网络安全学习--单臂路由和DHCP中继
Posted 丢爸
tags:
篇首语：本文由小常识网(cha138.com)小编为大家整理，主要介绍了网络安全学习--单臂路由和DHCP中继相关的知识，希望对你有一定的参考价值。
实现目标
- 实现VLAN间可以互相通信
- 各员工电脑通过DHCP动态获取IP地址
- 所有员工通过http://www.tye.com访问VLAN40中的服务器网站
公司网络规划
IT部：VLAN10–10.1.1.0/24
财务部：VLAN20–20.1.1.0/24
市场部：VLAN30–30.1.1.0/24
服务器：VLAN40–40.1.1.0/24
基本配置
实现各个VLAN之间互通
#注：在Switch0交换机上配置vtp domain之前，需要在三台交换机上先启用trunk
#----------------------Switch0配置-----------------
Switch>enable
Switch#configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
Switch(config)#interface fa0/3
Switch(config-if)#switchport mode trunk
%LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/3, changed state to down
%LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/3, changed state to up
nk
Switch(config-if)#exit
#设置vtp域后，在同一个域中的交换机会自动复制VLAN,所以vlan只需要在Switch0交换机上配置即可
Switch(config)#vtp domain tye
Domain name already set to tye.
Switch(config)#vlan 10
Switch(config-vlan)#exit
Switch(config)#vlan 20
Switch(config-vlan)#exit
Switch(config)#vlan 30
Switch(config-vlan)#exit
Switch(config)#vlan 40
Switch(config-vlan)#exit
Switch(config)#do show vlan brief
VLAN Name Status Ports
---- -------------------------------- --------- -------------------------------
1 default active Fa0/1, Fa0/2, Fa0/4, Fa0/5
Fa0/6, Fa0/7, Fa0/8, Fa0/9
Fa0/10, Fa0/11, Fa0/12, Fa0/13
Fa0/14, Fa0/15, Fa0/16, Fa0/17
Fa0/18, Fa0/19, Fa0/20, Fa0/21
Fa0/22, Fa0/23, Fa0/24, Gig0/1
Gig0/2
10 VLAN0010 active
20 VLAN0020 active
30 VLAN0030 active
40 VLAN0040 active
1002 fddi-default active
1003 token-ring-default active
1004 fddinet-default active
1005 trnet-default active
#将交换机接口加入VLAN
Switch(config)#interface Fa0/1
Switch(config-if)#switchport access vlan 10
Switch(config-if)#exit
Switch(config)#interface fa0/2
Switch(config-if)#switchport access vlan 20
Switch(config-if)#exit
#----------------------Switch0配置-----------------
#----------------------Switch1配置-----------------
Switch>enable
Switch#configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
Switch(config)#vtp domain tye
Changing VTP domain name from NULL to tye
Switch(config)#vtp do
Switch(config)#vtp domain ?
WORD The ascii name for the VTP administrative domain.
Switch(config)#interface range f0/3-5
Switch(config-if-range)#switchport mode trunk
Switch(config-if-range)#
%LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/3, changed state to down
%LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/3, changed state to up
%LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/4, changed state to down
%LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/4, changed state to up
Switch(config-if-range)#exit
Switch(config)#do show vlan brief
VLAN Name Status Ports
---- -------------------------------- --------- -------------------------------
1 default active Fa0/1, Fa0/2, Fa0/5, Fa0/6
Fa0/7, Fa0/8, Fa0/9, Fa0/10
Fa0/11, Fa0/12, Fa0/13, Fa0/14
Fa0/15, Fa0/16, Fa0/17, Fa0/18
Fa0/19, Fa0/20, Fa0/21, Fa0/22
Fa0/23, Fa0/24, Gig0/1, Gig0/2
10 VLAN0010 active
20 VLAN0020 active
30 VLAN0030 active
40 VLAN0040 active
1002 fddi-default active
1003 token-ring-default active
1004 fddinet-default active
1005 trnet-default active
Switch(config)#
Switch(config)#interface fa0/1
Switch(config-if)#switchport access vlan 10
Switch(config-if)#exit
Switch(config)#interface fa0/2
Switch(config-if)#switchport access vlan 20
Switch(config-if)#exit
#----------------------Switch1配置-----------------
#----------------------Switch2配置-----------------
Switch>enable
Switch#configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
Switch(config)#interface fa0/4
Switch(config-if)#switchport mode trunk
Switch(config-if)#do show vlan brief
VLAN Name Status Ports
---- -------------------------------- --------- -------------------------------
1 default active Fa0/1, Fa0/2, Fa0/3, Fa0/5
Fa0/6, Fa0/7, Fa0/8, Fa0/9
Fa0/10, Fa0/11, Fa0/12, Fa0/13
Fa0/14, Fa0/15, Fa0/16, Fa0/17
Fa0/18, Fa0/19, Fa0/20, Fa0/21
Fa0/22, Fa0/23, Fa0/24, Gig0/1
Gig0/2
10 VLAN0010 active
20 VLAN0020 active
30 VLAN0030 active
40 VLAN0040 active
1002 fddi-default active
1003 token-ring-default active
1004 fddinet-default active
1005 trnet-default active
Switch(config)#interface fa0/1
Switch(config-if)#switchport access vlan 30
Switch(config-if)#exit
Switch(config)#interface fa0/2
Switch(config-if)#switchport access vlan 40
Switch(config-if)#exit
#----------------------Switch2配置-----------------
#----------------------路由器配置-----------------
Router>enable
Router#configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
Router(config)#interface fa0/0.1
#配置以太网子接口vlan号为10，封装格式为802.1q
Router(config-subif)#encapsulation dot1Q 10
Router(config-subif)#ip addr 10.1.1.254 255.255.255.0
Router(config-subif)#no shutdown
Router(config-subif)#exit
Router(config)#interface fa0/0.2
Router(config-subif)#encapsulation dot1Q 20
Router(config-subif)#ip addr 20.1.1.254 255.255.255.0
Router(config-subif)#no shutdown
Router(config-subif)#exit
Router(config)#interface fa0/0.3
#配置以太网子接口vlan号为30，封装格式为802.1q
Router(config-subif)#encapsulation dot1Q 30
Router(config-subif)#ip addr 30.1.1.254 255.255.255.0
Router(config-subif)#no shutdown
Router(config-subif)#exit
Router(config)#interface fa0/0.4
#配置以太网子接口vlan号为40，封装格式为802.1q
Router(config-subif)#encapsulation dot1Q 40
Router(config-subif)#ip addr 40.1.1.254 255.255.255.0
Router(config-subif)#no shutdown
Router(config-subif)#exit
Router(config)#interface fa0/0
Router(config-if)#no shutdown
Router(config-if)#
%LINK-5-CHANGED: Interface FastEthernet0/0, changed state to up
%LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/0, changed state to up
%LINK-5-CHANGED: Interface FastEthernet0/0.1, changed state to up
%LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/0.1, changed state to up
%LINK-5-CHANGED: Interface FastEthernet0/0.2, changed state to up
%LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/0.2, changed state to up
%LINK-5-CHANGED: Interface FastEthernet0/0.3, changed state to up
%LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/0.3, changed state to up
%LINK-5-CHANGED: Interface FastEthernet0/0.4, changed state to up
%LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/0.4, changed state to up
Router(config-if)#
Router(config)#do show ip interface brief
Interface IP-Address OK? Method Status Protocol
FastEthernet0/0 unassigned YES unset up up
FastEthernet0/0.1 10.1.1.254 YES manual up up
FastEthernet0/0.2 20.1.1.254 YES manual up up
FastEthernet0/0.3 30.1.1.254 YES manual up up
FastEthernet0/0.4 40.1.1.254 YES manual up up
FastEthernet0/1 unassigned YES unset administratively down down
Vlan1 unassigned YES unset administratively down down
Router(config)#
#----------------------路由器配置-----------------
配置网关为DHCP服务器
- 基于上一节【基本配置】基础上进行网关DHCP配置
#在路由器上配置DHCP地址池
Router(config)#ip dhcp excluded-address 10.1.1.1 10.1.1.99
Router(config)#ip dhcp excluded-address 20.1.1.1 20.1.1.99
Router(config)#ip dhcp excluded-address 30.1.1.1 30.1.1.99
Router(config)#ip dhcp excluded-address 40.1.1.1 40.1.1.99
Router(config)#ip dhcp pool v10
Router(dhcp-config)#network 10.1.1.0 255.255.255.0
Router(dhcp-config)#default-router 10.1.1.254
Router(dhcp-config)#dns-server 40.1.1.1
Router(dhcp-config)#exit
Router(config)#ip dhcp pool v20
Router(dhcp-config)#network 20.1.1.0 255.255.255.0
Router(dhcp-config)#default-router 20.1.1.254
Router(dhcp-config)#dns-server 40.1.1.1
Router(dhcp-config)#exit
Router(config)#ip dhcp pool v30
Router(dhcp-config)#network 30.1.1.0 255.255.255.0
Router(dhcp-config)#default-router 30.1.1.254
Router(dhcp-config)#dns-server 40.1.1.1
Router(dhcp-config)#exit
- 路由器上DHCP池配置完成后，PC可以通过DHCP来获取IP地址了
- 配置DNS服务和ServerIP(使用静态IP)
4. 通过PC访问服务器上的web页面
使用Server作为DHCP服务器
待续… …
以上是关于网络安全学习--单臂路由和DHCP中继的主要内容，如果未能解决你的问题，请参考以下文章