第十八天实验-交换综合

一.实验要求

1，内网IP地址使用172.16.0.0/16分配
2，Sw1和sw2之间互为备份
3，VRRP/STP/VLAN/Eth-trunk均使用
4，所有Pc均通过DHCP获取Ip地址
5，ISP只能配置Ip地址
6，所有电脑可以正常访问ISP路由器环回

二.实验步骤

配置思路

eth-trunk　＞　创建vlan　＞　划分vlan　＞　trunk干道　＞　STP　＞　SVI　＞　VRRP　＞　DHCP
一，配置eth-trunk

SW１：
[sw1]int Eth-Trunk 0 —创建虚拟接口
[sw1-Eth-Trunk0]trunkport GigabitEthernet 0/0/3 0/0/2　—将接口划入虚拟接口
SW２：
[sw２]int Eth-Trunk 0
[sw２-Eth-Trunk0]trunkport GigabitEthernet 0/0/3 0/0/2

二，创建vlan，划分vlan，配置trunk干道。

SW1：
[sw1]port-group group-member GigabitEthernet 0/0/4 GigabitEthernet 0/0/5 Eth-Trunk 0
[sw1-port-group]port link-type trunk
[sw1-port-group]port trunk allow-pass vlan all
SW2：
[sw2]port-group group-member GigabitEthernet 0/0/4 GigabitEthernet 0/0/5 Eth-Trunk 0
[sw2-port-group]port link-type trunk
[sw2-port-group]port trunk allow-pass vlan all
SW3：
[sw3]vlan 2
[sw3]int g0/0/4
[sw3-GigabitEthernet0/0/4]port link-type access
[sw3-GigabitEthernet0/0/4]port default vlan 2
[sw3]port-group group-member GigabitEthernet 0/0/2 GigabitEthernet 0/0/1
[sw3-port-group]port link-type trunk
[sw3-port-group]port trunk allow-pass vlan all
SW4：
[sw4]vlan 2
[sw4]int g0/0/4
[sw4-GigabitEthernet0/0/4]port link-type access
[sw4-GigabitEthernet0/0/4]port default vlan 2
[sw4]port-group group-member GigabitEthernet 0/0/2 GigabitEthernet 0/0/1
[sw4-port-group]port link-type trunk
[sw4-port-group]port trunk allow-pass vlan all

三，配置STP

SW1 —— SW4
stp region-configuration —进入MSTP组
region-name a —创建名字，但其他交换机配置名必须一致
instance 1 vlan 1 —将VLAN按需求放入对应instance中
instance 2 vlan 2
active region-configuration —激活MST域的配置

[sw1]stp instance 1 root primary —将instan 1作为SW1的主根
[sw1]stp instance 2 root secondary —将instan 1作为SW1的备份根
[sw2]stp instance 1 root secondary
[sw2]stp instance 2 root primary

四，划分IP地址

172.16.0.0/24
172.16.0.0/25 —Vlanif 1
172.16.0.128/25 —Vlanif 2
172.16.0.0/30 —r1
172.16.0.4/30 —r1

五，配置VRRP

SW1：
[sw1]interface Vlanif 1
[sw1-Vlanif1]ip address 172.16.1.1 25
[sw1-Vlanif1]vrrp vrid 1 virtual-ip 172.16.1.126 —激活VRRP，配置虚拟网关
[sw1-Vlanif1]vrrp vrid 1 priority 110 —修改优先级
[sw1-Vlanif1]vrrp vrid 1 track interface GigabitEthernet 0/0/1 reduced 50 —上行链路追踪，如果上行的端口发送故障，则将网关接口的VRRP优先级降低50（默认降低10）

[sw1]interface Vlanif 2
[sw1-Vlanif2]ip address 172.16.1.129 25
[sw1-Vlanif2]vrrp vrid 1 virtual-ip 172.16.1.254

SW2：
[sw2]interface Vlanif 1
[sw2-Vlanif1]ip address 172.16.1.2 25
[sw2-Vlanif1]vrrp vrid 1 virtual-ip 172.16.1.126

[sw2]interface Vlanif 2
[sw2-Vlanif2]ip address 172.16.1.130 25
[sw2-Vlanif2]vrrp vrid 1 virtual-ip 172.16.1.254
[sw2-Vlanif2]vrrp vrid 1 priority 110
[sw2-Vlanif2]vrrp vrid 1 track interface GigabitEthernet 0/0/1 reduced 50

六，配置DHCP

[sw1]dhcp enable
[sw1]ip pool v1
[sw1-ip-pool-v1]network 172.16.1.0 mask 25
[sw1-ip-pool-v1]gateway-list 172.16.1.126
[sw1-ip-pool-v1]q
[sw1]ip pool v2
[sw1-ip-pool-v2]network 172.16.1.128 mask 25
[sw1-ip-pool-v2]gateway-list 172.16.1.254
[sw1]int Vlanif 1
[sw1-Vlanif1]dhcp select global
[sw1-Vlanif1]q
[sw1]int Vlanif 2
[sw1-Vlanif2]dhcp select global

SW2：
[sw2]dhcp enable
[sw2]ip pool v1
[sw2-ip-pool-v1]network 172.16.1.0 mask 25
[sw2-ip-pool-v1]gateway-list 172.16.1.126
[sw2-ip-pool-v1]q
[sw2]ip pool v2
[sw2-ip-pool-v2]network 172.16.1.128 mask 25
[sw2-ip-pool-v2]gateway-list 172.16.1.254
[sw2]int Vlanif 1
[sw2-Vlanif1]dhcp select global
[sw2-Vlanif1]q
[sw2]int Vlanif 2
[sw2-Vlanif2]dhcp select global
七，配置路由
（一）路由器R1配置IP地址。
[r1]interesting g0/0/0
[r1-GigabitEthernet0/0/0]ip address 12.0.0.1 24
[r1-GigabitEthernet0/0/1]ip address 172.16.0.1 30
[r1-GigabitEthernet0/0/2]ip address 172.16.0.5 30
二）交换机配置IP地址
因为交换机接口上不能直接配置IP地址，所以创建vlan使用虚拟接口配置

SW1：
[sw1]vlan 100
[sw1-vlan100]q
[sw1]int Vlanif 100
[sw1-Vlanif100]ip address 172.16.0.2 30
[sw1]int g0/0/1
[sw1-GigabitEthernet0/0/1]port link-type access
[sw1-GigabitEthernet0/0/1]port default vlan 100

SW2：
[sw2]vlan 100
[sw2-vlan100]q
[sw2]int Vlanif 100
[sw2-Vlanif100]ip address 172.16.0.6 30
[sw2]int g0/0/1
[sw2-GigabitEthernet0/0/1]port link-type access
[sw2-GigabitEthernet0/0/1]port default vlan 100

(三)启用RIP，是私网内部可达

[r1]rip
[r1-rip-1]v 2
[r1-rip-1]network 172.16.0.0

[sw1]rip
[sw1-rip-1]v 2
[sw1-rip-1]network 172.16.0.0

[sw2]rip
[sw2-rip-1]v 2
[sw2-rip-1]network 172.16.0.0

（四）做ACL，使PC内网可以访问公网

[r1]ip route-static 0.0.0.0 0 12.0.0.2
[r1]acl 2000
[r1-acl-basic-2000]rule permit source 172.16.0.0 0.0.255.255
[r1-acl-basic-2000]q
[r1]int g 0/0/0
[r1-GigabitEthernet0/0/0]nat outbound 2000