中小园区网配置案例超详细

最新推荐文章于 2024-06-06 23:32:37 发布

小马小马嘚嘚驾

最新推荐文章于 2024-06-06 23:32:37 发布

阅读量4.4k

点赞数 10

文章标签：网络协议网络安全

本文链接：https://blog.csdn.net/weixin_60508121/article/details/124120555

版权

园区网综合实验
实验组网：
在这里插入图片描述

访客 VLAN 10 192.168.10.0/24
市场 VLAN 20 192.168.20.0/24
行政 VLAN 30 192.168.30.0/24
研发 VLAN 40 192.168.40.0/24

配置步骤：

先配置二层
配置VLAN
SW1配置下接口类型，放行VLAN，上接口类型
[sw1]int g 0/0/1
[sw1-GigabitEthernet0/0/1]port link-type access
[sw1-GigabitEthernet0/0/1]port default vlan 10
[sw1-GigabitEthernet0/0/1]int g0/0/2
[sw1-GigabitEthernet0/0/2]port link-
[sw1-GigabitEthernet0/0/2]port link-flap
[sw1-GigabitEthernet0/0/2]port link-type trunk
[sw1-GigabitEthernet0/0/2]port trunk a
[sw1-GigabitEthernet0/0/2]port trunk allow-pass vlan 10
[sw1-GigabitEthernet0/0/3]port link-type trunk
[sw1-GigabitEthernet0/0/3] port trunk allow-pass vlan 10

交换机2、3、4同上
SW5和SW6上配置链路聚合
[sw5]vlan batch 10 20 30 40
Info: This operation may take a few seconds. Please wait for a moment…done.
[sw5]int Eth-Trunk 1
[sw5-Eth-Trunk1]mode lacp
[sw5-Eth-Trunk1]mode lacp-static
[sw5-Eth-Trunk1]trunkport g 0/0/7
Info: This operation may take a few seconds. Please wait for a moment…done.
[sw5-Eth-Trunk1]trunkport g 0/0/6
[sw6]vlan batch 10 20 30 40
[sw6]int Eth-Trunk 1
[sw6-Eth-Trunk1]mode lacp-static
[sw6-Eth-Trunk1]trunkport g 0/0/7
[sw6-Eth-Trunk1]trunkport g 0/0/6
Info: This operation may take a few seconds. Please wait for a moment…done.
配置SW5和SW6各接口类型，和放行VLAN ，以交换机SW5为例
[sw5]int g 0/0/1
[sw5-GigabitEthernet0/0/1]port link-type trunk
[sw5-GigabitEthernet0/0/1]port trunk allow-pass vlan 10
[sw5-GigabitEthernet0/0/1]int g0/0/2
[sw5-GigabitEthernet0/0/2]port link-type trunk
[sw5-GigabitEthernet0/0/2]port trunk allow-pass vlan 20
[sw5-GigabitEthernet0/0/2]int g0/0/3
[sw5-GigabitEthernet0/0/3]port link-type trunk
[sw5-GigabitEthernet0/0/3]port trunk allow-pass vlan 30
[sw5-GigabitEthernet0/0/3]int g 0/0/4
[sw5-GigabitEthernet0/0/4]port link-type trunk
[sw5-GigabitEthernet0/0/4]port trunk allow-pass vlan 40
[sw5-GigabitEthernet0/0/4]int e 1
[sw5-Eth-Trunk1]port link-type trunk
[sw5-Eth-Trunk1]port trunk allow-pass vlan 10 20 30 40
2. 配置生成树
在交换机1至7上配置生成树
stp region-configuration
region-name simp
instance 1 vlan 10
instance 2 vlan 20
instance 3 vlan 30
instance 4 vlan 40
active region-configuration
SW5设置成实例1和实例2的主根桥，3,4的备份根桥
stp instance 1 root primary
stp instance 2 root primary
stp instance 3 root secondary
stp instance 4 root secondary
SW6设置为实例1,2的备份根桥，
stp instance 1 root secondary
stp instance 2 root secondary
stp instance 3 root primary
stp instance 4 root primary
3. 配置DHCP
在SW7、5、6上配置VLAN
[sw7]vlan batch 150
Enter system view, return user view with Ctrl+Z.
[sw7]int g 0/0/1
[sw7-GigabitEthernet0/0/1]port link-type access
[sw7-GigabitEthernet0/0/1]port default vlan 150
[sw7-GigabitEthernet0/0/1]int g 0/0/2
[sw7-GigabitEthernet0/0/2]port link-type trunk
[
[sw7-GigabitEthernet0/0/2]port trunk allow-pass vlan 150
[sw7-GigabitEthernet0/0/2]int g 0/0/3
[sw7-GigabitEthernet0/0/3]port link-type trunk
[sw7-GigabitEthernet0/0/3]port trunk allow-pass vlan 150
SW5：
[sw5-GigabitEthernet0/0/9]int e 1
[sw5-Eth-Trunk1]port tr
[sw5-Eth-Trunk1]port trunk a
[sw5-Eth-Trunk1]port trunk allow-pass vlan 150
[sw5]int g 0/0/9
[sw5-GigabitEthernet0/0/9]port link-type trunk
[sw5-GigabitEthernet0/0/9]port trunk allow-pass vlan 150

SW6：
[sw6]int e 1
[sw6-Eth-Trunk1]port tr
[sw6-Eth-Trunk1]port trunk a
[sw6-Eth-Trunk1]port trunk allow-pass vlan 150
[sw6]int g 0/0/9
[sw6-GigabitEthernet0/0/9]port link-type trunk
[sw6-GigabitEthernet0/0/9]port trunk allow-pass vlan 150

在SW7上配置生成树
stp region-configuration
region-name simp
instance 1 vlan 10
instance 2 vlan 20
instance 3 vlan 30
instance 4 vlan 40
active region-configuration
SW5设为主根
[sw5]stp instance 0 root primary
SW6为备份根
stp instance 0 root secondary
4. 配置网关
SW5：
5. [sw5]int vlan 10
6. [sw5-Vlanif10]ip add 192.168.10.1 24
7. [sw5-Vlanif10]int vlan 20
8. [sw5-Vlanif20]ip add 192.168.20.1 24
9. [sw5-Vlanif20]int vlan 30
10. [sw5-Vlanif30]ip add 192.168.30.1
11. ^
12. Error:Incomplete command found at ‘^’ position.
13. [sw5-Vlanif30]ip add 192.168.30.1 24
14. [sw5-Vlanif30]int vlan 40
15. [sw5-Vlanif40]ip add 192.168.40.1 24
16. [sw5-Vlanif40]int vlan 150
17. [sw5-Vlanif150]ip add 192.168.150.1 24
SW6：
[sw6]int vlan 10
[sw6-Vlanif10]ip add 192.168.10.2 24
[sw6-Vlanif10]int vlan 20
[sw6-Vlanif20]ip add 192.168.20.2 24
[sw6-Vlanif20]int vlan 30
[sw6-Vlanif30]ip add 192.168.30.2 24
[sw6-Vlanif30]int vlan 40
[sw6-Vlanif40]ip add 192.168.40.2 24
[sw6-Vlanif40]int vlan 150
[sw6-Vlanif150]ip add 192.168.150.2 24
5.配置VRRP
SW5作为VLAN 10、20、150的主网关，30、40的备用，以交换机5为例
[sw5]int vlan 10
[sw5-Vlanif10]vrrp v
[sw5-Vlanif10]vrrp vrid 10 v
[sw5-Vlanif10]vrrp vrid 10 virtual-ip 192.168.10.254
[sw5-Vlanif10]vrrp v
[sw5-Vlanif10]vrrp vrid 10 priority 120
[sw5-Vlanif10]int vlan 20
[sw5-Vlanif20]vrrp vrid 20 virtual-ip 192.168.20.254
[sw5-Vlanif20]vrrp vrid 20 priority 120
[sw5-Vlanif20]int vlan 150
[sw5-Vlanif150]vrrp vrid 150 virtual-ip 192.168.150.254
[sw5-Vlanif150]vrrp vrid 150 priority 120
[sw5-Vlanif150]int vlan 30
[sw5-Vlanif30]vrrp vrid 30 virtual-ip 192.168.30.254
[sw5-Vlanif30]int vlan 40
[sw5-Vlanif40]vrrp vrid 40 virtual-ip 192.168.40.254

在R5上配置DHCP地址池，以VLAN 10 为例
[Huawei]sy rr5
rr5]ip route-static 0.0.0.0 0.0.0.0 192.168.150.254
[rr5]int g 0/0/0
[rr5-GigabitEthernet0/0/0]ip add 192.168.150.5 24
Mar 15 2022 17:37:39-08:00 rr5 %%01IFNET/4/LINK_STATE(l)[0]:The line protocol IP
on the interface GigabitEthernet0/0/0 has entered the UP state.
[rr5-GigabitEthernet0/0/0]q
[rr5]ip pool vlan10
Info: It’s successful to create an IP address pool.
[rr5-ip-pool-vlan10]network 192.168.10.0 mask 24
[rr5-ip-pool-vlan10]gateway-list 192.168.10.254
[rr5-ip-pool-vlan10]dns-list 8.8.8.8
[rr5-ip-pool-vlan10]excluded-ip-address 192.168.10.1
[rr5-ip-pool-vlan10]excluded-ip-address 192.168.10.2
在接口开启DHCP
[rr5]dhcp enable
Info: The operation may take a few seconds. Please wait for a moment.done.
[rr5]int g 0/0/0
[rr5-GigabitEthernet0/0/0]dhcp s
[rr5-GigabitEthernet0/0/0]dhcp select g
[rr5-GigabitEthernet0/0/0]dhcp select global
在SW5和SW6上开启DHCP中继功能
sw5>sy
Enter system view, return user view with Ctrl+Z.
[sw5]dhcp e
Info: The operation may take a few seconds. Please wait for a moment.done.
[sw5]int vlan 10
[sw5-Vlanif10]dhcp select relay
[sw5-Vlanif10]dhcp relay server-ip 192.168.150.5

[sw5-Vlanif10]int vlan 20
[sw5-Vlanif20]dhcp select relay
[sw5-Vlanif20] dhcp relay server-ip 192.168.150.5
[sw5-Vlanif20]
[sw5-Vlanif20]
[sw5-Vlanif20]int vlan 30
[sw5-Vlanif30]dhcp select relay
[sw5-Vlanif30] dhcp relay server-ip 192.168.150.5
[sw5-Vlanif30]int vlan 40
[sw5-Vlanif40]dhcp select relay
[sw5-Vlanif40] dhcp relay server-ip 192.168.150.5
交换机6同上

6.配置汇聚层往上互联VLAN及IP地址
SW5
[sw5]vlan batch 100 to 103
Info: This operation may take a few seconds. Please wait for a moment…done.
[sw5]int g 0/0/5
[sw5-GigabitEthernet0/0/5]port link-type access
[sw5-GigabitEthernet0/0/5]port d
[sw5-GigabitEthernet0/0/5]port discard
[sw5-GigabitEthernet0/0/5]port default vlan 100
[sw5-GigabitEthernet0/0/5]int g 0/0/8
[sw5-GigabitEthernet0/0/8]port link-type access
[sw5-GigabitEthernet0/0/8]port default vlan 101
[sw5-GigabitEthernet0/0/8]int vlan 100
[sw5-Vlanif100]ip add 192.168.100.5 24
[sw5-Vlanif100]int vlan 101
[sw5-Vlanif101]ip add 192.168.101.5 24
SW6
sw6]vlan batch 100 to 103
Info: This operation may take a few seconds. Please wait for a moment…done.
[sw6]int g0/0/5
[sw6-GigabitEthernet0/0/5]port link-type a
[sw6-GigabitEthernet0/0/5]port link-type access
[sw6-GigabitEthernet0/0/5]port default vlan 103
[sw6-GigabitEthernet0/0/5]int g 0/0/8
[sw6-GigabitEthernet0/0/8]port link-type access
[sw6-GigabitEthernet0/0/8]port default vlan 102
[sw6-GigabitEthernet0/0/8]int vlan 102
[sw6-Vlanif102]ip add 192.168.102.6 24
[sw6-Vlanif102]int vlan 103
[sw6-Vlanif103]ip add 192.168.103.6 24
R1上
[r1]int g0/0/0
[r1-GigabitEthernet0/0/0]ip add 192.168.100.1 24
[r1]int g 0/0/2
[r1-GigabitEthernet0/0/2]ip add 192.168.102.1 24
[r1]int g 0/0/1
[r1-GigabitEthernet0/0/1]ip add 192.168.13.2 24

R2上
[r2]int g 0/0/2
[r2-GigabitEthernet0/0/2]ip add 192.168.101.1 24
[r2-GigabitEthernet0/0/2]int g 0/0/0
[r2-GigabitEthernet0/0/0]ip add 192.168.103.1 24
[r2]int g 0/0/1
[r2-GigabitEthernet0/0/1]ip add 192.168.23.2 24
[r2-GigabitEthernet0/0/1]
R3
[R3]int g 0/0/0
[R3-GigabitEthernet0/0/0]ip add 192.168.13.3 24
[R3-GigabitEthernet0/0/0]int g 0/0/1
[R3-GigabitEthernet0/0/1]ip add 192.168.23.3 24

7.配置OSPF
R3上
[R3]int LoopBack 0
[R3-LoopBack0]ip add 3.3.3.3 24
[R3-LoopBack0]q
[R3]ospf r
[R3]ospf router-id 3.3.3.3
[R3-ospf-1]area 0
[R3-ospf-1-area-0.0.0.0]net
[R3-ospf-1-area-0.0.0.0]network 192.168.0.0 0.0.255.255
R2上
[r2]int LoopBack 0
[r2-LoopBack0]ip add 2.2.2.2 24
[r2-LoopBack0]q
[r2]ospf 1 r
[r2]ospf 1 router-id 2.2.2.2
[r2-ospf-1]area 0
[r2-ospf-1-area-0.0.0.0]net
[r2-ospf-1-area-0.0.0.0]network 192.168.0.0 0.0.255.255
R1上
[r1]int LoopBack 0
[r1-LoopBack0]ip add 1.1.1.1 24
[r1-LoopBack0]q
[r1]ospf 1 r
[r1]ospf 1 router-id 1.1.1.1
[r1-ospf-1]area 0
[r1-ospf-1-area-0.0.0.0]net
[r1-ospf-1-area-0.0.0.0]network 192.168.0.0 0.0.255.255
SW5上
[sw5-LoopBack0]ip add 5.5.5.5 24
[sw5-LoopBack0]q
[sw5]ospf 1
[sw5-ospf-1]q
[sw5]ospf 1 r
[sw5]ospf 1 router-id 5.5.5.5
Info: The configuration succeeded. You need to restart the OSPF process to valid
ate the new router ID.
[sw5-ospf-1]area 0
[sw5-ospf-1-area-0.0.0.0]net 192.168.100.0 0.0.0.255
[sw5-ospf-1-area-0.0.0.0]net
[sw5-ospf-1-area-0.0.0.0]network 192.168.101.0 0.0.0.255
[sw5-ospf-1-area-0.0.0.0]
[sw5-ospf-1-area-0.0.0.0]area 10
[sw5-ospf-1-area-0.0.0.10]net
[sw5-ospf-1-area-0.0.0.10]network 192.168.10.0 0.0.0.255
[sw5-ospf-1-area-0.0.0.10]area 20
[sw5-ospf-1-area-0.0.0.20]net
[sw5-ospf-1-area-0.0.0.20]network 192.168.20.0 0.0.0.255
[sw5-ospf-1-area-0.0.0.20]area 30
[sw5-ospf-1-area-0.0.0.30]net
[sw5-ospf-1-area-0.0.0.30]network 192.168.30.0 0.0.0.255
[sw5-ospf-1-area-0.0.0.30]net
[sw5-ospf-1-area-0.0.0.30]area 40
[sw5-ospf-1-area-0.0.0.40]net
[sw5-ospf-1-area-0.0.0.40]network 192.168.40.0 0.0.0.255
SW6上
[sw6]int LoopBack 0
[sw6-LoopBack0]ip add 6.6.6.6 24
[sw6-LoopBack0]q
[sw6]ospf 1 r
[sw6]ospf 1 router-id 6.6.6.6
[sw6-ospf-1]area 0
[sw6-ospf-1-area-0.0.0.0]net
[sw6-ospf-1-area-0.0.0.0]network 192.168.102.0 0.0.0.255
[sw6-ospf-1-area-0.0.0.0]net
[sw6-ospf-1-area-0.0.0.0]network 192.168.103.0 0.0.0.255
[sw6-ospf-1-area-0.0.0.0]area 10
[sw6-ospf-1-area-0.0.0.10]net
[sw6-ospf-1-area-0.0.0.10]network 192.168.10.0 0.0.0.255
[sw6-ospf-1-area-0.0.0.10]area 20
[sw6-ospf-1-area-0.0.0.20]net
[sw6-ospf-1-area-0.0.0.20]network 192.168.20.0 0.0.0.255
[sw6-ospf-1-area-0.0.0.20]area 30
[sw6-ospf-1-area-0.0.0.30]net
[sw6-ospf-1-area-0.0.0.30]network 192.168.30.0 0.0.0.255
[sw6-ospf-1-area-0.0.0.30]area 40
[sw6-ospf-1-area-0.0.0.40]net
为控制流量的路径，可以在交换机6上修改VLAN10和20的OSPF开销值
[sw6]int vlan 10
[sw6-Vlanif10]ospf cost 10
[sw6-Vlanif10]int vlan 20
[sw6-Vlanif20]osfp cost 10
SW5同理
[sw5]int vlan 30
[sw5-Vlanif30]ospf cost 10
[sw5-Vlanif30]int vlan 40
[sw5-Vlanif40]ospf cost 10
[sw5-Vlanif40]
在R3上下发一条默认路由，
[R3]ospf
[R3-ospf-1]default-route-advertise always

7.配置出口路由器到公网，NAT
在R3上配置路由，及默认路由
[Huawei]int g 0/0/2
[Huawei-GigabitEthernet0/0/2]ip add 10.1.4.1 24
Huawei-GigabitEthernet0/0/2]int g 4/0/0
[Huawei-GigabitEthernet4/0/0]ip add 10.1.5.1 24
[Huawei]ip route-static 0.0.0.0 0.0.0.0 10.1.4.2
[Huawei]ip route-static 0.0.0.0 0.0.0.0 10.1.5.2 preference
在R4上
[r4]int g 0/0/0
[r4-GigabitEthernet0/0/0]ip add 10.1.4.2 24
[r4-GigabitEthernet0/0/0]int g 0/0/1
[r4-GigabitEthernet0/0/1]ip add 10.1.3.254 24
r4-GigabitEthernet0/0/2]ip add 10.1.5.2 24
服务器上

在R3上配置ACL及NAT
[Huawei]acl 2000
[Huawei-acl-basic-2000]rule
[Huawei-acl-basic-2000]rule p
[Huawei-acl-basic-2000]rule permit s
[Huawei-acl-basic-2000]rule permit source 192.168.10.0 0.0.0.255
[Huawei-acl-basic-2000]q
[Huawei]int g 0/0/2
[Huawei-GigabitEthernet0/0/2]nat ou
[Huawei-GigabitEthernet0/0/2]nat outbound 2000
[Huawei-GigabitEthernet0/0/2]
[Huawei-GigabitEthernet0/0/2]
[Huawei-GigabitEthernet0/0/2]int g 4/0/0
[Huawei-GigabitEthernet4/0/0]nat o
[Huawei-GigabitEthernet4/0/0]nat outbound 2000
此时仅能访客访问服务器
8. VRRP与BFD联动以交换机5为例
在SW5上
[sw5]bfd
[sw5-bfd]q
[sw5]bfd tor3 bind peer-ip 3.3.3.3 source-ip 5.5.5.5
[sw5-bfd-session-tor3]discriminator local 10
[sw5-bfd-session-tor3]discriminator remote 20
[sw5-bfd-session-tor3]commit
[sw5-bfd-session-tor3]q
interface LoopBack0
ip address 5.5.5.5 255.255.255.0
ospf enable 1 area 0.0.0.0
在R3上
interface LoopBack0
ip address 3.3.3.3 255.255.255.0
ospf enable 1 area 0.0.0.0

[r3]bfd
[r3-bfd]q
[r3]bfd tosw5 bind p
[r3]bfd tosw5 bind peer-ip 5.5.5.5 s
[r3]bfd tosw5 bind peer-ip 5.5.5.5 source-ip 3.3.3.3
[r3-bfd-session-tosw5]d
[r3-bfd-session-tosw5]description
[r3-bfd-session-tosw5]detect-multiplier
[r3-bfd-session-tosw5]dialer
[r3-bfd-session-tosw5]discriminator l
[r3-bfd-session-tosw5]discriminator local 20
[r3-bfd-session-tosw5]d
[r3-bfd-session-tosw5]description
[r3-bfd-session-tosw5]detect-multiplier
[r3-bfd-session-tosw5]dialer
[r3-bfd-session-tosw5]discriminator r
[r3-bfd-session-tosw5]discriminator remote 10
[r3-bfd-session-tosw5]com
[r3-bfd-session-tosw5]commit
此时
[r3]dis bfd session a

Local Remote PeerIpAddr State Type InterfaceName

20 10 5.5.5.5 Up S_IP_PEER -

 Total UP/DOWN Session Number : 1/0

配置联动
[sw5]int vlan 10
[sw5-Vlanif10]vrrp vrid 10 track bfd-session 10 reduced 30
[sw5-Vlanif10]int vlan20
[sw5-Vlanif20]vrrp vrid 20 track bfd-session 10 reduced 30
[sw5-Vlanif20]
交换机6同理
9.安全
对交换机5和6开启根保护
[sw5]port-group 1
[sw5-port-group-1]group-member g 0/0/9
[sw5-port-group-1]group-member g 0/0/1 to g 0/0/5
[sw5-port-group-1]dis this

port-group 1
group-member GigabitEthernet0/0/9
group-member GigabitEthernet0/0/1
group-member GigabitEthernet0/0/2
group-member GigabitEthernet0/0/3
group-member GigabitEthernet0/0/4
group-member GigabitEthernet0/0/5

return
[sw5-port-group-1]stp r
[sw5-port-group-1]stp root-protection
[sw5-GigabitEthernet0/0/9]stp root-protection
[sw5-GigabitEthernet0/0/1]stp root-protection
[sw5-GigabitEthernet0/0/2]stp root-protection
[sw5-GigabitEthernet0/0/3]stp root-protection
[sw5-GigabitEthernet0/0/4]stp root-protection
[sw5-GigabitEthernet0/0/5]stp root-protection
交换机6同理
所有边缘端口开启BPDU保护，以交换机1为例
[sw1]int g 0/0/1
[sw1-GigabitEthernet0/0/1]stp ed
[sw1-GigabitEthernet0/0/1]stp edged-port e
[sw1-GigabitEthernet0/0/1]stp edged-port enable
[sw1-GigabitEthernet0/0/1]q
[sw1]stp b
[sw1]stp bpdu-filter
[sw1]stp bpdu-protection
配置ACL,访客只能访问服务器，不允许其他部门，市场比和行政部可以互访，研发部门独立
在交换机5上
[sw5-acl-adv-3000]dis this

acl number 3000
rule 1 permit ospf
rule 5 deny ip source 192.168.10.0 0.0.0.255
rule 10 deny ip destination 192.168.40.0 0.0.0.255

[sw5]traffic-filter vlan 20 outbound acl 3000
[sw5]traffic-filter vlan 30 outbound acl 3000
[sw5]traffic-filter vlan 40 outbound acl 3000
交换机6上
[sw6-acl-adv-3000] rule 1 permit ospf
[sw6-acl-adv-3000] rule 5 deny ip source 192.168.10.0 0.0.0.255
[sw6-acl-adv-3000] rule 10 deny ip destination 192.168.40.0 0.0.0.255
[sw6]traffic-filter vlan 10 outbound acl 3000
[sw6]traffic-filter vlan 20 outbound acl 3000
[sw6]traffic-filter vlan 30 outbound acl 3000