1. 在小型园区中，S5735-L-V2通常部署在网络的接入层，S8700-4通常部署在网络的核心，出口路由器一般选用AR系列路由器。
2. 接入交换机与核心交换机通过Eth-Trunk组网保证可靠性。
3. 每个部门业务划分到一个VLAN中，部门间的业务在CORE上通过VLANIF三层互通。
4. 核心交换机作为DHCP Server，为园区用户分配IP地址。
5. 接入交换机上配置DHCP Snooping功能，防止内网用户私接小路由器分配IP地址；同时配置IPSG功能，防止内网用户私自更改IP地址。

 ACC0的配置

#
sysname ACC1
#

dhcp enable
#

dhcp snooping enable
#

vlan batch 10
#
#配置BPDU保护功能，加强网络的稳定性。
stp bpdu-protection
#

#
vlan 10
 description ith
 ipv4 source check user-bind enable
#
interface Vlanif10
#
interface MEth0/0/0
#
interface Eth-Trunk1
 port link-type trunk
 port trunk allow-pass vlan 10
 mode lacp-static
 dhcp snooping enable
 dhcp snooping trusted
#
interface GE1/0/1
 eth-trunk 1
#
interface GE1/0/2
 eth-trunk 1
#
interface GE1/0/3
#
interface GE1/0/4
#
interface GE1/0/5
 port default vlan 10
 stp edged-port enable
 dhcp snooping enable
#
interface GE1/0/6
 port default vlan 10
 stp edged-port enable
 dhcp snooping enable
#
interface GE1/0/7
 port default vlan 10
 stp edged-port enable
 dhcp snooping enable
#
interface GE1/0/8
#
interface GE1/0/9
#
interface GE1/0/10
#

ACC2的配置

#
sysname ACC2
#
dhcp enable

#
dhcp snooping enable

#
vlan batch 20
#配置BPDU保护功能，加强网络的稳定性。
stp bpdu-protection

#
vlan 20
 ipv4 source check user-bind enable
#


#
interface Vlanif20

#
interface GE1/0/3
 eth-trunk 2
#
interface GE1/0/4
 eth-trunk 2
#
interface GE1/0/5
 port default vlan 20
 stp edged-port enable
 dhcp snooping enable
#
interface GE1/0/6
 port default vlan 20
 stp edged-port enable
 dhcp snooping enable
#
interface GE1/0/7
 port default vlan 20
 stp edged-port enable
 dhcp snooping enable

CORE配置

#
sysname CORE

#
dhcp enable
#
ip pool 10
 network 10.10.10.0 mask 255.255.255.0
 gateway-list 10.10.10.1 
#
ip pool 20
 network 10.10.20.0 mask 255.255.255.0
 gateway-list 10.10.20.1 
#

#
vlan batch 5 10 20 100
#
telnet server enable

telnet server-source -i Vlanif5

#
vlan 5
 management-vlan
#
aaa
 authentication-scheme default
  authentication-mode local
 authorization-scheme default
  authorization-mode local
 accounting-scheme default
  accounting-mode none
 local-aaa-user password policy administrator
 domain default
  authentication-scheme default
  accounting-scheme default
 domain default_admin
  authentication-scheme default
  accounting-scheme default
 local-user admin1 password irreversible-cipher $1d$Vy0gSYg@]QV-aiF>$;6vcY2EqR~kkz3Jxzq%9sxU;/pWK!XDx]`IZiF5F$
 local-user admin1 privilege level 3
 local-user admin1 service-type ssh telnet
#
license
#
interface Vlanif5
 ip address 10.10.1.1 255.255.255.0
#
interface Vlanif10
 ip address 10.10.10.1 255.255.255.0
 dhcp select global
#
interface Vlanif20
 ip address 10.10.20.1 255.255.255.0
 dhcp select global
#
interface Vlanif100
 ip address 10.10.100.1 255.255.255.0
#

interface Eth-Trunk1
 port link-type trunk
 undo port trunk allow-pass vlan 1
 port trunk allow-pass vlan 10
 mode lacp-static
#
interface Eth-Trunk2
 port link-type trunk
 undo port trunk allow-pass vlan 1
 port trunk allow-pass vlan 20
#
interface GE1/0/1
 eth-trunk 1
#
interface GE1/0/2
 eth-trunk 1
#
interface GE1/0/3
 eth-trunk 2
#
interface GE1/0/4
 eth-trunk 2
#
interface GE1/0/8
 port link-type trunk
 port trunk pvid vlan 5
 port trunk allow-pass vlan 5
#
interface GE1/0/9
#
interface GE1/0/10
 port default vlan 100
#
interface NULL0
#
ip route-static 0.0.0.0 0.0.0.0 10.10.100.2
#

# config ssh user admin1 配置
stelnet server enable
ssh user admin1
ssh user admin1 authentication-type password
ssh user admin1 service-type stelnet
ssh server-source all-interface
undo ssh ipv6 server-source all-interface
ssh authorization-type default aaa
#
ssh server cipher aes256_gcm aes128_gcm aes256_ctr aes192_ctr aes128_ctr
ssh server hmac sha2_512 sha2_256
ssh server key-exchange dh_group_exchange_sha256 dh_group16_sha512
#
ssh server publickey rsa_sha2_256 rsa_sha2_512
#
ssh server dh-exchange min-len 3072
#
ssh client publickey rsa_sha2_256 rsa_sha2_512
#
ssh client cipher aes256_gcm aes128_gcm aes256_ctr aes192_ctr aes128_ctr
ssh client hmac sha2_512 sha2_256
ssh client key-exchange dh_group_exchange_sha256 dh_group16_sha512 curve25519_sha256
#到这里结束
#
user-interface con 0
 authentication-mode password
 set authentication password cipher $1d$$%Q-7@{kt8aM'W#b$]ei;G"qJ$8(i,CE0If-F:UGSE+apw6l%Bv2Ped}K$
# ssh and telnet user-interface config
user-interface vty 0 4
 authentication-mode aaa
 idle-timeout 5 0
 protocol inbound ssh telnet

 router配置

#
sysname Router
#

#
acl number 2000
 rule 5 permit source 10.10.10.0 0.0.0.255
 rule 10 permit source 10.10.20.0 0.0.0.255
 rule 15 permit source 10.10.100.0 0.0.0.255

#
interface Ethernet3/0/0
 undo shutdown
 ip address 10.10.100.2 255.255.255.0
#
interface Ethernet3/0/1
 undo shutdown
 ip address 1.1.1.2 255.255.255.252
#
ip route-static 0.0.0.0 0.0.0.0 1.1.1.1
ip route-static 10.10.10.0 255.255.255.0 10.10.100.1
ip route-static 10.10.20.0 255.255.255.0 10.10.100.1
#
dns resolve
dns server 114.114.114.114