Chinaunix首页 | 论坛 | 博客
  • 博客访问: 3424817
  • 博文数量: 349
  • 博客积分: 5771
  • 博客等级: 大校
  • 技术积分: 4193
  • 用 户 组: 普通用户
  • 注册时间: 2009-07-06 11:52
个人简介

it

文章分类

全部博文(349)

文章存档

2019年(2)

2018年(2)

2017年(1)

2016年(2)

2015年(18)

2014年(36)

2013年(69)

2012年(100)

2011年(62)

2010年(57)

分类: 网络与安全

2013-04-24 09:49:39


clip_image002

 


实验拓朴:如上图。

实验要求:

1、 配置各接口的IP地址。

2、 配置VTP ,分别划分五个VLAN 2 、3、4、5 ,SW1 、SW2为服务器,其它为客户端。

3、 配置生成树协议,SW1为VLAN 2 、4 的主根桥,VLAN 3 、5 的次根桥,SW2为VLAN 2 、4 的次根桥,VLAN 3 、5 的主根桥。

4、 配置三层交换。

5、 在SW1 和 SW2 上配置HSRP协议,SW1为VLAN 2 、4的活跃路由器,SW2为VLAN 3 、5 的活跃路由器。

6、 在SW1和SW2的F0/14 、F0/15上配置以太网通道。

7、 在三层交换机和各个路由器上配置OSPF路由协议,R1到R2为area1,R4到R3为area2,三层交换和R3为area0。

8、 在R1 和 R3 之间配置VPN ,双方能够通过VPN上的虚拟接口学到对方的OSPF路由信息,并且两端的内部网络能够互相通信。

9、 在R3上配置NAT,使内部主机能够访问外网。

实验步骤:

1、 配置各接口的IP地址。

R1 S0/0 201.0.0.1/24

    LO0 192.168.6.1/24

    LO1 192.168.7.1/24

 

R2 S0/0 201.0.0.2/24

     S0/1 202.0.0.1/24

 

R3 S0/0 192.168.128.9/30

     S0/1 202.0.0.2/24

     F1/0 192.168.128.1/30

     F2/0 192.168.128.5/30

 

R4 S0/0 192.168.128.10/30

      LO0 192.168.8.1/24

      LO1 192.168.9.1/24

 

SW1 F0/0 192.168.128.2/30

        VLAN 2 192.168.2.1/24         VIRTUAL IP 192.168.2.254

        VLAN 3 192.168.3.1/24         VIRTUAL IP 192.168.3.254

        VLAN 4 192.168.4.1/24         VIRTUAL IP 192.168.4.254

        VLAN 5 192.168.5.1/24         VIRTUAL IP 192.168.5.254

 

SW2 F0/0 192.168.128.6/30

        VLAN 2 192.168.2.2/24         VIRTUAL IP 192.168.2.254

        VLAN 3 192.168.3.2/24         VIRTUAL IP 192.168.3.254

        VLAN 4 192.168.4.2/24         VIRTUAL IP 192.168.4.254

        VLAN 5 192.168.5.2/24         VIRTUAL IP 192.168.5.254

 

2、配置VTP ,分别划分五个VLAN 2 、3、4、5 ,SW1 、SW2为服务器,其它为客户端。

sw1(config)#int range f0/14 – 15

sw1(config-if-range)#switchport mode trunk

sw1(config-if-range)#int range f0/1 - 2

sw1(config-if-range)#switchport mode trunk

sw1#vlan da

sw1(vlan)#vlan 2

sw1(vlan)#vlan 3

sw1(vlan)#vlan 4

sw1(vlan)#vlan 5

sw1(vlan)#vtp domain jiawei

sw1(vlan)#vtp password 111111

sw1(vlan)#vtp server

sw1(vlan)#vtp pruning

sw1(vlan)#exit

 

sw3(config)#int range f0/1 - 2

sw3(config-if-range)#sw mo tr

sw3(config-if-range)#end

sw3#vlan da

sw3(vlan)#vtp domain jiawei

sw3(vlan)#vtp password 111111

sw3(vlan)#vtp client

SW2配置与SW1相同,SW4 、SW5配置与SW3相同。

 

3、 配置生成树协议,SW1为VLAN 2 、4 的主根桥,VLAN 3 、5 的次根桥,SW2为VLAN 2 、4 的次根桥,VLAN 3 、5 的主根桥。

sw1(config)#spanning-tree vlan 2 root primary

sw1(config)#spanning-tree vlan 4 root primary

sw1(config)#spanning-tree vlan 3 root secondary

sw1(config)#spanning-tree vlan 5 root secondary

 

sw2(config)#spanning-tree vlan 3 root primary

sw2(config)#spanning-tree vlan 5 root primary

sw2(config)#spanning-tree vlan 2 root secondary

sw2(config)#spanning-tree vlan 4 root secondary

 

4、 配置三层交换。

sw1(config)#int vlan 2

sw1(config-if)#ip add 192.168.2.1 255.255.255.0

sw1(config-if)#no shut

sw1(config-if)#int vlan 3

sw1(config-if)#ip add 192.168.3.1 255.255.255.0

sw1(config-if)#no shut

sw1(config-if)#int vlan 4

sw1(config-if)#ip add 192.168.4.1 255.255.255.0

sw1(config-if)#no shut

sw1(config-if)#int vlan 5

sw1(config-if)#ip add 192.168.5.1 255.255.255.0

sw1(config-if)#no shut

sw1(config-if)#end

 

sw2(config)#int vlan 2

sw2(config-if)#ip add 192.168.2.2 255.255.255.0

sw2(config-if)#no shut

sw2(config-if)#int vlan 3

sw2(config-if)#ip add 192.168.3.2 255.255.255.0

sw2(config-if)#no shut

sw2(config-if)#int vlan 4

sw2(config-if)#ip add 12.168.4.2 255.255.255.0

sw2(config-if)#no shut

sw2(config-if)#int vlan 5

sw2(config-if)#ip add 192.168.5.2 255.255.255.0

sw2(config-if)#no shut

sw2(config-if)#end

 

5、 在SW1 和 SW2 上配置HSRP协议,SW1为VLAN 2 、4的活跃路由器,SW2为VLAN 3 、5 的活跃路由器。

sw1(config)#int vlan 2

sw1(config-if)#standby 20 ip 192.168.2.254

sw1(config-if)#standby 20 priority 120

sw1(config-if)#standby 20 preempt

sw1(config-if)#standby 20 track f0/0 20

sw1(config-if)#exit

sw1(config)#int vlan 3

sw1(config-if)#standby 30 ip 192.168.3.254

sw1(config-if)#standby 30 priority 110

sw1(config-if)#standby 30 preempt

sw1(config-if)#exit

sw1(config)#int vlan 4

sw1(config-if)#standby 40 ip 192.168.4.254

sw1(config-if)#standby 40 priority 120

sw1(config-if)#standby 40 preempt

sw1(config-if)#standby 40 track f0/0 20

sw1(config-if)#exit

sw1(config)#int vlan 5

sw1(config-if)#standby 50 ip 192.168.5.254

sw1(config-if)#standby 50 priority 110

sw1(config-if)#standby 50 preempt

sw1(config-if)#end

 

sw2(config)#int vlan 2

sw2(config-if)#standby 20 ip 192.168.2.254

sw2(config-if)#standby 20 priority 110

sw2(config-if)#standby 20 preempt

sw2(config-if)#exit

sw2(config)#int vlan 3

sw2(config-if)#standby 30 ip 192.168.3.254

sw2(config-if)#standby 30 priority 120

sw2(config-if)#standby 30 preemp

sw2(config-if)#standby 30 track f0/0 20

sw2(config-if)#exit

sw2(config)#int vlan 4

sw2(config-if)#standby 40 ip 192.168.4.254

sw2(config-if)#standby 40 priority 110

sw2(config-if)#standby 40 preempt

sw2(config-if)#exit

sw2(config)#int vlan 5

sw2(config-if)#standby 50 ip 192.168.5.254

sw2(config-if)#standby 50 priority 120

sw2(config-if)#standby 50 preempt

sw2(config-if)#standby 50 track f0/0 20

sw2(config-if)#exit

sw2(config)#end

sw2#show standby bri

                                P indicates configured to preempt.

Interface    Grp Prio P State Active          Standby                    Virtual IP

Vl2      20 110 P Standby  192.168.2.1         local                  192.168.2.254

Vl3      30 120 P Active       local                   192.168.3.1       192.168.3.254

Vl4      40 110 P Standby   192.168.4.1        local                  192.168.4.254

Vl5      50 120 P Active       local                   192.168.5.1       192.168.5.254

 

sw1#show standby bri

                                P indicates configured to preempt.

Interface  Grp Prio P  State   Active                         standby                        Virtual IP

Vl2        20 120 P Active           local                       192.168.2.2               192.168.2.254

Vl3       30 110 P Standby        192.168.3.2           local                           192.168.3.254

Vl4       40 120 P Active             local                     192.168.4.2                192.168.4.254

Vl5       50 110 P Standby         192.168.5.2          local                           192.168.5.254

 

6、在SW1和SW2的F0/14 、F0/15上配置以太网通道

sw1(config)#int range f0/14 - 15

sw1(config-if-range)#channel-group 1 mode on

 

sw2(config)#int range f0/14 - 15

sw2(config-if-range)#channel-group 1 mode on

 

 

7、 在三层交换机和各个路由器上配置OSPF路由协议,R1到R2为area1,R4到R3为area2,三层交换和R3为area0。

sw1(config)#router ospf 100

sw1(config-router)#router-id 1.1.1.1

sw1(config-router)#do show ip int bri | in 192

FastEthernet0/0 192.168.128.2 YES manual up up

Vlan2 192.168.2.1 YES manual up up

Vlan3 192.168.3.1 YES manual up up

Vlan4 192.168.4.1 YES manual up up

Vlan5 192.168.5.1 YES manual up up

sw1(config-router)#network 192.168.128.2 0.0.0.0 a 0.0.0.0

sw1(config-router)#network 192.168.2.1 0.0.0.0 a 0.0.0.0

sw1(config-router)#network 192.168.3.1 0.0.0.0 a 0.0.0.0

sw1(config-router)#network 192.168.4.1 0.0.0.0 a 0.0.0.0

sw1(config-router)#network 192.168.5.1 0.0.0.0 a 0.0.0.0

sw1(config-router)#end

 

sw2(config)#router ospf 10

sw2(config-router)#router

sw2(config-router)#router-id 2.2.2.2

sw2(config-router)#do show ip int bri | in 192

FastEthernet0/0 192.168.128.6 YES manual up up

Vlan2 192.168.2.2 YES manual up up

Vlan3 192.168.3.2 YES manual up up

Vlan4 192.168.4.2 YES manual up up

Vlan5 192.168.5.2 YES manual up up

sw2(config-router)#network 192.168.128.6 0.0.0.0 a 0.0.0.0

sw2(config-router)#network 192.168.2.2 0.0.0.0 a 0.0.0.0

sw2(config-router)#network 192.168.3.2 0.0.0.0 a 0.0.0.0

sw2(config-router)#network 192.168.4.2 0.0.0.0 a 0.0.0.0

sw2(config-router)#network 192.168.5.2 0.0.0.0 a 0.0.0.0

 

r3(config)#router ospf 12

r3(config-router)#router

r3(config-router)#router-id 3.3.3.3

r3(config-router)#do show ip int bri

Interface IP-Address OK? Method Status Protocol

Serial0/0 192.168.128.9 YES manual up up

Serial0/1 202.0.0.2 YES manual up up

Serial0/2 unassigned YES unset administratively down down

Serial0/3 unassigned YES unset administratively down down

FastEthernet1/0 192.168.128.1 YES manual up up

FastEthernet2/0 192.168.128.5 YES manual up up

r3(config-router)#network 192.168.128.9 0.0.0.0 a 0.0.0.2

r3(config-router)#network 192.168.128.1 0.0.0.0 a 0.0.0.0

r3(config-router)#network 192.168.128.5 0.0.0.0 a 0.0.0.0

r3(config-router)#default-information originate always

r3(config-router)#end

 

r4(config)#router ospf 100

r4(config-router)#route

r4(config-router)#router-id 5.5.5.5

r4(config-router)#do show ip int bri

Interface IP-Address OK? Method Status Protocol

Serial0/0 192.168.128.10 YES manual up up

Serial0/1 unassigned YES unset administratively down down

Serial0/2 unassigned YES unset administratively down down

Serial0/3 unassigned YES unset administratively down down

Loopback0 192.168.8.1 YES manual up up

Loopback1 192.168.9.1 YES manual up up

r4(config-router)#network 192.168.128.10 0.0.0.0 a 0.0.0.2

r4(config-router)#network 192.168.8.1 0.0.0.0 a 0.0.0.2

r4(config-router)#network 192.168.9.1 0.0.0.0 a 0.0.0.2

r4(config-router)#end

 

8、在R1 和 R3 之间配置VPN ,双方能够通过VPN上的虚拟接口学到对方的OSPF路由信息,并且两端的内部网络能够互相通信。

r3(config)#crypto isakmp enable

r3(config)#crypto isakmp policy 100

r3(config-isakmp)#authentication pre-share

r3(config-isakmp)#exit

r3(config)#crypto isakmp key 0 qqqqqq add 201.0.0.1

r3(config)#crypto ipsec transform-set forvpn esp-des esp-md5-hmac

r3(cfg-crypto-trans)#exit

r3(config)#crypto ipsec profile site2site

r3(ipsec-profile)#set transform-set forvpn

r3(ipsec-profile)#end

r3(config)#int tunnel 0

r3(config-if)#ip add 1.1.1.1 255.255.255.0

r3(config-if)#no shut

r3(config-if)#tunnel source s0/1

r3(config-if)#tunnel destination 201.0.0.1

r3(config-if)#tunnel protection ipsec profile site2site

r3(config)#router ospf 12

r3(config-router)#do show ip int bri

Interface IP-Address OK? Method Status Protocol

Serial0/0 192.168.128.9 YES manual up up

Serial0/1 202.0.0.2 YES manual up up

Serial0/2 unassigned YES unset administratively down down

Serial0/3 unassigned YES unset administratively down down

FastEthernet1/0 192.168.128.1 YES manual up up

FastEthernet2/0 192.168.128.5 YES manual up up

Tunnel0 1.1.1.1 YES manual up up

r3(config-router)#network 1.1.1.1 0.0.0.0 a 0.0.0.1

 

r1(config)#crypto isakmp enable

r1(config)#crypto isakmp policy 100

r1(config-isakmp)#authentication pre-share

r1(config-isakmp)#exit

r1(config)#crypto isakmp key 0 qqqqqq add 202.0.0.2

r1(config)#crypto ipsec transform-set forvpn esp-des esp-md5-hmac

r1(cfg-crypto-trans)#exit

r1(config)#crypto ipsec profile site2site

r1(ipsec-profile)#set transform-set forvpn

r1(ipsec-profile)#end

r1(config)#int tunnel 0

r1(config-if)#ip add 1.1.1.2 255.255.255.0

r1(config-if)#no shut

r1(config-if)#tunnel source s0/0

r1(config-if)#tunnel destination 202.0.0.2

r1(config-if)#tunnel protection ipsec profile site2site

r1(config-if)#end

r1(config)#router ospf 2

r1(config-router)#router

r1(config-router)#router-id 4.4.4.4

r1(config-router)#network 192.168.6.1 0.0.0.0 a 0.0.0.1

r1(config-router)#network 192.168.7.1 0.0.0.0 a 0.0.0.1

r1(config-router)#network 1.1.1.2 0.0.0.0 a 0.0.0.1

r1(config-router)#end

r1#show ip route

Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP

D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area

N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2

E1 - OSPF external type 1, E2 - OSPF external type 2

i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2

ia - IS-IS inter area, * - candidate default, U - per-user static route

o - ODR, P - periodic downloaded static route

Gateway of last resort is 0.0.0.0 to network 0.0.0.0

1.0.0.0/24 is subnetted, 1 subnets

C 1.1.1.0 is directly connected, Tunnel0

192.168.128.0/30 is subnetted, 3 subnets

O IA 192.168.128.8 [110/11175] via 1.1.1.1, 00:00:27, Tunnel0

O 192.168.128.0 [110/11112] via 1.1.1.1, 00:00:27, Tunnel0

O 192.168.128.4 [110/11112] via 1.1.1.1, 00:00:27, Tunnel0

C 201.0.0.0/24 is directly connected, Serial0/0

O 192.168.4.0/24 [110/11113] via 1.1.1.1, 00:00:27, Tunnel0

O 192.168.5.0/24 [110/11113] via 1.1.1.1, 00:00:27, Tunnel0

C 192.168.6.0/24 is directly connected, Loopback0

C 192.168.7.0/24 is directly connected, Loopback1

O 192.168.2.0/24 [110/11113] via 1.1.1.1, 00:00:27, Tunnel0

O 192.168.3.0/24 [110/11113] via 1.1.1.1, 00:00:27, Tunnel0

S* 0.0.0.0/0 is directly connected, Serial0/0

 

r3#show ip route

Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP

D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area

N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2

E1 - OSPF external type 1, E2 - OSPF external type 2

i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2

ia - IS-IS inter area, * - candidate default, U - per-user static route

o - ODR, P - periodic downloaded static route

Gateway of last resort is 0.0.0.0 to network 0.0.0.0

1.0.0.0/24 is subnetted, 1 subnets

C 1.1.1.0 is directly connected, Tunnel0

192.168.128.0/30 is subnetted, 3 subnets

C 192.168.128.8 is directly connected, Serial0/0

C 192.168.128.0 is directly connected, FastEthernet1/0

C 192.168.128.4 is directly connected, FastEthernet2/0

C 202.0.0.0/24 is directly connected, Serial0/1

O 192.168.4.0/24 [110/2] via 192.168.128.6, 00:00:09, FastEthernet2/0

[110/2] via 192.168.128.2, 00:00:09, FastEthernet1/0

O 192.168.5.0/24 [110/2] via 192.168.128.6, 00:00:09, FastEthernet2/0

[110/2] via 192.168.128.2, 00:00:09, FastEthernet1/0

192.168.6.0/32 is subnetted, 1 subnets

O IA 192.168.6.1 [110/11112] via 1.1.1.2, 00:00:09, Tunnel0

192.168.7.0/32 is subnetted, 1 subnets

O IA 192.168.7.1 [110/11112] via 1.1.1.2, 00:00:24, Tunnel0

O 192.168.2.0/24 [110/2] via 192.168.128.6, 00:00:24, FastEthernet2/0

[110/2] via 192.168.128.2, 00:00:24, FastEthernet1/0

O 192.168.3.0/24 [110/2] via 192.168.128.6, 00:00:25, FastEthernet2/0

[110/2] via 192.168.128.2, 00:00:25, FastEthernet1/0

S* 0.0.0.0/0 is directly connected, Serial0/1

 

9、在R3上配置NAT,使内部主机能够访问外网。

r3(config)#access-list 1 permit 192.168.0.0 0.0.255.255

r3(config)#ip nat inside source list 1 interface s0/1 overload

r3(config)#int s0/1

r3(config-if)#ip nat outside

r3(config-if)#int s0/0

r3(config-if)#ip nat inside

r3(config-if)#int f1/0

r3(config-if)#ip nat inside

r3(config)#int f2/0

r3(config-if)#ip nat inside

r3(config-if)#end

r3#show ip nat translations

Pro Inside global Inside local Outside local Outside global

icmp 202.0.0.2:3 192.168.128.2:3 202.0.0.1:3 202.0.0.1:3

总结:经过上述配置后,所有网段都能互相通信,包括分公司内网同总公司内网,同时总公司内网也可以访问外网。总公司内网主机网关设为虚拟路由的IP即可。


阅读(1947) | 评论(0) | 转发(0) |
给主人留下些什么吧!~~