1、需求分析
某学校校园网如图所示分为两个校区,主校区用SwitchB模拟校园网三次交换机,出口路由器为RouterA; 分校区用一台PC模拟,即为PC4,出口路由器为RouterB;两个校区通过租用公网专线互联,用两条背靠背串口线互联模拟。PC1模拟公网主机,SwitchA模拟公网交换机,RouterA通过以太网接入到公网,RouterB通过两条背靠背串口线与RouterA互联,IP地址设置如图所示。学校要求主校区的PC2、PC3能够通过RouterA的动态地址转换访问到PC1;要求将主校区的Web服务发布的公网,让PC1和分校区的PC4能够访问;要求将分校区的PC4,以一对一的地址映射方式分布到公网,让PC1、PC2、PC3可以访问。
2、网络拓扑图
网络拓扑图如下图1所示。
图1 校园网拓扑图(改造前)
图2 校园网拓扑图(改造后)
3、训练要求
1)、按照图1设置个设备相应的IP地址。
配置RA、RB两台交换机的接口配置
RA
[Huawei]SYS RouteA
[RouteA]interface Serial1/0/0
[RouteA-Serial1/0/0] ip address 123.1.2.5 255.255.255.252
[RouteA-Serial1/0/0]interface Serial1/0/1
[RouteA-Serial1/0/1] ip address 123.1.2.9 255.255.255.252
[RouteA-Serial1/0/1]interface GigabitEthernet0/0/0
[RouteA-GigabitEthernet0/0/0] ip address 123.1.2.2 255.255.255.0
[RouteA-GigabitEthernet0/0/0]interface GigabitEthernet0/0/1
[RouteA-GigabitEthernet0/0/1] ip address 192.168.1.2 255.255.255.0
[RouteA-GigabitEthernet0/0/1]
RB
[RouteB] sysname RouteB
[RouteB]
[RouteB]interface Serial1/0/0
[RouteB-Serial1/0/0] ip address 123.1.2.6 255.255.255.252
[RouteB-Serial1/0/0]interface Serial1/0/1
[RouteB-Serial1/0/1] ip address 123.1.2.10 255.255.255.252
[RouteB-Serial1/0/1]interface GigabitEthernet0/0/0
[RouteB-GigabitEthernet0/0/0] ip address 10.1.1.1 255.255.255.0
[RouteB-GigabitEthernet0/0/0]interface LoopBack1
[RouteB-LoopBack1] ip address 123.6.6.6 255.255.255.255
2)、主校区SwitchB上划分VLAN10、VLAN20两个VLAN,PC2、PC3分别接入到VLAN10、VLAN20;SwitchB与RouteA之间实现三层互联,互联地址设置如下图2所示。
配置交换机接口模式和pc的网关地址
SwA
[SwitchA]
[SwitchA]vlan batch 100
[SwitchA]interface GigabitEthernet0/0/1
[SwitchA-GigabitEthernet0/0/1] port link-type access
[SwitchA-GigabitEthernet0/0/1]interface GigabitEthernet0/0/24
[SwitchA-GigabitEthernet0/0/24] port link-type access
[SwitchA-GigabitEthernet0/0/24] port default vlan 100
[SwitchA]interface Vlanif1
[SwitchA-Vlanif1] ip address 123.1.2.1 255.255.255.252
[SwitchA-Vlanif1]interface Vlanif100
[SwitchA-Vlanif100] ip address 123.1.1.1 255.255.255.0
SwB
[Huawei]sysname SwitchB
[SwitchB]
[SwitchB]vlan batch 10 20
[SwitchB]interface GigabitEthernet0/0/10
[SwitchB-GigabitEthernet0/0/10] port link-type access
[SwitchB-GigabitEthernet0/0/10] port default vlan 10
[SwitchB-GigabitEthernet0/0/10]interface GigabitEthernet0/0/11
[SwitchB-GigabitEthernet0/0/11] port link-type access
[SwitchB-GigabitEthernet0/0/11] port default vlan 20
[SwitchB]interface Vlanif1
[SwitchB-Vlanif1] ip address 192.168.1.1 255.255.255.0
[SwitchB-Vlanif1]interface Vlanif10
[SwitchB-Vlanif10] ip address 192.168.10.1 255.255.255.0
[SwitchB-Vlanif10]interface Vlanif20
[SwitchB-Vlanif20] ip address 192.168.20.1 255.255.255.0
3)SwitchB与RouteA之间运行路由RIP,实现内网两个VLAN与RouteA之间的正常通信。
配置交换机B和路由器A的rip路由协议
Swb
[SwitchB]rip 1
[SwitchB-rip-1] undo summary
[SwitchB-rip-1] version 2
[SwitchB-rip-1] network 192.168.1.0
[SwitchB-rip-1] network 192.168.10.0
[SwitchB-rip-1] network 192.168.20.0
[SwitchB-rip-1]
Ra
[RouteA]rip 1
[RouteA-rip-1]
[RouteA-rip-1] undo summary
[RouteA-rip-1] version 2
[RouteA-rip-1] network 192.168.1.0
[RouteA-rip-1] network 123.0.0.0
4)SwitchA与RouteB之间运行静态路由协议,实现PC1能正常访问RouteA。
配置SA和SB的静态路由
SWA
[SwitchA]ip route-sta 0.0.0.0 0 123.1.2.2
RA
[RouteA]ip route-static 123.1.1.0 255.255.255.0 123.1.2.1
[RouteA]ip route-static 0.0.0.0 0.0.0.0 123.1.2.6
5)RouteA与RouteB之间通过两条串口链路互联,封装PPP,配置123.1.2.8/30这条链路启动PPP协议CHAP验证方式,两端通信密匙均为cisco。
配置RA和RB的chap认证,RA为认证端,RB为客户端
RA
[RouteA]aaa
[RouteA-aaa]
[RouteA-aaa] local-user huawei password cipher cisco
[RouteA-aaa] local-user huawei privilege level 3
[RouteA-aaa] local-user huawei service-type ppp
[RouteA-aaa]Q
[RouteA]interface Serial1/0/1
[RouteA-Serial1/0/1] ppp authentication-mode chap
[RouteA-Serial1/0/1]
RB
[RouteB]interface Serial1/0/1
[RouteB-Serial1/0/1] ppp chap user huawei
[RouteB-Serial1/0/1] ppp chap password cipher cisco
6)RouteA与RouteB之间运行动态路由OSPF协议,实现RouteA能正常访问到RouteB的Lookback地址123.6.6.6。
配置RA和RB的ospf协议
RA
[RouteA]ospf 1
[RouteA-ospf-1]
[RouteA-ospf-1] area 0.0.0.0
[RouteA-ospf-1-area-0.0.0.0] network 123.1.2.4 0.0.0.3
[RouteA-ospf-1-area-0.0.0.0] network 123.1.2.8 0.0.0.3
[RouteA-ospf-1-area-0.0.0.0] network 123.6.6.6 0.0.0.0
RB
[RouteB]ospf 1
[RouteB-ospf-1]
[RouteB-ospf-1] area 0.0.0.0
[RouteB-ospf-1-area-0.0.0.0] network 10.1.1.0 0.0.0.255
[RouteB-ospf-1-area-0.0.0.0] network 123.1.2.4 0.0.0.3
[RouteB-ospf-1-area-0.0.0.0] network 123.1.2.8 0.0.0.3
[RouteB-ospf-1-area-0.0.0.0] network 123.6.6.6 0.0.0.0
7)在RouteA上,通过OSPF的静态路由重分布,实现PC1能正常访问RouteB的Lookback地址123.6.6.6。
[RouteA]ospf 1
[RouteA-ospf-1] import-route static
8)在RouteA上,配置动态NAT,以实现PC2和PC3能访问到PC1。
[RouteA]acl number 2000
[RouteA-acl-basic-2000]
[RouteA-acl-basic-2000] rule 5 permit source 192.168.10.0 0.0.0.255
[RouteA-acl-basic-2000] rule 10 permit source 192.168.20.0 0.0.0.255
[RouteA-acl-basic-2000]Q
[RouteA]interface GigabitEthernet0/0/0
[RouteA-GigabitEthernet0/0/0] nat outbound 2000