field Can use field debug commands firewall Can view firewall configuration firewall-control Can modify firewall configuration floppy Can read and write the floppy flow-tap Can view flow-tap configuration flow-tap-control Can modify flow-tap configuration flow-tap-operation Can tap flows
interface Can view interface configuration interface-control Can modify interface configuration maintenance Can become the super-user network Can access the network
reset Can reset/restart interfaces and daemons rollback Can rollback to previous configurations routing Can view routing configuration routing-control Can modify routing configuration secret Can view secret statements secret-control Can modify secret statements security Can view security configuration security-control Can modify security configuration shell Can start a local shell
snmp Can view SNMP configuration snmp-control Can modify SNMP configuration system Can view system configuration system-control Can modify system configuration trace Can view trace file settings trace-control Can modify trace file settings view Can view current values and statistics
view-configuration Can view all configuration (not including secrets) ? 新建/修改用户并指定该用户类别为刚才创建的类别：
set system login user zte class zte_class //设置用户为新建用户类别 2.3 VLAN配置
VLAN是交换机最重要的一个功能。EX交换机关于VLAN配置的菜单有三层，首先是vlans菜单层次，在vlans（通过edit vlans可以进入vlans菜单里面）里面可以创建vlan，而创建vlan的时候可以指定名字和vlan id。
第36页 共86页
在EX端口下面，可以指定该端口属于哪个VLAN。
EX交换机支持三层功能，如果要在交换机上配置三层VLAN 网关，需要先创建一个vlan interface子端口，然后将这个只端口和VLAN号关联起来. interfaces vlan是EX的三层端口，而不同VLAN通过不同的unit xx子端口来产生(xx为子端口号)，子端口号最好能跟VLAN号统一起来。(例如 interface vlan.100表示interface vlan unit 100,类似于cisco的interface vlan100)
2.3.1 VLAN配置步骤
如果创建一个名字为zte_vlan的VLAN 10，并且网关设置为192.168.1.1/24,ge-0/0/1属于该VLAN。 步骤：
(1) 创建一个VLAN，指定VLAN名称和ID号
set vlans ―zte_vlan‖ vlan id 10
(2) 将交换机端口修改为access模式加入到新创建的VLAN中
set interfaces ge-0/0/1 unit 0 family ethernet-switching port-mode access set interfaces ge-0/0/1 unit 0 family ethernet-switching vlan members 10 (3) 创建3层VLAN子端口，并且将子端口和VLAN关联： set interfaces vlan unit 10 family inet address 192.168.1.1/24 set vlans vlan l3-interface vlan.10 //vlan子端口和VLAN对应起来
2.3.2 VLAN配置规范要求
(1) 指定VLAN名称
(2) 设置端口VLAN的时候指定端口为access模式
(3) 设置interface vlan子端口的时候，unit子端口号要跟vlan id一致。
2.3.3 添加VLAN
? 创建vlan
set vlans ―zte_vlan‖ vlan id 10 //创建vlan id 为10，名字为 zte_vlan set vlans juniper_vlan vlan-id 20 ? 将端口加入到指定vlan
//下面命令修改ge-0/0/1端口模式为access模式
第37页 共86页
set interfaces ge-0/0/1 unit 0 family ethernet-switching port-mode access //下面命令将vlan加入到端口 set interfaces ge-0/0/1 unit 0 family ethernet-switching vlan members 10 set interfaces ge-0/0/2 unit 0 family ethernet-switching vlan members 20 或者 set interfaces ge-0/0/1 unit 0 family ethernet-switching vlan members ―zte_vlan‖ ? Vlan检查命令 show vlans show ethernet-switching interfaces 输出例子： lab@EX4200-1# run show vlans Name Tag Interfaces default
ge-0/0/7.0*, ge-0/0/14.0*, ge-0/0/17.0, ge-0/0/18.0, ge-0/0/19.0, ge-0/0/20.0,
ge-0/0/21.0, ge-0/0/22.0, ge-0/0/23.0
juniper_vlan 20 ge-0/0/2.0 zte_vlan 10 ge-0/0/1.0 mgmt
bme0.32769 [edit]
lab@EX4200-1#
lab@EX4200-1> show ethernet-switching interfaces Interface State VLAN members Blocking
第38页 共86页
bme0.32769 down mgmt unblocked ge-0/0/7.0 up default unblocked ge-0/0/14.0 up default unblocked ge-0/0/17.0 down default unblocked ge-0/0/18.0 down default unblocked ge-0/0/19.0 down default unblocked ge-0/0/20.0 down default unblocked ge-0/0/21.0 down default unblocked ge-0/0/22.0 down default unblocked ge-0/0/23.0 down default unblocked ge-1/0/1.0 down zte_vlan unblocked ge-1/0/2.0 down juniper_vlan unblocked [edit]
lab@EX4200-1#
2.3.4 修改端口VLAN
? 将端口加入到指定vlan
//下面命令修改ge-0/0/1端口模式为access模式 set interfaces ge-0/0/1 unit 0 family ethernet-switching port-mode access //下面命令将ge-0/0/1修改为vlan 10 或者zte_vlan set interfaces ge-0/0/1 unit 0 family ethernet-switching vlan members 10 或者 set interfaces ge-0/0/1 unit 0 family ethernet-switching vlan members ―new_vlan‖ 2.3.5 删除VLAN
? 1.删除端口vlan
delete interfaces ge-0/0/1 unit 0 family ethernet-switching port-mode access //下面命令将ge-0/0/1加入到vlan 10 或者zte_vlan delete interfaces ge-0/0/1 unit 0 family ethernet-switching vlan members 10 或者 delete interfaces ge-0/0/1 unit 0 family ethernet-switching vlan members ―zte_vlan‖ ? 2.删除vlan对应的L3子端口
第39页 共86页
delete vlans vlan l3-interface vlan.10 ? 3.接着删除vlan配置 delete vlans ―zte_vlan‖ 2.3.6 配置VLAN网关IP
set vlans zte vlan-id 100 //创建vlan 100 //下面命令设置vlan子端口IP地址 set interfaces vlan unit 100 family inet address 192.0.2.129/25 set vlans vlan l3-interface vlan.100 //vlan子端口和VLAN对应起来
2.4 Trunk配置
2.4.1 Trunk配置步骤
(1) 指定需要成为Trunk的端口模式为Trunk (2) 设置Trunk端口允许通过的VLAN id。
2.4.2 如何设置Trunk
? 端口修改成trunk
set interfaces ge-0/0/1 unit 0 family ethernet-switching port-mode trunk ? 删除端口trunk模式
delete interfaces ge-0/0/1 unit 0 family ethernet-switching port-mode trunk
2.4.3 允许/禁止VLAN通过Trunk
? 允许通过:允许vlan 10和vlan 20通过
第40页 共86页