企业项目拓扑3

Posted 2021-03-25

某知名企业及运营商网络拓扑图如下：

企业项目要如下：

实验要求：
1.如图所示蓝色区域为企业内网，红色区域为供应商网络；
2.运行MSTP协议，使得VLAN流量负载均衡；
3.SW1为vlan 10和20的主网关，SW1为30和40的备份网关；
4.SW2为vlan 30和40的主网关，SW2为10和20的备份网关；
5.DHCP服务器在vlan 66，网关在SW2上面；
6.企业内网运行静态路由协议或者OSPF路由协议；
7.所有PC机自动获取ip地址且可以与Server1互相ping通；
8.Client1仅可以访问Server1的www服务；
9.企业内网设备仅允许被IT部门远程管理。

第一步：配置基础网络；

SW1配置如下：
sysname SW1
vlan batch 10 20 30 40 66 100
interface GigabitEthernet 0/0/1
port link-type trunk
port trunk allow-pass vlan all
interface GigabitEthernet 0/0/2
port link-type trunk
port trunk allow-pass vlan all
interface GigabitEthernet 0/0/3
port link-type trunk
port trunk allow-pass vlan all
interface GigabitEthernet 0/0/4
port link-type access
port default vlan 100
interface Vlanif 100
ip address 192.168.100.2 24
interface Vlanif 66
ip address 192.168.66.251 24
quit
SW2配置如下：
sysname SW2
vlan batch 10 20 30 40 66 200
interface GigabitEthernet 0/0/1
port link-type trunk
port trunk allow-pass vlan all
interface GigabitEthernet 0/0/2
port link-type trunk
port trunk allow-pass vlan all
interface GigabitEthernet 0/0/3
port link-type trunk
port trunk allow-pass vlan all
interface GigabitEthernet 0/0/4
port link-type access
port default vlan 200
interface Vlanif 200
ip address 192.168.200.2 24
interface GigabitEthernet 0/0/5
port link-type access
port default vlan 66
interface Vlanif 66
ip address 192.168.66.252 24
quit
SW3配置如下
sysname SW3
vlan batch 10 20 30 40
interface Ethernet0/0/1
port link-type trunk
port trunk allow-pass vlan all
interface Ethernet0/0/2
port link-type trunk
port trunk allow-pass vlan all
interface Ethernet0/0/3
port link-type access
port default vlan 10
interface Ethernet0/0/4
port link-type access
port default vlan 20
interface Ethernet0/0/5
port link-type trunk
port trunk allow-pass vlan all
quit
SW4配置如下：
sysname SW4
vlan batch 10 20 30 40
interface Ethernet0/0/1
port link-type trunk
port trunk allow-pass vlan all
interface Ethernet0/0/2
port link-type trunk
port trunk allow-pass vlan all
interface Ethernet0/0/3
port link-type access
port default vlan 30
interface Ethernet0/0/4
port link-type access
port default vlan 40
interface Ethernet0/0/5
port link-type trunk
port trunk allow-pass vlan all
quit
R1配置如下：
sysname R1
interface g0/0/0
ip address 192.168.100.1 24
interface g0/0/1
ip address 192.168.200.1 24
interface g0/0/2
ip address 100.1.1.2 24
quit
R2配置如下：
sysname R2
interface g0/0/0
ip address 100.1.1.1 24
interface g0/0/1
ip address 200.1.1.254 24
quit
DHCP
sysname DHCP
dhcp enable
interface g0/0/0
ip address 192.168.66.1 24
quit

第二步：配置接入层网络；
配置STP 

SW1
stp region-configuration
region-name ntd
instance 12 vlan 10 20
instance 34 vlan 30 40
active region-configuration
quit
stp instance 12 priority 4096
stp instance 34 priority 8192
SW2
stp region-configuration
region-name ntd
instance 12 vlan 10 20
instance 34 vlan 30 40
active region-configuration
quit
stp instance 12 priority 8192
stp instance 34 priority 4096
SW3
stp region-configuration
region-name ntd
instance 12 vlan 10 20
instance 34 vlan 30 40
active region-configuration
quit
SW4
stp region-configuration
region-name ntd
instance 12 vlan 10 20
instance 34 vlan 30 40
active region-configuration
quit

第三步：配置汇聚层网络；

配置VRRP
SW1
interface Vlanif10
ip address 192.168.10.251 255.255.255.0
vrrp vrid 10 virtual-ip 192.168.10.250
vrrp vrid 10 priority 200
interface Vlanif20
ip address 192.168.20.251 255.255.255.0
vrrp vrid 20 virtual-ip 192.168.20.250
vrrp vrid 20 priority 200
interface Vlanif30
ip address 192.168.30.251 255.255.255.0
vrrp vrid 30 virtual-ip 192.168.30.250
interface Vlanif40
ip address 192.168.40.251 255.255.255.0
vrrp vrid 40 virtual-ip 192.168.40.250
SW2
interface Vlanif10
ip address 192.168.10.252 255.255.255.0
vrrp vrid 10 virtual-ip 192.168.10.250
interface Vlanif20
ip address 192.168.20.252 255.255.255.0
vrrp vrid 20 virtual-ip 192.168.20.250
interface Vlanif30
ip address 192.168.30.252 255.255.255.0
vrrp vrid 30 virtual-ip 192.168.30.250
vrrp vrid 30 priority 200
interface Vlanif40
ip address 192.168.40.252 255.255.255.0
vrrp vrid 40 virtual-ip 192.168.40.250
vrrp vrid 40 priority 200
验证查看VRRP配置：
SW1

SW2

配置DHCP
SW1
dhcp enable
interface Vlanif 10
dhcp select relay
dhcp relay server-ip 192.168.66.1
interface Vlanif 20
dhcp select relay
dhcp relay server-ip 192.168.66.1
interface Vlanif 30
dhcp select relay
dhcp relay server-ip 192.168.66.1
interface Vlanif 40
dhcp select relay
dhcp relay server-ip 192.168.66.1
SW2
dhcp enable
interface Vlanif 10
dhcp select relay
dhcp relay server-ip 192.168.66.1
interface Vlanif 20
dhcp select relay
dhcp relay server-ip 192.168.66.1
interface Vlanif 30
dhcp select relay
dhcp relay server-ip 192.168.66.1
interface Vlanif 40
dhcp select relay
dhcp relay server-ip 192.168.66.1
配置DHCP
SW1
dhcp enable
interface Vlanif 10
dhcp select relay
dhcp relay server-ip 192.168.66.1
interface Vlanif 20
dhcp select relay
dhcp relay server-ip 192.168.66.1
interface Vlanif 30
dhcp select relay
dhcp relay server-ip 192.168.66.1
interface Vlanif 40
dhcp select relay
dhcp relay server-ip 192.168.66.1
SW2
dhcp enable
interface Vlanif 10
dhcp select relay
dhcp relay server-ip 192.168.66.1
interface Vlanif 20
dhcp select relay
dhcp relay server-ip 192.168.66.1
interface Vlanif 30
dhcp select relay
dhcp relay server-ip 192.168.66.1
interface Vlanif 40
dhcp select relay
dhcp relay server-ip 192.168.66.1
DHCP
interface g0/0/0
dhcp select global
ip pool p1
gateway-list 192.168.10.250
network 192.168.10.0 mask 255.255.255.0
excluded-ip-address 192.168.10.251 192.168.10.252
dns-list 8.8.8.8
ip pool p2
gateway-list 192.168.20.250
network 192.168.20.0 mask 255.255.255.0
excluded-ip-address 192.168.20.251 192.168.20.252
dns-list 8.8.8.8
ip pool p3
gateway-list 192.168.30.250
network 192.168.30.0 mask 255.255.255.0
excluded-ip-address 192.168.30.251 192.168.30.252
dns-list 8.8.8.8
ip pool p4
gateway-list 192.168.40.250
network 192.168.40.0 mask 255.255.255.0
excluded-ip-address 192.168.40.251 192.168.40.252
dns-list 8.8.8.8

第四步：配置核心层网络；

配置OSPF
R1配置：
ospf 1
area 0
network 192.168.100.0 0.0.0.255
network 192.168.200.0 0.0.0.255
default-route-advertise always
quit
quit
ip route-static 0.0.0.0 0.0.0.0 100.1.1.1
SW1配置：
ospf 1
area 0
network 192.168.100.0 0.0.0.255
area 10
network 192.168.10.0 0.0.0.255
area 20
network 192.168.20.0 0.0.0.255
area 30
network 192.168.30.0 0.0.0.255
area 40
network 192.168.40.0 0.0.0.255
area 66
network 192.168.66.0 0.0.0.255
stub no-summary
quit
quit
SW2配置：
ospf 1
area 0
network 192.168.10.0 0.0.0.255
area 10
network 192.168.10.0 0.0.0.255
area 20
network 192.168.20.0 0.0.0.255
area 30
network 192.168.30.0 0.0.0.255
area 40
network 192.168.40.0 0.0.0.255
area 66
network 192.168.66.0 0.0.0.255
stub no-summary
quit
quit
stp instance 0 root primary
DHCP
ospf 1
area 66
network 192.168.66.0 0.0.0.255
stub
quit
quit
配置NAT和ACL
R1
acl number 3000
rule 10 permit tcp source 192.168.20.0 0.0.0.255 destination 200.1.1.1 0 destin
ation-port eq www
rule 15 deny ip source 192.168.20.0 0.0.0.255 destination 200.1.1.1 0
rule 20 permit ip
interface GigabitEthernet0/0/2
nat outbound 3000
acl number 2000
rule 10 permit source 192.168.10.0 0.0.0.255
interface GigabitEthernet0/0/2
acl 2000 inbound
quit
user-interface vty 0 4
acl 2000 inbound
authentication-mode password
123
user privilege level 15

第五步：进行验证。

验证PC自动获取ip地址，且可以ping通server1服务器：

验证Client1可以访问Server1的www服务，但不可以ping通服务器

 至此项目配置并验证成功。。。。。。