某公司采用华为设备组建办公网络,
需求如下:
(1)公司有4个部分,人力部,研发部,财务部,市场部每个部门有100台办公电脑需要接入公司办公网络,接入带宽不低于100M。请同学自行规划接入层设备【注意设备型号和数量要满足接入需求,同时要考虑可靠性和可扩展性,需要适当的端口冗余和链路冗余】。为方便管理和安全,需要按部门划分VLAN,公司内网全部使用192.168.X.X 私有IP,请同学自行规划IP地址。
(2)公司有2台S5700用做核心交换设备,为增强网络可靠性和核心链路带宽,需要配置eth-trunk。接入层设备通过Gbit接口分别与这两台S5700连接。
(3)公司有一台服务器,服务器直接接入核心交换机,配置了DNS、FTP、HTTP服务,内网和外网都可以访问HTTP服务,FTP只供研发部的员工访问。内网所有终端PC都可以访问DNS服务和HTTP服务。除人力部其他部门不可以访问财务部网络。核心网络拓扑如下图所示:
(4)公司获取的公网IP地址段是200.100.100.100-200.100.100.200,选用合适的NAT技术保证公司内网所有PC可以访问外网。
(5)全网采用OSPF路由协议。
以下是我的实施步骤方法和代码
步骤一 设备选型与拓扑设计
恰当选择合适设备并对原网络拓扑进行补充设计,以完成各部门员工终端PC的接入;
步骤二 IP地址规划
合理进行VLAN划分并进行IP地址规划,为网络设备及各部门网络分配IP址;详细见表1、表2。
序号 | 设备名 | 接口名 | IP | 掩码 |
1 | R1 | G0/0/0 G0/0/1 | 192.168.200.1 200.100.100.2 | 255.255.255.0 255.255.255.0 |
2 | R2 | G0/0/0 G0/0/1 | 200.100.100.1 200.101.100.1 | 255.255.255.0 255.255.255.0 |
3 | R3 | G0/0/0 G0/0/1 | 192.168.100.2 192.168.101.100 | 255.255.255.0 255.255.255.0 |
4 | S1 | VLANIF10 VLANIF20 VLANIF30 VLANIF40 VLANIF100 VLANIF200 | 192.168.10.100 192.168.20.100 192.168.30.100 192.168.40.100 192.168.100.3 192.168.200.2 | 255.255.255.0 255.255.255.0 255.255.255.0 255.255.255.0 255.255.255.0 255.255.255.0 |
5 | S2 | VLANIF10 VLANIF20 VLANIF30 VLANIF40 | 192.168.10.100 192.168.20.100 192.168.30.100 192.168.40.100 | 255.255.255.0 255.255.255.0 255.255.255.0 255.255.255.0 |
表1 设备IP
序号 | VLAN | 网络地址 | IP范围 | 掩码 |
1 | VLAN10 | 192.168.10.100 | 192.168.10.1-192.168.10.99 | 255.255.255.0 |
2 | VLAN20 | 192.168.20.100 | 192.168.20.1-192.168.20.99 | 255.255.255.0 |
3 | VLAN30 | 192.168.30.100 | 192.168.30.1-192.168.30.99 | 255.255.255.0 |
4 | VLAN40 | 192.168.40.100 | 192.168.40.1-192.168.40.99 | 255.255.255.0 |
表2 VLAN划分及IP分配
步骤三 设备配置
一、交换机的配置
划分VLAN
S1
#划分vlan
vlan batch 10 20 30 40 100 200
#指定交换机为根桥
stp instance 0 root primary
S2
#划分vlan
vlan batch 10 20 30 40 100 200
#指定交换机为备份根桥
stp instance 0 root secondary
S3和S4(注意:这里少设置了两个VLAN)
#划分vlan10 20 30 40
vlan batch 10 20 30 40
(注意:后边S5-S12分别对应拓扑图设置VLAN)
人力部S5和S6
#创建vlan 10
vlan batch 10
研发部S7和S8
#创建vlan 20
vlan batch 20
财务部S9和S10
#创建vlan 30
vlan batch 30
市场部S11和S12
#创建vlan 40
vlan batch 40
创建链路聚合,并配置端口
S1
#创建聚合链路,允许所有vlan通过
interface Eth-Trunk1
port link-type trunk
port trunk allow-pass vlan 2 to 4094
#应用在g0/0/1跟g0/0/2
interface GigabitEthernet0/0/1
eth-trunk 1
interface GigabitEthernet0/0/2
eth-trunk 1
#类型为access,允许vlan100通过
interface GigabitEthernet0/0/12
port link-type access
port default vlan 100
#类型为trunk,允许所有vlan通过
interface GigabitEthernet0/0/5
port link-type trunk
port trunk allow-pass vlan 2 to 4094
traffic-filter inbound acl 3000
#类型为trunk,允许所有vlan通过
interface GigabitEthernet0/0/6
port link-type trunk
port trunk allow-pass vlan 2 to 4094
traffic-filter inbound acl 3000
#类型为access,允许vlan200通过
interface GigabitEthernet0/0/7
port link-type access
port default vlan 200
traffic-filter inbound acl 3000
S2
#创建链路聚合
interface Eth-Trunk1
port link-type trunk
port trunk allow-pass vlan 2 to 4094
interface GigabitEthernet0/0/1
eth-trunk 1
interface GigabitEthernet0/0/2
eth-trunk 1
#端口类型为trunk,允许所有vlan通过
interface GigabitEthernet0/0/3
port link-type trunk
port trunk allow-pass vlan 2 to 4094
#interface GigabitEthernet0/0/4
port link-type trunk
port trunk allow-pass vlan 2 to 4094
S3
#g0/0/1到g0/0/12端口类型为trunk,允许所有vlan通过
interface GigabitEthernet0/0/1
port link-type trunk
port trunk allow-pass vlan 2 to 4094
#interface GigabitEthernet0/0/2
port link-type trunk
port trunk allow-pass vlan 2 to 4094
#interface GigabitEthernet0/0/3
port link-type trunk
port trunk allow-pass vlan 2 to 4094
#interface GigabitEthernet0/0/4
port link-type trunk
port trunk allow-pass vlan 2 to 4094
#interface GigabitEthernet0/0/5
port link-type trunk
port trunk allow-pass vlan 2 to 4094
#interface GigabitEthernet0/0/6
port link-type trunk
port trunk allow-pass vlan 2 to 4094
#interface GigabitEthernet0/0/7
port link-type trunk
port trunk allow-pass vlan 2 to 4094
#interface GigabitEthernet0/0/8
port link-type trunk
port trunk allow-pass vlan 2 to 4094
#interface GigabitEthernet0/0/9
port link-type trunk
port trunk allow-pass vlan 2 to 4094
#interface GigabitEthernet0/0/10
port link-type trunk
port trunk allow-pass vlan 2 to 4094
#interface GigabitEthernet0/0/11
port link-type trunk
port trunk allow-pass vlan 2 to 4094
#interface GigabitEthernet0/0/12
port link-type trunk
port trunk allow-pass vlan 2 to 4094
(注意:这个是为了公司后面新来的成员设置的)
#将g0/0/1到g0/0/5划分为组1
port-group 1
group-member GigabitEthernet0/0/1
group-member GigabitEthernet0/0/2
group-member GigabitEthernet0/0/3
group-member GigabitEthernet0/0/4
group-member GigabitEthernet0/0/5
#将g0/0/6到g0/0/10划分为组2
port-group 2
group-member GigabitEthernet0/0/6
group-member GigabitEthernet0/0/7
group-member GigabitEthernet0/0/8
group-member GigabitEthernet0/0/9
group-member GigabitEthernet0/0/10
S4
#g0/0/1到g0/0/12端口类型为trunk,允许所有vlan通过
interface GigabitEthernet0/0/1
port link-type trunk
port trunk allow-pass vlan 2 to 4094
#
interface GigabitEthernet0/0/2
port link-type trunk
port trunk allow-pass vlan 2 to 4094
#
interface GigabitEthernet0/0/3
port link-type trunk
port trunk allow-pass vlan 2 to 4094
#
interface GigabitEthernet0/0/4
port link-type trunk
port trunk allow-pass vlan 2 to 4094
#
interface GigabitEthernet0/0/5
port link-type trunk
port trunk allow-pass vlan 2 to 4094
#
interface GigabitEthernet0/0/6
port link-type trunk
port trunk allow-pass vlan 2 to 4094
#
interface GigabitEthernet0/0/7
port link-type trunk
port trunk allow-pass vlan 2 to 4094
#
interface GigabitEthernet0/0/8
port link-type trunk
port trunk allow-pass vlan 2 to 4094
#
interface GigabitEthernet0/0/9
port link-type trunk
port trunk allow-pass vlan 2 to 4094
#
interface GigabitEthernet0/0/10
port link-type trunk
port trunk allow-pass vlan 2 to 4094
#
interface GigabitEthernet0/0/11
port link-type trunk
port trunk allow-pass vlan 2 to 4094
#
interface GigabitEthernet0/0/12
port link-type trunk
port trunk allow-pass vlan 2 to 4094
(注意:这个是为了公司后面新来的成员设置的)
#将g0/0/1到g0/0/5划分为组1
port-group 1
group-member GigabitEthernet0/0/1
group-member GigabitEthernet0/0/2
group-member GigabitEthernet0/0/3
group-member GigabitEthernet0/0/4
group-member GigabitEthernet0/0/5
#将g0/0/6到g0/0/10划分为组2
port-group 2
group-member GigabitEthernet0/0/6
group-member GigabitEthernet0/0/7
group-member GigabitEthernet0/0/8
group-member GigabitEthernet0/0/9
group-member GigabitEthernet0/0/10
S5
#配置端口类型为access,允许vlan 10通过
interface Ethernet0/0/1
port link-type access
port default vlan 10
#配置端口类型为trunk,允许所有vlan通过
interface GigabitEthernet0/0/1
port link-type trunk
port trunk allow-pass vlan 2 to 4094
S6
#端口类型为access,允许vlan10通过
interface Ethernet0/0/2
port link-type access
port default vlan 10
#端口类型为access,允许vlan10通过
interface Ethernet0/0/3
port link-type access
port default vlan 10
#端口类型为trunk,运行所有vlan通过
interface GigabitEthernet0/0/1
port link-type trunk
port trunk allow-pass vlan 2 to 4094
S7
#端口类型为access,允许vlan20通过
#
interface Ethernet0/0/1
port link-type access
port default vlan 20
#端口类型为trunk,运行所有vlan通过
#
interface GigabitEthernet0/0/1
port link-type trunk
port trunk allow-pass vlan 2 to 4094
S8
#配置类型为access,允许vlan20通过
interface Ethernet0/0/2
port link-type access
port default vlan 20
#配置类型为access,允许vlan20通过
interface Ethernet0/0/3
port link-type access
port default vlan 20
#配置类型为trunk,允许所有vlan通过
interface GigabitEthernet0/0/1
port link-type trunk
port trunk allow-pass vlan 2 to 4094
S9
#配置类型为access,允许vlan30通过
interface Ethernet0/0/1
port link-type access
port default vlan 30
#配置类型为trunk,允许所有vlan通过
interface GigabitEthernet0/0/1
port link-type trunk
port trunk allow-pass vlan 2 to 4094
S10
#类型为access,允许vlan30通过
interface Ethernet0/0/2
port link-type access
port default vlan 30
#类型为access,允许vlan30通过
interface Ethernet0/0/3
port link-type access
port default vlan 30
#类型为trunk,允许所有vlan通过
interface GigabitEthernet0/0/1
port link-type trunk
port trunk allow-pass vlan 2 to 4094
S11
#类型为access,允许vlan40通过
interface Ethernet0/0/1
port link-type access
port default vlan 40
#类型为trunk,允许所有vlan通过
interface GigabitEthernet0/0/1
port link-type trunk
port trunk allow-pass vlan 2 to 4094
S12
#类型为access,允许vlan40通过
interface Ethernet0/0/2
port link-type access
port default vlan 40
#类型为access,允许vlan40通过
interface Ethernet0/0/3
port link-type access
port default vlan 40
#类型为trunk,允许所有vlan通过
interface GigabitEthernet0/0/1
port link-type trunk
port trunk allow-pass vlan 2 to 4094
配置DHCP,应用全局
S1和S2
#创建vlanif10,dhcp应用全局
interface Vlanif10
ip address 192.168.10.100 255.255.255.0
dhcp select global
#创建vlanif20,dhcp应用全局
interface Vlanif20
ip address 192.168.20.100 255.255.255.0
dhcp select global
#创建vlanif30,dhcp应用全局
interface Vlanif30
ip address 192.168.30.100 255.255.255.0
dhcp select global
#创建vlanif40,dhcp应用全局
interface Vlanif40
ip address 192.168.40.100 255.255.255.0
dhcp select global
#创建vlanif100
interface Vlanif100
ip address 192.168.100.3 255.255.255.0
#创建vlanif200
interface Vlanif200
ip address 192.168.200.2 255.255.255.0
配置ospf,学习直连网段,并配置默认路由
S1
#运用ospf,学习直连的网段
ospf 1
area 0.0.0.0
network 192.168.10.0 0.0.0.255
network 192.168.20.0 0.0.0.255
network 192.168.30.0 0.0.0.255
network 192.168.40.0 0.0.0.255
network 192.168.100.0 0.0.0.255
network 192.168.200.0 0.0.0.255
#配置默认路由
ip route-static 0.0.0.0 0.0.0.0 192.168.200.1
配置DNS服务
S1
#创建ip地址池1-4,指定网关地址,指定dns地址
ip pool 1
gateway-list 192.168.10.100
network 192.168.10.0 mask 255.255.255.0
dns-list 192.168.101.1
ip pool 2
gateway-list 192.168.20.100
network 192.168.20.0 mask 255.255.255.0
dns-list 192.168.101.1
ip pool 3
gateway-list 192.168.30.100
network 192.168.30.0 mask 255.255.255.0
dns-list 192.168.101.1
ip pool 4
gateway-list 192.168.40.100
network 192.168.40.0 mask 255.255.255.0
dns-list 192.168.101.
配置静态nat
S1
#配置静态nat
acl number 3000
rule 5 permit ip source 192.168.10.0 0.0.0.255 destination 192.168.30.0 0.0.0.2
55
rule 10 deny ip destination 192.168.30.0 0.0.0.255
二、路由器的配置
R1
#配置基本ACL,允许所有ip地址通过
acl number 2000
rule 5 permit
#配置napt 地址池
nat address-group 1 200.100.100.100 200.100.100.200
#配置IP地址,acl 2000 应用到napt里面
interface GigabitEthernet0/0/1
ip address 200.100.100.2 255.255.255.0
nat outbound 2000 address-group 1
#配置静态nat
nat static global 200.100.100.5 inside 192.168.1.254 netmask
255.255.255.255
#在g0/0/0上配置IP地址
interface GigabitEthernet0/0/0
ip address 192.168.200.1 255.255.255.0
#开启ospf
ospf 1
area 0.0.0.0
network 192.168.10.0 0.0.0.255
#配置默认路由
ip route-static 0.0.0.0 0.0.0.0 200.100.100.1
R2
#在g0/0/0端口上配置ip地址
interface GigabitEthernet0/0/0
ip address 200.100.100.1 255.255.255.0
#在g0/0/1端口上配置ip地址
interface GigabitEthernet0/0/1
ip address 200.101.100.1 255.255.255.0
#在g0/0/2端口上配置ip地址
interface GigabitEthernet0/0/2
ip address 200.102.100.1 255.255.255.0
R3
#配置高级ACl,允许研发部访问服务器的ftp,禁止其他部门访问服务器的ftp
acl number 3002
rule 5 permit tcp source 192.168.20.0 0.0.0.255 destination-port eq ftp
rule 10 deny tcp destination 192.168.101.1 0 destination-port eq ftp
#在g0/0/0端口上配置ip地址,将高级acl应用在此端口
interface GigabitEthernet0/0/0
ip address 192.168.100.2 255.255.255.0
traffic-filter inbound acl 3002
#在g0/0/1端口上配置ip地址
interface GigabitEthernet0/0/1
ip address 192.168.101.100 255.255.255.0
#配置链路状态协议
ospf 1
area 0.0.0.0
network 192.168.100.0 0.0.0.255
network 192.168.101.0 0.0.0.255
#配置默认路由
ip route-static 0.0.0.0 0.0.0.0 192.168.101.1
步骤四 实施效果
1、人力部ping财务部(能ping通)
研发部ping财务部(ping不通)
2、内网ping访问HTTP服务
外网访问HTTP服务
- Ping服务器DNS服务
- 研发部PingFTP服务(能ping通)
人力部pingFTP服务(ping不通)
内网ping外网(能ping通)