华为eNSP三层架构网络配置

用户密集，校园、集中的小区、大型企业、十几栋楼房一般采用三层架构。
园区网三层架构的配置：接入+汇聚+核心
一、企业内网划分多个VLAN，减少广播域大小，提高网络稳定性。划分VLAN,配置Trunk。核心配置SVI作为用户的网关，配置在核心交换机。
二、所有用户均为自动获取IP地址
三、所有设备，在任何位置都可以telnet远程管理。
四.出口配置NAT，企业总部和分支采用OSPF路由协议连接。
五.企业总部和分支采用PPP广域网链路连接，并采用CHAP对链路进行认证。

一、配置VLAN和Trunk。

汇聚层的上联级联端口选择千兆端口G0/0/1,配置从底往上配置

（一）配置交换机SW4

[SW4]vlan batch 10 999
[SW4]interface e0/0/1
[SW4-Ethernet0/0/1]port link-type access
[SW4-Ethernet0/0/1]port default vlan 10
[SW4-Ethernet0/0/1]dis this

interface Ethernet0/0/1
port link-type access
port default vlan 10

return

[SW4]interface gi0/0/1
[SW4-GigabitEthernet0/0/1]port link-type trunk
[SW4-GigabitEthernet0/0/1]port trunk allow-pass vlan 10 999
#VLAN 10是用户使用，VLAN 999是管理使用
[SW4-GigabitEthernet0/0/1]dis this

interface GigabitEthernet0/0/1
port link-type trunk
port trunk allow-pass vlan 10 999

return

（二）配置交换机SW5

[SW5]vlan batch 20 999
[SW5]interface e0/0/1
[SW5-Ethernet0/0/1]port link-type access
[SW5-Ethernet0/0/1]port default vlan 20
[SW5-Ethernet0/0/1]dis this

interface Ethernet0/0/1
port link-type access
port default vlan 20

return

[SW5]interface e0/0/2
[SW5-Ethernet0/0/2]port link-type trunk
[SW5-Ethernet0/0/2]port trunk allow-pass vlan 20 999
[SW5-Ethernet0/0/2]dis this

interface Ethernet0/0/2
port link-type trunk
port trunk allow-pass vlan 20 999

return

（三）配置汇聚交换机SW2

[SW2]vlan batch 10 20 999 #同时创建VLAN 10、20、999
[SW2]port-group group-member gi0/0/1 to gi0/0/2 e0/0/1 #把三个接口放在一组同时配置
[SW2-port-group]port link-type trunk
[SW2-port-group]port trunk allow-pass vlan 10 20 999 #允许VLAN 10、20、999通过

（四）配置汇聚交换机SW3

[SW3]undo info-center enable. #关闭消息中心
[SW3]vlan batch 200 999
[SW3]interface e0/0/1
[SW3-Ethernet0/0/1]port link-type access
[SW3-Ethernet0/0/1]port default vlan 200

[SW3]interface gi0/0/1
[SW3-GigabitEthernet0/0/1]port link-type trunk
[SW3-GigabitEthernet0/0/1]port trunk allow-pass vlan 200 999
[SW3-GigabitEthernet0/0/1]dis this

interface GigabitEthernet0/0/1
port link-type trunk
port trunk allow-pass vlan 200 999

return

（五）配置核心交换机SW1

1.配置VLAN和Trunk
[SW1]vlan batch 10 20 200 999
[SW1]interface gi0/0/1
[SW1-GigabitEthernet0/0/1]port link-type trunk
[SW1-GigabitEthernet0/0/1]port trunk allow-pass vlan 10 20 999
[SW1-GigabitEthernet0/0/1]dis this

interface GigabitEthernet0/0/1
port link-type trunk
port trunk allow-pass vlan 10 20 999

return

[SW1]interface gi0/0/2
[SW1-GigabitEthernet0/0/2]port link-type trunk
[SW1-GigabitEthernet0/0/2]port trunk allow-pass vlan 200 999
[SW1-GigabitEthernet0/0/2]dis this

interface GigabitEthernet0/0/2
port link-type trunk
port trunk allow-pass vlan 200 999

[SW1]dis vlan #检查配置VLAN
10 common TG:GE0/0/1(U)
20 common TG:GE0/0/1(U)
200 common TG:GE0/0/2(U)
999 common TG:GE0/0/1(U) GE0/0/2(U)

display port vlan
Port Link Type PVID Trunk VLAN List

---

GigabitEthernet0/0/1 trunk 1 1 10 20 999
GigabitEthernet0/0/2 trunk 1 1 200 999

2.用户的网关配置在核心交换机,配置成功后用户可以联通网关
[SW1]interface vlan 10
[SW1-Vlanif10]ip address 192.168.10.1 24
[SW1-Vlanif10]qu
[SW1]interface vlan 20
[SW1-Vlanif20]ip address 192.168.20.1 24
[SW1-Vlanif20]qu
[SW1]interface vlan 200
[SW1-Vlanif200]ip address 192.168.200.1 24

[SW1]display ip interface brief
Interface IP Address/Mask Physical Protocol
MEth0/0/1 unassigned down down
NULL0 unassigned up up(s)
Vlanif1 unassigned up down
Vlanif10 192.168.10.1/24 up up
Vlanif20 192.168.20.1/24 up up
Vlanif200 192.168.200.1/24 up up

配置成功后PC1、PC2和Server可以ping通各自的VLAN网关。

二、所有用户均为自动获取IP地址，在核心SW1上建立DHCP地址池。

配置二个VLAN地址池，一个固定IP地址。
[SW1]dhcp enable
[SW1]ip pool vlan_10 #以VLAN1_10为命名地址池
[SW1-ip-pool-vlan_10]network 192.168.10.0 mask 24
[SW1-ip-pool-vlan_10]gateway-list 192.168.10.1
[SW1-ip-pool-vlan_10]dns-list 119.29.29.29
[SW1-ip-pool-vlan_10]dis this

ip pool vlan_10
gateway-list 192.168.10.1
network 192.168.10.0 mask 255.255.255.0
dns-list 119.29.29.29

return

[SW1-ip-pool-vlan_20]network 192.168.20.0 mask 24
[SW1-ip-pool-vlan_20]gateway-list 192.168.20.1
[SW1-ip-pool-vlan_20]dns-list 119.29.29.29
[SW1-ip-pool-vlan_20]dis this

ip pool vlan_20
gateway-list 192.168.20.1
network 192.168.20.0 mask 255.255.255.0
dns-list 119.29.29.29

return

[SW1]interface vlan 10
[SW1-Vlanif10]dhcp select global #使用全局配置的地址池分配IP地址
[SW1-Vlanif10]qu
[SW1]interface vlan 20
[SW1-Vlanif20]dhcp select global

PC1使用DHCP自动获取IP地址192.168.10.254，证明DHCP配置正确。

三、所有设备，在任何位置都可以被telnet远程管理。

（一）交换机和路由器配置Telnet用户名和密码

[SW1]interface vlan 999
[SW1-Vlanif999]ip address 192.168.255.1 24

[SW1]aaa
[SW1-aaa]local-user apple password cipher 123456 privilege level 3
[SW1-aaa]local-user apple service-type telnet
[SW1]user-interface vty 0 4
[SW1-ui-vty0-4]authentication-mode aaa
[SW1-ui-vty0-4]dis this

user-interface con 0
user-interface vty 0 4
authentication-mode aaa

把如下所示的直接复制到SW2、SW3、SW4、SW5交换机以及l路由器R1和R2上。
路由器不需要创建VLAN。
aaa
local-user apple password cipher 123456 privilege level 3
local-user apple service-type telnet
user-interface vty 0 4
authentication-mode aaa

[SW2]interface vlan 999
[SW2-Vlanif999]ip address 192.168.255.2 24

[SW3]interface vlan 999
[SW3-Vlanif999]ip address 192.168.255.3 24

[SW4]interface vlan 999
[SW4-Vlanif999]ip address 192.168.255.4 24

[SW5]interface vlan 999
[SW5-Vlanif999]ip address 192.168.255.5 24

（二）配置缺省路由联通整个网络

接入和汇聚需要一条缺省路由指向核心路由器，配置缺省路由给管理流量回包
[SW2]ip route-static 0.0.0.0 0 192.168.255.1
[SW3]ip route-static 0.0.0.0 0 192.168.255.1
[SW4]ip route-static 0.0.0.0 0 192.168.255.1
[SW5]ip route-static 0.0.0.0 0 192.168.255.1

四、出口配置NAT，企业总部和分支采用OSPF路由协议连接。

（一）配置三层接口IP地址

1.配置三层IP地址
[SW1]vlan 10
[SW1-vlan10]description To_10#GCB #10号楼工程部
[SW1]vlan 800
[SW1-vlan800]description TO_chukouR1 #配置连接到R1的出口

[SW1]interface gi0/0/3
[SW1-GigabitEthernet0/0/3]port link-type access
[SW1-GigabitEthernet0/0/3]port default vlan 800
[SW1-GigabitEthernet0/0/3]dis this

interface GigabitEthernet0/0/3
port link-type access
port default vlan 800

return

[SW1]interface vlan 800
[SW1-Vlanif800]ip address 192.168.254.1 24 #配置连接到R1的三层地址

2.配置出口路由器R1
[R1]interface gi0/0/0
[R1-GigabitEthernet0/0/0]ip address 192.168.254.2 24
[R1]interface s4/0/0
[R1-Serial4/0/0]ip address 192.168.253.1 24
[R1]interface gi0/0/1
[R1-GigabitEthernet0/0/1]ip address 12.1.1.1 29
3.配置分部路由器R2
[R2]interface s4/0/0
[R2-Serial4/0/0]ip address 192.168.253.2 24
[R2]interface gi0/0/0
[R2-GigabitEthernet0/0/0]ip address 192.168.100.1 24
4.配置运营商路由器R3
[R3]interface g0/0/0
[R3-GigabitEthernet0/0/0]ip address 12.1.1.6 29 #配置网段最后一个地址
[R3]interface loopback 0
[R3-LoopBack0]ip address 9.9.9.9 24

（二）配置缺省路由联通整个网路

1.配置去向路由
[SW1]ip route-static 0.0.0.0 0 192.168.254.2 #配置三层核心交换机SW1到总部的路由
[R1]ip route-static 0.0.0.0 0 12.1.1.6 #配置总部到运营商的路由
2.配置回向路由，企业总部和分支采用OSPF路由协议连接。
三台设备运行OSPF协议，使得三台设备的7个网段互通，排除运营商
核心交换机SW1四个网段：192.168.10.X；192.168.20.X；192.168.200.X；192.168.254.X。
总部出口路由器R1两个网段：192.168.253.X；192.168.254.X。
分部路由器R2两个网段：192.168.100.X；192.168.253.X。
管理网段一个网段：192.168.255.X。

[SW1]ospf 1 #进程号为1
[SW1-ospf-1]area 0 #区域0
[SW1-ospf-1-area-0.0.0.0]network 192.168.10.0 ?
X.X.X.X OSPF wild card bits
[SW1-ospf-1-area-0.0.0.0]network 192.168.10.0 0.0.0.255 #宣告SW1核心直连路由
[SW1-ospf-1-area-0.0.0.0]network 192.168.20.0 0.0.0.255
[SW1-ospf-1-area-0.0.0.0]network 192.168.200.0 0.0.0.255
[SW1-ospf-1-area-0.0.0.0]network 192.168.254.0 0.0.0.255
[SW1-ospf-1-area-0.0.0.0]network 192.168.255.0 0.0.0.255

[R1]ospf 1
[R1-ospf-1]area 0
[R1-ospf-1-area-0.0.0.0]network 192.168.254.0 0.0.0.255
[R1-ospf-1-area-0.0.0.0]network 192.168.253.0 0.0.0.255

[R2]ospf 1
[R2-ospf-1]area 0
[R2-ospf-1-area-0.0.0.0]network 192.168.253.0 0.0.0.255
[R2-ospf-1-area-0.0.0.0]network 192.168.100.0 0.0.0.255

3.在总部路由器出口做NAT转换
[R1]acl 2000
[R1-acl-basic-2000]rule permit source 192.168.0.0 ? #提示填写反掩码
IP_ADDR Wildcard of source
0 Wildcard bits : 0.0.0.0 ( a host )
[R1-acl-basic-2000]rule permit source 192.168.0.0 0.0.255.255

[R1]interface g0/0/1
[R1-GigabitEthernet0/0/1]nat outbound 2000
#内网用户出外网时直接转换成公网接口g0/0/1所在IP地址上外网

在运营商R3路由器抓包接口gi0/0/0

在SW1上通过OSPF学习到的分部的路由100.0和253.0网段
display ip routing-table

display ip routing-table protocol ospf #查看OSPF路由

五.企业总部和分支采用PPP广域网链路连接，并采用CHAP对链路进行认证。

总部路由器R1做服务端（认证端），分部路由器R2做客户端。
[R1]aaa
[R1-aaa]local-user apple password cipher 12345
[R1-aaa]local-user apple service-type ppp
[R1]interface s4/0/0
[R1-Serial4/0/0]ppp authentication-mode chap #接口开启认证
分部路由器R2做客户端。
[R2-Serial4/0/0]ppp chap user apple
[R2-Serial4/0/0]ppp chap password simple 12345
[R2-Serial4/0/0]dis this
[V200R003C00]

interface Serial4/0/0
link-protocol ppp
ppp chap user apple
ppp chap password simple 12345
ip address 192.168.253.2 255.255.255.0

return