1.使用172.16.0.0/16 划分网段:
四个广播域,划分四段:
172.16.0.0/18
172.16.64.0/18
172.16.128.0/18
172.16.192.0/18
2.ospf 协议合理规划区域并保证更新安全
配置IP:
[r7]int g0/0/0
[r7-GigabitEthernet0/0/0]ip address 11.1.1.1 24
Nov 28 2022 15:52:53-08:00 r7 %%01IFNET/4/LINK_STATE(l)[0]:The line protocol IP
on the interface GigabitEthernet0/0/0 has entered the UP state.
[r7-GigabitEthernet0/0/0]int g0/0/1
[r7-GigabitEthernet0/0/1]ip address 10.1.1.1 24
[r6]int g0/0/0
[r6-GigabitEthernet0/0/0]ip address 10.1.1.2 24
Nov 28 2022 15:54:46-08:00 r6 %%01IFNET/4/LINK_STATE(l)[0]:The line protocol IP
on the interface GigabitEthernet0/0/0 has entered the UP state.
[r6-GigabitEthernet0/0/0]int g0/0/1
[r6-GigabitEthernet0/0/1]ip address 172.16.1.1 18
Nov 28 2022 15:55:04-08:00 r6 %%01IFNET/4/LINK_STATE(l)[1]:The line protocol IP
on the interface GigabitEthernet0/0/1 has entered the UP state.
[r1]int g0/0/0
[r1-GigabitEthernet0/0/0]ip address 172.16.1.2 18
Nov 28 2022 15:55:48-08:00 r1 %%01IFNET/4/LINK_STATE(l)[0]:The line protocol IP
on the interface GigabitEthernet0/0/0 has entered the UP state.
[r1-GigabitEthernet0/0/0]int g0/0/1
[r1-GigabitEthernet0/0/1]ip address 172.16.64.1 18
Nov 28 2022 15:56:22-08:00 r1 %%01IFNET/4/LINK_STATE(l)[1]:The line protocol IP
on the interface GigabitEthernet0/0/1 has entered the UP state.
[r2]int g0/0/0
[r2-GigabitEthernet0/0/0]ip address 172.16.64.2 18
Nov 28 2022 15:58:11-08:00 r2 %%01IFNET/4/LINK_STATE(l)[0]:The line protocol IP
on the interface GigabitEthernet0/0/0 has entered the UP state.
[r2-GigabitEthernet0/0/0]int g0/0/1
[r2-GigabitEthernet0/0/1]ip address 172.16.128.1 18
Nov 28 2022 15:58:36-08:00 r2 %%01IFNET/4/LINK_STATE(l)[1]:The line protocol IP
on the interface GigabitEthernet0/0/1 has entered the UP state.
[r3]int g0/0/0
[r3-GigabitEthernet0/0/0]ip address 172.16.64.3 18
Nov 28 2022 15:59:09-08:00 r3 %%01IFNET/4/LINK_STATE(l)[0]:The line protocol IP
on the interface GigabitEthernet0/0/0 has entered the UP state.
[r3-GigabitEthernet0/0/0]int g0/0/1
[r3-GigabitEthernet0/0/1]ip address 172.16.193.1 18
Nov 28 2022 15:59:29-08:00 r3 %%01IFNET/4/LINK_STATE(l)[1]:The line protocol IP
on the interface GigabitEthernet0/0/1 has entered the UP state.
[r8]int g0/0/0
[r8-GigabitEthernet0/0/0]ip address 172.16.128.2 18
Nov 28 2022 16:00:18-08:00 r8 %%01IFNET/4/LINK_STATE(l)[0]:The line protocol IP
on the interface GigabitEthernet0/0/0 has entered the UP state.
[r4]int g0/0/0
[r4-GigabitEthernet0/0/0]ip address 172.16.193.2 18
Nov 28 2022 16:00:46-08:00 r4 %%01IFNET/4/LINK_STATE(l)[0]:The line protocol IP
on the interface GigabitEthernet0/0/0 has entered the UP state.
ospf宣告:
[r6]ospf 1 router-id 6.6.6.6
[r6-ospf-1]area 1
[r6-ospf-1-area-0.0.0.1]network 172.16.1.0 0.0.63.255
[r1]ospf 1 router-id 1.1.1.1
[r1-ospf-1]area 1
[r1-ospf-1-area-0.0.0.1]network 172.16.1.0 0.0.63.255
[r1-ospf-1]area 0
[r1-ospf-1-area-0.0.0.0]network 172.16.64.0 0.0.63.255
[r2]ospf 1 router-id 2.2.2.2
[r2-ospf-1]area 0
[r2-ospf-1-area-0.0.0.0]network 172.16.64.0 0.0.63.255
[r2-ospf-1]area 2
[r2-ospf-1-area-0.0.0.2]network 172.16.128.0 0.0.63.255
........
保证更新安全:
明文加密:
[r1-GigabitEthernet0/0/0]int g0/0/1
[r1-GigabitEthernet0/0/1]ospf authentication-mode simple cipher 123
(对应接口都要配)
密文加密:
[r2-GigabitEthernet0/0/0]int g0/0/1
[r2-GigabitEthernet0/0/1]ospf authentication-mode simple cipher 123
[r2-GigabitEthernet0/0/1]ospf authentication-mode md5
(对应接口都要配)
3.加快收敛速度
[r6]interface g0/0/0
[r6-GigabitEthernet0/0/0]ospf timer hello 5
[r1]int g0/0/1
[r1-GigabitEthernet0/0/1]ospf timer hello 5
.......
(每个接口都配)
4.router1为DR没有BDR:
[r1]int g0/0/0
[r1-GigabitEthernet0/0/0]ospf dr-priority 0
(除router1 以外接口都配)
[r1]display ospf peer
OSPF Process 1 with Router ID 1.1.1.1
Neighbors
Area 0.0.0.0 interface 172.16.64.1(GigabitEthernet0/0/1)'s neighbors
Router ID: 2.2.2.2 Address: 172.16.64.2
State: Full Mode:Nbr is Master Priority: 0
DR: 172.16.64.1 BDR: None MTU: 0
Dead timer due in 18 sec
Retrans timer interval: 5
Neighbor is up for 00:03:15
Authentication Sequence: [ 0 ]
Router ID: 3.3.3.3 Address: 172.16.64.3
State: Full Mode:Nbr is Master Priority: 0
DR: 172.16.64.1 BDR: None MTU: 0
Dead timer due in 18 sec
Retrans timer interval: 5
Neighbor is up for 00:02:55
Authentication Sequence: [ 0 ]
5.pc2345自动获取ip地址:
[r8]int g0/0/1.1
[r8-GigabitEthernet0/0/1.1]dot1q termination vid 2
[r8-GigabitEthernet0/0/1.1]ip address 192.168.1.2 24
[r8]dhcp enable
Info: The operation may take a few seconds. Please wait for a moment.done.
[r8]ip p 2
Info: It's successful to create an IP address pool.
[r8-ip-pool-2]network 192.168.1.0 mask 24
[r8-ip-pool-2]gateway-list 192.168.1.1
[r8-ip-pool-2]dns-list 8.8.8.8 114.114.114.114
[r8-ip-pool-2]qu
[r8]int g0/0/1.1
[r8-GigabitEthernet0/0/1.1]dhcp select global
[r8]int g0/0/1.2
[r8-GigabitEthernet0/0/1.2]dot1q termination vid 3
[r8-GigabitEthernet0/0/1.2]ip address 192.168.2.1 24
[r8]int g0/0/1.2
[r8-GigabitEthernet0/0/1.2]dot1q termination vid 3
[r8-GigabitEthernet0/0/1.2]ip address 192.168.2.1 24
Nov 28 2022 15:01:48-08:00 r8 %%01IFNET/4/LINK_STATE(l)[3]:The line protocol IP
on the interface GigabitEthernet0/0/1.2 has entered the UP state.
[r8-GigabitEthernet0/0/1.2]qu
[r8]ip p 3
[r8-ip-pool-3]network 192.168.2.0 mask 24
[r8-ip-pool-3]gateway-list 192.168.2.1
[r8-ip-pool-3]dns-list 8.8.8.8 114.114.114.114
[r8-ip-pool-3]qu
[r8]interface g0/0/1.2
[r8-GigabitEthernet0/0/1.2]dhcp select global
[L2]vlan batch 2 3
Info: This operation may take a few seconds. Please wait for a moment...done.
[L2]interface e0/0/2
[L2-Ethernet0/0/2]port link-type access
[L2-Ethernet0/0/2]port default vlan 2
[L2-Ethernet0/0/2]int e0/0/3
[L2-Ethernet0/0/3]port link-type access
[L2-Ethernet0/0/3]port default vlan 3
[L2-Ethernet0/0/3]int e0/0/1
[L2-Ethernet0/0/1]port link-type trunk
[L2-Ethernet0/0/1]port trunk allow-pass vlan all
[r4]int g0/0/1.1
[r4-GigabitEthernet0/0/1.1]dot1q termination vid 4
[r4-GigabitEthernet0/0/1.1]ip address 192.168.3.1 24
Nov 28 2022 15:18:22-08:00 r4 %%01IFNET/4/LINK_STATE(l)[0]:The line protocol IP
on the interface GigabitEthernet0/0/1.1 has entered the UP state.
[r4-GigabitEthernet0/0/1.1]int g0/0/1.2
[r4-GigabitEthernet0/0/1.2]dot1q termination vid 5
[r4-GigabitEthernet0/0/1.2]ip address 192.168.4.1 24
Nov 28 2022 15:18:59-08:00 r4 %%01IFNET/4/LINK_STATE(l)[1]:The line protocol IP
on the interface GigabitEthernet0/0/1.2 has entered the UP state.
[r4-GigabitEthernet0/0/1.2]qu
[r4]ip p 4
Info: It's successful to create an IP address pool.
[r4-ip-pool-4]network 192.168.3.0 mask 24
[r4-ip-pool-4]gateway-list 192.168.3.1
[r4-ip-pool-4]dns-list 8.8.8.8 114.114.114.114
[r4-ip-pool-4]ip p 5
Info: It's successful to create an IP address pool.
[r4-ip-pool-5]network 192.168.4.0 mask 24
[r4-ip-pool-5]gateway-list 192.168.4.1
[r4-ip-pool-5]dns-list 8.8.8.8 114.114.114.114
[r4-ip-pool-5]qu
[r4]dhcp enable
Info: The operation may take a few seconds. Please wait for a moment.done.
[r4]int g0/0/1.1
[r4-GigabitEthernet0/0/1.1]dhcp select global
[r4-GigabitEthernet0/0/1.1]int g0/0/1.2
[r4-GigabitEthernet0/0/1.2]dhcp select global
[L3]vlan batch 4 5
Info: This operation may take a few seconds. Please wait for a moment...done.
[L3]int e0/0/2
[L3-Ethernet0/0/2]port link-type access
[L3-Ethernet0/0/2]port default vlan 4
[L3-Ethernet0/0/2]int e0/0/3
[L3-Ethernet0/0/3]port link-type access
[L3-Ethernet0/0/3]port default vlan 5
[L3-Ethernet0/0/3]int e0/0/1
[L3-Ethernet0/0/1]port link-type trunk
[L3-Ethernet0/0/1]port trunk allow-pass vlan all
pc1 为外网要求可以互相访问:
[r6]ospf 1 router-id 6.6.6.6
[r6-ospf-1]default-route-advertise always
[r6]interface g0/0/0
[r6-GigabitEthernet0/0/0]traffic-filter outbound acl 2000
6.router7为运营商只能配ip
[r7]int g0/0/0
[r7-GigabitEthernet0/0/0]ip address 11.1.1.1 24
Nov 28 2022 15:52:53-08:00 r7 %%01IFNET/4/LINK_STATE(l)[0]:The line protocol IP
on the interface GigabitEthernet0/0/0 has entered the UP state.
[r7-GigabitEthernet0/0/0]int g0/0/1
[r7-GigabitEthernet0/0/1]ip address 10.1.1.1 24
Nov 28 2022 15:53:10-08:00 r7 %%01IFNET/4/LINK_STATE(l)[1]:The line protocol IP
on the interface GigabitEthernet0/0/1 has entered the UP state.
7. pass(不做)
8.pc4能ping同router6但不能登录:
[r6]acl 3000
[r6-acl-adv-3000]rule deny tcp source 172.16.1.1 0.0.0.0 destination 192.168.3.254 0.0.0.0 destination-port eq 23
[r6]int g0/0/1
[r6-GigabitEthernet0/0/1]traffic-filter inbound acl 3000
9.pc3可以ping通pc5 但pc5不能ping通pc3:
[r4]acl 3000
[r4-acl-adv-3000]rule deny icmp source 192.168.4.254 0.0.0.0 destination 192.168.1.254 0.0.0.0 icmp-type echo
[r4]interface g0/0/1
[r4-GigabitEthernet0/0/1]traffic-filter inbound acl 3000