HCIA综合实验

要求：
1.ISP路由器仅配置IP地址
2.内部网络基于192.168.1.0 24 网段进行IP规划
3.R1/R2之间使用OSPF做到内侧全网，单区域
4.PC1-PC4使用DHCP获取地址
5.PC1-PC4可以访问PC5；PC1不行
6.R2出口只拥有一个公网IP
7.test-1设备可以登录内网telnet服务器；test-2不行

实验过程

1.分配网段，分配合适的网段

192.168.1.00 00 0000
192.168.1.00 00 0000
192.168.1.00 00 0001---192.168.1.1 28
192.168.1.00 01 0000
192.168.1.00 01 0001---192.168.1.17 28
192.168.1.00 10 0000
192.168.1.00 10 0001---192.168.1.33 28
192.168.1.00 11 0000
192.168.1.00 11 0001---192.168.1.49 28
192.168.1.01 000000
192.168.1.01 000001----192.168.1.65 26
192.168.1.01 000010----192.168.1.66 26

192.168.1.10 0 00000
192.168.1.10 0 00000
192.168.1.10 0 00001---192.168.1.129 27
192.168.1.10 1 00000
192.168.1.10 1 00001---192.168.1.161 27

192.168.1.11 000000---保留

2.在交换机上分配vlan

在两个交换机上的操作是一样的

[Huawei]vlan 2
[Huawei]vlan 3
[Huawei-GigabitEthernet0/0/1]port link-type access 
[Huawei-GigabitEthernet0/0/1]port default vlan 2
[Huawei-GigabitEthernet0/0/2]port link-type access 
[Huawei-GigabitEthernet0/0/2]port default vlan 3
[Huawei-GigabitEthernet0/0/4]port link-type trunk 
[Huawei-GigabitEthernet0/0/4]port trunk allow-pass vlan all 

创建结果

 3.在R1上启动DHCP协议（R2上也是一样）

[Huawei]interface GigabitEthernet 0/0/0.1
[Huawei-GigabitEthernet0/0/0.1]dot1q termination vid 2
[Huawei-GigabitEthernet0/0/0.1]ip address 192.168.1.1 28
[Huawei]dhcp enable 
[Huawei]ip pool tt
[Huawei-ip-pool-tt]network 192.168.1.0 mask 28
[Huawei-ip-pool-tt]gateway-list 192.168.1.1
[Huawei-ip-pool-tt]dns-list 8.8.8.8
[Huawei-ip-pool-dsy1]q
[Huawei]interface GigabitEthernet 0/0/0.1
[Huawei-GigabitEthernet0/0/0.1]dhcp select global 
[Huawei-GigabitEthernet0/0/0.1]q
[Huawei]interface GigabitEthernet 0/0/0.2
[Huawei-GigabitEthernet0/0/0.2]dot1q termination vid 3
[Huawei-GigabitEthernet0/0/0.2]ip address 192.168.1.17 28
[Huawei]dhcp enable 
[Huawei]ip pool ttt
[Huawei-ip-pool-ttt]network 192.168.1.16 mask 28
[Huawei-ip-pool-ttt]gateway-list 192.168.1.17
[Huawei-ip-pool-ttt]dns	
[Huawei-ip-pool-ttt]dns-list 8.8.8.8
[Huawei-ip-pool-ttt]q
[Huawei]interface GigabitEthernet 0/0/0.2
[Huawei-GigabitEthernet0/0/0.2]dhcp select global 
[Huawei]interface GigabitEthernet 0/0/0.3	
[Huawei-GigabitEthernet0/0/0.3]dot1q termination vid 4
[Huawei-GigabitEthernet0/0/0.3]ip address 192.168.1.33 28

 4.在R1上配置ospf的协议

 目的是为了在内网可以随意ping通    such as

 5.对telnet-service进行分配地址和开启telnet服务

[Huawei]interface GigabitEthernet 0/0/0
[Huawei-GigabitEthernet0/0/0]ip address 192.168.1.34 28
[Huawei]ip route-static 0.0.0.0 0 192.168.1.33
[Huawei]user-interface vty 0 4
[Huawei-ui-vty0-4]authentication-mode aaa
[Huawei-ui-vty0-4]q
[Huawei]aaa
[Huawei-aaa]local-user huawei password cipher 123456 privilege level 15

6.网络地址端口转换

[r2]acl 2000
[r2-acl-basic-2000]rule permit source 192.168.1.0 0.0.0.255
[r2-GigabitEthernet0/0/1]nat outbound 2000

7.lsp  test1 test2 设备的配置

LSP

 TEST1

 

TEST2

 9.在边界设备上进行端口映射，并强制下发缺省路由

[Huawei-GigabitEthernet0/0/1]nat server protocol tcp global current-interface telnet inside 192.168.1.98 telnet

最后就是进行acl使telnet2telnet不到服务器，在边界设备上进行配置

[Huawei-acl-adv-3000]rule deny tcp source 1.1.1.2 0 destination-port eq 23
[Huawei-acl-adv-3000]q
[Huawei]interface GigabitEthernet 0/0/1
[Huawei-GigabitEthernet0/0/1]traffic-filter inbound acl 3000

10.结果展示