【ensp】DHCP配置

实验条件：

1.合理配置IP地址
2.如图规划VLAN信息，PC1/PC2/PC3属于VLAN103，AR1属于VLAN101
3.需要合理配置MSTP,ETH-TRUNK,VRRP使网络达到最佳可用性
4.配置动态路由协议，使全网互通，私有地址不允许出现在ISP中 要求：AR3不允许配置任何路由
5.将PC5配置成DHCP服务器，所有的PC都需要通过DHCP自动获取地址。
6.AR2和AR6之间的链路上需要上CHAP认证
7.在AR1上配置telnet功能，使PC5可以使用admin1/admin1登陆到AR1上进行远程管理
8.只允许PC5 TELNET到AR1，其余所有设备都不能TELNET到AR1，但是PC5不能ping通AR1，其余的都不爱影响

第一步 搭建拓扑

第二步 划分vlan，配置合理的MSTP

[LSW1]vlan b  10 101 103
[LSW1]interface Eth-Trunk1
[LSW1-Eth-Trunk1]trunkport g 0/0/1 0/0/2
[LSW1-Eth-Trunk1]port link-type trunk
[LSW1-Eth-Trunk1]port trunk allow-pass vlan 101 103
[LSW1-Eth-Trunk1]interface GigabitEthernet0/0/3
[LSW1-GigabitEthernet0/0/3] port link-type trunk
[LSW1-GigabitEthernet0/0/3] port trunk allow-pass vlan 101 103
[LSW1-GigabitEthernet0/0/3]interface GigabitEthernet0/0/4
[LSW1-GigabitEthernet0/0/4] port link-type trunk
[LSW1-GigabitEthernet0/0/4] port trunk allow-pass vlan 101 103
[LSW1-GigabitEthernet0/0/4]interface GigabitEthernet0/0/5
[LSW1-GigabitEthernet0/0/5] port link-type access
[LSW1-GigabitEthernet0/0/5] port default vlan 10
[LSW1-GigabitEthernet0/0/5] quit 

[LSW1]stp region-configuration 	//配置MSTP
[LSW1-mst-region] region-name cake    
[LSW1-mst-region] revision-level 18		
[LSW1-mst-region] instance 1 vlan 101
[LSW1-mst-region] instance 2 vlan 103
[LSW1-mst-region] active region-configuration
[LSW1-mst-region]quit
[LSW1]stp instance 1 root primary
[LSW1]stp instance 2 root secondary

此处命令为：
display current-configuration | begin int

[LSW2]vlan b 20 101 103
[LSW2]interface Eth-Trunk1
[LSW2-Eth-Trunk1]trunkport g 0/0/1 0/0/2
[LSW2-Eth-Trunk1] port link-type trunk
[LSW2-Eth-Trunk1] port trunk allow-pass vlan 101 103
[LSW2-Eth-Trunk1]interface GigabitEthernet0/0/3
[LSW2-GigabitEthernet0/0/3] port link-type trunk
[LSW2-GigabitEthernet0/0/3] port trunk allow-pass vlan 101 103
[LSW2-GigabitEthernet0/0/3]interface GigabitEthernet0/0/4
[LSW2-GigabitEthernet0/0/4] port link-type trunk
[LSW2-GigabitEthernet0/0/4] port trunk allow-pass vlan 101 103
[LSW2-GigabitEthernet0/0/4]interface GigabitEthernet0/0/5
[LSW2-GigabitEthernet0/0/5] port link-type access
[LSW2-GigabitEthernet0/0/5] port default vlan 20
[LSW2-GigabitEthernet0/0/5]q

[LSW2]stp region-configuration  //配置MSTP
[LSW2-mst-region] region-name cake
[LSW2-mst-region] revision-level 18
[LSW2-mst-region] instance 1 vlan 101
[LSW2-mst-region] instance 2 vlan 103
[LSW2-mst-region] active region-configuration
[LSW2-mst-region]quit
[LSW2]stp instance 2 root primary
[LSW2]stp instance 1 root secondary

[LSW3]vlan b 101 103
[LSW3]interface GigabitEthernet0/0/1
[LSW3-GigabitEthernet0/0/1] port link-type trunk
[LSW3-GigabitEthernet0/0/1] port trunk allow-pass vlan 101 103
[LSW3-GigabitEthernet0/0/1]interface GigabitEthernet0/0/2
[LSW3-GigabitEthernet0/0/2] port link-type trunk
[LSW3-GigabitEthernet0/0/2] port trunk allow-pass vlan 101 103
[LSW3-GigabitEthernet0/0/2]interface GigabitEthernet0/0/3
[LSW3-GigabitEthernet0/0/3] port link-type access
[LSW3-GigabitEthernet0/0/3] port default vlan 101
[LSW3-GigabitEthernet0/0/3]interface GigabitEthernet0/0/4
[LSW3-GigabitEthernet0/0/4] port link-type access
[LSW3-GigabitEthernet0/0/4] port default vlan 103
[LSW3-GigabitEthernet0/0/4]quit 
[LSW3]stp region-configuration		//配置MSTP
[LSW3-mst-region] region-name cake
[LSW3-mst-region] revision-level 18
[LSW3-mst-region] instance 1 vlan 101
[LSW3-mst-region] instance 2 vlan 103
[LSW3-mst-region] active region-configuration
[LSW3-mst-region]quit

在这里插入图片描述

[LSW4]vlan b 101 103
[LSW4]interface GigabitEthernet0/0/1
[LSW4-GigabitEthernet0/0/1] port link-type trunk
[LSW4-GigabitEthernet0/0/1] port trunk allow-pass vlan 101 103
[LSW4-GigabitEthernet0/0/1]interface GigabitEthernet0/0/2
[LSW4-GigabitEthernet0/0/2] port link-type trunk
[LSW4-GigabitEthernet0/0/2] port trunk allow-pass vlan 101 103
[LSW4-GigabitEthernet0/0/2]interface GigabitEthernet0/0/3
[LSW4-GigabitEthernet0/0/3] port link-type access
[LSW4-GigabitEthernet0/0/3] port default vlan 103
[LSW4-GigabitEthernet0/0/3]interface GigabitEthernet0/0/4
[LSW4-GigabitEthernet0/0/4] port link-type access
[LSW4-GigabitEthernet0/0/4] port default vlan 103
[LSW4-GigabitEthernet0/0/4]quit 
[LSW4]stp region-configuration		//配置MSTP
[LSW4-mst-region] region-name cake
[LSW4-mst-region] revision-level 18
[LSW4-mst-region] instance 1 vlan 101
[LSW4-mst-region] instance 2 vlan 103
[LSW4-mst-region] active region-configuration

第三步 配置IP与VRRP

[LSW1]interface Vlanif10
[LSW1-Vlanif10] ip address 192.168.10.5 255.255.255.0	//此处ip应与对端（即ar2的0/0/0接口）IP网段相同
[LSW1-Vlanif10] interface Vlanif101
[LSW1-Vlanif101] ip address 192.168.101.252 255.255.255.0
[LSW1-Vlanif101] vrrp vrid 101 virtual-ip 192.168.101.254
[LSW1-Vlanif101] vrrp vrid 101 priority 105     //设置vrrp  vrid 101 的优先级为 105（默认为100），此时为了让LSW1成为101的master故有此条命令
[LSW1-Vlanif101]interface Vlanif103
[LSW1-Vlanif103] ip address 192.168.103.252 255.255.255.0
[LSW1-Vlanif103] vrrp vrid 103 virtual-ip 192.168.103.254

[LSW2]interface Vlanif20
[LSW2-Vlanif20] ip address 192.168.20.5 255.255.255.0		//此处ip应与对端（即ar2的0/0/1接口）IP网段相同
[LSW2-Vlanif20]interface Vlanif101
[LSW2-Vlanif101] ip address 192.168.101.253 255.255.255.0
[LSW2-Vlanif101] vrrp vrid 101 virtual-ip 192.168.101.254
[LSW2-Vlanif101]interface Vlanif103
[LSW2-Vlanif103] ip address 192.168.103.253 255.255.255.0
[LSW2-Vlanif103] vrrp vrid 103 virtual-ip 192.168.103.254
[LSW2-Vlanif103] vrrp vrid 103 priority 105		 //设置vrrp  vrid 103 的优先级为 105（默认为100），此时为了让LSW2成为103的master故有此条命令

检查配置

[AR2]interface GigabitEthernet0/0/0
[AR2-GigabitEthernet0/0/0] ip address 192.168.10.2 255.255.255.0 
[AR2-GigabitEthernet0/0/0]interface GigabitEthernet0/0/1
[AR2-GigabitEthernet0/0/1] ip address 192.168.20.2 255.255.255.0 
[AR2-GigabitEthernet0/0/1]interface GigabitEthernet0/0/2
[AR2-GigabitEthernet0/0/2] ip address 101.1.1.2 255.255.255.0 

[AR3]interface GigabitEthernet0/0/0
[AR3-GigabitEthernet0/0/0] ip address 101.1.1.3 255.255.255.0 
[AR3-GigabitEthernet0/0/0]interface LoopBack1
[AR3-LoopBack1] ip address 8.8.8.8 255.255.255.255 

第四步 配置DHCP

[PC5]dhcp en
[PC5]ip route-static 0.0.0.0 0.0.0.0 192.168.103.254		//指向网关
[PC5]ip pool VLAN101				//创建IP地址池VLAN01
[PC5-ip-pool-VLAN101]gateway-list 192.168.101.254 		//dhcp分配地址网关为192.168.101.254
[PC5-ip-pool-VLAN101]network 192.168.101.0 mask 255.255.255.0 		//dhcp分配地址网段为192.168.101.0网段	
[PC5-ip-pool-VLAN101] excluded-ip-address 192.168.101.252 192.168.101.253 		//排除地址 192.168.101.252到192.168.101.253 ----因为LSW1与LSW2已经占用了这两个地址，如果不排除，电脑获取会发生错误
[PC5-ip-pool-VLAN101]q
[PC5]ip pool VLAN103
[PC5-ip-pool-VLAN103]gateway-list 192.168.103.254 
[PC5-ip-pool-VLAN103]network 192.168.103.0 mask 255.255.255.0 
[PC5-ip-pool-VLAN103]excluded-ip-address 192.168.103.252 192.168.103.253 
[PC5-ip-pool-VLAN103]q
[PC5]interface GigabitEthernet0/0/0
[PC5-GigabitEthernet0/0/0]ip address 192.168.103.5 255.255.255.0 		//分发地址必须有个人地址
[PC5-GigabitEthernet0/0/0]dhcp select global		//启用DHCP全局地址池

//为了让AR1获取PC5分发的地址，我们在LSW1和LSW2中配置中继接口
[LSW1]dhcp enable
[LSW1-Vlanif101] dhcp select relay
[LSW1-Vlanif101] dhcp relay server-ip 192.168.103.5

[LSW2]dhcp enable
[LSW2-Vlanif101] dhcp select relay
[LSW2-Vlanif101] dhcp relay server-ip 192.168.103.5

此时查看pc有没有分配到IP地址

分配到说明DHCP配置应该没什么毛病

[AR1]dhcp enable
[AR1]interface GigabitEthernet0/0/0
[AR1-GigabitEthernet0/0/0] ip address dhcp-alloc

[AR6]interface GigabitEthernet0/0/0
[AR6-GigabitEthernet0/0/0] ip address 172.16.16.254 255.255.255.0 
[AR6-GigabitEthernet0/0/0] dhcp select interface			//从接口分配ip，网关为接口ip，网段与接口网段一致
[AR6-GigabitEthernet0/0/0] dhcp server static-bind ip-address 172.16.16.16 mac-address 5489-986f-4cba 			//dhcp服务器静态绑定ip地址172.16.16.16，绑定的mac地址是5489-986f-4cba

第五步 在AR2与AR6上配置CHAP

[AR2]aaa
[AR2-aaa] local-user admin1 password cipher admin1
[AR2-aaa] local-user admin1 service-type ppp
[AR2-aaa]q
[AR2]interface Serial4/0/0
[AR2-Serial4/0/0] link-protocol ppp
[AR2-Serial4/0/0] ppp chap user admin1		//user与对端aaa中的user一样，此处推荐两方aaa用户名密码保持一致
[AR2-Serial4/0/0] ppp chap password cipher admin1
[AR2-Serial4/0/0] ip address 10.26.26.1 255.255.255.252 

[AR6]aaa
[AR6-aaa] local-user admin1 password cipher admin1
[AR6-aaa] local-user admin1 service-type ppp
[AR6-aaa]q
[AR6]interface Serial4/0/0
[AR6-Serial4/0/0] link-protocol ppp
[AR6-Serial4/0/0] ppp chap user admin1
[AR6-Serial4/0/0] ppp chap password cipher admin1
[AR6-Serial4/0/0] ip address 10.26.26.2 255.255.255.252 
[AR6-Serial4/0/0]shutdown
[AR6-Serial4/0/0]undo shutdown		
//chap成功与否要shutdown看一下，如果shutdown过后还是双up的则配置成功

第六步 配置OSPF，配置NAT

[LSW1]ospf 10 
[LSW1-ospf-10] silent-interface Vlanif101
[LSW1-ospf-10] silent-interface Vlanif103
[LSW1-ospf-10] area 0.0.0.0
[LSW1-ospf-10-area-0.0.0.0]  network 192.168.10.0 0.0.0.255
[LSW1-ospf-10-area-0.0.0.0]  network 192.168.101.0 0.0.0.255
[LSW1-ospf-10-area-0.0.0.0]  network 192.168.103.0 0.0.0.255

[LSW2]ospf 10
[LSW2-ospf-10] silent-interface Vlanif101
[LSW2-ospf-10] silent-interface Vlanif103
[LSW2-ospf-10] area 0.0.0.0
[LSW2-ospf-10-area-0.0.0.0]  network 192.168.20.0 0.0.0.255
[LSW2-ospf-10-area-0.0.0.0]  network 192.168.101.0 0.0.0.255
[LSW2-ospf-10-area-0.0.0.0]  network 192.168.103.0 0.0.0.255

[AR2]ip route-static 0.0.0.0 0.0.0.0 101.1.1.3		//配置通往外网的默认路由
//开始配置NAT
[AR2]acl 2000  //进入acl2000。
[AR2-acl-basic-2000]rule permit source 192.168.20.0 0.0.0.255  
//允许192.168.10.0/24这个网段的主机通过。
[AR2-acl-basic-2000]rule permit source 192.168.10.0 0.0.0.255 
//允许192.168.168.20/24这个网段的主机通过。
[AR2-acl-basic-2000]rule permit source 192.168.101.0 0.0.0.255 
//允许192.168.101.0/24 这个网段的主机通过。
[AR2-acl-basic-2000]rule permit source 192.168.103.0 0.0.0.255 
//允许192.168.103.0/24 这个网段的主机通过。
[AR2-acl-basic-2000]interface g 0/0/2
[AR2-GigabitEthernet0/0/2]nat outbound 2000
//进入接口0/0/2，将acl2000允许的网段的私有ip地址转换为本接口ip地址。
[AR2-GigabitEthernet0/0/2]q
[AR2]ospf 10 
[AR2-ospf-10] default-route-advertise always		//宣告默认路由
[AR2-ospf-10] area 0.0.0.0 
[AR2-ospf-10-area-0.0.0.0]  network 10.26.26.0 0.0.0.3 
[AR2-ospf-10-area-0.0.0.0]  network 192.168.10.0 0.0.0.255 
[AR2-ospf-10-area-0.0.0.0]  network 192.168.20.0 0.0.0.255 

[AR6]ospf 10 
[AR6-ospf-10] area 0.0.0.0 
[AR6-ospf-10-area-0.0.0.0]  network 10.26.26.0 0.0.0.3 
[AR6-ospf-10-area-0.0.0.0]  network 172.16.16.0 0.0.0.255 

检查邻接关系

测试全网连通性—此处只放了一个图，个人检查要更细致些

测试ip地址是否转换

第七步 配置telnet

[AR1]aaa
[AR1-aaa] local-user admin1 password cipher admin1
[AR1-aaa] local-user admin1 privilege level 3
[AR1-aaa] local-user admin1 service-type telnet
[AR1-aaa]q
[AR1]user-interface vty 0 4
[AR1-ui-vty0-4] authentication-mode aaa

配置完成后测试别的路由是否能够登录到AR1上

第八步 配置高级acl达成仅PC5可以telnet到AR1

[AR1]acl 3000
[AR1-acl-adv-3000] rule  permit tcp source 192.168.103.5 0 destination-port eq telnet 		//允许源ip为192.168.103.5路由telnet
[AR1-acl-adv-3000] rule  deny icmp source 192.168.103.5 0 destination 192.168.101.251 0 		//不允许源ip为192.168.103.5 ping 目标IP为192.168.101.251
[AR1-acl-adv-3000] rule deny tcp destination-port eq telnet 	//除了前面允许的ip通过，其余所有想telnet的ip均不通过
[AR1-acl-adv-3000]q 
[AR1]interface GigabitEthernet0/0/0
[AR1-GigabitEthernet0/0/0] traffic-filter inbound acl 3000

配置成功后现象应为下图：

实验完成。

若有不足或错误，请帮忙指出，谢谢。