企业网三层架构实验

实验拓扑：

 

实验要求：

１、内网ip 地址172.16.0.0/16合理分配
２、SW1/2之间互为备份
３、VRRP / STP / VLAN / TRUNK 均使用
４、所有PC通过DHCP获取IP地址

操作思路：

        此类实验我们处理的思路为IP地址规划，交换，路由，该实验中，我们用到的交换部分知识有：VLAN,TRUNK,VRRP,MSTP,SVI，链路聚合，DHCP(在三层交换机上配置)，使用到的路由部分知识有：NAT,静态缺省，静态路由（或者动态路由）

        先IP地址规划，然后将连接终端的交换机接口调整为ACCESS接口，然后将其调整为STP的边缘接口，加快收敛速度。然后配置TRUNK，配置链路聚合，配置MSTP：四台交换机下的内容务必一致，然后分别修改实例1,2的优先级，使根交换机在汇聚层：最后路由部分使用静态路由配置，内网需要访问公网时，使用静态默认路由指向内网出口方向，然后再在接口上做NAT，内网即可访问公网，三层架构的最终目标是冗余，此时当我们关闭一台设备后内网仍然可以访问公网

具体配置：

SW1

SW1
[SW1]vlan 100
[SW1-GigabitEthernet0/0/1]port link-type access
[SW1-GigabitEthernet0/0/1]port default vlan 100
[SW1-GigabitEthernet0/0/1]int vlan 100
[SW1-Vlanif100]ip add 172.16.0.1 30
[SW1]int Eth-Trunk 0
[SW1]int g0/0/2
[SW1-GigabitEthernet0/0/2]eth-trunk 0
[SW1-GigabitEthernet0/0/2]int g0/0/3
[SW1-GigabitEthernet0/0/3]eth-trunk 0
[SW1]vlan 2
[SW1]port-group group-member GigabitEthernet 0/0/4 to GigabitEthernet 0/0/5 Eth-Trunk 0
[SW1-port-group]port link-type trunk
[SW1-port-group]port trunk allow-pass vlan 2 to 3
[SW1]stp mode mstp
[SW1-mst-region]region-name A
[SW1]stp region-configuration`` [SW1-mst-region]instance 1 vlan 
[SW1-mst-region]instance 2 vlan 2
[SW1-mst-region]active region-configuration 
[SW1]interface Vlan 1
[SW1-Vlanif1]ip add 172.16.1.1 25
[SW1-Vlanif1]int vlan 2
[SW1-Vlanif2]ip add 172.16.1.129 25
[SW1]int Vlanif 1
[SW1-Vlanif1]vrrp vrid 1 virtual-ip 172.16.1.126
[SW1-Vlanif1]vrrp vrid 1 priority 120
[SW1-Vlanif1]vrrp vrid 1 track interface g 0/0/1 reduced 30
[SW1-Vlanif1]int vlan2
[SW1-Vlanif2]vrrp vrid 1 virtual-ip 172.16.1.254
[SW1]ospf 1 router-id 2.2.2.2
[SW1-ospf-1]area 0
[SW1-ospf-1-area-0.0.0.0]network 172.16.0.1 0.0.0.0
[SW1-ospf-1-area-0.0.0.0]q
[SW1-ospf-1]area 1
[SW1-ospf-1-area-0.0.0.1]network 172.16.1.1 0.0.0.0
[SW1-ospf-1-area-0.0.0.1]network 172.16.1.129 0.0.0.0
[SW1-ospf-1-area-0.0.0.1]abr-summary 172.16.1.0 255.255.255.0
[SW1-ospf-1]silent-interface all
[SW1-ospf-1]undo silent-interface Eth-Trunk 0
[SW1-ospf-1]undo silent-interface Vlanif 1

SW2 

SW2
[SW2]vlan 100
[SW2-vlan100]q
[SW2]int vlan 100
[SW2-Vlanif100]ip add 172.16.0.5 30
[SW2-GigabitEthernet0/0/1]port link-type access
[SW2-GigabitEthernet0/0/1]p d v100
[SW2]int Eth-Trunk 0
[SW2-Eth-Trunk0]int g0/0/2
[SW2-GigabitEthernet0/0/2]eth-trunk 0
[SW2-GigabitEthernet0/0/2]int g0/0/3
[SW2-GigabitEthernet0/0/3]eth-trunk 0
[SW2]vlan 2
[SW2]port-group group-member GigabitEthernet 0/0/4 to GigabitEthernet 0/0/5 Eth-Trunk 0
[SW2-port-group]port link-type trunk
[SW2-port-group]port trunk allow-pass vlan 2 to 3
[SW2]stp instance 1 root secondary
[SW2]stp instance 2 root primary
[SW2]interface Vlan 1
[SW2-Vlanif1]ip add 172.16.1.2 25
[SW2-Vlanif1]int vlan 2
[SW2-Vlanif2]ip add 172.16.1.130 25
[SW2-Vlanif1]vrrp vrid 1 virtual-ip 172.16.1.126 
[SW2-Vlanif1]int vlan 2
[SW2-Vlanif2]vrrp vrid 1 virtual-ip 172.16.1.254 
[SW2-Vlanif2]vrrp vrid 1 priority 120
[SW2-Vlanif2]vrrp vrid 1 track int g 0/0/1 reduced 30
[SW2]dhcp enable
[SW2]ip pool g1
[SW2-ip-pool-g1] gateway-list 172.16.1.126
[SW2-ip-pool-g1] network 172.16.1.0 mask 255.255.255.128
[SW2-ip-pool-g1] dns-list 114.114.114.114
[SW2]ip pool g2
[SW2-ip-pool-g2] gateway-list 172.16.1.254
[SW2-ip-pool-g2] network 172.16.1.128 mask 255.255.255.128
[SW2-ip-pool-g2] dns-list 114.114.114.114
[SW2]int vlan 1
[SW2-Vlanif1]dhcp select global
[SW2-Vlanif1]int vlan 2
[SW2-Vlanif2]dhcp select global
[SW2]ospf 1 router-id 2.2.2.22
[SW2-ospf-1]area 0
[SW2-ospf-1-area-0.0.0.0]network 172.16.0.5 0.0.0.0
[SW2-ospf-1-area-0.0.0.0]area 1
[SW2-ospf-1-area-0.0.0.1]network 172.16.1.2 0.0.0.0
[SW2-ospf-1-area-0.0.0.1]network 172.16.1.130 0.0.0.0
[SW2-ospf-1]silent-interface all
[SW2-ospf-1]undo silent-interface Eth-Trunk 0
[SW2-ospf-1]undo silent-interface Vlanif 1
[SW2-ospf-1]undo silent-interface Vlanif 100

SW3

SW3
[SW3]vlan 2
[SW3]int e0/0/4
[SW3-Ethernet0/0/4]port link-type access
[SW3-Ethernet0/0/4]port default vlan 2
[SW3]port-group group-member GigabitEthernet 0/0/1 to GigabitEthernet 0/0/2
[SW3-port-group]port link-type trunk
[SW3-port-group]port trunk allow-pass vlan 2

SW4

SW4
[SW4]vlan 2
[SW4]int e0/0/4
[SW4-Ethernet0/0/4]port link-type access
[SW4-Ethernet0/0/4]port default vlan 2
[SW4]port-group group-member GigabitEthernet 0/0/1 to GigabitEthernet 0/0/2
[SW4-port-group]port link-type trunk
[SW4-port-group]port trunk allow-pass vlan 2
[SW4]port-group group-member Ethernet 0/0/3 to Ethernet 0/0/4
[SW4-port-group]stp enable
[SW4-port-group]stp edged-port enable

R1

R1
[R1]int g0/0/1
[R1-GigabitEthernet0/0/1]ip add 172.16.0.2 30
[R1-GigabitEthernet0/0/1]int g0/0/2
[R1-GigabitEthernet0/0/2]ip add 172.16.0.6 30
[R1-GigabitEthernet0/0/2]int g0/0/0
[R1-GigabitEthernet0/0/0]ip add 192.168.1.1 24
[R1]ospf 1 router-id 1.1.1.1
[R1-ospf-1]area 0
[R1-ospf-1-area-0.0.0.0]network 172.16.0.0 0.0.0.255
[R1]ip route-static 0.0.0.0 0 192.168.1.2
[R1-ospf-1]default-route-advertise
[R1-ospf-1]q
[R1]acl 2000
[R1-acl-basic-2000]rule permit source 172.16.0.0 0.0.255.255
[R1-acl-basic-2000]q
[R1]int g0/0/0
[R1-GigabitEthernet0/0/0]nat outbound 2000

R2

R2
[ISP]int g0/0/0
[ISP-GigabitEthernet0/0/0]ip add 192.168.1.2 24

实验结果：