ensp-两层架构的综合实验

实验拓扑:

实验要求：
① 用户的网关配置在核心交换机

② 企业内网划分多个vlan ，减少广播域大小，提高网络稳定性 接入层交换机配置vlan ，并将用户划入相应的vlan 配置好trunk链路 核心上面配置vlan 和SVI 虚拟接口

③ 所有设备，在任何位置都可以telnet远程管理

④ 出口配置NAT

⑤ stp 运行RSTP模式，确保核心交换机为根桥。并将接入用户的接口配置为边缘端口加快收敛。

⑥ 配置根桥保护措施，确保根桥不被抢占

⑦ 所有用户均为自动获取ip地址

⑧ 在企业出口将内网服务器的80端口映射出去，允许外网用户访问

⑨ 企业财务服务器，只允许财务部（vlan 30）的员工访问。

配置命令

SW2:

[SW2]vlan batch 10 30
[SW2]int e0/0/2
[SW2-Ethernet0/0/2]port link-type access 
[SW2-Ethernet0/0/2]port default vlan 10
[SW2-Ethernet0/0/2]int e0/0/3
[SW2-Ethernet0/0/3]port link-type access 
[SW2-Ethernet0/0/3]port default vlan 30
[SW2-Ethernet0/0/3]quit
[SW2]int gi 0/0/1
[SW2-GigabitEthernet0/0/1]port link-type trunk 
[SW2-GigabitEthernet0/0/1]port trunk allow-pass vlan 10 30

SW3

[SW3]vlan 200
[SW3-vlan200]qu
[SW3]int e0/0/2
[SW3-Ethernet0/0/2]port link-type access 
[SW3-Ethernet0/0/2]port default vlan 200
[SW3-Ethernet0/0/2]qu
[SW3]int e0/0/3
[SW3-Ethernet0/0/3]port link-type access 
[SW3-Ethernet0/0/3]port default vlan 200
[SW3-Ethernet0/0/3]qu
[SW3]int gi0/0/1
[SW3-GigabitEthernet0/0/1]port link-type trunk 
[SW3-GigabitEthernet0/0/1]port trunk allow-pass vlan 200

SW1

[SW1]int gi0/0/1
[SW1-GigabitEthernet0/0/1]port link-type trunk #链路模式为trunk
[SW1-GigabitEthernet0/0/1]port trunk allow-pass vlan 10 30  #该链路允许通过vlan 10和30
[SW1-GigabitEthernet0/0/1]qu
[SW1]vlan batch 10 30 200  #创建3个vlan
Info: This operation may take a few seconds. Please wait for a moment...done.
[SW1]int gi0/0/2
[SW1-GigabitEthernet0/0/2]port link-type trunk 
[SW1-GigabitEthernet0/0/2]port trunk allow-pass vlan 200
[SW1]int vlan 10
[SW1-Vlanif10]ip add 192.168.10.1 24
[SW1-Vlanif10]int vlan 30
[SW1-Vlanif30]ip add 192.168.30.1 24
[SW1-Vlanif30]qu
[SW1]int vlan 200
[SW1-Vlanif200]ip add	
[SW1-Vlanif200]ip address 192.168.200.1 24

[SW1]ip pool vlan_10  #在核心交换机上配置地址池
Info:It's successful to create an IP address pool.
[SW1-ip-pool-vlan_10]network 192.168.10.0 mask 24
[SW1-ip-pool-vlan_10]gateway-list 192.168.10.1 #配置网关
[SW1-ip-pool-vlan_10]dns-list 8.8.8.8  #配置dns地址
[SW1-ip-pool-vlan_10]qu
[SW1]ip pool vlan_30
Info:It's successful to create an IP address pool.
[SW1-ip-pool-vlan_30]gateway-list 192.168.30.1
[SW1-ip-pool-vlan_30]network 192.168.30.0 mask 24
[SW1-ip-pool-vlan_30]dns-list 8.8.8.8
[SW1]dhcp enable #开启dhcp服务
Info: The operation may take a few seconds. Please wait for a moment.done.
[SW1]int vlan10
[SW1-Vlanif10]dhcp select global 

配置telnet远程管理

以SW1为例:

[SW1]aaa
[SW1-aaa]local-user hcnp password simple hcnp123 #添加一个账户并设置密码
Info: Add a new user.
[SW1-aaa]local-user hcnp privilege level 3 
[SW1-aaa]local-user hcnp service-type telnet #设置这个用户的服务类型为tellnet远程登陆
[SW1-aaa]qu
[SW1]user-interface vty 0 4 #设置最大连接数为5
[SW1-ui-vty0-4]authentication-mode aaa

配置管理vlan999

管理地址段: 192.168.255.x
因为要对交换机进行配置，但是交换机的物理接口不能配置ip地址，所以设置vlan来添加特定的ip地址进行管理
SW1:

[SW1]vlan 999
[SW1-vlan999]qu
[SW1]interface Vlanif 999
[SW1-Vlanif999]ip address 192.168.255.1 24
[SW1]int gi0/0/1 
[SW1-GigabitEthernet0/0/1]port trunk allow-pass vlan 999
[SW1]int g0/0/2
[SW1-GigabitEthernet0/0/2]port trunk allow-pass vlan 999

SW2:

[SW2]vlan 999
[SW2-vlan999]qu
[SW2]interface Vlanif 999
[SW2-Vlanif999]ip address 192.168.255.2 24
[SW2]ip route-static 0.0.0.0 0 192.168.255.1

[SW2]int g0/0/1
[SW2-GigabitEthernet0/0/1]port trunk allow-pass vlan 999

SW3:

[SW3]vlan 999
[SW3-vlan999]qu
[SW3]interface Vlanif 999
[SW3-Vlanif999]ip address 192.168.255.3 24
[SW3]ip route-static 0.0.0.0 0 192.168.255.1
[SW3]int g0/0/1
[SW3-GigabitEthernet0/0/1]port trunk allow-pass vlan 999

出口配置NAT

SW1:

[SW1]vlan 800
[SW1-vlan800]qu
[SW1]interface g0/0/3
[SW1-GigabitEthernet0/0/3]port link-type access  #设置链路为access模式
[SW1-GigabitEthernet0/0/3]port default vlan 800
[SW1-GigabitEthernet0/0/3]qu
[SW1]interface Vlanif 800
[SW1-Vlanif800]ip address 192.168.254.1 24
[SW1]ip route-static 0.0.0.0 0 192.168.254.2

R1:

[R1]interface g0/0/0
[R1-GigabitEthernet0/0/0]ip address 192.168.254.2 24
[R1-GigabitEthernet0/0/0]qu
[R1]int g0/0/1
[R1-GigabitEthernet0/0/1]ip address 12.1.1.1 29
[R1]acl 2000
[R1-acl-basic-2000]rule permit source 192.168.0.0 0.0.255.255
[R1-acl-basic-2000]int gi0/0/1
[R1-GigabitEthernet0/0/1]nat outbound 2000
[R1]ip route-static 0.0.0.0 0 12.1.1.6
[R1]ip route-static 192.168.0.0 255.255.0.0 192.168.254.1

R2:

[R2]int g0/0/0
[R2-GigabitEthernet0/0/0]ip address 12.1.1.6 29
[R2-GigabitEthernet0/0/0]qu
[R2]int loo 0
[R2-LoopBack0]ip address 9.9.9.9 24  #设置环回地址

交换机配置rstp

在三个交换机上配置rstp

[SW1]stp mode rstp
[SW2]stp mode rstp
[SW3]stp mode rstp

确定核心交换机为根桥:

[SW1]stp priority 0   #修改SW1的优先级为0

设置边缘端口

[SW2]port g e0/0/2 to e0/0/3 #将e/0/2和e0/0/3设置为一个组
[SW2-port-group]stp edged-port enable #命令对于一个组都起作用

[SW3]port g e0/0/2 to e0/0/3
[SW3-port-group]stp edged-port enable 

配置根桥不被抢占

若有人抢占根桥的位置则断开根桥上的指定端口，这种方式对网络的影响很大不建议使用

[SW1]int gi0/0/1
[SW1-GigabitEthernet0/0/1]stp root-protection 
[SW1-GigabitEthernet0/0/1]int gi0/0/2
[SW1-GigabitEthernet0/0/2]stp root-protection 

或者在接入交换机上配置

stp bpdu-protection  #这种方式对网络的影响性较小

将内网的服务器映射出去

在R1的出接口配置

[R1]int g0/0/1
[R1-GigabitEthernet0/0/1]nat server protocol tcp global 12.1.1.4 www inside  192
.168.200.10 www   #将80端口映射出去

配置acl只允许财务部的人访问财务服务器

在核心交换机SW1配置acl

[SW1]acl number 3000
[SW1-acl-adv-3000]rule permit ip source 192.168.30.0 0.0.0.255 destination 192.1
[SW1-acl-adv-3000]rule deny ip source any destination 192.168.200.20 0
[SW1]interface g0/0/2
[SW1-GigabitEthernet0/0/2]traffic-filter outbound acl 3000  #调用acl 3000