一、设计需求:
1)经理室、设备科、人事处,可以访问外部网络,外部网络不能访问经理室、设备科、人事处,财务部不允许访问外部网络。
2)经理室可以访问设备科,财务部,人事处。
3)人事处和设备科可以互访,但人事处和设备科与财务部不能互访。
4)通过帧中继,实现云两端的路由能够通信。
二、网络拓扑
3.根据拓扑图和实验需求,我们分析一下整体的网络,首先要在二层交换机上配置vlan,并且把相应的端口加入,而在三层交换机上配置vlan间路由,在R1和三层交换机上配置一个路由协议EIGRP,需要注意的是R1上的s1/0端口不行宣告进动态路由协议,我们需要配置一条默认路由指向外网,我们需要实现经理室、设备科、人事处,可以访问外部网络,外部网络不能访问经理室、设备科、人事处,财务部不允许访问外部网络。就需要在R1上配置PAT,以实现需求,
要实现经理室可以访问设备科,财务部,人事处,人事处和设备科可以互访,但人事处和设备科与财务部不能互访。可以在三层交换机上配置ACL,并且在vlan中应用,并且要注意ACL的应用方向,最后就是配置一个帧中继网络了。
4.现在我们分析完整个网络就开始配置了
SW1:
Switch(config)#vlan 10
Switch(config-vlan)#vlan 20
Switch(config-vlan)#vlan 30
Switch(config-vlan)#ex
Switch(config)#int f0/1
Switch(config-if)#sw
Switch(config-if)#switchport a
Switch(config-if)#switchport access v
Switch(config-if)#switchport access vlan 10
Switch(config-if)#int f0/2
Switch(config-if)#sw
Switch(config-if)#switchport a
Switch(config-if)#switchport access v
Switch(config-if)#switchport access vlan 20
Switch(config-if)#int f0/3
Switch(config-if)#sw
Switch(config-if)#switchport a
Switch(config-if)#switchport access v
Switch(config-if)#switchport access vlan 30
Switch(config-if)#int f0/10
Switch(config-if)#sw
Switch(config-if)#switchport m
Switch(config-if)#switchport mode t
Switch(config-if)#switchport mode trunk
%LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/10, changed state to down
%LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/10, changed state to up
Switch(config-if)#int f0/15
Switch(config-if)#sw
Switch(config-if)#switchport m
Switch(config-if)#switchport mode t
Switch(config-if)#switchport mode trunk
SW2:
Switch(config)#vlan 10
Switch(config-vlan)#vlan 20
Switch(config-vlan)#vlan 30
Switch(config-vlan)#int f0/4
Switch(config-if)#sw
Switch(config-if)#switchport a
Switch(config-if)#switchport access v
Switch(config-if)#switchport access vlan 10
Switch(config-if)#int f0/5
Switch(config-if)#sw
Switch(config-if)#switchport a
Switch(config-if)#switchport access v
Switch(config-if)#switchport access vlan 20
Switch(config-if)#int f0/6
Switch(config-if)#sw
Switch(config-if)#switchport a
Switch(config-if)#switchport access v
Switch(config-if)#switchport access vlan 30
Switch(config-if)#int f0/10
Switch(config-if)#sw
Switch(config-if)#switchport m
Switch(config-if)#switchport mode t
Switch(config-if)#switchport mode trunk
Switch(config-if)#int f0/20
Switch(config-if)#sw
Switch(config-if)#switchport m
Switch(config-if)#switchport mode t
Switch(config-if)#switchport mode trunk
%LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/20, changed state to down
%LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/20, changed state to up
注意交换机之间的接口需要设置为trunk
5.在各路由接口,三层交换端口和SVI接口配置相应的ip地址
SW3
Switch(config)#vlan 10
Switch(config-vlan)#vlan 20
Switch(config-vlan)#vlan 30
Switch(config-vlan)#e
Switch(config)#int vlan 10
%LINK-5-CHANGED: Interface Vlan10, changed state to up
%LINEPROTO-5-UPDOWN: Line protocol on Interface Vlan10, changed state to up
Switch(config-if)#ip ad
Switch(config-if)#ip address 10.10.10.254 255.255.255.0
Switch(config-if)#no shut
Switch(config-if)#int vlan 20
%LINK-5-CHANGED: Interface Vlan20, changed state to up
%LINEPROTO-5-UPDOWN: Line protocol on Interface Vlan20, changed state to up
Switch(config-if)#ip ad
Switch(config-if)#ip address 20.20.20.254 255.255.255.0
Switch(config-if)#no shut
Switch(config-if)#int vlan 30
%LINK-5-CHANGED: Interface Vlan30, changed state to up
%LINEPROTO-5-UPDOWN: Line protocol on Interface Vlan30, changed state to up
Switch(config-if)#ip ad
Switch(config-if)#ip address 30.30.30.254 255.255.255.0
Switch(config-if)#no shut
Switch(config-if)#int f0/1
Switch(config-if)#no sw
Switch(config-if)#no switchport
Switch(config-if)#ip ad
Switch(config-if)#ip address 10.10.0.254 255.255.255.0
Switch(config-if)#no shut
Switch(config-if)#ex
Switch(config)#ip ro
Switch(config)#ip rout
Switch(config)#ip routi
Switch(config)#ip routing
R1:
Router(config)#host Router1
Router1(config)#int f0/1
Router1(config-if)#ip ad
Router1(config-if)#ip address 10.10.0.1 255.255.255.0
Router1(config-if)#no shut
%LINK-5-CHANGED: Interface FastEthernet0/1, changed state to up
%LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/1, changed state to up
Router1(config-if)#int f0/0
Router1(config-if)#ip ad
Router1(config-if)#ip address 10.0.0.1 255.255.255.0
Router1(config-if)#no shut
%LINK-5-CHANGED: Interface FastEthernet0/0, changed state to up
%LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/0, changed state to up
Router(config-if)#int s1/0
Router(config-if)#ip ad
Router1(config-if)#ip address 11.1.1.2 255.255.255.0
Router1(config-if)#no shut
%LINK-5-CHANGED: Interface Serial1/0, changed state to down
Router1(config-if)#cla
Router1(config-if)#cl
Router1(config-if)#clock r
Router1(config-if)#clock rate 64000
R2:
Router(config)#host Router2
Router2(config)#int s1/1
Router2(config-if)#ip ad
Router2(config-if)#ip address 11.1.1.1 255.255.255.0
Router2(config-if)#no shut
%LINK-5-CHANGED: Interface Serial1/1, changed state to up
Router(config-if)#int s1/0
Router(config-if)#ip a
%LINEPROTO-5-UPDOWN: Line protocol on Interface Serial1/1, changed state to up
d
Router2(config-if)#ip address 12.1.1.1 255.255.255.0
Router2(config-if)#no shut
Router2(config-if)#
%LINK-5-CHANGED: Interface Serial1/0, changed state to up
R3:
Router(config)#host Router3
Router3(config)#int s1/1
Router3(config-if)#ipa d
Router3(config-if)#ipad
Router3(config-if)#ipaddress 12.1.1.2 255.255.255.0
Router3(config-if)#no shut
注意三层交换机上要打开路由端口才可以配置ip地址还有要开启三层交换机的路由功能,还有就是PC的ip就要自己去配置了,这里就不讲了。
6.现在在R1和三层交换机上配置EIGRP协议,以便让内网互通
SW3:
Switch(config)#router eigrp 100
Switch(config-router)#net
Switch(config-router)#network 10.10.10.0 0.0.0.255
Switch(config-router)#network 20.20.20.0 0.0.0.255
Switch(config-router)#network 30.30.30.0 0.0.0.255
Switch(config-router)#network 10.10.0.0 0.0.0.255
R1:
Router1(config)#router eigrp 100
Router1(config-router)#net
Router1(config-router)#network 10.0.0.0 0.0.0.255
Router1(config-router)#network 10.10.0.0 0.0.0.255
Router(config-router)#
%DUAL-5-NBRCHANGE: IP-EIGRP 100: Neighbor 10.10.0.254 (FastEthernet0/1) is up: new adjacency
现在我们来测试一下内网是否可以互达
现在我们用设备科的pc1分别ping人事处财务部经理室
PC>ping 30.30.30.2
Pinging 30.30.30.2 with 32 bytes of data:
Reply from 30.30.30.2: bytes=32 time=11ms TTL=127
Reply from 30.30.30.2: bytes=32 time=17ms TTL=127
Reply from 30.30.30.2: bytes=32 time=17ms TTL=127
Reply from 30.30.30.2: bytes=32 time=9ms TTL=127
Ping statistics for 30.30.30.2:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 9ms, Maximum = 17ms, Average = 13ms
PC>ping 20.20.20.2
Pinging 20.20.20.2 with 32 bytes of data:
Reply from 20.20.20.2: bytes=32 time=8ms TTL=127
Reply from 20.20.20.2: bytes=32 time=13ms TTL=127
Reply from 20.20.20.2: bytes=32 time=16ms TTL=127
Reply from 20.20.20.2: bytes=32 time=14ms TTL=127
Ping statistics for 20.20.20.2:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 8ms, Maximum = 16ms, Average = 12ms
PC>ping 10.0.0.2
Pinging 10.0.0.2 with 32 bytes of data:
Reply from 10.0.0.2: bytes=32 time=12ms TTL=126
Reply from 10.0.0.2: bytes=32 time=13ms TTL=126
Reply from 10.0.0.2: bytes=32 time=10ms TTL=126
Reply from 10.0.0.2: bytes=32 time=14ms TTL=126
Ping statistics for 10.0.0.2:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 10ms, Maximum = 14ms, Average = 12ms
显然内网全网可达,
再ping一下外网地址
PC>ping 11.1.1.1
Pinging 11.1.1.1 with 32 bytes of data:
Request timed out.
Request timed out.
Request timed out.
Request timed out.
Ping statistics for 11.1.1.1:
Packets: Sent = 4, Received = 0, Lost = 4 (100% loss),
显然不通
但是我们需要实现经理室、设备科、人事处,可以访问外部网络,外部网络不能访问经理室、设备科、人事处,财务部不允许访问外部网络。就需要在R1上配置PAT,以实现需求,
要实现经理室可以访问设备科,财务部,人事处,人事处和设备科可以互访,但人事处和设备科与财务部不能互访。可以在三层交换机上配置ACL,并且在vlan中应用,并且要注意ACL的应用方向现在开始配置
7.就需要在R1上配置PAT,三层交换机上配置ACL
R1:
Router1(config)#int f0/0
Router1(config-if)#ip na
Router1(config-if)#ip nat i
Router1(config-if)#ip nat inside
Router(config-if)#int f0/1
Router1(config-if)#ip na
Router1(config-if)#ip nat i
Router1(config-if)#ip nat inside
Router1(config-if)#int s1/0
Router1(config-if)#ip na
Router1(config-if)#ip nat o
Router1(config-if)#ip nat outside
Router1(config-if)#ex
Router1(config)#ac
Router1(config)#access-list 1 d
Router1(config)#access-list 1 deny 20.20.20.0 0.0.0.255
Router1(config)#ac
Router1(config)#access-list 1 p
Router1(config)#access-list 1 permit a
Router1(config)#access-list 1 permit any
Router1(config)#ip rou
Router1(config)#ip route 0.0.0.0 0.0.0.0 11.1.1.1
Router1(config)#rou
Router1(config)#router e
Router1(config)#router eigrp 100
Router1(config-router)#re
Router1(config-router)#redistribute s
Router1(config-router)#redistribute static
SW3:
Switch(config)#access-list 100 permit icmp 20.20.20.0 0.0.0.255 10.0.0.0 0.0.0.255
Switch(config)#int vlan 20
Switch(config-if)#ip a
Switch(config-if)#ip-
Switch(config-if)#ip ac
Switch(config-if)#ip access-group 100 in
Switch(config-if)#
配置完成后,再ping一下外网
PC>ping 11.1.1.1
Pinging 11.1.1.1 with 32 bytes of data:
Reply from 11.1.1.1: bytes=32 time=88ms TTL=253
Reply from 11.1.1.1: bytes=32 time=15ms TTL=253
Reply from 11.1.1.1: bytes=32 time=21ms TTL=253
Reply from 11.1.1.1: bytes=32 time=19ms TTL=253
Ping statistics for 11.1.1.1:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 15ms, Maximum = 88ms, Average = 35ms
显然可以了
最后只差一个帧中继的网络了
8.配置帧中继网络
R2:
Router2(config)#int s1/0
Router2(config-if)#en
Router2(config-if)#encapsulation
Router2(config-if)#encapsulation f
Router2(config-if)#encapsulation frame-relay
Router2(config-if)#
%LINEPROTO-5-UPDOWN: Line protocol on Interface Serial1/0, changed state to up
Router2(config-if)#f
Router2(config-if)#fr
Router2(config-if)#frame-relay i
Router2(config-if)#frame-relay interface-dlci 203
Router2(config-if)#
R3:
Router3(config)#int s1/1
Router3(config-if)#en
Router3(config-if)#encapsulation f
Router3(config-if)#encapsulation frame-relay
Router3(config-if)#f
Router3(config-if)#fr
Router3(config-if)#frame-relay i
Router3(config-if)#frame-relay interface-dlci 302
Cloud0:
s0
大家这里需要注意一下,这样是不行的,以前自己粗心忘记按下ADD了,按下的效果是这样的
s1同上
好了我们这样子就已经做完全部的配置了,现在我们来测试实验需求
测试设备科可不可以和财务部互访
PC>ping 20.20.20.2
Pinging 20.20.20.2 with 32 bytes of data:
Request timed out.
Request timed out.
Request timed out.
Request timed out.
Ping statistics for 20.20.20.2:
Packets: Sent = 4, Received = 0, Lost = 4 (100% loss),
显然不可以
9.测试财务部可不可以和经理室互访
PC>ping 10.0.0.2
Pinging 10.0.0.2 with 32 bytes of data:
Reply from 10.0.0.2: bytes=32 time=15ms TTL=126
Reply from 10.0.0.2: bytes=32 time=14ms TTL=126
Reply from 10.0.0.2: bytes=32 time=18ms TTL=126
Reply from 10.0.0.2: bytes=32 time=18ms TTL=126
Ping statistics for 10.0.0.2:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 14ms, Maximum = 18ms, Average = 16ms
显然可以
测试财务部可不可以访问外网
PC>ping 11.1.1.1
Pinging 11.1.1.1 with 32 bytes of data:
Reply from 20.20.20.254: Destination host unreachable.
Reply from 20.20.20.254: Destination host unreachable.
Reply from 20.20.20.254: Destination host unreachable.
Reply from 20.20.20.254: Destination host unreachable.
Ping statistics for 11.1.1.1:
Packets: Sent = 4, Received = 0, Lost = 4 (100% loss),
显然不可以
测试外网可不可以访问内网
Router#ping 10.10.10.2
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.10.10.2, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)
显然不可以
10.写到这里有的人又说,现在为了实现企业网络的高性价比呢?不可能都是cisco的设备呢?那么就不可以在内网中用EIGRP了,那么又如何配置呢?
第二种协议ospf当然基本配置大家要自己去配置了,这里指出不一样的是静态路由的重分布,命令如下
Router1
Router1(config)#router os
Router1(config)#router ospf 110
Router1(config-router)#de
Router1(config-router)#default-information
Router1(config-router)#default-informationoriginate
11.第三种rip就是应用于内部网络比较小的情况了,这里是版本2的,有版本1和2的区别,至于想知道去别的,自己去百度了(呵呵)
Router1
Router1(config)#ip route 0.0.0.0 0.0.0.0 11.1.1.1
Router1(config)#router rip
Router(config-router)#version 2
Router1(config-router)#redistribute static
文章可能存在很多的问题,希望大家可以帮我指出。