网络规划期中实操总结

1.配置交换
AS1:
(config)#vlan 11
(config)#vlan 22
(config)#vlan 100
(config)#int f0/2
(config-if)#switchport access vlan 11
(config)#int f0/23
(config-if)#switchport access vlan 22
(config-vlan)#int f0/1
(config-if)#switchport access vlan 100

AS2:
(config)#vlan 22
(config)#vlan 100
(config)#int f0/2
(config-if)#switchport access vlan 22
(config-vlan)#int f0/1
(config-if)#switchport access vlan 100
CS:
(config)#vlan 11
(config-vlan)#vlan 22
(config-vlan)#vlan 200
(config-vlan)#vlan 100
(config-vlan)#vlan 1
(config-vlan)#int f0/1
(config-if)#switchport access vlan 11

(config-if)#int f0/2
(config-if)#switchport access vlan 22

(config-if)#int f0/22
(config-if)#switchport access vlan 1

(config-if)#int f0/24
(config-if)#switchport access vlan 200

(config-if)#int f0/6
(config-if)#switchport access vlan 100

(config)#int range f0/1-f0/2
(config-if)#switchport trunk encapsulation dot1q
(config-if)#switchport mode trunk

2.配置CS核心交换
CS：
(config)#ip routing
(config)#int vlan 11
(config-if)#ip address 172.16.11.1 255.255.255.0
(config)#int vlan 22
(config-if)#ip address 172.16.22.1 255.255.255.0
(config)#int vlan 200
(config-if)#ip address 172.16.200.1 255.255.255.0
(config)#int vlan 1
(config-if)#no shutdown
(config-if)#ip address 172.16.1.1 255.255.255.0
(config)#int vlan 100
(config-if)#ip address 172.16.100.2 255.255.255.0
(config)#int f0/5
(config-if)#no switchport
(config-if)#ip address 172.16.253.1 255.255.255.0

CS：
(config)#ip route 0.0.0.0 0.0.0.0 172.16.253.2

3.配置Firewall出口路由
Firewall：
(config)#ip route 0.0.0.0 0.0.0.0 2.0.0.1
(config)#ip route 172.16.0.0 255.255.0.0 172.16.253.1

(config)#access-list 101 deny ip 172.16.0.0 0.0.255.255 192.168.0.0 0.0.255.255
(config)#access-list 101 permit ip 172.16.0.0 0.0.255.255 any
(config)#ip nat inside source list 101 interface FastEthernet1/0 overload
(config)#int f0/0
(config-if)#ip nat inside
(config)#int f1/0
(config-if)#ip nat outside

(config)#ip nat inside source static tcp 172.16.254.2 80 2.0.0.3 80
(config)#int f0/1
(config-if)#ip nat inside


4.配置互联网路由ospf
ASP1:
(config)#int loopback 0
(config-if)#ip address 10.0.0.1 255.255.255.255
(config)#router ospf 1
(config-router)#network 3.0.0.0 0.255.255.255 area 0
(config-router)#network 5.0.0.0 0.255.255.255 area 0
(config-router)#network 2.0.0.0 0.0.0.7 area 0

ASP2:
(config)#int loopback 0
(config-if)#ip address 10.0.0.2 255.255.255.255
(config)#router ospf 1
(config-router)#network 4.0.0.0 0.255.255.255 area 0
(config-router)#network 5.0.0.0 0.255.255.255 area 0
(config-router)#network 7.0.0.0 0.0.0.3 area 0
(config-router)#network 8.0.0.0 0.255.255.255 area 0

ASP3:
(config)#int loopback 0
(config-if)#ip address 10.0.0.3 255.255.255.255
(config)#router ospf 1
(config-router)#network 3.0.0.0 0.255.255.255 area 0
(config-router)#network 4.0.0.0 0.255.255.255 area 0
(config-router)#network 6.0.0.0 0.255.255.255 area 0

5.配置Div-R分公司路由器
ISP2:
(config)#int s0/1/0
(config-if)#clock rate 2000000
(config-if)#encapsulation ppp
Div-R:
(config)#interface s0/1/0
(config-if)#encapsulation ppp
Div-R:
(config)#ip route 0.0.0.0 0.0.0.0 7.0.0.1

(config)#access-list 101 deny ip 192.168.1.0 0.0.0.255 172.16.0.0 0.0.255.255
(config)#access-list 101 permit ip 192.168.1.0 0.0.0.255 any
(config)#ip nat inside source list 101 int s0/1/0 overload
(config)#int s0/1/0
(config-if)#ip nat outside
(config-if)#int f0/0
(config-if)#ip nat inside

6.wlan无线接入

7.配置PPPoE接入

ISP2:
(config)#int f1/0
(config-if)#pppoe enable

(config)#ip local pool mypool 8.0.0.2 8.0.0.200
(config)#username c password 0 c

(config)#vpdn enable
(config)#vpdn-group mygroup
(config-vpdn)#accept-dialin
(config-vpdn-acc-in)#protocol pppoe
(config-vpdn-acc-in)#virtual-template 1
(config)#int virtual-template 1
(config-if)#ip unnumbered f1/0
(config-if)#peer default ip address pool mypool
(config-if)#ppp authentication chap

(config)#aaa new-model
(config)#aaa authentication ppp default group radius
(config)#radius-server host 6.0.0.2 key aaa





8.配置VPN

Firewall:

(config)#crypto isakmp enable
(config)#crypto isakmp policy 1
(config-isakmp)#hash sha
(config-isakmp)#authentication pre-share

(config)#crypto isakmp key 123 address 7.0.0.2
(config)#crypto ipsec transform-set testform ah-sha-hmac esp-des
(config)#access-list 102 permit ip 172.16.0.0 0.0.255.255 192.168.1.0 0.0.0.255
(config)#crypto map testmap 1 ipsec-isakmp
(config-crypto-map)#set peer 7.0.0.2
(config-crypto-map)#set transform-set testform
Router(config-crypto-map)#match address 102

(config)#int f1/0
(config-if)#crypto map testmap

Div-R:
(config)#crypto isakmp enable
(config)#crypto isakmp policy 1
(config-isakmp)#hash sha
(config-isakmp)#authentication pre-share

(config)#crypto isakmp key 123 address 2.0.0.2
(config)#crypto ipsec transform-set testform ah-sha-hmac esp-des
(config)#access-list 102 permit ip 192.168.1.0 0.0.0.255 172.16.0.0 0.0.255.255
(config)#crypto map testmap 1 ipsec-isakmp
(config-crypto-map)#set peer 2.0.0.2
(config-crypto-map)#set transform-set testform
Router(config-crypto-map)#match address 102

(config)#int s0/1/0
(config-if)#crypto map testmap

9.配置VoIP

AS1:
(config)#int f0/1
(config-if)#switchport voice vlan 1
AS2:
(config)#int f0/1
(config-if)#switchport voice vlan 1
CS:
(config)#int f0/6
(config-if)#switchport voice vlan 1

Switch:
(config)#int f0/1
(config-if)#switchport voice vlan 1
(config)#int f0/24
(config-if)#switchport voice vlan 1

CallM:
(config)#ip dhcp pool voip
(dhcp-config)#network 172.16.100.0 255.255.255.0
(dhcp-config)#default-router 172.16.100.1
(dhcp-config)#option 150 ip 172.16.100.1
(config)#telephony-service
(config-telephony)#max-ephones 20
(config-telephony)#max-dn 20
(config-telephony)#auto assign 1 to 10
(config-telephony)#ip source-address 172.16.100.1 port 2000
(config)#ephone-dn 1
(config-ephone-dn)#number 1001
(config)#ephone-dn 2
(config-ephone-dn)#number 1002

Div-R:
(config)#ip dhcp pool voip
(dhcp-config)#network 192.168.1.0 255.255.255.0
(dhcp-config)#default-router 192.168.1.1
(dhcp-config)#option 150 ip 192.168.1.1
(config)#telephony-service
(config-telephony)#max-ephones 20
(config-telephony)#max-dn 20
(config-telephony)#auto assign 1 to 10
(config-telephony)#ip source-address 192.168.1.1 port 2000
(config)#ephone-dn 1
(config-ephone-dn)#number 2001

CallManager:
(config)#ip route 0.0.0.0 0.0.0.0 172.16.100.2

CallManager:
(config)#dial-peer voice 1 voip
(config-dial-peer)#destination-pattern 2…
(config-dial-peer)#session target ipv4:192.168.1.1

Div-R:
(config)#dial-peer voice 1 voip
(config-dial-peer)#destination-pattern 1…
(config-dial-peer)#session target ipv4:172.16.100.1

最后设置财务部不能访问外网：
Firewall：
(config)#access-list 103 permit ip 172.16.11.0 0.0.0.255 172.16.254.0 0.0.0.255
(config)#access-list 103 deny ip 172.16.11.0 0.0.0.255 any
(config)#access-list 103 permit ip any any
(config)#int f0/0
(config-if)#ip access-group 103 in

不要忘了给laptop 设置静态IP