H3C交换机、路由器、防火墙常用指令，详细分类，一篇整理！

interface GigabitEthernet1/0/1#进入接口视图undoshutdown#启用接口portlink-type access/trunk/hybrid#设置端口模式port access vlan10#将接口加入VLAN 10port-group manual1#创建手动端口组（批量配置）

vlan10#创建VLAN 10port trunk permit vlan all#允许所有VLAN通过Trunk口display vlan#查看VLAN信息interface Vlan-interface10#进入VLAN虚接口配置IP

acl number 2000#创建基本ACLtraffic-filter inbound acl 2000#应用ACL到接口port-securityenable#启用端口安全

interface Bridge-Aggregation1 #创建聚合组link-aggregation mode dynamic #启用LACP动态协商interface GigabitEthernet1/0/1#进入接口portlink-aggregation group1#将成员端口加入聚合组

stpenable#全局启用STPstp mode rstp #配置为快速生成树模式display stp brief #查看STP端口状态

mirroring-group1local#创建本地镜像组mirroring-group1mirroring-port GigabitEthernet1/0/1both #配置镜像端口mirroring-group1monitor-port GigabitEthernet1/0/2#设置监控端口

clock timezone BJadd8#设置时区（北京时间）language-mode Chinese  #切换中文界面display version     #查看设备版本信息

interfaceGigabitEthernet0/0#进入接口视图ip address192.168.1.1255.255.255.0#配置接口IP
interface LoopBack0   #创建环回接口ip address1.1.1.132 #配置环回地址

iproute-static0.0.0.00.0.0.0192.168.1.254#配置默认路由ospf1#启动OSPF进程network192.168.1.00.0.0.255area0#宣告OSPF网络bgp65001#启动BGP进程

nat address-group 1#创建NAT地址池dhcpenable#全局启用DHCPdhcp server ip-pool VLAN10#配置DHCP地址池

ikeproposal10#创建IKE提议encryption-algorithm aes-cbc-128#设置加密算法ipsec policy POLICY110isakmp #创建IPSec策略tunnel local202.100.1.1#指定本端公网IP

interfaceVlan-interface10 vrrpvrid1virtual-ip192.168.1.254#配置虚拟IPvrrpvrid1priority120#设置优先级

user-interface vty04authentication-mode scheme #启用AAA认证protocolinbound ssh   #仅允许SSH登录

aclnumber3000rule5permit ip source192.168.1.00.0.0.255destination10.1.1.00.0.0.255#精确匹配源/目的网段

system-view#进入系统视图sysname FW01#命名防火墙language-mode Chinese # 切换中文界面interface GigabitEthernet1/0/1#配置接口IPsave force #强制保存配置resetsaved-configuration #清除启动配置

security-zone name Trust#创建安全区域zone-pair securitysourceTrust destination Untrust#配置域间策略rule permitsource192.168.1.0 0.0.0.255#允许指定网段流量

aspf policy 1 #创建ASPF策略detect http #启用HTTP应用检测zone-pair securitysourceUntrust destination Trust aspf apply policy 1 #应用策略到安全域间

acladvanced3000rulepermit tcp source192.168.1.00.0.0.255destination10.1.1.10eq80#放行HTTP流量packet-filter3000inbound #应用ACL到接口入方向

nataddress-group1address202.100.1.100202.100.1.200#配置地址池natoutbound3000address-group1#关联ACL与地址池

natserver protocol tcp global202.100.1.18080inside192.168.1.10080#端口映射

ikeproposal10encryption-algorithm aes-cbc-128 # 配置IKE加密算法ipsecpolicy POLICY110isakmp securityacl3001 # 指定感兴趣流

anti-ddosenable#启用防DDoS功能blacklistenable#启用黑名单

info-center loghost192.168.1.100facility local6 #发送日志到服务器displayfirewall session table #查看会话表

displaycpu-usage #查看CPU使用率displaymemory #查看内存状态displaylogbuffer #查看日志缓存displaypower  #显示电源状态displayarp   #查看ARP表项displayip routing-table #查看IPv4路由表displayipv6 routing-table#查看IPv6路由表displaybgp peer  #检查BGP邻居状态