企业网三层架构实验

一，实验要求及拓扑图

1. 内网IP地址172.16.0.0/16合理分配
2. SW1/SW2之间互为备份
3. VRRP/STP/VLAN/TRUNK均使用
4. 所有PC通过DHCP获取IP

二，配置过程 

1.划分IP地址

R1与R2之间公有地址使用12.1.1.0/24 网段

ISP环回地址为1.1.1.1/24

内网ip地址划分：

172.16.0.0/30   左边骨干  
172.16.0.4/30   右边骨干
172.16.1.0/24   vlan 1
172.16.2.0/24   vlan 2

2.在SW1与SW2 之间创建二层通道

 interface Eth-Trunk1 
 port link-type trunk   //改变接口模式为trunk模式
 port trunk allow-pass vlan 2 to 4094
 interface GigabitEthernet0/0/2
 eth-trunk 1
 interface GigabitEthernet0/0/3
 eth-trunk 1

3.创建 vlan

 vlan 2
 interface Ethernet 0/0/2
 port link-type access
 port default vlan 2

4.将接口模式调为trunk模式

 port trunk allow-pass vlan 2 to 4094

5.开启stp

 stp region-configuration
 region-name a
 instance 1 vlan 1
 instance 2 vlan 2
 active region-configuration
修改SW1为vlan 1 根网桥，vlan 2 的备份网桥，SW2为vlan2 的根网桥，vlan 1 的备份网桥

 stp instance 1 root primary
 stp instance 2 root secondary

6.开启Svi，并配置虚拟网关（网关冗余）

SW1：

 interface Vlanif1
 ip address 172.16.1.1 255.255.255.0
 vrrp vrid 1 virtual-ip 172.16.1.10
 vrrp vrid 1 priority 101
 vrrp vrid 1 track interface GigabitEthernet0/0/1
 dhcp select global
 
 interface Vlanif2
 ip address 172.16.2.1 255.255.255.0
 vrrp vrid 1 virtual-ip 172.16.2.10
 dhcp select global
 

配置DHCP池
 ip pool a
 gateway-list 172.16.1.10
 network 172.16.1.0 mask 255.255.255.0
 dns-list 114.114.114.114
 ip pool b
 gateway-list 172.16.2.10 
 network 172.16.2.0 mask 255.255.255.0
 dns-list 114.114.114.114

SW2：

 interface Vlanif1
 ip address 172.16.1.2 255.255.255.0
 vrrp vrid 1 virtual-ip 172.16.1.10
 dhcp select global
 
 interface Vlanif2
 ip address 172.16.2.2 255.255.255.0
 vrrp vrid 1 virtual-ip 172.16.2.10
 vrrp vrid 1 priority 101
 vrrp vrid 1 track interface GigabitEthernet0/0/1
 dhcp select global
 

配置DHCP池
 ip pool a
 gateway-list 172.16.1.10
 network 172.16.1.0 mask 255.255.255.0
 dns-list 114.114.114.114
 ip pool b
 gateway-list 172.16.2.10
 network 172.16.2.0 mask 255.255.255.0
 dns-list 114.114.114.114

7.接口模式改为access

interface Vlanif3
ip address 172.16.0.1 255.255.255.252
 
interface Vlanif4
ip address 172.16.0.5 255.255.255.252

8.配置ospf

ospf 1 router-id 3.3.3.3
area 0.0.0.0
network 172.16.0.0 0.0.255.255
 
ospf 1 router-id 2.2.2.2
area 0.0.0.0
network 172.16.0.0 0.0.255.255
 
ospf 1 router-id 1.1.1.1 
default-route-advertise always
area 0.0.0.0 
network 172.16.0.0 0.0.255.255 

9.制定ACl、NAT

acl number 2000  
rule 5 permit source 172.16.0.0 0.0.255.255 
nat out bound 2000

三，结果测试