HCIA期末实验

一.实验要求

（设备名称按照拓扑标识修改，注意区分大小写）
1、ISP路由器仅配置IP地址
2、test-1和test-2仅作为代替终端设备进行测试使用，路由采用静态路由
3、R1/R2之间使用OSPF做到内网全通，单区域，OSPF使用一条命令进行宣告（直接宣告192.168.1.0网段）；router-ID分别为1.1.1.1和2.2.2.2；OSPF进程为1
4、PC1-PC4使用DHCP获取地址，地址池名称使用1，2
5、PC1不能访问PC5，acl编号为3000
6、R2出口只拥有一个公网IP
7、test-1设备可以登录内网telnet服务器，test-2不行；acl编号为3000
8、telnet服务器的账号密码为huawei/123456
9、内网用户可以正常访问ISP（边界做默认路由）
10、公网设备的路由表不能有私网的路由，使用nat（acl编号为2000）
11、内网设备的路由表不能有公网的路由，边界下发默认路由
12、VLAN及IP规划查看附件材料（所有trunk链路按照最少VLAN透传原则放通）

二,附件资料

三,实验步骤

(1)划分网段(根据实验附件划分)

(2)配置VLAN

    LW1:
 
     <Huawei>sys
     Enter system view, return user view with Ctrl+Z.
     [Huawei]sys LW1    
     [LW1]user-interface console 0
     [LW1-ui-console0]idle-timeout 0 0
     [LW1-ui-console0]quit
     [LW1]vlan batch 2 3 4
     [LW1]int g0/0/2
     [LW1-GigabitEthernet0/0/2]port link-type access 
     [LW1-GigabitEthernet0/0/2]port default vlan 2
     [LW1-GigabitEthernet0/0/2]int g0/0/3
     [LW1-GigabitEthernet0/0/3]port link-type access 
     [LW1-GigabitEthernet0/0/3]port default vlan 3
     [LW1-GigabitEthernet0/0/3]int g0/0/4    
     [LW1-GigabitEthernet0/0/4]port link-type access     
     [LW1-GigabitEthernet0/0/4]port default vlan 4
     [LW1-GigabitEthernet0/0/4]int g0/0/1
     [LW1-GigabitEthernet0/0/1]port link-type trunk 
     [LW1-GigabitEthernet0/0/1]port trunk allow-pass vlan 2 3 4
    
 

  LW2:

     <Huawei>sys
     Enter system view, return user view with Ctrl+Z.
     [Huawei]sys LW2
     [LW2]user-interface console 0
     [LW2-ui-console0]idle-timeout 0 0
     [LW2-ui-console0]quit
     [LW2]vlan batch 20 30
     [LW2]int g0/0/2    
     [LW2-GigabitEthernet0/0/2]port link-type access 
     [LW2-GigabitEthernet0/0/2]port default vlan 20
     [LW2-GigabitEthernet0/0/2]int g0/0/3
     [LW2-GigabitEthernet0/0/3]port link-type access 
     [LW2-GigabitEthernet0/0/3]port default vlan 3
     [LW2-GigabitEthernet0/0/3]int g0/0/1
     [LW2-GigabitEthernet0/0/1]port link-type trunk 
     [LW2-GigabitEthernet0/0/1]port trunk allow-pass vlan 
     [LW2-GigabitEthernet0/0/1]port trunk allow-pass vlan 20 30
 

(3)R1 R2配置DHCP以及子接口

  R1:

     <Huawei>sys
     Enter system view, return user view with Ctrl+Z.
     [Huawei]sysname R1
     [R1]user-interface console 0
     [R1-ui-console0]i    
     [R1-ui-console0]idle-timeout 0 0
     [R1-ui-console0]int g0/0/0.1
     [R1-GigabitEthernet0/0/0.1]dot1q  termination vid 2
     [R1-GigabitEthernet0/0/0.1]ip address 192.168.1.30 27
     [R1-GigabitEthernet0/0/0.1]int g0/0/0.2
     [R1-GigabitEthernet0/0/0.2]dot1q termination vid 3
     [R1-GigabitEthernet0/0/0.2]ip address 192.168.1.62 27
     [R1-GigabitEthernet0/0/0.2]int g0/0/0.3
     [R1-GigabitEthernet0/0/0.3]dot1q termination vid 4
     [R1-GigabitEthernet0/0/0.3]ip address 192.168.1.158 27
     [R1-GigabitEthernet0/0/0.3]quit
     [R1]dhcp enable 
     [R1]ip pool 1
     [R1-ip-pool-1]network 192.168.1.0 mask 27
     [R1-ip-pool-1]gateway-list 192.168.1.30
     [R1-ip-pool-1]dns-list 8.8.8.8
     [R1-ip-pool-1]quit
     [R1]ip pool 2
     [R1-ip-pool-2]network 192.168.1.32 mask 27
     [R1-ip-pool-2]gateway-list 192.168.1.62
     [R1-ip-pool-2]dns-list 8.8.8.8
     [R1-ip-pool-2]quit
     [R1]int g0/0/0.1    
     [R1-GigabitEthernet0/0/0.1]dhcp select global 
     [R1-GigabitEthernet0/0/0.1]arp broadcast enable 
     [R1-GigabitEthernet0/0/0.1]int g0/0/0.2    
     [R1-GigabitEthernet0/0/0.2]dhcp select global 
     [R1-GigabitEthernet0/0/0.2]arp broadcast enable 
     [R1-GigabitEthernet0/0/0.2]int g0/0/0.3
     [R1-GigabitEthernet0/0/0.3]dhcp select global
     [R1-GigabitEthernet0/0/0.3]arp broadcast enable 

  R2:

     <Huawei>sys
     Enter system view, return user view with Ctrl+Z.
     [Huawei]sys R2
     [R2]user-interface console 0
     [R2-ui-console0]idle-timeout 0 0
     [R2-ui-console0]int g0/0/0.1    
     [R2-GigabitEthernet0/0/0.1]dot1q termination vid 20
     [R2-GigabitEthernet0/0/0.1]ip address 192.168.1.94 27
     [R2-GigabitEthernet0/0/0.1]int g0/0/0.2
     [R2-GigabitEthernet0/0/0.2]dot1q termination vid 30
     [R2-GigabitEthernet0/0/0.2]ip address 192.168.1.126 27
     [R2-GigabitEthernet0/0/0.2]quit
     [R2]dhcp enable 
     [R2]ip pool 1
     [R2-ip-pool-1]network 192.168.1.64 mask 27
     [R2-ip-pool-1]gateway-list 192.168.1.94
     [R2-ip-pool-1]dns-list 8.8.8.8
     [R2-ip-pool-1]quit
     [R2]ip pool 2    
     [R2-ip-pool-2]network 192.168.1.96 mask 27
     [R2-ip-pool-2]gateway-list 192.168.1.126
     [R2-ip-pool-2]dns-list 8.8.8.8
     [R2-ip-pool-2]quit
     [R2]int g0/0/0.1    
     [R2-GigabitEthernet0/0/0.1]dhcp select global 
     [R2-GigabitEthernet0/0/0.1]arp broadcast enable 
     [R2-GigabitEthernet0/0/0.1]int g0/0/0.2
     [R2-GigabitEthernet0/0/0.2]dhcp select global 
     [R2-GigabitEthernet0/0/0.2]arp broadcast enable 

(4)配置剩余路由器接口的IP地址(根据附件材料进行配置)

  R1: 

     [R1]int g0/0/1

     [R1-GigabitEthernet0/0/1]ip address 192.168.1.161 30

 R2: 

     [R2]int g0/0/1
     [R2-GigabitEthernet0/0/1]ip address 192.168.1.162 30
     [R2-GigabitEthernet0/0/1]int g0/0/2
     [R2-GigabitEthernet0/0/2]ip address 202.1.1.1 30

  test-1:
     <Huawei>sys
     Enter system view, return user view with Ctrl+Z.
     [Huawei]sys test-1
     [test-1]user-interface console 0
     [test-1-ui-console0]idle-timeout 0 0
     [test-1-ui-console0]quit
     [test-1]int g0/0/0
     [test-1-GigabitEthernet0/0/0]ip address 203.1.1.1 24

test-2:

     <Huawei>sys
     Enter system view, return user view with Ctrl+Z.
     [Huawei]sysname test-2
     [test-2]user-interface console 0
     [test-2-ui-console0]i    
     [test-2-ui-console0]idle-timeout 0 0
     [test-2-ui-console0]quit
     [test-2]int g0/0/0
     [test-2-GigabitEthernet0/0/0]ip address 203.1.1.2 24

Telent-Server:

     <Huawei>sys
     Enter system view, return user view with Ctrl+Z.
     [Huawei]sys Telnet Server
     [Telnet Server]user-interface console 0
     [Telnet Server-ui-console0]idle-timeout 0 0
     [Telnet Server-ui-console0]quit
     [Telnet Server]int g0/0/0
     [Telnet Server-GigabitEthernet0/0/0]ip address 192.168.1.129 27

LSP:

     <Huawei>sys
     Enter system view, return user view with Ctrl+Z.
     [Huawei]sys ISP
     [LSP]user-interface console 0
     [LSP-ui-console0]idle-timeout 0 0
     [LSP-ui-console0]quit
     [LSP]int g0/0/0
     [LSP-GigabitEthernet0/0/0]ip address 202.1.1.2 30
     [LSP-GigabitEthernet0/0/0]int g0/0/1
     [LSP-GigabitEthernet0/0/1]ip address 203.1.1.254 24

(5)配置R1与R2间的OSPF

R1:

     [R1]ospf 1 router-id 1.1.1.1

     [R1-ospf-1]area 0

     [R1-ospf-1-area-0.0.0.0]network 192.168.1.0 0.0.0.255

R2:

     [R2]ospf 1 router-id 2.2.2.2

     [R2-ospf-1]area 0

     [R2-ospf-1-area-0.0.0.0]network 192.168.1.0 0.0.0.255

(6)Telent服务器配置缺省路由

     [Telnet Server]ip route-static 0.0.0.0 0 192.168.1.158

(7)PC端通过DHCP获取IP地址

 

(8)在R2上配置缺省指向外网，并配置OSPF和配置NAT

     [R2]ip route-static 0.0.0.0 0 202.1.1.2
     [R2]ospf 1 router-id 2.2.2.2
     [R2-ospf-1]default-route-advertise
     [R2-ospf-1]quit
     [R2]acl 2000
     [R2-acl-basic-2000]rule permit source 192.168.1.0 0.0.0.255
     [R2-acl-basic-2000]quit
     [R2]int g0/0/2
     [R2-GigabitEthernet0/0/2]nat outbound 2000

(9)T-1 T-2配置静态路由:

 

test-1：   

     [test-1]ip route-static 202.1.1.0 30 203.1.1.254

     [test-1]

test-2：   

     [test-2]ip route-static 202.1.1.0 30 203.1.1.254

     [test-2]

(10)配置acl不让PC1访问PC5:

     [R1]acl 3000
     [R1-acl-adv-3000]rule deny icmp source 192.168.1.29 0 destination 203.1.1.100 0
     [R1-acl-adv-3000]quit
     [R1]int g0/0/0.1
     [R1-GigabitEthernet0/0/0.1]traffic-filter inbound acl 3000

(11)在telnet server路由器进行telnet配置:

     [Telnet Server]aaa
     [Telnet Server-aaa]local-user huawei password cipher 123456 privilege level 15
     [Telnet Server-aaa]local-user huawei service-type telnet
     [Telnet Server-aaa]quit
     [Telnet Server]user-interface vty 0 4
     [Telnet Server-ui-vty0-4]authentication-mode aaa

(12)配置端口映射:

R2:

     [R2]int g0/0/2
     [R2-GigabitEthernet0/0/2]nat server protocol tcp global current-interface 23 ins
     ide 192.168.1.129 23
     Are you sure to continue?[Y/N]:y

(13)配置ACL拒绝test-2的包:

LSP:

     [LSP]acl 3000
     [LSP-acl-adv-3000]
     [LSP-acl-adv-3000]rule deny tcp source 203.1.1.2 0 destination 202.1.1.1 0 desti
     nation-port eq 23
     [LSP-acl-adv-3000]quit
     [LSP]int g0/0/1
     [LSP-GigabitEthernet0/0/1]traffic-filter inbound acl 3000