1.1.5. 实现
(一) 划分VLAN
a) 在四台二层交换机上划分VLAN
以二层交换s1为例，配置如下：
Switch(vlan)#vlan 10 name shengchan
VLAN 10 added:
Name: shengchan
Switch(vlan)#vlan 20 name xiaoshou
VLAN 20 added:
Name: xiaoshou
Switch(vlan)#vlan 30 name caiwu
VLAN 30 added:
Name: caiwu
Switch(vlan)#vlan 40 name jishu
VLAN 40 added:
Name: jishu
b) 在两台三层交换机上划分VLAN
以三层交换ms1为例，配置如下：
ms1(vlan)#vlan 10 name shengchan
VLAN 10 added:
Name: shengchan
ms1(vlan)#vlan 20 name xiaoshou
VLAN 20 added:
Name: xiaoshou
ms1(vlan)#vlan 30 name caiwu
VLAN 30 added:
Name: caiwu
ms1(vlan)#vlan 40 name jishu
VLAN 40 added:
Name: jishu
(二) 配置Trunk中继链路
a) 在四台二层交换机上配置中继链路
以二层交换s1为例配置如下：
Switch(config)#interface range f0/1-2
Switch(config-if-range)#switchport access vlan 10
Switch(config-if-range)#exit
Switch(config)#interface range f0/3-4
Switch(config-if-range)#switchport mode trunk
b) 在两台三层交换机上配置中继链路
以三层交换ms1为例配置如下：
ms1(config)#interface range f0/1-4
ms1(config-if-range)#switchport trunk encapsulation dot1q
ms1(config-if-range)#switchport mode trunk
c) 为三层交换虚接口配置IP地址
三层交换ms1配置如下:
ms1(config)#interface vlan 10
ms1(config-if)#ip address 192.168.10.252 255.255.255.0
ms1(config-if)#exit
ms1(config)#interface vlan 20
ms1(config-if)#ip address 192.168.20.252 255.255.255.0
ms1(config-if)#exit
ms1(config)#interface vlan 30
ms1(config-if)#ip address 192.168.30.252 255.255.255.0
ms1(config-if)#exit
ms1(config)#interface vlan 40
ms1(config-if)#ip address 192.168.40.252 255.255.255.0
ms1(config-if)#exit
三层交换ms2配置如下:
ms2(config)#interface vlan 10
ms2(config-if)#ip address 192.168.10.253 255.255.255.0
ms2(config-if)#exit
ms2(config)#interface vlan 20
ms2(config-if)#ip address 192.168.20.253 255.255.255.0
ms2(config-if)#exit
ms2(config)#interface vlan 30
ms2(config-if)#ip address 192.168.30.253 255.255.255.0
ms2(config-if)#exit
ms2(config)#interface vlan 40
ms2(config-if)#ip address 192.168.40.253 255.255.255.0
ms2(config-if)#exit
(三) 配置以太通道
a) 在两台三层交换机上配置以太通道
以三层交换ms1为例配置如下
ms1(config)#interface range g0/1-2
ms1(config-if-range)#switchport trunk encapsulation dot1q
ms1(config-if-range)#switchport mode trunk
ms1(config-if-range)#channel-group 1 mode on
(四) 配置STP生成树
a) 三层交换ms1配置为VLAN10、VLAN30的主根网桥，VLAN20、VLAN40的次根网桥
ms1(config)#spanning-tree vlan 10,30 root primary
ms1(config)#spanning-tree vlan 20,40 root secondary
b) 三层交换ms2配置为VLAN10、VLAN30的次根网桥，VLAN20、VLAN40的主根网桥
ms1(config)#spanning-tree vlan 10,30 root secondary
ms1(config)#spanning-tree vlan 20,40 root primary
(五) 配置DHCP
a) 三层交换为各Vlan（Vlan40除外）配置DHCP
ms1配置DHCP如下（要求自动分配的地址范围为x.x.x.1~100）：
ms1(config)#ip dhcp pool 10
ms1(dhcp-config)#network 192.168.10.0 255.255.255.0
ms1(dhcp-config)#default-router 192.168.10.254
ms1(dhcp-config)#dns-server 8.8.8.8
ms1(dhcp-config)#exit
ms1(config)#ipdhcp excluded-address 192.168.10.101 192.168.10.254
ms1(config)#ip dhcp pool 20
ms1(dhcp-config)#network 192.168.20.0 255.255.255.0
ms1(dhcp-config)#default-router 192.168.20.254
ms1(dhcp-config)#dns-server 8.8.8.8
ms1(dhcp-config)#exit
ms1(config)#ipdhcp excluded-address 192.168.20.101 192.168.20.254
ms1(config)#ip dhcp pool 30
ms1(dhcp-config)#network 192.168.30.0 255.255.255.0
ms1(dhcp-config)#default-router 192.168.30.254
ms1(dhcp-config)#dns-server 8.8.8.8
ms1(dhcp-config)#exit
ms1(config)#ipdhcp excluded-address 192.168.30.101 192.168.30.254
ms2配置DHCP如下（要求自动分配的地址范围为x.x.x.101~200）:
ms2(config)#ip dhcp pool 10
ms2(dhcp-config)#network 192.168.10.0 255.255.255.0
ms2(dhcp-config)#default-router 192.168.10.254
ms2(dhcp-config)#dns-server 8.8.8.8
ms2(dhcp-config)#exit
ms2(config)#ipdhcp excluded-address 192.168.10.1 192.168.10.100
ms2(config)#ipdhcp excluded-address 192.168.10.101 192.168.10.254
ms2(config)#ipdhcp pool 20
ms2(dhcp-config)#network 192.168.20.0 255.255.255.0
ms2(dhcp-config)#default-router 192.168.20.254
ms2(dhcp-config)#dns-server 8.8.8.8
ms2(dhcp-config)#exit
ms2(config)#ipdhcp excluded-address 192.168.20.1 192.168.20.100
ms2(config)#ipdhcp excluded-address 192.168.20.101 192.168.20.254
ms2(config)#ipdhcp pool 30
ms2(dhcp-config)#network 192.168.30.0 255.255.255.0
ms2(dhcp-config)#default-router 192.168.30.254
ms2(dhcp-config)#dns-server 8.8.8.8
ms2(dhcp-config)#exit
ms2(config)#ipdhcp excluded-address 192.168.30.1 192.168.30.100
ms2(config)#ipdhcp excluded-address 192.168.10.301 192.168.30.254
(六) 配置HSRP
a) 配置三层交换ms1为vlan10、vlan30的活动路由，为vlan20、vlan40的备份路由
ms1(config)#interface vlan 10
ms1(config-if)#standby 10 ip 192.168.10.254
ms1(config-if)#standby 10 priority 200
ms1(config-if)#standby 10 preempt
ms1(config-if)#exit
ms1(config)#interface vlan 20
ms1(config-if)#standby 10 ip 192.168.20.254
ms1(config-if)#standby 10 priority 195
ms1(config-if)#standby 10 preempt
ms1(config-if)#exit
ms1(config)#interface vlan 30
ms1(config-if)#standby 10 ip 192.168.30.254
ms1(config-if)#standby 10 priority 200
ms1(config-if)#standby 10 preempt
ms1(config-if)#exit
ms1(config)#interface vlan 40
ms1(config-if)#standby 10 ip 192.168.40.254
ms1(config-if)#standby 10 priority 195
ms1(config-if)#standby 10 preempt
ms1(config-if)#exit
b) 配置三层交换ms2为vlan10、vlan30的备份路由，为vlan20、vlan40的活动路由
ms2(config)#interface vlan 10
ms2(config-if)#standby 10 ip 192.168.10.254
ms2(config-if)#standby 10 priority 195
ms2(config-if)#standby 10 preempt
ms2(config-if)#exit
ms2(config)#interface vlan 20
ms2(config-if)#standby 10 ip 192.168.20.254
ms2(config-if)#standby 10 priority 200
ms2(config-if)#standby 10 preempt
ms2(config-if)#exit
ms2(config)#interface vlan 30
ms2(config-if)#standby 10 ip 192.168.30.254
ms2(config-if)#standby 10 priority 195
ms2(config-if)#standby 10 preempt
ms2(config-if)#exit
ms2(config)#interface vlan 40
ms2(config-if)#standby 10 ip 192.168.40.254
ms2(config-if)#standby 10 priority 200
ms2(config-if)#standby 10 preempt
ms2(config-if)#exit
(七) 配置三层交换机的路由接口及IP地址
a) 配置ms1如下：
ms1(config)#interface f0/23
ms1(config-if)#no switchport
ms1(config-if)#ip address 192.168.50.1 255.255.255.0
ms1(config-if)#exit
ms1(config)#interface f0/24
ms1(config-if)#no switchport
ms1(config-if)#ip address 192.168.60.1 255.255.255.0
ms1(config-if)#exit
b) 配置ms2如下：
ms2(config)#interface f0/23
ms2(config-if)#no switchport
ms2(config-if)#ip address 192.168.70.1 255.255.255.0
ms2(config-if)#exit
ms2(config)#interface f0/24
ms2(config-if)#no switchport
ms2(config-if)#ip address 192.168.80.1 255.255.255.0
ms2(config-if)#exit
(八) 配置路由器各接口IP地址
a) 配置r1接口IP
r1(config)#interface f0/0
r1(config-if)#ip address 192.168.50.2 255.255.255.0
r1(config-if)#no shutdown
r1(config-if)#exit
r1(config)#interface f0/1
r1(config-if)#ip address 192.168.70.2 255.255.255.0
r1(config-if)#no shutdown
r1(config-if)#ex
r1(config)#interface f1/0
r1(config-if)#ip address 200.1.1.1 255.255.255.0
r1(config-if)#no shutdown
r1(config-if)#exit
b) 配置r2接口IP
r2(config)#interface f0/0
r2(config-if)#ip address 192.168.60.2 255.255.255.0
r2(config-if)#no shutdown
r2(config-if)#exit
r2(config)#interface f0/1
r2(config-if)#ip address 192.168.80.2 255.255.255.0
r2(config-if)#no shutdown
r2(config-if)#exit
r2(config)#interface f1/0
r2(config-if)#ip address 200.1.1.2 255.255.255.0
r2(config-if)#no shutdown
r2(config-if)#exit
(九) 配置RIP
a) 在三层交换机上配置RIP
ms1：
ms1(config)#route rip
ms1(config-router)#version 2
ms1(config-router)#no auto-summary
ms1(config-router)#network 192.168.10.0
ms1(config-router)#network 192.168.20.0
ms1(config-router)#network 192.168.30.0
ms1(config-router)#network 192.168.40.0
ms1(config-router)#network 192.168.50.0
ms1(config-router)#network 192.168.60.0
ms1(config-router)#exit
ms2：
ms2(config)#route rip
ms2(config-router)#version 2
ms2(config-router)#no auto-summary
ms2(config-router)#network 192.168.10.0
ms2(config-router)#network 192.168.20.0
ms2(config-router)#network 192.168.30.0
ms2(config-router)#network 192.168.40.0
ms2(config-router)#network 192.168.70.0
ms2(config-router)#network 192.168.80.0
ms2(config-router)#exit
b) 在路由器上配置RIP
r1：
r1(config)#route rip
r1(config-router)#version 2
r1(config-router)#no auto-summary
r1(config-router)#network 192.168.50.0
r1(config-router)#network 192.168.70.0
r1(config-router)#network 200.1.1.0
r1(config-router)#exit
r2：
r2(config)#route rip
r2(config-router)#version 2
r2(config-router)#no auto-summary
r2(config-router)#network 192.168.60.0
r2(config-router)#network 192.168.80.0
r2(config-router)#network 200.1.1.0
r2(config-router)#exit
(十) 配置默认路由并注入宣告
a) 在路由器r1上配置默认路由并注入宣告
r1(config)#ip route 0.0.0.0 0.0.0.0 f1/0
r1(config)#route rip
r1(config-router)#version 2
r1(config-router)#no auto-summary
r1(config-router)#default-information originate
r1(config-router)#exit
b) 在路由器r2上配置默认路由并注入宣告
r2(config)#ip route 0.0.0.0 0.0.0.0 f1/0
r2(config)#route rip
r2(config-router)#version 2
r2(config-router)#no auto-summary
r2(config-router)#default-information originate
r2(config-router)#exit
(十一) 配置ACL（访问控制列表）
a) 在路由器r1上配置ACL
r1(config)#access-list 1 permit 192.168.10.0 0.0.0.255
r1(config)#access-list 1 permit 192.168.20.0 0.0.0.255
r1(config)#access-list 1 permit 192.168.30.0 0.0.0.255
r1(config)#access-list 1 permit 192.168.40.0 0.0.0.255
b) 在路由器r2上配置ACL
r2(config)#access-list 1 permit 192.168.10.0 0.0.0.255
r2(config)#access-list 1 permit 192.168.20.0 0.0.0.255
r2(config)#access-list 1 permit 192.168.30.0 0.0.0.255
r2(config)#access-list 1 permit 192.168.40.0 0.0.0.255
(十二) 配置NAT（网络地址转换）
a) 在路由器r1上配置NAT并在各端口开启控制列表
r1(config)#ipnat inside source list 1 interface f1/0 overload
r1(config)#interfacef0/0
r1(config-if)#ipaccess-group 1 in
r1(config-if)#exit
r1(config)#interfacef0/1
r1(config-if)#ipaccess-group 1 in
r1(config-if)#exit
r1(config)#interfacef1/0
r1(config-if)#ipaccess-group 1 out
r1(config-if)#exit
b) 在路由器r2上配置NAT并在个端口开启控制列表
r2(config)#ipnat inside source list 1 interface f1/0 overload
r2(config)#interfacef0/0
r2(config-if)#ipaccess-group 1 in
r2(config-if)#exit
r2(config)#interfacef0/1
r2(config-if)#ipaccess-group 1 in
r2(config-if)#exit
r2(config)#interfacef1/0
r2(config-if)#ipaccess-group 1 out
r2(config-if)#exit