HCIP三层架构

实验拓扑：

思路：我们从eth-trunk trunk stp vlan svi vrrp dhcp 这几个步骤开始

先做eth-trunk
[SW1]interface Eth-Trunk 0
[SW1-Eth-Trunk0]q
[SW1-Ethernet0/0/1]eth-trunk 0
[SW1-Ethernet0/0/1].int e0/0/2
[SW1-Ethernet0/0/2]eth-trunk 0

[SW2]int Eth-Trunk 0
[SW2-Eth-Trunk0]int e0/0/1
[SW2-Ethernet0/0/1]eth-trunk 0
[SW2-Ethernet0/0/1]int e0/0/2
[SW2-Ethernet0/0/2]eth-trunk 0

再做trunk
[SW1]port-group group-member Ethernet 0/0/3 to Ethernet 0/0/4 Eth-Trunk 0
[SW1-port-group]port link-type trunk
[SW1-port-group]port trunk allow-pass vlan 2

[SW2]port-group group-member Ethernet 0/0/3 to Ethernet 0/0/4 Eth-Trunk 0
[SW2-port-group]port link-type trunk
[SW2-port-group]port trunk allow-pass vlan 2

stp:
[SW1]stp enable
[SW1]stp mode mstp
[SW1]stp region-configuration
[SW1-mst-region]region-name a
[SW1-mst-region]instance 1 vlan 1
[SW1-mst-region]instance 2 vlan 2
[SW1-mst-region]active region-configuration

SW２，３，４都一样

做完后发现根网桥不在SW1上,调整分流

[SW1]stp instance 1 root primary
[SW1]stp instance 2 root secondary

[SW2]stp instance 1 root secondary
[SW2]stp instance 2 root primary

vlan:

SW１;
interface GigabitEthernet0/0/1
port link-type access
port default vlan 100

sw2:
interface GigabitEthernet0/0/2
port link-type access
port default vlan 100

sw3:
interface Ethernet0/0/1
port link-type access

interface Ethernet0/0/2
port link-type access
port default vlan 2

sw4:
interface Ethernet0/0/1
port link-type access

interface Ethernet0/0/2
port link-type access
port default vlan 2

svi:

[SW1]int Vlanif 1
[SW1-Vlanif1]ip add 172.16.1.1 25
[SW1]interface Vlanif 2
[SW1-Vlanif2]ip add 172.16.1.129 25

[SW2]int Vlanif 1
[SW2-Vlanif1]ip add 172.16.1.12 25
[SW2]interface Vlanif 2
[SW2-Vlanif2]ip address 172.16.1.130 25

VRRP:

[SW1-Vlanif1]dis th

interface Vlanif1
ip address 172.16.1.1 255.255.255.128
vrrp vrid 1 virtual-ip 172.16.1.126
vrrp vrid 1 priority 120
vrrp vrid 1 track interface GigabitEthernet0/0/1 reduced 30

[SW1-Vlanif2]display th

interface Vlanif2
ip address 172.16.1.129 255.255.255.128
vrrp vrid 1 virtual-ip 172.16.1.254

[SW2-Vlanif1]dis th

interface Vlanif1
ip address 172.16.1.12 255.255.255.128
vrrp vrid 1 virtual-ip 172.16.1.126

[SW2-Vlanif2]dis th

interface Vlanif2
ip address 172.16.1.130 255.255.255.128
vrrp vrid 1 virtual-ip 172.16.1.254
vrrp vrid 1 priority 120
vrrp vrid 1 track interface GigabitEthernet0/0/2 reduced 30

DHCP:

SW１和SW２一样的地址池：
ip pool v1
gateway-list 172.16.1.126
network 172.16.1.0 mask 255.255.255.128
dns-list 114.114.114.114 8.8.8.8

ip pool v2
gateway-list 172.16.1.254
network 172.16.1.128 mask 255.255.255.128
dns-list 114.114.114.114 8.8.8.8

再进入ｖｌａｎ１　和　ｖｌａｎ２　开启ＤＨＣＰ

各个电脑均以拿到地址

开始配置底层路由:

因为华为的三层接口有问题无法在undo portswitch 后配置地址,所以我们这里使用VLAN 100来代替,具有相同效果,都是唯一的

[SW1]int g0/0/1
[SW1-GigabitEthernet0/0/1]port link-type access
[SW1-GigabitEthernet0/0/1]port default vlan 100
[SW1-GigabitEthernet0/0/1]q
[SW1]int Vlanif 100
[SW1-Vlanif100]ip address 172.16.0.1 30

[SW2]int g0/0/2
[SW2-GigabitEthernet0/0/2]po li ac
[SW2-GigabitEthernet0/0/2]po de vl 100
[SW2-GigabitEthernet0/0/2]q
[SW2]int v100
[SW2-Vlanif100]ip add 172.16.0.5 30

R2:

interface GigabitEthernet0/0/0
ip address 12.1.1.1 255.255.255.0

interface GigabitEthernet0/0/1
ip address 172.16.0.2 255.255.255.252

interface GigabitEthernet0/0/2
ip address 172.16.0.6 255.255.255.252

R1(ISP):

interface GigabitEthernet0/0/0
ip address 12.1.1.2 255.255.255.0

interface LoopBack0
ip address 1.1.1.1 255.255.255.0

策略:

动态协议ospf:
R2:

ospf 1 router-id 1.1.1.1
area 0.0.0.0
network 172.16.0.0 0.0.0.255

[SW1-ospf-1]dis th

ospf 1 router-id 2.2.2.2
silent-interface all
undo silent-interface GigabitEthernet0/0/1
undo silent-interface Eth-Trunk0
undo silent-interface Vlanif1
undo silent-interface Vlanif100
area 0.0.0.0
network 172.16.0.1 0.0.0.0
area 0.0.0.1
abr-summary 172.16.1.0 255.255.255.0
network 172.16.1.1 0.0.0.0
network 172.16.1.129 0.0.0.0

[SW2-ospf-1]dis th

ospf 1 router-id 3.3.3.3
silent-interface all
undo silent-interface GigabitEthernet0/0/2
undo silent-interface Eth-Trunk0
undo silent-interface Vlanif1
undo silent-interface Vlanif100
area 0.0.0.0
network 172.16.0.5 0.0.0.0
area 0.0.0.1
abr-summary 172.16.1.0 255.255.255.0
network 172.16.1.2 0.0.0.0
network 172.16.1.130 0.0.0.0

为了使电脑能够上网,需要用缺省,ACL
[R2]ip route-static 0.0.0.0 0 12.1.1.2
[R2-ospf-1]default-route-advertise
[R2-acl-basic-2000]dis th
[V200R003C00]

acl number 2000
rule 5 permit source 172.16.0.0 0.0.255.255
[R2-GigabitEthernet0/0/0]dis th
[V200R003C00]

interface GigabitEthernet0/0/0
ip address 12.1.1.1 255.255.255.0
nat outbound 2000

测试:

断掉设备SW１后，依然能正常上网