1. 网络拓扑图:
2. 网络要求:
1) VLAN 10和VLAN 20的用户能够访问Internet;
2) 正常情况下,VLAN 10的用户访问Internet走的是电信提供的链路,VLAN 20的用户访问Internet走的是网通提供的链路;
3) 若电信链路故障,所有的用户走网通链路。若网通链路故障,所有用户走电信链路。
3. 各设备的基本配置情况:
1) SW1
system-view
sysname SW1
int vlan-int 1
ip add 1.1.1.1 24
local-user admin
password simple admin
service-type telnet level 3
quit
user-interface vty 0 4
authen scheme
quit
vlan 10
port e1/0/10
vlan 20
port e1/0/20
quit
#stp
stp enable
stp mode rstp
int e1/0/22
port link-type trunk
port trunk permit vlan all
int e1/0/23
port link-type trunk
port trunk permit vlan all
int e1/0/24
port link-type trunk
port trunk permit vlan all
quit
#链路聚合
link-aggregation group 1 mode manual
int e1/0/23
port link-aggregation group 1
int e1/0/24
port link-aggregation group 1
#查看
dis link-aggregation summay
dis link-aggregation verbose
2) SW2
system-view
sysname SW2
int vlan-int 1
ip add 1.1.1.2 24
quit
vlan 10
port e1/0/10
vlan 20
port e1/0/20
quit
#stp
stp enable
stp mode rstp
int e1/0/22
port link-type trunk
port trunk permit vlan all
int e1/0/23
port link-type trunk
port trunk permit vlan all
int e1/0/24
port link-type trunk
port trunk permit vlan all
quit
#链路聚合
link-aggregation group 1 mode manual
int e1/0/23
port link-aggregation group 1
int e1/0/24
port link-aggregation group 1
#测试
ping 1.1.1.1
3) FW1
system-view
sysname FW1
int eth0/0
ip add 1.1.1.253 24
int eth0/0.1
vlan-type dot1q vid 10
ip add 192.168.10.1 24
int eth0/0.2
vlan-type dot1q vid 20
ip add 192.168.20.1 24
int eth0/4
ip add 61.130.130.1 30
quit
ip route-static 0.0.0.0 0 61.130.130.2
undo insulate
firewall zone trust
add int eth0/0.1
add int eth0/0.2
quit
firewall zone untrust
add int eth0/4
#查看
dis ip routing-table
#nat
acl number 2000 match-order auto
rule 10 permit source any
int eth0/4
nat outbound 2000
4) FW2
system-view
sysname FW2
int eth0/0
ip add 1.1.1.254 24
int eth0/0.1
vlan-type dot1q vid 10
ip add 192.168.10.2 24
int eth0/0.2
vlan-type dot1q vid 20
ip add 192.168.20.2 24
int eth0/4
ip add 61.130.130.3 30
quit
undo insulate
firewall zone trust
add int eth0/0.1
add int eth0/0.2
quit
firewall zone untrust
add int eth0/4
quit
#测试
ping 192.168.10.1
ping 192.168.20.1
ip route-static 0.0.0.0 0 61.130.130.3
dis ip routing-table
acl number 2000 match-order auto
rule 10 permit source any
int eth0/4
nat outbound 2000
5) Internet-FW
system-view
sysname ISP
int eth0/0
ip add 61.130.130.2 30
int eth0/4
ip add 61.130.130.4 30
int eth0/1
ip add 1.2.3.4 24
loopback
quit
firewall zone untrust
add int eth0/1
add int eth0/4
quit
dis ip routing-table
ping 61.130.130.1
ping 61.130.130.3
*检查测试
一台虚拟机(XP)ip:192.168.10.100 gateway:192.168.10.1 桥接模式
ping 192.168.10.1
ping 192.168.20.1
ping 192.168.10.2
ping 192.168.20.2
ping 61.130.130.2
ping 61.130.130.4
ping 1.2.3.4
更改虚拟机的网关为:192.168.10.2
ping 1.2.3.4
能够ping通说明基本的配置没有问题
4. 各设备的功能实现配置情况
1) SW1
#为交换机指定网关
ip route 0.0.0.0 0 1.1.1.253
2) SW2
Ip route 0.0.0.0 0 1.1.1.254
3) FW1
vrrp ping-enable
#虚拟设备
int eth0/0.1
vrrp vrid 10 virtual-ip 192.168.10.254
vrrp vrid 10 priority 120
dis vrrp
#接口跟踪 当eth0/4接口上的链路出现故障时将优先级降低30
vrrp vrid 10 track eth0/4 reduced 30
int eth0/0.2
vrrp vrid 20 virtual-ip 192.168.20.254
dis vrrp
4) FW2
vrrp ping-enable
int etn0/0.1
vrrp vrid 10 virtual-ip 192.168.10.254
int eth0/0.2
vrrp vrid 20 virtual-ip 192.168.20.254
vrrp vrid 20 priority 120
vrrp vrid 20 track eth0/4 reduced 30
dis vrrp
5. 测试网络功能的实现
1) 虚拟机(PC1)网关指向更改成:192.168.10.254;在与SW2相连的VLAN 20添加一台虚拟机(PC2)ip:192.168.20.100 网关指向:192.168.20.254
2) PC1:tracert192.168.20.100
PC2:tracret 192.168.10.100
模拟故障:PC1 ping 192.168.20.100 –t
将FW1的e0/0shutdown
可以观察到ping的过程依然能够收到来自192.168.20.100的回复了。
tracert 192.168.20.100
再将FW1的eth0/0取消shutdown后
3) PC1访问Internet
模拟故障:将FW1的eth0/4shutdown
当eth0/4恢复时