R&S_HCIP综合实验
一、实验拓扑
二、实验需求
IP地址自行规划
Site1需求：
1、PC1和PC3属于VLAN10，PC2和PC4属于VLAN20
2、SW1与sw2的互连接口启用eth-trunk，使用lacp协议，最大带宽为2G。
3、SW1、sw2、sw3、sw4运行MSTP，SW1为vlan10的root, SW2为vlan20的root
4、pc1到pc4的网关需要能提供冗余,需要使用bfd动态检查上连链接状态，实现自动切换。
AS6500需求：
1、AS65000底层IGP协议为isis，区域为level2，需要保证各路由器的loopback0接口互通。
2、R1与R4使用loobpack0建立IGBP邻居关系.
AS65001需求：
1、SW5为二层交换机，PC5与PC6需要不同vlan，需要保证两台PC能互访（不能使用vlanif接口）
2、R4与R5之间的串行链路需要启用ppp chap认证，R4为认证端。
MPLS_需求：
1、总的需求为Site1的pc能访问site2的PC，需要使用mpls_来实现
2、R1与SW1/SW2之间运行OSPF协议
3、R4与R5之间运行BGP协议，R4属于AS65000，R5属于AS65001,可选用ISIS实现。
4、R1与R4直接建立v4邻居关系
5、PC5能访问site1里面的所有PC， 但PC6不能访问。
三、实验思路
1. 规划IP地址
2. 先交换后路由，再完成应用部署
3. 按区域部署先做总部再分部
4. 全网可达再实现策略【ACL】
四、实验配置
1、ISP（AS65000需求）
AS65000底层IGP协议为isis，区域为level2，需要保证各路由器的loopback0接口互通。
R1：
isis 10
is-level level-2
network-entity 49.0001.0000.0000.0001.00interface GigabitEthernet2/0/0
ip address 12.0.0.1 255.255.255.0
isis enable 10interface GigabitEthernet2/0/1
ip address 13.0.0.1 255.255.255.0
isis enable 10interface LoopBack0
ip address 1.1.1.1 255.255.255.255
isis enable 10bgp 65000
peer 4.4.4.4 as-number 65000
peer 4.4.4.4 connect-interface LoopBack0peer 4.4.4.4 next-hop-local
R2：
isis 10
is-level level-2
network-entity 49.0001.0000.0000.0002.00interface GigabitEthernet0/0/0
ip address 12.0.0.2 255.255.255.0
isis enable 10interface GigabitEthernet0/0/1
ip address 24.0.0.2 255.255.255.0
isis enable 10interface LoopBack0
ip address 2.2.2.2 255.255.255.255
isis enable 10
R3：
isis 10
is-level level-2
network-entity 49.0001.0000.0000.0003.00interface GigabitEthernet0/0/0
ip address 13.0.0.3 255.255.255.0
isis enable 10interface GigabitEthernet0/0/1
ip address 34.0.0.3 255.255.255.0
isis enable 10interface LoopBack0
ip address 3.3.3.3 255.255.255.255
isis enable 10
R4：
isis 10
is-level level-2
network-entity 49.0001.0000.0000.0004.00interface GigabitEthernet0/0/0
ip address 34.0.0.4 255.255.255.0
isis enable 10interface GigabitEthernet0/0/1
ip address 24.0.0.4 255.255.255.0
isis enable 10interface LoopBack0
ip address 4.4.4.4 255.255.255.255
isis enable 10bgp 65000
peer 1.1.1.1 as-number 65000
peer 1.1.1.1 connect-interface LoopBack0peer 1.1.1.1 next-hop-local
验证：isis 10 邻居建立是否成功
验证;BGP邻居是否建立成功
2、Site1：
1、MSTP、链路聚合、DHCP
SW1：
vlan batch 10 20
interface GigabitEthernet0/0/1
port link-type trunk
port trunk allow-pass vlan 10 20
interface GigabitEthernet0/0/2
port link-type trunk
port trunk allow-pass vlan 10 20interface GigabitEthernet0/0/6
eth-trunk 1
interface GigabitEthernet0/0/7
eth-trunk 1
interface GigabitEthernet0/0/8
eth-trunk 1stp instance 10 root primary
stp instance 20 root secondarystp region-configuration
region-name 1
instance 10 vlan 10
instance 20 vlan 20
active region-configurationinterface Eth-Trunk1
port link-type trunk
port trunk allow-pass vlan 2 to 4094
mode lacp-static
max active-linknumber 2bfd
q
bfd 1 bind peer-ip 192.168.10.253 source-ip 192.168.10.254 auto
commitinterface Vlanif10
ip address 192.168.10.254 255.255.255.0
vrrp vrid 1 virtual-ip 192.168.10.250
vrrp vrid 1 priority 200
vrrp vrid 1 track bfd-session session-name 1
dhcp select interface
dhcp server excluded-ip-address 192.168.10.250 192.168.10.253interface Vlanif20
ip address 192.168.20.254 255.255.255.0
vrrp vrid 2 virtual-ip 192.168.20.250
dhcp select interface
dhcp server excluded-ip-address 192.168.20.250 192.168.20.253
SW2：
vlan batch 10 20
interface GigabitEthernet0/0/1
port link-type trunk
port trunk allow-pass vlan 10 20
#
interface GigabitEthernet0/0/2
port link-type trunk
port trunk allow-pass vlan 10 20interface GigabitEthernet0/0/6
eth-trunk 1
#
interface GigabitEthernet0/0/7
eth-trunk 1
#
interface GigabitEthernet0/0/8
eth-trunk 1stp instance 20 root primary
stp instance 10 root secondarystp region-configuration
region-name 1
instance 10 vlan 10
instance 20 vlan 20
active region-configurationinterface Eth-Trunk1
port link-type trunk
port trunk allow-pass vlan 2 to 4094
mode lacp-static
max active-linknumber 2
bfd
q
bfd 1 bind peer-ip 192.168.10.254 source-ip 192.168.10.253 auto
commitinterface Vlanif10
ip address 192.168.10.253 255.255.255.0
vrrp vrid 1 virtual-ip 192.168.10.250
vrrp vrid 1 track bfd-session session-name 1
dhcp select interface
dhcp server excluded-ip-address 192.168.10.250 192.168.10.252
dhcp server excluded-ip-address 192.168.10.254interface Vlanif20
ip address 192.168.20.253 255.255.255.0
vrrp vrid 2 virtual-ip 192.168.20.250
vrrp vrid 2 priority 200
dhcp select interface
dhcp server excluded-ip-address 192.168.20.250 192.168.20.252
dhcp server excluded-ip-address 192.168.20.254
SW3：
vlan batch 10 20
stp region-configuration
region-name 1
instance 10 vlan 10
instance 20 vlan 20
active region-configurationinterface Ethernet0/0/1
port link-type access
port default vlan 10
interface Ethernet0/0/2
port link-type access
port default vlan 20interface GigabitEthernet0/0/1
port link-type trunk
port trunk allow-pass vlan 10 20
interface GigabitEthernet0/0/2
port link-type trunk
port trunk allow-pass vlan 10 20
stp instance 10 cost 50000 //阻塞stp instance 10的G0/0/2
SW4：
vlan batch 10 20
stp region-configuration
region-name 1
instance 10 vlan 10
instance 20 vlan 20
active region-configurationinterface Ethernet0/0/1
port link-type access
port default vlan 10
interface Ethernet0/0/2
port link-type access
port default vlan 20interface GigabitEthernet0/0/1
port link-type trunk
port trunk allow-pass vlan 10 20
interface GigabitEthernet0/0/2
port link-type trunk
port trunk allow-pass vlan 10 20
stp instance 20 cost 50000 //阻塞stp instance 20的G0/0/2
验证：
MSTP：dis stp brief（Site1的交换机。SW3是G0/0/2堵塞，SW4是G0/0/1堵塞）
DHCP：ipconfig（四台PC都获取地址）
VRRP：
VRRP和BFD联动：（注意图片BFD-session state： UP）
3、ISP和Site1（MPLS_VPN）
R1：
ip -instance 1
ipv4-family
route-distinguisher 1:1
-target 1:1 export-extcommunity
-target 1:1 import-extcommunitympls lsr-id 1.1.1.1
mpls
mpls ldpinterface GigabitEthernet0/0/0
ip binding -instance 1
ip address 192.168.11.1 255.255.255.0
mpls
interface GigabitEthernet0/0/1
ip binding -instance 1
ip address 192.168.12.1 255.255.255.0
mpls
interface GigabitEthernet2/0/0
mpls
mpls ldp
interface GigabitEthernet2/0/1
mpls
mpls ldpbgp 65000
ipv4-family v4
policy -target
peer 4.4.4.4 enableipv4-family -instance 1
import-route ospf 10ospf 10 router-id 1.1.1.1 -instance 1
import-route bgp
area 0.0.0.0
network 192.168.11.0 0.0.0.255
network 192.168.12.0 0.0.0.255
R2：
mpls lsr-id 2.2.2.2
mpls
mpls ldpinterface GigabitEthernet0/0/0
mpls
mpls ldp
interface GigabitEthernet0/0/1
mpls
mpls ldp
R3：
mpls lsr-id 3.3.3.3
mpls
mpls ldpinterface GigabitEthernet0/0/0
mpls
mpls ldp
interface GigabitEthernet0/0/1
mpls
mpls ldp
R4：
mpls lsr-id 4.4.4.4
mpls
mpls ldpinterface GigabitEthernet0/0/0
mpls
mpls ldp
interface GigabitEthernet0/0/1
mpls
mpls ldpinterface Serial2/0/0
mpls
SW1:
vlan batch 11
interface GigabitEthernet0/0/23
port link-type access
port default vlan 11interface Vlanif11
ip address 192.168.11.2 255.255.255.0ospf 10 router-id 11.1.1.1
area 0.0.0.0
network 0.0.0.0 255.255.255.255
SW2：
vlan batch 12
interface GigabitEthernet0/0/23
port link-type access
port default vlan 12interface Vlanif12
ip address 192.168.12.2 255.255.255.0ospf 10 router-id 12.1.1.1
area 0.0.0.0
network 0.0.0.0 255.255.255.255
验证：R1、SW1、SW2、建立ospf邻居
MPLS ：
4、Site2
R5：
dhcp enable
interface GigabitEthernet0/0/0.5
dot1q termination vid 5
ip address 192.168.5.254 255.255.255.0
arp broadcast enable
dhcp select interface
interface GigabitEthernet0/0/0.6
dot1q termination vid 6
ip address 192.168.6.254 255.255.255.0
arp broadcast enable
dhcp select interfaceacl number 3000
rule 5 deny ip source 192.168.6.0 0.0.0.255 destination 192.168.20.0 0.0.0.255
rule 10 deny ip source 192.168.6.0 0.0.0.255 destination 192.168.10.0 0.0.0.255interface GigabitEthernet0/0/0
traffic-filter inbound acl 3000
SW5：
vlan batch 5 6
interface GigabitEthernet0/0/1
port link-type trunk
port trunk allow-pass vlan 5 to 6
interface GigabitEthernet0/0/2
port link-type access
port default vlan 5
port-isolate enable group 1
interface GigabitEthernet0/0/3
port link-type access
port default vlan 6
port-isolate enable group 1
验证：DHCP-----ipconfigPC5、PC6获取地址
PC6访问不了Site1PC
5、ISP和Site2
R4：
ip -instance 1
ipv4-family
route-distinguisher 1:1
-target 1:1 export-extcommunity
-target 1:1 import-extcommunityinterface Serial2/0/0
link-protocol ppp
ppp authentication-mode chap
ip binding -instance 1
ip address 10.1.1.4 255.255.255.0
bgp 65000
ipv4-family v4
policy -target
peer 1.1.1.1 enable
ipv4-family -instance 1
peer 10.1.1.5 as-number 65001
R5：
bgp 65001
peer 10.1.1.4 as-number 65000
network 192.168.5.0
network 192.168.6.0
interface Serial2/0/0
ppp chap user 1
ppp chap password cipher %$%$t"e+L5{(^7L_,v0.46OE,(s,%$%$
ip address 10.1.1.5 255.255.255.0
验证：R4和R5建立BGP邻居
R4S20/0/0和R5S2/0/0认证是否成功
6、最终验证
