1.拓扑图的搭建
2.实验要求:
- 设置合理的STP优先级、边缘端口、ETH_trunk;
- 企业内网划分多个vlan,减少广播域大小,提高网络稳定性;
- 企业财务服务器,只允许财务部(vlan 30)的员工访问;
- 出口配置nat;
- 所有用户均为自动获取IP地址;
- 在企业出口将内网服务器的80端口映射出去,允许外网用户访问;
1.端口IP地址的添加。
路由器/交换机 | 接口 | IP地址 |
R1 | G0/0/0 | 192.168.254.1/24 |
E0/0/0 | 12.1.1.1/29 | |
R2 | E0/0/0 | 12.1.1.2/29 |
LoopBack 1 | 9.9.9.9/32 | |
server 1 | 192.168.200.2 | |
server 2 | 192.168.200.3 | |
vlanif 10 | 192.168.10.1/24 | |
vlanif 20 | 192.168.20.1/24 | |
sw1 | vlanif 30 | 192.168.30.1/24 |
vlanif 40 | 192.168.40.1/24 | |
vlanif 200 | 192.168.200.1/24 | |
vlanif 800 | 192.168.254.2/24 |
2.设置合理的STP优先级、边缘端口、Eth-trunk。
<1>设置stp优先级
命令:stp priority 4096
(1)sw1(2)sw2
<2>配置边缘端口(与终端相连的端口)命令:
int g0/0/x
stp edged-port enable
<3>eth-trunk命令:
int eth-trunk 1
port link-type trunk
port trunk allow-pass vlan all
mode lacp-static
trunkport g 0/0/1 to 0/0/2
(1)eth-trunk1
(2)eth-trunk2
(3)eth-trunk3
(4)eth-trunk4
(5)sw1 trunk
3.划分vlan,减少广播域大小,提高网络稳定性。命令:
vlan batch 10
int g0/0/1
port link-type access//接口类型配置为access
port defult vlan 10
(1)vlan 10 20(2)vlan30
(3)vlan40
(4)vlan200
(5)vlan 800
4.出口配置NAT。(R1)
acl number 2000
rule 5 permit source 192.168.10.0 0.0.0.255
rule 10 permit source 192.168.20.0 0.0.0.255
rule 15 permit source 192.168.30.0 0.0.0.255
rule 20 permit source 192.168.40.0 0.0.0.255
rule 25 permit source 192.168.200.0 0.0.0.255
rule 30 permit source 192.168.254.0 0.0.0.255
nat address-group 1 12.1.1.2 12.1.1.5
int e0/0/1
nat outbound 2000 address-group 1
抓包测试(wireshake)
5.所有用户均为自动获取IP地址。(三层交换机)
DHCP enable
ip pool 1
network 192.168.10.0 mask 24
gatway 192.168.10.1
DNS server 192.168.1.154
int vlan 10
dhcp select global
在pc机上开启DHCP;
6.在企业出口将内网服务器的80端口映射出去。(R1)
int e0/0/1
nat server protocol tcp global 12.1.1.5 80 inside 192.168.200.2 80
7.企业财务服务器,只允许财务部(vlan 30)的员工访问。(LSW5)
acl3000
rule 5 permit ip soure 192.168.30.0 0.0.0.255 destination 192.168.200.2 0
rule 10 deny ip
int e0/0/2
traffic-filter outbound acl 3000
测试:
(1)PC2 ping 财务服务器
(2)PC3 ping 财务服务器