总部核心交换机DCRS上开启SSH远程管理功能, 本地认证用户名:2022DCN,密码:DCN2022;
ssh-server enable
username test privilege 15 password 0 test
authentication line vty login local
ssh-user test password 0 test
CS开启telnet登录功能,用户名skills01,密码skills01,配置使用telnet方式登录终端界面前显示如下授权信息:“WARNING!!! Authorised access only, all of your done will be recorded! Disconnected IMMEDIATELY if you are not an authorised user! Otherwise, we retain the right to pursue the legal responsibility”;
telnet-server enable
username skills01 privilege 15 password 0 skills01
authentication line vty login local
banner login WARNING!!! Authorised access only, all of your done will be recorded! Disconnected IMMEDIATELY if you are not an authorised user! Otherwise, we retain the right to pursue the legal responsibility
对SW上VLAN50开启以下安全机制。业务内部终端相互二层隔离;14口启用环路检测,环路检测的时间间隔为10s,发现环路以后关闭该端口,恢复时间为30分钟,如私设DHCP服务器关闭该端口,同时开启防止ARP网关欺骗攻击。
isolate-port group 4 sw int e/0/4 //端口加入隔离组
isolate-port group 5 sw int e/0/5
isolate-port group 6 sw int e/0/6
isolate-port group 7 sw int e/0/7
isolate-port group 8 sw int e/0/8
启用环路检测:
loopback-detection trap enable
loopback-detection interval-time 10 10 //设置环路时间间隔配置
int e1/0/4-8
loopback-detection specified-vlan 40 //指定VLAN环路检测
loopback-detection control shutdown //端口控制方式
exit
loopback-detection control-recovery timeout 3000 //环路自动回复时间
检测到在vlan40中私设dhcp服务器则关闭该端口
ip dhcp snooping enable
ip dhcp snooping binding enable #开启DHCP snooping //绑定开关
ip dhcp snooping binding arp
int e1/0/4-8
ip dhcp snooping binding user-control //端口绑定用户配置
ip dhcp snooping action shutdown //端口防御动作为shutdown
勒索蠕虫病毒席卷全球,爆发了堪称史上最大规模的网络攻击,通过对总部核心交换机CS所有业务VLAN下配置访问控制策略实现双向安全防护;
ip access-list extended bingdu
deny tcp any-source any-destination d-port 135
deny tcp any-source any-destination d-port 137
deny tcp any-source any-destination d-port 138
deny tcp any-source any-destination d-port 139
deny tcp any-source any-destination d-port 445
permit tcp any-source any-destination
vacl ip access-group bingdu in vlan 10;20;30;40
vacl ip access-group bingdu out vlan 10;20;30;40
permit ip any-source any-destination
permit ip any-source tcp any-destination d-port 135
permit ip any-source tcp any-destination d-port 137
permit ip any-source tcp any-destination d-port 138
permit ip any-source tcp any-destination d-port 139
permit ip any-source tcp any-destination d-port 445
permit ip any-source udp any-destination d-port 135
permit ip any-source udp any-destination d-port 137
permit ip any-source udp any-destination d-port 138
permit ip any-source udp any-destination d-port 139
permit ip any-source udp any-destiantion d-port 445
vacl ip acccess-group BD in vlan 10;20;30;40
如果CS E1/0/3端口的收包速率超过30000则关闭此端口,恢复时间5分钟,并每隔10分钟对端口的速率进行统计;为了更好地提高数据转发的性能,CS交换中的数据包大小指定为1600字节;
int e1/0/3
rate-violation all 30000
rate-vio con shut re 300 //后面的rec300,可以不用配置,这是默认配置
mtu 1600 //数据包大小16字节
sflow counter-interval //配置统计时间
port-rate-statistics interval 600 //配置统计时间
在总部核心交换机端口ethernet1/0/6上,将属于网段20.1.41.0内的报文带宽限制为10M比特/秒,突发值设为4M字节,超过带宽的该网段内的报文一律丢弃。
ip access-list extended ftp //建立访问控制列表
permit tcp 192.168.80.0 0.0.0.255 any-destination //建立规则
mls qos //启动Qos功能
class-map 1 //建立匹配列表
match access-group ftp //匹配访问列表
policy-map 1 //建立策略
class 1 //策略匹配列表
policy 10000 4000 exceed-action drop
int e0/1/6 //进入接口模式
service-policy input 1 //应用于接口
总部部署了一套网管系统实现对核心 DCRS 进行管理,网管系统 IP 为:10.52.0.100,读团体值为:DCN2021,版本为 V2C, DCRS Trap 信息实时上报网管,当 MAC 地址发生变化时,也要立即通知 网管发生的变化,每35s发送一次;DCRS出口往返流量发送给DCBI, 由 DCBI 对收到的数据进行用户所要求的分析;
snmp-server enable //开启snmp功能
snmp-server security ip 10.52.0.100 //配置网管主机ip地址
snmp-server host 10.52.0.100 v2c DCN2021 //将trap信息发送到网管主机
snmp-server community ro 0 DCN2021 //ro方式的都团体串
snmp-server enable traps
snmp-server enable traps mac-notification
mac-address-table notification interval 35
mac-address-table violation-trap-interval 35
总部交换机SW配置简单网络管理协议,计划启用V3版本,V3版本在安全性方面做了极大的扩充。配置引擎号分别为62001;创建认证用户为skills01,采用3des算法进行加密,密钥为:skills01,哈希算法为SHA,密钥为:skills01;加入组ABC,采用最高安全级别;配置组的读、写视图分别为:2022_R、2022_W;当设备有异常时,需要使用本地的VLAN100地址发送Trap消息至网管服务器10.51.0.203,采用最高安全级别;
snmp-server enable
snmp-server engineid 62001
snmp-server trap-source 10.51.0.203
snmp-server user skills01 ABC authpriv 3des skills01 auth sha skills01
snmp-server group ABC authpriv wite 2022_W read 2022_R
snmp-server host 10.51.0.203 v3 authpriv skills01
为了防止DOS攻击的发生,在总部交换机vlan50接口下对MAC、ARP、ND表项数量进行限制,具体要求为:最大可以学习20个动态MAC地址、20个动态ARP地址、50个NEIGHBOR表项。
int vlan 50
switchport mac-address dynamic maximum 20 //配置mac地址学习限制
switchport arp dynamic maximum 20 //配置arp地址学习限制
switchport nd dynamic maximum 50 //新建NEIGHOBR表项限制
FW与CS建立两对IBGP邻居关系,使用AS 65500,FW上loopback1-4为模拟AS 65500中网络,为保证数据通信的可靠性和负载,完成以下配置,要求如下:
l CS通过BGP到达loopback1,2网路下一跳为10.3.0.254;
l CS通过BGP到达loopback3,4网络下一跳为10.4.0.254;
l 通过BGP实现到达loopback1,2,3,4的网络冗余;
l 使用IP前缀列表匹配上述业务数据流;
l 使用LP属性进行业务选路,只允许使用route-map来改变LP属性、实现路由控制,AS PATH属性可配置的参数数值为:65509
CS:
router bgp 65500
neighbor 10.3.0.254 remote-as 65500
neighbor 10.3.0.254 update-source 10.3.0.253
neighbor 10.4.0.254 remote-as 65500
neighbor 10.4.0.254 update-source 10.4.0.253
show ip bgp summary /查看bgp邻居状态,down的话需要在BC上放行策略
开始配置前缀表
ip prefix-list 1and2 permit 10.11.0.0/24
ip prefix-list 1and2 permit 10.12.0.0/24
ip prefix-lsit 3and4 permit 10.13.0.0/24
ip prefix-list 3and4 permit 10.14.0.0/24
开始配置路由图
router-map 1and2 permit 12
match ip address prefix-list 1and2
exit
router-map 3and4 permit 34
match ip address prefix-list 3and4
exit
router bgp 65500
neighbor 10.3.0.254 route-map 1and2 in
neighbor 10.4.0.254 route-map 3and4 in //到这选路下一跳设置完成
exit
exit
show ip bgp
config
route-map 1and2 permit 12
set local-preference 200
set as-path prepend 65509
exit
route-map 1and2 permit 120 //为l1和l2新建一个冗余备份路由图序号
match ip address prefix-list 3and4 //为其匹配前缀路由表路径
set local-preference 100
set as-path prepend 65509
exit
route-map 3and4 permit 34
set local-perference 200
set as-path prepend 65509
exit
route-map 3and4 permit 340 //为l3和l4新建一个冗余备份路由图序号
match ip address prefix-list 1and2 //为其匹配前缀路由表路径
set local-preference 100
set as-path prepend 65509
show ip bgp
FW:
ip vrouter trust-vr
router bgp 65500
neighbor 10.3.0.253 remote-as 65500
neighbor 10.3.0.253 update-source e0/3
neighbor 10.4.0.253 remote-as 65500
neighbor 10.4.0.253 update-source e0/4
show ip bgp summary //查看bgp邻居状态
show configuration vrouter trust-vr //查看路由配置
开始宣告题目需要配置的地址路径
network 10.11.0.1/24
network 10.12.0.1/24
network 10.13.0.1/24
network 10.14.0.1/24
配置使总部VLAN50 业务的用户访问IDC SERVER 的数据流 经过FW 10.1.0.254, IDC SERVER 返回数据流经过FW 10.2.0.254,且 对双向数据流开启所有安全防护,参数和行为为默认。
CS(config)#ip access-list extended valn40-IDC
CS(config-ip-ext-nacl-valn40-idc)#permit ip 172.16.40.0 0.0.0.63 host-destination 10.100.18.2
CS(config-ip-ext-nacl-valn40-idc)#exit
CS(config)#class-map c-out
CS(config-classmap-c-out)#match access-group vlan40-IDC
Warning:fail to find access-group vlan40-IDC.
CS(config-classmap-c-out)#exit
CS(config)#policy-map p-out
CS(config-policymap-p-out)#class c-out
CS(config-policymap-p-out-class-c-out)#set ip nexthop 10.1.0.254
RS配置IPv6地址,使用相关特性实现VLAN50的IPv6终端可自动从网关处获得IPv6有状态地址;
WS配置IPv6地址,开启路由公告功能,路由器公告的生存期为2小时,确保VLAN30的IPv6终端可以获得IPv6无状态地址。
WS与RS之间配置RIPng, 使PC1与PC3可以通过IPv6通信;
IPv6业务地址规划如下,其它IPv6地址自行规划:
业务 | IPV6地址 |
VLAN30 | 2001:30::254/64 |
VLAN50 | 2001:50::254/64 |
WS:
server dhcpv6 //开启dhcpv6地址下发
ipv6 dhcp pool vlan30 //配置dhcpv6地址池
exit
int vlan 30
ipv6 address 2001:30::254/64 //手动配置ipv6地址
ipv6 nd mamaged-config-flag //无地址配置时主机使用dhcpv6协议
ipv6 nd other-config-flag //无地址配置时使用dhcpv6
exit
server dhcpv6
ipv6 dhcp pool vlan50
network-address 2001:80::64 //设置下发地址
exit
int vlan 50
ipv6 address 2001:80::254/64
ipv6 nd other-config-flag //无地址时配置主机使用dhcpv6协议
DCRS(config)#interface Vlan30
DCRS(Config-if-Vlan30) #ipv6 router rip
Exit
Int vlan 50
Ipv6 router rip