C】系统视图与命名
system-view
sysname CORE-S1
#【C】管理地址 + SSH
interface MEth0/0/1 / Vlanif 99
 ip address 10.1.99.1 24
aaa
 local-user admin password irreversible-cipher Huawei@123
 local-user admin privilege level 15
 local-user admin service-type ssh
stelnet server enable
ssh user admin authentication-type password
user-interface vty 0 4
 authentication-mode aaa
 protocol inbound ssh
#【C】日志/NTP
info-center logbuffer size 1024
ntp-service unicast-server 10.1.99.100
#【V】三板斧
display version / display interface brief / display ip interface brief
display current-configuration | include ospf     # 过滤神器
display this                                       # 当前视图配置
save

#【C】VLAN 与端口
vlan batch 10 20 99
interface GigabitEthernet0/0/1
 port link-type access
 port default vlan 10
interface GigabitEthernet0/0/24
 port link-type trunk
 port trunk allow-pass vlan 10 20 99
#【C】SVI 网关
interface Vlanif10
 ip address 10.1.10.254 24
#【C】MSTP
stp mode mstp
stp region-configuration
 region-name RG1
 instance 1 vlan 10 30
 instance 2 vlan 20 40
 active region-configuration
stp instance 0 priority 4096        # 全局视图；实例1根
stp edged-port default               # 全局边缘口（接口视图亦可）
stp bpdu-protection                  # 边缘口保护
#【C】LACP 链路聚合
interface Eth-Trunk 1
 mode lacp-static
 port trunk allow-pass vlan 10 20
 trunkport GigabitEthernet0/0/1 0/0/2
 lacp preempt enable                # 如需抢占
#【C】堆叠（S 系列 iStack）
stack slot 0 priority 200           # 主
interface stack-port 0/1
 port member-group interface GigabitEthernet0/0/51
mad detect mode direct              # 直连MAD
#【V】
display vlan / display port vlan
display stp brief / display stp region-configuration
display eth-trunk / display lacp statistics eth-trunk 1
display stack / display stack configuration
display mac-address / display mac-address flapping record

#【C】基础多区域
ospf 1 router-id 1.1.1.1
 area 0.0.0.0
  network 10.1.12.0 0.0.0.255
 area 0.0.0.1
  network 10.1.13.0 0.0.0.255
#【C】接口微调
interface GigabitEthernet0/0/0
 ospf cost 100
 ospf timer hello 1                  # 配套 dead 4
 ospf network-type p2p               # 快收敛改造
 ospf dr-priority 100
 ospf authentication-mode hmac-sha256 1 huawei@123
 silent-interface GigabitEthernet0/0/1  # 面向终端
#【C】特殊区域/汇总/默认
 area 0.0.0.1
  nssa no-summary                    # / stub no-summary
  abr-summary 10.1.0.0 255.255.0.0
 asbr-summary 172.16.0.0 255.255.0.0
 default-route-advertise always cost 10
 import-route static type 1 tag 100
#【C】虚链路
 area 0.0.0.1
  virtual-link 3.3.3.3
#【V】排错五连
display ospf peer brief
display ospf lsdb / display ospf lsdb ase
display ospf routing
display ospf error                  # 认证/区域不符计数
display ospf interface
display ospf vlink

#【C】
isis 1
 is-level level-2
 cost-style wide
 network-entity 49.0001.0010.0001.0001.00
 import-route isis level-2 into level-1   # 渗透（+filter-policy）
 import-route direct
interface GigabitEthernet0/0/0
 isis enable 1
 isis cost 20
 isis circuit-level level-2
 dis-priority 100
#【V】
display isis peer / display isis interface
display isis lsdb [level-2] [detail]
display isis route / display isis name

#【C】邻居
bgp 65001
 router-id 1.1.1.1
 peer 10.1.12.2 as-number 65002
 peer 2.2.2.2 as-number 65001
 peer 2.2.2.2 connect-interface LoopBack0
 peer 2.2.2.2 password cipher xxx
 peer 10.1.12.2 ebgp-max-hop 2       # 非直连
 ipv4-family unicast
  peer 10.1.12.2 enable
  peer 2.2.2.2 enable
  peer 2.2.2.2 next-hop-local
  peer 2.2.2.2 preferred-value 100    # 选路规则①
  peer 2.2.2.2 route-policy RP-IN import
  peer 2.2.2.2 advertise-community
#【C】RR / 注入 / 聚合
  peer 3.3.3.3 reflect-client
  network 10.1.1.0 255.255.255.0     # 表中需精确存在
  import-route ospf 1 route-policy ONLY-DC
  aggregate 10.1.0.0 255.255.0.0 detail-suppressed
  default-route-advertise
  dampening 15 750 2000 16           # 抖动抑制
#【V】
display bgp peer [verbose]
display bgp routing-table 10.1.1.0 [verbose]
display bgp routing-table peer 2.2.2.2 received-routes
display bgp routing-table peer 2.2.2.2 accepted-routes
refresh bgp all import               # 软复位

#【C】前缀列表
ip ip-prefix P1 index 10 permit 10.1.0.0 16 greater-equal 24 less-equal 28
ip ip-prefix DEF index 10 permit 0.0.0.0 0
#【C】route-policy（含 tag 防环：先拒本域标记，再放行其余并打标）
route-policy ISIS2OSPF deny node 10
 if-match tag 10                      # 回锅路由拒收
route-policy ISIS2OSPF permit node 20
 apply tag 20                         # 其余打本域标记
route-policy OSPF2ISIS deny node 10
 if-match tag 20
route-policy OSPF2ISIS permit node 20
 apply tag 10
ospf 1
 import-route isis 1 route-policy ISIS2OSPF
 filter-policy ip-prefix P1 import    # 只影响计算入表
#【C】PBR 策略路由
traffic classifier C1
 if-match acl 3000
traffic behavior B1
 redirect ip-nexthop 20.1.1.2 track nqa admin toISP
 # 说明：不配 track 时下一跳不可达会「回退查路由表」，不会自动切换/丢弃
 #      redirect ip-nexthop 20.1.1.2 discard  → 不可达直接丢
traffic policy P1
 classifier C1 behavior B1
interface GigabitEthernet0/0/1
 traffic-policy P1 inbound
#【V】
display route-policy / display ip ip-prefix
display ip routing-table 10.1.1.0 verbose
display traffic-policy applied-record

#【C】
multicast routing-enable
interface GigabitEthernet0/0/0
 pim sm
 igmp enable
 igmp version 3
pim
 static-rp 2.2.2.2                   # 或 BSR：
 c-bsr LoopBack0 priority 10
 c-rp LoopBack0 group-policy 2000
#【C】二层
igmp-snooping enable (VLAN 视图)
#【V】
display pim neighbor / display pim interface
display pim routing-table [verbose]
display pim rp-info
display igmp interface / display igmp group
display multicast routing-table
display multicast forwarding-table
display l2-multicast forwarding-table vlan 10
#【测试】模拟源（eNSP）
ping -g 239.1.1.1 x.x.x.x

#【C】骨干 LDP
mpls lsr-id 1.1.1.1
mpls
mpls ldp
interface GigabitEthernet0/0/0
 mpls
 mpls ldp
#【C】VPN 实例（PE）
ip vpn-instance VPNA
 route-distinguisher 100:1
 vpn-target 100:1 both / 100:2 export-extcommunity
interface GigabitEthernet0/0/2
 ip binding vpn-instance VPNA      # 先绑再配地址！
 ip address 192.168.1.1 24
#【C】MP-BGP VPNv4
bgp 65001
 ipv4-family vpnv4
  peer 3.3.3.3 enable
 ipv4-family vpn-instance VPNA
  peer 192.168.1.2 as-number 65010   # PE-CE
  import-route direct
#【V】排错五连（口诀：有传对在通）
display ip vpn-instance verbose
display bgp vpnv4 all peer
display bgp vpnv4 all routing-table 192.168.10.0
display mpls lsp / display mpls lsp vpn-instance VPNA
ping -vpn-instance VPNA 192.168.1.2
#【C】VXLAN（示意）
bridge-domain 10
 vxlan vni 10010
interface nve 1
 source 2.2.2.2
 vni 10010 head-end peer-list protocol bgp
bgp 65001
 l2vpn-family evpn
  peer 1.1.1.1 enable

#【C】ACL
acl 3000
 rule 5 permit tcp source 10.1.10.0 0.0.0.255 destination 192.168.100.10 0 dest-port 443
interface GigabitEthernet0/0/1
 traffic-filter outbound acl 3000
#【C】DHCP Snooping + IPSG + DAI
dhcp enable
dhcp snooping enable
vlan 10
 dhcp snooping enable
interface GigabitEthernet0/0/24
 dhcp snooping trusted
 arp anti-attack check user-bind enable
 ip source check user-bind enable
#【C】802.1X
dot1x enable
interface GigabitEthernet0/0/1
 dot1x enable
 port-isolate enable group 1
#【C】GRE over IPSec
interface Tunnel0/0/1
 ip address 172.16.0.1 255.255.255.0
 tunnel-protocol gre
 source 10.1.12.1
 destination 10.1.23.3
ike proposal 10
 encryption-algorithm aes-256 / dh group14 / authentication-method pre-share
ike peer PEER1 v2
 remote-address 202.1.1.2
 pre-shared-key cipher xxx
ipsec proposal PROP1
 esp authentication-algorithm sha2-256
 esp encryption-algorithm aes-256
ipsec policy MAP1 10 isakmp
 ike-peer PEER1 / proposal PROP1 / security acl 3000
interface GigabitEthernet0/0/1
 ipsec policy MAP1
#【V】
display ike sa / display ipsec sa [verbose]
display dhcp snooping [binding] / display arp anti-attack statistics
display acl 3000 / display dot1x statistics

#【C】VRRP
interface Vlanif10
 ip address 10.1.10.2 255.255.255.0
 vrrp vrid 10 virtual-ip 10.1.10.254
 vrrp vrid 10 priority 120
 vrrp vrid 10 preempt-mode timer delay 20
 vrrp vrid 10 track interface GigabitEthernet0/0/1 reduced 30
 vrrp vrid 10 track bfd-session session-name TOUP
#【C】BFD 静态会话 + 联动
bfd
bfd TOUP bind peer-ip 10.1.23.2 interface GigabitEthernet0/0/1
 discriminator local 1
 discriminator remote 2
 min-rx-interval 100
 min-tx-interval 100
 detect-multiplier 3
 commit
interface GigabitEthernet0/0/0
 ospf bfd enable
ip route-static 0.0.0.0 0 10.1.12.2 track bfd-session TOUP
#【V】
display vrrp [verbose]
display bfd session all [verbose]
display ospf bfd session

#【C】三段式
traffic classifier VOIP
 if-match dscp ef
traffic behavior B-VOIP
 remark dscp ef
 queue llq bandwidth 20000
 car cir 30000 pir 40000
traffic policy ENTERPRISE
 classifier VOIP behavior B-VOIP
 statistic enable
interface GigabitEthernet0/0/1
 traffic-policy ENTERPRISE inbound
#【C】GTS 出口整形
interface GigabitEthernet0/0/2
 qos gts cir 5000 cbs 125000
#【V】
display traffic classifier / behavior / policy
display traffic-policy statistics interface GigabitEthernet0/0/1 inbound
display qos queue statistics interface GigabitEthernet0/0/2

#【C】
ipv6
ospfv3 1
 router-id 1.1.1.1
interface GigabitEthernet0/0/0
 ipv6 enable
 ipv6 address 2001:DB8:12::1/64
 ospfv3 1 area 0
 undo ipv6 nd ra halt              # 默认抑制RA，必开！
ipv6 route-static 2001:DB8:10:: 64 2001:DB8:12::2
ipv6 route-static :: 0 GigabitEthernet0/0/0 FE80::2E0:FCFF:FE11:22
#【C】DHCPv6
dhcp enable
ipv6 pool POOL1
 address prefix 2001:DB8:2::/64
 dns-server 2001:DB8::53
interface GigabitEthernet0/0/2
 ipv6 nd autoconfig managed-address-flag
#【V】
display ipv6 interface [brief]
display ipv6 routing-table
display ospfv3 peer / display ipv6 neighbors

#【C】NETCONF 使能
netconf
 protocol inbound ssh port 830
#【C】Telemetry（示意）
telemetry
 sensor-group SG1
  sensor-path huawei-ifm:ifm/interfaces/interface
 destination-group DG1
  ipv4-address 10.1.99.100 port 50001 protocol grpc no-tls
 subscription SUB1
  sensor-group SG1 sample-interval 1000
  destination-group DG1
#【V】
display netconf capability / display netconf session all
display telemetry subscription
# Python：ncclient 核心 3 行
from ncclient import manager
m = manager.connect(host='10.1.1.1', port=830, username='admin',
                    password='xxx', device_params={'name':'huawei'})
print(m.get_config(source='running'))