思科大型实验

2.实验要求：（R4是三层交换机，R5是二层交换机）

1：C1是VLAN10成员，C2是VLAN20成员

2：CI的流量默认通过R3，C2流量默认通过R4

3：通过HSRP和VRRP两种协议实现

4：所有成员通过R1外网口上网

5：R3需要通过R2远程管理，且只允许R2管理其他地址不行

6：所有员工上班时间不能上网，其他不影响

 

3.实验具体步骤：:

R1#conf t

R1(config)#int fa0/0

R1(config-if)#ip add 192.168.13.1 255.255.255.0     添加ip地址

R1(config-if)#no shut

R1(config-if)#int fa0/1

R1(config-if)#ip add 192.168.14.1 255.255.255.0     添加ip地址

R1(config-if)#no shut

R1(config-if)#int fa1/0

R1(config-if)#no switchport

R1(config-if)#ip add 12.0.0.1 255.255.255.0         添加ip地址

R1(config-if)#no shut

R1(config)#router rip                     使用RIP协议宣告路由，原则是有什么说什么

R1(config-router)#ver 2

R1(config-router)#no auto-summary

R1(config-router)#network 192.168.13.0

R1(config-router)#network 192.168.14.0

R1(config-router)#network 12.0.0.0

R1(config)#access-list 10 permit 192.168.10.0 0.0.0.255  
                                使用PAT，让私网地址通过路由器外

R1(config)#access-list 10 permit 192.168.20.0 0.0.0.255  
                                   部出口接口上公网

R1(config)#ip nat inside source list 10 interface fa1/0 overload

R1(config)#int fa0/0

R1(config-if)#ip nat inside

R1(config-if)#int fa0/1

R1(config-if)#ip nat inside

R1(config-if)#int fa1/0

R1(config-if)#ip nat outside

 

R1(config)#ip nat inside source static tcp 192.168.13.3 23 interface fa1/0 23 

R1#conf t

R1(config)#time-range time                        

R1(config-time-range)#periodic weekdays 5:30 to 17:30         

R1(config)#access-list 110 deny tcp any any eq 80 time-range time

R1(config)#

R1(config)#access-list 110 permit ip any any

R1(config)#int fa1/0

R1(config-if)#ip access-group 110 out

R1(config-if)#

 

 

 

 

 

R2#conf t

R2(config)#int fa0/0

R2(config-if)#ip add 12.0.0.2 255.255.255.0                 ^

R2(config-if)#no shut

 

R2(config)#router rip

R2(config-router)#ver 2

R2(config-router)#no auto-summary

R2(config-router)#network 12.0.0.0

 

R2#debug ip icmp           使用debug命令，查看流量通过那个地址上网的。

ICMP packet debugging is on

R2#

*Mar  1 00:31:20.059: ICMP: echo reply sent, src 12.0.0.2, dst 12.0.0.1

R2#

*Mar  1 00:31:21.211: ICMP: echo reply sent, src 12.0.0.2, dst 12.0.0.1

R2#

*Mar  1 00:31:22.323: ICMP: echo reply sent, src 12.0.0.2, dst 12.0.0.1

R2#

*Mar  1 00:31:23.411: ICMP: echo reply sent, src 12.0.0.2, dst 12.0.0.1

R2#

*Mar  1 00:31:24.523: ICMP: echo reply sent, src 12.0.0.2, dst 12.0.0.1

R2#

*Mar  1 00:31:36.287: ICMP: echo reply sent, src 12.0.0.2, dst 12.0.0.1

R2#

*Mar  1 00:31:37.399: ICMP: echo reply sent, src 12.0.0.2, dst 12.0.0.1

R2#

*Mar  1 00:31:38.539: ICMP: echo reply sent, src 12.0.0.2, dst 12.0.0.1

R2#

*Mar  1 00:31:39.627: ICMP: echo reply sent, src 12.0.0.2, dst 12.0.0.1

R2#

*Mar  1 00:31:40.727: ICMP: echo reply sent, src 12.0.0.2, dst 12.0.0.1

 

R2#telnet 12.0.0.1      Telnet12.0.0.1可以远程管理到R3

Trying 12.0.0.1 ... Open

 

 

User Access Verification

 

Password:

R3>

 

 

 

 

 

 

 

 

 

R3#conf t

R3(config)#int fa0/1

R3(config-if)#ip add 192.168.13.3 255.255.255.0

R3(config-if)#no shut

R3(config-if)#int fa0/0

R3(config-if)#no shut                       只有将主接口开启，才能将下边的子接口开启

R3(config-if)#int fa0/0.10              

R3(config-subif)#encapsulation dot1Q 10       改变接口封装类型

R3(config-subif)#ip add 192.168.10.10 255.255.255.0

R3(config-subif)#no shut

R3(config-subif)#int fa0/0.20

R3(config-subif)#encapsulation dot1Q 20

R3(config-subif)#ip add 192.168.20.10 255.255.255.0

R3(config-subif)#no shut

R3(config)#router rip                         RIP协议宣告路由

R3(config-router)#ver 2

R3(config-router)#no auto-summary

R3(config-router)#network 192.168.13.0

R3(config-router)#network 192.168.10.0

R3(config-router)#network 192.168.20.0

R3#ping

*Mar  1 00:07:49.731: %SYS-5-CONFIG_I: Configured from console by console

R3#ping 192.168.10.20

 

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 192.168.10.20, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 20/27/44 ms

R3#

R3#

R3#ping 12.0.0.2

 

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 12.0.0.2, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 40/62/84 ms

R3#

*Mar  1 00:08:08.863: %CDP-4-DUPLEX_MISMATCH: duplex mismatch discovered on FastEthernet0/0 (not full duplex), with R5 FastEthernet1/10 (full duplex).

R3#

*Mar  1 00:09:08.839: %CDP-4-DUPLEX_MISMATCH: duplex mismatch discovered on FastEthernet0/0 (not full duplex), with R5 FastEthernet1/10 (full duplex).

R3#

*Mar  1 00:10:08.867: %CDP-4-DUPLEX_MISMATCH: duplex mismatch discovered on FastEthernet0/0 (not full duplex), with R5 FastEthernet1/10 (full duplex).

R3#

R3#

R3#                                              PC1主

R3#conf t                               

R3(config)#int fa0/0.10                    使用HSRP做路由器备份。

R3(config-subif)#standby 1 ip 192.168.10.1    设置一个虚拟IP地址。   

R3(config-subif)#standby 1 priority 120       设置优先级(默认优先级为100）

R3(config-subif)#standby 1 preempt          设置抢占

R3(config-subif)#standby 1 track fa0/1        追踪上行口

R3(config-subif)#

R3(config-subif)#end

R3#

R3#show standby brief

                   P indicates configured to preempt.

                   |

Interface Grp  Pri P State   Active          Standby         Virtual IP

Fa0/0.10  1    120 P Active  local           192.168.10.20   192.168.10.1

R3#

*

R3#conf t

 

R3(config)#int fa0/1

R3(config-if)#shut

R3(config-if)#no shut

 

R3(config-if)#exit                                  PC2备

R3(config)#int fa0/0.20                        使用vrrp做路由备份

R3(config-subif)#vrrp 1 ip 192.168.20.1           设置一个虚拟IP地址。

R3(config-subif)#vrrp 1 priority 95               设置优先级(默认优先级为100）

R3(config-subif)#vrrp 1 preempt                 设置抢占

 

 

R3#show vrrp brief                 查看主备信息

Interface          Grp Pri Time  Own Pre State   Master addr     Group addr

Fa0/0.20           1   95  3628       Y  Backup  192.168.20.20   192.168.20.1

R3#show standby brief

                       |

Interface Grp  Pri P State   Active          Standby         Virtual IP

Fa0/0.10  1    120 P Active  local           192.168.10.20   192.168.10.1

R3#

*Mar  1 00:21:08.807: %CDP-4-DUPLEX_MISMATCH: duplex mismatch discovered on FastEthernet0/0 (not full duplex), with R5 FastEthernet1/10 (full duplex).

R3#

*Mar  1 00:22:08.811: %CDP-4-DUPLEX_MISMATCH: duplex mismatch discovered on FastEthernet0/0 (not full duplex), with R5 FastEthernet1/10 (full duplex).

R3#

R3#

R3#

 

R3(config)#line v                      开启远程控制功能

R3(config)#line vty 0 4

R3(config-line)#password 123

R3(config-line)#login

R3(config-line)#exit

R3(config)#

R3(config)#access-list 10 permit host 12.0.0.2 做一个列表，只允许知己12.0.0.2可以远程管理

R3(config)#

R3(config)#lin

R3(config)#line v

R3(config)#line vty 0 4

R3(config-line)#access-class 10 in

 

 

R4#conf t

R4(config)#vlan 10,20,100              创建VLAN

R4(config)#int fa1/1

R4(config-if)#switchport mode trunk      将三层交换机的fa/1口设置为trunk口

R4(config-vlan)#int fa1/2

R4(config-if)#switchport access vlan 100     

R4(config-if)#int vlan 100              给VLAN配置IP地址

R4(config-if)#ip add 192.168.14.4 255.255.255.0

R4(config-if)#no shut

R4(config-if)#int vlan 10

R4(config-if)#ip add 192.168.10.20 255.255.255.0

R4(config-if)#int vlan 20

R4(config-if)#ip add 192.168.20.20 255.255.255.0   

R4(config-if)#no shut

R4(config-if)#

R4(config-if)#exit

 

R4(config)#router rip                 使用RIP宣告路由

R4(config-router)#ver 2

R4(config-router)#network 192.168.14.0

R4(config-router)#network 192.168.10.0

R4(config-router)#network 192.168.20.0

R4(config-router)#end

R4#

R4#

R4#ping

*Mar  1 00:07:34.067: %SYS-5-CONFIG_I: Configured from console by console

R4#ping 192.168.10.10

 

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 192.168.10.10, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 20/23/28 ms

R4#ping 12.0.0.2

 

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 12.0.0.2, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 36/57/76 ms

R4#conf t

R4(config)#int vlan 10             使用HSRP做路由器备份。

R4(config-if)#standby 1 ip 192.168.10.1     设置一个虚拟IP地址。

R4(config-if)#standby 1 priority 115     设置优先级(默认优先级为100）

R4(config-if)#standby 1 preempt      设置抢占

R4(config-if)#end

R4#

R4#

R4#show standby brief

 

                   P indicates configured to preempt.

                   |

Interface Grp  Pri P State   Active          Standby         Virtual IP

Vl10      1    115 P Standby 192.168.10.10   local           192.168.10.1

R4#

R4(config)#

R4(config)#int vlan 20                        使用VRRP做路由器备份。

R4(config-if)#vrrp 1 ip 192.168.20.1             设置一个虚拟IP地址。

R4(config-if)#vrrp 1 preempt                   设置抢占

R4(config-if)#exit

R4(config)#track 1 int fa1/2 line-protocol         追踪上行口

R4(config-track)#int vlan 20

R4(config-if)#vrrp 1 track 1

R4#

R4#

*Mar  1 00:20:11.339: %SYS-5-CONFIG_I: Configured from console by console

R4#show stan

R4#show standby b

R4#show standby brief

                   P indicates configured to preempt.

                   |

Interface Grp  Pri P State   Active          Standby         Virtual IP

Vl10      1    115 P Standby 192.168.10.10   local           192.168.10.1

R4#

R4#

R4#show vrr

R4#show vrrp b

R4#show vrrp brief

Interface          Grp Pri Time  Own Pre State   Master addr     Group addr

Vl20               1   100 3609       Y  Master  192.168.20.20   192.168.20.1

R4#show standby brief

                   P indicates configured to preempt.

                   |

Interface Grp  Pri P State   Active          Standby         Virtual IP

Vl10      1    115 P Standby 192.168.10.10   local           192.168.10.1

 (half duplex).

R4#

 

R4(config)#int fa1/2

R4(config-if)#shut

R4(config-if)#no shut

 

R5#

R5#conf t

R5(config)#vlan 10,20

R5(config-vlan)#int fa1/1

R5(config-if)#switchport access vlan 10

R5(config-if)#int fa1/2

R5(config-if)#switchport access vlan 20

R5(config-if)#int ran fa1/10 -11

R5(config-if-range)#switchport mode trunk

 

1.当主的的路由器R3正常运行时，ping12.0.0.2 和所走的路径。

2. 当主的路由器不能正常工作时，备的三层交换机（R4）会接替路由器的工作，ping12.0.0.2 和所走的路径。

1.当主的的三层交换机正常运行时，ping12.0.0.2 和所走的路径。

2. 当主三层交换机（R4）不能正常工作时，备的路由器会接替交换机（R4）的工作，ping12.0.0.2 和所走的路径。

 

在R2上使用debug命令，查看ping12.0.0.2时，所使用的地址