{
	"name": "rule lib",
	"rules": [
		{
			"name": "zhengfu",
			"rules": [
				{
					"name": "anti_arp",
					"desc": "ARP欺骗解决方案",
					"rules": [
						{
							"name": "anti_arp_1",
							"desc": "接入端DHCP SNOOPing+IP SOURCE GUARD+ARP CHECK",
							"desc_detail": "在接入交换机部署DHCP SNOOPing、IP SOURCE GUARD和ARP CHECK这三项功能，接入交换机把DHCP分配的地址通过硬件绑定表项，ARP CHECK根据绑定的硬件表项检测ARP报文，合法的通过，不合法的丢弃。",
							"limit": "采用此方案防ARP攻击，需要在防攻击的接入端整网使用DHCP动态地址分配，不能使用静态IP。\r\n此方案硬件绑定表项是通过IP SOURCE GUARD生成的，每台接入交换机的最大用户数不得超过IP SOURCE GUARD容量。\r\n此方案硬件绑定表项和ACL是共用的，每台接入交换机的最大用户数及ACL的总和不得超过ACL的容量。\r\n采用此方案最好接入交换机都是我司的交换机，否则需要协调配置友商的接入交换机。\r\n其它安全策略（比如端口安全）有放行ARP的策略，会引起ARP CHECK失效。",
							"config_sample": [
								{
									"name": "access",
									"desc": "接入设备",
									"config": "//开启dhcp snooping，设置DHCP服务器互联接口为信任口\r\nRuijie>enable\r\nRuijie#configure terminal\r\nRuijie(config)#ip dhcp snooping\r\nRuijie(config)#interface gigabitEthernet 0/1\r\nRuijie(config-GigabitEthernet 0/1)#ip dhcp snooping trust\r\nRuijie(config-GigabitEthernet 0/1)#exit\r\n\r\n//连接用户的接口开启IP Source Guard功能，开启IP+MAC绑定\r\nRuijie(config)#interface range fastEthernet 0/2-6\r\nRuijie(config-if-range)#ip verify source port-security\r\n\r\n//开启连接用户的接口ARP CHECK\r\nRuijie(config-if-range)#arp-check\r\nRuijie(config-if-range)#exit"
								}
							],
							"config_check": [
								{
									"name": "access",
									"desc": "接入设备",
									"config": [
										{
											"name": "dhcp_snooping",
											"desc": "检测dhcp-snooping配置",
											"config": [
												"ip dhcp snooping",
												"interface\r\nip dhcp snooping trust"
											]
										},
										{
											"name": "ip_source_guard",
											"desc": "检测ip-source-guard配置",
											"config": [
												"interface\r\nip verify source port-security"
											]
										},
										{
											"name": "arp_check",
											"desc": "检测arp-check配置",
											"config": [
												"interface\r\narp-check"
											]
										}
									],
									"dependency": [
										{
											"name": "depend",
											"desc": "依赖性检测",
											"rules": [
												{
													"desc": "相同接口下ip-source-guard需要与arp-check共存",
													"config": "interface\r\nip verify source port-security",
													"depend": "interface\r\narp-check"
												},
												{
													"desc": "相同接口下需要arp-check与ip-source-guard共存",
													"config": "interface\r\narp-check",
													"depend": "interface\r\nip verify source port-security"
												}
											]
										},
										{
											"name": "exclude",
											"desc": "互斥性检测",
											"rules": [
												{
													"desc": "相同接口下dhcp-snooping不能与和ip-source-guard和arp-check共存",
													"config": "interface\r\nip dhcp snooping trust",
													"exclude": "interface\r\nip verify source port-security",
													"exclude": "interface\r\narp-check"
												}
											]
										}
									]
								}
							]
						},
						{
							"name": "anti_arp_2",
							"desc": "接入端口隔离+网关DHCP SNOOPing+IP SOURCE GUARD+ARP CHECK+ARP代理",
							"desc_detail": "用户端到网关之间所有二层交换设备开启端口隔离，防止ARP报文直接通过二层设备传输。网关设备部署DHCP SNOOPing、IP SOURCE GUARD、ARP CHECK和ARP代理这四项功能。",
							"limit": "采用此方案防ARP攻击，需要在防攻击的接入端整网使用DHCP动态地址分配，不能使用静态IP。\r\n此方案硬件绑定表项是通过IP SOURCE GUARD生成的，每台网关的最大用户数不得超过IP SOURCE GUARD容量。\r\n此方案硬件绑定表项和ACL是共用的，每台网关的最大用户数及ACL的总和不得超过ACL的容量。\r\n此方案推荐用于人数不多，网关上收到核心的极简场景。",
							"config_sample": [
								{
									"name": "access",
									"desc": "接入设备",
									"config": "//开启端口隔离\r\nRuijie>enable\r\nRuijie#configure terminal\r\nRuijie(config)#interface gigabitEthernet 0/1\r\nRuijie(config-GigabitEthernet 0/1)#switchport protect\r\nRuijie(config-GigabitEthernet 0/1)#exit"
								},
								{
									"name": "gateway",
									"desc": "网关设备",
									"config": "//开启dhcp snooping，设置DHCP服务器互联接口为信任口\r\nRuijie>enable\r\nRuijie#configure terminal\r\nRuijie(config)#ip dhcp snooping\r\nRuijie(config)#interface gigabitEthernet 0/1\r\nRuijie(config-GigabitEthernet 0/1)#ip dhcp snooping trust\r\nRuijie(config-GigabitEthernet 0/1)#exit\r\n\r\n//连接用户的接口开启IP Source Guard功能，开启IP+MAC绑定\r\nRuijie(config)#interface range fastEthernet 0/2-6\r\nRuijie(config-if-range)#ip verify source port-security\r\n\r\n//开启连接用户的接口ARP CHECK\r\nRuijie(config-if-range)#arp-check\r\n\r\n//开启连接用户的接口ARP代理功能\r\nRuijie(config-if-range)#local-proxy-arp\r\nRuijie(config-if-range)#exit"
								}
							],
							"config_check": [
								{
									"name": "access",
									"desc": "接入设备",
									"config": [
										{
											"name": "switchport_protect",
											"desc": "检测端口隔离配置",
											"config": [
												"interface\r\nswitchport protect"
											]
										}
									]
								},
								{
									"name": "gateway",
									"desc": "网关设备",
									"config": [
										{
											"name": "dhcp_snooping",
											"desc": "检测dhcp-snooping配置",
											"config": [
												"ip dhcp snooping",
												"interface\r\nip dhcp snooping trust"
											]
										},
										{
											"name": "ip_source_guard",
											"desc": "检测ip-source-guard配置",
											"config": [
												"interface\r\nip verify source port-security"
											]
										},
										{
											"name": "arp_check",
											"desc": "检测arp-check配置",
											"config": [
												"interface\r\narp-check"
											]
										},
										{
											"name": "local_proxy_arp",
											"desc": "检测本地arp代理配置",
											"config": [
												"interface\r\nlocal-proxy-arp"
											]
										}
									]
								}
							]
						},
						{
							"name": "anti_arp_3",
							"desc": "接入端口隔离+极简认证网关模式+ARP代理",
							"desc_detail": "极简认证网关模式，在终端认证通过后会绑定静态ARP表项，绑定后就不会被欺骗。\r\n由于二层报文可在接入设备直接转发，因此在接入交换机上需要开启端口隔离，防止ARP广播报文直接在接入端被转发。\r\n接入交换机开启二层隔离后，局域网内无法传播二层报文。为了保证终端能够获取到局域网内其它终端的IP/MAC表项，需要在网关设备开启ARP代理功能。\r\n需要防ARP欺骗的局域网整网采用认证模式，终端不认证无法上网。\r\n核心设备开启接入认证网关模式+ARP代理。\r\n接入/汇聚交换机开启端口隔离。",
							"limit": "整网使用认证模式，非认证终端不能上网（除非配置免认证VLAN或免认证IP）。\r\n整网无法跑二层应用，如有二层应用需要变更为三层访问的方式。\r\n表项容量受限于认证表项。",
							"config_sample": [
								{
									"name": "core",
									"desc": "核心设备",
									"config": "//开启接入认证网关模式\r\nRuijie>enable\r\nRuijie#configure terminal\r\nRuijie(config)#auth-mode gateway\r\nRuijie(config)#exit\r\n\r\n//开启ARP代理"
								},
								{
									"name": "converge",
									"desc": "汇聚设备",
									"config": "//开启端口隔离\r\nRuijie>enable\r\nRuijie#configure terminal\r\nRuijie(config)#interface gigabitEthernet 0/1\r\nRuijie(config-GigabitEthernet 0/1)#switchport protect\r\nRuijie(config-GigabitEthernet 0/1)#exit"
								},
								{
									"name": "access",
									"desc": "接入设备",
									"config": "//开启端口隔离\r\nRuijie>enable\r\nRuijie#configure terminal\r\nRuijie(config)#interface gigabitEthernet 0/1\r\nRuijie(config-GigabitEthernet 0/1)#switchport protect\r\n\r\n//开启ARP代理\r\nRuijie(config-GigabitEthernet 0/1)#local-proxy-arp\r\nRuijie(config-GigabitEthernet 0/1)#exit"
								}
							],
							"config_check": [
								{
									"name": "core",
									"desc": "核心设备",
									"config": [
										{
											"name": "auth_mode_gateway",
											"desc": "检测认证网关模式配置",
											"config": [
												"auth-mode gateway"
											]
										},
										{
											"name": "local_proxy_arp",
											"desc": "检测本地arp代理配置",
											"config": [
												"interface\r\nlocal-proxy-arp"
											]
										}
									]
								},
								{
									"name": "converge",
									"desc": "汇聚设备",
									"config": [
										{
											"name": "switchport_protect",
											"desc": "检测端口隔离配置",
											"config": [
												"interface\r\nswitchport protect"
											]
										}
									]
								},
								{
									"name": "access",
									"desc": "接入设备",
									"config": [
										{
											"name": "switchport_protect",
											"desc": "检测端口隔离配置",
											"config": [
												"interface\r\nswitchport protect"
											]
										}
									]
								}
							]
						},
						{
							"name": "anti_arp_4",
							"desc": "接入端防网关欺骗",
							"desc_detail": "在所有接入交换机的用户端接口开启防网关ARP欺骗。",
							"limit": "采用此方案只能防止网关ARP欺骗。\r\n采用此方案最好接入交换机都是我司的交换机，否则需要协调配置友商的接入交换机。\r\n对于使用静态地址而又未使用认证的场景，可采用此方案防止网关ARP欺骗。",
							"config_sample": [
								{
									"name": "access",
									"desc": "接入设备",
									"config": "//连接用户的接口开启防网关欺骗，把所有需要保护的网关地址都配置上\r\nRuijie>enable\r\nRuijie#configure terminal\r\nRuijie(config)#interface range fastEthernet 0/2-6\r\nRuijie(config-if-range)# anti-arp-spoofing ip 192.168.1.1\r\nRuijie(config-if-range)# anti-arp-spoofing ip 192.168.2.1"
								}
							],
							"config_check": [
								{
									"name": "access",
									"desc": "接入设备",
									"config": [
										{
											"name": "anti_arp_spoofing",
											"desc": "检测防网关ARP欺骗配置",
											"config": [
												"interface\r\nanti-arp-spoofing ip"
											]
										}
									]
								}
							]
						}
					]
				},
				{
					"name": "vsu",
					"desc": "VSU解决方案",
					"rules": [
						{
							"name": "vsu_1",
							"desc": "VSU场景",
							"desc_detail": "单园区场景每个区域的距离都不大，非常有利于双链路的部署。\r\n各区域（楼层和数据中心）相对独立，接入交换机通过2层接入到汇聚，汇聚通过3层接入核心。\r\n核心（外网或内外网融合的场景）上联互联网或广域网出口。\r\n各区域不能直接互访，区域间的流量都需要通过核心转发。",
							"limit": "",
							"config_sample": [
								{
									"name": "core_1",
									"desc": "核心设备1",
									"config": "//配置VSU域，设备对应的虚拟编号，优先级，别名\r\nRuijie(config)#switch virtual domain 1\r\nRuijie(config-vs-domain)# switch 1 priority 150\r\nRuijie(config-vs-domain)# switch 1 description core-1\r\nRuijie(config-vs-domain)#exit\r\n//配置VSL线路（一条以上链路，分布在不同线卡）\r\nRuijie(config)#vsl-port\r\nRuijie(config-vsl-port)#port-member interface TenGigabitEthernet 1/48\r\nRuijie(config-vsl-port)#port-member interface TenGigabitEthernet 2/48\r\nRuijie(config-vsl-port)#exit\r\nRuijie(config)#exit\r\n//切换到VSU模式\r\nRuijie#swit convert mode virtual\r\n\r\n//配置BFD双主机检测（至少和一条VSL链路不在同一张板卡上）\r\nRuijie(config)#interface gigabitEthernet 1/3/1\r\nRuijie(config-if-GigabitEthernet 1/3/1)# no switchport\r\nRuijie(config-if-GigabitEthernet 1/3/1)#exit\r\nRuijie(config)#interface gigabitEthernet 2/3/1\r\nRuijie(config-if-GigabitEthernet 2/3/1)# no switchport\r\nRuijie(config-if-GigabitEthernet 2/3/1)#exit\r\nRuijie(config)#switch virtual domain 1\r\nRuijie(config-vs-domain)#dual-active detection bfd\r\nRuijie(config-vs-domain)#dual-active bfd interface GigabitEthernet 1/3/1\r\nRuijie(config-vs-domain)#dual-active bfd interface GigabitEthernet 2/3/1\r\n\r\n//配置下联VSU设备的L3聚合，下联每台设备两条链路分别连接到VSU不同主机的线卡上\r\n//如果下联是单机设备，只需配置一对链路（1/1/45和2/1/45）即可\r\nRuijie(config)#interface tenGigabitEthernet 1/1/45\r\nRuijie(config-if-TenGigabitEthernet 1/1/45)#no switchport \r\nRuijie(config-if-TenGigabitEthernet 1/1/45)#port-group 1\r\nRuijie(config-if-TenGigabitEthernet 1/1/45)#exit\r\nRuijie(config)#interface tenGigabitEthernet 1/1/46\r\nRuijie(config-if-TenGigabitEthernet 1/1/46)#no switchport \r\nRuijie(config-if-TenGigabitEthernet 1/1/46)#port-group 1\r\nRuijie(config-if-TenGigabitEthernet 1/1/46)#exit\r\nRuijie(config)#interface tenGigabitEthernet 2/1/45\r\nRuijie(config-if-TenGigabitEthernet 2/1/45)#no switchport \r\nRuijie(config-if-TenGigabitEthernet 2/1/45)#port-group 1\r\nRuijie(config-if-TenGigabitEthernet 2/1/45)#exit\r\nRuijie(config)#interface tenGigabitEthernet 2/1/46\r\nRuijie(config-if-TenGigabitEthernet 2/1/46)#no switchport \r\nRuijie(config-if-TenGigabitEthernet 2/1/46)#port-group 1\r\nRuijie(config-if-TenGigabitEthernet 2/1/46)#exit\r\nRuijie(config)#interface aggregateport 1\r\nRuijie(config-if-AggregatePort 1)#ip addr 192.168.10.254 255.255.255.0\r\n\r\n//上联路由器对应两个地址192.168.100.253/192.168.101.253\r\nRuijie(config)# interface gigabitEthernet 1/1/1\r\nRuijie(config-if-GigabitEthernet 1/1/1)#no switchport \r\nRuijie(config-if-GigabitEthernet 1/1/1)#ip addr 192.168.100.254 255.255.255.0\r\nRuijie(config-if-GigabitEthernet 1/1/1)#exit\r\nRuijie(config)# interface gigabitEthernet 2/1/1\r\nRuijie(config-if-GigabitEthernet 2/1/1)#no switchport \r\nRuijie(config-if-GigabitEthernet 2/1/1)#ip addr 192.168.101.254 255.255.255.0\r\nRuijie(config-if-GigabitEthernet 2/1/1)#exit\r\nRuijie(config)# ip route 0.0.0.0 0.0.0.0 192.168.100.253\r\nRuijie(config)# ip route 0.0.0.0 0.0.0.0 192.168.101.253"
								},
								{
									"name": "core_2",
									"desc": "核心设备2",
									"config": "//配置VSU域，设备对应的虚拟编号，优先级，别名\r\nRuijie(config)#switch virtual domain 1\r\nRuijie(config-vs-domain)# switch 1 renumber 2\r\nRuijie(config-vs-domain)# switch 2 priority 100\r\nRuijie(config-vs-domain)# switch 2 description core-2\r\nRuijie(config-vs-domain)#exit\r\n//配置VSL线路（一条以上链路，分布在不同线卡）\r\nRuijie(config)#vsl-port\r\nRuijie(config-vsl-port)#port-member interface TenGigabitEthernet 1/48\r\nRuijie(config-vsl-port)#port-member interface TenGigabitEthernet 2/48\r\nRuijie(config-vsl-port)#exit\r\n//切换到VSU模式\r\nRuijie(config)#exit\r\nRuijie#swit convert mode virtual\r\n\r\n//配置BFD双主机检测（至少和一条VSL链路不在同一张板卡上）\r\nRuijie(config)#interface gigabitEthernet 1/3/1\r\nRuijie(config-if-GigabitEthernet 1/3/1)# no switchport\r\nRuijie(config-if-GigabitEthernet 1/3/1)#exit\r\nRuijie(config)#interface gigabitEthernet 2/3/1\r\nRuijie(config-if-GigabitEthernet 2/3/1)# no switchport\r\nRuijie(config-if-GigabitEthernet 2/3/1)#exit\r\nRuijie(config)#switch virtual domain 1\r\nRuijie(config-vs-domain)#dual-active detection bfd\r\nRuijie(config-vs-domain)#dual-active bfd interface GigabitEthernet 1/3/1\r\nRuijie(config-vs-domain)#dual-active bfd interface GigabitEthernet 2/3/1\r\n\r\n//配置下联VSU设备的L3聚合，下联每台设备两条链路分别连接到VSU不同主机的线卡上\r\n//如果下联是单机设备，只需配置一对链路（1/1/45和2/1/45）即可\r\nRuijie(config)#interface tenGigabitEthernet 1/1/45\r\nRuijie(config-if-TenGigabitEthernet 1/1/45)#no switchport \r\nRuijie(config-if-TenGigabitEthernet 1/1/45)#port-group 1\r\nRuijie(config-if-TenGigabitEthernet 1/1/45)#exit\r\nRuijie(config)#interface tenGigabitEthernet 1/1/46\r\nRuijie(config-if-TenGigabitEthernet 1/1/46)#no switchport \r\nRuijie(config-if-TenGigabitEthernet 1/1/46)#port-group 1\r\nRuijie(config-if-TenGigabitEthernet 1/1/46)#exit\r\nRuijie(config)#interface tenGigabitEthernet 2/1/45\r\nRuijie(config-if-TenGigabitEthernet 2/1/45)#no switchport \r\nRuijie(config-if-TenGigabitEthernet 2/1/45)#port-group 1\r\nRuijie(config-if-TenGigabitEthernet 2/1/45)#exit\r\nRuijie(config)#interface tenGigabitEthernet 2/1/46\r\nRuijie(config-if-TenGigabitEthernet 2/1/46)#no switchport \r\nRuijie(config-if-TenGigabitEthernet 2/1/46)#port-group 1\r\nRuijie(config-if-TenGigabitEthernet 2/1/46)#exit\r\nRuijie(config)#interface aggregateport 1\r\nRuijie(config-if-AggregatePort 1)#ip addr 192.168.10.254 255.255.255.0\r\n\r\n//上联路由器对应两个地址192.168.100.253/192.168.101.253\r\nRuijie(config)# interface gigabitEthernet 1/1/1\r\nRuijie(config-if-GigabitEthernet 1/1/1)#no switchport \r\nRuijie(config-if-GigabitEthernet 1/1/1)#ip addr 192.168.100.254 255.255.255.0\r\nRuijie(config-if-GigabitEthernet 1/1/1)#exit\r\nRuijie(config)# interface gigabitEthernet 2/1/1\r\nRuijie(config-if-GigabitEthernet 2/1/1)#no switchport \r\nRuijie(config-if-GigabitEthernet 2/1/1)#ip addr 192.168.101.254 255.255.255.0\r\nRuijie(config-if-GigabitEthernet 2/1/1)#exit\r\nRuijie(config)# ip route 0.0.0.0 0.0.0.0 192.168.100.253\r\nRuijie(config)# ip route 0.0.0.0 0.0.0.0 192.168.101.253"
								},
								{
									"name": "converge_1",
									"desc": "汇聚设备1",
									"config": "//配置VSU域，设备对应的虚拟编号，优先级，别名\r\nRuijie(config)#switch virtual domain 1\r\nRuijie(config-vs-domain)# switch 1 priority 150\r\nRuijie(config-vs-domain)# switch 1 description gw-1\r\nRuijie(config-vs-domain)#exit\r\n//配置VSL线路（一条以上链路，分布在不同线卡）\r\nRuijie(config)#vsl-port\r\nRuijie(config-vsl-port)#port-member interface TenGigabitEthernet 1/48\r\nRuijie(config-vsl-port)#port-member interface TenGigabitEthernet 2/48\r\nRuijie(config-vsl-port)#exit\r\n//切换到VSU模式\r\nRuijie(config)#exit\r\nRuijie#swit convert mode virtual\r\n\r\n//配置BFD双主机检测（至少和一条VSL链路不在同一张板卡上）\r\nRuijie(config)#interface gigabitEthernet 1/1/1\r\nRuijie(config-if-GigabitEthernet 1/3/1)# no switchport\r\nRuijie(config-if-GigabitEthernet 1/3/1)#exit\r\nRuijie(config)#interface gigabitEthernet 2/3/1\r\nRuijie(config-if-GigabitEthernet 2/3/1)# no switchport\r\nRuijie(config-if-GigabitEthernet 2/3/1)#exit\r\nRuijie(config)#switch virtual domain 1\r\nRuijie(config-vs-domain)#dual-active detection bfd\r\nRuijie(config-vs-domain)#dual-active bfd interface GigabitEthernet 1/3/1\r\nRuijie(config-vs-domain)#dual-active bfd interface GigabitEthernet 2/3/1\r\n\r\n//配置下联VSU设备的L3聚合，下联每台设备两条链路分别连接到VSU不同主机的线卡上\r\n//如果下联是单机设备，只需配置一对链路（1/1/45和2/1/45）即可\r\nRuijie(config)#interface tenGigabitEthernet 1/1/45\r\nRuijie(config-if-TenGigabitEthernet 1/1/45)#no switchport \r\nRuijie(config-if-TenGigabitEthernet 1/1/45)#port-group 1\r\nRuijie(config-if-TenGigabitEthernet 1/1/45)#exit\r\nRuijie(config)#interface tenGigabitEthernet 1/1/46\r\nRuijie(config-if-TenGigabitEthernet 1/1/46)#no switchport \r\nRuijie(config-if-TenGigabitEthernet 1/1/46)#port-group 1\r\nRuijie(config-if-TenGigabitEthernet 1/1/46)#exit\r\nRuijie(config)#interface tenGigabitEthernet 2/1/45\r\nRuijie(config-if-TenGigabitEthernet 2/1/45)#no switchport \r\nRuijie(config-if-TenGigabitEthernet 2/1/45)#port-group 1\r\nRuijie(config-if-TenGigabitEthernet 2/1/45)#exit\r\nRuijie(config)#interface tenGigabitEthernet 2/1/46\r\nRuijie(config-if-TenGigabitEthernet 2/1/46)#no switchport \r\nRuijie(config-if-TenGigabitEthernet 2/1/46)#port-group 1\r\nRuijie(config-if-TenGigabitEthernet 2/1/46)#exit\r\nRuijie(config)#interface aggregateport 1\r\nRuijie(config-if-AggregatePort 1)#ip addr 192.168.10.254 255.255.255.0\r\n\r\n//上联路由器对应两个地址192.168.100.253/192.168.101.253\r\nRuijie(config)# interface gigabitEthernet 1/1/1\r\nRuijie(config-if-GigabitEthernet 1/1/1)#no switchport \r\nRuijie(config-if-GigabitEthernet 1/1/1)#ip addr 192.168.100.254 255.255.255.0\r\nRuijie(config-if-GigabitEthernet 1/1/1)#exit\r\nRuijie(config)# interface gigabitEthernet 2/1/1\r\nRuijie(config-if-GigabitEthernet 2/1/1)#no switchport \r\nRuijie(config-if-GigabitEthernet 2/1/1)#ip addr 192.168.101.254 255.255.255.0\r\nRuijie(config-if-GigabitEthernet 2/1/1)#exit\r\nRuijie(config)# ip route 0.0.0.0 0.0.0.0 192.168.100.253\r\nRuijie(config)# ip route 0.0.0.0 0.0.0.0 192.168.101.253"
								},
								{
									"name": "converge_2",
									"desc": "汇聚设备2",
									"config": "//配置VSU域，设备对应的虚拟编号，优先级，别名\r\nRuijie(config)#switch virtual domain 1\r\nRuijie(config-vs-domain)# switch 1 renumber 2\r\nRuijie(config-vs-domain)# switch 2 priority 100\r\nRuijie(config-vs-domain)# switch 2 description gw-2\r\nRuijie(config-vs-domain)#exit\r\n//配置VSL线路（一条以上链路，分布在不同线卡）\r\nRuijie(config)#vsl-port\r\nRuijie(config-vsl-port)#port-member interface TenGigabitEthernet 1/48\r\nRuijie(config-vsl-port)#port-member interface TenGigabitEthernet 2/48\r\nRuijie(config-vsl-port)#exit\r\n//切换到VSU模式\r\nRuijie(config)#exit\r\nRuijie#swit convert mode virtual\r\n\r\n//配置BFD双主机检测（至少和一条VSL链路不在同一张板卡上）\r\nRuijie(config)#interface gigabitEthernet 1/1/1\r\nRuijie(config-if-GigabitEthernet 1/3/1)# no switchport\r\nRuijie(config-if-GigabitEthernet 1/3/1)#exit\r\nRuijie(config)#interface gigabitEthernet 2/3/1\r\nRuijie(config-if-GigabitEthernet 2/3/1)# no switchport\r\nRuijie(config-if-GigabitEthernet 2/3/1)#exit\r\nRuijie(config)#switch virtual domain 1\r\nRuijie(config-vs-domain)#dual-active detection bfd\r\nRuijie(config-vs-domain)#dual-active bfd interface GigabitEthernet 1/3/1\r\nRuijie(config-vs-domain)#dual-active bfd interface GigabitEthernet 2/3/1\r\n\r\n//配置下联VSU设备的L3聚合，下联每台设备两条链路分别连接到VSU不同主机的线卡上\r\n//如果下联是单机设备，只需配置一对链路（1/1/45和2/1/45）即可\r\nRuijie(config)#interface tenGigabitEthernet 1/1/45\r\nRuijie(config-if-TenGigabitEthernet 1/1/45)#no switchport \r\nRuijie(config-if-TenGigabitEthernet 1/1/45)#port-group 1\r\nRuijie(config-if-TenGigabitEthernet 1/1/45)#exit\r\nRuijie(config)#interface tenGigabitEthernet 1/1/46\r\nRuijie(config-if-TenGigabitEthernet 1/1/46)#no switchport \r\nRuijie(config-if-TenGigabitEthernet 1/1/46)#port-group 1\r\nRuijie(config-if-TenGigabitEthernet 1/1/46)#exit\r\nRuijie(config)#interface tenGigabitEthernet 2/1/45\r\nRuijie(config-if-TenGigabitEthernet 2/1/45)#no switchport \r\nRuijie(config-if-TenGigabitEthernet 2/1/45)#port-group 1\r\nRuijie(config-if-TenGigabitEthernet 2/1/45)#exit\r\nRuijie(config)#interface tenGigabitEthernet 2/1/46\r\nRuijie(config-if-TenGigabitEthernet 2/1/46)#no switchport \r\nRuijie(config-if-TenGigabitEthernet 2/1/46)#port-group 1\r\nRuijie(config-if-TenGigabitEthernet 2/1/46)#exit\r\nRuijie(config)#interface aggregateport 1\r\nRuijie(config-if-AggregatePort 1)#ip addr 192.168.10.254 255.255.255.0\r\n\r\n//上联路由器对应两个地址192.168.100.253/192.168.101.253\r\nRuijie(config)# interface gigabitEthernet 1/1/1\r\nRuijie(config-if-GigabitEthernet 1/1/1)#no switchport \r\nRuijie(config-if-GigabitEthernet 1/1/1)#ip addr 192.168.100.254 255.255.255.0\r\nRuijie(config-if-GigabitEthernet 1/1/1)#exit\r\nRuijie(config)# interface gigabitEthernet 2/1/1\r\nRuijie(config-if-GigabitEthernet 2/1/1)#no switchport \r\nRuijie(config-if-GigabitEthernet 2/1/1)#ip addr 192.168.101.254 255.255.255.0\r\nRuijie(config-if-GigabitEthernet 2/1/1)#exit\r\nRuijie(config)# ip route 0.0.0.0 0.0.0.0 192.168.100.253\r\nRuijie(config)# ip route 0.0.0.0 0.0.0.0 192.168.101.253\r\n"
								}
							],
							"config_check": [
								{
									"name": "core_1",
									"desc": "核心设备1",
									"config": [
										{
											"name": "vsu_domain",
											"desc": "检测VSU域配置",
											"config": [
												"switch virtual domain"
											]
										},
										{
											"name": "vsu_dual_active_bfd",
											"desc": "检测bfd双主机检测配置",
											"config": [
												"switch virtual domain\r\ndual-active detection bfd",
												"switch virtual domain\r\ndual-active bfd interface"
											]
										}
									]
								},
								{
									"name": "core_2",
									"desc": "核心设备2",
									"config": [
										{
											"name": "vsu_domain",
											"desc": "检测VSU域配置",
											"config": [
												"switch virtual domain"
											]
										},
										{
											"name": "vsu_dual_active_bfd",
											"desc": "检测bfd双主机检测配置",
											"config": [
												"switch virtual domain\r\ndual-active detection bfd",
												"switch virtual domain\r\ndual-active bfd interface"
											]
										}
									]
								},
								{
									"name": "converge_1",
									"desc": "汇聚设备1",
									"config": [
										{
											"name": "配置vsu域",
											"config": [
												"switch virtual domain"
											]
										},
										{
											"name": "配置bfd双主机检测",
											"config": [
												"switch virtual domain\r\ndual-active detection bfd",
												"switch virtual domain\r\ndual-active bfd interface"
											]
										}
									]
								},
								{
									"name": "converge_2",
									"desc": "汇聚设备2",
									"config": [
										{
											"name": "vsu_domain",
											"desc": "检测VSU域配置",
											"config": [
												"switch virtual domain"
											]
										},
										{
											"name": "vsu_dual_active_bfd",
											"desc": "检测bfd双主机检测配置",
											"config": [
												"switch virtual domain\r\ndual-active detection bfd",
												"switch virtual domain\r\ndual-active bfd interface"
											]
										}
									]
								}
							]
						}
					]
				},
				{
					"name": "ip_conflict",
					"desc": "私设IP/IP冲突解决方案",
					"rules": [
						{
							"name": "ip_conflict_1",
							"desc": "接入端DHCP SNOOPing + IP SOURCE GUARD",
							"desc_detail": "利用DHCP Snooping监控DHCP分配的地址表项，IPSG生成硬件表项，未生成表项的终端都无法通信。\r\n需要防私设IP的局域网整网采用DHCP，终端不得采用静态指定IP地址。\r\n接入交换机开启DHCP Snooping + IP SOURCE GUARD。",
							"limit": "1）整网使用DHCP动态地址分配，不能使用静态IP。\r\n2）表项容量受限于DHCP Snooping和IP SOURCE GUARD，每台接入交换机的最大用户数不得超过这两个组件的最小容量。\r\n3）此方案硬件绑定表项和ACL是共用的，每台接入交换机的最大用户数和ACL的总和不得超过ACL的容量。",
							"config_sample": [
								{
									"name": "access",
									"desc": "接入设备",
									"config": "//开启dhcp snooping，设置DHCP服务器互联接口为信任口\r\nRuijie>enable\r\nRuijie#configure terminal\r\nRuijie(config)#ip dhcp snooping\r\nRuijie(config)#interface gigabitEthernet 0/1\r\nRuijie(config-GigabitEthernet 0/1)#ip dhcp snooping trust\r\nRuijie(config-GigabitEthernet 0/1)#exit\r\n\r\n//连接用户的接口开启IP Source Guard功能，开启IP+MAC绑定\r\nRuijie(config)#interface range fastEthernet 0/2-6\r\nRuijie(config-if-range)#ip verify source port-security"
								}
							],
							"config_check": [
								{
									"name": "access",
									"desc": "接入设备",
									"config": [
										{
											"name": "dhcp_snooping",
											"desc": "检测dhcp-snooping配置",
											"config": [
												"ip dhcp snooping",
												"interface\r\nip dhcp snooping trust"
											]
										},
										{
											"name": "ip_source_guard",
											"desc": "检测ip-source-guard配置",
											"config": [
												"interface\r\nip verify source port-security"
											]
										}
									],
									"dependency": [
										{
											"name": "exclude",
											"desc": "互斥性检测",
											"rules": [
												{
													"desc": "相同接口下dhcp-snooping不能与和ip-source-guard共存",
													"config": "interface\r\nip dhcp snooping trust",
													"exclude": "interface\r\nip verify source port-security"
												}
											]
										}
									]
								}
							]
						},
						{
							"name": "ip_conflict_2",
							"desc": "网关DHCP SNOOPing + IP SOURCE GUARD",
							"desc_detail": "利用DHCP Snooping监控DHCP分配的地址表项，IP SOURCE GUARD把地址表项绑定为硬件表项，非绑定表项都无法通信。\r\n需要私设的局域网整网采用DHCP，终端不得采用静态指定IP地址。\r\n做网关的交换机开启DHCP Snooping + IP SOURCE GUARD。",
							"limit": "1）整网使用DHCP动态地址分配，不能使用静态IP。\r\n2）表项容量受限于DHCP Snooping和IP SOURCE GUARD，网关交换机的最大用户数不得超过这两个组件的最小容量。\r\n3）此方案硬件绑定表项和ACL是共用的，网关交换机的最大用户数和ACL的总和不得超过ACL的容量。",
							"config_sample": [
								{
									"name": "gateway",
									"desc": "网关设备",
									"config": "//开启dhcp snooping，设置DHCP服务器互联接口为信任口\r\nRuijie>enable\r\nRuijie#configure terminal\r\nRuijie(config)#ip dhcp snooping\r\nRuijie(config)#interface gigabitEthernet 0/1\r\nRuijie(config-GigabitEthernet 0/1)#ip dhcp snooping trust\r\nRuijie(config-GigabitEthernet 0/1)#exit\r\n\r\n//连接用户的接口开启IP Source Guard功能，开启IP+MAC绑定\r\nRuijie(config)#interface range fastEthernet 0/2-6\r\nRuijie(config-if-range)#ip verify source port-security"
								}
							],
							"config_check": [
								{
									"name": "gateway",
									"desc": "网关设备",
									"config": [
										{
											"name": "dhcp_snooping",
											"desc": "检测dhcp-snooping配置",
											"config": [
												"ip dhcp snooping",
												"interface\r\nip dhcp snooping trust"
											]
										},
										{
											"name": "ip_source_guard",
											"desc": "检测ip-source-guard配置",
											"config": [
												"interface\r\nip verify source port-security"
											]
										}
									],
									"dependency": [
										{
											"name": "exclude",
											"desc": "互斥性检测",
											"rules": [
												{
													"desc": "相同接口下dhcp-snooping不能与和ip-source-guard共存",
													"config": "interface\r\nip dhcp snooping trust",
													"exclude": "interface\r\nip verify source port-security"
												}
											]
										}
									]
								}
							]
						}
					]
				},
				{
					"name": "loop_check",
					"desc": "环路解决方案",
					"rules": [
						{
							"name": "loop_check_1",
							"desc": "整网RSTP/MSTP",
							"desc_detail": "整网设备开启RSTP或MSTP。",
							"limit": "1）需要整网开启RSTP/MSTP，对于未开启RSTP/MSTP的设备环路无法防止。\r\n2）网络规模较大的情况下，收敛比较慢。",
							"config_sample": [
								{
									"name": "access_mstp",
									"desc": "接入设备MSTP",
									"config": "//开启mstp\r\nRuijie>enable\r\nRuijie#configure terminal\r\nRuijie(config)#interface gigabitEthernet 0/1\r\nRuijie(config-GigabitEthernet 0/1)#spanning-tree mode mstp"
								},
								{
									"name": "access_rstp",
									"desc": "接入设备RSTP",
									"config": "//开启rstp\r\nRuijie>enable\r\nRuijie#configure terminal\r\nRuijie(config)#interface gigabitEthernet 0/1\r\nRuijie(config-GigabitEthernet 0/1)#spanning-tree mode rstp"
								}
							],
							"config_check": [
								{
									"name": "access_mstp",
									"desc": "接入设备MSTP",
									"config": [
										{
											"name": "mstp",
											"desc": "检测mstp配置",
											"config": [
												"interface\r\nspanning-tree mode mstp"
											]
										}
									]
								},
								{
									"name": "access_rstp",
									"desc": "接入设备RSTP",
									"config": [
										{
											"name": "rstp",
											"desc": "检测rstp配置",
											"config": [
												"interface\r\nspanning-tree mode rstp"
											]
										}
									]
								}
							]
						},
						{
							"name": "loop_check_2",
							"desc": "接入端开启RLDP",
							"desc_detail": "RLDP协议检测本机是否收到发出的检测报文判断下联是否环路。\r\n在接入交换机用户侧端口开启RLDP。",
							"limit": "1）通常在用户侧端口开启RLDP，不能级联开启RLDP，否则上下联交换机会同时判断到环路引起误操作。",
							"config_sample": [
								{
									"name": "access",
									"desc": "接入设备",
									"config": "//开启rldp\r\nRuijie>enable\r\nRuijie#configure terminal\r\nRuijie(config)#rldp enable\r\nRuijie(config)#interface gigabitEthernet 0/1\r\nRuijie(config-GigabitEthernet 0/1)#rldp port loop-detect block"
								}
							],
							"config_check": [
								{
									"name": "access",
									"desc": "接入设备",
									"config": [
										{
											"name": "rldp",
											"desc": "检测rldp配置",
											"config": [
												"rldp enable",
												"interface\r\nrldp port loop-detect block"
											]
										}
									]
								}
							]
						}
					]
				}
			]
		}
	]
}
