it
分类： 网络与安全
2013-04-24 09:49:39
|
实验要求：
1、 配置各接口的IP地址。
2、 配置VTP ，分别划分五个VLAN 2 、3、4、5 ，SW1 、SW2为服务器，其它为客户端。
3、 配置生成树协议，SW1为VLAN 2 、4 的主根桥，VLAN 3 、5 的次根桥，SW2为VLAN 2 、4 的次根桥，VLAN 3 、5 的主根桥。
4、 配置三层交换。
5、 在SW1 和 SW2 上配置HSRP协议，SW1为VLAN 2 、4的活跃路由器，SW2为VLAN 3 、5 的活跃路由器。
6、 在SW1和SW2的F0/14 、F0/15上配置以太网通道。
7、 在三层交换机和各个路由器上配置OSPF路由协议，R1到R2为area1，R4到R3为area2，三层交换和R3为area0。
8、 在R1 和 R3 之间配置VPN ，双方能够通过VPN上的虚拟接口学到对方的OSPF路由信息，并且两端的内部网络能够互相通信。
9、 在R3上配置NAT，使内部主机能够访问外网。
实验步骤：
1、 配置各接口的IP地址。
R1 S0/0 201.0.0.1/24
LO0 192.168.6.1/24
LO1 192.168.7.1/24
R2 S0/0 201.0.0.2/24
S0/1 202.0.0.1/24
R3 S0/0 192.168.128.9/30
S0/1 202.0.0.2/24
F1/0 192.168.128.1/30
F2/0 192.168.128.5/30
R4 S0/0 192.168.128.10/30
LO0 192.168.8.1/24
LO1 192.168.9.1/24
SW1 F0/0 192.168.128.2/30
VLAN 2 192.168.2.1/24 VIRTUAL IP 192.168.2.254
VLAN 3 192.168.3.1/24 VIRTUAL IP 192.168.3.254
VLAN 4 192.168.4.1/24 VIRTUAL IP 192.168.4.254
VLAN 5 192.168.5.1/24 VIRTUAL IP 192.168.5.254
SW2 F0/0 192.168.128.6/30
VLAN 2 192.168.2.2/24 VIRTUAL IP 192.168.2.254
VLAN 3 192.168.3.2/24 VIRTUAL IP 192.168.3.254
VLAN 4 192.168.4.2/24 VIRTUAL IP 192.168.4.254
VLAN 5 192.168.5.2/24 VIRTUAL IP 192.168.5.254
2、配置VTP ，分别划分五个VLAN 2 、3、4、5 ，SW1 、SW2为服务器，其它为客户端。
sw1(config)#int range f0/14 – 15
sw1(config-if-range)#switchport mode trunk
sw1(config-if-range)#int range f0/1 - 2
sw1(config-if-range)#switchport mode trunk
sw1#vlan da
sw1(vlan)#vlan 2
sw1(vlan)#vlan 3
sw1(vlan)#vlan 4
sw1(vlan)#vlan 5
sw1(vlan)#vtp domain jiawei
sw1(vlan)#vtp password 111111
sw1(vlan)#vtp server
sw1(vlan)#vtp pruning
sw1(vlan)#exit
sw3(config)#int range f0/1 - 2
sw3(config-if-range)#sw mo tr
sw3(config-if-range)#end
sw3#vlan da
sw3(vlan)#vtp domain jiawei
sw3(vlan)#vtp password 111111
sw3(vlan)#vtp client
SW2配置与SW1相同，SW4 、SW5配置与SW3相同。
3、 配置生成树协议，SW1为VLAN 2 、4 的主根桥，VLAN 3 、5 的次根桥，SW2为VLAN 2 、4 的次根桥，VLAN 3 、5 的主根桥。
sw1(config)#spanning-tree vlan 2 root primary
sw1(config)#spanning-tree vlan 4 root primary
sw1(config)#spanning-tree vlan 3 root secondary
sw1(config)#spanning-tree vlan 5 root secondary
sw2(config)#spanning-tree vlan 3 root primary
sw2(config)#spanning-tree vlan 5 root primary
sw2(config)#spanning-tree vlan 2 root secondary
sw2(config)#spanning-tree vlan 4 root secondary
4、 配置三层交换。
sw1(config)#int vlan 2
sw1(config-if)#ip add 192.168.2.1 255.255.255.0
sw1(config-if)#no shut
sw1(config-if)#int vlan 3
sw1(config-if)#ip add 192.168.3.1 255.255.255.0
sw1(config-if)#no shut
sw1(config-if)#int vlan 4
sw1(config-if)#ip add 192.168.4.1 255.255.255.0
sw1(config-if)#no shut
sw1(config-if)#int vlan 5
sw1(config-if)#ip add 192.168.5.1 255.255.255.0
sw1(config-if)#no shut
sw1(config-if)#end
sw2(config)#int vlan 2
sw2(config-if)#ip add 192.168.2.2 255.255.255.0
sw2(config-if)#no shut
sw2(config-if)#int vlan 3
sw2(config-if)#ip add 192.168.3.2 255.255.255.0
sw2(config-if)#no shut
sw2(config-if)#int vlan 4
sw2(config-if)#ip add 12.168.4.2 255.255.255.0
sw2(config-if)#no shut
sw2(config-if)#int vlan 5
sw2(config-if)#ip add 192.168.5.2 255.255.255.0
sw2(config-if)#no shut
sw2(config-if)#end
5、 在SW1 和 SW2 上配置HSRP协议，SW1为VLAN 2 、4的活跃路由器，SW2为VLAN 3 、5 的活跃路由器。
sw1(config)#int vlan 2
sw1(config-if)#standby 20 ip 192.168.2.254
sw1(config-if)#standby 20 priority 120
sw1(config-if)#standby 20 preempt
sw1(config-if)#standby 20 track f0/0 20
sw1(config-if)#exit
sw1(config)#int vlan 3
sw1(config-if)#standby 30 ip 192.168.3.254
sw1(config-if)#standby 30 priority 110
sw1(config-if)#standby 30 preempt
sw1(config-if)#exit
sw1(config)#int vlan 4
sw1(config-if)#standby 40 ip 192.168.4.254
sw1(config-if)#standby 40 priority 120
sw1(config-if)#standby 40 preempt
sw1(config-if)#standby 40 track f0/0 20
sw1(config-if)#exit
sw1(config)#int vlan 5
sw1(config-if)#standby 50 ip 192.168.5.254
sw1(config-if)#standby 50 priority 110
sw1(config-if)#standby 50 preempt
sw1(config-if)#end
sw2(config)#int vlan 2
sw2(config-if)#standby 20 ip 192.168.2.254
sw2(config-if)#standby 20 priority 110
sw2(config-if)#standby 20 preempt
sw2(config-if)#exit
sw2(config)#int vlan 3
sw2(config-if)#standby 30 ip 192.168.3.254
sw2(config-if)#standby 30 priority 120
sw2(config-if)#standby 30 preemp
sw2(config-if)#standby 30 track f0/0 20
sw2(config-if)#exit
sw2(config)#int vlan 4
sw2(config-if)#standby 40 ip 192.168.4.254
sw2(config-if)#standby 40 priority 110
sw2(config-if)#standby 40 preempt
sw2(config-if)#exit
sw2(config)#int vlan 5
sw2(config-if)#standby 50 ip 192.168.5.254
sw2(config-if)#standby 50 priority 120
sw2(config-if)#standby 50 preempt
sw2(config-if)#standby 50 track f0/0 20
sw2(config-if)#exit
sw2(config)#end
sw2#show standby bri
P indicates configured to preempt.
Interface Grp Prio P State Active Standby Virtual IP
Vl2 20 110 P Standby 192.168.2.1 local 192.168.2.254
Vl3 30 120 P Active local 192.168.3.1 192.168.3.254
Vl4 40 110 P Standby 192.168.4.1 local 192.168.4.254
Vl5 50 120 P Active local 192.168.5.1 192.168.5.254
sw1#show standby bri
P indicates configured to preempt.
Interface Grp Prio P State Active standby Virtual IP
Vl2 20 120 P Active local 192.168.2.2 192.168.2.254
Vl3 30 110 P Standby 192.168.3.2 local 192.168.3.254
Vl4 40 120 P Active local 192.168.4.2 192.168.4.254
Vl5 50 110 P Standby 192.168.5.2 local 192.168.5.254
6、在SW1和SW2的F0/14 、F0/15上配置以太网通道
sw1(config)#int range f0/14 - 15
sw1(config-if-range)#channel-group 1 mode on
sw2(config)#int range f0/14 - 15
sw2(config-if-range)#channel-group 1 mode on
7、 在三层交换机和各个路由器上配置OSPF路由协议，R1到R2为area1，R4到R3为area2，三层交换和R3为area0。
sw1(config)#router ospf 100
sw1(config-router)#router-id 1.1.1.1
sw1(config-router)#do show ip int bri | in 192
FastEthernet0/0 192.168.128.2 YES manual up up
Vlan2 192.168.2.1 YES manual up up
Vlan3 192.168.3.1 YES manual up up
Vlan4 192.168.4.1 YES manual up up
Vlan5 192.168.5.1 YES manual up up
sw1(config-router)#network 192.168.128.2 0.0.0.0 a 0.0.0.0
sw1(config-router)#network 192.168.2.1 0.0.0.0 a 0.0.0.0
sw1(config-router)#network 192.168.3.1 0.0.0.0 a 0.0.0.0
sw1(config-router)#network 192.168.4.1 0.0.0.0 a 0.0.0.0
sw1(config-router)#network 192.168.5.1 0.0.0.0 a 0.0.0.0
sw1(config-router)#end
sw2(config)#router ospf 10
sw2(config-router)#router
sw2(config-router)#router-id 2.2.2.2
sw2(config-router)#do show ip int bri | in 192
FastEthernet0/0 192.168.128.6 YES manual up up
Vlan2 192.168.2.2 YES manual up up
Vlan3 192.168.3.2 YES manual up up
Vlan4 192.168.4.2 YES manual up up
Vlan5 192.168.5.2 YES manual up up
sw2(config-router)#network 192.168.128.6 0.0.0.0 a 0.0.0.0
sw2(config-router)#network 192.168.2.2 0.0.0.0 a 0.0.0.0
sw2(config-router)#network 192.168.3.2 0.0.0.0 a 0.0.0.0
sw2(config-router)#network 192.168.4.2 0.0.0.0 a 0.0.0.0
sw2(config-router)#network 192.168.5.2 0.0.0.0 a 0.0.0.0
r3(config)#router ospf 12
r3(config-router)#router
r3(config-router)#router-id 3.3.3.3
r3(config-router)#do show ip int bri
Interface IP-Address OK? Method Status Protocol
Serial0/0 192.168.128.9 YES manual up up
Serial0/1 202.0.0.2 YES manual up up
Serial0/2 unassigned YES unset administratively down down
Serial0/3 unassigned YES unset administratively down down
FastEthernet1/0 192.168.128.1 YES manual up up
FastEthernet2/0 192.168.128.5 YES manual up up
r3(config-router)#network 192.168.128.9 0.0.0.0 a 0.0.0.2
r3(config-router)#network 192.168.128.1 0.0.0.0 a 0.0.0.0
r3(config-router)#network 192.168.128.5 0.0.0.0 a 0.0.0.0
r3(config-router)#default-information originate always
r3(config-router)#end
r4(config)#router ospf 100
r4(config-router)#route
r4(config-router)#router-id 5.5.5.5
r4(config-router)#do show ip int bri
Interface IP-Address OK? Method Status Protocol
Serial0/0 192.168.128.10 YES manual up up
Serial0/1 unassigned YES unset administratively down down
Serial0/2 unassigned YES unset administratively down down
Serial0/3 unassigned YES unset administratively down down
Loopback0 192.168.8.1 YES manual up up
Loopback1 192.168.9.1 YES manual up up
r4(config-router)#network 192.168.128.10 0.0.0.0 a 0.0.0.2
r4(config-router)#network 192.168.8.1 0.0.0.0 a 0.0.0.2
r4(config-router)#network 192.168.9.1 0.0.0.0 a 0.0.0.2
r4(config-router)#end
8、在R1 和 R3 之间配置VPN ，双方能够通过VPN上的虚拟接口学到对方的OSPF路由信息，并且两端的内部网络能够互相通信。
r3(config)#crypto isakmp enable
r3(config)#crypto isakmp policy 100
r3(config-isakmp)#authentication pre-share
r3(config-isakmp)#exit
r3(config)#crypto isakmp key 0 qqqqqq add 201.0.0.1
r3(config)#crypto ipsec transform-set forvpn esp-des esp-md5-hmac
r3(cfg-crypto-trans)#exit
r3(config)#crypto ipsec profile site2site
r3(ipsec-profile)#set transform-set forvpn
r3(ipsec-profile)#end
r3(config)#int tunnel 0
r3(config-if)#ip add 1.1.1.1 255.255.255.0
r3(config-if)#no shut
r3(config-if)#tunnel source s0/1
r3(config-if)#tunnel destination 201.0.0.1
r3(config-if)#tunnel protection ipsec profile site2site
r3(config)#router ospf 12
r3(config-router)#do show ip int bri
Interface IP-Address OK? Method Status Protocol
Serial0/0 192.168.128.9 YES manual up up
Serial0/1 202.0.0.2 YES manual up up
Serial0/2 unassigned YES unset administratively down down
Serial0/3 unassigned YES unset administratively down down
FastEthernet1/0 192.168.128.1 YES manual up up
FastEthernet2/0 192.168.128.5 YES manual up up
Tunnel0 1.1.1.1 YES manual up up
r3(config-router)#network 1.1.1.1 0.0.0.0 a 0.0.0.1
r1(config)#crypto isakmp enable
r1(config)#crypto isakmp policy 100
r1(config-isakmp)#authentication pre-share
r1(config-isakmp)#exit
r1(config)#crypto isakmp key 0 qqqqqq add 202.0.0.2
r1(config)#crypto ipsec transform-set forvpn esp-des esp-md5-hmac
r1(cfg-crypto-trans)#exit
r1(config)#crypto ipsec profile site2site
r1(ipsec-profile)#set transform-set forvpn
r1(ipsec-profile)#end
r1(config)#int tunnel 0
r1(config-if)#ip add 1.1.1.2 255.255.255.0
r1(config-if)#no shut
r1(config-if)#tunnel source s0/0
r1(config-if)#tunnel destination 202.0.0.2
r1(config-if)#tunnel protection ipsec profile site2site
r1(config-if)#end
r1(config)#router ospf 2
r1(config-router)#router
r1(config-router)#router-id 4.4.4.4
r1(config-router)#network 192.168.6.1 0.0.0.0 a 0.0.0.1
r1(config-router)#network 192.168.7.1 0.0.0.0 a 0.0.0.1
r1(config-router)#network 1.1.1.2 0.0.0.0 a 0.0.0.1
r1(config-router)#end
r1#show ip route
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
ia - IS-IS inter area, * - candidate default, U - per-user static route
o - ODR, P - periodic downloaded static route
Gateway of last resort is 0.0.0.0 to network 0.0.0.0
1.0.0.0/24 is subnetted, 1 subnets
C 1.1.1.0 is directly connected, Tunnel0
192.168.128.0/30 is subnetted, 3 subnets
O IA 192.168.128.8 [110/11175] via 1.1.1.1, 00:00:27, Tunnel0
O 192.168.128.0 [110/11112] via 1.1.1.1, 00:00:27, Tunnel0
O 192.168.128.4 [110/11112] via 1.1.1.1, 00:00:27, Tunnel0
C 201.0.0.0/24 is directly connected, Serial0/0
O 192.168.4.0/24 [110/11113] via 1.1.1.1, 00:00:27, Tunnel0
O 192.168.5.0/24 [110/11113] via 1.1.1.1, 00:00:27, Tunnel0
C 192.168.6.0/24 is directly connected, Loopback0
C 192.168.7.0/24 is directly connected, Loopback1
O 192.168.2.0/24 [110/11113] via 1.1.1.1, 00:00:27, Tunnel0
O 192.168.3.0/24 [110/11113] via 1.1.1.1, 00:00:27, Tunnel0
S* 0.0.0.0/0 is directly connected, Serial0/0
r3#show ip route
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
ia - IS-IS inter area, * - candidate default, U - per-user static route
o - ODR, P - periodic downloaded static route
Gateway of last resort is 0.0.0.0 to network 0.0.0.0
1.0.0.0/24 is subnetted, 1 subnets
C 1.1.1.0 is directly connected, Tunnel0
192.168.128.0/30 is subnetted, 3 subnets
C 192.168.128.8 is directly connected, Serial0/0
C 192.168.128.0 is directly connected, FastEthernet1/0
C 192.168.128.4 is directly connected, FastEthernet2/0
C 202.0.0.0/24 is directly connected, Serial0/1
O 192.168.4.0/24 [110/2] via 192.168.128.6, 00:00:09, FastEthernet2/0
[110/2] via 192.168.128.2, 00:00:09, FastEthernet1/0
O 192.168.5.0/24 [110/2] via 192.168.128.6, 00:00:09, FastEthernet2/0
[110/2] via 192.168.128.2, 00:00:09, FastEthernet1/0
192.168.6.0/32 is subnetted, 1 subnets
O IA 192.168.6.1 [110/11112] via 1.1.1.2, 00:00:09, Tunnel0
192.168.7.0/32 is subnetted, 1 subnets
O IA 192.168.7.1 [110/11112] via 1.1.1.2, 00:00:24, Tunnel0
O 192.168.2.0/24 [110/2] via 192.168.128.6, 00:00:24, FastEthernet2/0
[110/2] via 192.168.128.2, 00:00:24, FastEthernet1/0
O 192.168.3.0/24 [110/2] via 192.168.128.6, 00:00:25, FastEthernet2/0
[110/2] via 192.168.128.2, 00:00:25, FastEthernet1/0
S* 0.0.0.0/0 is directly connected, Serial0/1
9、在R3上配置NAT，使内部主机能够访问外网。
r3(config)#access-list 1 permit 192.168.0.0 0.0.255.255
r3(config)#ip nat inside source list 1 interface s0/1 overload
r3(config)#int s0/1
r3(config-if)#ip nat outside
r3(config-if)#int s0/0
r3(config-if)#ip nat inside
r3(config-if)#int f1/0
r3(config-if)#ip nat inside
r3(config)#int f2/0
r3(config-if)#ip nat inside
r3(config-if)#end
r3#show ip nat translations
Pro Inside global Inside local Outside local Outside global
icmp 202.0.0.2:3 192.168.128.2:3 202.0.0.1:3 202.0.0.1:3
总结：经过上述配置后，所有网段都能互相通信，包括分公司内网同总公司内网，同时总公司内网也可以访问外网。总公司内网主机网关设为虚拟路由的IP即可。
