没有废话，上玩意

接入层 （其他接入略）
#
sysname sw1
#
vlan batch 10 20 101
#
interface Ethernet0/0/1
 port link-type access
 port default vlan 10
#
interface Ethernet0/0/2
 port link-type access
 port default vlan 20
#
interface Ethernet0/0/3
 port link-type trunk
 port trunk pvid vlan 101
 port trunk allow-pass vlan 10 101
#
interface GigabitEthernet0/0/1
 port link-type trunk
 port trunk allow-pass vlan 10 20 101
#
interface GigabitEthernet0/0/2
 port link-type trunk
 port trunk allow-pass vlan 10 20 101
#

汇聚层（其他汇聚略）

#
sysname sw4
#
vlan batch 10 20 30 40 101
#
interface GigabitEthernet0/0/1
 port link-type trunk
 port trunk allow-pass vlan 10 20 30 40 101
#
interface GigabitEthernet0/0/2
 port link-type trunk
 port trunk allow-pass vlan 10 20 30 40 101
#
interface GigabitEthernet0/0/3
 port link-type trunk
 port trunk allow-pass vlan 10 20 101
#
interface GigabitEthernet0/0/4
 port link-type trunk
 port trunk allow-pass vlan 20 30 101
#
interface GigabitEthernet0/0/5
 port link-type trunk
 port trunk allow-pass vlan 30 40 101


核心1
#
sysname sw6
#
vlan batch 10 20 30 40 60 100 to 102
#
stp instance 0 root primary
#
dhcp enable
#
interface Vlanif10
 ip address 10.0.10.252 255.255.255.0 
 vrrp vrid 10 virtual-ip 10.0.10.254
 vrrp vrid 10 priority 120
 vrrp vrid 10 track interface GigabitEthernet0/0/1 reduced 30
 dhcp select interface
#
interface Vlanif20
 ip address 10.0.20.252 255.255.255.0 
 vrrp vrid 20 virtual-ip 10.0.20.254
 vrrp vrid 20 priority 120
 vrrp vrid 20 track interface GigabitEthernet0/0/1 reduced 30
 dhcp select interface
#
interface Vlanif30
 ip address 10.0.30.252 255.255.255.0 
 vrrp vrid 30 virtual-ip 10.0.30.254
 vrrp vrid 30 priority 120
 vrrp vrid 30 track interface GigabitEthernet0/0/1 reduced 30
 dhcp select interface
#
interface Vlanif40
 ip address 10.0.40.252 255.255.255.0 
 vrrp vrid 40 virtual-ip 10.0.40.254
 vrrp vrid 40 priority 120
 vrrp vrid 40 track interface GigabitEthernet0/0/1 reduced 30
 dhcp select interface
#
interface Vlanif60
 ip address 172.16.0.252 255.255.255.0 
 vrrp vrid 60 virtual-ip 172.16.0.254
 vrrp vrid 60 priority 120
 vrrp vrid 60 track interface GigabitEthernet0/0/1 reduced 30
#
interface Vlanif100
 ip address 10.0.0.1 255.255.255.252 
#
interface Vlanif102
 ip address 10.0.0.10 255.255.255.252 
#
interface Eth-Trunk1
 port link-type trunk
 port trunk allow-pass vlan 10 20 30 40 60 101
#
interface GigabitEthernet0/0/1
 port link-type access
 port default vlan 100
#
interface GigabitEthernet0/0/2
 port link-type trunk
 port trunk allow-pass vlan 10 20 30 40 101
#
interface GigabitEthernet0/0/3
 port link-type trunk
 port trunk allow-pass vlan 10 20 30 40 101
#
interface GigabitEthernet0/0/4
 port link-type trunk
 port trunk allow-pass vlan 10 20 30 40 101 to 102
#
interface GigabitEthernet0/0/10
 port link-type trunk
 port trunk allow-pass vlan 60
#
interface GigabitEthernet0/0/23
 eth-trunk 1
#
interface GigabitEthernet0/0/24
 eth-trunk 1
#
ospf 1 
 silent-interface Vlanif102
 area 0.0.0.0 
  network 172.16.0.0 0.0.0.255 
  network 10.0.0.0 0.0.0.3 
  network 10.0.0.4 0.0.0.3 
  network 10.0.0.8 0.0.0.3 
 area 0.0.0.1 
  network 10.0.10.0 0.0.0.255 
  network 10.0.20.0 0.0.0.255 
  network 10.0.30.0 0.0.0.255 
  network 10.0.40.0 0.0.0.255 
#

核心2
#
sysname sw7
#
vlan batch 10 20 30 40 60 100 to 101
#
stp instance 0 root secondary
#
dhcp enable
#
interface Vlanif10
 ip address 10.0.10.253 255.255.255.0 
 vrrp vrid 10 virtual-ip 10.0.10.254
 dhcp select interface
#
interface Vlanif20
 ip address 10.0.20.253 255.255.255.0 
 vrrp vrid 20 virtual-ip 10.0.20.254
 dhcp select interface
#
interface Vlanif30
 ip address 10.0.30.253 255.255.255.0 
 vrrp vrid 30 virtual-ip 10.0.30.254
 dhcp select interface
#
interface Vlanif40
 ip address 10.0.40.253 255.255.255.0 
 vrrp vrid 40 virtual-ip 10.0.40.254
 dhcp select interface
#
interface Vlanif60
 ip address 172.16.0.253 255.255.255.0 
 vrrp vrid 60 virtual-ip 172.16.0.254
#
interface Vlanif100
 ip address 10.0.0.5 255.255.255.252 
#
interface Eth-Trunk1
 port link-type trunk
 port trunk allow-pass vlan 10 20 30 40 60 101
#
interface GigabitEthernet0/0/1
 port link-type access
 port default vlan 100
#
interface GigabitEthernet0/0/2
 port link-type trunk
 port trunk allow-pass vlan 10 20 30 40 101
#
interface GigabitEthernet0/0/3
 port link-type trunk
 port trunk allow-pass vlan 10 20 30 40 101
#
interface GigabitEthernet0/0/10
 port link-type trunk
 port trunk allow-pass vlan 60
#
interface GigabitEthernet0/0/23
 eth-trunk 1
#
interface GigabitEthernet0/0/24
 eth-trunk 1
#
ospf 1 
 area 0.0.0.0 
  network 10.0.0.0 0.0.0.3 
  network 10.0.0.4 0.0.0.3 
  network 172.16.0.0 0.0.0.255 
 area 0.0.0.1 
  network 10.0.10.0 0.0.0.255 
  network 10.0.20.0 0.0.0.255 
  network 10.0.30.0 0.0.0.255 
  network 10.0.40.0 0.0.0.255 

防火墙

#
sysname USG6000V1
#
interface GigabitEthernet1/0/0
 undo shutdown
 ip address 10.0.0.2 255.255.255.252
#
interface GigabitEthernet1/0/1
 undo shutdown
 ip address 10.0.0.6 255.255.255.252
#
interface GigabitEthernet1/0/2
 undo shutdown
 ip address 220.100.0.1 255.255.255.0
#
firewall zone trust
 set priority 85
 add interface GigabitEthernet0/0/0
 add interface GigabitEthernet1/0/0
 add interface GigabitEthernet1/0/1
#
firewall zone untrust
 set priority 5
 add interface GigabitEthernet1/0/2
#
ospf 1
 default-route-advertise
 area 0.0.0.0
  network 10.0.0.2 0.0.0.0
  network 10.0.0.6 0.0.0.0
#
ip route-static 0.0.0.0 0.0.0.0 220.100.0.2
#
security-policy
 rule name T-U
  source-zone trust
  destination-zone untrust
  source-address 10.0.10.0 mask 255.255.255.0
  source-address 10.0.20.0 mask 255.255.255.0
  source-address 10.0.30.0 mask 255.255.255.0
  source-address 10.0.40.0 mask 255.255.255.0
  action permit
#
nat-policy
 rule name T-U
  source-zone trust
  destination-zone untrust
  source-address 10.0.10.0 mask 255.255.255.0
  source-address 10.0.20.0 mask 255.255.255.0
  source-address 10.0.30.0 mask 255.255.255.0
  source-address 10.0.40.0 mask 255.255.255.0
  action source-nat easy-ip
#

AC
#
vlan batch 10 20 30 40 101 to 102
#
dhcp enable
#
ip pool ap
 gateway-list 10.0.1.254 
 network 10.0.1.0 mask 255.255.255.0 
 option 43 sub-option 3 ascii 10.0.0.9 
#
interface Vlanif101
 ip address 10.0.1.254 255.255.255.0
 dhcp select global
#
interface Vlanif102
 ip address 10.0.0.9 255.255.255.252
#
interface GigabitEthernet0/0/1
 port link-type trunk
 port trunk allow-pass vlan 10 20 30 40 101 to 102
#
ip route-static 0.0.0.0 0.0.0.0 10.0.0.10
#
capwap source interface vlanif102
#
wlan

 security-profile name sec
  security wpa-wpa2 psk pass-phrase %^%#+!SyUB4ck%lV_X#id8"!]hYp<'Z>l<K<u08v#B"A%^%# aes

 ssid-profile name ssid
  ssid wifi

 vap-profile name vlan10
  service-vlan vlan-id 10
  ssid-profile ssid
  security-profile sec
 vap-profile name vlan40
  service-vlan vlan-id 40
  ssid-profile ssid
  security-profile sec

 ap-group name vlan10
  radio 0
   vap-profile vlan10 wlan 1
  radio 1
   vap-profile vlan10 wlan 1
 ap-group name vlan40
  radio 0
   vap-profile vlan40 wlan 1
  radio 1
   vap-profile vlan40 wlan 1

 ap-id 1 type-id 45 ap-mac 00e0-fcc9-5790 ap-sn 2102354483108876DF1D
  ap-name vlan10
  ap-group vlan10
 ap-id 2 type-id 45 ap-mac 00e0-fca5-2810 ap-sn 210235448310F207ED3A
  ap-name vlan40
  ap-group vlan40


外网配置
#
 sysname AR6
#
interface GigabitEthernet0/0/0
 ip address 220.100.0.2 255.255.255.0 
#
interface GigabitEthernet0/0/1
 ip address 221.0.0.1 255.255.255.252 
#
interface GigabitEthernet0/0/2
 ip address 221.0.0.5 255.255.255.252 
#
rip 1
 undo summary
 version 2
 network 221.0.0.0
 network 220.100.0.0
#


 sysname AR7
#
interface GigabitEthernet0/0/0
 ip address 221.0.0.2 255.255.255.252 
#
interface GigabitEthernet0/0/1
 ip address 221.0.0.9 255.255.255.252 
#
rip 1
 undo summary
 version 2
 network 221.0.0.0


 sysname AR8
#
interface GigabitEthernet0/0/0
 ip address 221.0.0.10 255.255.255.252 
#
interface GigabitEthernet0/0/1
 ip address 221.0.0.13 255.255.255.252 
#
interface GigabitEthernet0/0/2
 ip address 221.0.0.6 255.255.255.252 
#
rip 1
 undo summary
 version 2
 network 221.0.0.0


 sysname AR9
#
interface GigabitEthernet0/0/0
 ip address 221.0.0.14 255.255.255.252 
#
interface GigabitEthernet0/0/1
 ip address 200.100.0.2 255.255.255.0 
#
rip 1
 undo summary
 version 2
 network 200.100.0.0
 network 221.0.0.0