HCIA综合实验-CSDN博客

本文链接：https://blog.csdn.net/weixin_74260687/article/details/131255216

实验内容：

1.配置交换机，划分VLAN

建立vlan分区 [SW1]vlan 2

划分access [SW1-GigabitEthernet0/0/2]port link-type access
[SW1-GigabitEthernet0/0/2]port default vlan 2

        划分trunk [SW1]interface GigabitEthernet 0/0/1
                        [SW1-GigabitEthernet0/0/1]port link-type trunk
                        [SW1-GigabitEthernet0/0/1]port trunk allow-pass vlan 2 3 4

[SW1]display vlan

[SW2]dis vlan

2.配置路由器，配IP

路由器R1下g0/0/0下有连接三个广播域,用子接口方式连接

子接口 [R1]interface GigabitEthernet 0/0/0.1
配IP [R1-GigabitEthernet0/0/0.1]ip address 192.168.1.65 28

标签 dq [R1-GigabitEthernet0/0/0.1]dot1q termination vid 2

开启广播 [R1-GigabitEthernet0/0/0.1]arp broadcast enable
最后配置连接外网的ip以及isp
[R1]dis ip interface brief

3.配置Telnet Server和test

(注意：192.168.1.97已经分配给网关了，此时配置Telnet Server配置192.168.1.98；注意 203.1.1.1给了ISP网关)

[Telnet Server]dis ip int b

[test-1]dis ip int b

4.配置OSPF

[R1]ospf 1 router-id 1.1.1.1

单区[R1-ospf-1]area 0

宣告

[R1-ospf-1-area-0.0.0.0]network 192.168.1.1 0.0.0.0
[R1-ospf-1-area-0.0.0.0]network 192.168.1.65 0.0.0.0
[R1-ospf-1-area-0.0.0.0]network 192.168.1.81 0.0.0.0
[R1-ospf-1-area-0.0.0.0]network 192.168.1.97 0.0.0.0

[R2]ospf 1 rou 2.2.2.2
[R2-ospf-1]area 0
[R2-ospf-1-area-0.0.0.0]network 192.168.1.2 0.0.0.0

[R2-ospf-1-area-0.0.0.0]network 192.168.1.129 0.0.0.0
[R2-ospf-1-area-0.0.0.0]network 192.168.1.161 0.0.0.0

不用宣告外网的0/0/2

5.dhcp获取地址

[R1]dhcp enable

[R1]ip pool 1

[R1-ip-pool-1]network 192.168.1.64 mask 28

[R1-ip-pool-1]gateway-list 192.168.1.65

[R1]ip pool 2
[R1-ip-pool-2]network 192.168.1.80 mask 28
[R1-ip-pool-2]gateway-list 192.168.1.81

进子接口激活：

[R1]int g 0/0/0.1
[R1-GigabitEthernet0/0/0.1]dhcp select global
[R1-GigabitEthernet0/0/0.1]int g 0/0/0.2
[R1-GigabitEthernet0/0/0.2]dhcp select global
[R1-GigabitEthernet0/0/0.2]

查看目前配置

[R1]display current-configuration

查看pc是否获取ip

PC>ipconfig

没获取到ip的策略：

1.查看池塘：display ip pool看看是否gateway-list写错

2.查看接口：display ip interface brief

3.查看接口是否激活,进入接口，display this

4.都没问题就多次重试获取ip

6.边界路由器R2配置nat（地址转换）

easy-ip启动 [R2]acl 2000

抓1.0/24 [R2-acl-basic-2000]rule permit source 192.168.1.0 0.0.0.255

进对外接口 [R2]int g 0/0/2

建立映射关系 [R2-GigabitEthernet0/0/2]nat outbound 2000

R2路由表没有到pc5的203网段，需要写静态路由缺省，指向ISP运营商：

[R2]ip route-static 0.0.0.0 0 202.1.1.2

R1路由表也没有PC5的203网段的路由，让边界R2下发一条缺省

进入ospf [R2]ospf 1

下发路由（R2配过静态路由） [R2-ospf-1]default-route-advertise

此时查看R1中已经有了缺省

7.R1上配置ACL，使得PC1不能访问PC5

[R1]acl 3000

限制网段（vlan 2一台pc写法），不能写死。

[R1-acl-adv-3000]rule deny ip source 192.168.1.64 0.0.0.15 destination 203.1.1.1
00 0.0.0.0

入接口干掉

[R1]int g 0/0/0.1

入方向调用，PC1向上

[R1-GigabitEthernet0/0/0.1]traffic-filter inbound acl 3000

8.telnet测试

开启平台空间0-4 [Telnet Server]user-interface vty 0 4

登录方式aaa [Telnet Server-ui-vty0-4]authentication-mode aaa

进入aaa平台 [Telnet Server]aaa
[Telnet Server-aaa]

用户名密码huawei [Telnet Server-aaa]local-user huawei password cipher huawei

权限 [Telnet Server-aaa]local-user huawei privilege level 15

用户登录的服务类型改为telnet

[Telnet Server-aaa]local-user huawei service-type telnet

编码

[R1-ospf-1-area-0.0.0.0]network 192.168.1.0 0.0.0.31 ospf宣告0区内,R1的直连链路
[R1-ospf-1-area-0.0.0.0]network 192.168.1.32 0.0.0.31
[R1-ospf-1-area-0.0.0.0]network 192.168.1.64 0.0.0.31
[R1-ospf-1-area-0.0.0.0]network 192.168.1.96 0.0.0.31

( R1宣告g0/0/0端口3个广播域和g0/0/1对应等等网段)
[R1]dhcp enable                                                                开启DHCP协议
[R1-ip-pool-a]network 192.168.1.0 mask 27                      ip池a宣告1.0/27网段
[R1-ip-pool-a]gateway-list 192.168.1.1                              宣告1.1为网关
[R1-ip-pool-a]dns-list 114.114.114.114 8.8.8.8                   写入根服务器地址
[R1-ip-pool-b]network 192.168.1.32 mask 27                     同上
[R1-ip-pool-b]gateway-list 192.168.1.33
[R1-ip-pool-b]dns-list 114.114.114.144 8.8.8.8
[R1-ip-pool-c]network 192.168.1.64 mask 27                    同上
[R1-ip-pool-c]gateway-list 192.168.1.65
[R1-ip-pool-c]dns-list 114.114.114.114 8.8.8.8
[R1-GigabitEthernet0/0/0.1]ip address 192.168.1.1 27       写入端口网关
[R1-GigabitEthernet0/0/0.1]dhcp select global                     开启dhcp服务
[R1-GigabitEthernet0/0/0.1]dot1q termination vid 2              以802-1q型帧形式定义子接口管理vid
[R1-GigabitEthernet0/0/0.1]arp broadcast enable                 开启arp服务
[R1-GigabitEthernet0/0/0.2]ip address 192.168.1.33 27       同上
[R1-GigabitEthernet0/0/0.2]dhcp select global
[R1-GigabitEthernet0/0/0.2]dot1q termination vid 3
[R1-GigabitEthernet0/0/0.2]arp broadcast enable
[R1-GigabitEthernet0/0/0.3]ip address 192.168.1.65 27        同上
[R1-GigabitEthernet0/0/0.3]dhcp select global
[R1-GigabitEthernet0/0/0.3]dot1q termination vid 4
[R1-GigabitEthernet0/0/0.3]arp broadcast enable
[R1]ip route-static 0.0.0.0 0 192.168.1.98                              缺省,下一跳为1.98
[R1]ip route-static 192.168.1.0 24 NULL 0                             防止路由黑洞
[R1-acl-adv-3001]rule deny ip source 192.168.1.30 0.0.0.0 destination 192.168.3.3 0.0.0.0

acl3001:拒绝1.30(PC1)指向3.3(PC5)的流量

[R1-GigabitEthernet0/0/1]traffic-filter outbound acl 3001 R1g0/0/1端口outbound使用acl3001规则

[R2-ospf-1-area-0.0.0.0]network 192.168.1.96 0.0.0.31           ospf宣告0区内,R2的直连链路
[R2-ospf-1-area-0.0.0.0]network 192.168.1.128 0.0.0.31
[R2-ospf-1-area-0.0.0.0]network 192.168.1.160 0.0.0.31
[R2]dhcp enable                                                                        DHCP自动分配IP代码与R1类似
[R2-ip-pool-a]network 192.168.1.128 mask 27
[R2-ip-pool-a]gateway-list 192.168.1.129
[R2-ip-pool-a]dns-list 114.114.114.114 8.8.8.8
[R2-ip-pool-b]network 192.168.1.160 mask 27
[R2-ip-pool-b]gateway-list 192.168.1.161
[R2-ip-pool-b]dns-list 114.114.114.114 8.8.8.8
[R2-GigabitEthernet0/0/1.1]ip address 192.168.1.129 27
[R2-GigabitEthernet0/0/1.1]dhcp select global
[R2-GigabitEthernet0/0/1.1]dot1q termination vid 2
[R2-GigabitEthernet0/0/1.1]arp broadcast enable
[R2-GigabitEthernet0/0/1.2]ip address 192.168.1.161 27
[R2-GigabitEthernet0/0/1.2]dhcp select global
[R2-GigabitEthernet0/0/1.2]dot1q termination vid 3
[R2-GigabitEthernet0/0/1.2]arp broadcast enable
[R2]ip route-static 0.0.0.0 0 192.168.2.2                                      缺省,下一跳为2.2
[R2-acl-basic-2000]rule 5 permit source 192.168.1.0 0.0.0.255   acl 2000:允许1.0/24网段通过
[R2-GigabitEthernet0/0/2]nat outbound 2000                                配置easy ip(一对多)
[R2-GigabitEthernet0/0/2]nat server protocol tcp global current-interface 10 inside 192.168.1.10 10                                                                              将现接口的10号端口与IP1.10的10号端口绑定

[ISP]ip route-static 192.168.1.0 24 192.168.2.1                 外网服务器ISP配置静态指向1.0/24网段
[ISP-acl-adv-3000]rule deny tcp source 192.168.3.4 0.0.0.0 destination 192.168.1.10 0.0.0.0 destination-port eq 23              acl 3000:拒绝ip 3.4(PC5)的Telnet请求前往ip1.10(Telnet server)
[ISP-GigabitEthernet0/0/1]traffic-filter inbound acl 3000       ISP的g0/0/1接口inbound使用acl 3000

[telnet server-GigabitEthernet0/0/0]ip address 192.168.1.66 27 配置接口IP为1.66
[telnet server]ip route-static 0.0.0.0 0 192.168.1.65 缺省,下一跳为1.65
[telnet server-aaa]local-user test-1 privilege level 15 password cipher 123

                                                                          创建用户test-1并给予最高权限(level 15),密码为123
[telnet server-aaa]local-user test-1 service-type telnet                宣布test-1用户是用Telnet服务的
[telnet server-aaa]local-user test-2 privilege level 15 password cipher 123                    同上
[telnet server-aaa]local-user test-2 service-type telnet
[telnet server]user-interface vty 0 4                                                                     创建4个虚拟接口
[telnet server-ui-vty0-4]authentication-mode aaa                    宣告这4个虚拟接口是给aaa服务用的

[SW1]vlan batch 2 to 4                                                                                       创建vlan2 到vlan4
[SW1-GigabitEthernet0/0/1]port link-type trunk                               定义该接口链路类型为trunk
[SW1-GigabitEthernet0/0/1]port trunk allow-pass vlan all           该接口下的trunk链路放通所有vlan
[SW1-GigabitEthernet0/0/2]port link-type access                            定义该接口链路类型为access
[SW1-GigabitEthernet0/0/2]port default vlan 2                               将该接口处的链路划入vlan2
[SW1-GigabitEthernet0/0/3]port link-type access                          同上
[SW1-GigabitEthernet0/0/3]port default vlan 3
[SW1-GigabitEthernet0/0/4]port link-type access                           同上
[SW1-GigabitEthernet0/0/4]port default vlan 4

[sw2]vlan batch 2 to 4 同交换机sw1
[sw2-GigabitEthernet0/0/1]port link-type trunk
[sw2-GigabitEthernet0/0/1]port trunk allow-pass vlan all
[sw2-GigabitEthernet0/0/2]port link-type access
[sw2-GigabitEthernet0/0/2]port default vlan 2
[sw2-GigabitEthernet0/0/3]port link-type access
[sw2-GigabitEthernet0/0/3]port default vlan 3

[test-1]ip route-static 0.0.0.0 0 192.168.3.1 test-1缺省,下一跳为3.1
[test-2]ip route-static 0.0.0.0 0 192.168.3.1 test-2缺省,下一跳为3.1