小型企业网络,网络规模小,设备少。
涉及技术:静态路由、单臂路由、RIP、VLAN技术、SVI、web、DNS、DHCP、NAT、TFTP、Telnet、口令加密、SSH
友情提示:我配置发现自己配置的逻辑比较乱,如果大家配置的话,最好是配置交换机就一系列配置完,我是一会儿这个,一会那个,最后就会难受
首先设备选择
设备 | 数量 | 扩展模块 | 设备名称 |
Cisco 2960 Switch | 3 | AS-1、AS-2、AS2-1 | |
Cisco 3650 Switch | 2 | AC Power Supply GLC-LH-SMD | DS1、DS2 |
Cisco 2901 Router | 1 | HWIC-1GE-SFP GLC-LH-SMD | R-Edge |
Cisco 2911 Router | 1 | HWIC-1GE-SFP GLC-LH-SMD | ISP |
Cisco1 941 Router | 1 | HWIC-1GE-SFP GLC-LH-SMD | QD-Router |
批注:AS是access的缩写,以为接入层,DS为汇聚层的缩写,R-Edge为边缘路由器,ISP为网络服务提供商
DS1 | G1/0/3 | 10.0.100.2 | 255.255.255.252 |
VLAN10 | 10.1.10.254 | 255.255.255.0 | |
VLAN20 | 10.1.20.254 | 255.255.255.0 | |
VLAN30 | 10.1.30.254 | 255.255.255.0 | |
VLAN40 | 10.1.40.254 | 255.255.255.0 | |
VLAN99 | 10.1.12.254 | 255.255.255.0 | |
VLAN100 | 10.3.100.254 | 255.255.255.0 | |
DS2 | G1/1/1 | 217.9.5.2 | 255.255.255.252 |
G1/1/2 | 222.138.4.254 | 255.255.255.252 | |
G1/1/3 | 200.200.200.254 | 255.255.255.252 | |
AS2-1 | VLAN99 | 10.0.12.1 | 255.255.255.0 |
AS-2 | VLAN99 | 10.0.12.2 | 255.255.255.0 |
AS2-1 | VLAN99 | 10.8.0.100 | 255.255.255.0 |
R-Edge | G0/0/0 | 218.12.10.1 | 255.255.255.252 |
Tunnel 1 | 192.168.12.1 | 255.255.255.252 | |
G0/0 | 10.0.100.1 | 255.255.255.252 | |
QD-Router | G0/0 | 218.12.11.2 | 255.255.255.252 |
Tunnel 2 | 192.168.12.2 | 255.255.255.252 | |
VLAN5 | 10.8.5.254 | 255.255.255.0 | |
VLAN6 | 10.8.6.254 | 255.255.255.0 | |
VLAN99 | 10.8.0.254 | 255.255.255.0 | |
ISP | G0/0/0 | 218.12.10.2 | 255.255.255.252 |
G0/1/0 | 217.9.5.1 | 255.255.255.252 | |
G0/2/0 | 218.12.11.1 | 255.255.255.252 | |
PC | DHCP | ||
Public PC | 218.12.10.2 | 255.255.255.252 | |
www.Cisco.com | 217.9.5.2 | 255.255.255.252 | |
WEB | 10.3.100.4 | 255.255.255.0 | |
DNS | 10.3.100.5 | 255.255.255.0 | |
DHCP | 10.3.100.6 | 255.255.255.0 |
PS:这里的地址与之前的不太一样,看起来是不规则,当然大家也可以归地址使得都使用一个大类的地址
扩展的操作:
点击路由器或交换机进入
选择对应的模块,
加入模块前,先断电源 ;加入后在打开电源(下图为打开电源)
以下是扩展的全部
PS:DS2同样
拓扑搭建
划分VLAN并加入接口
Switch>enable
Switch#configure
Switch(config)#hostname AS-1
AS-1(config)#vlan 10
AS-1(config-vlan)#vlan 20
AS-1(config-vlan)#vlan 99
AS-1(config-vlan)#exit
AS-1(config)#interface range fastEthernet 0/1-2
AS-1(config-if-range)#switchport mode access
AS-1(config-if-range)#switchport access vlan 10
AS-1(config-if-range)#exit
AS-1(config)#interface range fastEthernet 0/13-14
AS-1(config-if-range)#switchport mode access
AS-1(config-if-range)#switchport access vlan 20
AS-1(config-if-range)#exit
AS-1(config)#interface gigabitEthernet 0/1
AS-1(config-if)#switchport mode trunk
AS-1(config-if)#switchport trunk allowed vlan 10,20,99
AS-1(config-if)#exit
Switch>enable
Switch#configure
Switch(config)#hostname AS-2
AS-2(config)#vlan 30
AS-2(config-vlan)#vlan 40
AS-2(config-vlan)#vlan 99
AS-2(config-vlan)#exit
AS-2(config)#interface range fastEthernet 0/1-2
AS-2(config-if-range)#switchport mode access
AS-2(config-if-range)#switchport access vlan 30
AS-2(config-if-range)#exit
AS-2(config)#interface range fastEthernet 0/13-14
AS-2(config-if-range)#switchport mode access
AS-2(config-if-range)#switchport access vlan 40
AS-2(config-if-range)#exit
AS-2(config)#interface gigabitEthernet 0/1
AS-2(config-if)#switchport mode trunk
AS-2(config-if)#switchport trunk allowed vlan 30,40,99
AS-2(config-if)#exit
Switch>enable
Switch#configure
Switch(config)#hostname DS1
DS1(config)#vlan 10
DS1(config-vlan)#vlan 20
DS1(config-vlan)#vlan 30
DS1(config-vlan)#vlan 40
DS1(config-vlan)#vlan 99
DS1(config)#vlan 100
DS1(config-vlan)#exit
DS1(config-vlan)#interface range gigabitEthernet 1/0/4-6
DS1(config-if-range)#switchport mode access
DS1(config-if-range)#switchport access vlan 100
DS1(config)#interface gigabitEthernet 1/0/1
DS1(config-if)#switchport mode trunk
DS1(config-if)#switchport trunk allowed vlan all
DS1(config)#interface gigabitEthernet 1/0/2
DS1(config-if)#switchport mode trunk
DS1(config-if)#switchport trunk allowed vlan all
DS1(config-if)#exit
Switch>enable
Switch#configure
Switch(config)#hostname AS2-1
AS2-1(config)#vlan 5
AS2-1(config-vlan)#vlan 6
AS2-1(config)#vlan 99
AS2-1(config-vlan)#exit
AS2-1(config)#interface range fastEthernet 0/1-2
AS2-1(config-if-range)#switchport mode access
AS2-1(config-if-range)#switchport access vlan 5
AS2-1(config-if-range)#exit
AS2-1(config)#interface range fastEthernet 0/13-14
AS2-1(config-if-range)#switchport mode access
AS2-1(config-if-range)#switchport access vlan 6
AS2-1(config-if-range)#exit
AS2-1(config)#interface gigabitEthernet 0/1
AS2-1(config-if)#switchport mode trunk
AS2-1(config-if)#switchport trunk allowed vlan 5,6,99
二层交换机的配置网关
AS-1(config)#interface vlan 99
AS-1(config-if)#ip address 10.0.12.1 255.255.255.0
AS-1(config-if)#no shutdown
AS-1(config-if)#exit
AS-1(config)#ip default-gateway 10.0.12.254
AS-2(config)#interface vlan 99
AS-2(config-if)#ip address 10.0.12.2 255.255.255.0
AS-2(config-if)#no shutdown
AS-2(config-if)#exit
AS-2(config)#ip default-gateway 10.0.12.254
S2-1(config)#interface vlan 99
AS2-1(config-if)#ip address 10.8.0.100 255.255.255.0
AS2-1(config-if)#no shutdown
AS2-1(config-if)#exit
AS2-1(config)#ip default-gateway 10.8.0.254
三层交换机IP配置
DS1(config)#interface gigabitEthernet 1/0/3
DS1(config-if)#no switchport
DS1(config-if)#ip address 10.0.100.2 255.255.255.252
DS1(config-if)#exit
配置R-Edge、QD-Router(这里的路由器名称可以随便命名)
Router>enable
Router#configure
Router(config)#hostname R-Edge
R-Edge(config)#interface gigabitEthernet 0/0
R-Edge(config-if)#ip address 10.0.100.1 255.255.255.252
R-Edge(config-if)#no shutdown
R-Edge(config-if)#exit
R-Edge(config)#interface gigabitEthernet 0/0/0
R-Edge(config-if)#ip address 218.12.10.1 255.255.255.252
R-Edge(config-if)#no shutdown
Router>enable
Router#configure
Router(config)#hostname QD-Router
QD-Router(config)#interface gigabitEthernet 0/0/0
QD-Router(config-if)#ip address 218.12.11.2 255.255.255.252
QD-Router(config-if)#no shutdown
配置ISP路由器
Router>enable
Router#configure
Router(config)#hostname ISP
ISP(config)#interface gigabitEthernet 0/0/0
ISP(config-if)#ip address 218.12.10.2 255.255.255.252
ISP(config-if)#no shutdown
ISP(config-if)#exit
ISP(config)#interface gigabitEthernet 0/1/0
ISP(config-if)#ip address 217.9.5.1 255.255.255.252
ISP(config-if)#no shutdown
ISP(config-if)#exit
ISP(config)#interface gigabitEthernet 0/2/0
ISP(config-if)#ip address 218.12.11.1 255.255.255.252
ISP(config-if)#no shutdown
配置DS2
Switch>enable
Switch#configure
Switch(config)#hostname DS2
DS2(config)#ip routing
DS2(config)#interface gigabitEthernet 1/1/1
DS2(config-if)#no switchport
DS2(config-if)#ip address 217.9.5.2 255.255.255.252
DS2(config-if)#no shutdown
DS2(config-if)#ex
DS2(config)#interface gigabitEthernet 1/1/2
DS2(config-if)#no switchport
DS2(config-if)#ip address 222.138.4.254 255.255.255.252
DS2(config-if)#exit
DS2(config)#interface gigabitEthernet 1/1/3
DS2(config-if)#no switchport
DS2(config-if)#ip address 200.200.200.254 255.255.255.252
DS2(config-if)#no shutdown
配置DS1 SVI(也就是在VLAN上配置IP)
DS1(config)#ip routing
DS1(config)#interface vlan 10
DS1(config-if)#ip address 10.1.10.254 255.255.255.0
DS1(config-if)#exit
DS1(config)#interface vlan 20
DS1(config-if)#ip address 10.1.20.254 255.255.255.254
Bad mask /31 for address 10.1.20.254
DS1(config-if)#ip address 10.1.20.254 255.255.255.0
DS1(config-if)#exit
DS1(config)#interface vlan 30
DS1(config-if)#ip address 10.1.30.254 255.255.255.0
DS1(config-if)#exit
DS1(config)#interface vlan 40
DS1(config-if)#ip address 10.1.40.254 255.255.255.0
DS1(config-if)#exit
DS1(config)#interface vlan 99
DS1(config-if)#ip address 10.0.12.254 255.255.255.0
DS1(config-if)#exit
DS1(config)#interface vlan 100
DS1(config-if)#ip address 10.3.100.254 255.255.255.0
DS1(config-if)#exit
QD-Router上配置DHCP
QD-Router(config)#ip dhcp pool 1
QD-Router(dhcp-config)#network 10.8.5.0 255.255.255.0
QD-Router(dhcp-config)#default-router 10.8.5.254
QD-Router(dhcp-config)#exit
QD-Router(config)#ip dhcp pool 2
QD-Router(dhcp-config)#network 10.8.6.0 255.255.255.0
QD-Router(dhcp-config)#default-router 10.8.6.254
QD-Router(config)#ip dhcp excluded-address 10.8.5.254
QD-Router(config)#ip dhcp excluded-address 10.8.6.254
DS1上配置DHCP中继
DS1(config)#interface vlan 10
DS1(config-if)#ip helper-address 10.30.100.6
DS1(config-if)#exit
DS1(config)#interface vlan 20
DS1(config-if)#ip helper-address 10.3.100.6
DS1(config-if)#exit
DS1(config)#interface vlan 30
DS1(config-if)#ip helper-address 10.3.100.6
DS1(config-if)#exit
DS1(config)#interface vlan 40
DS1(config-if)#ip helper-address 10.3.100.6
DS1(config-if)#exit
QD-Router上配置单臂路由
QD-Router(config)#interface gigabitEthernet 0/0
QD-Router(config-if)#no shutdown
QD-Router(config-if)#exit
QD-Router(config)#interface gigabitEthernet 0/0.5
QD-Router(config-subif)#encapsulation dot1Q 5
QD-Router(config-subif)#ip address 10.8.5.254 255.255.255.0
QD-Router(config-subif)#exit
QD-Router(config)#interface gigabitEthernet 0/0.6
QD-Router(config-subif)#encapsulation dot1Q 6
QD-Router(config-subif)#ip address 10.8.6.254 255.255.255.0
QD-Router(config-subif)#exit
QD-Router(config)#interface gigabitEthernet 0/0.99
QD-Router(config-subif)#encapsulation dot1Q 99
QD-Router(config-subif)#ip address 10.8.0.254 255.255.255.0
QD-Router(config-subif)#exit
DS1、DS2配置RIP协议
DS1(config)#router rip
DS1(config-router)#version 2
DS1(config-router)#no auto-summary
DS1(config-router)#network 10.0.0.0
DS2(config)#router rip
DS2(config-router)#version 2
DS2(config-router)#network 10.0.0.0
DS2(config-router)#no auto-summary
R-Edge上配置默认静态路由(可以使用下一跳的方式,也可以使用接口)
R-Edge(config)#router rip
R-Edge(config-router)#version 2
R-Edge(config-router)#no auto-summary
R-Edge(config-router)#network 10.0.0.0
R-Edge(config-router)#exit
R-Edge(config)#ip route 0.0.0.0 0.0.0.0 218.12.10.2
R-Edge(config)#router rip
R-Edge(config-router)#default-information originate
DS2配置默认静态路由
DS2(config)#ip route 0.0.0.0 0.0.0.0 217.9.5.1
ISP配置默认静态理由
ISP(config)#ip route 200.200.200.0 255.255.255.0 217.9.5.2
ISP(config)#ip route 222.138.4.0 255.255.255.0 217.9.5.2
R-Edge上配置NAT并添加端口映射
添加端口映射的目的是为,在之后的访问web服务等方便使用
R-Edge(config)#access list 1 permit 10.0.0.0 0.3.255.255
R-Edge(config)#ip nat inside source list 1 interface gigabitEthernet 0/0/0 overload
R-Edge(config)#interface gigabitEthernet 0/0/0
R-Edge(config-if)#ip nat outside
R-Edge(config-if)#exit
R-Edge(config)#interface gigabitEthernet 0/0
R-Edge(config-if)#ip nat inside
R-Edge(config-if)#exit
R-Edge(config)#ip nat inside source static tcp 10.3.100.4 80 218.12.10.1 80
R-Edge(config)#ip nat inside source static udp 10.3.100.6 69 218.12.10.1 69
R-Edge(config)#ip nat inside source static tcp 10.0.100.2 22 218.12.10.1 22
QD-Router上配置NAT
QD-Router(config)#ip route 0.0.0.0 0.0.0.0 218.12.11.1
QD-Router(config)#access-list 1 permit 10.8.0.0 0.0.255.255
QD-Router(config)#ip nat inside source list 1 interface gigabitEthernet 0/0/0 overload
QD-Router(config)#interface gigabitEthernet 0/0/0
QD-Router(config-if)#ip nat outside
QD-Router(config-if)#exit
QD-Router(config)#interface gigabitEthernet 0/0.5
QD-Router(config-subif)#ip nat inside
QD-Router(config-subif)#exit
QD-Router(config)#interface gigabitEthernet 0/0.6
QD-Router(config-subif)#ip nat inside
QD-Router(config-subif)#exit
QD-Router(config)#interface gigabitEthernet 0/0.99
QD-Router(config-subif)#ip nat inside
QD-Router(config-subif)#exit
配置GRE VPN
R-Edge(config)#interface tunnel 1
R-Edge(config-if)#ip address 192.168.12.1 255.255.255.252
R-Edge(config-if)#tunnel mode gre ip
R-Edge(config-if)#tunnel source gigabitEthernet0/0/0
R-Edge(config-if)#tunnel destination 218.12.11.2
R-Edge(config-if)#exit
R-Edge(config)#ip route
R-Edge(config)#ip route 10.8.0.0 255.255.248.0 192.168.12.2
QD-Router(config)#interface tunnel 1
QD-Router(config-if)#ip address 192.168.12.2 255.255.255.252
QD-Router(config-if)#tunnel mode gre ip
QD-Router(config-if)#tunnel source gigabitEthernet 0/0/0
QD-Router(config-if)#tunnel destination 218.12.10.1
QD-Router(config-if)#exit
QD-Router(config)#ip route 10.0.0.0 255.252.0.0 192.168.12.1
为所有的设备配置Tenet(仅限路由器交换机)
AS-1(config)#enable secret cisco
AS-1(config)#service password-encryption
AS-1(config)#line vty 0 4
AS-1(config-line)#password cisco
AS-1(config-line)#login
AS-2(config)#enable secret cisco
AS-2(config)#service password-encryption
AS-2(config)#line vty 0 4
AS-2(config-line)#password cisco
AS-2(config-line)#login
AS2-1(config)#enable secret cisco
AS2-1(config)#service password-encryption
AS2-1(config)#line vty 0 4
AS2-1(config-line)#password cisco
AS2-1(config-line)#login
三层交换机使用SSH远程登录
DS1(config)#enable secret cisco
DS1(config)#service password-encryption
DS1(config)#ip domain-name test.cn
DS1(config)#username cisco password cisco
DS1(config)#line vty 0 4
DS1(config-line)#transport input ssh
DS1(config-line)#login local
DS1(config-line)#crypto key generate rsa
The name for the keys will be: DS1.test.cn
Choose the size of the key modulus in the range of 360 to 2048 for your
General Purpose Keys. Choosing a key modulus greater than 512 may take
a few minutes.
How many bits in the modulus [512]: 1024
% Generating 1024 bit RSA keys, keys will be non-exportable...[OK]
DS2(config)#enable secret cisco
DS2(config)#service password-encryption
DS2(config)#ip domain-name test.cn
DS2(config)#username cisco password cisco
DS2(config)#line vty 0 4
DS2(config-line)#transport input ssh
DS2(config-line)#login local
DS2(config-line)#crypto key generate rsa
The name for the keys will be: DS2.test.cn
Choose the size of the key modulus in the range of 360 to 2048 for your
General Purpose Keys. Choosing a key modulus greater than 512 may take
a few minutes.
How many bits in the modulus [512]: 1024
% Generating 1024 bit RSA keys, keys will be non-exportable...[OK]
最后就配置DHCP服务器、DNS服务器、TFTP服务器
连通性测试
这里尤其注意哈!!!我们是在路由器上有做ACL的,部分是能进入但不能出,部分是能出但不能进
PC11 ping PC21
PC11 ping Public PC
连通性测试还是比较成功的!若是后面大家有发现错误,欢迎大家提出来哦