实验要求
1、公网设备只配置IP地址
2、全网可达
3、外网设备不允许存在私网路由
4、内网设备不允许存在公网路由
5、test-1可以登录telnet server;而test-2不可以
6、PC1可以访问test-1;PC2不可以
7、PC使用DHCP获取IP地址
实验步骤:
1.为每个路由接口分配ip
以telnet server为例,其他路由同理
[telent server]interface GigabitEthernet 0/0/0
[telent server-GigabitEthernet0/0/0]ip address 192.168.1.100 24
2.给部分路由配置缺省路由
test-1、test-2和telnet server实际上是在模拟PC端,因此给它们添加缺省路由
缺省路由的目的是为了让他们把流量送给上端的路由器
[telnet]ip route-static 0.0.0.0 0 192.168.1.254
[test-1]ip route-static 0.0.0.0 0 34.0.0.254
[test-2]ip route-static 0.0.0.0 0 34.0.0.254
3.AR1和AR3之间启动OSPF协议(以AR1为例,AR3同理)
[R1]ospf 1 router-id 1.1.1.1
[R1-ospf-1]area 0
[R1-ospf-1-area-0.0.0.0]network 192.168.1.254 0.0.0.0
[R1-ospf-1-area-0.0.0.0]network 192.168.12.1 0.0.0.0
AR1和AR3上启用DHCP为PC分配IP(以AR1为例,AR3同理)
[R1]dhcp enable
[R1]ip pool 1
[R1-ip-pool-1]network 192.168.1.0 mask 24
[R1-ip-pool-1]gateway-list 192.168.1.254
[R1-ip-pool-1]dns-list 8.8.8.8
[R1-ip-pool-1]q
[R1]int g 0/0/0
[R1-GigabitEthernet0/0/0]dhcp select global
R3
[R3]ip route-static 0.0.0.0 0 23.0.0.3
[R3]ospf 1
[R3-ospf-1]default-route-advertise
[R3]acl 2000
[R3-acl-basic-2000]rule permit source 192.168.0.0 0.0.255.255
[R3-acl-basic-2000]q
[R3]int g 0/0/2
[R3-GigabitEthernet0/0/2]nat outbound 2000
R8
R8]acl 3000
[R8-acl-adv-3000]rule deny ip source 192.168.2.253 0.0.0.0 destination 34.0.0.1
0
[R8-acl-adv-3000]q
[R8]int g 0/0/1
[R8-GigabitEthernet0/0/1]traffic-filter inbound acl 3000
开启telnet服务
[telnet]user-interface vty 0 4
[telnet-ui-vty0-4]authentication-mode aaa
[telnet-ui-vty0-4]q
[telnet]aaa
[telnet-aaa]local-user huawei password cipher 123456 privilege level 15
[telnet-aaa]local-user huawei service-type telnet
测试
[R2-GigabitEthernet0/0/2]nat server protocol tcp global current-interface 2323 inside 192.168.1.100 23
[R2]acl 3100
[R2-acl-adv-3100]rule deny tcp source 34.0.0.2 0 destination 23.0.0.2 0 destinat
ion-port eq 2323
[R2-acl-adv-3100]q
[R2]int g 0/0/2
[R2-GigabitEthernet0/0/2]traffic-filter inbound acl 3100