H3CNE综合实验

Posted 养一只金毛呗

tags:

篇首语:本文由小常识网(cha138.com)小编为大家整理,主要介绍了H3CNE综合实验相关的知识,希望对你有一定的参考价值。

H3CNE综合实验

实验拓扑

实验要求

  1. 按图示配置IP地址
  2. SW1 和 SW2 之间的直连链路配置链路聚合
  3. 公司内部业务网段为Vlan10 和Vlan20;Vlan10是市场部,Vlan20是技术部,要求对Vlan进行命名以便识别;PC1属于Vlan10,PC2属于Vlan20,Vlan30用于SW1和SW2建立OSPF邻居;Vlan111为SW1和R1的互联Vlan,Vlan222为SW2和R2的互联Vlan
  4. 所有交换机相连的端口配置为Trunk,允许相关流量通过
  5. 交换机连接PC的端口配置为边缘端口
  6. 各个交换机上配置mstp,mst域为nidaye,vlan10映射到instance1,vlan20映射到instance2,要求vlan10流量默认走SW1,vlan20的流量默认走SW2
  7. SW1和SW2配置VRRP互为备份,监听上行接口,避免抢占
  8. 在SW1上配置DHCP服务,为Vlan10和Vlan20的PC动态分配IP地址、网关和DNS地址;要求Vlan10的网关是192.168.1.252,Vlan20的网关是192.168.2.253
  9. 配置OSPF实现公司内部网络全网互通,ABR的环回口宣告进骨干区域;业务网段不允许出现协议报文
  10. R1上配置默认路由指向互联网,并引入到OSPF
  11. R1通过双线连接到互联网,配置PPP-MP,并配置双向chap验证
  12. 配置easy ip,只有业务网段192.168.1.0/24和192.168.2.0/24的数据流可以通过R1访问互联网
  13. R1开启TELNET远程管理,使用用户 telnet登录,密码nidaye123456,只允许技术部远程管理R1

实验步骤

1.配置IP地址略

2.配置链路聚合

SW1
#创建聚合组
 int Bridge-Aggregation 1
  port link-type trunk
  port trunk permit vlan 10 20 30
#把端口加入到聚合组
 int g1/0/1
  port link-aggregation group 1
 int g1/0/2
  port link-aggregation group 1
#
SW2配置类似

注意,先把链路聚合配好了再去配trunk

3.配置vlan地址和接口类型略

4.配置边缘端口

SW3
#
interface GigabitEthernet1/0/3
 stp edged-port
#
interface GigabitEthernet1/0/4
 stp edged-port
#

5.配置MSTP

SW1、SW2、SW3
#配置mst域
stp region-configuration
 region-name nidaye
 instance 1 vlan 10 
 instance 2 vlan 20 
 active region-configuration  这里别忘记激活
#

SW1
#
stp instance 1 root primary
stp instance 2 root secondary
#

SW2
#
stp instance 1 root secondary
stp instance 2 root primary
#

6.配置VRRP

SW1
#
track 1 interface GigabitEthernet1/0/4   监听上行接口
interface Vlan-interface10
 vrrp vrid 10 virtual-ip 192.168.1.254
 vrrp vrid 10 priority 120
 vrrp vrid 10 track 1 priority reduced 30   降低优先级避免发生抢占
interface Vlan-interface20
 vrrp vrid 20 virtual-ip 192.168.2.254
#

SW2
#
track 1 interface GigabitEthernet 1/0/4   监听上行接口
interface Vlan-interface10
 vrrp vrid 10 virtual-ip 192.168.1.254
interface Vlan-interface20
 vrrp vrid 20 virtual-ip 192.168.2.254
 vrrp vrid 20 priority 120
 vrrp vrid 20 track 1 priority reduced 30   降低优先级避免发生抢占
#

7.配置DHCP服务

SW1
#
dhcp enable   开启dhcp服务
dhcp server ip-pool 1  创建dhcp地址池
 gateway-list 192.168.1.252
 network 192.168.1.0 mask 255.255.255.0
 dns-list 8.8.8.8
#
dhcp server ip-pool 2
 gateway-list 192.168.2.253
 network 192.168.2.0 mask 255.255.255.0
 dns-list 8.8.8.8
#

配置完后,在PC1和PC2中开启DHCP就可以获取到IP地址

8.配置OSPF

SW1
#
ospf 1 router-id 10.1.1.11
业务网段不能出现协议报文,所以要配置静默接口
 silent-interface Vlan-interface10   
 silent-interface Vlan-interface20
 area 0.0.0.1
  network 10.0.0.6 0.0.0.0   将接口宣告进区域可以避免掩码计算出错
  network 10.1.1.11 0.0.0.0
  network 10.1.2.1 0.0.0.0
  network 192.168.1.252 0.0.0.0
  network 192.168.2.252 0.0.0.0
#
--------------------------------------------------------------------------------
SW2
#
ospf 1 router-id 10.1.1.12
业务网段不能出现协议报文,所以要配置静默接口
 silent-interface Vlan-interface10
 silent-interface Vlan-interface20
 area 0.0.0.1
  network 10.0.0.10 0.0.0.0   将接口宣告进区域可以避免掩码计算出错
  network 10.1.1.12 0.0.0.0
  network 10.1.2.2 0.0.0.0
  network 192.168.1.253 0.0.0.0
  network 192.168.2.253 0.0.0.0
#
--------------------------------------------------------------------------------
R1
#
ospf 1 router-id 10.1.1.1
 area 0.0.0.0
  network 10.0.0.1 0.0.0.0   将接口宣告进区域可以避免掩码计算出错
  network 10.0.0.14 0.0.0.0
  network 10.1.1.1 0.0.0.0
 area 0.0.0.1
  network 10.0.0.5 0.0.0.0
#
注意R1和R2之间的那两个接口宣告进同一个区域,不然邻居起不来
--------------------------------------------------------------------------------
R2
#
ospf 1 router-id 10.1.1.2
 area 0.0.0.0
  network 10.0.0.2 0.0.0.0   将接口宣告进区域可以避免掩码计算出错
  network 10.0.0.18 0.0.0.0
  network 10.1.1.2 0.0.0.0
 area 0.0.0.1
  network 10.0.0.9 0.0.0.0
#
--------------------------------------------------------------------------------
R3
#
ospf 1 router-id 10.1.1.3
业务网段不能出现协议报文,所以要配置静默接口
 silent-interface GigabitEthernet0/2
 area 0.0.0.0
  network 10.0.0.13 0.0.0.0   将接口宣告进区域可以避免掩码计算出错
  network 10.0.0.17 0.0.0.0
  network 10.1.1.3 0.0.0.0
  network 192.168.3.254 0.0.0.0
#

可以用display ospf peer查看邻居是否都起来了

R1有三个邻居
[R1]dis ospf peer

         OSPF Process 1 with Router ID 10.1.1.1
               Neighbor Brief Information

 Area: 0.0.0.0        
 Router ID       Address         Pri Dead-Time  State             Interface
 10.1.1.2        10.0.0.2        1   35         Full/DR           GE0/1
 10.1.1.3        10.0.0.13       1   35         Full/DR           GE0/2

 Area: 0.0.0.1        
 Router ID       Address         Pri Dead-Time  State             Interface
 10.1.1.11       10.0.0.6        1   34         Full/DR           GE0/0
--------------------------------------------------------------------------------
R2有三个邻居
[R2]dis ospf peer

         OSPF Process 1 with Router ID 10.1.1.2
               Neighbor Brief Information

 Area: 0.0.0.0        
 Router ID       Address         Pri Dead-Time  State             Interface
 10.1.1.3        10.0.0.17       1   33         Full/DR           GE0/1
 10.1.1.1        10.0.0.1        1   34         Full/BDR          GE0/2

 Area: 0.0.0.1        
 Router ID       Address         Pri Dead-Time  State             Interface
 10.1.1.12       10.0.0.10       1   30         Full/DR  
-------------------------------------------------------------------------------- 
R3有两个邻居
[R3]dis ospf peer

         OSPF Process 1 with Router ID 10.1.1.3
               Neighbor Brief Information

 Area: 0.0.0.0        
 Router ID       Address         Pri Dead-Time  State             Interface
 10.1.1.1        10.0.0.14       1   38         Full/BDR          GE0/0
 10.1.1.2        10.0.0.18       1   30         Full/BDR  
--------------------------------------------------------------------------------
SW1有两个邻居
[SW1]dis ospf peer

         OSPF Process 1 with Router ID 10.1.1.11
               Neighbor Brief Information

 Area: 0.0.0.1        
 Router ID       Address         Pri Dead-Time  State             Interface
 10.1.1.12       10.1.2.2        1   40         Full/BDR          Vlan30
 10.1.1.1        10.0.0.5        1   40         Full/BDR 
-------------------------------------------------------------------------------- 
SW2有两个邻居
[SW2]dis ospf peer

         OSPF Process 1 with Router ID 10.1.1.12
               Neighbor Brief Information

 Area: 0.0.0.1        
 Router ID       Address         Pri Dead-Time  State             Interface
 10.1.1.11       10.1.2.1        1   34         Full/DR           Vlan30
 10.1.1.2        10.0.0.9        1   36         Full/BDR 

9.配置默认路由并引入到OSPF

R1
#
ip route-static 0.0.0.0 0 202.100.1.1
#
ospf 1 router-id 10.1.1.1
 default-route-advertise
#

配置完后,其他运行OSPF的路由器也能学习到外部默认路由,注意OSPF外部路由的默认优先级为150

[R2]display ip routing-table 

Destinations : 28       Routes : 29

Destination/Mask   Proto   Pre Cost        NextHop         Interface
0.0.0.0/0          O_ASE2  150 1           10.0.0.1        GE0/2
......
--------------------------------------------------------------------------------
[R3]display ip routing-table 

Destinations : 28       Routes : 32

Destination/Mask   Proto   Pre Cost        NextHop         Interface
0.0.0.0/0          O_ASE2  150 1           10.0.0.14       GE0/0
......
--------------------------------------------------------------------------------
[SW1]display ip routing-table 

Destinations : 36       Routes : 38

Destination/Mask   Proto   Pre Cost        NextHop         Interface
0.0.0.0/0          O_ASE2  150 1           10.0.0.5        Vlan111
......
--------------------------------------------------------------------------------
[SW2]display ip routing-table 

Destinations : 36       Routes : 38

Destination/Mask   Proto   Pre Cost        NextHop         Interface
0.0.0.0/0          O_ASE2  150 1           10.1.2.1        Vlan30
......
--------------------------------------------------------------------------------

10.配置PPP-MP和双向CHAP验证

R1
#创建MP组
interface MP-group1
 ip address 202.100.1.2 255.255.255.252
#把接口加入到组
interface Serial1/0
 ppp mp MP-group1
interface Serial2/0
 ppp mp MP-group1
#internet配置类似
--------------------------------------------------------------------------------
R1
#创建对端用于ppp验证的用户
local-user internet class network
 password simple nidaye123456
 service-type ppp
#
interface Serial1/0
 ppp authentication-mode chap   认证模式为chap
 ppp chap password simple nidaye123456
 ppp chap user internet 指定本端用户
#
interface Serial2/0
 ppp authentication-mode chap   认证模式为chap
 ppp chap password simple nidaye123456
 ppp chap user internet 指定本端用户
#
--------------------------------------------------------------------------------
internet
#创建对端用于ppp验证的用户
local-user r1 class network
 password simple nidaye123456
 service-type ppp
#
interface Serial1/0
 ppp authentication-mode chap   认证模式为chap
 ppp chap password simple nidaye123456
 ppp chap user internet 指定本端用户
#
interface Serial2/0
 ppp authentication-mode chap   认证模式为chap
 ppp chap password simple nidaye123456
 ppp chap user internet 指定本端用户
#

11.配置easy ip

R1
#创建基本acl,允许两个业务网段访问internet
acl basic 2000
 rule 0 permit source 192.168.1.0 0.0.0.255
 rule 5 permit source 192.168.2.0 0.0.0.255
#
interface MP-group1
 nat outbound 2000   将acl应用到配置了IP地址的接口上
#

配置完后,只有PC1和PC2能ping通internet,PC3ping不通internet

<PC1>ping 100.1.1.1
Ping 100.1.1.1 (100.1.1.1): 56 data bytes, press CTRL_C to break
56 bytes from 100.1.1.1: icmp_seq=0 ttl=253 time=2.000 ms
56 bytes from 100.1.1.1: icmp_seq=1 ttl=253 time=5.000 ms
56 bytes from 100.1.1.1: icmp_seq=2 ttl=253 time=2.000 ms
56 bytes from 100.1.1.1: icmp_seq=3 ttl=253 time=2.000 ms
56 bytes from 100.1.1.1: icmp_seq=4 ttl=253 time=4.000 ms

--- Ping statistics for 100.1.1.1 ---
5 packet(s) transmitted, 5 packet(s) received, 0.0% packet loss
round-trip min/avg/max/std-dev = 2.000/3.000/5.000/1.265 ms
--------------------------------------------------------------------------------
<PC2>ping 100.1.1.1
Ping 100.1.1.1 (100.1.1.1): 56 data bytes, press CTRL_C to break
56 bytes from 100.1.1.1: icmp_seq=0 ttl=253 time=2.000 ms
56 bytes from 100.1.1.1: icmp_seq=1 ttl=253 time=6.000 ms
56 bytes from 100.1.1.1: icmp_seq=2 ttl=253 time=7.000 ms
56 bytes from 100.1.1.1: icmp_seq=3 ttl=253 time=8.000 ms
56 bytes from 100.1.1.1: icmp_seq=4 ttl=253 time=5.000 ms

--- Ping statistics for 100.1.1.1 ---
5 packet(s) transmitted, 5 packet(s) received, 0.0% packet loss
round-trip min/avg/max/std-dev = 2.000/5.600/8.000/2.059 ms
--------------------------------------------------------------------------------
<PC3>ping 100.1.1.1
Ping 100.1.1.1 (100.1.1.1): 56 data bytes, press CTRL_C to break
Request time out
Request time out
Request time out
Request time out
Request time out

--- Ping statistics for 100.1.1.1 ---
5 packet(s) transmitted, 0 packet(s) received, 100.0% packet loss

12.配置telnet服务

R1
#
telnet server enable   开启telnet服务
local-user telnet class manage   创建远程管理用户
 password simple nidaye123456
 service-type telnet
 authorization-attribute user-role level-15
#
user-interface vty 0 4
 authentication-mode scheme   认证模式为AAA
 user-role level-15
#创建基本acl,只允许技术部远程管理R1
acl basic 2001
 rule 0 permit source 192.168.2.0 0.0.0.255
#将acl应用到telnet服务上
telnet server acl 2001
#
配置完后PC2可以telnet到R1上,由于模拟器中PC不支持telnet,所以我就不做演示了,大家可以用路由器替换掉PC,在路由器上可以实现telnet登录

这个综合实验基本上运用到了NE阶段的所有内容,学习并不是一蹴而就的,还是要多做实验才能熟练,将理论与实践相结合!

以上是关于H3CNE综合实验的主要内容,如果未能解决你的问题,请参考以下文章

H3CNE认证

H3CNE认证

20191130 实验四 Python综合实践

20162302 实验五《数据结构综合应用》实验报告

DNS解析综合学习案例实验详细代码

20162308 实验五 数据结构综合应用