Example for Configuring a Small-Sized Campus Network

Procedure

1. Log in to a switch.

   A switch using factory settings can be logged in to through the web system for the first time. The following uses the switch CORE as an example to describe how to log in to a switch through the web system for the first time. The login methods of switches ACC1 and ACC2 are similar to that of the switch CORE.

   The switch that does not use factory settings cannot be logged in to through the web system for the first time. However, subsequent logins through the web system are supported. For details, see Web System Login.

   1. Connect the switch to a PC.

      Connect the PC to any Ethernet interface (except the management interface) of the switch.

   2. Enter the initial configuration mode.

      Press and hold down the MODE button for 6 seconds or longer. When all indicators are steady green, the switch enters the initial configuration mode.

      In the initial configuration mode, the system sets the switch's IP address to 192.168.1.253/24 and sets the level of the default user admin to 15 by default.

   3. Configure an IP address for the PC.

      To ensure that the switch and PC are reachable, configure an IP address that is on the same network segment as the switch's default IP address for the PC.

   4. Log in to the switch through the web system.

      Open a browser on the PC, enter https://192.168.1.253 in the address box, and press Enter. The web system login page is displayed, as shown in Figure 10-3. Enter the default user name and password, and select the system language. Click GO or press Enter. The web system configuration page is displayed. The default username and password are available in S Series Switches Default Usernames and Passwords (Enterprise Network or Carrier). If you have not obtained the access permission of the document, see Help on the website to find out how to obtain it.

      Open a browser on the PC, enter https://192.168.1.253 in the address box, and press Enter. The page for creating a web system user is displayed, as shown in Figure 10-2. After a user is created, the login web system login page is displayed, as shown in Figure 10-3. Enter the created user name and password, select the system language, and click GO or press Enter. The web system configuration page is displayed.

      Figure 10-2 Page for creating a web system user
      
      Figure 10-3 First login page of the web system
      

      To log in to a switch through the web system for the first time, you must use Microsoft Edge, Internet Explorer 10.0, Internet Explorer 11.0, Firefox 61.0 to 66.0, and Google Chrome 64.0 to 73.0. If a browser or browser patch is not in the specified range, the web page may not be properly displayed. Upgrade the browser and browser patch.

      When you log in to the web system for the first time, you must change the password. Only in this way, you can access the main page of the web system.

   5. Configure the switch.
      On the web configuration page, perform the following operations in the Basic Setting area:

      • Set Management IP Address to 10.10.1.1 and Mask to 24(255.255.255.0).
      • Enter default password in the Old Password text box.
      • Enter the password of the created user in the Old Password text box.
      • Enter a new password in WEB User Password and Confirm Password text boxes.
      • Select 15 from the WEB User Level drop-down list box.

      The configuration is shown in Figure 10-4. Click Apply.

      Figure 10-4 Initial configuration
      

      The configured management IP address and 192.168.1.253/24 are not on the same network segment, so you cannot log in to the switch through the web system after exiting the first login page. Therefore, the IP address of the PC needs to be configured again to ensure that the switch and PC are reachable.

2. Configure interfaces and VLANs on access switches (ACC1 is used as an example here, and the configuration on ACC2 is similar).
   • Configure Eth-Trunk 1 that connects ACC1 to CORE to transparently transmit packets from the VLAN of department A.
     1. Choose Configuration > Basic Services > Interface Settings, and click Connect to Switch in the Select Task area.
     2. Select GigabitEthernet0/0/1 and GigabitEthernet0/0/2 to be configured.
     3. Select Enable link aggregation in the Configure Interface area, and set parameters, as shown in Figure 10-5.
        • Interface Status: ON
        • Eth-Trunk: 1
        • Eth-Trunk Mode: Static LACP
        • Allowed VLANs: 10
        • Default VLAN: 1
        • Auto VLAN Creation: ON
        Figure 10-5 Configuring Eth-Trunk 1 that connects ACC1 to CORE
        
        
     4. Click Apply. In the dialog box that is displayed, click OK.
   • Configure interfaces of ACC1 connected to users and add users to a VLAN.
     1. Choose Configuration > Basic Services > Interface Settings, and click Connect to PC in the Select Task area.
     2. Select Ethernet0/0/2 and Ethernet0/0/3 to be configured.
     3. Set parameters in the Configure Interface area, as shown in Figure 10-6.
        • Interface Status: ON
        • Default VLAN: 10
        • Port Isolation: OFF
        • Port Security: OFF
        • Loopback Detection: OFF
        • Trust Priority: None
        Figure 10-6 Configuring interfaces of ACC1 connected to users
        
        
     4. Click Apply. In the dialog box that is displayed, click OK.
   • Configure edge ports and the BPDU protection function.
     1. Choose Configuration > Advanced Services > STP > STP Summary. The STP Summary tab page is displayed.
     2. Enable BPDU protection in the STP Global Setting area, as shown in Figure 10-7. Click Apply.
        Figure 10-7 Enabling the BPDU protection function
        
        
     3. Select Ethernet0/0/2 and Ethernet0/0/3 to be configured in the Interface Status area, and click Enable Edge Port, as shown in Figure 10-8.
        Figure 10-8 Configuring edge ports
        
        

3. Configure the interfaces and VLAN on the core switch.
   • Configure downlink interfaces of the core switch. (The following uses the configuration of Eth-Trunk 1 that connects CORE to ACC1 as an example, and the configuration for connecting to ACC2 is similar.)
     1. Choose Configuration > Basic Services > Interface Settings > Service Interface Setting, and click Connect to Switch in the Select Task area.
     2. Select GigabitEthernet0/0/1 and GigabitEthernet0/0/2 to be configured.
     3. Select Enable link aggregation in the Configure Interface area, and set parameters, as shown in Figure 10-9.
        • Interface Status: ON
        • Eth-Trunk: 1
        • Eth-Trunk Mode: Static LACP
        • Allowed VLANs: 10
        • Default VLAN: 1
        • Auto VLAN Creation: ON
        Figure 10-9 Configuring Eth-Trunk 1 that connects CORE to ACC1
        
        
     4. Click Apply. In the dialog box that is displayed, click OK.
   • Configure VLANIF interfaces for departments A and B to communicate with each other.
     1. Choose Configuration > Basic Services > VLAN to access the VLAN configuration page.
     2. Click 10 in the VLAN ID column. The Modify VLAN dialog box is displayed.
     3. Click Create VLANIF, set IPv4 address to 10.10.10.1, and set Mask to 24. Use the same method to configure VLANIF 20, as shown in Figure 10-10 and Figure 10-11. Click OK.
        Figure 10-10 Configuring VLANIF 10
        
        
        Figure 10-11 Configuring VLANIF 20
        
        
   • Configure uplink interfaces and VLANIF interfaces of the core switch for communication between the campus network and the Internet.
     1. Choose Configuration > Basic Services > VLAN to access the VLAN configuration page.
     2. Click Create. In the Create VLAN dialog box, set parameters, as shown in Figure 10-12.
        • VLAN ID: 100
        • Select Create VLANIF
        • IPv4 address: 10.10.100.1
        • Mask: 24
        • Add Interface: GigabitEthernet0/0/20
        Figure 10-12 Configuring VLAN 100
        
        
     3. Click OK.

4. Configure the DHCP server on the core switch.

   Configure the DHCP server on CORE to assign IP address to users in departments A (VLAN 10) and B (VLAN 20).

   1. Choose Configuration > Basic Services > DHCP > DHCP Address Pool. On the DHCP configuration page, set DHCP status to ON.
   2. Click Create. In the Create DHCP Address Pool dialog box, set parameters, as shown in Figure 10-13. Click OK. Users in department A then can obtain IP addresses from the interface address pool on VLANIF 10.
      • Address pool type: Interface address pool
      • Select Interface: Vlanif10
      Figure 10-13 Configuring users in department A to obtain IP addresses from an interface address pool
      
      

   3. Use the same method to configure users in department B to obtain IP addresses from the interface address pool on VLANIF 20. The parameter settings are shown in Figure 10-14.
      Figure 10-14 Configuring users in department B to obtain IP addresses from an interface address pool
      
      

5. Configure routes on the core switch.
   1. Choose Configuration > Basic Services > Static Routes > IPv4 Static Routes. The IPv4 Static Routes tab page is displayed.
   2. Click Add and set the parameters, as shown in Figure 10-15.
      • Destination IP Address: 0.0.0.0
      • Destination IP Address Mask: 0.0.0.0
      • Next Hop Address: 10.10.100.2
      Figure 10-15 Configuring routes on the core switch
      
      

   3. Click .
6. Configure an egress router. (The following uses an AR router in V200R009C00 as an example. For details about how to log in to the web system of an AR router, see the corresponding documentation.)

   Before configuring the egress router, you need the following data: IP address of the public network interface (1.1.1.2/30), IP address of the public network gateway (1.1.1.1), and DNS server address (2.2.2.2). These parameters are provided by carriers when the broadband service is applied. The data used in this example is for reference only.

   • Configure IP addresses of the intranet and public network interfaces on the egress router.
     1. Choose WAN Access > Ethernet Interface. The Ethernet Interface tab page is displayed.
     2. In the Ethernet Interface List area, click in the Ethernet0/0/1 column. The Modify Ethernet Interface dialog box is displayed.
     3. Set parameters, as shown in Figure 10-16. Click OK. The IP address of the public network interface is configured.
        • Select IPv4.
        • Connection mode: Static
        • IP address: 1.1.1.2
        • Subnet mask: 255.255.255.252
        Figure 10-16 Configuring an IP address for the public network interface
        
        
     4. Use the same method to configure an IP address for the intranet interface. The parameter settings are shown in Figure 10-17.
        Figure 10-17 Configuring an IP address for the intranet interface
        
        
   • Configure an ACL that allows users to connect to the Internet.
     1. Choose Security > ACL > Basic ACL Setting. The Basic ACL Setting tab page is displayed.
     2. Click Create. The Create Basic ACL Setting dialog box is displayed.
     3. Set parameters, as shown in Figure 10-18. Click OK. The basic ACL is created.
        • ACL name: acl2000
        • Type: IPv4
        Figure 10-18 Creating a basic ACL
        
        
     4. Click Add rules in the acl2000 column, and set parameters, as shown in Figure 10-19. Click .

        ACL Rule ID	Action	Source IP Address/Prefix Length (Wildcard)
        5	Permit	10.10.10.0/0.0.0.255
        10	Permit	10.10.20.0/0.0.0.255
        15	Permit	10.10.100.0/0.0.0.255

        Figure 10-19 Adding rules to a basic ACL
        
        
   • Configure NAT on the interface that connects to the public network so that intranet users can access the Internet.
     1. Choose IP Service > NAT > External Network Access. The External Network Access tab page is displayed.
     2. Click Create. The Create External Network Access dialog box is displayed.
     3. Set parameters, as shown in Figure 10-20. Click OK.
        • Interface name: Ethernet0/0/1
        • Translation mode: Easy IP
        • ACL name: acl2000
        Figure 10-20 Configuring external network access
        
        
   • Configure a specific route to the intranet and a default static route to the public network.
     1. Choose IP Service > Route > Static Route Configuration. The Static Route Configuration tab page is displayed.
     2. In the IPv4 Static Route Configuration Table area, click Create. The Create IPv4 Static Route Service dialog box is displayed.
     3. Set parameters, as shown in Figure 10-21. Click OK.

        Destination IP Address	Subnet Mask	Next Hop
        10.10.10.0	255.255.255.0	10.10.100.1
        10.10.20.0	255.255.255.0	10.10.100.1
        0.0.0.0	0.0.0.0	1.1.1.1

        Figure 10-21 Configuring a specific route to the intranet and a default static route to the public network
        
        
   • Configure the DNS server function.
     1. Choose IP Service > DNS. The DNS tab page is displayed.
     2. In the DNS Setting area, click Enabled for DNS proxy(IPv4), and click Apply.
     3. In the DNS Server Configuration List(IPv4 Address) area, click Create. The Create IPv4 DNS Server dialog box is displayed.
     4. Set DNS server IPv4 address to 2.2.2.2, as shown in Figure 10-22. Click OK.
        Figure 10-22 Configuring a DNS server
        
        

7. Configure DHCP snooping and IPSG on access switches.

   After the DHCP function is configured, intranet users in departments can automatically obtain IP addresses. To prevent intranet users from connecting to an unauthorized router and enabling the DHCP function, configure the DHCP snooping function so that intranet valid users can connect to the Internet successfully. Additionally, to prevent intranet users from changing their IP addresses to attack the network, enable the IPSG function on access switches. ACC1 is used as an example.

   • Configure the DHCP snooping function.
     1. Choose Configuration > Security Services > IP Security > DHCP Snooping. The DHCP Snooping tab page is displayed.
     2. Set Global status to ON.
     3. Add Eth-Trunk1 to Trusted port, as shown in Figure 10-23. Click Apply.
        Figure 10-23 Configure a trusted port
        
        
     4. In the Interface List area, select Eth-Trunk1, Ethernet0/0/2, and Ethernet0/0/3, and click Enable, as shown in Figure 10-24. The DHCP snooping function is enabled on the interface that connects to the DHCP server and the interface that connects to terminals.
        Figure 10-24 Enabling the DHCP snooping function
        
        
   • Enable the IPSG function.
     1. Choose Configuration > Security Services > IP Security > IPSG. The IPSG tab page is displayed.
     2. Select Ethernet0/0/2 and Ethernet0/0/3 in the Select Interface area.
     3. Set parameters in the Configure IPSG area, as shown in Figure 10-25. Click Apply.
        • IPSG status: ON
        • IPSG matching option: IP, MAC, and VLAN
        Figure 10-25 Enabling the IPSG function
        
        

8. Save the configuration.

   Click Save in the upper right corner. The system saves all configurations to the configuration file.