当前位置：首页 > article >正文

ENSP综合实验(中小型网络）

article 2025/1/8 16:06:24

一、实验背景

在当今数字化的企业环境中，一个稳定、高效且安全的网络架构对于业务的持续运营和发展至关重要。随着企业内部各部门业务的不断拓展，如财务部门对数据保密性要求极高，访客区域的网络接入需求逐渐增多，以及对外提供特定服务器服务的需求增长，构建一个既能满足日常办公和业务运营，又能保障信息安全和资源合理分配的园区网络迫在眉睫。

为了实现这些目标，本实验来模仿中型企业网路环境，通过一系列技术要求和配置。企业内部拥有多个不同的业务部门，各部门之间的网络流量需要合理规划和隔离，以避免相互干扰和数据泄露风险。同时，随着移动办公设备的普及，无线网络的覆盖和优化也成为提升员工工作效率的关键因素。此外，为了与外部网络进行安全、可靠的通信并对外提供部分服务，如FTP 服务，以及保障内部用户对外部网络和特定内部资源（如DNS服务器）的访问，需要精心设计和配置网络的各个层面，包括交换机、路由器和防火墙等设备，以适应复杂多变的网络环境和业务需求。

二、拓扑图规划

三、实验需求

1、所有主机通过DHCP获取地址（包括DNS地址）。

2、LSW1为默认STP域的根桥。

3、LSW1为VLAN10、30、100、101的根桥。

4、LSW2为VLAN20、40、102的根桥。

5、 LSW1与LSW2之间为配置Eth-Trunk，模式为LACP。

6、LSW1为VLAN10、30、100、101的网关。

7、 LSW2为VLAN20、40、102的网关。

8、AR1、AR2、LSW1、LSW2使用OSPF。

9、配置OSPF使得内部默认从AR1访问外网。

10、防火墙外部流量访问内部时默认先走R1、SW1

11、配置AC、AP。

12、内部可以访问DMZ服务器。

13、DMZ区域FTP服务器为Internet用户提供FTP服务。

14、DMZ区域DNS服务器为内部用户提供服务。

15.FW上配置Easy IP，使内部用户可以访问外网。

16.限制其它部门访问财务部。

17.访客区只可以访问服务器以及外网。

18.设置边缘端口。

19.设置访客区不可以互相访问。

四、配置思路

4-1、创建vlan和划分vlan

4-1-1在接入层需要进行VLAN划分、设置端口类型

LSW3

[LSW3]vlan batch 10 to 11 20 30 40 100 to 102
[LSW3]int e0/0/1
[LSW3-Ethernet0/0/1]port link-type trunk
[LSW3-Ethernet0/0/1]port trunk allow-pass vlan all
[LSW3-Ethernet0/0/1]port trunk pvid vlan 100
[LSW3-Ethernet0/0/1]q
[LSW3]int e0/0/2
[LSW3-Ethernet0/0/2]port link-type trunk
[LSW3-Ethernet0/0/2]port trunk allow-pass vlan all
[LSW3-Ethernet0/0/2]port trunk pvid vlan 100
[LSW3-Ethernet0/0/2]q
[LSW3]int e0/0/3
[LSW3-Ethernet0/0/3]port link-type access
[LSW3-Ethernet0/0/3]port default vlan 10
[LSW3-Ethernet0/0/3]q
[LSW3]int e0/0/3
[LSW3-Ethernet0/0/4]port link-type access
[LSW3-Ethernet0/0/4]port default vlan 10
[LSW3-Ethernet0/0/4]q
[LSW3]int g0/0/1
[LSW3-GigabitEthernet0/0/1]port link-type trunk
[LSW3-GigabitEthernet0/0/1]port trunk allow-pass vlan all
[LSW3-GigabitEthernet0/0/1]port trunk pvid vlan 100
[LSW3-GigabitEthernet0/0/1]q
[LSW3]

LSW4

[LSW4]vlan batch 10 to 11 20 30 40 100 to 102
[LSW4]int e0/0/1
[LSW4-Ethernet0/0/1]port link-type trunk
[LSW4-Ethernet0/0/1]port trunk allow-pass vlan 20
[LSW4-Ethernet0/0/1]port trunk allow-pass vlan all
[LSW4-Ethernet0/0/1]q
[LSW4]int e0/0/2
[LSW4-Ethernet0/0/2]port link-type trunk
[LSW4-Ethernet0/0/2]port trunk allow-pass vlan all
[LSW4-Ethernet0/0/2]port trunk pvid vlan 100
[LSW4-Ethernet0/0/2]q
[LSW4]int e0/0/1
[LSW4-Ethernet0/0/1]port trunk pvid vlan 100
[LSW4-Ethernet0/0/1]q
[LSW4]int e0/0/3
[LSW4-Ethernet0/0/3]port link-type access
[LSW4-Ethernet0/0/3]port default vlan 20
[LSW4-Ethernet0/0/3]q
[LSW4]int e0/0/4
[LSW4-Ethernet0/0/4]port link-type access
[LSW4-Ethernet0/0/4]port default vlan 20
[LSW4-Ethernet0/0/4]q

LSW5

[LSW5]vlan batch 10 to 11 20 30 40 100 to 102
[LSW5]int e0/0/1
[LSW5-Ethernet0/0/1]port link-type trunk
[LSW5-Ethernet0/0/1]port trunk allow-pass vlan all
[LSW5-Ethernet0/0/1]port trunk pvid vlan 100
[LSW5-Ethernet0/0/1]q
[LSW5]int e0/0/2
[LSW5-Ethernet0/0/2]port link-type trunk
[LSW5-Ethernet0/0/2]port trunk allow-pass vlan all
[LSW5-Ethernet0/0/2]port trunk pvid vlan 100
[LSW5-Ethernet0/0/2]q
[LSW5]int e0/0/3
[LSW5-Ethernet0/0/3]port link-type access
[LSW5-Ethernet0/0/3]port default vlan 30
[LSW5-Ethernet0/0/3]q
[LSW5]int e0/0/4
[LSW5-Ethernet0/0/4]port link-type access
[LSW5-Ethernet0/0/4]port default vlan 30
[LSW5-Ethernet0/0/4]q

LSW6

[LSW6][LSW5]vlan batch 10 to 11 20 30 40 100 to 102
[LSW6]int e0/0/1
[LSW6-Ethernet0/0/1]port link-type trunk 
[LSW6-Ethernet0/0/1]port trunk allow-pass vlan all
[LSW6-Ethernet0/0/1]port trunk pvid vlan 100
[LSW6-Ethernet0/0/1]q
[LSW6]int e0/0/2
[LSW6-Ethernet0/0/2]port link-type trunk
[LSW6-Ethernet0/0/2]port trunk allow-pass vlan all
[LSW6-Ethernet0/0/2]port trunk pvid vlan 100
[LSW6-Ethernet0/0/2]q
[LSW6]int e0/0/3
[LSW6-Ethernet0/0/3]port link-type access
[LSW6-Ethernet0/0/3]port default vlan 40
[LSW6-Ethernet0/0/3]q
[LSW6]int e0/0/4
[LSW6-Ethernet0/0/4]port link-type access
[LSW6-Ethernet0/0/4]port default vlan 40
[LSW6-Ethernet0/0/4]q
[LSW6]int g0/0/1
[LSW6-GigabitEthernet0/0/1]port link-type trunk
[LSW6-GigabitEthernet0/0/1]port trunk allow-pass vlan all
[LSW6-GigabitEthernet0/0/1]port trunk pvid vlan 100
[LSW6-GigabitEthernet0/0/1]q

4-1-2在接入层需要进行VLAN划分、设置端口类型。

LSW1

[LSW1]vlan batch 10 20 30 40 11 31 32 100 101 102
[LSW1]int g0/0/1
[LSW1-GigabitEthernet0/0/1]port link-type trunk
[LSW1-GigabitEthernet0/0/1]port trunk allow-pass vlan all
[LSW1-GigabitEthernet0/0/1]port trunk pvid vlan 100
[LSW1-GigabitEthernet0/0/1]q
[LSW1]int g0/0/2
[LSW1-GigabitEthernet0/0/2]port link-type trunk
[LSW1-GigabitEthernet0/0/2]port trunk allow-pass vlan all
[LSW1-GigabitEthernet0/0/2]port trunk pvid vlan 100
[LSW1-GigabitEthernet0/0/2]q
[LSW1]int g0/0/3
[LSW1-GigabitEthernet0/0/3]port link-type trunk
[LSW1-GigabitEthernet0/0/3]port trunk allow-pass vlan all
[LSW1-GigabitEthernet0/0/3]port trunk pvid vlan 100
[LSW1-GigabitEthernet0/0/3]q
[LSW1]int g0/0/4
[LSW1-GigabitEthernet0/0/4]port link-type trunk
[LSW1-GigabitEthernet0/0/4]port trunk allow-pass vlan all
[LSW1-GigabitEthernet0/0/4]port trunk pvid vlan 100
[LSW1-GigabitEthernet0/0/4]q
[LSW1]int g0/0/11
[LSW1-GigabitEthernet0/0/11]port link-type access
[LSW1-GigabitEthernet0/0/11]port default vlan 11
[LSW1-GigabitEthernet0/0/11]q
[LSW1]int g0/0/12
[LSW1-GigabitEthernet0/0/12]port link-type access
[LSW1-GigabitEthernet0/0/12]port default vlan 31
[LSW1-GigabitEthernet0/0/12]q
[LSW1]int g0/0/13
[LSW1-GigabitEthernet0/0/13]port link-type access
[LSW1-GigabitEthernet0/0/13]port default vlan 32
[LSW1-GigabitEthernet0/0/13]q

LSW2

[LSW2]vlan batch 10 20 30 40 34 33 22 100 101 102
[LSW2]int g0/0/1
[LSW2-GigabitEthernet0/0/1]port link-type trunk
[LSW2-GigabitEthernet0/0/1]port trunk allow-pass vlan all
[LSW2-GigabitEthernet0/0/1]port trunk pvid vlan 100
[LSW2-GigabitEthernet0/0/1]q
[LSW2]int g0/0/2
[LSW2-GigabitEthernet0/0/2]port link-type trunk
[LSW2-GigabitEthernet0/0/2]port trunk allow-pass vlan all
[LSW2-GigabitEthernet0/0/2]port trunk pvid vlan 100
[LSW2-GigabitEthernet0/0/2]q
[LSW2]int g0/0/3
[LSW2-GigabitEthernet0/0/3]port link-type trunk
[LSW2-GigabitEthernet0/0/3]port trunk allow-pass vlan all
[LSW2-GigabitEthernet0/0/3]port trunk pvid vlan 100
[LSW2-GigabitEthernet0/0/3]q
[LSW2]int g0/0/4
[LSW2-GigabitEthernet0/0/4]port link-type trunk
[LSW2-GigabitEthernet0/0/4]port trunk allow-pass vlan all
[LSW2-GigabitEthernet0/0/4]port trunk pvid vlan 100
[LSW2-GigabitEthernet0/0/4]q
[LSW2]int g0/0/12
[LSW2-GigabitEthernet0/0/12]port link-type access
[LSW2-GigabitEthernet0/0/12]port default vlan 34
[LSW2-GigabitEthernet0/0/12]q
[LSW2]int g0/0/13
[LSW2-GigabitEthernet0/0/13]port link-type access
[LSW2-GigabitEthernet0/0/13]port default vlan 33
[LSW2-GigabitEthernet0/0/13]q
[LSW2]int g0/0/22
[LSW2-GigabitEthernet0/0/22]port link-type access
[LSW2-GigabitEthernet0/0/22]port default vlan 22
[LSW2-GigabitEthernet0/0/22]q
[LSW2]

AC

[AC1]vlan batch 22
[AC1]int g0/0/2
[AC1-GigabitEthernet0/0/2]port link-type access
[AC1-GigabitEthernet0/0/2]port default vlan 22
[AC1-GigabitEthernet0/0/2]q
[AC1]q

4-2、配置各个设备的IP地址

LSW1

LSW2

AR1

AR2

AR3

DHCP-Server

[DHCP]int g0/0/1

[DHCP-GigabitEthernet0/0/1]ip add 192.168.11.11 24

AC1

[AC1]int vlanif 22

[AC1-Vlanif22]ip add 192.168.22.22 24

FW

4-3、配置静态路由

#

[FW]ip route-static 0.0.0.0 0.0.0.0 202.1.1.2
[FW]ip route-static 192.168.0.0 255.255.192.0 10.1.1.1 preference 10
[FW]ip route-static 192.168.0.0 255.255.192.0 10.2.2.1
[FW]ip route-static 192.168.100.0 255.255.252.0 10.1.1.1 preference 10
[FW]ip route-static 192.168.100.0 255.255.252.0 10.2.2.1
[FW]q
#

AR1
[AR1]ip route-ststic 0.0.0.0 0.0.0.0 10.1.1.2

#
AR2
[AR2]ip route-ststic 0.0.0.0 0.0.0.0 10.2.2.2

#
LSW3-LSW6
[LSW3]ip route-static 0.0.0.0 0.0.0.0 192.168.100.254
[LSW4]ip route-static 0.0.0.0 0.0.0.0 192.168.100.254
[LSW5]ip route-static 0.0.0.0 0.0.0.0 192.168.100.254
[LSW6]ip route-static 0.0.0.0 0.0.0.0 192.168.100.254

#
DHCP
[DHCP]ip route-static 0.0.0.0 0.0.0.0 192.168.11.254


#
AC
[AC1]ip route-static 0.0.0.0 0.0.0.0 192.168.22.254


#

4-4、在LAW1-LSW2配置链路聚合，模式为LACP

LSW1

[LSW1]int eth-trunk 1
[LSW1-Eth-Trunk1]mode lacp-static 	
[LSW1-Eth-Trunk1]trunkport GigabitEthernet 0/0/10 0/0/20
[LSW1-Eth-Trunk1]port link-type trunk
[LSW1-Eth-Trunk1]port trunk allow-pass vlan all
[LSW1-Eth-Trunk1]port trunk pvid vlan 100
[LSW1-Eth-Trunk1]q
[LSW1]lacp priority 4096
[LSW1]int eth-trunk 1	
[LSW1-Eth-Trunk1]lacp preempt enable
[LSW1-Eth-Trunk1]q

查看链路聚合

LSW2

#


[LSW2]int eth-trunk 1
[LSW2-Eth-Trunk1]mode lacp-st	
[LSW2-Eth-Trunk1]mode lacp-static 
[LSW2-Eth-Trunk1]trunkport g	
[LSW2-Eth-Trunk1]trunkport GigabitEthernet 0/0/10 0/0/20
Info: This operation may take a few seconds. Please wait for a moment...done.
[LSW2-Eth-Trunk1]port link-type trunk
[LSW2-Eth-Trunk1]port trunk allow-pass vlan all
[LSW2-Eth-Trunk1]port trunk pvid vlan 100
[LSW2-Eth-Trunk1]q



#

4-5、在DHCP_Server上配置DHCP

#
[DHCP]dhcp enable
[DHCP]int g0/0/1
[DHCP-GigabitEthernet0/0/1]dhcp select global 
[DHCP-GigabitEthernet0/0/1]q
[DHCP]ip pool vlan10
[DHCP-ip-pool-vlan10]gateway-list 192.168.10.254
[DHCP-ip-pool-vlan10]network 192.168.10.0 mask 255.255.255.0
[DHCP-ip-pool-vlan10]excluded-ip-address 192.168.10.246 192.168.10.253
[DHCP-ip-pool-vlan10]dns-list 172.16.1.200
[DHCP-ip-pool-vlan10]q
[DHCP]ip pool vlan20
[DHCP-ip-pool-vlan20]gateway-list 192.168.20.254
[DHCP-ip-pool-vlan20]network 192.168.20.0 mask 255.255.255.0
[DHCP-ip-pool-vlan20]excluded-ip-address 192.168.20.246 192.168.20.253
[DHCP-ip-pool-vlan20]dns-list 172.16.1.200
[DHCP-ip-pool-vlan20]q
[DHCP]ip pool vlan30
[DHCP-ip-pool-vlan30]gateway-list 192.168.30.254
[DHCP-ip-pool-vlan30]network 192.168.30.0 mask 255.255.255.0
[DHCP-ip-pool-vlan30]excluded-ip-address 192.168.30.246 192.168.30.253
[DHCP-ip-pool-vlan30]dns-list 172.16.1.200
[DHCP-ip-pool-vlan30]q
[DHCP]ip pool vlan40
[DHCP-ip-pool-vlan40]gateway-list 192.168.40.254
[DHCP-ip-pool-vlan40]network 192.168.40.0 mask 255.255.255.0
[DHCP-ip-pool-vlan40]excluded-ip-address 192.168.40.246 192.168.40.253
[DHCP-ip-pool-vlan40]dns-list 172.16.1.200
[DHCP-ip-pool-vlan40]q
[DHCP]ip pool vlan100
[DHCP-ip-pool-vlan100]gateway-list 192.168.100.254
[DHCP-ip-pool-vlan100]network 192.168.100.0 mask 255.255.255.0
[DHCP-ip-pool-vlan100]excluded-ip-address 192.168.100.1 192.168.100.10
[DHCP-ip-pool-vlan100]excluded-ip-address 192.168.100.246 192.168.100.253
[DHCP-ip-pool-vlan100]dns-list 172.16.1.200
[DHCP-ip-pool-vlan100]Option 43 sub-option 3 ascii 192.168.22.22
[DHCP-ip-pool-vlan100]q
[DHCP]ip pool vlan101
[DHCP-ip-pool-vlan101]gateway-list 192.168.101.254
[DHCP-ip-pool-vlan101]network 192.168.101.0 mask 255.255.255.0
[DHCP-ip-pool-vlan101]excluded-ip-address 192.168.101.246 192.168.101.253
[DHCP-ip-pool-vlan101]Lease day 0 hour 3 minute 0
[DHCP-ip-pool-vlan101]dns-list 172.16.1.200
[DHCP-ip-pool-vlan101]q
[DHCP]ip pool vlan102
[DHCP-ip-pool-vlan102]gateway-list 192.168.102.254
[DHCP-ip-pool-vlan102]network 192.168.102.0 mask 255.255.255.0
[DHCP-ip-pool-vlan102]excluded-ip-address 192.168.102.246 192.168.102.253
[DHCP-ip-pool-vlan102]Lease day 0 hour 3 minute 0
[DHCP-ip-pool-vlan102]q

#

4-6、DHCP中继器

需要在LSW1和LSW2上的vlanif 10 20 30 40 100 101 102

注：LSW1和LSW2一样的配置，在这里LSW2略

#

[LSW1]dhcp enable
[LSW1]int vlanif 10
[LSW1-Vlanif10]dhcp select relay 
[LSW1-Vlanif10]dhcp relay server-ip 192.168.11.11 
[LSW1-Vlanif10]q
[LSW1]int vlanif 20
[LSW1-Vlanif20]dhcp select relay
[LSW1-Vlanif20]dhcp relay server-ip 192.168.11.11
[LSW1-Vlanif20]q
[LSW1]int vlanif 30
[LSW1-Vlanif30]dhcp select relay
[LSW1-Vlanif30]dhcp relay server-ip 192.168.11.11
[LSW1-Vlanif30]q
[LSW1]int vlanif 40
[LSW1-Vlanif40]dhcp select relay
[LSW1-Vlanif40]dhcp relay server-ip 192.168.11.11
[LSW1-Vlanif40]q
[LSW1]int vlanif 100
[LSW1-Vlanif100]dhcp select relay
[LSW1-Vlanif100]dhcp relay server-ip 192.168.11.11
[LSW1-Vlanif100]q
[LSW1]int vlanif 101
[LSW1-Vlanif101]dhcp select relay
[LSW1-Vlanif101]dhcp relay server-ip 192.168.11.11
[LSW1-Vlanif101]q
[LSW1]int vlanif 102
[LSW1-Vlanif102]dhcp select relay
[LSW1-Vlanif102]dhcp relay server-ip 192.168.11.11
[LSW1-Vlanif102]q
[LSW1]q

#

4-7、配置STP

LSW1

#

[LSW1]stp enable
[LSW1]stp mode mstp
[LSW1]stp instance 1 priority 4096
[LSW1]stp instance 2 priority 8192
[LSW1]stp instance 3 priority 4096
[LSW1]stp instance 4 priority 8192
[LSW1]stp instance 10 priority 4096
[LSW1]stp instance 11 priority 4096
[LSW1]stp instance 12 priority 8192
[LSW1]stp instance 0 root primary
[LSW1]stp region-configuration 
[LSW1-mst-region]region-name huawei
[LSW1-mst-region]instance 1 vlan 10
[LSW1-mst-region]instance 2 vlan 20
[LSW1-mst-region]instance 3 vlan 30
[LSW1-mst-region]instance 4 vlan 40
[LSW1-mst-region]instance 10 vlan 100
[LSW1-mst-region]instance 11 vlan 101
[LSW1-mst-region]instance 12 vlan 102
[LSW1-mst-region]active region-configuration
[LSW1-mst-region]q

#

LSW2

[LSW2]stp enable
[LSW2]stp mode mstp
[LSW2]stp instance 1 priority 8192
[LSW2]stp instance 2 priority 4096
[LSW2]stp instance 3 priority 8192
[LSW2]stp instance 4 priority 4096
[LSW2]stp instance 10 priority 8192
[LSW2]stp instance 11 priority 8192
[LSW2]stp instance 12 priority 4096
[LSW2]stp instance 0 root secondary
[LSW2]stp region-configuration 
[LSW2-mst-region]region-name huawei
[LSW2-mst-region]instance 1 vlan 10
[LSW2-mst-region]instance 2 vlan 20
[LSW2-mst-region]instance 3 vlan 30
[LSW2-mst-region]instance 4 vlan 40
[LSW2-mst-region]instance 10 vlan 100
[LSW2-mst-region]instance 11 vlan 101
[LSW2-mst-region]instance 12 vlan 102
[LSW2-mst-region]active region-configuration
[LSW2-mst-region]q
[LSW2]

4-8、配置VRRP

LSW1作为vlan 10 30 100 101 的主网关，LSW2作为vlan20 40 102的主网关

LSW1

#

[LSW1]int vlanif 10
[LSW1-Vlanif10]vrrp vrid 10 virtual-ip 192.168.10.254
[LSW1-Vlanif10]vrrp vrid 10 priority 120
[LSW1-Vlanif10]vrrp vrid 10 preempt-mode timer delay 20
[LSW1-Vlanif10]q
[LSW1]int vlanif 20
[LSW1-Vlanif20]vrrp vrid 20 virtual-ip 192.168.20.254 
[LSW1]int vlanif 30
[LSW1-Vlanif30]vrrp vrid 30 virtual-ip 192.168.30.254
[LSW1-Vlanif30]vrrp vrid 30 priority 140
[LSW1-Vlanif30]q
[LSW1]int vlan40 
[LSW1-Vlanif40]vrrp vrid 40 virtual-ip 192.168.40.254
[LSW1-Vlanif40]q
[LSW1]int vlanif 100
[LSW1-Vlanif100]vrrp vrid 100 virtual-ip 192.168.100.254
[LSW1-Vlanif100]vrrp vrid 100 priority  160
[LSW1-Vlanif100]q
[LSW1]int vlanif 101
[LSW1-Vlanif101]vrrp vrid 101 virtual-ip 192.168.101.254
[LSW1-Vlanif101]vrrp vrid 101 priority 170
[LSW1-Vlanif101]q
[LSW1]int vlanif 102
[LSW1-Vlanif102]vrrp vrid 102 virtual-ip 192.168.102.254
[LSW1-Vlanif102]q


#

LSW2


#

[LSW2]int vlanif 10
[LSW2-Vlanif10]vrrp vrid 10 virtual-ip 192.168.10.254
[LSW2-Vlanif10]q
[LSW2]int vlanif 20
[LSW2-Vlanif20]vrrp vrid 20 virtual-ip 192.168.20.254
[LSW2-Vlanif20]vrrp vrid 20 priority 130
[LSW2-Vlanif20]q
[LSW2]int vlanif 30
[LSW2-Vlanif30]vrrp vrid 30 virtual-ip 192.168.30.254
[LSW2-Vlanif30]q
[LSW2]int vlanif 40
[LSW2-Vlanif40]vrrp vrid 40 virtual-ip 192.168.40.254
[LSW2-Vlanif40]vrrp vrid 40 priority 150
[LSW2-Vlanif40]q
[LSW2]int vlanif 100	
[LSW2-Vlanif100]vrrp vrid 100 virtual-ip 192.168.100.254
[LSW2-Vlanif100]q
[LSW2]int vlanif 101
[LSW2-Vlanif101]vrrp vrid 101 virtual-ip 192.168.101.254
[LSW2-Vlanif101]q
[LSW2]int vlanif 102
[LSW2-Vlanif102]vrrp vrid 102 virtual-ip 192.168.102.254
[LSW2-Vlanif102]vrrp vrid 102 priority 180
[LSW2-Vlanif102]q


#

4-9、配置OSPF

LSW1、LSW2、AR1、AR2都要配置

#

[LSW1]ospf 10 router-id 3.3.3.3
[LSW1-ospf-10]area 0
[LSW1-ospf-10-area-0.0.0.0]network 10.11.11.0 0.0.0.3
[LSW1-ospf-10-area-0.0.0.0]network 10.12.12.0 0.0.0.3
[LSW1-ospf-10-area-0.0.0.0]network 3.3.3.3 0.0.0.0 
[LSW1-ospf-10-area-0.0.0.0]area 0.0.0.10
[LSW1-ospf-10-area-0.0.0.10]network 192.168.10.0 0.0.0.255
[LSW1-ospf-10-area-0.0.0.10]area 0.0.0.11
[LSW1-ospf-10-area-0.0.0.11]network 192.168.11.0 0.0.0.255
[LSW1-ospf-10-area-0.0.0.11]area 0.0.0.20
[LSW1-ospf-10-area-0.0.0.20]network 192.168.20.0 0.0.0.255
[LSW1-ospf-10-area-0.0.0.20]area 0.0.0.30
[LSW1-ospf-10-area-0.0.0.30]network 192.168.30.0 0.0.0.255
[LSW1-ospf-10-area-0.0.0.30]area 0.0.0.40
[LSW1-ospf-10-area-0.0.0.40]network 192.168.40.0 0.0.0.255
[LSW1-ospf-10-area-0.0.0.40]area 0.0.0.100
[LSW1-ospf-10-area-0.0.0.100]network 192.168.100.0 0.0.0.255
[LSW1-ospf-10-area-0.0.0.100]area 0.0.0.101
[LSW1-ospf-10-area-0.0.0.101]network 192.168.101.0 0.0.0.255
[LSW1-ospf-10-area-0.0.0.101]area 0.0.0.102
[LSW1-ospf-10-area-0.0.0.102]network 192.168.102.0 0.0.0.255
[LSW1-ospf-10-area-0.0.0.102]q
[LSW1-ospf-10]q


#


LSW2
[LSW2]ospf 10 router-id 4.4.4.4
[LSW2-ospf-10]area 0
[LSW2-ospf-10-area-0.0.0.0]network 10.21.21.0 0.0.0.3
[LSW2-ospf-10-area-0.0.0.0]network 10.22.22.0 0.0.0.3
[LSW2-ospf-10-area-0.0.0.0]  network 4.4.4.4 0.0.0.0
[LSW2-ospf-10-area-0.0.0.0] area 0.0.0.10
[LSW2-ospf-10-area-0.0.0.10]  network 192.168.10.0 0.0.0.255
[LSW2-ospf-10-area-0.0.0.10] area 0.0.0.20
[LSW2-ospf-10-area-0.0.0.20]  network 192.168.20.0 0.0.0.255
[LSW2-ospf-10-area-0.0.0.20] area 0.0.0.22
[LSW2-ospf-10-area-0.0.0.22]  network 192.168.22.0 0.0.0.255
[LSW2-ospf-10-area-0.0.0.22] area 0.0.0.30
[LSW2-ospf-10-area-0.0.0.30]  network 192.168.30.0 0.0.0.255
[LSW2-ospf-10-area-0.0.0.30] area 0.0.0.40
[LSW2-ospf-10-area-0.0.0.40]  network 192.168.40.0 0.0.0.255
[LSW2-ospf-10-area-0.0.0.40] area 0.0.0.100
[LSW2-ospf-10-area-0.0.0.100]  network 192.168.100.0 0.0.0.255
[LSW2-ospf-10-area-0.0.0.100] area 0.0.0.101
[LSW2-ospf-10-area-0.0.0.101]  network 192.168.101.0 0.0.0.255
[LSW2-ospf-10-area-0.0.0.101] area 0.0.0.102
[LSW2-ospf-10-area-0.0.0.102] network 192.168.102.0 0.0.0.255
[LSW2-ospf-10-area-0.0.0.102]

#


AR1
[AR1]ospf 10 router-id 1.1.1.1   
[AR1-ospf-10]default-route-advertise  #下发一条缺省路由到普通ospf
[AR1-ospf-10]area 0
[AR1-ospf-10-area-0.0.0.0]network 1.1.1.1 0.0.0.0
[AR1-ospf-10-area-0.0.0.0]network 10.11.11.0 0.0.0.3
[AR1-ospf-10-area-0.0.0.0]network 10.21.21.0 0.0.0.3
[AR1-ospf-10-area-0.0.0.0]q
[AR1-ospf-10]q

#


AR2
[AR2]ospf 10 router-id 2.2.2.2
[AR2-ospf-10]default-route-advertise cost 5
[AR2-ospf-10]area 0
[AR2-ospf-10-area-0.0.0.0]network 2.2.2.2 0.0.0.0
[AR2-ospf-10-area-0.0.0.0]network 10.12.12.0 0.0.0.3
[AR2-ospf-10-area-0.0.0.0]network 10.22.22.0 0.0.0.3
[AR2-ospf-10-area-0.0.0.0]q
[AR2-ospf-10]q

4-10 配置AC

先查看AP1、AP2的地址获取情况

AP1

AP2

配置AC


#

[AC]vlan pool vlan101
[AC-ip-pool-vlan101]vlan 101
[AC-ip-pool-vlan101]vlan pool vlan102
[AC-ip-pool-vlan102]vlan 102

#

[AC]capwap source int vlanif 22    #配置信令源

#

创建域管理模板
#

[AC]wlan
[AC-wlan-view]regulatory-domain-profile name cfig
[AC-wlan-regulate-domain-cfig]country-code CN      #配置国家代码
[AC-wlan-regulate-domain-cfig]q
[AC-wlan-view]ap-group name bg
[AC-wlan-ap-group-bg]regulatory-domain-profile cfig
[AC-wlan-ap-group-bg]ap-group name guest
[AC-wlan-ap-group-guest]regulatory-domain-profile cfig
[AC-wlan-ap-group-guest]q
[AC-wlan-view]q
[AC]

#

配置AP上线

#

[AC]WLAN
[AC-wlan-view]ap auth-mode mac-auth
[AC1-wlan-view]ap-id 1 ap-mac 00e0-fca1-3f10       #这里的mac地址要在AP上查看
[AC-wlan-ap-1]ap-name GUEST
[AC-wlan-ap-1]ap-group guest
[AC-wlan-ap-1]ap-id 2 ap-mac 00e0-fc60-5700
[AC-wlan-ap-2]
[AC-wlan-ap-2]ap-name BanGong
[AC-wlan-ap-2]ap-group bg
[AC-wlan-ap-2]

#

配置VLAN业务参数
#
创建安全模板
[AC]wlan
[AC-wlan-view]security-profile name bg      #创建密码文件，用于办公区域
[AC-wlan-sec-prof-bg]security wpa2 psk pass-phrase 12345678 aes     #wifi密码为：12345678
[AC-wlan-sec-prof-bg]security-profile name guest     #创建密码文件，用于访客区
[AC-wlan-sec-prof-guest]security wpa2 psk pass-phrase 12345678 aes  #wifi密码为：12345678
[AC-wlan-sec-prof-guest]q
[AC-wlan-view]q

#

创建SSID模板
#

[AC]wlan
[AC-wlan-view]ssid-profile name bg     #创建wifi名称文件
[AC-wlan-ssid-prof-bg]ssid BanGong      #办公区域wifi名称为BanGong
[AC-wlan-ssid-prof-bg]ssid-profile name guest
[AC-wlan-ssid-prof-guest]ssid guest
[AC-wlan-ssid-prof-guest]

#

创建VPA模板
#

[AC]wlan
[AC-wlan-view]vap-profile name bg
[AC-wlan-vap-prof-bg]forward-mode tunnel
[AC-wlan-vap-prof-bg]service-vlan vlan-id 102
[AC-wlan-vap-prof-bg]ssid-profile bg
[AC-wlan-vap-prof-bg]security-profile bg
[AC-wlan-vap-prof-bg]vap-profile name guest
[AC-wlan-vap-prof-guest]forward-mode tunnel
[AC-wlan-vap-prof-guest]service-vlan vlan-id 101
[AC-wlan-vap-prof-guest]ssid-profile guest
[AC-wlan-vap-prof-guest]security-profile guest
[AC-wlan-vap-prof-guest]q
[AC-wlan-view]q
[AC]


#

调用VAP模板

#

[AC]wlan
[AC-wlan-view]ap-group name bg
[AC-wlan-ap-group-bg]vap-profile bg wlan 1 radio 0    #配置P的组“bg”中的设备发射wifi信号
[AC-wlan-ap-group-bg]vap-profile bg wlan 1 radio 1
[AC-wlan-ap-group-bg]q
[AC-wlan-view]ap-group name guest
[AC-wlan-ap-group-guest]vap-profile bg wlan 1 radio 0 #配置P的组“guest”中的设备发射wifi信号
[AC-wlan-ap-group-guest]vap-profile bg wlan 1 radio 1
[AC-wlan-ap-group-guest]

4-11、测试，无线设备连接WLAN 和获取IP

这里只演示STA1

4-12、配置防火墙

将接口加入对应的安全区域

#
[FW]firewall zone trust
[FW-zone-trust]add int g1/0/1
[FW-zone-trust]add int g1/0/2
[FW-zone-trust]q
[FW]firewall zone untrust
[FW-zone-untrust]add int g1/0/6
[FW-zone-untrust]q
[FW]firewall zone dmz
[FW-zone-dmz]add int g1/0/0
[FW-zone-dmz]q
[FW]quit

#

配置NAT Server，使内部FTP为Internet用户提供FTP http服务：

#
FTP服务器公网地址为202.1.1.4，且外网用户必须使用2121端口才能访问企业内部服务器，不进行反向NAT。
#
[FW] nat server ut->d-ftp protocol tcp global 202.1.1.4 2121 inside 172.16.1.100 ftp no-reverse

#

配置安全策略

#

[FW]security-policy                     #进入nat策略视图
[FW-policy-security]rule name t->d          #允许trust区域流量到DMZ区域                                                     
[FW-policy-security-rule-t->d]source-zone trust       	#源区域
[FW-policy-security-rule-t->d]destination-zone dmz       #目的区域
[FW-policy-security-rule-t->d]action permit            #执行动作允许
[FW-policy-security-rule-t->d]q
[FW-policy-security]rule name t->ut            #允许trust区域流量到untrust区域
[FW-policy-security-rule-t->ut]source-zone trust
[FW-policy-security-rule-t->ut]destination-zone untrust
[FW-policy-security-rule-t->ut]action permit
[FW-policy-security-rule-t->ut]rule name ut-d      #允许trust区域流量到dmz区域
[FW-policy-security-rule-ut-d]source-zone untrust
[FW-policy-security-rule-ut-d]destination-zone dmz
[FW-policy-security-rule-ut-d]destination-address 172.16.1.0 mask 255.255.255.0    #源IP为172.16.1.0/24
[FW-policy-security-rule-ut-d]service ftp
[FW-policy-security-rule-ut-d]service http
[FW-policy-security-rule-ut-d]action permit
[FW-policy-security-rule-ut-d]q
[FW-policy-security]q
[FW]q

#

配置easy-IP使得内部用户可以访问外网

#

[FW]nat-policy
[FW-policy-nat]rule name t->ut
[FW-policy-nat-rule-t->ut]source-zone trust
[FW-policy-nat-rule-t->ut]destination-zone untrust
[FW-policy-nat-rule-t->ut]action source-nat easy-ip
[FW-policy-nat-rule-t->ut]q
[FW-policy-nat]q
[FW-policy-security]rule name d->ut
[FW-policy-security-rule-t->ut]source-zone dmz
[FW-policy-security-rule-t->ut]destination-zone untrust
[FW-policy-security-rule-t->ut]action source-nat easy-ip
[FW-policy-security-rule-t->ut]q
[FW-policy-security]q

#

4-13、查看全部PC是否获取IP，每台PC都可以访问得到外网，就是内网可以访问外网

PC1

PC2

其他PC都获取到IP和都可以访问外网和DMZ区域。

外网用户访问内部服务器

开启FTP服务

4-14、端口安全

限制其它部门访问财务部。


#

[LSW4]acl 3000
[LSW4-acl-adv-3001]rule 5 deny ip source 192.168.20.0 0.0.0.255 destination 192.168.10.0 0.0.0.255        #禁止财务部访问办公区
[LSW4-acl-adv-3000]rule 10 deny  ip source 192.168.20.0 0.0.0.255 destination 192.168.30.0 0.0.0.255      #禁止财务部访问人事部
[LSW4-acl-adv-3000]rule 15 deny  ip source 192.168.40.0 0.0.0.255 
[LSW4-acl-adv-3000]destination 192.168.40.0 0.0.0.255  #禁止财务部访问访客区
[LSW4-acl-adv-3000]q
[LSW4]int vlanif 40
[LSW4-Vlanif20]traffic-filter vlan 20 inbound acl 3000

#

测试：PC2是不可以访问其它部门的

访客区只可以访问服务器以及外网。

#

[LSW6]acl 3001
[LSW6-acl-adv-3001]rule 5 permit ip source 192.168.40.0 0.0.0.255 destination 172.16.1.0 0.0.0.255
[LSW6-acl-adv-3001]rule 10 permit ip source 192.168.40.0 0.0.0.255 destination 20.20.20.0 0.0.0.255
[LSW6-acl-adv-3001]rule 15 deny ip source 192.1680.0 0.0.0.255 destination 192.168.10.0 0.0.0.255
[LSW6-acl-adv-3001]rule  deny ip source 192.168.40.0 0.0.0.255 destination 192.168.20.0 0.0.0.255
[LSW6-acl-adv-3001]rule 25 deny ip source 192.168.40.0 0.0.0.255 destination 192.168.30.0 0.0.0.255
[LSW6-acl-adv-3001]q
[LSW6]int vlanif 40
[LSW6-Vlanif40]traffic-filter vlan 40 inbound acl 3001


#

测试：访客区只可以访问外网和DMZ区的，不可可以访问其它部门的

4-15、LSW3-LSW6设置边缘端口

#

[LSW3]int e0/0/3
[LSW3-Ethernet0/0/3]stp edged-port enable
[LSW3-Ethernet0/0/3]q
[LSW3]int e0/0/4
[LSW3-Ethernet0/0/4]stp edged-port enable
[LSW3-Ethernet0/0/4]q
[LSW3]q

#
[LSW4]int e0/0/3
[LSW4-Ethernet0/0/3]stp edged-port enable
[LSW4-Ethernet0/0/3]q
[LSW4]int e0/0/4
[LSW4-Ethernet0/0/4]stp edged-port enable
[LSW4-Ethernet0/0/4]q
[LSW4]q

#
[LSW5]int e0/0/3
[LSW5-Ethernet0/0/3]stp edged-port enable
[LSW5-Ethernet0/0/3]q
[LSW5]int e0/0/4
[LSW5-Ethernet0/0/4]stp edged-port enable
[LSW5-Ethernet0/0/4]q
[LSW5]q


#
[LSW6]int e0/0/3
[LSW6-Ethernet0/0/3]stp edged-port enable
[LSW6-Ethernet0/0/3]q
[LSW6]int e0/0/4
[LSW6-Ethernet0/0/4]stp edged-port enable
[LSW6-Ethernet0/0/4]q
[LSW6]q

4-16、端口隔离

在访客区做端口隔离

[LSW6]int e0/0/3
[LSW6-Ethernet0/0/3]port-isolate enable group 1
[LSW6]int e0/0/4
[LSW6-Ethernet0/0/4]port-isolate enable group 1

测试：访客区之间不同通信的

以上就是本实验的大致情况，

非常感谢各位读者们阅读。

查看全文

http://www.kler.cn/a/470195.html

计算机网络：网络层知识点及习题（一）

huggingface 下载方法测试ok

在线机考|2024华为实习秋招春招编程题（最新）——第3题_个性化歌单推荐系统_300分（十一）

解决ESP32 wifi scan：1. 获取WIFI扫描列表个数为0 的问题 2.扫描WIFI列表时导致程序崩溃问题。

Linux中rsync命令使用

练习（继承）

解决电脑开机PcaSvc.dll出错丢失条目：PcaWallpaperAppDetect最新方法

物联网：七天构建一个闭环的物联网DEMO

【Golang 面试题】每日 3 题（二十）

Java基础注解

C#版OpenCv常用函数大全

手写RPC笔记

Redis（三）单线程架构介绍

QT：控件属性及常用控件(2)-----按钮类控件及显示类控件

Rtemis解题过程

基于人脸识别和 MySQL 的考勤管理系统实现

庐山派K230学习日记5 UART

LabVIEW软件侵权分析与应对

element组件el-select、el-tree-select有值，不渲染lable

GitLab创建用户，设置访问SSH Key

数造科技荣获 2024 年“年度数据资源创新开发企业”

软件体系结构与设计模式

解决GitHub上的README.md文件的图片内容不能正常显示问题

Springboot启动报错：Failed to start bean ‘documentationPluginsBootstrapper‘

软件项目体系建设文档，项目开发实施运维，审计，安全体系建设，验收交付，售前资料（word原件）

一、实验背景

二、拓扑图规划

三、实验需求

四、配置思路

4-1、创建vlan和划分vlan

4-1-1在接入层需要进行VLAN划分、设置端口类型

LSW3

LSW4

LSW5

LSW6

4-1-2在接入层需要进行VLAN划分、设置端口类型 。

LSW1

LSW2

AC

4-2、配置各个设备的IP地址

LSW1

LSW2

AR1

AR2

AR3

DHCP-Server

AC1

FW

4-3、配置静态路由

4-4、在LAW1-LSW2配置链路聚合，模式为LACP

LSW1

LSW2

4-5、在DHCP_Server上配置DHCP

4-6、DHCP中继器

4-7、配置STP

LSW1

LSW2

4-8、配置VRRP

LSW1

LSW2

4-9、配置OSPF

4-10 配置AC

先查看AP1、AP2的地址获取情况

AP1

AP2

配置AC

4-11、测试，无线设备连接WLAN 和获取IP

4-12、配置防火墙

将接口加入对应的安全区域

配置NAT Server，使内部FTP为Internet用户提供FTP http服务：

配置安全策略

配置easy-IP使得内部用户可以访问外网

4-13、查看全部PC是否获取IP，每台PC都可以访问得到外网，就是内网可以访问外网

外网用户访问内部服务器

4-14、端口安全

限制其它部门访问财务部。

测试：PC2是不可以访问其它部门的

访客区只可以访问服务器以及外网。

测试：访客区只可以访问外网和DMZ区的，不可可以访问其它部门的

4-15、LSW3-LSW6设置边缘端口

4-16、端口隔离

在访客区做端口隔离

测试：访客区之间不同通信的

相关文章：

4-1-2在接入层需要进行VLAN划分、设置端口类型。