基于某高校的园区网络综合实验（eNSP）

园区综合实验
构造网络拓扑图
 
1、首先配置sw1和sw2、sw3的vlan.
Sw1（允许vlan10通过）
 
Sw2（允许vlan10 20通过）
 
Sw3（允许vlan10 20通过）
 
2、配置fw3和fw4、sw4的vlan
Sw4
 
Fw3、Fw4
 
3、在sw1、sw2、sw3、sw5上配置stp
[sw1]stp region-configuration 
[sw1-mst-region]region-name simp
[sw1-mst-region]instance 1 vlan 10 21
[sw1-mst-region]active region-configuration
在四个交换机上是一样的配置
 
配置sw2为主根桥sw3为备份根桥
[sw2]stp instance 1 root primary 
[sw3]stp instance 1 root secondary 
 
 

此时sw1和sw5的g0/0/2接口都是阻塞状态，此时证明生成树的配置是没有问题的。
4、创建fw3和fw4的虚拟防火墙、并划分安全区域
[fw3]vsys enable
[fw3]vsys name xz
[fw3-vsys-xz]assign vlan 11
[fw3-vsys-xz]assign resource-class r0
[fw3]vsys name zj
[fw3-vsys-zj]assign vlan 12
[fw3-vsys-zj]assign resource-class r0
[fw3]vsys name sc
[fw3-vsys-sc]assign vlan 13
[fw3-vsys-sc]assign resource-class r0
[fw3]vsys name yf
[fw3-vsys-yf]assign vlan 14
[fw3-vsys-yf]assign resource-class r0
划分安全区域
Trust

Untrust
 
 
 
 
5、配置交换机sw2和sw3的vrrp
在sw2上创建虚拟接口
[sw2]interface Vlanif 10
[sw2-Vlanif10]ip address 192.168.10.252 24
[sw2]interface Vlanif 21
[sw2-Vlanif21]ip address 192.168.21.252 24
 
在sw3上创建虚拟接口
[sw3]interface Vlanif 10
[sw3-Vlanif10]ip address 192.168.10.253 24
[sw3]interface Vlanif 21
[sw3-Vlanif21]ip address 192.168.21.253 24
 
[sw2]interface Vlanif 10
[sw2-Vlanif10]vrrp vrid 10 virtual-ip 192.168.10.254
[sw2-Vlanif10]vrrp vrid 10 priority 150
 
[sw3]interface Vlanif 10
[sw3-Vlanif10]vrrp vrid 10 virtual-ip 192.168.10.254
 
[sw2]interface Vlanif 21
[sw2-Vlanif21]vrrp vrid 21 virtual-ip 192.168.21.254
[sw2-Vlanif21]vrrp vrid 21 priority 150
 
[sw3]interface Vlanif 21
[sw3-Vlanif21]vrrp vrid 21 virtual-ip 192.168.21.254
 
给dhcp服务的g0/0/0接口配置IP地址
[dhcp-server]interface GigabitEthernet 0/0/0
[dhcp-server-GigabitEthernet0/0/0]ip address 192.168.21.1 24
6、配置dhcp中继服务
[sw2]dhcp enable
[sw2]interface Vlanif 10
[sw2-Vlanif10]dhcp select relay 
[sw2-Vlanif10]dhcp relay server-ip 192.168.21.1
 
[sw3]dhcp enable
[sw3]interface Vlanif 10
[sw3-Vlanif10]dhcp select relay 
[sw3-Vlanif10]dhcp relay server-ip 192.168.21.1
 
配置一条前往DHCP网关的默认路由
[dhcp-server]ip route-static 0.0.0.0 0.0.0.0 192.168.21.254
[dhcp-server]dhcp enable       #开启dhcp服务
[dhcp-server]ip pool vlan10   #地址池
[dhcp-server-ip-pool-vlan10]network 192.168.10.0 mask 24   #宣告的地址段
[dhcp-server-ip-pool-vlan10]gateway-list 192.168.10.254  #网关
[dhcp-server-ip-pool-vlan10]dns-list 8.8.8.8      #子网掩码
[dhcp-server-ip-pool-vlan10]lease day 2     #有效期
[dhcp-server-ip-pool-vlan10]excluded-ip-address 192.168.10.200 192.168.10.253                                    #保留的地址
 
[dhcp-server]interface GigabitEthernet 0/0/0
[dhcp-server-GigabitEthernet0/0/0]dhcp select global   #在接口下调用地址池
此时pc1和pc2启用dhcp，显示已经分配了IP地址。
 
 
 [dhcp-server]dis ip pool name vlan10 used （此时显示已经用掉了2个地址）
 
7、配置防火墙的双机热备和负载均衡
Fw3配置四个部门的接口网关
 
Fw4配置四个部门的接口网关
 
配置fw3和fw4的心跳接口
[fw3]interface GigabitEthernet 1/0/2
[fw3-GigabitEthernet1/0/2]ip address 172.16.10.33 24
[fw4]interface GigabitEthernet 1/0/2
[fw4-GigabitEthernet1/0/2]ip address 172.16.10.44 24
将心跳接口加入安全区域dmz
[fw3]firewall zone dmz 
[fw3-zone-dmz]add interface GigabitEthernet 1/0/2
[fw4]firewall zone dmz 
[fw4-zone-dmz]add interface GigabitEthernet 1/0/2
将四个部门的vlanif接口加入trust区域
[fw3]switch vsys xz
[fw3-xz]firewall zone trust 
[fw3-xz-zone-trust]add interface Vlanif11
 
[fw3]switch vsys zj    
[fw3-zj]firewall zone trust 
[fw3-zj-zone-trust]add interface Vlanif12
 
[fw3]switch vsys sc    
[fw3-sc]firewall zone trust 
[fw3-sc-zone-trust]add interface Vlanif13
 
[fw3]switch vsys yf    
[fw3-yf]firewall zone trust 
[fw3-yf-zone-trust]add interface Vlanif14
 
配置fw3和fw4网关的主备，vlanif11、12在fw3上是主，vlanif13、14在fw4上是主网关
[fw3]interface Vlanif 11
[fw3-Vlanif11]vrrp vrid 11 virtual-ip 192.168.11.254 active 
[fw3]interface Vlanif 12
[fw3-Vlanif12]vrrp vrid 12 virtual-ip 192.168.12.254 active 
[fw3]interface Vlanif 13
[fw3-Vlanif13]vrrp vrid 13 virtual-ip 192.168.13.254 standby
[fw3]interface Vlanif 14
[fw3-Vlanif14]vrrp vrid 14 virtual-ip 192.168.14.254 standby
[fw4]interface Vlanif 11
[fw4-Vlanif11]vrrp vrid 11 virtual-ip 192.168.11.254 standby 
[fw4]interface Vlanif 12
[fw4-Vlanif12]vrrp vrid 12 virtual-ip 192.168.12.254 standby 
[fw4]interface Vlanif 13
[fw4-Vlanif13]vrrp vrid 13 virtual-ip 192.168.13.254 active
[fw4]interface Vlanif 14
[fw4-Vlanif14]vrrp vrid 14 virtual-ip 192.168.14.254 active
在防火墙3和4上开启双机热备服务
[fw3]hrp load balance device   #开启防火墙的双机热备