网络拓扑配置（内网-外网）

网络拓扑配置（内网-外网）

配置流程

内网二层交换机的配置

1. 改名

switch（config）#hostname s2

2. 建立vlan

s2（config）#vlan 100
s2（config）#vlan 200
s2（config）#vlan 1

3. 设置互联地址

int vlan 1
ip address 172.16.1.1 255.255.255.0
no shutdown

4. 设置接口类型

int fa0/1
switchport mode trunk
switchport trunk allowed vlan all
int fa0/2
switchport access vlan 100
int fa0/3
switchport access vlan 200

5. 设置默认网关

ip default-gatway 172.16.1.2 !默认网关不需要掩码

6. 保存配置

s2#write

内网三层交换机的配置

1. 改名

switch（config）#hostname s1

2. 建立vlan

vlan 100
vlan 200
vlan 300
vlan 1
vlan 2

3. 设置互联地址

int vlan 1
ip address 172.16.1.2 255.255.255.0
no shutdown

4. 设置接口类型

int fa0/2
switchport mode trunk
switchport trunk allowed vlan all
int fa0/1
switchport access vlan 2
int fa0/3
switchport access vlan 300
int fa0/4
switchport access vlan 300

5. 设置用户网关

int vlan 100
ip address 192.168.1.10 255.255.255.0
no shutdown
int vlan 200
ip address 192.168.2.10 255.255.255.0
no shutdown
int vlan 300
ip address 10.1.1.126 255.255.255.128
no shutdown

6. 设置默认路由

ip route 0.0.0.0 0.0.0.0 172.16.2.1

7. 保存配置

s2#write

路由器R1的配置（内网路由器）

使用静态路由协议

1. 设置接口地址 C

int fa0/0
ip address 172.16.2.1 255.255.255.0
int fa0/1
ip address 172.16.3.1 255.255.255.0

2. 设置静态路由（指向内网）

ip route 192.168.1.0 255.255.255.0 172.16.2.2
ip route 192.168.2.0 255.255.255.0 172.16.2.2
ip route 10.1.1.0 255.255.255.128 172.16.2.2
ip route 0.0.0.0 0.0.0.0 172.16.3.2 (指向外网)

1. 建立nat 地址池

1. 建立nat 地址池

ip nat pool abc 10.1.1.128 10.1.1.254 netmask 255.255.255.128
2.建立 ACL
access-list 10 permit 192.168.2.0 0.0.0.255
3.建立 NAT 和 ACL 关联
ip nat inside source list 10 pool abc
4.应用到端口
int fa0/1
ip nat outside
int fa0/0
ip nat inside

2.设置 ACL

1. 建立规则

access-list 101 deny tcp 192.168.2.0 0.0.0.255 host 10.10.10.1 eq 21
access-list 101 deny tcp 192.168.2.0 0.0.0.255 any eq 8000
access-list 101 deny udp 192.168.2.0 0.0.0.255 any eq 4000
access-list 101 permit ip any any

2. 应用规则到端口

int fa0/0
ip access-group 101 in

路由器R2的配置（外网路由器）

1. 配置接口地址

int fa0/0
ip address 172.16.3.2 255.255.255.0
no shutdown
int fa0/1
ip address 10.10.10.254 255.255.255.0
no shutdown
2.静态路由
ip route 10.1.1.0 255.255.255.0 172.16.3.1
255.255.255.0 包括公网服务器地址和nat地址池地址

3. 保存配置

write