实验要求:
一.先划分192.168.1.0/24给内网
R1-R2:192.168.1.0/26
R2:192.168.1.128/26
vlan2:192.168.1.128/27
vlan3:192.168.1.160/27
R1:192.168.1.64/26
vlan2:192.168.1.64/28
vlan3:192.168.1.80/28
vlan4:192.168.1.96/28
192.168.1.192/26—保留
二.给交换机划分vlan,并进行对pc1-pc4进行DHCP分配地址
交换机:
[Huawei]vlan 2
[Huawei-vlan2]q
[Huawei]vlan 3
[Huawei-vlan3]q
[Huawei]interface GigabitEthernet 0/0/2
[Huawei-GigabitEthernet0/0/2]port link-type access
[Huawei-GigabitEthernet0/0/2]port default vlan 2
[Huawei-GigabitEthernet0/0/2]q
[Huawei]interface GigabitEthernet 0/0/3
[Huawei-GigabitEthernet0/0/3]port link-type access
[Huawei-GigabitEthernet0/0/3]port default vlan 3
[Huawei-GigabitEthernet0/0/3]q
[Huawei]interface GigabitEthernet 0/0/4
[Huawei-GigabitEthernet0/0/4]port link-type access
[Huawei-GigabitEthernet0/0/4]port default vlan 4
[Huawei-GigabitEthernet0/0/4]q
[Huawei]interface GigabitEthernet 0/0/1
[Huawei-GigabitEthernet0/0/1]port link-type trunk
[Huawei-GigabitEthernet0/0/1]port trunk allow-pass vlan 4
[Huawei-GigabitEthernet0/0/1]
[Huawei]interface GigabitEthernet 0/0/1
[Huawei-GigabitEthernet0/0/1]port link-type trunk
[Huawei-GigabitEthernet0/0/1]port trunk allow-pass vlan 2 3 4
R1
[Huawei]interface GigabitEthernet 0/0/0.1
[Huawei-GigabitEthernet0/0/0.1]dot1q termination vid 2
[Huawei-GigabitEthernet0/0/0.1]ip address 192.168.1.65 28
[Huawei]dhcp enable
[Huawei]ip pool dsy1
[Huawei-ip-pool-dsy1]network 192.168.1.64 mask 28
[Huawei-ip-pool-dsy1]gateway-list 192.168.1.65
[Huawei-ip-pool-dsy1]dns-list 8.8.8.8
[Huawei-ip-pool-dsy1]q
[Huawei]interface GigabitEthernet 0/0/0.1
[Huawei-GigabitEthernet0/0/0.1]dhcp select global
[Huawei-GigabitEthernet0/0/0.1]q
[Huawei]interface GigabitEthernet 0/0/0.2
[Huawei-GigabitEthernet0/0/0.2]dot1q termination vid 3
[Huawei-GigabitEthernet0/0/0.2]ip address 192.168.1.81 28
[Huawei]dhcp enable
[Huawei]ip pool dsy2
[Huawei-ip-pool-dsy2]network 192.168.1.80 mask 28
[Huawei-ip-pool-dsy2]gateway-list 192.168.1.81
[Huawei-ip-pool-dsy2]dns
[Huawei-ip-pool-dsy2]dns-list 8.8.8.8
[Huawei-ip-pool-dsy2]q
[Huawei]interface GigabitEthernet 0/0/0.2
[Huawei-GigabitEthernet0/0/0.2]dhcp select global
[Huawei]interface GigabitEthernet 0/0/0.3
[Huawei-GigabitEthernet0/0/0.3]dot1q termination vid 4
[Huawei-GigabitEthernet0/0/0.3]ip address 192.168.1.97 28
R2:
[Huawei]interface GigabitEthernet 0/0/2.1
[Huawei-GigabitEthernet0/0/2.1]dot1q termination vid 2
[Huawei-GigabitEthernet0/0/2.1]ip address 192.168.1.129 27
[Huawei-GigabitEthernet0/0/2.1]q
[Huawei]dhcp enable
[Huawei]ip pool dsy1
[Huawei-ip-pool-dsy1]network 192.168.1.128 mask 27
[Huawei-ip-pool-dsy1]gateway-list 192.168.1.129
[Huawei-ip-pool-dsy1]dns-list 8.8.8.8
[Huawei-ip-pool-dsy1]q
[Huawei]interface GigabitEthernet 0/0/2.1
[Huawei-GigabitEthernet0/0/2.1]dhcp select global
[Huawei-GigabitEthernet0/0/2.1]q
[Huawei-GigabitEthernet 0/0/0.2
[Huawei-GigabitEthernet0/0/0.2]dot1q termination vid 3
[Huawei-GigabitEthernet0/0/0.2]ip address 192.168.1.161 27
[Huawei-GigabitEthernet0/0/0.2]q
[Huawei]dhcp enable
[Huawei]ip pool dsy2
[Huawei-ip-pool-dsy2]network 192.168.1.160 mask 27
[Huawei-ip-pool-dsy2]gateway-list 192.168.1.161
[Huawei-ip-pool-dsy2]dns-list 8.8.8.8
[Huawei-ip-pool-dsy2]q
[Huawei]interface GigabitEthernet 0/0/2.2
[Huawei-GigabitEthernet0/0/2.2]dhcp select global
R1和R2都进行划分子接口的操作
三.对telnet-service进行分配地址和开启telnet服务
[Huawei]interface GigabitEthernet 0/0/0
[Huawei-GigabitEthernet0/0/0]ip address 192.168.1.98 28
[Huawei]ip route-static 0.0.0.0 0 192.168.1.97
[Huawei]user-interface vty 0 4
[Huawei-ui-vty0-4]authentication-mode aaa
[Huawei-ui-vty0-4]q
[Huawei]aaa
[Huawei-aaa]local-user huawei password cipher 123456 privilege level 15
四.运用ospf协议将内网联通
AR1:
[Huawei]ospf 1 router-id 1.1.1.1
[Huawei-ospf-1]area 0
[Huawei-ospf-1-area-0.0.0.0]network 192.168.1.65 0.0.0.0
[Huawei-ospf-1-area-0.0.0.0]network 192.168.1.81 0.0.0.0
[Huawei-ospf-1-area-0.0.0.0]network 192.168.1.97 0.0.0.0
[Huawei-ospf-1-area-0.0.0.0]network 192.168.1.1 0.0.0.0
AR2:
[Huawei]ospf 1 router-id 1.1.1.1
[Huawei-ospf-1]area 0
[Huawei-ospf-1-area-0.0.0.0]network 192.168.1.129 0.0.0.0
[Huawei-ospf-1-area-0.0.0.0]network 192.168.1.2 0.0.0.0
[Huawei-ospf-1-area-0.0.0.0]network 192.168.1.161 0.0.0.0
这样内网就通了
五.在进行配置外网的IP地址,是外网联通
ISP:
test1:
test2:
pc5;
六.在边界在设备上进行端口转换
[r2]acl 2000
[r2-acl-basic-2000]rule permit source 192.168.1.0 0.0.0.255
[r2-GigabitEthernet0/0/1]nat outbound 2000
七.在边界设备上进行端口映射,并强制下发缺省路由
[Huawei-GigabitEthernet0/0/1]nat server protocol tcp global current-interface te
lnet inside 192.168.1.98 telnet
最后就是进行acl使telnet2telnet不到服务器,在边界设备上进行配置
[Huawei-acl-adv-3000]rule deny tcp source 1.1.1.2 0 destination-port eq 23
[Huawei-acl-adv-3000]q
[Huawei]interface GigabitEthernet 0/0/1
[Huawei-GigabitEthernet0/0/1]traffic-filter inbound acl 3000
测试:
telnet1:
telnet2:
这样,整个实验就结束了