H3CNE综合实验二

最新推荐文章于 2024-09-30 17:57:44 发布

学识小鑫

最新推荐文章于 2024-09-30 17:57:44 发布

阅读量877

点赞数 8

文章标签：网络

本文链接：https://blog.csdn.net/weixin_55270891/article/details/142642892

版权

H3CNE综合实验二

一、实验拓扑

在这里插入图片描述

二、项目说明

某集团公司经过业务快速发展，，为了实现快捷的信息交流和资源共享，需要构建统一网络，整合公司所有相关业务流程。总部采用双核心的网络构架，为了保证公司数据通信的安全性，通过租用运营商的两条 2M 专线及一条千兆专线利用路由器实现负载分担的网络环境。公司为了安全管理每个部门的用户，使用 VLAN 技术将每个部门的用户划分到不同的 VLAN 中。公司采用路由器接入互联网络和城域网专用网络。

公司把服务器托管到运营商的 IDC 机房，但设备的软件维护仍由公司自己完成。为了保障总公司与分公司业务数据流传输的高可用性，使用ACL包过滤技术进行保证网络安全，对公司重要的业务数据流进行保障。网络采用OSPF动态路由协议和RIP动态路由协议以及静态路由，各部门主机地址通过DHCP进行下发以防止地址冲突问题。

三、地址规划表

在这里插入图片描述

四、实验需求

按照图示配置IP地址。
Sw7和sw8之间的直连链路配置链路聚合。
公司内部业务网段为vlan10和vlan20，vlan10是市场部，vlan20是技术部，要求对vlan进行命名以便区分识别；pc10属于vlan10，pc11属于vlan20，其中vlan30，vlan40，vlan50，vlan60，vlan70，vlan80，vlan90，vlan100，vlan110，vlan120，vlan130，vlan140，vlan150用于交换机之间建立rip动态路由协议及互联vlan。
所有交换机相连的端口配置为trunk，允许相关流量通过。
交换机连接pc的端口配置为边缘端口。
将sw9选举为生成树的根网桥。
在sw9上配置dhcp服务，为vlan10和20的pc动态分配IP地址、网关和dns地址，要求vlan10的网关是192.168.1.254，vlan20的网关是192.168.2.254。
按照图示分区域配置ospf协议，环回口宣告进对应区域中。
按照图示区域配置rip协议，环回口宣告进对应区域中，业务网段不允许出现协议报文。
要求实现内网全网互通。
R1和R2之间通过双线连接到互联网配置ppp-mp，并配置双向chap验证。
配置easy ip只有业务网段192.168.1.0/24和192.168.2.0/24的数据流可以通过R2和R3访问互联网。
R12开启telent远程登录，使用自己名字缩写创建用户1，密码为名字缩写加上123456@com，只允许192.168.3.0/24登录访问。
R13开启ftp服务，使用自己名字缩写创建用户2，密码为名字缩写加上123456@com，只允许192.168.4.0/24登录访问。

实验步骤

1.Sw7和sw8之间的直连链路配置链路聚合

[SW7]int Bridge-Aggregation 1

[SW7]int range g1/0/3 to g1/0/5 
[SW7-if-range]port link-aggregation group 1

[SW8]int Bridge-Aggregation 1 

[SW8-if-range]int range g1/0/3 to g1/0/5 
[SW8-if-range]port link-aggregation group 1

2.按照图示配置IP地址

[R1]int MP-group 1 
[R1-MP-group1]ip add 202.100.1.1 24 

[R1]int s1/0 
[R1-Serial1/0]ppp mp MP-group 1 

[R1]int s2/0 
[R1-Serial2/0]ppp mp MP-group 1

[R1]int g0/0 
[R1-GigabitEthernet0/0]ip add 202.100.2.1 24 

[R1]int l0
[R1-LoopBack0]ip add 1.1.1.1 32

[R2]int MP-group 1 
[R2-MP-group1]ip add 202.100.1.1 24 

[R2]int s1/0
[R2-Serial1/0]ppp mp MP-group 1

[R2-Serial1/0]int s2/0
[R2-Serial2/0]ppp mp MP-group 1

[R2]int g0/0 
[R2-GigabitEthernet0/0]ip add 172.16.2.1 24 
[R2-GigabitEthernet0/0]int g0/1 
[R2-GigabitEthernet0/1]ip add 172.16.1.1 24 
[R2-GigabitEthernet0/1]int g0/2 
[R2-GigabitEthernet0/2]ip add 172.16.5.1 24 

[R2]int l0 
[R2-LoopBack0]ip add 2.2.2.2 32

[R3]int g5/0 
[R3-GigabitEthernet5/0]ip add 202.100.2.2 24 
[R3-GigabitEthernet5/0]int g0/0
[R3-GigabitEthernet0/0]ip add 172.16.2.2 24 
[R3-GigabitEthernet0/0]int g0/1
[R3-GigabitEthernet0/1]ip add 172.16.3.1 24 
[R3-GigabitEthernet0/1]int g0/2 
[R3-GigabitEthernet0/2]ip add 172.16.7.1 24 

[R3]int l0
[R3-LoopBack0]ip add 3.3.3.3 32

[R4]int g0/0 
[R4-GigabitEthernet0/0]ip add 172.16.1.2 24 
[R4-GigabitEthernet0/0]int g0/1 
[R4-GigabitEthernet0/1]ip add 172.16.4.1 24 
[R4-GigabitEthernet0/1]int g0/2 
[R4-GigabitEthernet0/2]ip add 10.1.3.1 24
[R4-GigabitEthernet0/2]int g5/0 
[R4-GigabitEthernet5/0]ip add 10.1.1.1 24 
[R4-GigabitEthernet5/0]int g5/1 
[R4-GigabitEthernet5/1]ip add 172.16.6.2 24 

[R4]int l0
[R4-LoopBack0]ip add 4.4.4.4 32

[R5]int g0/0 
[R5-GigabitEthernet0/0]ip add 172.16.4.2 24 
[R5-GigabitEthernet0/2]int g0/1 
[R5-GigabitEthernet0/1]ip add 172.16.3.2 24 
[R5-GigabitEthernet0/1]int g0/2 
[R5-GigabitEthernet0/2]ip add 10.1.4.1 24 
[R5-GigabitEthernet0/2]int g5/0 
[R5-GigabitEthernet5/0]ip add 10.1.2.1 24
[R5-GigabitEthernet5/0]int g5/1 
[R5-GigabitEthernet5/1]ip add 172.16.8.2 24

[R5]int l0 
[R5-LoopBack0]ip add 5.5.5.5 32

[R12]int g0/0 
[R12-GigabitEthernet0/0]ip add 172.15.5.2 24 
[R12-GigabitEthernet0/0]int g0/1 
[R12-GigabitEthernet0/1]ip add 172.16.6.1 24

[R12]int l0
[R12-LoopBack0]ip add 12.12.12.12 32

[R13]int g0/0  
[R13-GigabitEthernet0/0]ip add 172.16.7.2 24 
[R13-GigabitEthernet0/0]int g0/1 
[R13-GigabitEthernet0/1]ip add 172.16.8.1 24

[R13]int l0
[R13-LoopBack0]ip add 13.13.13.13 32

[SW6]vlan 100 
[SW6-vlan100]vlan 90 
[SW6-vlan150]vlan 50
[SW6-vlan50]vlan 60

[SW6-vlan90]int vlan 100
[SW6-Vlan-interface100]ip add 10.1.3.2 24 
[SW6-Vlan-interface100]int vlan 90 
[SW6-Vlan-interface90]ip add 10.1.4.2 24
[SW6-Vlan-interface150]int vlan 50
[SW6-Vlan-interface50]ip add 10.1.5.1 24 
[SW6-Vlan-interface50]int vlan 60
[SW6-Vlan-interface60]ip add 10.1.6.1 24 

[SW6]int g1/0/1
[SW6-GigabitEthernet1/0/1]port access vlan 100
[SW6-GigabitEthernet1/0/1]int g1/0/2 
[SW6-GigabitEthernet1/0/2]port access vlan 90


[SW6]int l0 
[SW6-LoopBack0]ip add 6.6.6.6 32

[SW7]vlan 50
[SW7-vlan50]vlan 30
[SW7-vlan30]vlan 70 
[SW7-vlan70]vlan 110

[SW7-vlan110]int vlan 50
[SW7-Vlan-interface50]ip add 10.1.5.2 24 
[SW7-Vlan-interface50]int vlan 30
[SW7-Vlan-interface30]ip add 192.168.3.1 24
[SW7-Vlan-interface30]int vlan 70
[SW7-Vlan-interface70]ip add 10.1.1.2 24 
[SW7-Vlan-interface70]int vlan 110 
[SW7-Vlan-interface110]ip add  192.168.5.1 24

[SW7]int g1/0/6 
[SW7-GigabitEthernet1/0/6]port access vlan 70

[SW7]int l0
[SW7-LoopBack0]ip add 7.7.7.7 32

[SW8]vlan 60
[SW8-vlan60]vlan 40
[SW8-vlan40]vlan 80
[SW8-vlan80]vlan 110
[SW8-vlan110]int vlan 60
[SW8-Vlan-interface60]ip add 10.1.6.2 24 
[SW8-Vlan-interface60]int vlan 40
[SW8-Vlan-interface40]ip add 192.168.5.1 24 
[SW8-Vlan-interface40]ip add 192.168.4.1 24 
[SW8-Vlan-interface40]int vlan 80
[SW8-Vlan-interface80]ip add 10.1.2.2 24 
[SW8-Vlan-interface80]int vlan 110
[SW8-Vlan-interface110]ip add 192.168.5.2 24 

[SW8]int g1/0/6 
[SW8-GigabitEthernet1/0/6]port access vlan 80

[SW8]int l0
[SW8-LoopBack0]ip add 8.8.8.8 32

[SW9]vlan 30
[SW9-vlan30]vlan 40
[SW9-vlan40]vlan 10
[SW9-vlan10]vlan 20
[SW9-vlan20]int vlan 30 
[SW9-Vlan-interface30]ip add 192.168.3.2 24 
[SW9-Vlan-interface30]int vlan 40
[SW9-Vlan-interface40]ip add 192.168.4.2 24 
[SW9-Vlan-interface40]int vlan 10 
[SW9-Vlan-interface10]ip add 192.168.1.254 24
[SW9-Vlan-interface10]int vlan 20 
[SW9-Vlan-interface20]ip add 192.168.2.254 24 

[SW9-GigabitEthernet1/0/2]int g1/0/3 
[SW9-GigabitEthernet1/0/3]port access vlan 10
[SW9-GigabitEthernet1/0/3]int g1/0/4 
[SW9-GigabitEthernet1/0/4]port access vlan 20 

[SW9]int l0
[SW9-LoopBack0]ip add 9.9.9.9 32

公司内部业务网段为vlan10和vlan20，vlan10是市场部，vlan20是技术部，要求对vlan进行命名以便区分识别；pc10属于vlan10，pc11属于vlan20，其中vlan30，vlan40，vlan50，vlan60，vlan70，vlan80，vlan90，vlan100，vlan110，vlan120，vlan130，vlan140，vlan150用于交换机之间建立rip动态路由协议及互联vlan。

[SW9-vlan10]name shichangbu
[SW9-vlan10]vlan 20 
[SW9-vlan20]name jishubu

4.所有交换机相连的端口配置为trunk，允许相关流量通过

[SW6]int g1/0/3 
[SW6-GigabitEthernet1/0/3]port link-type trunk
[SW6-GigabitEthernet1/0/3]port trunk permit vlan all
[SW6-GigabitEthernet1/0/3]port trunk pvid vlan 50

[SW6-GigabitEthernet1/0/3]int g1/0/4 
[SW6-GigabitEthernet1/0/4]port link-type trunk 
[SW6-GigabitEthernet1/0/4]port trunk permit vlan all 
[SW6-GigabitEthernet1/0/4]port trunk pvid vlan 60

[SW7]int g1/0/1
[SW7-GigabitEthernet1/0/1]port link-type trunk
[SW7-GigabitEthernet1/0/1]port trunk permit vlan all
[SW7-GigabitEthernet1/0/1]port trunk pvid vlan 50 
[SW7-GigabitEthernet1/0/1]int g1/0/2 
[SW7-GigabitEthernet1/0/2]port link-type trunk 
[SW7-GigabitEthernet1/0/2]port trunk permit vlan all
[SW7-GigabitEthernet1/0/2]port trunk pvid vlan 30
[SW7-GigabitEthernet1/0/2]int br 1
[SW7-Bridge-Aggregation1]port link-type trunk
Configuring GigabitEthernet1/0/3 done.
Configuring GigabitEthernet1/0/4 done.
Configuring GigabitEthernet1/0/5 done.
[SW7-Bridge-Aggregation1]port trunk permit vlan all
Configuring GigabitEthernet1/0/3 done.
Configuring GigabitEthernet1/0/4 done.
Configuring GigabitEthernet1/0/5 done.
[SW7-Bridge-Aggregation1]port trunk pvid vlan 110 
Configuring GigabitEthernet1/0/3 done.
Configuring GigabitEthernet1/0/4 done.
Configuring GigabitEthernet1/0/5 done.

[SW8]int g1/0/1 
[SW8-GigabitEthernet1/0/1]port link-type trunk 
[SW8-GigabitEthernet1/0/1]port trunk permit vlan all
[SW8-GigabitEthernet1/0/1]port trunk pvid vlan 60

[SW8]int g1/0/2 
[SW8-GigabitEthernet1/0/2]port link-type trunk 
[SW8-GigabitEthernet1/0/2]port trunk permit vlan all
[SW8-GigabitEthernet1/0/2]port trunk pvid vlan 40

[SW8]int Bridge-Aggregation 1
[SW8-Bridge-Aggregation1]port link-type trunk 
Configuring GigabitEthernet1/0/3 done.
Configuring GigabitEthernet1/0/4 done.
Configuring GigabitEthernet1/0/5 done.
[SW8-Bridge-Aggregation1]port trunk permit vlan all
Configuring GigabitEthernet1/0/3 done.
Configuring GigabitEthernet1/0/4 done.
Configuring GigabitEthernet1/0/5 done.
[SW8-Bridge-Aggregation1]port trunk pvid vlan 110

[SW9]int g1/0/1
[SW9-GigabitEthernet1/0/1]port link-type trunk 
[SW9-GigabitEthernet1/0/1]port trunk permit vlan all
[SW9-GigabitEthernet1/0/1]port trunk pvid vlan 30

[SW9-GigabitEthernet1/0/1]int g1/0/2 
[SW9-GigabitEthernet1/0/2]port link-type trunk 
[SW9-GigabitEthernet1/0/2]port trunk permit vlan all
[SW9-GigabitEthernet1/0/2]port trunk pvid vlan 40

5.交换机连接pc的端口配置为边缘端口

[SW9]int g1/0/3 
[SW9-GigabitEthernet1/0/3]stp edged-port 
[SW9-GigabitEthernet1/0/3]int g1/0/4 
[SW9-GigabitEthernet1/0/4]stp edged-port

6.将sw9选举为生成树的根网桥。

[SW9]stp priority 4096

7.在sw9上配置dhcp服务，为vlan10和20的pc动态分配IP地址、网关和dns地址，要求vlan10的网关是192.168.1.254，vlan20的网关是192.168.2.254

[SW9]dhcp enable
[SW9]dhcp server ip-pool 1
[SW9-dhcp-pool-1]network 192.168.1.0 24
[SW9-dhcp-pool-1]gateway-list 192.168.1.254 

[SW9]dhcp server ip-pool 2
[SW9-dhcp-pool-2]network 192.168.2.0 24 
[SW9-dhcp-pool-2]gateway-list 192.168.2.254

发现已获取到DHCP
在这里插入图片描述

8.按照图示分区域配置ospf协议，环回口宣告进对应区域中

[R2]ospf 1 router-id 2.2.2.2 
[R2-ospf-1]area 1
[R2-ospf-1-area-0.0.0.1]network 172.16.5.0 0.0.0.255
[R2-ospf-1-area-0.0.0.1]area 0
[R2-ospf-1-area-0.0.0.0]network 172.16.2.0 0.0.0.255
[R2-ospf-1-area-0.0.0.0]network 172.16.1.0 0.0.0.255
[R2-ospf-1-area-0.0.0.0]network 2.2.2.2 0.0.0.0

[R3]ospf 1 router-id 3.3.3.3
[R3-ospf-1]area 0
[R3-ospf-1-area-0.0.0.0]network 3.3.3.3 0.0.0.0
[R3-ospf-1-area-0.0.0.0]network 172.16.3.0 0.0.0.255
[R3-ospf-1-area-0.0.0.0]network 172.16.2.0 0.0.0.255 
[R3-ospf-1-area-0.0.0.0]area 2 
[R3-ospf-1-area-0.0.0.2]network 172.16.7.0 0.0.0.255

[R4]ospf 1 router-id 4.4.4.4 
[R4-ospf-1]area 0 
[R4-ospf-1-area-0.0.0.0]network 4.4.4.4 0.0.0.0
[R4-ospf-1-area-0.0.0.0]network 172.16.1.0 0.0.0.255 
[R4-ospf-1-area-0.0.0.0]network 172.16.4.0 0.0.0.255
[R4-ospf-1-area-0.0.0.0]area 1 
[R4-ospf-1-area-0.0.0.1]network 172.16.6.0 0.0.0.255
[R4-ospf-1]import-route rip 
[R4-ospf-1]import-route direct

[R5]ospf 1 router-id 5.5.5.5
[R5-ospf-1]area 0 
[R5-ospf-1-area-0.0.0.0]network 5.5.5.5 0.0.0.0
[R5-ospf-1-area-0.0.0.0]network 172.16.3.0 0.0.0.255
[R5-ospf-1-area-0.0.0.0]network 172.16.4.0 0.0.0.255
[R5-ospf-1-area-0.0.0.0]area 2 
[R5-ospf-1-area-0.0.0.2]network 172.16.8.0 0.0.0.255
[R5-ospf-1]import-route rip 
[R5-ospf-1]import-route direct

[R12]ospf 1 router-id 12.12.12.12 
[R12-ospf-1]area 1 
[R12-ospf-1-area-0.0.0.1]network 12.12.12.12 0.0.0.0
[R12-ospf-1-area-0.0.0.1]network 172.16.5.0 0.0.0.255
[R12-ospf-1-area-0.0.0.1]network 172.16.6.0 0.0.0.255

[R13]ospf 1 router-id 13.13.13.13
[R13-ospf-1]area 2 
[R13-ospf-1-area-0.0.0.2]network 13.13.13.13 0.0.0.0
[R13-ospf-1-area-0.0.0.2]network 172.16.7.0 0.0.0.255
[R13-ospf-1-area-0.0.0.2]network 172.16.8.0 0.0.0.255

9.按照图示区域配置rip协议，环回口宣告进对应区域中，业务网段不允许出现协议报文。

[R4]rip 1
[R4-rip-1]version 2
[R4-rip-1]undo summary 
[R4-rip-1]network 10.0.0.0
[R4-rip-1]import-route ospf 1
[R4-rip-1]import-route direct

[R5]rip 1
[R5-rip-1]version 2
[R5-rip-1]undo summary 
[R5-rip-1]network 10.0.0.0
[R5-rip-1]import-route ospf 1
[R5-rip-1]import-route direct

[SW6]rip 1 
[SW6-rip-1]version 2
[SW6-rip-1]undo summary 
[SW6-rip-1]network 10.0.0.0
[SW6-rip-1]network 6.6.6.6

[SW7]rip 1
[SW7-rip-1]version 2
[SW7-rip-1]undo summary 
[SW7-rip-1]network 10.0.0.0
[SW7-rip-1]network 192.168.5.0 
[SW7-rip-1]network 192.168.3.0
[SW7-rip-1]network 7.7.7.7

[SW8]rip 1
[SW8-rip-1]version 2
[SW8-rip-1]undo summary 
[SW8-rip-1]network 192.168.5.0
[SW8-rip-1]network 10.0.0.0
[SW8-rip-1]network 192.168.4.0 
[SW8-rip-1]network 8.8.8.8

[SW9]rip 1
[SW9-rip-1]version 2
[SW9-rip-1]undo summary 
[SW9-rip-1]network 192.168.3.0 
[SW9-rip-1]network 192.168.4.0 
[SW9-rip-1]network 192.168.1.0
[SW9-rip-1]network 192.168.2.0
[SW9-rip-1]network 9.9.9.9
[Sw9-rip-1]silent-interface Van-interface 10
[Sw9-rip-1]silent-interface Van-interface 20

要求实现内网全网互通

<H3C>pc 10
     ^
 % Unrecognized command found at '^' position.
<H3C>ping 202.100.1.1
Ping 202.100.1.1 (202.100.1.1): 56 data bytes, press CTRL_C to break
56 bytes from 202.100.1.1: icmp_seq=0 ttl=251 time=1.930 ms
56 bytes from 202.100.1.1: icmp_seq=1 ttl=251 time=2.014 ms
56 bytes from 202.100.1.1: icmp_seq=2 ttl=251 time=2.374 ms
56 bytes from 202.100.1.1: icmp_seq=3 ttl=251 time=1.932 ms
56 bytes from 202.100.1.1: icmp_seq=4 ttl=251 time=2.422 ms

--- Ping statistics for 202.100.1.1 ---
5 packet(s) transmitted, 5 packet(s) received, 0.0% packet loss
round-trip min/avg/max/std-dev = 1.930/2.134/2.422/0.218 ms
<H3C>%Sep 27 21:31:24:307 2024 H3C PING/6/PING_STATISTICS: Ping statistics for 202.100.1.1: 5 packet(s) transmitted, 5 packet(s) received, 0.0% packet loss, round-trip min/avg/max/std-dev = 1.930/2.134/2.422/0.218 ms.

[R1]ping 192.168.2.1
Ping 192.168.2.1 (192.168.2.1): 56 data bytes, press CTRL+C to break
56 bytes from 192.168.2.1: icmp_seq=0 ttl=250 time=2.141 ms
56 bytes from 192.168.2.1: icmp_seq=1 ttl=250 time=3.206 ms
56 bytes from 192.168.2.1: icmp_seq=2 ttl=250 time=1.833 ms
56 bytes from 192.168.2.1: icmp_seq=3 ttl=250 time=1.658 ms
56 bytes from 192.168.2.1: icmp_seq=4 ttl=250 time=2.183 ms

--- Ping statistics for 192.168.2.1 ---
5 packet(s) transmitted, 5 packet(s) received, 0.0% packet loss
round-trip min/avg/max/std-dev = 1.658/2.204/3.206/0.537 ms
[R1]%Sep 27 21:30:57:347 2024 R1 PING/6/PING_STATISTICS: Ping statistics for 192.168.2.1: 5 packet(s) transmitted, 5 packet(s) received, 0.0% packet loss, round-trip min/avg/max/std-dev = 1.658/2.204/3.206/0.537 ms.

[R1]ping 192.168.1.1
Ping 192.168.1.1 (192.168.1.1): 56 data bytes, press CTRL+C to break
56 bytes from 192.168.1.1: icmp_seq=0 ttl=250 time=2.462 ms
56 bytes from 192.168.1.1: icmp_seq=1 ttl=250 time=1.256 ms
56 bytes from 192.168.1.1: icmp_seq=2 ttl=250 time=1.747 ms
56 bytes from 192.168.1.1: icmp_seq=3 ttl=250 time=1.782 ms
56 bytes from 192.168.1.1: icmp_seq=4 ttl=250 time=2.304 ms

--- Ping statistics for 192.168.1.1 ---
5 packet(s) transmitted, 5 packet(s) received, 0.0% packet loss
round-trip min/avg/max/std-dev = 1.256/1.910/2.462/0.431 ms
[R1]%Sep 27 21:32:04:125 2024 R1 PING/6/PING_STATISTICS: Ping statistics for 192.168.1.1: 5 packet(s) transmitted, 5 packet(s) received, 0.0% packet loss, round-trip min/avg/max/std-dev = 1.256/1.910/2.462/0.431 ms.

R1和R2之间通过双线连接到互联网配置ppp-mp，并配置双向chap验证。

[R1]local-user lfx  class network 
New local user added.
[R1-luser-network-lfx]password simple 123
[R1-luser-network-lfx]service-type ppp

[R1]int s1/0
[R1-Serial1/0]ppp authentication-mode chap
[R1-Serial1/0]ppp chap user lfx 
[R1-Serial1/0]int s2/0
[R1-Serial2/0]ppp authentication-mode chap
[R1-Serial2/0]ppp chap user lfx

[R2]local-user lfx class network 
New local user added.
[R2-luser-network-lfx]password simple 123 
[R2-luser-network-lfx]service-type ppp

[R2]int s1/0
[R2-Serial1/0]ppp authentication-mode chap 
[R2-Serial1/0]ppp chap user lfx
[R2-Serial1/0]int s2/0
[R2-Serial2/0]ppp authentication-mode chap 
[R2-Serial2/0]ppp chap user lfx

配置easy ip只有业务网段192.168.1.0/24和192.168.2.0/24的数据流可以通过R2和R3访问互联网。

[R1]ip route-static 0.0.0.0 0 202.100.2.2
[R1]ip route-static 0.0.0.0 0 202.100.1.2
[R2]ospf
[R2-ospf-1]area 0 
[R2-ospf-1-area-0.0.0.0] network 202.100.1.0 0.0.0.255
[R3]ospf
[R3-ospf-1]area 0 
[R3-ospf-1-area-0.0.0.0] network 202.100.2.0 0.0.0.255

[R2]acl basic 2000
[R2-acl-ipv4-basic-2000]rule permit source 192.168.1.0 0.0.0.255
[R2-acl-ipv4-basic-2000]rule permit source 192.168.2.0 0.0.0.255
[R2-acl-ipv4-basic-2000]int MP-group 1
[R2-MP-group1]nat outbound 2000

[R3]acl basic 2000
[R3-acl-ipv4-basic-2000]rule permit source 192.168.1.0 0.0.0.255
[R3-acl-ipv4-basic-2000]rule permit source 192.168.2.0 0.0.0.255
[R3]int g5/0 
[R3-GigabitEthernet5/0]nat outbound 2000

R12开启telent远程登录，使用自己名字缩写创建用户1，密码为123456@com，不允许 192.168.3.0/24登录访问。

[R12]telnet server enable 

[R12]local-user lfx class manage 
New local user added.
[R12-luser-manage-lfx]password simple 123456@com 
[R12-luser-manage-lfx]service-type telnet 
[R12-luser-manage-lfx]authorization-attribute user-role level-15 

[R12]line vty 0 4
[R12-line-vty0-4]authentication-mode scheme 

[R12]acl basic 2000 
[R12-acl-ipv4-basic-2000]rule deny source 192.168.3.0 0.0.0.255

[R12]int range g0/0 to g0/1 
[R12-if-range]packet-filter 2000 inbound

PC10：
<H3C>telnet 12.12.12.12
Trying 12.12.12.12 ...s
Press CTRL+K to abort
Connected to 12.12.12.12 ...

******************************************************************************
* Copyright (c) 2004-2021 New H3C Technologies Co., Ltd. All rights reserved.*
* Without the owner's prior written consent,                                 *
* no decompiling or reverse-engineering shall be allowed.                    *
******************************************************************************

Login: lfx
Password: 
<R12>

带上源地址192.168.4.9 会发现拒绝服务，同理ftp也一样
<sw9>telnet 12.12.12.12 source ip 192.168.4.9
Trying 12.12.12.12 ...
Press CTRL+K to abort
Connected to 12.12.12.12 ...

R13开启ftp服务，使用自己名字缩写创建用户2，密码为123456@com，不允许192.168.4.0/24登录访问

[R13]local-user lfx class manage 
New local user added.
[R13-luser-manage-lfx]password simple 123456@com
[R13-luser-manage-lfx]authorization-attribute user-role level-15
[R13-luser-manage-lfx]service-type ftp 

[R13]line vty 0 4 
[R13-line-vty0-4]authentication-mode scheme 

[R13]acl  basic 2000 
[R13-acl-ipv4-basic-2000]rule deny source 192.168.4.0 0.0.0.255

[R13]int range g0/0 to g0/1 
[R13-if-range]packet-filter 2000 inbound

<SW9>ftp 13.13.13.13
Press CTRL+C to abort.
Connected to 13.13.13.13 (13.13.13.13).
220 FTP service ready.
User (13.13.13.13:(none)): lfx
331 Password required for lfx.
Password: 
230 User logged in.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp>

el-15
[R13-luser-manage-lfx]service-type ftp

[R13]line vty 0 4 
[R13-line-vty0-4]authentication-mode scheme 

[R13]acl  basic 2000 
[R13-acl-ipv4-basic-2000]rule deny source 192.168.4.0 0.0.0.255

[R13]int range g0/0 to g0/1 
[R13-if-range]packet-filter 2000 inbound 
```

```
<SW9>ftp 13.13.13.13
Press CTRL+C to abort.
Connected to 13.13.13.13 (13.13.13.13).
220 FTP service ready.
User (13.13.13.13:(none)): lfx
331 Password required for lfx.
Password: 
230 User logged in.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> 
```