实验目的
增强分析和配置中小型企业网络的综合能力
实验内容
本实验模拟了一个企业网络场景, 其中R1和R2为公司总部路由器,交换机S1、S2、S3组成了总部的园区网,R3、R4、 R5为公司分部的路由器。 总部园区网中3台交换机都运行MSTP协议,用来防止二层冗余网络中的环路以及实现 不同VLAN间流量的负载分担,同时还配置了MSTP保护功能以提高网络的可靠性和安全性。 R1、R2、S2、S3运行IS-IS路协议,以实现总部网络的互通。S2和S3使用IS-IS 下发的缺省路由访问总部之外的网络。另外,为了提高网络的安全性,还需要配置IS-IS 认证功能。 R3、R4、R5运行OSPF路由协议,以实现公司分部网络的互通。总部与分部之间 通过BGP路由协议互通,同时需要通过修改BGP路由的属性来实现流量的负载分担。
实验拓补图
实验步骤
1.先配置好图中的IP地址和Loopback 0 接口
[r5]int LoopBack 0
[r5-LoopBack0]ip address 10.0.5.5 32
[r5-LoopBack0]int LoopBack 1
[r5-LoopBack1]ip address 20.0.5.5 32
[r5-LoopBack1]q
[r5]interface GigabitEthernet 0/0/0
[r5-GigabitEthernet0/0/0]ip address 10.0.35.5 24
[r5-GigabitEthernet0/0/0]interface GigabitEthernet 0/0/1
[r5-GigabitEthernet0/0/1]ip address 10.0.45.5 24
[r3]interface LoopBack 0
[r3-LoopBack0]ip address 10.0.4.4 32
[r3-LoopBack0]q
[r3]interface GigabitEthernet 0/0/0
[r3-GigabitEthernet0/0/0]ip address 10.0.35.3 24
[r3-GigabitEthernet0/0/0]interface GigabitEthernet 0/0/2
[r3-GigabitEthernet0/0/2]ip address 10.0.34.3 24
[r3-GigabitEthernet0/0/2]interface GigabitEthernet 0/0/1
[r3-GigabitEthernet0/0/1]ip address 10.0.13.3 24
[r4]interface LoopBack 0
[r4-LoopBack0]ip address 10.0.4.4 32
[r4-LoopBack0]q
[r4]interface GigabitEthernet 0/0/0
[r4-GigabitEthernet0/0/0]ip address 10.0.34.4 24
[r4-GigabitEthernet0/0/0]interface GigabitEthernet 0/0/1
[r4-GigabitEthernet0/0/1]ip address 10.0.45.4 24
[r4-GigabitEthernet0/0/1]interface GigabitEthernet 0/0/2
[r4-GigabitEthernet0/0/2]ip address 10.0.24.4 24
[r1]interface LoopBack 0
[r1-LoopBack0]ip address 10.0.1.1 24
[r1-LoopBack0]q
[r1]interface GigabitEthernet 0/0/1
[r1-GigabitEthernet0/0/1]ip address 10.0.13.1 24
[r1]interface GigabitEthernet 0/0/0
[r1-GigabitEthernet0/0/0]ip address 10.0.12.1 24
[r1-GigabitEthernet0/0/0]interface GigabitEthernet 0/0/2
[r1-GigabitEthernet0/0/2]ip address 10.0.17.1 24
[r1-GigabitEthernet0/0/2]interface GigabitEthernet 2/0/0
[r1-GigabitEthernet2/0/0]ip address 10.0.18.1 24
[r2]interface LoopBack 0
[r2-LoopBack0]ip address 10.0.2.2 32
[r2-LoopBack0]q
[r2]interface GigabitEthernet 0/0/2
[r2-GigabitEthernet0/0/2]ip address 10.0.24.2 24
[r2-GigabitEthernet0/0/2]interface GigabitEthernet 0/0/0
[r2-GigabitEthernet0/0/0]ip address 10.0.12.2 24
[r2-GigabitEthernet0/0/0]interface GigabitEthernet 0/0/1
[r2-GigabitEthernet0/0/1]ip address 10.0.28.2 24
[r2-GigabitEthernet0/0/1]interface GigabitEthernet 2/0/0
[r2-GigabitEthernet2/0/0]ip address 10.0.27.2 24
[s2]interface LoopBack 0
[s2-LoopBack0]ip address 10.0.7.7 32
[s2]vlan batch 71 72
[s2]interface Vlanif 71
[s2-Vlanif71]ip address 10.0.17.7 24
[s2-Vlanif71]interface Vlanif 72
[s2-Vlanif72]ip address 10.0.27.7 24
[s2]interface GigabitEthernet 0/0/4
[s2-GigabitEthernet0/0/4]port link-type access
[s2-GigabitEthernet0/0/4]port default vlan 72
[s2]interface GigabitEthernet 0/0/2
[s2-GigabitEthernet0/0/2]port link-type access
[s2-GigabitEthernet0/0/2]port default vlan 71
[s3]interface LoopBack 0
[s3-LoopBack0]ip address 10.0.8.8 32
[s3]vlan batch 81 82
[s3]interface Vlanif 81
[s3-Vlanif81]ip address 10.0.18.8 24
[s3-Vlanif81]interface Vlanif 82
[s3-Vlanif82]ip address 10.0.28.8 24
[s3]interface GigabitEthernet 0/0/1
[s3-GigabitEthernet0/0/1]port link-type access
[s3-GigabitEthernet0/0/1]port default vlan 82
[s3-GigabitEthernet0/0/1]interface GigabitEthernet 0/0/4
[s3-GigabitEthernet0/0/4]port link-type access
[s3-GigabitEthernet0/0/4]port default vlan 81
2.s1到s3都开始创建vlan {vlan batch 2 3 4 10 20 30 }
然后把相连的接口变为Trunk端口,允许其他vlan通行
[s1]interface GigabitEthernet 0/0/1
[s1-GigabitEthernet0/0/1]port link-type trunk
[s1-GigabitEthernet0/0/1]port trunk allow-pass vlan 2 3 10 20 30
[s1-GigabitEthernet0/0/1]interface GigabitEthernet 0/0/2
[s1-GigabitEthernet0/0/2]port link-type trunk
[s1-GigabitEthernet0/0/2]port trunk allow-pass vlan 2 3 10 20 30
[s2]interface GigabitEthernet 0/0/1
[s2-GigabitEthernet0/0/1]port link-type trunk
[s2-GigabitEthernet0/0/1]port trunk allow-pass vlan 2 3 10 20 30
[s2-GigabitEthernet0/0/1]interface GigabitEthernet 0/0/3
[s2-GigabitEthernet0/0/3]port link-type trunk
[s2-GigabitEthernet0/0/3]port trunk allow-pass vlan 2 3 10 20 30
[s3]interface GigabitEthernet 0/0/2
[s3-GigabitEthernet0/0/2]port link-type trunk
[s3-GigabitEthernet0/0/2]port trunk allow-pass vlan 2 3 10 20 30
[s3-GigabitEthernet0/0/2]interface GigabitEthernet 0/0/3
[s3-GigabitEthernet0/0/3]port link-type trunk
[s3-GigabitEthernet0/0/3]port trunk allow-pass vlan 2 3 10 20 30
3.将PC-1添加到VLAN2,PC-2添加到VLAN3
[s1]interface Ethernet 0/0/1
[s1-Ethernet0/0/1]port link-type access
[s1-Ethernet0/0/1]port default vlan 2
[s1-Ethernet0/0/1]interface Ethernet 0/0/2
[s1-Ethernet0/0/2]port link-type access
[s1-Ethernet0/0/2]port default vlan 3
可以测试一下
在S1上配置VLAN4为Super VLAN,VLANIF4的IP地址为70.1.30.2/24,并配置 Proxy ARP
[s1]vlan 4
[s1-vlan4]aggregate-vlan
[s1-vlan4]access-vlan 2 to 3
[s1-vlan4]interface Vlanif 4
[s1-Vlanif4]ip address 70.1.30.2 24
[s1-Vlanif4]arp-proxy inter-sub-vlan-proxy enable
4.配置MSTP模式,创建MSTP域RG
s1的配置
[s1]stp mode mstp
[s1]stp region-configuration
[s1-mst-region]region-name RG
[s1-mst-region]instance 1 vlan 2 3
[s1-mst-region]instance 2 vlan 10 20 30
[s1-mst-region]revision-level 1
[s1-mst-region]active region-configuration
s2的配置
[s2]stp mode mstp
[s2]stp region-configuration
[s2-mst-region]region-name RG
[[s2-mst-region]instance 1 vlan 2 3
[s2-mst-region]instance 2 vlan 10 20 30
[s2-mst-region]revision-level 1
[s2-mst-region]active region-configuration
[s2]stp instance 1 priority 0
[s2]stp instance 0 priority 0
s3的配置
[s3]stp mode mstp
[s3]stp region-configuration
[s3-mst-region]region-name RG
[s3-mst-region]instance 1 vlan 2 3
[s3-mst-region]instance 2 vlan 10 20 30
[s3-mst-region]revision-level 1
[s3-mst-region]active region-configuration
[s3]stp instance 2 priority 0
为了保证网络的稳定性,确保当由于链路拥塞或者单向链路故障导致交换机收不到 来自上游交换设备的BPDU时,不会产生临时环路,在S1上启用环路保护功能。
[s1]interface GigabitEthernet 0/0/1
[s1-GigabitEthernet0/0/1]stp loop-protection
[s1-GigabitEthernet0/0/1]interface GigabitEthernet 0/0/2
[s1-GigabitEthernet0/0/2]stp loop-protection
为了加快生成树的收敛速度,配置交换机S1的Ethernet 0/0/1和Ethernet 0/0/2为边 缘端口,并配置保护功能以防止这些端口因收到不合法的BPDU而影响生成树的计算
[s1]stp bpdu-protection
[s1]interface Ethernet 0/0/1
[s1-Ethernet0/0/1]stp edged-port enable
[s1-Ethernet0/0/1]interface Ethernet 0/0/2
[s1-Ethernet0/0/2]stp edged-port enable
5.开始配置IS-IS路由协议
公司总部内R1、R2、S2、S3运行IS-IS路由协议,并且都属于同一个区域,System ID由Loopback 0接口地址转换而得到
[s2]isis 1
[s2-isis-1]network-entity 49.0001.0100.0000.7007.00
[s2]interface Vlanif 71
[s2-Vlanif71]isis enable
[s2-Vlanif71]interface Vlanif 72
[s2-Vlanif72]isis enable
[s2-Vlanif72]interface LoopBack 0
[s2-LoopBack0]isis enable
[s3]isis 1
[s3-isis-1]network-entity 49.0001.0100.0000.8008.00
[s3-isis-1]interface Vlanif 81
[s3-Vlanif81]isis enable
[s3-Vlanif81]interface Vlanif 82
[s3-Vlanif82]isis enable
[s3-Vlanif82]interface LoopBack 0
[s3-LoopBack0]isis enable
[r1]isis 1
[r1-isis-1]network-entity 49.0001.0100.0000.1001.00
[r1-isis-1]interface GigabitEthernet 0/0/0
[r1-GigabitEthernet0/0/0]isis enable
[r1-GigabitEthernet0/0/0]interface GigabitEthernet 0/0/2
[r1-GigabitEthernet0/0/2]isis enable
[r1-GigabitEthernet0/0/2]interface GigabitEthernet 2/0/0
[r1-GigabitEthernet2/0/0]isis enable
[r1-GigabitEthernet2/0/0]interface loopback 0
[r1-LoopBack0]isis enable
[r2]isis 1
[r2-isis-1]network-entity 49.0001.0100.0000.2002.00
[r2-isis-1]interface GigabitEthernet 0/0/0
[r2-GigabitEthernet0/0/0]isis enable
[r2-GigabitEthernet0/0/0]interface GigabitEthernet 0/0/1
[r2-GigabitEthernet0/0/1]isis enable
[r2-GigabitEthernet0/0/1]interface GigabitEthernet 2/0/0
[r2-GigabitEthernet2/0/0]isis enable
[r2-GigabitEthernet2/0/0]interface loopback 0
[r2-LoopBack0]isis enable
配置vlan接口的IP地址,然后将用户网段引入IS-IS中,且对路由进行聚合
[s2]interface Vlanif 10
[s2-Vlanif10]ip address 70.1.10.1 24
[s2-Vlanif10]interface Vlanif 20
[s2-Vlanif20]ip address 70.1.20.1 24
[s2-Vlanif20]interface Vlanif 30
[s2-Vlanif30]ip address 70.1.30.1 24
[s3]interface Vlanif 10
[s3-Vlanif10]ip address 80.1.10.1 24
[s3-Vlanif10]interface Vlanif 20
[s3-Vlanif20]ip address 80.1.20.1 24
[s3-Vlanif20]interface Vlanif 30
[s3-Vlanif30]ip address 80.1.30.1 24
[s2] isis 1
[s2-isis-1]import-route direct
[s2-isis-1]summary 70.1.0.0 255.255.224.0
[s3]isis 1
[s3-isis-1]import-route direct
[s3-isis-1]summary 80.1.0.0 255.255.224.0
修改网络类型为p2p,避免选举DIS
[s2]interface Vlanif 71
[s2-Vlanif71]isis circuit-type p2p
[s2-Vlanif71]interface Vlanif 72
[s2-Vlanif72]isis circuit-type p2p
[s3]interface Vlanif 81
[s3-Vlanif81]isis circuit-type p2p
[s3-Vlanif81]interface Vlanif 82
[s3-Vlanif82]isis circuit-type p2p
[r1]interface GigabitEthernet 0/0/0
[r1-GigabitEthernet0/0/0]isis circuit-type p2p
[r1-GigabitEthernet0/0/0]interface GigabitEthernet 0/0/2
[r1-GigabitEthernet0/0/2]isis circuit-type p2p
[r1-GigabitEthernet0/0/2]interface GigabitEthernet 2/0/0
[r1-GigabitEthernet2/0/0]isis circuit-type p2p
[r2]interface GigabitEthernet 0/0/0
[r2-GigabitEthernet0/0/0]isis circuit-type p2p
[r2-GigabitEthernet0/0/0]interface GigabitEthernet 0/0/1
[r2-GigabitEthernet0/0/1]isis circuit-type p2p
[r2-GigabitEthernet0/0/1]interface GigabitEthernet 2/0/0
[r2-GigabitEthernet2/0/0]isis circuit-type p2p
S2和S3不运行BGP路由协议,所以为了使S2和S3能够访问外网,需要在路由器 RI和R2上配置IS-IS下发缺省路由。
[r1]isis 1
[r1-isis-1]default-route-advertise
[r2]isis 1
[r2-isis-1]default-route-advertise
为了提高网络安全性,R1、R2、S2、S3均需要相互通过认证后才能交换IS-IS路由 信息。配置认证模式为MD5认证,密钥为huawei
[s2]isis 1
[s2-isis-1]area-authentication-mode md5 huawei
[s3]isis 1
[s3-isis-1]area-authentication-mode md5 huawei
[r1]isis 1
[r1-isis-1]area-authentication-mode md5 huawei
[r2]isis 1
[r2-isis-1]area-authentication-mode md5 huawei
6.配置OSPF路由协议
[r3]ospf router-id 10.0.3.3
[r3-ospf-1]area 0
[r3-ospf-1-area-0.0.0.0]network 10.0.35.0 0.0.0.255
[r3-ospf-1-area-0.0.0.0]network 10.0.34.0 0.0.0.255
[r3-ospf-1-area-0.0.0.0]network 10.0.3.3 0.0.0.0
[r4]ospf router-id 10.0.4.4
[r4-ospf-1]area 0
[r4-ospf-1-area-0.0.0.0]network 10.0.45.0 0.0.0.255
[r4-ospf-1-area-0.0.0.0]network 10.0.34.0 0.0.0.255
[r4-ospf-1-area-0.0.0.0]network 10.0.4.4 0.0.0.0
[r5]ospf router-id 10.0.5.5
[r5-ospf-1]area 0
[r5-ospf-1-area-0.0.0.0]network 10.0.35.0 0.0.0.255
[r5-ospf-1-area-0.0.0.0]network 10.0.45.0 0.0.0.255
[r5-ospf-1-area-0.0.0.0]network 10.0.5.5 0.0.0.0
[r5-ospf-1-area-0.0.0.0]network 20.0.5.5 0.0.0.0
7.配置BGP协议
[r1]router id 10.0.1.1
[r1]bgp 100
[r1-bgp]peer 10.0.13.3 as-number 200
[r1-bgp]peer 10.0.2.2 as-number 100
[r1-bgp]peer 10.0.2.2 connect-interface LoopBack 0
[r2]router id 10.0.2.2
[r2]bgp 100
[r2-bgp]peer 10.0.24.4 as-number 200
[r2-bgp]peer 10.0.1.1 as-number 100
[r2-bgp]peer 10.0.1.1 connect-interface LoopBack 0
[r3]bgp 200
[r3-bgp]peer 10.0.13.1 as-number 100
[r3-bgp]peer 10.0.4.4 as-number 200
[r3-bgp]peer 10.0.5.5 as-number 200
[r3-bgp]peer 10.0.5.5 connect-interface LoopBack 0
[r3-bgp]peer 10.0.4.4 connect-interface LoopBack 0
[r4]bgp 200
[r4-bgp]peer 10.0.24.2 as-number 100
[r4-bgp]peer 10.0.3.3 as-number 200
[r4-bgp]peer 10.0.5.5 as-number 200
[r4-bgp]peer 10.0.5.5 connect-interface LoopBack 0
[r4-bgp]peer 10.0.3.3 connect-interface LoopBack 0
[r5]bgp 200
[r5-bgp]peer 10.0.3.3 as-number 200
[r5-bgp]peer 10.0.4.4 as-number 200
[r5-bgp]peer 10.0.4.4 connect-interface LoopBack 0
[r5-bgp]peer 10.0.3.3 connect-interface LoopBack 0
为了将公司总部的路由信息通告给公司分部,在Rl和R2上同时将IS-IS的路由信 息引进BGP进程。
[r1]bgp 100
[r1-bgp]import-route isis 1
[r2]bgp 100
[r2-bgp]import-route isis 1
[r3]bgp 200
[r3-bgp]import-route direct
[r4]bgp 200
[r4-bgp]import-route direct
[r1]bgp 100
[r1-bgp]import-route isis 1 med 0
[r2]bgp 100
[r2-bgp]import-route isis 1 med 0
[r3]bgp 200
[r3-bgp]import-route ospf 1
[r4]bgp 200
[r4-bgp]import-route ospf 1
考虑到公司后续问题,把r3配置为BGP路由反射器
[r3]bgp 200
[r3-bgp]peer 10.0.4.4 reflect-client
[r3-bgp]peer 10.0.5.5 reflect-client
8.开始配置策略
[r1]acl 2001
[r1-acl-basic-2001]rule permit source 10.0.13.0 0
[r1-acl-basic-2001]route-policy isis permit node 10
[r1-route-policy]if-match acl 2001
[r1-route-policy]isis 1
[r1-isis-1]default-route-advertise route-policy isis
[r2]acl 2001
[r2-acl-basic-2001]rule permit source 10.0.24.0 0
[r2-acl-basic-2001]route-policy isis permit node 10
[r2-route-policy]if-match acl 2001
[r2-route-policy]isis 1
[r2-isis-1]default-route-advertise route-policy isis
为了实现从R5去往总部的流量能够负载分担,在R5上修改BGP路由的Local Preference属性,从而保证R5通过R3去访问S2所连接的总部用户网段,通过R4去访 问S3所连接的总部用户网段
[r5]acl 2001
[r5-acl-basic-2001]rule permit source 80.1.0.0 0.0.31.255
[r5]route-policy fuzai permit node 10
[r5-route-policy]if-match acl 2001
[r5-route-policy]apply local-preference 200
[r5-route-policy]route-policy fuzai permit node 20
[r5-route-policy]bgp 200
[r5-bgp]peer 10.0.4.4 route-policy fuzai import
改BGP路由的团体属性为No-Export
[r3]acl 2002
[r3-acl-basic-2002]rule permit source 20.0.5.5 0
[r3-acl-basic-2002]quit
[r3]route-policy 1 permit node 10
[r3-route-policy]if-match acl 2002
[r3-route-policy]apply community no-export
[r3-route-policy]route-policy 1 permit node 20
[r3-route-policy]bgp 200
[r3-bgp]peer 10.0.13.1 route-policy 1 export
[r3-bgp]peer 10.0.13.1 advertise-community
[r4]acl 2002
[r4-acl-basic-2002]rule permit source 20.0.5.5 0
[r4-acl-basic-2002]quit
[r4]route-policy 1 permit node 10
[r4-route-policy]if-match acl 2002
[r4-route-policy]apply community no-export
[r4-route-policy]route-policy 1 permit node 20
[r4-route-policy]bgp 200
[r4-bgp]peer 10.0.24.2 route-policy 1 export
[r4-bgp]peer 10.0.24.2 advertise-community