eNSP小实验2
这里写目录标题
1. 实验拓扑
2. 实验内容
2.1 配置 IP 地址、LP0接口地址
R2 的 LP0 地址为 2.2.2.2 32;R1 的 LP0 接口地址式 1.1.1.1 32;
路由器的接口地址正常配置,交换机的先创建 vlan 再配置。
2.2 某企业网接入了PC1和PC2两个用户
PC1划分到VLAN10;PC2划分到VLAN20 LSW2为俩用户的网关设备;PC1位于192.168.0.0/24网络,网关为192.168.0.254; PC2位于172.16.0.0/24;网关为172.16.0.254;
1. S2 配置
[S2]dis current-configuration
#
sysname S2
#
undo info-center enable
#
vlan batch 10 20
#
... ...
#
interface Vlanif10
ip address 192.168.0.254 255.255.255.0
#
interface Vlanif20
ip address 172.16.0.254 255.255.255.0
#
interface MEth0/0/1
#
interface Ethernet0/0/1
#
interface Ethernet0/0/2
port link-type trunk
port trunk allow-pass vlan 10 20
#
... ...
#
user-interface con 0
user-interface vty 0 4
#
return
--------------------------------------------------
2. S3 配置
[S3]dis cu
#
sysname S3
#
undo info-center enable
#
vlan batch 10 20
#
... ...
#
interface Ethernet0/0/1
port link-type trunk
port trunk allow-pass vlan 10 20
#
interface Ethernet0/0/2
port link-type trunk
port trunk allow-pass vlan 10 20
#
interface Ethernet0/0/3
port link-type access
port default vlan 10
#
interface Ethernet0/0/4
port link-type access
port default vlan 20
#
... ...
#
user-interface con 0
user-interface vty 0 4
#
return
--------------------------------------------------
3. S1 配置:
#
interface Ethernet0/0/2
port link-type trunk
port trunk allow-pass vlan 10 20
#
2.3 部署快速生成树协议
为给用户提供冗余链路,二层网络部署了三台S3700交换机,为解决二层网络的环路问题,需在三台交换机上启用RSTP生成树协议;请合理规划RSTP ROOT交换机,使PC1和PC2访问网关设备走最短路径;
1. S2 配置:
[S2]stp mode rstp
Info: This operation may take a few seconds. Please wait for a moment...done.
[S2]stp instance 0 root primary
--------------------------------------------------
2. S1 配置:
[S1]stp mode rstp
--------------------------------------------------
3. S3 配置:
[S3]stp mode rstp
[S3]stp bpdu-protection
2.4 LSW1和LSW2做(eth-trunk)链路聚合
S2 和 S1 之间部署了网络
1. S2 配置:
[S2-Eth-Trunk1]dis this
#
interface Eth-Trunk1
port link-type trunk
port trunk pvid vlan 100
port trunk allow-pass vlan 10 20 100
#
return
[S2-Eth-Trunk1]trunkport e 0/0/3
[S2-Eth-Trunk1]trunkport e 0/0/4
[S2-Eth-Trunk1]int vlanif 100
[S2-Vlanif100]ip add 21.0.0.2 24
--------------------------------------------------
2. S1 配置
[S1-Eth-Trunk1]dis this
#
interface Eth-Trunk1
port link-type trunk
port trunk pvid vlan 100
port trunk allow-pass vlan 10 20 100
#
return
[S1-Eth-Trunk1]trunkport e 0/0/3
[S1-Eth-Trunk1]trunkport e 0/0/2
[S1-Eth-Trunk1]int vlanif 100
[S1-Vlanif100]ip add 21.0.0.1 24
2.5 部署静态路由
实现用户能够访问到 R2 的 LOOPBACK0 接口地址; LSW1和LSW2间链路做2层+3层使用;
1. S2 配置:
[S2]int Vlanif 12
[S2-Vlanif12]ip add 22.0.0.1 24
[S2-Vlanif12]q
[S2]int e 0/0/1
[S2-Ethernet0/0/1]port link-type access
[S2-Ethernet0/0/1]port default vlan 12
--------------------------------------------------
2. 配置静态路由----目的是PC ping 通R2的lp接口地址,所以S2做一个去往 2.2.2.2 32 的静态路由,下一跳R1的接口,R1也需要做去往 2.2.2.2 32 的静态路由,此时报文能到达R2,想要回话还得做去往PC的;
全部配置完成静态路由后,PC 能够 ping 通 2.2.2.2
2.6 R1、R2 部署 OSPF
且工作在骨干区域area0;要求用设备的loopback0接口地址来做设备的router id;要求 R1 为 R1 和 R2 互联链路的 DR 设备;
1. R1配置:
[R1-ospf-1]dis this
#
ospf 1 router-id 1.1.1.1
area 0.0.0.0
network 23.0.0.0 0.0.0.255
network 22.0.0.0 0.0.0.255
network 11.0.0.0 0.0.0.255
network 1.1.1.1 0.0.0.0
#
return
[R1-Ethernet0/0/0]dis this
#
interface Ethernet0/0/0
ip address 23.0.0.1 255.255.255.0
ospf dr-priority 255
#
return
--------------------------------------------------
2. R2 配置
[R2-ospf-1]dis this
#
ospf 1 router-id 2.2.2.2
area 0.0.0.0
network 23.0.0.0 0.0.0.255
network 2.2.2.2 0.0.0.0
#
return
<R2>dis ospf peer
OSPF Process 1 with Router ID 2.2.2.2
Neighbors
Area 0.0.0.0 interface 23.0.0.2(Ethernet0/0/0)'s neighbors
Router ID: 1.1.1.1 Address: 23.0.0.1
State: Full Mode:Nbr is Slave Priority: 255
DR: 23.0.0.1 BDR: 23.0.0.2 MTU: 0
Dead timer due in 28 sec
Retrans timer interval: 5
Neighbor is up for 00:01:42
Authentication Sequence: [ 0 ]
DR\BDR不具备抢占机制,一旦选举成功,不故障就一直是此角色,因此修改设备优先级后需要重启设备,不要忘记save。
2.7 配置OSPF认证
企业由于安全需求,需要在R1和R2的互联链路上起OSPF的接口认证,要求使用MD5认证,密钥为huawei;
1. R2配置:
[R2-ospf-1-area-0.0.0.0]dis this
#
area 0.0.0.0
authentication-mode md5 1 cipher IaK"M{,MlC;BH^68NhwOt9-#
network 23.0.0.0 0.0.0.255
network 2.2.2.2 0.0.0.0
#
return
--------------------------------------------------
2. R1 配置:
[R1-ospf-1-area-0.0.0.0]dis this
#
area 0.0.0.0
authentication-mode md5 1 cipher {N^NHIvq>:pe}@HMNPn@>:a#
network 23.0.0.0 0.0.0.255
network 22.0.0.0 0.0.0.255
network 11.0.0.0 0.0.0.255
network 1.1.1.1 0.0.0.0
#
return
2.8 联通性测试
PC1和PC2都能Ping通R2的loopback0地址;
2.9 R1和R2设备配置远程登陆
R1 和 R2 设备配置远程登陆,采用明文密码验证,密码为 huawei ;并且要求 R2 设备配置成网络中的 FTP 服务器,用户名为 huawei ,密码为huawei123;
1. R1配置
[R1]telnet server enable
[R1-ui-vty0-4]dis this
#
user-interface con 0
user-interface vty 0 4
set authentication password simple huawei
user-interface vty 16 20
#
return
--------------------------------------------------
2. R2配置
[R2]telnet server enable
[R2]ftp server enable
[R2]user-interface vty 0 4
[R2-ui-vty0-4]dis this
#
user-interface con 0
user-interface vty 0 4
set authentication password simple huawei
user-interface vty 16 20
#
return
[R2]aaa
[R2-aaa]dis this
#
aaa
authentication-scheme default
authorization-scheme default
accounting-scheme default
domain default
domain default_admin
local-user admin password cipher lFk-5|VYA%@X,k6.E\Z,F.{#
local-user admin service-type http
local-user huawei password cipher ds+E&Z4P=6C-"-B>~\[S`Dq#
local-user huawei ftp-directory flash:
local-user huawei service-type ftp
#
return
验证: