实验要求：
某企业通过路由器R1接入Internet，R2、R3和R4模拟Internet中的网云，整个网络的拓扑如下图：
各设备的IP地址配置如下：
R1：
S0/0/0:12.1.1.1/24
Fa0/0.1:192.168.1.254/24
Fa0/0.2:192.168.2.254/24
Fa0/0.3:192.168.3.254/24
R2:
S0/0/0:12.1.1.2/24
Fa0/0:24.1.1.2/24
Fa0/1:23.1.1.2/24
R3:
Fa0/1:23.1.1.3/24
S0/0/0:34.1.1.3/24
R4:
S0/0/0: 34.1.1.4/24
Fa0/0:24.1.1.4/24
Fa0/1:218.1.1.1/24
SW1: vlan 1 :192.168.1.2/24
SW2: vlan 1 :192.168.1.3/24
PC1、PC2、PC3和PC4的IP地址均自动获取。PC1和PC3属于vlan 2 ，vlan 2：192.168.2.0/24；PC2和PC4属于vlan 3 ，vlan 3:192.168.3.0/24
Web 服务器：218.1.1.2/24
一、要求：
1、本实验拓扑如上图；
2、根据拓扑要求为每个设备配置IP地址，保证所有配置的接口状态为UP；
3、配置设备的远程登录和密码保护。配置图中的2台交换机、4台路由器，使6台设备均支持远程登录和配置，配置中出现的所有密码均使用cisco，并且不能在配置文件中明文显示；
4、配置VTP协议，在SW1为VTP Server ，SW2为VTP Client ；
5、vlan 配置。在SW1上配置VLAN ，保证SW2可以使用VTP协议从SW1上同步VLAN配置信息，配置4台PC到对应的VLAN，配置路由器R1的子接口，使其支持vlan间路由；
6、配置STP协议，配置生成树协议，使SW1为跟交换机；
7、配置DHCP。在路由器R1上配置DHCP，使4台PC都可以获取到正确的IP地址、网关和DNS，DNS服务器的地址是218.1.1.2；
8、配置路由器协议，配置R1，使其可以访问Internet，配置R2、R3和R4运行OSPF路由协议，配置完成后，4台路由器之间互相都可以访问；
9、配置PPP协议，路由器R1与R2之间封装的协议是PPP，使用CHAP验证，密码仍然是cisco；
10、配置NAT，在路由器R1上配置动态PAT，使4台PC都可以通过R1访问Internet。在路由器R1上配置静态PAT，是Internet可以通过路由器R1的TCP 2323端口Telnet登录到SW1；
11、配置ACL，配置路由器R1，拒绝vlan 2的主机访问Web 服务器的www 服务，其他服务不受影响。
二、实验配置
1、图中使用了5根交叉双绞线、5根直通双绞线、2根串行线，R1和R3是串行线的DCE端；
2、配置IP地址
l 配置
R1的配置如下，这里仅配置S0/0/0接口的IP地址，并打开F0/0接口，每个子接口IP地址的配置属于VLAN配置部分。
Router>en
Router#conf t
Enter configuration commands, one per line. End with CNTL/Z.
Router(config)#no ip domain lookup
Router(config)#hostname R1
R1(config)#int s0/0/0
R1(config-if)#ip add 12.1.1.1 255.255.255.0
R1(config-if)#clock rate 56000
R1(config-if)#no shut
R1(config-if)#int fa0/0
R1(config-if)#no shut
R2的配置如下：
Router>en
Router#conf t
Enter configuration commands, one per line. End with CNTL/Z.
Router(config)#no ip domain lookup
Router(config)#hostname R2
R2(config)#int s0/0/0
R2(config-if)#ip add 12.1.1.2 255.255.255.0
R2(config-if)#no sh
R2(config-if)#int fa0/0
R2(config-if)#ip add 24.1.1.2 255.255.255.0
R2(config-if)#no sh
R2(config-if)#int fa0/1
R2(config-if)#ip add 23.1.1.2 255.255.255.0
R2(config-if)#no sh
R3的配置如下：
Router>en
Router#conf t
Enter configuration commands, one per line. End with CNTL/Z.
Router(config)#no ip domain lookup
Router(config)#hostname R3
R3(config)#int s0/0/0
R3(config-if)#ip add 34.1.1.3 255.255.255.0
R3(config-if)#clock rate 56000
R3(config-if)#no sh
R3(config-if)#int fa0/1
R3(config-if)#ip add 23.1.1.3 255.255.255.0
R3(config-if)#no sh
R4的配置如下：
Router>en
Router#conf t
Enter configuration commands, one per line. End with CNTL/Z.
Router(config)#no ip domain lookup
Router(config)#hostname R4
R4(config)#int s0/0/0
R4(config-if)#ip add 34.1.1.4 255.255.255.0
R4(config-if)#no sh
R4(config-if)#int fa0/0
R4(config-if)#ip add 24.1.1.4 255.255.255.0
R4(config-if)#no sh
R4(config-if)#int fa0/1
R4(config-if)#ip add 218.1.1.1 255.255.255.0
R4(config-if)#no sh
SW1的配置如下：
Switch>en
Switch#conf t
Enter configuration commands, one per line. End with CNTL/Z.
Switch(config)#no ip domain lookup
Switch(config)#hostname SW1
SW1(config)#int vlan 1
SW1(config-if)#ip add 192.168.1.2 255.255.255.0
SW1(config-if)#no sh
SW1(config-if)#exit
SW1(config)#ip default-gateway 192.168.1.1
SW2的配置如下：
Switch>en
Switch#conf t
Enter configuration commands, one per line. End with CNTL/Z.
Switch(config)#no ip domain lookup
Switch(config)#hostname SW2
SW2(config)#int vlan 1
SW2(config-if)#ip add 192.168.1.3 255.255.255.0
SW2(config-if)#no sh
SW2(config-if)#exit
SW2(config)#ip default-gateway 192.168.1.1
PC1、PC2、PC3和PC4的地址是自动获取，等配置完DHCP后再来查看。
Web 服务器的配置如下：
l 检验
IP地址配置完成后，可以使用“show ip interface brief ”命令进行检查，看所有接口IP地址的配置和接口的状态。比如路由器R2的执行和显示如下：
R2#show ip interface brief
Interface IP-Address OK? Method Status Protocol
FastEthernet0/0 24.1.1.2 YES manual up up
FastEthernet0/1 23.1.1.2 YES manual up up
Serial0/0/0 12.1.1.2 YES manual up up
Serial0/1/0 unassigned YES unset administratively down down
Serial0/2/0 unassigned YES unset administratively down down
Serial0/3/0 unassigned YES unset administratively down down
Vlan1 unassigned YES unset administratively down down
R2#
在所有设备上ping所有直连设备与本设备接口的IP地址，测试网络的连通性：
R2#ping 12.1.1.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 12.1.1.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 18/35/78 ms
R2#
3、配置设备的远程登录和密码保护
l 配置
R1的配置如下：
R1#conf t
Enter configuration commands, one per line. End with CNTL/Z.
R1(config)#line vty 0 4
R1(config-line)#password cisco
R1(config-line)#login
R1(config-line)#exit
R1(config)#enable secret cisco
R1(config)#service password-encryption
R2#conf t
Enter configuration commands, one per line. End with CNTL/Z.
R2(config)#line vty 0 4
R2(config-line)#password cisco
R2(config-line)#login
R2(config-line)#exit
R2(config)#enable secret cisco
R2(config)#service password-encryption
R3>en
R3#conf t
Enter configuration commands, one per line. End with CNTL/Z.
R3(config)#line vty 0 4
R3(config-line)#password cisco
R3(config-line)#login
R3(config-line)#exit
R3(config)#enable secret cisco
R3(config)#service password-encryption
R4>en
R4#conf t
Enter configuration commands, one per line. End with CNTL/Z.
R4(config)#line vty 0 4
R4(config-line)#password cisco
R4(config-line)#login
R4(config-line)#exit
R4(config)#enable secret cisco
R4(config)#service password-encryption
SW1#conf t
Enter configuration commands, one per line. End with CNTL/Z.
SW1(config)#line vty 0 4
SW1(config-line)#password cisco
SW1(config-line)#login
SW1(config-line)#exit
SW1(config)#enable secret cisco
SW1(config)#service password-encryption
SW2>en
SW2#conf t
Enter configuration commands, one per line. End with CNTL/Z.
SW2(config)#line vty 0 4
SW2(config-line)#password cisco
SW2(config-line)#login
SW2(config-line)#exit
SW2(config)#enable secret cisco
SW2(config)#service password-encryption
l 检验
在路由器R2上远程登录路由器R1，操作和显示如下：
R2#telnet 12.1.1.1
Trying 12.1.1.1 ...Open
User Access Verification
Password:
R1>en
Password:
R1#
在路由器R2上使用“show running-config ”命令查看密码的显示情况，关键部分的显示如下：
R2#show running-config
Building configuration...
line vty 0 4
password 7 0822455D0A16
login
!
end
4、配置VTP协议
l 配置
SW1的配置如下：
SW1#vlan database
% Warning: It is recommended to configure VLAN from config mode,
as VLAN database mode is being deprecated. Please consult user
documentation for configuring VTP/VLAN in config mode.
SW1(vlan)#vtp domain CYSD
Changing VTP domain name from NULL to CYSD
SW1(vlan)#exit
APPLY completed.
Exiting....
SW1#conf t
Enter configuration commands, one per line. End with CNTL/Z.
SW1(config)#int fa0/23
SW1(config-if)#switchport mode trunk
SW1(config-if)#int fa0/24
SW1(config-if)#switchport mode trunk
SW2的配置如下：
SW2#vlan database
% Warning: It is recommended to configure VLAN from config mode,
as VLAN database mode is being deprecated. Please consult user
documentation for configuring VTP/VLAN in config mode.
SW2(vlan)#vtp domain CYSD
Domain name already set to CYSD.
SW2(vlan)#v
SW2(vlan)#vtp client
Setting device to VTP CLIENT mode.
SW2(vlan)#exit
APPLY completed.
Exiting....
SW2#conf t
Enter configuration commands, one per line. End with CNTL/Z.
SW2(config)#int fa0/23
SW2(config-if)#switchport mode trunk
SW2(config-if)#int fa0/24
SW2(config-if)#switchport mode trunk
因为cisco交换机默认是VTP Server，所以SW1只要配置VTP域名就可以了。特别要注意的是，VTP信息只能在Trunk链路上传输，SW1和SW2之间的两条链路要配置成主干链路。
l 检验
配置完成后，在SW2上使用“show vtp status”命令进行查看，显示结果如下：
SW2#sh vtp status
VTP Version : 2
Configuration Revision : 0
Maximum VLANs supported locally : 255
Number of existing VLANs : 5
VTP Operating Mode : Client
VTP Domain Name : CYSD
VTP Pruning Mode : Disabled
VTP V2 Mode : Disabled
VTP Traps Generation : Disabled
MD5 digest : 0xE6 0xFE 0x11 0x67 0xCE 0xCC 0xE6 0xD4
Configuration last modified by 0.0.0.0 at 0-0-00 00:00:00
SW2#
因为SW1上还没有配置vlan信息，SW1上VTP的配置修正号是0，所以SW2的配置修正号也是0，存在的vlan个数仍然是默认的5个。配置完成后，可以进一步检验VTP的配置。
5、vlan配置
配置vlan
在vtp Server交换机SW1上添加vlan，并把端口加入对应的vlan中，SW1的配置如下：
SW1#vlan database
% Warning: It is recommended to configure VLAN from config mode,
as VLAN database mode is being deprecated. Please consult user
documentation for configuring VTP/VLAN in config mode.
SW1(vlan)#vlan 2 name gouzhongxing
VLAN 2 added:
Name: gouzhongxing
SW1(vlan)#vlan 3 name lixiaomeng
VLAN 3 added:
Name: lixiaomeng
SW1(vlan)#exit
APPLY completed.
Exiting....
SW1#conf t
Enter configuration commands, one per line. End with CNTL/Z.
SW1(config)#int fa0/2
SW1(config-if)#sw
SW1(config-if)#switchport m
SW1(config-if)#switchport mode a
SW1(config-if)#switchport mode access
SW1(config-if)#sw
SW1(config-if)#switchport a
SW1(config-if)#switchport access v
SW1(config-if)#switchport access vlan 2
SW1(config-if)#int fa0/3
SW1(config-if)#switchport mode access
SW1(config-if)#switchport access vlan 3
配置完成后，使用“show vlan”命令检查SW1上vlan的配置情况，显示如下：
SW1#show vlan
VLAN Name Status Ports
---- -------------------------------- --------- -------------------------------
1 default active Fa0/1, Fa0/4, Fa0/5, Fa0/6
Fa0/7, Fa0/8, Fa0/9, Fa0/10
Fa0/11, Fa0/12, Fa0/13, Fa0/14
Fa0/15, Fa0/16, Fa0/17, Fa0/18
Fa0/19, Fa0/20, Fa0/21, Fa0/22
Gig1/1, Gig1/2
2 gouzhongxing active Fa0/2
3 lixiaomeng active Fa0/3
1002 fddi-default act/unsup
1003 token-ring-default act/unsup
1004 fddinet-default act/unsup
1005 trnet-default act/unsup
使用“show vtp status”命令检查SW1上的VTP信息，显示如下：
SW1#show vtp status
VTP Version : 2
Configuration Revision : 2
Maximum VLANs supported locally : 255
Number of existing VLANs : 7
VTP Operating Mode : Server
VTP Domain Name : CYSD
VTP Pruning Mode : Disabled
VTP V2 Mode : Disabled
VTP Traps Generation : Disabled
MD5 digest : 0x78 0x1B 0xA3 0x8F 0xCD 0x13 0x17 0x88
Configuration last modified by 192.168.1.2 at 3-1-93 01:54:55
Local updater ID is 192.168.1.2 on interface Vl1 (lowest numbered VLAN interface found)
SW1#
注意到VTP的配置修正号变成了2，存在的VLAN数也变成了7，使用“show vtp status”命令检查SW2上的VTP信息，显示如下：
SW2#sh vtp status
VTP Version : 2
Configuration Revision : 2
Maximum VLANs supported locally : 255
Number of existing VLANs : 7
VTP Operating Mode : Client
VTP Domain Name : CYSD
VTP Pruning Mode : Disabled
VTP V2 Mode : Disabled
VTP Traps Generation : Disabled
MD5 digest : 0x78 0x1B 0xA3 0x8F 0xCD 0x13 0x17 0x88
Configuration last modified by 192.168.1.2 at 3-1-93 01:54:55
SW2#
从上面的输出中可以看到，SW2上的vlan配置信息与SW1的vlan配置信息同步，VTP仅能同步vlan信息，vlan中包含的端口还需要单独配置，SW2的配置如下：
SW2#conf t
Enter configuration commands, one per line. End with CNTL/Z.
SW2(config)#int fa0/1
SW2(config-if)#switchport mode access
SW2(config-if)#switchport access vlan 2
SW2(config-if)#int fa0/2
SW2(config-if)#switchport mode access
SW2(config-if)#switchport access vlan 3
l 配置vlan间路由
这里要配置单臂路由，借助路由器R1实现vlan 1 、vlan 2 、vlan 3之间的互访。SW1和R1之间的链路要配置成主干链路，SW1配置如下：
SW1>en
Password:
SW1#conf t
Enter configuration commands, one per line. End with CNTL/Z.
SW1(config)#int fa0/1
SW1(config-if)#switchport mode trunk
路由器R1的配置如下：
R1>en
Password:
R1#conf t
Enter configuration commands, one per line. End with CNTL/Z.
R1(config)#int fa0/0
R1(config-if)#int fa0/0.1
R1(config-subif)#encapsulation dot1Q 1
R1(config-subif)#ip add 192.168.1.1 255.255.255.0
R1(config-subif)#no sh
R1(config-subif)#int fa0/0.2
R1(config-subif)#encapsulation dot1Q 2
R1(config-subif)#ip add 192.168.2.254 255.255.255.0
R1(config-subif)#no sh
R1(config-subif)#int fa0/0.3
R1(config-subif)#encapsulation dot1Q 3
R1(config-subif)#ip add 192.168.3.254 255.255.255.0
R1(config-subif)#no sh
6、配置STP协议。要求配置生成树协议，使SW1为根交换机。
配置前先查看STP协议的运行情况，SW1上显示如下：
SW1#show spanning-tree
VLAN0001
Spanning tree enabled protocol ieee
Root ID Priority 32769
Address 0001.6472.0D1A
This bridge is the root
Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec
Bridge ID Priority 32769 (priority 32768 sys-id-ext 1)
Address 0001.6472.0D1A
Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec
Aging Time 20
Interface Role Sts Cost Prio.Nbr Type
---------------- ---- --- --------- -------- --------------------------------
Fa0/1 Desg FWD 19 128.1 P2p
Fa0/23 Desg FWD 19 128.23 P2p
Fa0/24 Desg FWD 19 128.24 P2p
VLAN0002
Spanning tree enabled protocol ieee
Root ID Priority 32770
Address 0001.6472.0D1A
This bridge is the root
Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec
Bridge ID Priority 32770 (priority 32768 sys-id-ext 2)
Address 0001.6472.0D1A
Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec
Aging Time 20
Interface Role Sts Cost Prio.Nbr Type
---------------- ---- --- --------- -------- --------------------------------
Fa0/1 Desg FWD 19 128.1 P2p
Fa0/2 Desg FWD 19 128.2 P2p
Fa0/23 Desg FWD 19 128.23 P2p
Fa0/24 Desg FWD 19 128.24 P2p
VLAN0003
Spanning tree enabled protocol ieee
Root ID Priority 32771
Address 0001.6472.0D1A
This bridge is the root
Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec
Bridge ID Priority 32771 (priority 32768 sys-id-ext 3)
Address 0001.6472.0D1A
Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec
Aging Time 20
Interface Role Sts Cost Prio.Nbr Type
---------------- ---- --- --------- -------- --------------------------------
Fa0/1 Desg FWD 19 128.1 P2p
Fa0/3 Desg FWD 19 128.3 P2p
Fa0/23 Desg FWD 19 128.23 P2p
Fa0/24 Desg FWD 19 128.24 P2p
SW1#
网络中只有两台交换机，既然SW1不是根交换机，那么根交换机是SW2。配置SW1使其成为所有vlan的根交换机，配置命令如下：
SW1(config)#spanning-tree vlan 1,2,3 priority 4096
SW1#show spanning-tree
VLAN0001
Spanning tree enabled protocol ieee
Root ID Priority 4097
Address 0001.6472.0D1A
This bridge is the root
Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec
Bridge ID Priority 4097 (priority 4096 sys-id-ext 1)
Address 0001.6472.0D1A
Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec
Aging Time 20
Interface Role Sts Cost Prio.Nbr Type
---------------- ---- --- --------- -------- --------------------------------
Fa0/1 Desg FWD 19 128.1 P2p
Fa0/23 Desg FWD 19 128.23 P2p
Fa0/24 Desg FWD 19 128.24 P2p
VLAN0002
Spanning tree enabled protocol ieee
Root ID Priority 4098
Address 0001.6472.0D1A
This bridge is the root
Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec
Bridge ID Priority 4098 (priority 4096 sys-id-ext 2)
Address 0001.6472.0D1A
Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec
Aging Time 20
Interface Role Sts Cost Prio.Nbr Type
---------------- ---- --- --------- -------- --------------------------------
Fa0/1 Desg FWD 19 128.1 P2p
Fa0/2 Desg FWD 19 128.2 P2p
Fa0/23 Desg FWD 19 128.23 P2p
Fa0/24 Desg FWD 19 128.24 P2p
VLAN0003
Spanning tree enabled protocol ieee
Root ID Priority 4099
Address 0001.6472.0D1A
This bridge is the root
Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec
Bridge ID Priority 4099 (priority 4096 sys-id-ext 3)
Address 0001.6472.0D1A
Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec
Aging Time 20
Interface Role Sts Cost Prio.Nbr Type
---------------- ---- --- --------- -------- --------------------------------
Fa0/1 Desg FWD 19 128.1 P2p
Fa0/3 Desg FWD 19 128.3 P2p
Fa0/23 Desg FWD 19 128.23 P2p
Fa0/24 Desg FWD 19 128.24 P2p
SW1#
注意，此时SW1已经是根交换机了。
7、配置DHCP
路由器R1的配置如下：
R1>en
Password:
R1#conf t
Enter configuration commands, one per line. End with CNTL/Z.
R1(config)#ip dhcp excluded-address 192.168.2.254
R1(config)#ip dhcp pool vlan2
R1(dhcp-config)#network 192.168.2.0 255.255.255.0
R1(dhcp-config)#default-router 192.168.2.254
R1(dhcp-config)#dns-server 218.1.1.2
R1(dhcp-config)#exit
R1(config)#ip dhcp excluded-address 192.168.3.254
R1(config)#ip dhcp pool vlan3
R1(dhcp-config)#network 192.168.3.0 255.255.255.0
R1(dhcp-config)#default-router 192.168.3.254
R1(dhcp-config)#dns-server 218.1.1.2
l 检验
使用如下图所示的方法，依次配置PC1、PC2、PC3和PC4,使用DHCP分配。
配置PC自动获取IP地址
配置完成后，在PC1的DOS窗口中查看IP地址的获取情况，显示如下：
在PC1上ping PC2的IP地址，显示如下：
PC1能成功地ping通PC2，表明前面配置的VLAN间路由正确，在PC1上ping PC3，显示如下：
PC1能成功地ping通PC3，表明前面配置的跨交换机vlan内的通信也正确。
8、配置路由协议
在路由器R1上配置默认路由，把所有未知流量都发往Internet，配置命令如下：
R1(config)#ip route 0.0.0.0 0.0.0.0 12.1.1.2
配置R2、R3和R4，运行OSPF路由协议
R2(config)#router ospf 1
R2(config-router)#network 24.1.1.0 0.0.0.255 area 0
R2(config-router)#network 23.1.1.0 0.0.0.255 area 0
R2(config-router)#network 12.1.1.0 0.0.0.255 area 0
R3(config)#router ospf 1
R3(config-router)#network 23.1.1.0 0.0.0.255 area 0
R3(config-router)#network 34.1.1.0 0.0.0.255 area 0
R4(config)#router ospf 1
R4(config-router)#network 24.1.1.0 0.0.0.255 area 0
R4(config-router)#network 34.1.1.0 0.0.0.255 area 0
R4(config-router)#network 218.1.1.0 0.0.0.255 area 0
l 检验
R1#ping 218.1.1.2
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 218.1.1.2, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 93/93/94 ms
R1#
路由器R2的OSPF邻居表显示如下：
R2#sh ip ospf neighbor
Neighbor ID Pri State Dead Time Address Interface
218.1.1.1 1 FULL/BDR 00:00:36 24.1.1.4 FastEthernet0/0
34.1.1.3 1 FULL/BDR 00:00:34 23.1.1.3 FastEthernet0/1
R2#
路由器E2的路由表显示如下：
R2#sh ip route
Codes: C - connected, S - static, I - IGRP, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGP
i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area
* - candidate default, U - per-user static route, o - ODR
P - periodic downloaded static route
Gateway of last resort is not set
12.0.0.0/24 is subnetted, 1 subnets
C 12.1.1.0 is directly connected, Serial0/0/0
23.0.0.0/24 is subnetted, 1 subnets
C 23.1.1.0 is directly connected, FastEthernet0/1
24.0.0.0/24 is subnetted, 1 subnets
C 24.1.1.0 is directly connected, FastEthernet0/0
34.0.0.0/24 is subnetted, 1 subnets
O 34.1.1.0 [110/782] via 23.1.1.3, 00:04:06, FastEthernet0/1
[110/782] via 24.1.1.4, 00:02:47, FastEthernet0/0
O 218.1.1.0/24 [110/2] via 24.1.1.4, 00:02:33, FastEthernet0/0
R2#
9、配置PPP协议
路由器R1的配置如下：
R1(config)#username R2 password cisco
R1(config)#int s0/0/0
R1(config-if)#encapsulation ppp
R1(config-if)#ppp authentication chap
路由器R2的配置如下：
R2(config)#username R1 password cisco
R2(config)#int s0/0/0
R2(config-if)#encapsulation ppp
R2(config-if)#ppp authentication chap
测试
R1#ping 218.1.1.2
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 218.1.1.2, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 63/81/93 ms
R1#
R1可以成功ping通服务器，PPP的CHAP验证成功。
10、配置NAT
在路由器R1上配置动态PAT，使4台PC都可以通过R1访问Internet，R1的配置如下：
R1(config)#int fa0/0.2
R1(config-subif)#ip nat inside
R1(config-subif)#int fa0/0.3
R1(config-subif)#ip nat inside
R1(config-subif)#int s0/0/0
R1(config-if)#ip nat outside
R1(config-if)#exit
R1(config)#access-list 1 permit 192.168.2.0 0.0.0.255
R1(config)#access-list 1 permit 192.168.3.0 0.0.0.255
R1(config)#ip nat inside source list 1 int s0/0/0 overload
R1(config)#
在路由器R1上配置静态PAT，使Internet可以通过路由器R1的TCP 2323端口Telnet登录到SW1。R1的配置如下：
R1(config)#int fa0/0.1
R1(config-subif)#ip nat inside
R1(config-subif)#exit
R1(config)#ip nat inside source static tcp 192.168.1.2 23 12.1.1.1 2323
R1(config)#access-list 1 permit 192.168.1.0 0.0.0.255
测试
在PC1上ping Web服务器的IP地址，显示如下：
PC>ping 218.1.1.2
Pinging 218.1.1.2 with 32 bytes of data:
Reply from 218.1.1.2: bytes=32 time=203ms TTL=125
Reply from 218.1.1.2: bytes=32 time=125ms TTL=125
Reply from 218.1.1.2: bytes=32 time=125ms TTL=125
Reply from 218.1.1.2: bytes=32 time=156ms TTL=125
Ping statistics for 218.1.1.2:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 125ms, Maximum = 203ms, Average = 152ms
PC>
11、配置ACL 。配置路由器R1，拒绝vlan 2 的主机访问Web 服务器的WWW服务，其他服务不受影响。
配置ACL前，在PC1上访问www.cysd.com ，显示如图：
PC1浏览Web服务器成功
接下来配置ACL，路由器R1的配置如下：
R1(config)#access-list 100 deny tcp 192.168.2.0 0.0.0.255 host 218.1.1.2 eq 80
R1(config)#access-list 100 permit ip any any
R1(config)#int fa0/0.2
R1(config-subif)#ip access-group 100 in
在PC1上访问www.cysd.com ，如图所示：
PC1浏览Web服务器失败
PC1浏览Web服务器失败，在PC1上ping Web服务器的IP地址，显示如下：
PC>ping 218.1.1.2
Pinging 218.1.1.2 with 32 bytes of data:
Reply from 218.1.1.2: bytes=32 time=125ms TTL=125
Reply from 218.1.1.2: bytes=32 time=140ms TTL=125
Reply from 218.1.1.2: bytes=32 time=156ms TTL=125
Reply from 218.1.1.2: bytes=32 time=108ms TTL=125
Ping statistics for 218.1.1.2:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 108ms, Maximum = 156ms, Average = 132ms
PC>
PC1仍可以成功ping通Web服务器。
至此，综合实验配置全部完成。
转载于:https://blog.51cto.com/19880423/1189627
229
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
