ensp模拟项目:小型网络规划设计与实施

某公司采用华为设备组建办公网络,

需求如下:

(1)公司有4个部分,人力部,研发部,财务部,市场部每个部门有100台办公电脑需要接入公司办公网络,接入带宽不低于100M。请同学自行规划接入层设备【注意设备型号和数量要满足接入需求,同时要考虑可靠性和可扩展性,需要适当的端口冗余和链路冗余】。为方便管理和安全,需要按部门划分VLAN,公司内网全部使用192.168.X.X 私有IP,请同学自行规划IP地址。

(2)公司有2台S5700用做核心交换设备,为增强网络可靠性和核心链路带宽,需要配置eth-trunk。接入层设备通过Gbit接口分别与这两台S5700连接。

(3)公司有一台服务器,服务器直接接入核心交换机,配置了DNS、FTP、HTTP服务,内网和外网都可以访问HTTP服务,FTP只供研发部的员工访问。内网所有终端PC都可以访问DNS服务和HTTP服务。除人力部其他部门不可以访问财务部网络。核心网络拓扑如下图所示:

(4)公司获取的公网IP地址段是200.100.100.100-200.100.100.200,选用合适的NAT技术保证公司内网所有PC可以访问外网。

(5)全网采用OSPF路由协议。

以下是我的实施步骤方法和代码

步骤一 设备选型与拓扑设计

恰当选择合适设备并对原网络拓扑进行补充设计,以完成各部门员工终端PC的接入;

步骤二 IP地址规划

合理进行VLAN划分并进行IP地址规划,为网络设备及各部门网络分配IP址;详细见表1、表2。

序号

设备名

接口名

IP

掩码

1

R1

G0/0/0

G0/0/1

192.168.200.1

200.100.100.2

255.255.255.0

255.255.255.0

2

R2

G0/0/0

G0/0/1

200.100.100.1

200.101.100.1

255.255.255.0

255.255.255.0

3

R3

G0/0/0

G0/0/1

192.168.100.2

192.168.101.100

255.255.255.0

255.255.255.0

4

S1

VLANIF10

VLANIF20

VLANIF30

VLANIF40

VLANIF100

VLANIF200

192.168.10.100

192.168.20.100

192.168.30.100

192.168.40.100

192.168.100.3

192.168.200.2

255.255.255.0

255.255.255.0

255.255.255.0

255.255.255.0

255.255.255.0

255.255.255.0

5

S2

VLANIF10

VLANIF20

VLANIF30

VLANIF40

192.168.10.100

192.168.20.100

192.168.30.100

192.168.40.100

255.255.255.0

255.255.255.0

255.255.255.0

255.255.255.0

表1 设备IP

序号

VLAN

网络地址

IP范围

掩码

1

VLAN10

192.168.10.100

192.168.10.1-192.168.10.99

255.255.255.0

2

VLAN20

192.168.20.100

192.168.20.1-192.168.20.99

255.255.255.0

3

VLAN30

192.168.30.100

192.168.30.1-192.168.30.99

255.255.255.0

4

VLAN40

192.168.40.100

192.168.40.1-192.168.40.99

255.255.255.0

表2 VLAN划分及IP分配

步骤三 设备配置

一、交换机的配置

划分VLAN

S1

#划分vlan

vlan batch 10 20 30 40 100 200

#指定交换机为根桥

stp instance 0 root primary

S2

#划分vlan

vlan batch 10 20 30 40 100 200

#指定交换机为备份根桥

stp instance 0 root secondary

S3和S4(注意:这里少设置了两个VLAN

#划分vlan10 20 30 40

vlan batch 10 20 30 40

注意:后边S5-S12分别对应拓扑图设置VLAN

人力部S5和S6

#创建vlan 10

vlan batch 10

研发部S7和S8

#创建vlan 20

vlan batch 20

财务部S9和S10

#创建vlan 30

vlan batch 30

市场部S11和S12

#创建vlan 40

vlan batch 40

创建链路聚合,并配置端口

S1

#创建聚合链路,允许所有vlan通过

interface Eth-Trunk1

 port link-type trunk

 port trunk allow-pass vlan 2 to 4094

#应用在g0/0/1跟g0/0/2

interface GigabitEthernet0/0/1

 eth-trunk 1

interface GigabitEthernet0/0/2

 eth-trunk 1

#类型为access,允许vlan100通过

interface GigabitEthernet0/0/12

 port link-type access

 port default vlan 100

#类型为trunk,允许所有vlan通过

interface GigabitEthernet0/0/5

 port link-type trunk

 port trunk allow-pass vlan 2 to 4094

 traffic-filter inbound acl 3000

#类型为trunk,允许所有vlan通过

interface GigabitEthernet0/0/6

 port link-type trunk

 port trunk allow-pass vlan 2 to 4094

 traffic-filter inbound acl 3000

#类型为access,允许vlan200通过

interface GigabitEthernet0/0/7

 port link-type access

 port default vlan 200

 traffic-filter inbound acl 3000

S2

#创建链路聚合

interface Eth-Trunk1

 port link-type trunk

 port trunk allow-pass vlan 2 to 4094

interface GigabitEthernet0/0/1

 eth-trunk 1

interface GigabitEthernet0/0/2

 eth-trunk 1

#端口类型为trunk,允许所有vlan通过

interface GigabitEthernet0/0/3

 port link-type trunk

 port trunk allow-pass vlan 2 to 4094

#interface GigabitEthernet0/0/4

 port link-type trunk

 port trunk allow-pass vlan 2 to 4094

S3

#g0/0/1到g0/0/12端口类型为trunk,允许所有vlan通过

interface GigabitEthernet0/0/1

 port link-type trunk

 port trunk allow-pass vlan 2 to 4094

#interface GigabitEthernet0/0/2

 port link-type trunk

 port trunk allow-pass vlan 2 to 4094

#interface GigabitEthernet0/0/3

 port link-type trunk

 port trunk allow-pass vlan 2 to 4094

#interface GigabitEthernet0/0/4

 port link-type trunk

 port trunk allow-pass vlan 2 to 4094

#interface GigabitEthernet0/0/5

 port link-type trunk

 port trunk allow-pass vlan 2 to 4094

#interface GigabitEthernet0/0/6

 port link-type trunk

 port trunk allow-pass vlan 2 to 4094

#interface GigabitEthernet0/0/7

 port link-type trunk

 port trunk allow-pass vlan 2 to 4094

#interface GigabitEthernet0/0/8

 port link-type trunk

 port trunk allow-pass vlan 2 to 4094

#interface GigabitEthernet0/0/9

 port link-type trunk

 port trunk allow-pass vlan 2 to 4094

#interface GigabitEthernet0/0/10

 port link-type trunk

 port trunk allow-pass vlan 2 to 4094

#interface GigabitEthernet0/0/11

 port link-type trunk

 port trunk allow-pass vlan 2 to 4094

#interface GigabitEthernet0/0/12

 port link-type trunk

 port trunk allow-pass vlan 2 to 4094

(注意:这个是为了公司后面新来的成员设置的)

#将g0/0/1到g0/0/5划分为组1

port-group 1

 group-member GigabitEthernet0/0/1

 group-member GigabitEthernet0/0/2

 group-member GigabitEthernet0/0/3

 group-member GigabitEthernet0/0/4

 group-member GigabitEthernet0/0/5

#将g0/0/6到g0/0/10划分为组2

port-group 2

 group-member GigabitEthernet0/0/6

 group-member GigabitEthernet0/0/7

 group-member GigabitEthernet0/0/8

 group-member GigabitEthernet0/0/9

 group-member GigabitEthernet0/0/10

S4

#g0/0/1到g0/0/12端口类型为trunk,允许所有vlan通过

interface GigabitEthernet0/0/1

 port link-type trunk

 port trunk allow-pass vlan 2 to 4094

#

interface GigabitEthernet0/0/2

 port link-type trunk

 port trunk allow-pass vlan 2 to 4094

#

interface GigabitEthernet0/0/3

 port link-type trunk

 port trunk allow-pass vlan 2 to 4094

#

interface GigabitEthernet0/0/4

 port link-type trunk

 port trunk allow-pass vlan 2 to 4094

#

interface GigabitEthernet0/0/5

 port link-type trunk

 port trunk allow-pass vlan 2 to 4094

#

interface GigabitEthernet0/0/6

 port link-type trunk

 port trunk allow-pass vlan 2 to 4094

#

interface GigabitEthernet0/0/7

 port link-type trunk

 port trunk allow-pass vlan 2 to 4094

#

interface GigabitEthernet0/0/8

 port link-type trunk

 port trunk allow-pass vlan 2 to 4094

#

interface GigabitEthernet0/0/9

 port link-type trunk

 port trunk allow-pass vlan 2 to 4094

#

interface GigabitEthernet0/0/10

 port link-type trunk

 port trunk allow-pass vlan 2 to 4094

#

interface GigabitEthernet0/0/11

 port link-type trunk

 port trunk allow-pass vlan 2 to 4094

#

interface GigabitEthernet0/0/12

 port link-type trunk

 port trunk allow-pass vlan 2 to 4094

(注意:这个是为了公司后面新来的成员设置的)

#将g0/0/1到g0/0/5划分为组1

port-group 1

 group-member GigabitEthernet0/0/1

 group-member GigabitEthernet0/0/2

 group-member GigabitEthernet0/0/3

 group-member GigabitEthernet0/0/4

 group-member GigabitEthernet0/0/5

#将g0/0/6到g0/0/10划分为组2

port-group 2

 group-member GigabitEthernet0/0/6

 group-member GigabitEthernet0/0/7

 group-member GigabitEthernet0/0/8

 group-member GigabitEthernet0/0/9

 group-member GigabitEthernet0/0/10

S5

#配置端口类型为access,允许vlan 10通过

interface Ethernet0/0/1

 port link-type access

 port default vlan 10

#配置端口类型为trunk,允许所有vlan通过

interface GigabitEthernet0/0/1

 port link-type trunk

 port trunk allow-pass vlan 2 to 4094

S6

#端口类型为access,允许vlan10通过

interface Ethernet0/0/2

 port link-type access

 port default vlan 10

#端口类型为access,允许vlan10通过

interface Ethernet0/0/3

 port link-type access

 port default vlan 10

#端口类型为trunk,运行所有vlan通过

interface GigabitEthernet0/0/1

 port link-type trunk

 port trunk allow-pass vlan 2 to 4094

S7

#端口类型为access,允许vlan20通过

#

interface Ethernet0/0/1

 port link-type access

 port default vlan 20

#端口类型为trunk,运行所有vlan通过

#

interface GigabitEthernet0/0/1

 port link-type trunk

 port trunk allow-pass vlan 2 to 4094

S8

#配置类型为access,允许vlan20通过

interface Ethernet0/0/2

 port link-type access

 port default vlan 20

#配置类型为access,允许vlan20通过

interface Ethernet0/0/3

 port link-type access

 port default vlan 20

#配置类型为trunk,允许所有vlan通过

interface GigabitEthernet0/0/1

 port link-type trunk

 port trunk allow-pass vlan 2 to 4094

S9

#配置类型为access,允许vlan30通过

interface Ethernet0/0/1

 port link-type access

 port default vlan 30

#配置类型为trunk,允许所有vlan通过

interface GigabitEthernet0/0/1

 port link-type trunk

 port trunk allow-pass vlan 2 to 4094

S10

#类型为access,允许vlan30通过

interface Ethernet0/0/2

 port link-type access

 port default vlan 30

#类型为access,允许vlan30通过

interface Ethernet0/0/3

 port link-type access

 port default vlan 30

#类型为trunk,允许所有vlan通过

interface GigabitEthernet0/0/1

 port link-type trunk

 port trunk allow-pass vlan 2 to 4094

S11

#类型为access,允许vlan40通过

interface Ethernet0/0/1

 port link-type access

 port default vlan 40

#类型为trunk,允许所有vlan通过

interface GigabitEthernet0/0/1

 port link-type trunk

 port trunk allow-pass vlan 2 to 4094

S12

#类型为access,允许vlan40通过

interface Ethernet0/0/2

 port link-type access

 port default vlan 40

#类型为access,允许vlan40通过

interface Ethernet0/0/3

 port link-type access

 port default vlan 40

#类型为trunk,允许所有vlan通过

interface GigabitEthernet0/0/1

 port link-type trunk

 port trunk allow-pass vlan 2 to 4094

配置DHCP,应用全局

S1和S2

#创建vlanif10,dhcp应用全局

interface Vlanif10

 ip address 192.168.10.100 255.255.255.0

 dhcp select global

#创建vlanif20,dhcp应用全局

interface Vlanif20

 ip address 192.168.20.100 255.255.255.0

 dhcp select global

#创建vlanif30,dhcp应用全局

interface Vlanif30

 ip address 192.168.30.100 255.255.255.0

 dhcp select global

#创建vlanif40,dhcp应用全局

interface Vlanif40

 ip address 192.168.40.100 255.255.255.0

 dhcp select global

#创建vlanif100

interface Vlanif100

 ip address 192.168.100.3 255.255.255.0

#创建vlanif200

interface Vlanif200

 ip address 192.168.200.2 255.255.255.0

配置ospf,学习直连网段,并配置默认路由

S1

#运用ospf,学习直连的网段

ospf 1

 area 0.0.0.0

  network 192.168.10.0 0.0.0.255

  network 192.168.20.0 0.0.0.255

  network 192.168.30.0 0.0.0.255

  network 192.168.40.0 0.0.0.255

  network 192.168.100.0 0.0.0.255

  network 192.168.200.0 0.0.0.255

#配置默认路由

ip route-static 0.0.0.0 0.0.0.0 192.168.200.1

配置DNS服务

S1

#创建ip地址池1-4,指定网关地址,指定dns地址

ip pool 1

 gateway-list 192.168.10.100

 network 192.168.10.0 mask 255.255.255.0

 dns-list 192.168.101.1

ip pool 2

 gateway-list 192.168.20.100

 network 192.168.20.0 mask 255.255.255.0

 dns-list 192.168.101.1

ip pool 3

 gateway-list 192.168.30.100

 network 192.168.30.0 mask 255.255.255.0

 dns-list 192.168.101.1

ip pool 4

 gateway-list 192.168.40.100

 network 192.168.40.0 mask 255.255.255.0

 dns-list 192.168.101.

配置静态nat

S1

#配置静态nat

acl number 3000

 rule 5 permit ip source 192.168.10.0 0.0.0.255 destination 192.168.30.0 0.0.0.2

55

 rule 10 deny ip destination 192.168.30.0 0.0.0.255

二、路由器的配置

R1

#配置基本ACL,允许所有ip地址通过

acl number 2000  

rule 5 permit

#配置napt 地址池

nat address-group 1 200.100.100.100 200.100.100.200

#配置IP地址,acl 2000 应用到napt里面

interface GigabitEthernet0/0/1

 ip address 200.100.100.2 255.255.255.0

 nat outbound 2000 address-group 1

#配置静态nat

nat static global 200.100.100.5 inside 192.168.1.254 netmask

255.255.255.255

#在g0/0/0上配置IP地址

interface GigabitEthernet0/0/0

 ip address 192.168.200.1 255.255.255.0

#开启ospf

ospf 1

 area 0.0.0.0

  network 192.168.10.0 0.0.0.255

#配置默认路由

ip route-static 0.0.0.0 0.0.0.0 200.100.100.1

R2

#在g0/0/0端口上配置ip地址

interface GigabitEthernet0/0/0

 ip address 200.100.100.1 255.255.255.0

#在g0/0/1端口上配置ip地址

interface GigabitEthernet0/0/1

 ip address 200.101.100.1 255.255.255.0

#在g0/0/2端口上配置ip地址

interface GigabitEthernet0/0/2

 ip address 200.102.100.1 255.255.255.0

R3

#配置高级ACl,允许研发部访问服务器的ftp,禁止其他部门访问服务器的ftp

acl number 3002  

 rule 5 permit tcp source 192.168.20.0 0.0.0.255 destination-port eq ftp

 rule 10 deny tcp destination 192.168.101.1 0 destination-port eq ftp

#在g0/0/0端口上配置ip地址,将高级acl应用在此端口

interface GigabitEthernet0/0/0

 ip address 192.168.100.2 255.255.255.0

 traffic-filter inbound acl 3002

#在g0/0/1端口上配置ip地址

interface GigabitEthernet0/0/1

 ip address 192.168.101.100 255.255.255.0

#配置链路状态协议

ospf 1

 area 0.0.0.0

  network 192.168.100.0 0.0.0.255

  network 192.168.101.0 0.0.0.255

#配置默认路由

ip route-static 0.0.0.0 0.0.0.0 192.168.101.1

步骤 实施效果

1、人力部ping财务部(能ping通)

研发部ping财务部(ping不通)

2、内网ping访问HTTP服务

外网访问HTTP服务

  1. Ping服务器DNS服务 
  2. 研发部PingFTP服务(能ping通)

人力部pingFTP服务(ping不通)

内网ping外网(能ping通)

评论
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值