1三、CISCO交換機常規配置

一、同步網絡時鐘、設置日誌格式

conf t

clock timezone GMT +8

ntp server 120.25.115.20

service timestamps debug datetime msec localtime show-timezone

service timestamps log datetime msec localtime show-timezone

end

show clock

二、搭建日誌服務器

vim /etc/rsyslog.conf

# Provides UDP syslog reception

$ModLoad imudp

$UDPServerRun 514

$template RemoteHost,"/home/syslog/%$YEAR%-%$MONTH%-%$DAY%/%FROMHOST-IP%.log"   

*.*  ?RemoteHost

# Provides TCP syslog reception

$ModLoad imtcp

$InputTCPServerRun 514

$template RemoteHost,"/home/syslog/%$YEAR%-%$MONTH%-%$DAY%/%FROMHOST-IP%.log"   

*.*  ?RemoteHost

三、交換機同步日誌

conf t

logging on

logging host 192.168.1.15

logging facility local7

logging trap 7

end

write

四、搭建tftp服務器

yum -y install xinetd tftp-server

vim /etc/xinetd.d/tftp 

service tftp

{

        socket_type             = dgram

        protocol                = udp

        wait                    = yes

        user                    = root

        server                  = /usr/sbin/in.tftpd

        server_args             = -s /tmp/config -c

        disable                 = no

        per_source              = 11

        cps                     = 100 2

        flags                   = IPv4

}

chmod ugo+w /tmp/config

/etc/init.d/xinetd start

cat /home/config.sh 

#!/bin/bash

#

#

dirdate=`date +%Y%m%d`

mkdir -p /home/$dirdate

mv /tmp/config/* /home/$dirdate

crontab -l

*/30 6 * * * /home/config.sh

五、自動備份到tftp

kron occurrence BAK at 6:00 recurring

 policy-list BAK

kron policy-list BAK

 cli show run | redirect tftp://192.168.1.1/192.168.1.2.cfg

六、設置訪問策略

access-list 1 permit 192.168.1.5

login block-for 60 attempts 3 within 30

login quiet-mode access-class 10

login on-failure log

login on-success log

access-list 1 permit 192.168.1.1

ip domain-name test.com

enable secret Abc@123

username switch_admin password Abc@123

service password-encryption

line console 0

login local

line vty 0 15

access-class 1 in

login local

exec-timeout 5 0

transport input ssh

transport output ssh

crypto key generate rsa