ensp模拟数据中心网络

拓扑图

MSTP可阻塞二层网络中的冗余链路，将网络修建成树状，达到消除环路的目的。同时在SW1和SW2上配置VRRP，PC1以SW1为默认网关接入Internet，SW2作为备份网关；PC3以SW2为默认网关接入Internet，SW1作为备份网关以实现可靠性及流量的负载分担。
SW1交换机：配置vlan2地址为172.16.2.253/24，配置vlan7地址为172.16.7.253/24.
SW2交换机：配置vlan2地址为172.16.2.252/24，配置vlan7地址为172.16.7.252/24.
VRRP配置vlan2用户网络虚拟网关为172.16.2.254，配置vlan7用户网络虚拟网关为172.16.7.254.

防火墙使用USG5500

FW1防火墙配置

<SRG>system-view 
[SRG]sysname FW1
[FW1]interface GigabitEthernet 0/0/0
[FW1-GigabitEthernet0/0/0]ip address 192.168.2.1 24
[FW1-GigabitEthernet0/0/0]qu
[FW1]interface GigabitEthernet 0/0/1
[FW1-GigabitEthernet0/0/1]ip address 192.168.3.1 24
[FW1-GigabitEthernet0/0/1]qu
[FW1]interface GigabitEthernet 0/0/2
[FW1-GigabitEthernet0/0/2]ip address 192.168.12.9 24
[FW1-GigabitEthernet0/0/2]qu
[FW1]firewall zone trust 
[FW1-zone-trust]add interface GigabitEthernet 0/0/0
[FW1-zone-trust]add interface GigabitEthernet 0/0/1
14:24:35  2020/04/23
[FW1-zone-trust]qu
[FW1]firewall zone untrust 
[FW1-zone-untrust]add interface GigabitEthernet 0/0/2
[FW1-zone-untrust]qu
[FW1]policy interzone trust untrust outbound 
[FW1-policy-interzone-trust-untrust-outbound]policy 0
[FW1-policy-interzone-trust-untrust-outbound-0]action permit 
[FW1-policy-interzone-trust-untrust-outbound-0]policy source 172.16.2.0 0.0.0.25
5
[FW1-policy-interzone-trust-untrust-outbound-0]policy source 172.16.7.0 0.0.0.25
5
[FW1-policy-interzone-trust-untrust-outbound-0]qu
[FW1-policy-interzone-trust-untrust-outbound]qu
[FW1]nat-policy interzone trust untrust outbound 	
[FW1-nat-policy-interzone-trust-untrust-outbound]policy 1	
[FW1-nat-policy-interzone-trust-untrust-outbound-1]action source-nat 	
[FW1-nat-policy-interzone-trust-untrust-outbound-1]policy source 172.16.2.0 0.0.
0.255	
[FW1-nat-policy-interzone-trust-untrust-outbound-1]policy source 172.16.7.0 0.0.
0.255
[FW1-nat-policy-interzone-trust-untrust-outbound-1]easy-ip GigabitEthernet 0/0/2
[FW1-nat-policy-interzone-trust-untrust-outbound-1]qu
[FW1-nat-policy-interzone-trust-untrust-outbound]qu
[FW1]ip route-static 0.0.0.0 0 192.168.12.1	
[FW1]ospf 1
[FW1-ospf-1]default-route-advertise always cost 200 type 1
[FW1-ospf-1]area 0
[FW1-ospf-1-area-0.0.0.0]network 192.168.2.0 0.0.0.255
[FW1-ospf-1-area-0.0.0.0]network 192.168.3.0 0.0.0.255

S1交换机配置

<Huawei>system-view 
[Huawei]sysname SW1
[SW1]vlan batch 2 7 102 103
[SW1]interface Vlanif 102
[SW1-Vlanif102]ip address 192.168.2.2 24
[SW1-Vlanif102]qu
[SW1]interface GigabitEthernet 0/0/4	
[SW1-GigabitEthernet0/0/4]port link-type access 
[SW1-GigabitEthernet0/0/4]port default vlan 102
[SW1-GigabitEthernet0/0/4]qu
[SW1]interface GigabitEthernet 0/0/1
[SW1-GigabitEthernet0/0/1]port link-type trunk 
[SW1-GigabitEthernet0/0/1]port trunk allow-pass vlan 2 7 102 103
[SW1-GigabitEthernet0/0/1]qu
[SW1]interface GigabitEthernet 0/0/3
[SW1-GigabitEthernet0/0/3]port link-type trunk 
[SW1-GigabitEthernet0/0/3]port trunk allow-pass vlan 2 7 102 103
[SW1-GigabitEthernet0/0/3]qu
[SW1]interface Eth-Trunk0
[SW1-Eth-Trunk0]port link-type trunk 
[SW1-Eth-Trunk0]por	
[SW1-Eth-Trunk0]port tr	
[SW1-Eth-Trunk0]port trunk all	
[SW1-Eth-Trunk0]port trunk allow-pass vlan 2 7 102 to 103
[SW1-Eth-Trunk0]trunkport GigabitEthernet 0/0/2
[SW1-Eth-Trunk0]trunkport GigabitEthernet 0/0/5	
[SW1-Eth-Trunk0]qu
[SW1]interface Vlanif 2
[SW1-Vlanif2]ip address 172.16.2.253 24
[SW1-Vlanif2]vrrp vrid 1 virtual-ip 172.16.2.254
[SW1-Vlanif2]vrrp vrid 1 priority 120
[SW1-Vlanif2]vrrp vrid 1 track interface GigabitEthernet 0/0/4 reduced 15
[SW1-Vlanif2]vrrp vrid 1 track interface Eth-Trunk 0 reduced 15
[SW1-Vlanif2]qu
[SW1]interface Vlanif 7
[SW1-Vlanif7]ip address 172.16.7.253 24
[SW1-Vlanif7]vrrp vrid 2 virtual-ip 172.16.7.254
[SW1-Vlanif7]qu
[SW1]ip route-static 0.0.0.0 0 192.168.2.1
[SW1]stp region-configuration 
[SW1-mst-region]region-name RG1
[SW1-mst-region]instance 1 vlan 2
[SW1-mst-region]instance 2 vlan 7
[SW1-mst-region]active region-configuration 
[SW1-mst-region]qu
[SW1]stp instance 1 root primary 
[SW1]stp instance 2 root secondary 
[SW1]stp pathcost-standard legacy 
[SW1]stp enable 
[SW1]ospf 1
[SW1-ospf-1]area 0
[SW1-ospf-1-area-0.0.0.0]network 192.168.2.0 0.0.0.255
[SW1-ospf-1-area-0.0.0.0]network 172.16.2.0 0.0.0.255
[SW1-ospf-1-area-0.0.0.0]network 172.16.7.0 0.0.0.255

S2交换机配置

<Huawei>system-view 
[Huawei]sysname SW2
[SW2]vlan batch 2 7 102 103
[SW2]interface GigabitEthernet 0/0/4
[SW2-GigabitEthernet0/0/4]port link-type access 
[SW2-GigabitEthernet0/0/4]port default vlan 103
[SW2-GigabitEthernet0/0/4]qu
[SW2]interface GigabitEthernet 0/0/1
[SW2-GigabitEthernet0/0/1]port link-type trunk 
[SW2-GigabitEthernet0/0/1]port trunk allow-pass vlan 2 7 102 103
[SW2-GigabitEthernet0/0/1]qu
[SW2]interface GigabitEthernet 0/0/3
[SW2-GigabitEthernet0/0/3]port link-type trunk 
[SW2-GigabitEthernet0/0/3]port trunk allow-pass vlan 2 7 102 103
[SW2-GigabitEthernet0/0/3]qu
[SW2]interface Eth-Trunk 0
[SW2-Eth-Trunk0]port link-type trunk 
[SW2-Eth-Trunk0]port trunk allow-pass vlan 2 7 102 to 103
[SW2-Eth-Trunk0]trunkport GigabitEthernet 0/0/2
[SW2-Eth-Trunk0]trunkport GigabitEthernet 0/0/5
[SW2-Eth-Trunk0]qu
[SW2]interface Vlanif 103
[SW2-Vlanif103]ip address 192.168.3.2 24
[SW2-Vlanif103]qu
[SW2]interface Vlanif 2	
[SW2-Vlanif2]ip address 172.16.2.252 24
[SW2-Vlanif2]vrrp vrid 1 virtual-ip 172.16.2.254
[SW2-Vlanif2]qu
[SW2]interface Vlanif 7
[SW2-Vlanif7]ip address 172.16.7.252 24
[SW2-Vlanif7]vrrp vrid 2 virtual-ip 172.16.7.254
[SW2-Vlanif7]vrrp vrid 2 priority 120
[SW2-Vlanif7]vrrp vrid 2 track interface GigabitEthernet 0/0/4 reduced 15
[SW2-Vlanif7]vrrp vrid 2 track  interface Eth-Trunk 0 reduced 15
[SW2-Vlanif7]qu
[SW2]ip route-static 0.0.0.0 0 192.168.3.1
[SW2]stp region-configuration 
[SW2-mst-region]region-name RG1
[SW2-mst-region]instance 1 vlan 2
[SW2-mst-region]instance 2 vlan 7
[SW2-mst-region]active region-configuration 
[SW2-mst-region]qu
[SW2]stp instance 1 root secondary 
[SW2]stp instance 2 root primary 
[SW2]stp pathcost-standard legacy 
[SW2]stp enable 
[SW2]ospf 1
[SW2-ospf-1]area 0
[SW2-ospf-1-area-0.0.0.0]network 192.168.3.0 0.0.0.255
[SW2-ospf-1-area-0.0.0.0]network 172.16.2.0 0.0.0.255
[SW2-ospf-1-area-0.0.0.0]network 172.16.7.0 0.0.0.255

S3交换机配置

<Huawei>system-view 
[Huawei]sysname SW3
[SW3]vlan batch 2 7 102 103
[SW3]inte		
[SW3]interface GigabitEthernet 0/0/1
[SW3-GigabitEthernet0/0/1]port link-type trunk 
[SW3-GigabitEthernet0/0/1]port trunk allow-pass vlan 2 7 102 103
[SW3-GigabitEthernet0/0/1]qu
[SW3]interface GigabitEthernet 0/0/2
[SW3-GigabitEthernet0/0/2]port link-type trunk 
[SW3-GigabitEthernet0/0/2]port trunk allow-pass vlan 2 7 102 103
[SW3-GigabitEthernet0/0/2]qu
[SW3]interface GigabitEthernet 0/0/3
[SW3-GigabitEthernet0/0/3]port link-type access 
[SW3-GigabitEthernet0/0/3]port default vlan 2
[SW3-GigabitEthernet0/0/3]qu
[SW3]interface GigabitEthernet 0/0/4
[SW3-GigabitEthernet0/0/4]port link-type access 
[SW3-GigabitEthernet0/0/4]port default vlan 7
[SW3-GigabitEthernet0/0/4]qu
[SW3]stp region-configuration 
[SW3-mst-region]region-name RG1
[SW3-mst-region]instance 1 vlan 2
[SW3-mst-region]instance 2 vlan 7
[SW3-mst-region]active region-configuration 
[SW3-mst-region]qu	
[SW3]stp enable 

SW4配置

<Huawei>system-view 
[Huawei]sysname SW4
[SW4]vlan batch 2 7 102 103
[SW4]interface GigabitEthernet 0/0/1
[SW4-GigabitEthernet0/0/1]port link-type trunk 
[SW4-GigabitEthernet0/0/1]port trunk allow-pass vlan 2 7 102 103
[SW4-GigabitEthernet0/0/1]qu
[SW4]interface GigabitEthernet 0/0/2
[SW4-GigabitEthernet0/0/2]port link-type trunk 
[SW4-GigabitEthernet0/0/2]port trunk allow-pass vlan 2 7 102 103
[SW4-GigabitEthernet0/0/2]qu
[SW4]interface GigabitEthernet 0/0/3	
[SW4-GigabitEthernet0/0/3]port link-type access 
[SW4-GigabitEthernet0/0/3]port default vlan 2
[SW4-GigabitEthernet0/0/3]qu
[SW4]interface GigabitEthernet 0/0/4
[SW4-GigabitEthernet0/0/4]port link-type access 
[SW4-GigabitEthernet0/0/4]port default vlan 7
[SW4-GigabitEthernet0/0/4]qu
[SW4]stp region-configuration 
[SW4-mst-region]region-name RG1
[SW4-mst-region]instance 1 vlan 2
[SW4-mst-region]instance 2 vlan 7
[SW4-mst-region]active region-configuration 
[SW4-mst-region]qu
[SW4]stp enable 

配置PC1和PC3的ip地址


测试能否ping外网，并通过tracert命令查看通信过程所经过的地址