- 实验要求
1、R6为ISP(互联网提供商),接口IP地址均为公有地址,该设备只能配置I地址,之后不能再对其进行任何配置
2、R1-R5为局域网,私有IP地址192.168.1.0/24,请合理分配;
3、R1、R2、R4,各有两个环回IP地址;R5,R6各有一个环回地址;所有路由器上环回均代表连接用户的接口,
4、R3下面的两台PC通过DHCP自动获取IP地址;
5、选路最佳,路由表尽量小,避免环路;
6、R1-R5均可以访问R6的环回;
7、在R1上配置te1net服务,使R6能通过R5的公有地址te1net到R1上;
7、R4与R5正常通过1000M链路,故障时通过100m链路;
- 实验top
- 实验思路
- 实现内网全网通
- 确定端口ip:
R[1]: E0端口:192.168.1.1 30
E1端口:192.168.1.5 30
环回口0:192.168.1.33 28
环回口1:192.168.1.49 28
R[2]: E0端口:192.168.1.2 30
E1端口:192.168.1.9 30
环回口0:192.168.1.65 28
环回口1:192.168.1.81 28
R[3]: E0端口:192.168.1.13 30
E1端口:192.168.1.6 30
G0端口:192.168.1.97 27
R[4]: E0端口:192.168.1.10 30
E1端口:192.168.1.14 30
G0端口:192.168.1.21 30
G1端口:192.168.1.17 30
环回口0:192.168.1.129 28
环回口1:192.168.1.145 28
R[5]: E1端口:192.168.1.22 30
E0端口:192.168.1.18 30
G0端口:12.0.0.1 24
环回口0:192.168.1.161 27
R[6]: E0端口:12.0.0.2 24
环回口:1.1.1.1 24
- 配IP地址与环回地址
- 配协议:
- DHCP(自动发地址给客户)
- 路由协议(静、动)
4.防环
- 连接外网
- 配缺省
- 根据题意要求实现步骤
a)要求6(要求6私网数据走向公网):做NAT
b)要求7:做telent服务
c)要求8:更改线路优先级
- 实验步骤
- 配ip地址环回地址:进接口配,配完记得查表
命令:a.ip:进接口:int g……
配ip:ip add ……
R1:
[R1]int e0/0/0
[R1-Ethernet0/0/0]ip add 192.168.1.1 30
[R1]int e0/0/1
[R1-Ethernet0/0/1]ip add 192.168.1.5 30
R2:
[R2]int e0/0/0
[R2-Ethernet0/0/0]ip add 192.168.1.2 30
[R2-Ethernet0/0/0]int e0/0/1
[R2-Ethernet0/0/1]ip add 192.168.1.9 30
R3:
[R3]int e0/0/0
[R3-Ethernet0/0/0]ip add 192.168.1.13 30
[R3-Ethernet0/0/0]int e0/0/1
[R3-Ethernet0/0/1]ip add 192.168.1.6 30
[R3-Ethernet0/0/1]int g0/0/0
[R3-GigabitEthernet0/0/0]ip add 192.168.1.97 27
R4:
[R4]int e0/0/0
[R4-Ethernet0/0/0]ip address 192.168.1.10 30
[R4-Ethernet0/0/0]int e0/0/1
[R4-Ethernet0/0/1]ip add 192.168.1.14 30
[R4-Ethernet0/0/1]int g0/0/0
[R4-GigabitEthernet0/0/0]ip add 192.168.1.21 30
[R4-GigabitEthernet0/0/0]int g0/0/1
[R4-GigabitEthernet0/0/1]ip add 192.168.1.17 30
R5:
[R5]int e0/0/1
[R5-Ethernet0/0/1]ip add 192.168.1.22 30
[R5-Ethernet0/0/1]int e0/0/0
[R5-Ethernet0/0/0]ip add 92.168.1.18 30
[R5-Ethernet0/0/0]int g0/0/0
[R5-GigabitEthernet0/0/0]ip add 12.0.0.1 24
R6:
[R6]int e0/0/0
[R6-Ethernet0/0/0]ip add 12.0.0.2 24
b.环回:进虚拟接口:int l0
配ip:ip add ……
R1:
[R1]int LoopBack 0
[R1-LoopBack0]ip add 192.168.1.33 28
[R1-LoopBack0]int LoopBack 1
[R1-LoopBack1]ip add 192.168.1.49 28
R2:
[R2]int LoopBack 0
[R2-LoopBack0]ip add 192.168.1.65 28
[R2-LoopBack0]int LoopBack 1
[R2-LoopBack1]ip add 192.168.1.81 28
R4:
[R4]int LoopBack 0
[R4-LoopBack0]ip add 192.168.1.129 28
[R4-LoopBack0]int LoopBack 1
[R4-LoopBack1]ip add 192.168.1.145 28
R5:
[R5]int LoopBack 0
[R5-LoopBack0]ip add 192.168.1.161 27
R6:
[R6]int LoopBack 0
[R6-LoopBack0]ip add 12.0.0.2 24
Error: The specified address conflicts with another address.
[R6-LoopBack0]ip add 1.1.1.1 24
c.查表:display ip interface brief
R1:
R2
R3
R4
R5
R6
-
- 配DHCP:
- 打开DHCP:dhcp enable
- 创建地址池:ip pool aa
- 在地址池中放入网段:network ……(网段) mask……
- 在地址池中设网关:gateway-list……(设为网关的地址不加掩码((此中为top:端口G0)))
- 配NDS:dns-list 8.8.8.8(全球通) 114.114.114.114(全球通)
- 进入接口发放地址池:int g……
- 配DHCP:
dhcp select global
[R3]ip pool bb
[R3-ip-pool-bb]network 192.168.1.96 mask 27
[R3-ip-pool-bb]gateway-list 192.168.1.97
[R3-ip-pool-bb]dns-list 8.8.8.8
[R3-ip-pool-bb]int g0/0/0
[R3-GigabitEthernet0/0/0]dhcp select global
- 测试:进入PC端命令行输入:ipconfig
PC1:
PC>ipconfig
PC2:
PC>ipconfig
-
- 配路由(此题选静态)
- R1到R5静态路由命令,不只只有端口记得配环回(注:在R4去往R5的环回上有两条路由线所以R4上要把这两条线都写上):ip route-static目标(有掩码) 下一跳(无掩码);(此题目标用大网段易于防环)
- 配路由(此题选静态)
R1:
[R1]ip route-static 192.168.1.8 30 192.168.1.2
[R1]ip route-static 192.168.1.128 27 192.168.1.2
[R1]ip route-static 192.168.1.12 30 192.168.1.6
[R1]ip route-static 192.168.1.20 30 192.168.1.2
[R1]ip route-static 192.168.1.20 30 192.168.1.6
[R1]ip route-static 192.168.1.16 30 192.168.1.6
[R1]ip route-static 192.168.1.16 30 192.168.1.2
[R1]ip route-static 192.168.1.160 27 192.168.1.6
[R1]ip route-static 192.168.1.160 27 192.168.1.2
[R1]ip route-static 192.168.1.64 27 198.168.1.2
[R1]ip route-static 192.168.1.96 27 198.168.1.6
[R1]ip route-static 192.168.1.128 27 198.168.1.6
R2:
[R2]ip route-static 192.168.1.20 30 192.168.1.10
[R2]ip route-static 192.168.1.16 30 192.168.1.10
[R2]ip route-static 192.168.1.160 27 192.168.1.10
[R2]ip route-static 192.168.1.12 30 192.168.1.10
[R2]ip route-static 192.168.1.97 27 192.168.1.10
Info: The destination address and mask of the configured static route mismatched
, and the static route 192.168.1.96/27 was generated.
[R2]ip route-static 192.168.1.96 27 192.168.1.1
[R2]ip route-static 192.168.1.4 30 192.168.1.1
[R2]ip route-static 192.168.1.32 27 192.168.1.1
[R2]ip route-static 192.168.1.128 27 192.168.1.10
R3
[R3]ip route-static 192.168.1.0 30 192.168.1.5
[R3]ip route-static 192.168.1.8 30 192.168.1.14
[R3]ip route-static 192.168.1.16 30 192.168.1.14
[R3]ip route-static 192.168.1.20 30 192.168.1.14
[R3]ip route-static 192.168.1.160 27 192.168.1.14
[R3]ip route-static 192.168.1.128 27 192.168.1.14
[R3]ip route-static 192.168.1.64 27 192.168.1.14
[R3]ip route-static 192.168.1.64 27 192.168.1.5
[R3]ip route-static 192.168.1.32 27 192.168.1.5
R4:
[R4]ip route-static 192.168.1.96 27 192.168.1.13
[R4]ip route-static 192.168.1.32 27 192.168.1.13
[R4]ip route-static 192.168.1.4 30 192.168.1.13
[R4]ip route-static 192.168.1.0 30 192.168.1.9
[R4]ip route-static 192.168.1.32 27 192.168.1.9
[R4]ip route-static 192.168.1.64 27 192.168.1.9
[R4]ip route-static 192.168.1.160 27 192.168.1.22
[R4]ip route-static 192.168.1.160 27 192.168.1.18
R5(R5到R1、R2、R3、R4都是等价路径)
[R5]ip route-static 192.168.1.128 27 198.168.1.17
[R5]ip route-static 192.168.1.128 27 198.168.1.21
[R5]ip route-static 192.168.1.64 27 198.168.1.21
[R5]ip route-static 192.168.1.64 27 198.168.1.17
[R5]ip route-static 192.168.1.96 27 198.168.1.17
[R5]ip route-static 192.168.1.96 27 198.168.1.21
[R5]ip route-static 192.168.1.32 27 198.168.1.17
[R5]ip route-static 192.168.1.32 27 198.168.1.21
[R5]ip route-static 192.168.1.8 30 198.168.1.21
[R5]ip route-static 192.168.1.8 30 198.168.1.17
[R5]ip route-static 192.168.1.0 30 198.168.1.21
[R5]ip route-static 192.168.1.0 30 198.168.1.17
[R5]ip route-static 192.168.1.4 30 198.168.1.17
[R5]ip route-static 192.168.1.4 30 198.168.1.21
[R5]ip route-static 192.168.1.12 30 198.168.1.17
[R5]ip route-static 192.168.1.12 30 198.168.1.21
-
-
- 配置完后检查:display IP routing-table protool 类型(static)(当全部路由不活跃时更改活跃性即可)
-
R1:
R2:
R3
R4
R5(当全部路由不活跃时更改活跃性即可)情况如下:(必须要改不然ping不通R5)
[R5]ip route-static 192.168.1.0 30 192.168.1.17 preference 65
[R5]ip route-static 192.168.1.4 30 192.168.1.17 preference 65
[R5]ip route-static 192.168.1.8 30 192.168.1.17 preference 65
[R5]ip route-static 192.168.1.12 30 192.168.1.17 preference 65
[R5]ip route-static 192.168.1.32 27 192.168.1.17 preference 65
[R5]ip route-static 192.168.1.64 27 192.168.1.17 preference 65
[R5]ip route-static 192.168.1.96 27 192.168.1.17 preference 65
[R5]ip route-static 192.168.1.128 27 192.168.1.17 preference 65
[R5]ip route-static 192.168.1.0 30 192.168.1.21 preference 65
[R5]ip route-static 192.168.1.8 30 192.168.1.21 preference 65
[R5]ip route-static 192.168.1.4 30 192.168.1.2 preference 65
[R5]ip route-static 192.168.1.12 30 192.168.1.21 preference 65
[R5]ip route-static 192.168.1.32 27 192.168.1.21 preference 65
[R5]ip route-static 192.168.1.64 27 192.168.1.21 preference 65
[R5]ip route-static 192.168.1.96 27 192.168.1.21 preference 65
[R5]ip route-static 192.168.1.128 27 192.168.1.21 preference 65
测试(ping IP地址):ping……
R1pingR4:
R1pingR5环回:
-
- 防环
- 汇总(分段给客户用)后就要防环,(R1、R2、R4):ip route-static 汇总网段 NULL 0
- 防环
R1
[R1]ip route-static 192.168.1.32 27 null 0
R2
[R2]ip route-static 192.168.1.64 27 null 0
R3
[R4]ip route-static 192.168.1.128 27 null 0
-
-
- 配置完后检查:display IP routing-table protool 类型(static)
-
R1
R2
R4
-
- 连外网配缺省
- 一定要在内网(R5上)配一条静态缺省指向外网(公网):ip route-static 0.0.0.0 0 下一跳
- 连外网配缺省
R5
[R5]ip route-static 0.0.0.0 0 12.0.0.2
-
-
- 证明连接成功(R5pingR6):
-
R5pingR6:
-
- 做NAT
(1)在内网与外网交界设备上做easy IP
(不做高级acl原因:其目标要写确定的IP地址)
- 做acl列表(把整个内网流量抓出来并且放通):alc 2000
- 在acl-2000中存放规则:rule permit source IP地址(此题直接用内网大网段:192.168.1.0) 通配符(反掩码:24位反掩码:0.0.0.255)
[R5]acl 2000
R5-acl-basic-2000]rule permit source 192.268.1.0 0.0.0.255
- 进公网接口下发nat:nat outbound 2000
[R5-GigabitEthernet0/0/1]nat outbound 2000
- 在R1、R2、R3、R4上配缺省(内网中的设备没有到达公网网段的路由,所以要配),按最近的走(R1上面、下面都要做,R4也一样):ip route-static 0.0.0.0 0 下一跳
R1:
[R1]ip route-static 0.0.0.0 0 192.168.1.2
[R1]ip route-static 0.0.0.0 0 192.168.1.6
R2:
[R2]ip route-static 0.0.0.0 0 192.168.1.10
R3:
[R3]ip route-static 0.0.0.0 0 192.168.1.14
R4:
[R4]ip route-static 0.0.0.0 0 192.168.1.18
[R4]ip route-static 0.0.0.0 0 192.168.1.22
- 测试(pingR6):
-
- 做telent服务:
- 配置telent服务命令:
- 做telent服务:
a.打开远程登录:telent server enable
b进入三a模式:aaa
c.在三a模式下设置用户、密码、权限:
local-user 用户名 password cipher 密码 privilege level 权限(router路由器最高是4,其他的是15)
d.在三a模式下提供服务:local-user 用户名 server-type 服务类型(telent)
e.退出三a,设置运程登录用户数量:user-interface vty 0 4(五台可以同时用)
f.在此端口下做认证模式:authentication-mode aaa(用户名加密码登录)or password(不用输用户名,直接输入密码就可登录)
[R1]aaa
[R1-aaa]local-user gxf1 password cipher gxf12345 privilege level 15
Info: Add a new user.
[R1-aaa]local-user gxf1 service-type telnet
[R1]user-interface vty 0 4
[R1-ui-vty0-4]authentication-mode aaa
(2)发布telnet服务到公网去,使得公网上的主机也可以访问其(在私网与公网的设备上进入公网端口做NAT server):
NAT服务类型:nat server protocol 类型(远程登录服务基于TCP协议去实现,所以此类型为TCP) global(公网地址与私网地址的转换) current-interface(当前接口(可变,有三种选择)) 端口号(23)//此时公网端口号已经写好了,接下来就是写私网// in 接口地址(不加掩码后面直接跟端口号)(配置telnet服务的接口) 端口号(23)
在私网与公网的设备上进入公网端口:int g……
NAT服务类型:nat server protocol tcp global current-interface 23 inside接口地址 23
[R5]int g0/0/1
[R5-GigabitEthernet0/0/1]nat server protocol tcp global current-interface 23 inside 192.168.1.1 23
-
-
- 进行远程登录测试:
-
命令用户模式下:telnet 地址
<R5>telnet 192.168.1.5
-
- 更改线路优先级(可以改缺省,也可以改明细(指定的那一条,即谁经过了top中R4的G0端口))
注意:优先级数值越大,优先级越低
-
-
- 在R4上更改缺省:
-
-
- 先查看路由信息:display IP routing-table static
-
-
- 在R4上更改缺省:
-
-
-
-
-
-
- 再更改优先级:ip route-static 0.0.0.0 下一跳() preference 优先级(比原先大即可)
- 再次查看路由信息:display IP routing-table static
-
-
-
-
[R4]ip route-static 0.0.0.0 0 192.168.1.18 preference 65
-
-
- 在R5上明细的更改(R5没有指向内网的缺省):
-
-
- 先查看路由信息(只要去往(top图)E0端口地址的都要改):display IP routing-table static
-
-
- 在R5上明细的更改(R5没有指向内网的缺省):
-
-
-
-
-
-
- 更改优先级:ip route-static 源 E0端口地址 preference 优先级
-
-
-
-
[R5]ip route-static 192.168.1.0 30 192.168.1.17 preference 66
[R5]ip route-static 192.168.1.4 30 192.168.1.17 preference 66
[R5]ip route-static 192.168.1.8 30 192.168.1.17 preference 66
[R5]ip route-static 192.168.1.12 30 192.168.1.17 preference 66
[R5]ip route-static 192.168.1.32 27 192.168.1.17 preference 66
[R5]ip route-static 192.168.1.64 27 192.168.1.17 preference 66
[R5]ip route-static 192.168.1.96 27 192.168.1.17 preference 66
[R5]ip route-static 192.168.1.128 27 192.168.1.17 preference 66
-
-
-
-
-
- 再次查看路由信息:display IP routing-table static
-
-
- 测试:
- 跟踪数据包:Tracert 地址( R5上的地址(建议环回))
-
-
<R1>tracert 192.168.1.161
-
-
-
- 进入R4或R5接口去关闭路由线:shutdown
-
-
[R4]int g0/0/1
[R4-GigabitEthernet0/0/1]shutdown
-
-
-
- 再次跟踪:Tracert 地址( R5上的地址(建议环回))
-
-
-
-
-
- 实验完记得恢复路由线:undo shutdown
-
-
[R4-GigabitEthernet0/0/1]undo shutdown