交换配置实验

尽可能的减少洪泛范围，防止产生互联
交换机的每个口上只允许通过接口下方有的vlan通过（即不能allow-pass all） （交换机与交换机之间用trunk端口，交换机与PC和路由器之间用access端口）

例如：SW2的g0/0/1 port trunk allow-pass vlan 2 3
g0/0/2 port default vlan 2 3
SW1的g0/0/2 port trunk allow-pass vlan 2 3
创建SW1和SW4三层互联
[SW1]int vlan 114
[SW1-Vlanif114]ip address 10.1.114.1 24

[SW4]int vlan 114
[SW4-Vlanif114]ip address 10.1.114.2 24

让R1和SW1 SW4直连之间可以相互通信
[SW1]vlan batch 11
[SW1]int vlan 11
[SW1-Vlanif11]ip address 10.1.11.2 24
[SW1]int g0/0/3
[SW1-GigabitEthernet0/0/3]port link-type access
[SW1-GigabitEthernet0/0/3]port default vlan 11

[SW4]vlan batch 14
[SW4]int vlan 14
[SW4-Vlanif14]ip address 10.1.14.2 24
[SW4]int g0/0/3
[SW4-GigabitEthernet0/0/3]port link-type access
[SW4-GigabitEthernet0/0/3]port default vlan 14

[R1]int g0/0/0
[R1-GigabitEthernet0/0/0]ip address 10.1.11.1 24
[R1]int g0/0/1
[R1-GigabitEthernet0/0/1]ip address 10.1.14.1 24

给SW1和SW4创建网关地址
[SW1]int vlan 2
[SW1-Vlanif2]ip address 10.1.2.254 24
[SW1]int vlan 3
[SW1-Vlanif3]ip address 10.1.3.254 24

[SW4]int vlan 4
[SW4]ip address 10.1.4.254 24
[SW4]int vlan 5
[SW4-Vlanif5]ip address 10.1.5.254 24

在SW1和SW2上配置DHCP,让PC1-PC6获取到地址
[SW1]int vlan 2
[SW1-Vlanif2]dhcp select interface
[SW1-Vlanif2]dhcp server dns-list 8.8.8.8
[SW1]int vlan 3
[SW1-Vlanif3]dhcp select interface
[SW1-Vlanif3]dhcp server dns-list 8.8.8.8

[SW4]int vlan 4
[SW4-Vlanif4]dhcp select interface
[SW4-Vlanif4]dhcp server dns-list 8.8.8.8
[SW4]int vlan 5
[SW4-Vlanif5]dhcp select interface
[SW4-Vlanif5]dhcp server dns-list 8.8.8.8

在PC1和PC5上验证一下


在SW7上划分vlan和配置接口属性,还有SW1的g0/0/4和SW4的g0/0/5
配置交换机SW１和SW４的网关
[SW1]int vlan 100
[SW1-Vlanif100]ip address 10.1.100.254 24

[SW4]int vlan 200
[SW4-Vlanif200]ip address 10.1.200.254 24

在Server1和Server2上配置地址和网关
Server1 地址:10.1.100.1
网关:10.1.100.254
Server2 地址:10.1.200.1
网关:10.1.200.254
R1上配置:
[R1]int g0/0/2
[R1-GigabitEthernet0/0/2]ip address 100.1.1.1 30

[ISP]int lo 0
[ISP-LoopBack0]ip address 8.8.8.8 32
[ISP-LoopBack0]int g0/0/0
[ISP-GigabitEthernet0/0/0]ip address 100.1.1.2 30

在R1 SW1 SW4上起ＯＳＰＦ协议
R1,SW1,SW4之间的线做一个区(area0),vlan2 vlan3划分一个区(area1),vlan4 vlan5划分一个区(area2),服务器在划一个区(area3 vlan100 ,area4 vlan200)
[SW1]ospf 1 router-id 11.11.11.11
[SW1-ospf-1]area 0
[SW1-ospf-1-area-0.0.0.0]network 10.1.114.0 0.0.0.255
[SW1-ospf-1-area-0.0.0.0]network 10.1.11.0 0.0.0.255
[SW1-ospf-1-area-0.0.0.0]area 1
[SW1-ospf-1-area-0.0.0.1]network 10.1.2.0 0.0.0.255
[SW1-ospf-1-area-0.0.0.1]network 10.1.3.0 0.0.0.255
[SW1-ospf-1-area-0.0.0.1]stub no-summary
[SW1-ospf-1-area-0.0.0.1]area 3
[SW1-ospf-1-area-0.0.0.3]network 10.1.100.0 0.0.0.255
[SW1-ospf-1-area-0.0.0.3]stub no-summary

[SW4]ospf 1 router-id 4.4.4.4
[SW4-ospf-1]area 0
[SW4-ospf-1-area-0.0.0.0]network 10.1.114.0 0.0.0.255
[SW4-ospf-1-area-0.0.0.0]network 10.1.14.0 0.0.0.255
[SW4-ospf-1-area-0.0.0.0]area 2
[SW4-ospf-1-area-0.0.0.2]network 10.1.4.0 0.0.0.255
[SW4-ospf-1-area-0.0.0.2]network 10.1.5.0 0.0.0.255
[SW4-ospf-1-area-0.0.0.2]stub no-summary
[SW4-ospf-1-area-0.0.0.2]area 4
[SW4-ospf-1-area-0.0.0.4]network 10.1.200.0 0.0.0.255
[SW4-ospf-1-area-0.0.0.4]stu no-summary

[R1]ospf 1 router-id 1.1.1.1
[R1-ospf-1]area 0
[R1-ospf-1-area-0.0.0.0]network 10.1.11.0 0.0.0.255
[R1-ospf-1-area-0.0.0.0]network 10.1.14.0 0.0.0.255

[R1]ip route-static 0.0.0.0 0 100.1.1.2(R1去外网写缺省 )
[R1]ospf 1
[R1-ospf-1]default-route-advertise
[R1]acl 2000
[R1-acl-basic-2000]rule permit source 10.1.0.0 0.0.255.255
[R1]int g0/0/2
[R1-GigabitEthernet0/0/2]nat outbound 2000

做个端口映射,访问R1的g0/0/2接口会访问到server 2
[R1]int g0/0/2
[R1-GigabitEthernet0/0/2]nat server protocol tcp global current-interface 80 inside 10.1.200.1 80
配置R2和client1的地址
测试

最后所有的网关配置静默接口
silent-interface vlanif 2(命令示例)

全网可达