[V200R023C00SPC100]
#
 sysname AC-C-2.PEK3-G
#
 http secure-server ssl-policy default_policy
 http secure-server server-source -i all
 http server enable
#
 clock timezone Beijing add 08:00:00
#
  set np rss hash-mode 5-tuple
#
mdns permit service-type _airplay._tcp.local id 0
mdns permit service-type _raop._tcp.local id 1
mdns permit service-type _printer._tcp.local id 2
mdns permit service-type _ipp._tcp.local id 3
mdns permit service-type _universal._sub._ipp._tcp.local id 4
mdns permit service-type _cups._sub._ipp._tcp.local id 5
#
kpi disable
#
vrrp recover-delay 60
#
stp bpdu-protection
stp enable
#
authentication-profile name default_authen_profile
authentication-profile name dot1x_authen_profile
authentication-profile name mac_authen_profile
authentication-profile name macportal_authen_profile
authentication-profile name portal_authen_profile
#
domain nacs.com admin
#
dns resolve
dns proxy enable
#
diffserv domain default
#
#
radius-server template default
#
hwtacacs-server template nacs
 hwtacacs-server authentication 101.200.147.225
 hwtacacs-server authentication 47.107.62.135 secondary
 hwtacacs-server authorization 101.200.147.225
 hwtacacs-server authorization 47.107.62.135 secondary
 hwtacacs-server accounting 101.200.147.225
 hwtacacs-server accounting 47.107.62.135 secondary
 hwtacacs-server shared-key cipher Q9JAFKegkGNE4wHX
#
pki realm default
 certificate-check none
#
ssl policy default_policy type server
 pki-realm default
 version tls1.2
 ciphersuite ecdhe_rsa_aes128_gcm_sha256 ecdhe_rsa_aes256_gcm_sha384
#
ike proposal default
 encryption-algorithm aes-256
 dh group14
 authentication-algorithm sha2-256
 authentication-method pre-share
 integrity-algorithm hmac-sha2-256
 prf hmac-sha2-256
#
free-rule-template name default_free_rule
#
portal-access-profile name portal_access_profile
#
aaa
 authentication-scheme default
  authentication-mode local
 authentication-scheme radius
  authentication-mode radius
 authentication-scheme tacacs1
  authentication-mode hwtacacs local
 authorization-scheme default
  authorization-mode local
 authorization-scheme tacacs2
  authorization-mode hwtacacs local
  authorization-cmd 15 hwtacacs local
 accounting-scheme default
  accounting-mode none
 accounting-scheme tacacs3
  accounting-mode hwtacacs
  accounting start-fail online
 recording-scheme tacacs0
  recording-mode hwtacacs nacs
 cmd recording-scheme tacacs0
 local-aaa-user password policy administrator
 domain default
  authentication-scheme default
  accounting-scheme default
  radius-server default
 domain default_admin
  authentication-scheme default
  accounting-scheme default
 domain nacs.com
  authentication-scheme tacacs1
  accounting-scheme tacacs3
  authorization-scheme tacacs2
  hwtacacs-server nacs
 local-user cnadmin password irreversible-cipher $1a$/!sY(z"+mJ$F&8j%3_2iV#ng1JPix(N7l"*H:bg(E-4xaTdK+(G$
 local-user cnadmin privilege level 15
 local-user cnadmin service-type ssh http
#
interface Vlanif1
 ip address 169.254.1.1 255.255.255.0
 ip address dhcp-alloc unicast
#
interface Ethernet0/0/47
 ip address 169.254.3.1 255.255.255.0
#
interface GigabitEthernet0/0/1
#
interface GigabitEthernet0/0/2
#
interface GigabitEthernet0/0/3
#
interface GigabitEthernet0/0/4
#
interface GigabitEthernet0/0/5
#
interface GigabitEthernet0/0/6
#
interface GigabitEthernet0/0/7
#
interface GigabitEthernet0/0/8
#
interface GigabitEthernet0/0/9
#
interface GigabitEthernet0/0/10
#
interface XGigabitEthernet0/0/1
#
interface XGigabitEthernet0/0/2
#
interface NULL0
#
 ftp server-source -i Vlanif1
#
 info-center timestamp log date precision-time millisecond
 info-center timestamp trap date precision-time millisecond
#
undo icmp name timestamp-request receive
#
 ssh server-source -i all
 stelnet server enable
 undo telnet server enable
 undo telnet ipv6 server enable
 telnet server-source -i Vlanif1
ssh server secure-algorithms cipher aes256_ctr aes128_ctr
ssh server secure-algorithms hmac sha2_256
ssh server key-exchange dh_group16_sha512 dh_group15_sha512 ecdh-sha2-nistp521 ecdh-sha2-nistp384 ecdh-sha2-nistp256 dh_group_exchange_sha256
ssh client secure-algorithms cipher aes256_ctr aes128_ctr
ssh client secure-algorithms hmac sha2_256
ssh client key-exchange dh_group16_sha512 dh_group15_sha512 ecdh-sha2-nistp521 ecdh-sha2-nistp384 ecdh-sha2-nistp256 dh_group_exchange_sha256
#
user-interface con 0
 authentication-mode password
 set authentication password irreversible-cipher $1b$l!LNQs:%{5$ZP)f7;mt-%-v5/3zZkIJ>C|U0`w-,S(.`+K<BGoK$
user-interface vty 0 4
 authentication-mode aaa
 protocol inbound ssh
user-interface vty 16 20
 authentication-mode aaa
 protocol inbound ssh
#
wmi-server
#
wmi-server2
#
hsb-service 0
 service-ip-port local-ip 0.0.0.0 peer-ip 0.0.0.0 local-data-port 10241 peer-data-port 10241
#
hsb-service-type access-user hsb-group 0
#
hsb-service-type dhcp hsb-group 0
#
hsb-service-type ap hsb-group 0
#
wlan
 license centralized enable
 temporary-management psk %^%#AD_VDnopn5G"y2%Y'T58[.ui9Fse~4iH|p#vr9i;%^%#
 ap username cnadmin password cipher %^%#KC&u,O<NUVJ0g#R4lEZ*M|Ft4@2$M&WTqn3T-|]:%^%#
 traffic-profile name default
 security-profile name default
 security-profile name default-wds
 security-profile name default-mesh
 ssid-profile name default
 vap-profile name default
 wds-profile name default
 mesh-handover-profile name default
 mesh-profile name default
 regulatory-domain-profile name default
 air-scan-profile name default
 rrm-profile name default
 radio-2g-profile name default
 radio-5g-profile name default
 wids-spoof-profile name default
 wids-whitelist-profile name default
 wids-profile name default
 wireless-access-specification
 tunnel-ap-group name default
 ap-system-profile name default
  keep-service enable allow new-access
 port-link-profile name default
 wired-port-profile name default
 ap auth-mode no-auth
 ap-group name default
  radio 0
  radio 1
  radio 2
 provision-ap
#
device-profile profile-name @default_device_profile
 device-type default_type_phone
 enable
 rule 0 user-agent sub-match Android
 rule 1 user-agent sub-match iPhone
 rule 2 user-agent sub-match iPad
 if-match rule 0 or rule 1 or rule 2
#
dot1x-access-profile name dot1x_access_profile
#
mac-access-profile name mac_access_profile
#
return