Complete H3C Switch, Router & Firewall Config Guide: From First Steps to VPN

Device Series Overview

Switches : S5130/S5170 (access), S5560/S5590 (aggregation), S6850/S689 (data‑center), S12500/S12500X (core CLOS), S10500 (multiservice chassis).

Routers : ER G3 series (SME gateways), MSR2600/MSR3600 (multiservice), MSR5600/MSR8000 (mid‑high), SR6600/SR8800 (high‑end backbone).

Firewalls : F1000 (entry‑level), F5000 (mid‑high), F5000‑AI (AI‑enhanced), SecBlade FW (blade module), vFW (virtual).

First‑Time Device Setup

System name and time

<H3C> system-view
[H3C] sysname SW-BJ-3F-01
[SW-BJ-3F-01] clock protocol ntp
[SW-BJ-3F-01] ntp-service unicast-server 10.1.1.1

Disable the info‑center to stop log flooding [SW-BJ-3F-01] undo info-center enable Console and VTY authentication, enable SSH

# Console authentication
[SW-BJ-3F-01] user-interface console 0
[SW-BJ-3F-01-ui-console0] authentication-mode password
[SW-BJ-3F-01-ui-console0] set authentication password simple H3C@2024
[SW-BJ-3F-01-ui-console0] quit
# Enable SSH
[SW-BJ-3F-01] ssh server enable
[SW-BJ-3F-01] local-user admin class manage
[SW-BJ-3F-01-luser-manage-admin] password simple H3C@2024
[SW-BJ-3F-01-luser-manage-admin] service-type ssh terminal
[SW-BJ-3F-01-luser-manage-admin] authorization-attribute user-role network-admin
[SW-BJ-3F-01-luser-manage-admin] quit
# VTY configuration
[SW-BJ-3F-01] user-interface vty 0 4
[SW-BJ-3F-01-ui-vty0-4] authentication-mode scheme
[SW-BJ-3F-01-ui-vty0-4] protocol inbound ssh
[SW-BJ-3F-01-ui-vty0-4] quit

VLAN and interface basics (switch example)

# Create VLANs 10,20,30
[SW-BJ-3F-01] vlan batch 10 20 30
# Access port
[SW-BJ-3F-01] interface GigabitEthernet 1/0/1
[SW-BJ-3F-01-GigabitEthernet1/0/1] port link-type access
[SW-BJ-3F-01-GigabitEthernet1/0/1] port access vlan 10
[SW-BJ-3F-01-GigabitEthernet1/0/1] quit
# Trunk port (uplink)
[SW-BJ-3F-01] interface GigabitEthernet 1/0/24
[SW-BJ-3F-01-GigabitEthernet1/0/24] port link-type trunk
[SW-BJ-3F-01-GigabitEthernet1/0/24] port trunk permit vlan 10 20 30
[SW-BJ-3F-01-GigabitEthernet1/0/24] quit

If many ports share the same configuration, use a port‑group:

[SW-BJ-3F-01] port-group manual group1
[SW-BJ-3F-01-port-group-manual-group1] group-member GigabitEthernet 1/0/2 to GigabitEthernet 1/0/20
[SW-BJ-3F-01-port-group-manual-group1] port link-type access
[SW-BJ-3F-01-port-group-manual-group1] port access vlan 20

Save configuration (otherwise it disappears after reboot)

<SW-BJ-3F-01> save
The current configuration will be written to the device.
Are you sure? [Y/N]: y
Now saving current configuration to the device.

Routing Configuration

Static routing (small networks) uses the syntax ip route-static <dest> <mask> <next‑hop>. Example:

[RT-HQ-01] ip route-static 172.16.0.0 255.255.0.0 10.1.1.2
# Default route
[RT-HQ-01] ip route-static 0.0.0.0 0.0.0.0 200.1.1.1
# Floating static (backup, higher preference)
[RT-HQ-01] ip route-static 172.16.0.0 255.255.0.0 10.1.1.3 preference 80

Verify with display ip routing-table.

OSPF (medium‑large networks) follows the same steps as Huawei:

# Create OSPF process and set router ID
[RT-HQ-01] ospf 1 router-id 1.1.1.1
# Define area and advertise directly‑connected networks
[RT-HQ-01-ospf-1] area 0.0.0.0
[RT-HQ-01-ospf-1-area-0.0.0.0] network 10.1.1.0 0.0.0.255
[RT-HQ-01-ospf-1-area-0.0.0.0] network 192.168.1.0 0.0.0.255
[RT-HQ-01-ospf-1-area-0.0.0.0] quit
# Optional: silent interface to stop sending Hello packets
[RT-HQ-01-ospf-1] silent-interface GigabitEthernet 0/0/1
[RT-HQ-01-ospf-1] quit

Key verification commands:

<RT-HQ-01> display ospf peer
<RT-HQ-01> display ospf routing
<RT-HQ-01> display ospf interface

Common OSPF neighbor failures (≈95 % of cases) are mismatched area numbers or Hello/Dead timers; check with display ospf peer.

NAT Configuration

Easy IP (dynamic NAT) – define an ACL for internal traffic, then bind it to the outbound interface:

# ACL definition
[FW-HQ] acl number 3000
[FW-HQ-acl-adv-3000] rule permit ip source 192.168.1.0 0.0.0.255
[FW-HQ-acl-adv-3000] quit
# Apply to outbound interface
[FW-HQ] interface GigabitEthernet 1/0/2
[FW-HQ-GigabitEthernet1/0/2] nat outbound 3000
[FW-HQ-GigabitEthernet1/0/2] quit

NAT Server (port‑forwarding) maps a public IP/port to an internal server:

# Map public 202.1.1.10:80 to 192.168.1.100:80
[FW-HQ] interface GigabitEthernet 1/0/2
[FW-HQ-GigabitEthernet1/0/2] nat server protocol tcp global 202.1.1.10 80 inside 192.168.1.100 80
[FW-HQ-GigabitEthernet1/0/2] quit
# Optional ACL restriction
[FW-HQ] nat server protocol tcp global 202.1.1.10 80 inside 192.168.1.100 80 acl 3100

Validate with display nat session. A frequent pitfall is forgetting the firewall security policy after NAT, which blocks traffic.

IPSec VPN Configuration

Scenario: HQ firewall (200.1.1.1, 10.0.0.0/16) connects to branch router (200.1.2.1, 10.1.0.0/16). All parameters must match.

# ACL for VPN traffic
[FW-HQ] acl number 3100
[FW-HQ-acl-adv-3100] rule permit ip source 10.0.0.0 0.0.255.255 destination 10.1.0.0 0.0.255.255
[FW-HQ-acl-adv-3100] quit
# IKE proposal
[FW-HQ] ike proposal 1
[FW-HQ-ike-proposal-1] authentication-method pre-share
[FW-HQ-ike-proposal-1] authentication-algorithm md5
[FW-HQ-ike-proposal-1] encryption-algorithm 3des-cbc
[FW-HQ-ike-proposal-1] dh group2
[FW-HQ-ike-proposal-1] quit
# IKE peer (point to branch)
[FW-HQ] ike peer branch1
[FW-HQ-ike-peer-branch1] pre-shared-key simple H3C@VPN2024
[FW-HQ-ike-peer-branch1] remote-address 200.1.2.1
[FW-HQ-ike-peer-branch1] quit
# IPSec proposal
[FW-HQ] ipsec proposal 1
[FW-HQ-ipsec-proposal-1] encapsulation-mode tunnel
[FW-HQ-ipsec-proposal-1] transform esp
[FW-HQ-ipsec-proposal-1] esp encryption-algorithm 3des-cbc
[FW-HQ-ipsec-proposal-1] esp authentication-algorithm md5
[FW-HQ-ipsec-proposal-1] quit
# IPSec policy binding all elements
[FW-HQ] ipsec policy vpn-to-branch1 1 isakmp
[FW-HQ-ipsec-policy-isakmp-vpn-to-branch1-1] security acl 3100
[FW-HQ-ipsec-policy-isakmp-vpn-to-branch1-1] ike-peer branch1
[FW-HQ-ipsec-policy-isakmp-vpn-to-branch1-1] proposal 1
[FW-HQ-ipsec-policy-isakmp-vpn-to-branch1-1] quit
# Apply policy to outbound interface
[FW-HQ] interface GigabitEthernet 1/0/2
[FW-HQ-GigabitEthernet1/0/2] ipsec apply policy vpn-to-branch1
[FW-HQ-GigabitEthernet1/0/2] quit

On the branch side, mirror the configuration, changing remote-address to the HQ IP and keeping the same pre‑shared key. Verify tunnel status with display ike sa and display ipsec sa.

Security Configuration (ACL & Policies)

Switch ACL – basic (2000‑2999) matches source IP; advanced (3000‑3999) matches source/destination, ports, protocol.

# Deny 192.168.1.0/24 to external 203.0.113.0/24
[SW-CORE] acl number 3001
[SW-CORE-acl-adv-3001] rule deny ip source 192.168.1.0 0.0.0.255 destination 203.0.113.0 0.0.0.255
[SW-CORE-acl-adv-3001] rule permit ip
[SW-CORE-acl-adv-3001] quit
# Apply outbound on VLAN interface 10
[SW-CORE] interface Vlan-interface 10
[SW-CORE-Vlan-interface10] packet-filter 3001 outbound
[SW-CORE-Vlan-interface10] quit

Firewall security zones and policies – zones: Trust, Untrust, DMZ, Local. Policies are defined as source‑zone → destination‑zone with services.

# Create zones and bind interfaces
[FW-HQ] security-zone name Trust
[FW-HQ-security-zone-Trust] import interface GigabitEthernet 1/0/1
[FW-HQ-security-zone-Trust] quit
[FW-HQ] security-zone name Untrust
[FW-HQ-security-zone-Untrust] import interface GigabitEthernet 1/0/2
[FW-HQ-security-zone-Untrust] quit
# Permit HTTP/HTTPS/DNS/ICMP from Trust to Untrust
[FW-HQ] security-policy ip
[FW-HQ-security-policy-ip] rule name permit-out
[FW-HQ-security-policy-ip-10-permit-out] source-zone trust
[FW-HQ-security-policy-ip-10-permit-out] destination-zone untrust
[FW-HQ-security-policy-ip-10-permit-out] service http
[FW-HQ-security-policy-ip-10-permit-out] service https
[FW-HQ-security-policy-ip-10-permit-out] service dns
[FW-HQ-security-policy-ip-10-permit-out] service icmp
[FW-HQ-security-policy-ip-10-permit-out] action permit
[FW-HQ-security-policy-ip-10-permit-out] quit
# Default deny all
[FW-HQ-security-policy-ip] rule name deny-all
[FW-HQ-security-policy-ip-11-deny-all] source-zone any
[FW-HQ-security-policy-ip-11-deny-all] destination-zone any
[FW-HQ-security-policy-ip-11-deny-all] action deny
[FW-HQ-security-policy-ip-11-deny-all] quit

Three troubleshooting commands for security policies: display security-policy ip statistics – view hit counts. debugging packet – packet capture (use cautiously in production). display logbuffer – examine dropped logs.

Emergency Troubleshooting Cheat‑Sheet

display current-configuration

(or dis cu) – full config. display interface brief – interface up/down status. display ip routing-table – routing table. display mac-address – MAC table (switch). display vlan brief – VLAN‑interface mapping. display version – device model and software version. display cpu-usage and display memory-usage – resource usage. display logbuffer – recent logs, first place to look when a device stalls.