模拟高校 中小型企业网络搭建配置案例（模拟高校2018汉化版下载）

模拟高校 中小型企业网络搭建配置案例（模拟高校2018汉化版下载）

本实验模拟高校网络建设。高校校园网的信息化建设一直走在各个行业前列，其网络建设相对比较复杂，涉及到多种网元，如交换机，路由器，无线设备及安全设备等。本实验模拟某高校园区网络，GL 校区为研究生部，XL 校区为本科部。GL、XL 校区网络都需重新建设，现需对网络进行规划与配置，涉及两部分的网络建设。

实验拓扑

1.基本配置

根据实验编址表、规划表进行相应的配置。交换机 VLAN 规划表如下。

设备接口IPv4地址规划表如下。

1.1 配置Eth-Trunk

在 Agg1—Agg2 之间的链路，通过 LACP 模式实现链路聚合，成员接口为 GE0/0/5 和 GE0/0/6。该逻辑接口编号为 0。

1.1.1 配置Agg1的Eth-Trunk

system-view [Huawei]sysname Agg1[Agg1]interface Eth-Trunk0[Agg1-Eth-Trunk0]mode lacp-static[Agg1-Eth-Trunk0]trunkport GigabitEthernet 0/0/5 0/0/6[Agg1-Eth-Trunk0]quit

拷贝代码system-view sysname Agg1interface Eth-Trunk0mode lacp-statictrunkport GigabitEthernet 0/0/5 0/0/6quit

1.1.2 配置Agg2的Eth-Trunk

system-view [Huawei]sysname Agg2[Agg2]interface Eth-Trunk0[Agg2-Eth-Trunk0]mode lacp-static[Agg2-Eth-Trunk0]trunkport GigabitEthernet 0/0/5 0/0/6[Agg2-Eth-Trunk0]quit

拷贝代码system-view sysname Agg2interface Eth-Trunk0mode lacp-statictrunkport GigabitEthernet 0/0/5 0/0/6quit

1.2 配置VLAN

参照VLAN 规划表完成全网设备 VLAN的配置和接口划分。

1.2.1 配置Acc1的VLAN

system-view [Huawei]sysname Acc1[Acc1]vlan batch 30 40[Acc1]interface GigabitEthernet0/0/1[Acc1-GigabitEthernet0/0/1] port link-type trunk[Acc1-GigabitEthernet0/0/1] port trunk pvid vlan 30[Acc1-GigabitEthernet0/0/1] port trunk allow-pass vlan 30 40[Acc1-GigabitEthernet0/0/1]quit[Acc1]interface GigabitEthernet0/0/2[Acc1-GigabitEthernet0/0/2] port link-type trunk[Acc1-GigabitEthernet0/0/2] port trunk allow-pass vlan 2 to 4094[Acc1-GigabitEthernet0/0/2]quit[Acc1]interface GigabitEthernet0/0/3[Acc1-GigabitEthernet0/0/3] port link-type trunk[Acc1-GigabitEthernet0/0/3] port trunk allow-pass vlan 2 to 4094[Acc1-GigabitEthernet0/0/3]quit

拷贝代码system-view sysname Acc1vlan batch 30 40interface GigabitEthernet0/0/1port link-type trunkport trunk pvid vlan 30port trunk allow-pass vlan 30 40quitinterface GigabitEthernet0/0/2port link-type trunkport trunk allow-pass vlan 2 to 4094quitinterface GigabitEthernet0/0/3port link-type trunkport trunk allow-pass vlan 2 to 4094quit

1.2.2 配置Acc2的VLAN

system-view [Huawei]sysname Acc2[Acc2]vlan batch 10[Acc2]interface GigabitEthernet0/0/3[Acc2-GigabitEthernet0/0/3]port link-type trunk[Acc2-GigabitEthernet0/0/3]port trunk allow-pass vlan 2 to 4094[Acc2-GigabitEthernet0/0/3]quit[Acc2]interface GigabitEthernet0/0/2[Acc2-GigabitEthernet0/0/2]port link-type trunk[Acc2-GigabitEthernet0/0/2]port trunk allow-pass vlan 2 to 4094[Acc2-GigabitEthernet0/0/2]quit[Acc2]interface GigabitEthernet0/0/1[Acc2-GigabitEthernet0/0/1]port link-type access[Acc2-GigabitEthernet0/0/1]port default vlan 10[Acc2-GigabitEthernet0/0/1]quit

拷贝代码system-view sysname Acc2vlan batch 10interface GigabitEthernet0/0/3port link-type trunkport trunk allow-pass vlan 2 to 4094quitinterface GigabitEthernet0/0/2port link-type trunkport trunk allow-pass vlan 2 to 4094quitinterface GigabitEthernet0/0/1port link-type accessport default vlan 10quit

1.2.3 配置Agg1的VLAN

[Agg1]vlan batch 10 30 40 105[Agg1]interface GigabitEthernet0/0/1[Agg1-GigabitEthernet0/0/1]port link-type trunk[Agg1-GigabitEthernet0/0/1]port trunk allow-pass vlan 30[Agg1-GigabitEthernet0/0/1]quit[Agg1]interface GigabitEthernet0/0/2[Agg1-GigabitEthernet0/0/2]port link-type trunk[Agg1-GigabitEthernet0/0/2]port trunk allow-pass vlan 2 to 4094[Agg1-GigabitEthernet0/0/2]quit[Agg1]interface GigabitEthernet0/0/3[Agg1-GigabitEthernet0/0/3]port link-type trunk[Agg1-GigabitEthernet0/0/3]port trunk allow-pass vlan 2 to 4094[Agg1-GigabitEthernet0/0/3]quit[Agg1]interface GigabitEthernet0/0/4[Agg1-GigabitEthernet0/0/4]port link-type access[Agg1-GigabitEthernet0/0/4]port default vlan 105[Agg1-GigabitEthernet0/0/4]quit[Agg1]interface Eth-Trunk0[Agg1-Eth-Trunk0]port link-type trunk[Agg1-Eth-Trunk0]port trunk allow-pass vlan 2 to 4094

拷贝代码vlan batch 10 30 40 105interface GigabitEthernet0/0/1port link-type trunkport trunk allow-pass vlan 30quitinterface GigabitEthernet0/0/2port link-type trunkport trunk allow-pass vlan 2 to 4094quitinterface GigabitEthernet0/0/3port link-type trunkport trunk allow-pass vlan 2 to 4094quitinterface GigabitEthernet0/0/4port link-type accessport default vlan 105quitinterface Eth-Trunk0port link-type trunkport trunk allow-pass vlan 2 to 4094

1.2.4 配置Agg2的VLAN

[Agg2]vlan batch 10 106[Agg2]interface GigabitEthernet0/0/2[Agg2-GigabitEthernet0/0/2]port link-type trunk[Agg2-GigabitEthernet0/0/2]port trunk allow-pass vlan 2 to 4094[Agg2-GigabitEthernet0/0/2]quit[Agg2]interface GigabitEthernet0/0/3[Agg2-GigabitEthernet0/0/3]port link-type trunk[Agg2-GigabitEthernet0/0/3]port trunk allow-pass vlan 2 to 4094[Agg2-GigabitEthernet0/0/3]quit[Agg2]interface GigabitEthernet0/0/4[Agg2-GigabitEthernet0/0/4]port link-type access[Agg2-GigabitEthernet0/0/4]port default vlan 106[Agg2-GigabitEthernet0/0/4]quit[Agg2]interface Eth-Trunk0[Agg2-Eth-Trunk0]port link-type trunk[Agg2-Eth-Trunk0]port trunk allow-pass vlan 2 to 4094

拷贝代码vlan batch 10 106interface GigabitEthernet0/0/2port link-type trunkport trunk allow-pass vlan 2 to 4094quitinterface GigabitEthernet0/0/3port link-type trunkport trunk allow-pass vlan 2 to 4094quitinterface GigabitEthernet0/0/4port link-type accessport default vlan 106quitinterface Eth-Trunk0port link-type trunkport trunk allow-pass vlan 2 to 4094

1.2.5 配置AC1的VLAN

system-view [AC6605]sysname AC1[AC1]vlan 30[AC1-vlan30]interface GigabitEthernet0/0/1[AC1-GigabitEthernet0/0/1]port link-type trunk[AC1-GigabitEthernet0/0/1]port trunk allow-pass vlan 30[AC1-GigabitEthernet0/0/1]quit

拷贝代码system-view sysname AC1vlan 30interface GigabitEthernet0/0/1port link-type trunkport trunk allow-pass vlan 30quit

1.2.6 配置Agg3的VLAN

system-view [Huawei]sysname Agg3[Agg3]vlan batch 50 108[Agg3]interface GigabitEthernet0/0/1[Agg3-GigabitEthernet0/0/1] port link-type access[Agg3-GigabitEthernet0/0/1] port default vlan 108[Agg3-GigabitEthernet0/0/1]quit[Agg3]interface GigabitEthernet0/0/2[Agg3-GigabitEthernet0/0/2] port link-type trunk[Agg3-GigabitEthernet0/0/2] port trunk allow-pass vlan 2 to 4094[Agg3-GigabitEthernet0/0/2]quit

拷贝代码system-view sysname Agg3vlan batch 50 108interface GigabitEthernet0/0/1 port link-type access port default vlan 108quitinterface GigabitEthernet0/0/2 port link-type trunk port trunk allow-pass vlan 2 to 4094quit

1.2.7 配置Acc3的VLAN

system-view [Huawei]sysname Acc3[Acc3]vlan batch 50[Acc3]interface GigabitEthernet0/0/1[Acc3-GigabitEthernet0/0/1] port link-type access[Acc3-GigabitEthernet0/0/1] port default vlan 50[Acc3-GigabitEthernet0/0/1]quit[Acc3]interface GigabitEthernet0/0/2[Acc3-GigabitEthernet0/0/2] port link-type trunk[Acc3-GigabitEthernet0/0/2] port trunk allow-pass vlan 2 to 4094[Acc3-GigabitEthernet0/0/2]quit

拷贝代码system-view sysname Acc3vlan batch 50interface GigabitEthernet0/0/1 port link-type access port default vlan 50quitinterface GigabitEthernet0/0/2 port link-type trunk port trunk allow-pass vlan 2 to 4094quit

1.2.8 配置DC1的VLAN

system-view [Huawei]sysname DC1[DC1]vlan batch 201[DC1]interface GigabitEthernet0/0/2[DC1-GigabitEthernet0/0/2] port link-type access[DC1-GigabitEthernet0/0/2] port default vlan 201[DC1-GigabitEthernet0/0/2]quit

拷贝代码system-view sysname DC1vlan batch 201interface GigabitEthernet0/0/2 port link-type access port default vlan 201quit

1.3 配置IP地址

根据IP地址规划表进行设备IP地址的配置。

1.3.1 进行AC1的地址配置

[AC1]interface Vlanif30[AC1-Vlanif30] ip address 192.168.30.254 255.255.255.0[AC1-Vlanif30]quit

拷贝代码interface Vlanif30ip address 192.168.30.254 255.255.255.0quit

1.3.2 进行Agg1的地址配置

[Agg1-Eth-Trunk0]quit[Agg1]interface Vlanif10[Agg1-Vlanif10] ip address 192.168.10.1 255.255.255.0[Agg1-Vlanif10]quit[Agg1]interface Vlanif40[Agg1-Vlanif40] ip address 192.168.40.254 255.255.255.0[Agg1-Vlanif40]quit[Agg1]interface Vlanif105[Agg1-Vlanif105] ip address 10.1.79.7 255.255.255.0[Agg1-Vlanif105]quit[Agg1]interface LoopBack0[Agg1-LoopBack0] ip address 10.1.7.7 255.255.255.255[Agg1-LoopBack0]quit

拷贝代码quitinterface Vlanif10 ip address 192.168.10.1 255.255.255.0quitinterface Vlanif40ip address 192.168.40.254 255.255.255.0quitinterface Vlanif105ip address 10.1.79.7 255.255.255.0quitinterface LoopBack0ip address 10.1.7.7 255.255.255.255quit

1.3.3 进行Agg2的地址配置

[Agg2-Eth-Trunk0]quit[Agg2]interface Vlanif10[Agg2-Vlanif10] ip address 192.168.10.2 255.255.255.0[Agg2-Vlanif10]quit[Agg2]interface Vlanif106[Agg2-Vlanif106] ip address 10.1.89.8 255.255.255.0[Agg2-Vlanif106]quit[Agg2]interface LoopBack0[Agg2-LoopBack0] ip address 10.1.8.8 255.255.255.255[Agg2-LoopBack0]quit

拷贝代码quitinterface Vlanif10ip address 192.168.10.2 255.255.255.0quitinterface Vlanif106ip address 10.1.89.8 255.255.255.0quitinterface LoopBack0ip address 10.1.8.8 255.255.255.255quit

1.3.4 进行Core1的地址配置

system-view [Huawei]sysname Core1[Core1]interface GigabitEthernet0/0/0[Core1-GigabitEthernet0/0/0] ip address 210.28.1.2 255.255.255.224 [Core1-GigabitEthernet0/0/0]quit[Core1]interface GigabitEthernet0/0/1[Core1-GigabitEthernet0/0/1] ip address 10.1.79.9 255.255.255.0 [Core1-GigabitEthernet0/0/1]quit[Core1]interface GigabitEthernet0/0/2[Core1-GigabitEthernet0/0/2] ip address 10.1.89.9 255.255.255.0 [Core1-GigabitEthernet0/0/2]quit[Core1]interface GigabitEthernet2/0/0[Core1-GigabitEthernet2/0/0] ip address 10.3.69.9 255.255.255.0 [Core1-GigabitEthernet2/0/0]quit[Core1]interface GigabitEthernet2/0/2[Core1-GigabitEthernet2/0/2] ip address 10.2.69.9 255.255.255.0 [Core1-GigabitEthernet2/0/2]quit[Core1]interface LoopBack0[Core1-LoopBack0] ip address 10.1.9.9 255.255.255.255 [Core1-LoopBack0]quit

拷贝代码system-view sysname Core1interface GigabitEthernet0/0/0 ip address 210.28.1.2 255.255.255.224 quitinterface GigabitEthernet0/0/1 ip address 10.1.79.9 255.255.255.0 quitinterface GigabitEthernet0/0/2 ip address 10.1.89.9 255.255.255.0 quitinterface GigabitEthernet2/0/0 ip address 10.3.69.9 255.255.255.0 quitinterface GigabitEthernet2/0/2 ip address 10.2.69.9 255.255.255.0 quitinterface LoopBack0 ip address 10.1.9.9 255.255.255.255 quit

1.3.5 进行Core3的地址配置

system-view [Huawei]sysname Core3[Core3]interface GigabitEthernet0/0/0[Core3-GigabitEthernet0/0/0] ip address 223.2.1.2 255.255.255.192 [Core3-GigabitEthernet0/0/0]quit[Core3]interface GigabitEthernet0/0/1[Core3-GigabitEthernet0/0/1] ip address 10.1.56.6 255.255.255.0 [Core3-GigabitEthernet0/0/1]quit[Core3]interface GigabitEthernet0/0/2[Core3-GigabitEthernet0/0/2] ip address 10.1.201.6 255.255.255.0 [Core3-GigabitEthernet0/0/2]quit[Core3]interface GigabitEthernet2/0/0[Core3-GigabitEthernet2/0/0] ip address 10.3.69.6 255.255.255.0 [Core3-GigabitEthernet2/0/0]quit[Core3]interface GigabitEthernet2/0/2[Core3-GigabitEthernet2/0/2] ip address 10.2.69.6 255.255.255.0 [Core3-GigabitEthernet2/0/2]quit[Core3]interface LoopBack0[Core3-LoopBack0] ip address 10.1.128.6 255.255.255.255 [Core3-LoopBack0]quit

拷贝代码system-view sysname Core3interface GigabitEthernet0/0/0 ip address 223.2.1.2 255.255.255.192 quitinterface GigabitEthernet0/0/1 ip address 10.1.56.6 255.255.255.0 quitinterface GigabitEthernet0/0/2 ip address 10.1.201.6 255.255.255.0 quitinterface GigabitEthernet2/0/0 ip address 10.3.69.6 255.255.255.0 quitinterface GigabitEthernet2/0/2 ip address 10.2.69.6 255.255.255.0 quitinterface LoopBack0 ip address 10.1.128.6 255.255.255.255 quit

1.3.6 进行Agg3的地址配置

[Agg3]interface Vlanif50[Agg3-Vlanif50] ip address 192.168.50.254 255.255.255.0[Agg3-Vlanif50]quit[Agg3]interface Vlanif108[Agg3-Vlanif108] ip address 10.1.56.5 255.255.255.0[Agg3-Vlanif108]quit[Agg3]interface LoopBack0[Agg3-LoopBack0] ip address 10.1.128.5 255.255.255.255[Agg3-LoopBack0]quit

拷贝代码interface Vlanif50 ip address 192.168.50.254 255.255.255.0quitinterface Vlanif108 ip address 10.1.56.5 255.255.255.0quitinterface LoopBack0 ip address 10.1.128.5 255.255.255.255quit

1.3.7 进行DC1的地址配置

[DC1]interface Vlanif201[DC1-Vlanif201] ip address 10.1.201.5 255.255.255.0[DC1-Vlanif201]quit

拷贝代码interface Vlanif201 ip address 10.1.201.5 255.255.255.0quit

1.3.8 进行SR1的地址配置

system-view [Huawei]sysname SR1[SR1]interface GigabitEthernet0/0/0[SR1-GigabitEthernet0/0/0] ip address 210.28.1.1 255.255.255.224 [SR1-GigabitEthernet0/0/0]quit[SR1]interface GigabitEthernet0/0/1[SR1-GigabitEthernet0/0/1] ip address 223.2.1.1 255.255.255.192 [SR1-GigabitEthernet0/0/1]quit[SR1]interface GigabitEthernet0/0/2[SR1-GigabitEthernet0/0/2] ip address 14.1.1.2 255.255.255.252 [SR1-GigabitEthernet0/0/2]quit

拷贝代码system-view sysname SR1interface GigabitEthernet0/0/0 ip address 210.28.1.1 255.255.255.224 quitinterface GigabitEthernet0/0/1 ip address 223.2.1.1 255.255.255.192 quitinterface GigabitEthernet0/0/2 ip address 14.1.1.2 255.255.255.252 quit

1.3.9 进行Taobao1的地址配置

system-view [Huawei]sysname Taobao1[Taobao1]interface GigabitEthernet0/0/2[Taobao1-GigabitEthernet0/0/2] ip address 14.1.1.1 255.255.255.252 [Taobao1-GigabitEthernet0/0/2]quit[Taobao1]interface LoopBack0[Taobao1-LoopBack0] ip address 14.4.4.4 255.255.255.255 [Taobao1-LoopBack0]quit

拷贝代码system-view sysname Taobao1interface GigabitEthernet0/0/2 ip address 14.1.1.1 255.255.255.252 quitinterface LoopBack0 ip address 14.4.4.4 255.255.255.255 quit

1.4 配置MSTP

为了防止 Acc1、Acc2、Agg1、Agg2 之间出现环路，使用设备默认支持的 MSTP。Agg1 为 instance 0 的根桥， Agg2 为 instance 0 的备份根桥。通过配置桥优先级值来明确根桥（桥优先级为 0）、备份根桥（桥优先级为 4096） 的角色。

1.4.1 进行Agg1的STP优先级配置

[Agg1]stp priority 0

拷贝代码stp priority 0

1.4.2 进行Agg2的STP优先级配置

[Agg2]stp priority 4096

拷贝代码stp priority 4096

1.5 VRRP

Agg1 和 Agg2 作为研究生教学的网关，为了保证业务网段的可靠性和连续性，要求在Agg1 和 Agg2 上配置 VRRP 来实现网关的备份。1. VLAN 10 使用 VRRP 备份组 1，VRRP 备份组 1 虚拟 IP 地址为 192.168.10.254。2. VRRP 备份组 1 以 Agg1 为主网关（优先级为 200），Agg2 作为备份网关（优先级为缺省）。

1.5.1 进行Agg1的VRRP配置

[Agg1]interface Vlanif10[Agg1-Vlanif10]vrrp vrid 1 virtual-ip 192.168.10.254[Agg1-Vlanif10]vrrp vrid 1 priority 200

拷贝代码interface Vlanif10vrrp vrid 1 virtual-ip 192.168.10.254vrrp vrid 1 priority 200

1.5.2 进行Agg2的VRRP配置

[Agg2]interface Vlanif10[Agg2-Vlanif10]vrrp vrid 1 virtual-ip 192.168.10.254

拷贝代码interface Vlanif10vrrp vrid 1 virtual-ip 192.168.10.254

1.6 DHCP

在大型网络中，一般使用 DHCP 来为终端分配 IP 地址。本科生教学 1 主机通过 DHCP 获取 IP 地址，Agg3 作为 VLAN 50 的 DHCP 服务器，采用 VLANif50 的接口地址池。

[Agg3]dhcp enable[Agg3]interface Vlanif50[Agg3-Vlanif50] dhcp select interface

拷贝代码dhcp enableinterface Vlanif50dhcp select interface

1.7 WLAN

在 NJUPT-GL 校区，使用 Fit AP+AC 的组网方式，为研究生宿舍提供 WLAN 接入。请根据以下参数进行组网。

1.7.1 配置AP和客户端的DHCP服务器

配置AP在AC1上的DHCP服务器

[AC1]dhcp enable[AC1]interface Vlanif30[AC1-Vlanif30] dhcp select interface[AC1-Vlanif30] dhcp server gateway-list 192.168.30.254[AC1-Vlanif30]quit

拷贝代码dhcp enableinterface Vlanif30 dhcp select interface dhcp server gateway-list 192.168.30.254quit

配置客户端在Agg1上的DHCP服务器

[Agg1-Vlanif10]quit[Agg1]dhcp enable[Agg1]interface Vlanif40[Agg1-Vlanif40] dhcp select interface

拷贝代码quitdhcp enableinterface Vlanif40dhcp select interface

1.7.2 配置AC源接口地址

[AC1]capwap source interface vlanif30

拷贝代码capwap source interface vlanif30

1.7.3 配置SSID模板

[AC1]wlan[AC1-wlan-view]ssid-profile name NJUPT[AC1-wlan-ssid-prof-NJUPT] ssid NJUPT[AC1-wlan-ssid-prof-NJUPT]quit

拷贝代码wlanssid-profile name NJUPTssid NJUPTquit

1.7.4 配置Security模板

[AC1-wlan-view]quit[AC1]wlan[AC1-wlan-view][AC1-wlan-view] traffic-profile name default[AC1-wlan-traffic-prof-default][AC1-wlan-traffic-prof-default] security-profile name NJUPT[AC1-wlan-sec-prof-NJUPT][AC1-wlan-sec-prof-NJUPT] security wpa-wpa2 psk pass-phrase huawei@123 aes[AC1-wlan-sec-prof-NJUPT]quit

拷贝代码quitwlantraffic-profile name defaultsecurity-profile name NJUPTsecurity wpa-wpa2 psk pass-phrase huawei@123 aesquit

1.7.5 配置VAP模板

[AC1-wlan-view]quit[AC1]wlan[AC1-wlan-view] vap-profile name NJUPT[AC1-wlan-vap-prof-NJUPT] service-vlan vlan-id 40[AC1-wlan-vap-prof-NJUPT] ssid-profile NJUPT[AC1-wlan-vap-prof-NJUPT]quit

拷贝代码wlan vap-profile name NJUPTservice-vlan vlan-id 40ssid-profile NJUPTsecurity-profile NJUPTquit

1.7.6 配置AP组

[AC1-wlan-view]quit[AC1]wlan [AC1-wlan-view]ap-group name g1[AC1-wlan-ap-group-g1]quit

拷贝代码wlan ap-group name g1quit

1.7.7 配置AP上线

[AC1-wlan-view]quit[AC1]wlan[AC1-wlan-view] ap-id 0 type-id 69 ap-mac 00e0-fc0f-72c0 ap-sn 210235448310094D735A[AC1-wlan-ap-0] ap-name AP1[AC1-wlan-ap-0] ap-group g1Warning: This operation may cause AP reset. If the country code changes, it will clear channel,power and antenna gain configurations of the radio, Whether to continue? [Y/N]:y[AC1-wlan-ap-0]quit

拷贝代码wlanap-id 0 type-id 69 ap-mac 00e0-fc0f-72c0 ap-sn 210235448310094D735Aap-name AP1ap-group g1

拷贝代码yquit

1.7.8 配置射频口

[AC1-wlan-view]quit[AC1]wlan[AC1-wlan-view][AC1-wlan-view]ap-group name g1[AC1-wlan-ap-group-g1][AC1-wlan-ap-group-g1]vap-profile NJUPT wlan 1 radio all [AC1-wlan-ap-group-g1][AC1-wlan-ap-group-g1]quit[AC1-wlan-view]

拷贝代码wlanap-group name g1vap-profile NJUPT wlan 1 radio all quit

1.8 配置OSPF

1.8.1 局域网OSPF配置

1. 在 GL 校区内部，使用 OSPF 协议进行网络互联。Agg1—Core1 之间运行 OSPF，互连网段为 10.1.79.0/24；在 Agg2—Core1 之间运行 OSPF，互连网段为10.1.89.0/24。OSPF 进程号为 1，区域号为 0。2. 在 XL 校区内部，使用 OSPF 协议进行网络互联。Agg3—Core3 之间运行 OSPF，互连网段为10.1.56.0/24。OSPF 进程号为 1，区域号为 0。3. DC1—Core3 之间运行 OSPF，互连网段为 10.1.201.0/24。OSPF 进程号为 1，区域号为 0。4. 在 Agg1、Agg2，将 VLANif10、VLANif40 的直连网段通告入 OSPF 区域 0。5. 在 Agg3，将 VLANif50 的直连网段通告入 OSPF 区域 0。OSPF 通告时，主机所在的直连网段，整网段宣告；互连网段精确宣告。比如Agg1 的 VLANif10 接口网段，通过 network 192.168.10.0 0.0.0.255 整网段通告；在Agg1 上，与 Core1 互连的 VLANif105 接口网段，通过 network 10.1.79.7 0.0.0.0 精 确通告。

在Agg1上配置OSPF

[Agg1-Vlanif40]quit[Agg1]ospf 1 router-id 10.1.7.7[Agg1-ospf-1]area 0.0.0.0[Agg1-ospf-1-area-0.0.0.0]network 192.168.10.0 0.0.0.255[Agg1-ospf-1-area-0.0.0.0]network 192.168.40.0 0.0.0.255[Agg1-ospf-1-area-0.0.0.0]network 10.1.79.7 0.0.0.0[Agg1-ospf-1-area-0.0.0.0]quit[Agg1-ospf-1]quit

拷贝代码quitospf 1 router-id 10.1.7.7area 0.0.0.0network 192.168.10.0 0.0.0.255network 192.168.40.0 0.0.0.255network 10.1.79.7 0.0.0.0quitquit

在Core1上配置OSPF

[Core1]ospf 1 router-id 10.1.9.9 [Core1-ospf-1] area 0.0.0.0 [Core1-ospf-1-area-0.0.0.0] network 10.1.79.9 0.0.0.0 [Core1-ospf-1-area-0.0.0.0] network 10.1.89.9 0.0.0.0 [Core1-ospf-1-area-0.0.0.0]quit[Core1-ospf-1]quit

拷贝代码sysospf 1 router-id 10.1.9.9 area 0.0.0.0 network 10.1.79.9 0.0.0.0 network 10.1.89.9 0.0.0.0 quitquit

在Agg2上配置OSPF

[Agg2-Vlanif10]quit[Agg2]ospf 1 router-id 10.1.8.8[Agg2-ospf-1] area 0.0.0.0[Agg2-ospf-1-area-0.0.0.0] network 10.1.89.8 0.0.0.0[Agg2-ospf-1-area-0.0.0.0] network 192.168.10.0 0.0.0.255[Agg2-ospf-1-area-0.0.0.0]quit[Agg2-ospf-1]quit

拷贝代码quitospf 1 router-id 10.1.8.8area 0.0.0.0network 10.1.89.8 0.0.0.0network 192.168.10.0 0.0.0.255quitquit

在Core3上配置OSPF

[Core3]ospf 1 router-id 10.1.128.6 [Core3-ospf-1] area 0.0.0.0 [Core3-ospf-1-area-0.0.0.0] network 10.1.56.6 0.0.0.0 [Core3-ospf-1-area-0.0.0.0] network 10.1.201.6 0.0.0.0 [Core3-ospf-1-area-0.0.0.0]quit[Core3-ospf-1]quit

拷贝代码sysospf 1 router-id 10.1.128.6 area 0.0.0.0 network 10.1.56.6 0.0.0.0 network 10.1.201.6 0.0.0.0 quitquit

在DC1上配置OSPF

[DC1]ospf 1[DC1-ospf-1] area 0.0.0.0[DC1-ospf-1-area-0.0.0.0] network 10.1.201.5 0.0.0.0[DC1-ospf-1-area-0.0.0.0]quit[DC1-ospf-1]quit

拷贝代码ospf 1area 0.0.0.0network 10.1.201.5 0.0.0.0quitquit

在Agg3上配置OSPF

[Agg3-Vlanif50]quit[Agg3]ospf 1 router-id 10.1.128.5[Agg3-ospf-1] area 0.0.0.0[Agg3-ospf-1-area-0.0.0.0] network 192.168.50.0 0.0.0.255[Agg3-ospf-1-area-0.0.0.0] network 10.1.56.5 0.0.0.0[Agg3-ospf-1-area-0.0.0.0]quit[Agg3-ospf-1]quit

拷贝代码quitospf 1 router-id 10.1.128.5area 0.0.0.0network 192.168.50.0 0.0.0.255network 10.1.56.5 0.0.0.0quitquit

1.8.2 OSPF选路配置

在 GL—XL 校区间，从 2 个运营商，分别租了 1 条 WAN 链路：从运营商 ISP1 租用裸光纤（命名为WAN1）；从运营商 ISP2 租用 WDM 电路（命名为 WAN2。在实验中，采用S57 模拟 WDM 设备 T1、T2）。1. 通过 WAN1、WAN2，Core1—Core3 建立 2 对 OSPF 邻居。2. GL—XL 校区间互通优选 WAN2：WAN1 的 OSPF 链路 cost=3，WAN2 的 OSPF 链路cost=1。cost 已预配3. 研究生宿舍 1、研究生教学 1、本科生教学 1，可以互相 ping 通。

在Core1上做OSPF的配置并修改G2/0/0口的开销为3

[Core1-ospf-1]ospf 1 router-id 10.1.9.9 [Core1-ospf-1] area 0[Core1-ospf-1-area-0.0.0.0] network 10.2.69.9 0.0.0.0 [Core1-ospf-1-area-0.0.0.0] network 10.3.69.9 0.0.0.0 [Core1-ospf-1-area-0.0.0.0]interface GigabitEthernet2/0/0 [Core1-GigabitEthernet2/0/0] ospf cost 3[Core1-GigabitEthernet2/0/0]quit

拷贝代码ospf 1 router-id 10.1.9.9 area 0network 10.2.69.9 0.0.0.0 network 10.3.69.9 0.0.0.0 interface GigabitEthernet2/0/0 ospf cost 3quit

在Core3上做OSPF的配置并修改G2/0/0口的开销为3

[Core3]ospf 1 router-id 10.1.128.6 [Core3-ospf-1] area 0[Core3-ospf-1-area-0.0.0.0] network 10.2.69.6 0.0.0.0 [Core3-ospf-1-area-0.0.0.0] network 10.3.69.6 0.0.0.0 [Core3-ospf-1-area-0.0.0.0]interface GigabitEthernet2/0/0[Core3-GigabitEthernet2/0/0]ospf cost 3

拷贝代码ospf 1 router-id 10.1.128.6 area 0network 10.2.69.6 0.0.0.0 network 10.3.69.6 0.0.0.0 interface GigabitEthernet2/0/0ospf cost 3

1.8.3 OSPF和BFD联动配置

T1—T2 之间的光缆被挖断后，Core1、Core3 需要 40s（OSPF 的 dead-interval）才能感知该故障。为了缩短该段光缆故障的感知时间，在 Core1、Core3 配置 OSPF 与 BFD 联动：BFD 的最小发送、接收间隔，都设为 30ms。这样，T1—T2 之间的光缆被挖断后，Core1、Core3 仅需要 90ms 就能够感知该故障。

在Core1上配置BFD，并修改BFD报文发送的时间间隔

[Core1]bfd[Core1-bfd]quit[Core1]ospf 1 [Core1-ospf-1] bfd all-interfaces enable[Core1-ospf-1]quit[Core1]interface GigabitEthernet2/0/0[Core1-GigabitEthernet2/0/0] ospf bfd enable[Core1-GigabitEthernet2/0/0] ospf bfd min-tx-interval 30 min-rx-interval 30[Core1-GigabitEthernet2/0/0]quit[Core1]interface GigabitEthernet2/0/2[Core1-GigabitEthernet2/0/2] ospf bfd enable[Core1-GigabitEthernet2/0/2] ospf bfd min-tx-interval 30 min-rx-interval 30[Core1-GigabitEthernet2/0/2]quit

拷贝代码bfdquitospf 1 bfd all-interfaces enablequitinterface GigabitEthernet2/0/0 ospf bfd enable ospf bfd min-tx-interval 30 min-rx-interval 30quitinterface GigabitEthernet2/0/2 ospf bfd enable ospf bfd min-tx-interval 30 min-rx-interval 30quit

在Core3上配置BFD，并修改BFD报文发送的时间间隔

[Core3-GigabitEthernet2/0/0]quit[Core3]ospf 1 [Core3-ospf-1] bfd all-interfaces enable[Core3-ospf-1]quit[Core3]interface GigabitEthernet2/0/0[Core3-GigabitEthernet2/0/0] ospf bfd enable[Core3-GigabitEthernet2/0/0] ospf bfd min-tx-interval 30 min-rx-interval 30[Core3-GigabitEthernet2/0/0]quit[Core3]interface GigabitEthernet2/0/2[Core3-GigabitEthernet2/0/2] ospf bfd enable[Core3-GigabitEthernet2/0/2] ospf bfd min-tx-interval 30 min-rx-interval 30

拷贝代码quitbfdospf 1 bfd all-interfaces enablequitinterface GigabitEthernet2/0/0ospf bfd enableospf bfd min-tx-interval 30 min-rx-interval 30quitinterface GigabitEthernet2/0/2ospf bfd enableospf bfd min-tx-interval 30 min-rx-interval 30

1.9 BGP

跨组织间的路由学习，必须通过 EBGP 协议。本实验中，某网上购物 ICP 的 Taobao1路由器与教育网的 SR1 路由器之间，通过 EBGP 互通。1. Taobao1—SR1 通过互连接口建立 EBGP 邻居。2. Taobao1 在 AS 24429，将业务地址 14.4.4.4/32，通过 network 通告到 BGP。3. SR1 在 AS 4538，将直连网段 210.28.1.0/27、223.2.1.0/26，通过 network 通告到BGP。Taobao1 学习到 210.28.1.0/27、223.2.1.0/26，SR1 学习到 14.4.4.4/32。

在Taobao1上配置BGP

[Taobao1]bgp 24429[Taobao1-bgp] peer 14.1.1.2 as-number 4538 [Taobao1-bgp] network 14.4.4.4 255.255.255.255[Taobao1-bgp]quit

拷贝代码sysbgp 24429peer 14.1.1.2 as-number 4538 network 14.4.4.4 255.255.255.255quit

在SR1上配置BGP

[SR1]bgp 4538[SR1-bgp] peer 14.1.1.1 as-number 24429 [SR1-bgp] network 210.28.1.0 255.255.255.224 [SR1-bgp] network 223.2.1.0 255.255.255.192[SR1-bgp]quit

拷贝代码sysbgp 4538peer 14.1.1.1 as-number 24429 network 210.28.1.0 255.255.255.224 network 223.2.1.0 255.255.255.192quit

1.10 静态路由

Core1 通过静态默认路由访问 Internet，下一跳为 210.28.1.1。Core3 通过静态默认路由访问 Internet，下一跳为 223.2.1.1。

在Core1上配置静态路由

[Core1]ip route-static 0.0.0.0 0.0.0.0 210.28.1.1

拷贝代码ip route-static 0.0.0.0 0.0.0.0 210.28.1.1

在Core3上配置静态路由

[Core3-GigabitEthernet2/0/2]quit[Core3]ip route-static 0.0.0.0 0.0.0.0 223.2.1.1

拷贝代码quitip route-static 0.0.0.0 0.0.0.0 223.2.1.1

1.11 OSPF引入路由

在 Core1，将静态默认路由引入 OSPF。

[Core1]ospf 1[Core1-ospf-1] default-route-advertise always[Core1-ospf-1] import-route static[Core1-ospf-1]quit

拷贝代码ospf 1default-route-advertise alwaysimport-route staticquit

在 Core3，将静态默认路由引入 OSPF。

[Core3]ospf 1[Core3-ospf-1] default-route-advertise always[Core3-ospf-1] import-route static

拷贝代码ospf 1default-route-advertise alwaysimport-route static

1.12 NAT配置

1. 在 Core1 的 GE0/0/0，通过 NAPT，将 192.168.0.0/16 的私网地址，转换为210.28.1.3—210.28.1.30 的公网地址。2. 在 Core3 的 GE0/0/0，通过 NAPT，将 192.168.0.0/16 的私网地址，转换为223.2.1.3—223.2.1.30 的公网地址。以上 ACL 均使用基本 ACL，编号 2000，rule 编号从 5 开始，采用默认步长。NAT address-group 的编号为 1。研究生宿舍 1、研究生教学 1、本科生教学 1，都能够 ping 通 Taobao1 的业务地址14.4.4.4，实现网上购物的网络层可达。

1.12.1 在Core1上配置NAT

在Core1上配置ACL 2000

[Core1]acl number 2000 [Core1-acl-basic-2000] rule 5 permit source 192.168.10.0 0.0.0.255 [Core1-acl-basic-2000] rule 10 permit source 192.168.40.0 0.0.0.255 [Core1-acl-basic-2000]quit

拷贝代码acl number 2000 rule 5 permit source 192.168.10.0 0.0.0.255 rule 10 permit source 192.168.40.0 0.0.0.255 quit

在Core1上配置地址池

[Core1]nat address-group 1 210.28.1.3 210.28.1.30

拷贝代码nat address-group 1 210.28.1.3 210.28.1.30

在Core1上配置nat

[Core1]interface GigabitEthernet0/0/0[Core1-GigabitEthernet0/0/0] nat outbound 2000 address-group 1

拷贝代码interface GigabitEthernet0/0/0nat outbound 2000 address-group 1

1.12.2 在Core3上配置NAT

在Core3上配置ACL 2000

[Core3-ospf-1]quit[Core3]acl number 2000 [Core3-acl-basic-2000] rule 5 permit source 192.168.50.0 0.0.0.255 [Core3-acl-basic-2000]quit

拷贝代码quitacl number 2000 rule 5 permit source 192.168.50.0 0.0.0.255quit

在Core3上配置地址池

[Core3] nat address-group 1 223.2.1.3 223.2.1.30

拷贝代码 nat address-group 1 223.2.1.3 223.2.1.30

在Core3上配置NAT

[Core3]interface GigabitEthernet0/0/0[Core3-GigabitEthernet0/0/0] nat outbound 2000 address-group 1 [Core3-GigabitEthernet0/0/0]quit

拷贝代码interface GigabitEthernet0/0/0nat outbound 2000 address-group 1quit

2.实验验证

2.1 查看OSPF邻居表

查看Core1的OSPF邻居表

display ospf peer brief

拷贝代码display ospf peer brief

查看Core3的OSPF邻居表

display ospf peer brief

拷贝代码display ospf peer brief

2.2 查看BGP邻居表

查看Taobao1的BGP邻居表display bgp peer

拷贝代码display bgp peer

2.3 查看网关设备的路由表

查看Agg1的路由表display ip routing-table

拷贝代码display ip routing-table

查看Agg2的路由表

display ip routing-table

拷贝代码display ip routing-table

查看Agg3的路由表

display ip routing-table

拷贝代码display ip routing-table

查看Taobao1的路由表display ip routing-table

拷贝代码display ip routing-table

查看SR1的路由display ip routing-table

拷贝代码display ip routing-table

2.4 查看AP的状态

display ap all

拷贝代码display ap all

2.5 查看终端地址获取情况

查看无线终端地址获取情况

STA>ipconfig

拷贝代码ipconfig

查看有线终端本科生教学1的地址获取情况

PC>ipconfig

拷贝代码ipconfig

2.6 查看终端业务互通性

从终端本课程教学1ping测研究生教学1和研究生宿舍1

PC>ping 192.168.10.10PC>ping 192.168.40.253

拷贝代码ping 192.168.10.10

拷贝代码ping 192.168.40.253

从研究生教学1ping测研究生宿舍1

PC>ping 192.168.40.253

拷贝代码ping 192.168.40.253

2.7 查看是否可上网

从所有终端分别ping测14.4.4.4

PC>ping 14.4.4.4

拷贝代码ping 14.4.4.4

拷贝代码ping 14.4.4.4

拷贝代码ping 14.4.4.4

版权声明：本文内容由网络用户投稿，版权归原作者所有，本站不拥有其著作权，亦不承担相应法律责任。如果您发现本站中有涉嫌抄袭或描述失实的内容，请联系我们jiasou666@gmail.com 处理，核实后本网站将在24小时内删除侵权内容。