eNSP小实验2

eNSP小实验2

---

---

1. 实验拓扑

2. 实验内容

2.1 配置 IP 地址、LP0接口地址

R2 的 LP0 地址为 2.2.2.2 32；R1 的 LP0 接口地址式 1.1.1.1 32；

路由器的接口地址正常配置，交换机的先创建 vlan 再配置。

2.2 某企业网接入了PC1和PC2两个用户

PC1划分到VLAN10；PC2划分到VLAN20 LSW2为俩用户的网关设备；PC1位于192.168.0.0/24网络，网关为192.168.0.254； PC2位于172.16.0.0/24;网关为172.16.0.254；

1. S2 配置
[S2]dis current-configuration 
#
sysname S2
#
undo info-center enable
#
vlan batch 10 20
#
... ...
#
interface Vlanif10
 ip address 192.168.0.254 255.255.255.0
#
interface Vlanif20
 ip address 172.16.0.254 255.255.255.0
#
interface MEth0/0/1
#
interface Ethernet0/0/1
#
interface Ethernet0/0/2
 port link-type trunk
 port trunk allow-pass vlan 10 20
#
... ...
#
user-interface con 0
user-interface vty 0 4
#
return
--------------------------------------------------
2. S3 配置
[S3]dis cu
#
sysname S3
#
undo info-center enable
#
vlan batch 10 20
#
... ...
#
interface Ethernet0/0/1
 port link-type trunk
 port trunk allow-pass vlan 10 20
#
interface Ethernet0/0/2
 port link-type trunk
 port trunk allow-pass vlan 10 20
#
interface Ethernet0/0/3
 port link-type access
 port default vlan 10
#
interface Ethernet0/0/4
 port link-type access
 port default vlan 20
#
... ...
#
user-interface con 0
user-interface vty 0 4
#
return
--------------------------------------------------
3. S1 配置：
#
interface Ethernet0/0/2
 port link-type trunk
 port trunk allow-pass vlan 10 20
#

2.3 部署快速生成树协议

为给用户提供冗余链路，二层网络部署了三台S3700交换机，为解决二层网络的环路问题，需在三台交换机上启用RSTP生成树协议；请合理规划RSTP ROOT交换机，使PC1和PC2访问网关设备走最短路径；

1. S2 配置：
[S2]stp mode rstp 
Info: This operation may take a few seconds. Please wait for a moment...done.
[S2]stp instance 0 root primary
--------------------------------------------------
2. S1 配置：
[S1]stp mode rstp 
--------------------------------------------------
3. S3 配置：
[S3]stp mode rstp
[S3]stp bpdu-protection

2.4 LSW1和LSW2做（eth-trunk）链路聚合

S2 和 S1  之间部署了网络

1. S2 配置：
[S2-Eth-Trunk1]dis this
#
interface Eth-Trunk1
 port link-type trunk
 port trunk pvid vlan 100
 port trunk allow-pass vlan 10 20 100
#
return
[S2-Eth-Trunk1]trunkport e 0/0/3
[S2-Eth-Trunk1]trunkport e 0/0/4
[S2-Eth-Trunk1]int vlanif 100
[S2-Vlanif100]ip add 21.0.0.2 24
--------------------------------------------------
2. S1 配置
[S1-Eth-Trunk1]dis this
#
interface Eth-Trunk1
 port link-type trunk
 port trunk pvid vlan 100
 port trunk allow-pass vlan 10 20 100
#
return
[S1-Eth-Trunk1]trunkport e 0/0/3
[S1-Eth-Trunk1]trunkport e 0/0/2
[S1-Eth-Trunk1]int vlanif 100
[S1-Vlanif100]ip add 21.0.0.1 24

2.5 部署静态路由

实现用户能够访问到 R2 的 LOOPBACK0 接口地址； LSW1和LSW2间链路做2层+3层使用；

1. S2 配置：
[S2]int Vlanif 12
[S2-Vlanif12]ip add 22.0.0.1 24
[S2-Vlanif12]q
[S2]int e 0/0/1
[S2-Ethernet0/0/1]port link-type  access 
[S2-Ethernet0/0/1]port default vlan 12
--------------------------------------------------
2. 配置静态路由----目的是PC ping 通R2的lp接口地址，所以S2做一个去往 2.2.2.2 32 的静态路由，下一跳R1的接口，R1也需要做去往 2.2.2.2 32 的静态路由，此时报文能到达R2，想要回话还得做去往PC的；

全部配置完成静态路由后，PC 能够 ping 通 2.2.2.2

2.6 R1、R2 部署 OSPF

且工作在骨干区域area0；要求用设备的loopback0接口地址来做设备的router id；要求 R1 为 R1 和 R2 互联链路的 DR 设备；

1. R1配置：
[R1-ospf-1]dis this
#
ospf 1 router-id 1.1.1.1
 area 0.0.0.0
  network 23.0.0.0 0.0.0.255
  network 22.0.0.0 0.0.0.255
  network 11.0.0.0 0.0.0.255
  network 1.1.1.1 0.0.0.0
#
return
[R1-Ethernet0/0/0]dis this
#
interface Ethernet0/0/0
 ip address 23.0.0.1 255.255.255.0
 ospf dr-priority 255
#
return
--------------------------------------------------
2. R2 配置
[R2-ospf-1]dis this
#
ospf 1 router-id 2.2.2.2
 area 0.0.0.0
  network 23.0.0.0 0.0.0.255
  network 2.2.2.2 0.0.0.0
#
return
<R2>dis ospf peer 

	 OSPF Process 1 with Router ID 2.2.2.2
		 Neighbors 

 Area 0.0.0.0 interface 23.0.0.2(Ethernet0/0/0)'s neighbors
 Router ID: 1.1.1.1          Address: 23.0.0.1        
   State: Full  Mode:Nbr is  Slave  Priority: 255
   DR: 23.0.0.1  BDR: 23.0.0.2  MTU: 0    
   Dead timer due in 28  sec 
   Retrans timer interval: 5 
   Neighbor is up for 00:01:42     
   Authentication Sequence: [ 0 ]
  DR\BDR不具备抢占机制，一旦选举成功，不故障就一直是此角色，因此修改设备优先级后需要重启设备，不要忘记save。

2.7 配置OSPF认证

企业由于安全需求，需要在R1和R2的互联链路上起OSPF的接口认证，要求使用MD5认证，密钥为huawei；

1. R2配置：
[R2-ospf-1-area-0.0.0.0]dis this
#
 area 0.0.0.0
  authentication-mode md5 1 cipher IaK"M{,MlC;BH^68NhwOt9-#
  network 23.0.0.0 0.0.0.255
  network 2.2.2.2 0.0.0.0
#
return
--------------------------------------------------
2. R1 配置：
[R1-ospf-1-area-0.0.0.0]dis this
#
 area 0.0.0.0
  authentication-mode md5 1 cipher {N^NHIvq>:pe}@HMNPn@>:a#
  network 23.0.0.0 0.0.0.255
  network 22.0.0.0 0.0.0.255
  network 11.0.0.0 0.0.0.255
  network 1.1.1.1 0.0.0.0
#
return

2.8 联通性测试

PC1和PC2都能Ping通R2的loopback0地址；

2.9 R1和R2设备配置远程登陆

R1 和 R2 设备配置远程登陆，采用明文密码验证，密码为 huawei ；并且要求 R2 设备配置成网络中的 FTP 服务器，用户名为 huawei ，密码为huawei123；

1. R1配置
[R1]telnet server enable
[R1-ui-vty0-4]dis this
#
user-interface con 0
user-interface vty 0 4
 set authentication password simple huawei
user-interface vty 16 20
#
return
--------------------------------------------------
2. R2配置
[R2]telnet server enable
[R2]ftp server enable
[R2]user-interface vty 0 4
[R2-ui-vty0-4]dis this
#
user-interface con 0
user-interface vty 0 4
 set authentication password simple huawei
user-interface vty 16 20
#
return
[R2]aaa
[R2-aaa]dis this
#
aaa
 authentication-scheme default
 authorization-scheme default
 accounting-scheme default
 domain default
 domain default_admin
 local-user admin password cipher lFk-5|VYA%@X,k6.E\Z,F.{#
 local-user admin service-type http
 local-user huawei password cipher ds+E&Z4P=6C-"-B>~\[S`Dq#
 local-user huawei ftp-directory flash:
 local-user huawei service-type ftp
#
return

验证：