注:该文章最终归属权为博客:等不到释怀
!!!未经允许请勿转载!!!
目录
前言介绍(未经允许禁止转发任何内容)
该网络运用到的技术主要有链路聚合、VLAN划分、MSTP生成树、VRRP网关冗余、DHCP中继、OSPF路由、NAT地址转换和无线AC+AP等技术。非常适合适用于校园、企业和园区网络的小伙伴使用,还可适用于毕设,课设,园区网络的实现等等场景!
一、设计思路
- 每个部门划分一个VLAN,部门内互通,各部门根据ACL规则实现互通。
- 内网使用私网IP,为每个部门分配一个24位掩码长度的私网段,实现上网。
- 部门主机采用DHCP自动获取地址,减少管理员手动分配的任务量,方便管理与维护。
- 运行OSPF协议,提高收敛速度。而且OSPF可以适应拓扑变化,路由自动学习,防止路由环路,提高拓扑稳定性。
- 接入层和汇聚层交换机配置MSTP和VRRP技术,实现设备冗余、线路可靠、数据负载分担,能够保证主设备故障后,可以快速切换到备用设备,不影响业务转发。
- 增加防火墙设备,设置安全区域,控制部门主机、服务器和外网设备的数据转发,保证公司网络的安全性。
- 出口采用光纤接入,汇聚层交换机进行链路聚合,提高网络带宽,实现运营商万兆接入,千兆到部门,百兆到桌面的体验。
- 公司内部实现无线全覆盖,保障内部终端设备可以无线接入并上网。
- 汇聚层交换机配置ACL控制访问技术,实现市场部和行政部不通,财务部只能和行政部互通,其他部门全互通的网络需求。
- SNAT:应用于内网用户访问Internet时进行的地址转换将私网地址转为公网地址,这里我们采用easy-ip的NAT,保证公司上网采用出接口地址。
- DNAT:使的外网用户能够访问内部服务器,用户访问202.96.137.88:8080时,防火墙将流量能够送给内网的WEB服务器。当用户访问202.96.137.88:21时防火墙将目的地址转换为172.16.50.20:21 访问公司的FTP服务器。
该topo图中防火墙使用的是USG5500V防火墙,topo图就是如下,相应的地址规划表在图中标明了。
二、地址规划表
三、基于eNSP中大型校园企业网络规划与设计(可以不看)
插曲部分:基于eNSP中大型校园企业网络规划与设计 如下图所示(查看详情可点击进入查看详细的介绍和阅读)。
四、详细配置步骤(跟着一步一步走)
1、Eth-trunk
LSW1:
sys
un in en
sysname LSW1
int eth-trunk 1
mode lacp-static
trunkport g0/0/4
trunkport g0/0/5
qui
----------------------
LSW2:
sys
un in en
sysname LSW2
int eth-trunk 1
mode lacp-static
trunkport g0/0/4
trunkport g0/0/5
qui
-------------------------
2、vlan划分
LSW1:
vlan batch 10 20 30 40 50 60 70 80 100 200
vlan batch 1000 2000
interface Eth-Trunk1
port link-type trunk
port trunk allow-pass vlan 10 20 30 40 50 60 70 200 1000 2000
mode lacp-static
interface GigabitEthernet0/0/1
port link-type trunk
port trunk allow-pass vlan 10 1000 2000
interface GigabitEthernet0/0/2
port link-type trunk
port trunk allow-pass vlan 20 30 1000 2000
interface GigabitEthernet0/0/3
port link-type trunk
port trunk allow-pass vlan 40 50
interface GigabitEthernet0/0/6
port link-type access
port default vlan 100
interface GigabitEthernet0/0/7
port link-type trunk
port trunk allow-pass vlan 60 70
interface GigabitEthernet0/0/8
port link-type trunk
port trunk allow-pass vlan 200
interface GigabitEthernet0/0/23
port link-type access
port default vlan 80
-------------------------------
LSW2:
vlan batch 10 20 30 40 50 60 70 90 200 1000
vlan batch 2000
interface MEth0/0/1
interface Eth-Trunk1
port link-type trunk
port trunk allow-pass vlan 10 20 30 40 50 60 70 200 1000 2000
mode lacp-static
interface GigabitEthernet0/0/1
port link-type trunk
port trunk allow-pass vlan 10 1000 2000
interface GigabitEthernet0/0/2
port link-type trunk
port trunk allow-pass vlan 20 30 1000 2000
interface GigabitEthernet0/0/3
port link-type trunk
port trunk allow-pass vlan 40 50
interface GigabitEthernet0/0/6
port link-type trunk
port trunk allow-pass vlan 60 70
interface GigabitEthernet0/0/7
port link-type trunk
port trunk allow-pass vlan 200
interface GigabitEthernet0/0/24
port link-type access
port default vlan 90
------------------------------
LSW3:
vlan batch 10 1000 2000
interface Ethernet0/0/1
port link-type access
port default vlan 10
interface Ethernet0/0/2
port link-type trunk
port trunk pvid vlan 2000
port trunk allow-pass vlan 1000 2000
interface Ethernet0/0/3
port link-type trunk
port trunk allow-pass vlan 10 1000 2000
interface Ethernet0/0/4
port link-type trunk
port trunk allow-pass vlan 10 1000 2000
--------------------------------
LSW4:
vlan batch 20 30 1000 2000
interface Ethernet0/0/1
port link-type access
port default vlan 20
interface Ethernet0/0/2
port link-type access
port default vlan 30
interface Ethernet0/0/3
port link-type trunk
port trunk pvid vlan 2000
port trunk allow-pass vlan 1000 2000
interface Ethernet0/0/4
port link-type trunk
port trunk allow-pass vlan 20 30 1000 2000
interface Ethernet0/0/5
port link-type trunk
port trunk allow-pass vlan 20 30 1000 2000
-------------------------------
LSW5:
vlan batch 40 50
interface Ethernet0/0/1
port link-type access
port default vlan 40
interface Ethernet0/0/2
port link-type access
port default vlan 50
interface Ethernet0/0/3
port link-type trunk
port trunk allow-pass vlan 40 50
interface Ethernet0/0/4
port link-type trunk
port trunk allow-pass vlan 40 50
-------------------------------
LSW6:
vlan batch 60 70
interface Ethernet0/0/1
port link-type trunk
port trunk allow-pass vlan 60 70
interface Ethernet0/0/2
port link-type access
port default vlan 60
interface Ethernet0/0/3
port link-type access
port default vlan 70
interface Ethernet0/0/4
port link-type trunk
port trunk allow-pass vlan 60 70
--------------------------------
LSW7:
vlan batch 200
interface Ethernet0/0/1
port link-type trunk
port trunk allow-pass vlan 200
interface Ethernet0/0/2
port link-type access
port default vlan 200
interface Ethernet0/0/3
port link-type trunk
port trunk allow-pass vlan 200
---------------------------------
LSW8:
vlan batch 80 90 172
interface GigabitEthernet0/0/3
port link-type access
port default vlan 172
interface GigabitEthernet0/0/23
port link-type access
port default vlan 80
interface GigabitEthernet0/0/24
port link-type access
port default vlan 90
3、MSTP生成树
LSW1:
stp region-configuration
region-name mstp
revision-level 1
instance 1 vlan 10 20 30 1000 2000
instance 2 vlan 40 50 60 70 200
instance 3 vlan 80
instance 4 vlan 90
active region-configuration
stp instance 1 root primary
stp instance 2 root secondary
---------------------------------
LSW2:
stp region-configuration
region-name mstp
revision-level 1
instance 1 vlan 10 20 30 1000 2000
instance 2 vlan 40 50 60 70 200
instance 3 vlan 80
instance 4 vlan 90
active region-configuration
stp instance 1 root secondary
stp instance 2 root primary
----------------------------------
LSW3:
stp region-configuration
region-name mstp
revision-level 1
instance 1 vlan 10 20 30 1000 2000
instance 2 vlan 40 50 60 70 200
active region-configuration
--------------------------------
LSW4:
stp region-configuration
region-name mstp
revision-level 1
instance 1 vlan 10 20 30 1000 2000
instance 2 vlan 40 50 60 70 200
active region-configuration
-------------------------------
LSW5:
stp region-configuration
region-name mstp
revision-level 1
instance 1 vlan 10 20 30 1000 2000
instance 2 vlan 40 50 60 70 200
active region-configuration
-----------------------------
LSW6:
stp region-configuration
region-name mstp
revision-level 1
instance 1 vlan 10 20 30 1000 2000
instance 2 vlan 40 50 60 70 200
active region-configuration
-------------------------------
LSW7:
stp region-configuration
region-name mstp
revision-level 1
instance 1 vlan 10 20 30 1000 2000
instance 2 vlan 40 50 60 70 200
active region-configuration
-----------------------------
LSW8:
stp region-configuration
region-name mstp
revision-level 1
instance 1 vlan 10 20 30 1000 2000
instance 2 vlan 40 50 60 70 200
instance 3 vlan 80
instance 4 vlan 90
active region-configuration
stp instance 3 root primary
stp instance 4 root secondary
4、VRRP网关冗余
LSW1:
interface Vlanif10
ip address 192.168.10.252 255.255.255.0
vrrp vrid 10 virtual-ip 192.168.10.254
vrrp vrid 10 priority 120
dhcp select global
interface Vlanif20
ip address 192.168.20.252 255.255.255.0
vrrp vrid 20 virtual-ip 192.168.20.254
vrrp vrid 20 priority 120
dhcp select global
interface Vlanif30
ip address 192.168.30.252 255.255.255.0
vrrp vrid 30 virtual-ip 192.168.30.254
vrrp vrid 30 priority 120
dhcp select global
interface Vlanif40
ip address 192.168.40.252 255.255.255.0
vrrp vrid 40 virtual-ip 192.168.40.254
dhcp select global
interface Vlanif50
ip address 192.168.50.252 255.255.255.0
vrrp vrid 50 virtual-ip 192.168.50.254
dhcp select global
interface Vlanif60
ip address 192.168.60.252 255.255.255.0
vrrp vrid 60 virtual-ip 192.168.60.254
dhcp select global
interface Vlanif70
ip address 192.168.70.252 255.255.255.0
vrrp vrid 70 virtual-ip 192.168.70.254
dhcp select global
interface Vlanif80
ip address 172.16.80.1 255.255.255.0
interface Vlanif100
ip address 172.16.20.254 255.255.255.0
interface Vlanif200
ip address 192.168.200.252 255.255.255.0
vrrp vrid 201 virtual-ip 192.168.200.254
dhcp select global
interface Vlanif1000
ip address 192.168.100.252 255.255.255.0
vrrp vrid 100 virtual-ip 192.168.100.254
vrrp vrid 100 priority 120
dhcp select global
interface Vlanif2000
ip address 172.16.100.252 255.255.255.0
vrrp vrid 200 virtual-ip 172.16.100.254
vrrp vrid 200 priority 120
dhcp select global
--------------------------------
LSW2:
interface Vlanif10
ip address 192.168.10.253 255.255.255.0
vrrp vrid 10 virtual-ip 192.168.10.254
dhcp select global
interface Vlanif20
ip address 192.168.20.253 255.255.255.0
vrrp vrid 20 virtual-ip 192.168.20.254
dhcp select global
interface Vlanif30
ip address 192.168.30.253 255.255.255.0
vrrp vrid 30 virtual-ip 192.168.30.254
dhcp select global
interface Vlanif40
ip address 192.168.40.253 255.255.255.0
vrrp vrid 40 virtual-ip 192.168.40.254
vrrp vrid 40 priority 120
dhcp select global
interface Vlanif50
ip address 192.168.50.253 255.255.255.0
vrrp vrid 50 virtual-ip 192.168.50.254
vrrp vrid 50 priority 120
dhcp select global
interface Vlanif60
ip address 192.168.60.253 255.255.255.0
vrrp vrid 60 virtual-ip 192.168.60.254
vrrp vrid 60 priority 120
dhcp select global
interface Vlanif70
ip address 192.168.70.253 255.255.255.0
vrrp vrid 70 virtual-ip 192.168.70.254
vrrp vrid 70 priority 120
dhcp select global
interface Vlanif90
ip address 172.16.90.1 255.255.255.0
interface Vlanif200
ip address 192.168.200.253 255.255.255.0
vrrp vrid 201 virtual-ip 192.168.200.254
vrrp vrid 201 priority 120
dhcp select global
interface Vlanif1000
ip address 192.168.100.253 255.255.255.0
vrrp vrid 100 virtual-ip 192.168.100.254
dhcp select global
interface Vlanif2000
ip address 172.16.100.253 255.255.255.0
vrrp vrid 200 virtual-ip 172.16.100.254
dhcp select global
---------------------------------
LSW8:
interface Vlanif80
ip address 172.16.80.2 255.255.255.0
interface Vlanif90
ip address 172.16.90.2 255.255.255.0
interface Vlanif172
ip address 172.16.172.2 255.255.255.0
5、DHCP中继
LSW1:
dhcp enable
interface Vlanif10
ip address 192.168.10.252 255.255.255.0
vrrp vrid 10 virtual-ip 192.168.10.254
vrrp vrid 10 priority 120
dhcp select global
interface Vlanif20
ip address 192.168.20.252 255.255.255.0
vrrp vrid 20 virtual-ip 192.168.20.254
vrrp vrid 20 priority 120
dhcp select global
interface Vlanif30
ip address 192.168.30.252 255.255.255.0
vrrp vrid 30 virtual-ip 192.168.30.254
vrrp vrid 30 priority 120
dhcp select global
interface Vlanif40
ip address 192.168.40.252 255.255.255.0
vrrp vrid 40 virtual-ip 192.168.40.254
dhcp select global
interface Vlanif50
ip address 192.168.50.252 255.255.255.0
vrrp vrid 50 virtual-ip 192.168.50.254
dhcp select global
interface Vlanif60
ip address 192.168.60.252 255.255.255.0
vrrp vrid 60 virtual-ip 192.168.60.254
dhcp select global
interface Vlanif70
ip address 192.168.70.252 255.255.255.0
vrrp vrid 70 virtual-ip 192.168.70.254
dhcp select global
interface Vlanif80
ip address 172.16.80.1 255.255.255.0
interface Vlanif100
ip address 172.16.20.254 255.255.255.0
interface Vlanif200
ip address 192.168.200.252 255.255.255.0
vrrp vrid 201 virtual-ip 192.168.200.254
dhcp select global
interface Vlanif1000
ip address 192.168.100.252 255.255.255.0
vrrp vrid 100 virtual-ip 192.168.100.254
vrrp vrid 100 priority 120
dhcp select global
interface Vlanif2000
ip address 172.16.100.252 255.255.255.0
vrrp vrid 200 virtual-ip 172.16.100.254
vrrp vrid 200 priority 120
dhcp select global
-------------------------------
LSW2:
dhcp enable
ip pool vlan10
gateway-list 192.168.10.254
network 192.168.10.0 mask 255.255.255.0
excluded-ip-address 192.168.10.252 192.168.10.253
ip pool vlan20
gateway-list 192.168.20.254
network 192.168.20.0 mask 255.255.255.0
excluded-ip-address 192.168.20.252 192.168.20.253
ip pool vlan30
gateway-list 192.168.30.254
network 192.168.30.0 mask 255.255.255.0
excluded-ip-address 192.168.30.252 192.168.30.253
ip pool vlan40
gateway-list 192.168.40.254
network 192.168.40.0 mask 255.255.255.0
excluded-ip-address 192.168.40.252 192.168.40.253
ip pool vlan50
gateway-list 192.168.50.254
network 192.168.50.0 mask 255.255.255.0
excluded-ip-address 192.168.50.252 192.168.50.253
ip pool vlan60
gateway-list 192.168.60.254
network 192.168.60.0 mask 255.255.255.0
excluded-ip-address 192.168.60.252 192.168.60.253
ip pool vlan70
gateway-list 192.168.70.254
network 192.168.70.0 mask 255.255.255.0
excluded-ip-address 192.168.70.252 192.168.70.253
ip pool vlan200
gateway-list 192.168.200.254
network 192.168.200.0 mask 255.255.255.0
excluded-ip-address 192.168.200.252 192.168.200.253
ip pool vlan1000
gateway-list 192.168.100.254
network 192.168.100.0 mask 255.255.255.0
excluded-ip-address 192.168.100.252 192.168.100.253
ip pool vlan2000
gateway-list 172.16.100.254
network 172.16.100.0 mask 255.255.255.0
excluded-ip-address 172.16.100.252 172.16.100.253
option 43 sub-option 3 ascii 172.16.20.1
6、OSPF路由
LSW1:
ospf 1
area 0.0.0.0
network 192.168.0.0 0.0.255.255
network 172.16.0.0 0.0.255.255
----------------------------
LSW2:
ospf 1
area 0.0.0.0
network 192.168.0.0 0.0.255.255
network 172.16.0.0 0.0.255.255
----------------------------
LSW8:
ospf 1
area 0.0.0.0
network 172.16.0.0 0.0.255.255
7、防火墙FW1基本配置&OSPF
这一部分要不我就先不放在文章中,
配置的设备主要是FW1基本配置
还有OSPF路由等。
如果实在自己弄不出来可以滴滴博主
(因部分资源是收费的,还请见谅)
8、NAT地址转换
FW1:
nat-policy interzone trust untrust outbound
policy 10
action source-nat
policy source 192.168.0.0 mask 16
policy source 172.16.0.0 mask 16
easy-ip GigabitEthernet0/0/0
9、出口路由
AR1:
interface GigabitEthernet0/0/0
ip address 200.1.1.2 255.255.255.0
interface GigabitEthernet0/0/1
ip address 201.1.1.1 255.255.255.0
q
ip route-static 0.0.0.0 0.0.0.0 200.1.1.1
10、无线AC配置
AC2:
vlan batch 100
interface Vlanif100
ip address 172.16.20.1 255.255.255.0
interface GigabitEthernet0/0/1
port link-type access
port default vlan 100
q
ospf 1
area 0.0.0.0
network 172.16.0.0 0.0.255.255
q
wlan
traffic-profile name default
security-profile name ap
security wpa2 psk pass-phrase huawei@123 aes
security-profile name default
security-profile name default-wds
security-profile name default-mesh
ssid-profile name ap
ssid wifi
ssid-profile name default
vap-profile name ap
service-vlan vlan-pool sta-pool
ssid-profile ap
security-profile ap
vap-profile name default
wds-profile name default
mesh-handover-profile name default
mesh-profile name default
regulatory-domain-profile name China regulatory-domain-profile name default
air-scan-profile name default
rrm-profile name default
radio-2g-profile name default
radio-5g-profile name default
wids-spoof-profile name default
wids-profile name default
wireless-access-specification
ap-system-profile name default
port-link-profile name default
wired-port-profile name default
serial-profile name preset-enjoyor-toeap
ap-group name ap
regulatory-domain-profile China
radio 0
vap-profile ap wlan 1
radio 1
vap-profile ap wlan 1
radio 2
vap-profile ap wlan 1
ap-group name default
ap-id 1 ap-mac 00e0-fc54-63e0
ap-name AP2
ap-group ap
ap-id 2 ap-mac 00e0-fcfa-2690
ap-name AP3
ap-group ap
provision-ap