HCIA综合实验

拓扑图

需求分析

1、ISP路由器仅配置Ip地址
2、内网基于192. 168.1.0/24网段进行IP划分
3、R1/R2之间使用ospF做到内网全通，单区域
4、PC1-PC4使用pHCP获取地址
5、PC2-PC4 可以访问PC5, PC1不行
6、R2出口只拥有-个公网IP
7、test- 1设备可以登录内网telnet服务器，test-2不行

配置内容

AR1

[a1-GigabitEthernet0/0/0.2]arp broadcast enable 
[a1-GigabitEthernet0/0/0.2]int g 0/0/0.3
[a1-GigabitEthernet0/0/0.3]ip add 192.168.1.97 28
[a1-GigabitEthernet0/0/0.3]dot1q termination vid 4
[a1-GigabitEthernet0/0/0.3]arp broadcast enable 
[a1]ospf 1 rou 1.1.1.1
[a1-ospf-1]area 0
[a1-ospf-1-area-0.0.0.0]network 192.168.1.1 0.0.0.0
[a1-ospf-1-area-0.0.0.0]network 192.168.1.65 0.0.0.0
[a1]ospf 1 rou 1.1.1.1
[a1-ospf-1]area 0
[a1-ospf-1-area-0.0.0.0]network 192.168.1.81 0.0.0.0
[a1-ospf-1-area-0.0.0.0]network 192.168.1.97 0.0.0.0
[a1]dhcp enable 

[a1]ip pool 1
[a1-ip-pool-1]network 192.168.1.64 mask 28
[a1-ip-pool-1]gateway-list 192.168.1.65
[a1]ip pool 2
[a1-ip-pool-2]network 192.168.1.80 mask 28
[a1-ip-pool-2]gateway-list 192.168.1.81
[a1]int g 0/0/0.1
[a1-GigabitEthernet0/0/0.1]dhcp select global 
[a1-GigabitEthernet0/0/0.1]int g 0/0/0.2
[a1-GigabitEthernet0/0/0.2]dhcp select global 
[a1]acl 3000
[a1-acl-adv-3000]rule deny ip source 192.168.1.64 0.0.0.15 destination 203.1.1.1
00 0.0.0.0
[a1]interface GigabitEthernet 0/0/0.1
[a1-GigabitEthernet0/0/0.1]traffic-filter inbound acl 3000

AR2

[r2]int g 0/0/2
[r2-GigabitEthernet0/0/2]ip add 202.1.1.1 30
[r2]ospf 1 rou 2.2.2.2
[r2-ospf-1]area 0
[r2-ospf-1-area-0.0.0.0]network 192.168.1.2 0.0.0.0
[r2-ospf-1-area-0.0.0.0]network 192.168.1.129 0.0.0.0
[r2-ospf-1-area-0.0.0.0]network 192.168.1.161 0.0.0.0
[r2-ospf-1]dis ip rou p o
[r2]dhcp enable 
[r2]ip pool 1
[r2-ip-pool-2]network 192.168.1.160 mask 27
[r2-ip-pool-2]gateway-list 192.168.1.161
[r2]int g 0/0/0.1
[r2-GigabitEthernet0/0/0.1]dhcp select global 
[r2-GigabitEthernet0/0/0.1]int g 0/0/0.2
[r2-GigabitEthernet0/0/0.2]dhcp select global 
[r2]acl 2000
[r2-acl-basic-2000]rule permit source 192.168.1.0 0.0.0.255
[r2-GigabitEthernet0/0/2]nat outbound 2000
[r2]ip route-static 0.0.0.0 0 202.1.1.2
[r2]ospf 1
[r2]int g 0/0/2
[r2-GigabitEthernet0/0/2]nat server protocol tcp global current-interface telnet
 inside 192.168.1.98 telnet 
Warning:The port 23 is well-known port. If you continue it may cause function fa
ilure.
Are you sure to continue?[Y/N]:y
[r2]acl 3000
[r2-acl-adv-3000]rule deny tcp source 203.1.1.3 0 destination-port eq 23
[r2-acl-adv-3000]q
[r2-GigabitEthernet0/0/2]traffic-filter inbound acl 3000

ISP

[isp]int g 0/0/0
[isp-GigabitEthernet0/0/0]ip add 202.1.1.2 30
[isp-GigabitEthernet0/0/0]int g 0/0/1
[isp-GigabitEthernet0/0/1]ip add 203.1.1.1 24

ts

[ts]int g 0/0/0
[ts-GigabitEthernet0/0/0]ip add 192.168.1.98 28
[ts]user-interface vty 0 4
[ts-ui-vty0-4]authentication-mode aaa
[ts]aaa
[ts-aaa]local-user huawei password cipher huawei
[ts-aaa]local-user huawei privilege level 15
[ts-aaa]local-user huawei service-type telnet
[ts]ip rou 0.0.0.0 0 192.168.1.97

t1

[t1]int g 0/0/0 
[t1-GigabitEthernet0/0/0]ip add 203.1.1.2 24

t2

[t2]int g0/0/1
[t2-GigabitEthernet0/0/1]int g0/0/0

l1

[s1]vlan 2
[s1]vlan 3
[s1]int g 0/0/2
[s1-GigabitEthernet0/0/2]port link-flap 
[s1]int g 0/0/2
[s1-GigabitEthernet0/0/2]port link-type access 
[s1-GigabitEthernet0/0/2]port 
[s1-GigabitEthernet0/0/2]port default vlan 2
[s1-GigabitEthernet0/0/2]int g 0/0/3
[s1-GigabitEthernet0/0/3]po li a
[s1-GigabitEthernet0/0/3]po de v 
[s1-GigabitEthernet0/0/3]int g 0/0
[s1-GigabitEthernet0/0/4]po li a
[s1]int g 0/0/1
[s1-GigabitEthernet0/0/1]po li t
[s1-GigabitEthernet0/0/1]po t all v 2 3 4

l2

[s2]vlan 2
[s2]vlan 3
[s2-GigabitEthernet0/0/2]port link-type access 
[s2-GigabitEthernet0/0/2]int g 0/0/3
[s2-GigabitEthernet0/0/3]po li a
[s2]int g 0/0/1
[s2-GigabitEthernet0/0/1]port link-type trunk 
[s2-GigabitEthernet0/0/1]port trunk allow-pass vlan 2 3

结果测试