综合网络（华为ensp）

1、要求

下面为一般企业网络的结构、规划以及配置。
对内网部门划分vlan、无线配置、服务器的映射以及内网之间的互访都做了介绍。

1.各部门、服务器、无线都独立一个网段。
2.无线网络采用旁挂隧道模式。
3.无线网络不能访问公司内网资源、只允许上网。

2、拓扑图

3、命令

AC

sys 
sys AC1
vlan batch 10 100
dhcp enable
int vlan 10
ip address 192.168.10.1 24
dhcp select interface
q
int vlan 100
ip address 100.1.1.1 24
dhcp select interface
q
int g0/0/1
p l t
p t a v 10 100
q


wlan 
ap auth-mode mac-auth
regulatory-domain-profile name JT
q
ap-group name one
regulatory-domain-profile JT
y
q

ap-id 0 ap-mac 00E0-FCE8-2E40
ap-name AP1
ap-group one
y
q
ap-id 1 ap-mac 00E0-FC0B-3120
ap-name AP2
ap-group one
y
q

capwap source interface vlanif 100

wlan
ssid-profile name JT
ssid huawei
q
security-profile name JT
security wpa-wpa2 psk pass-phrase 123456789 aes
y
q
vap-profile name JT
forward-mode tunnel 
service-vlan vlan-id 10
ssid-profile JT
security-profile JT
q

ap-group name one
vap-profile JT wlan 1 radio 0
vap-profile JT wlan 1 radio 1
q
q
ip route-static 0.0.0.0 0 192.168.10.2

LSW1

sys
sys LSW1
vlan batch 10 20 30 40 100 1000
acl 2000
rule deny source 192.168.10.0 0.0.0.255 
q
dhcp enable
int vlan 10
ip ad 192.168.10.2 24
q
int vlan 20
ip ad 192.168.20.1 24
dhcp select interface
q
int vlan 30
ip ad 192.168.30.1 24
dhcp select interface
q
observe-port 1 interface GigabitEthernet 0/0/6
int vlan 40
ip ad 192.168.40.2 24
q
int vlan 1000
ip ad 11.1.1.1 24
q
int g0/0/1
p l a
p d v 1000
port-mirroring to observe-port 1 both 
q
int g0/0/2
p l t
p t a v 10 100
q
int g0/0/3
p l t
p t a v 20 100
q
int g0/0/4
p l t
p t a v 30 100
q
int g0/0/5
traffic-filter outbound  acl 2000
p l a
p d v 40
q
ip route-static 0.0.0.0 0 11.1.1.2
ip route-static 192.168.10.0 24 192.168.10.1
ip route-static 100.1.1.0 24 192.168.10.1
ip route-static 192.168.40.0 24 192.168.40.1

LSW2

sys
sys LSW2
vlan batch 20 100
int g0/0/1
p l t
p t a v 20 100
q
int g0/0/2
p l t
p t a v 100
p t p v 100
q
int g0/0/3
p l a
p d v 20
q

LSW3

sys
sys LSW3
vlan batch 30 100
int g0/0/1
p l t
p t a v 30 100
q
int g0/0/2
p l t
p t a v 100
p t p v 100
q
int g0/0/3
p l a
p d v 30
q

FW

sys 
sys FW2
int g1/0/0
ip ad 11.1.1.2 24
service-manage ping permit
q
int g1/0/1
ip ad 23.1.1.2 24
service-manage ping permit
q
firewall zone trust 
add interface GigabitEthernet 1/0/0
q
firewall zone untrust 
add interface GigabitEthernet 1/0/1
q
security-policy
rule name localtotrust
source-zone local 
destination-zone trust 
action permit 
q
rule name trusttolocal
source-zone trust
destination-zone local
action permit 
q
rule name localtountrust
source-zone local 
destination-zone untrust 
action permit 
q
rule name trusttountrust
source-zone trust
destination-zone untrust
action permit
q
rule name untrusttolocal
source-zone untrust
destination-zone local
action deny
q
rule name untrusttotrust
source-zone untrust 
destination-zone trust 
action deny 
q
q
nat-policy 
rule name nat
source-zone trust
source-address 192.168.0.0 16
destination-zone untrust 
action source-nat easy-ip 
q
q
nat server protocol tcp global 23.1.1.23 888 inside 192.168.40.1 80
ip route-static 0.0.0.0 0 23.1.1.1
ip route-static 11.1.1.0 24 11.1.1.1
ip route-static 192.168.0.0 16 11.1.1.1
ip route-static 100.1.1.0 24 11.1.1.1

AR1

sys
sys AR1
int g0/0/0
ip ad 23.1.1.1 24
q
int g0/0/1
ip ad 12.1.1.1 24
q
ip route-static 0.0.0.0 0 23.1.1.2
ip route-static 12.1.1.0 24 12.1.1.2

4、实验设计bug

服务器应另立DMZ区。
否则即使成功映射内网服务器，client也不能访问server，因为untrust不能访问trust区。