构建某企业项目案例

拓扑图如下：

计算桥接参数为：\Device\NPF_{90E3A748-7F8C-4FEB-9F47-50A8AC66C8B1}

接口连接

Router1 F0/0 <----> Router4 F0/1 注：S1做VTP Client

Router2 F0/0 <----> Router4 F0/5 S2做VTP Server 更便于管理

Router3 F0/0 <----> Router4 F0/10

Router4 F0/13 <----> Router5 F0/13

Router4 F0/14 <----> Router5 F0/14

Router5 F0/15 <----> Router6 F1/0

Router6 S0/0 <----> Router7 S0/0

Router7 S0/1 <----> Router8 S0/0

Router8 F1/0 <----> XPC P0/0

路由器参考配置如下：

真机PC的配置：

真机开启telnet服务：开始---运行---services.msc---找到telnet---启用

C:\&gt;ipconfig //查看PC的IP地址

Windows IP Configuration

Ethernet adapter 本地连接 2:

Connection-specific DNS Suffix . :

IP Address. . . . . . . . . . . . : 202.101.225.2

Subnet Mask . . . . . . . . . . . : 255.255.255.0

Default Gateway . . . . . . . . . : 202.101.225.1

C:\&gt;ping 202.101.225.1 //可以ping通网关

Pinging 202.101.225.1 with 32 bytes of data:

Reply from 202.101.225.1: bytes=32 time=176ms TTL=255

Reply from 202.101.225.1: bytes=32 time=47ms TTL=255

Reply from 202.101.225.1: bytes=32 time=50ms TTL=255

Reply from 202.101.225.1: bytes=32 time=51ms TTL=255

Ping statistics for 202.101.225.1:

Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),

Approximate round trip times in milli-seconds:

Minimum = 47ms, Maximum = 176ms, Average = 81ms

C:\&gt;ping 202.101.224.1

Pinging 202.101.224.1 with 32 bytes of data:

Reply from 202.101.224.1: bytes=32 time=56ms TTL=255

Reply from 202.101.224.1: bytes=32 time=50ms TTL=255

Reply from 202.101.224.1: bytes=32 time=17ms TTL=255

Reply from 202.101.224.1: bytes=32 time=20ms TTL=255

Ping statistics for 202.101.224.1:

Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),

Approximate round trip times in milli-seconds:

Minimum = 17ms, Maximum = 56ms, Average = 35ms

C:\&gt;ping 202.101.224.2 //R2发布默认路由信息后才可以ping通

Pinging 202.101.224.2 with 32 bytes of data:

Reply from 202.101.224.2: bytes=32 time=223ms TTL=254

Reply from 202.101.224.2: bytes=32 time=42ms TTL=254

Reply from 202.101.224.2: bytes=32 time=332ms TTL=254

Reply from 202.101.224.2: bytes=32 time=69ms TTL=254

Ping statistics for 202.101.224.2:

Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),

Approximate round trip times in milli-seconds:

Minimum = 42ms, Maximum = 332ms, Average = 166ms

C:\&gt;net user administrator huayu //配置PC的管理员密码

命令成功完成。

C:\&gt;

路由器PC1的配置：

Router&gt; //用户模式

Router&gt;enable //从用户模式进入到特权模式

Router#configure terminal //从特权模式进入到全局模式

Router(config)#no ip domain-lookup //关闭域名查找

Router (config)#line console 0 //进入控制口

Router (config-line)#logging synchronous //光标跟随

Router (config-line)#exec-timeout 0 0 //关闭延迟

Router(config-line)#hostname PC1 //给路由器重命名为PC1

PC1(config)#interface f0/0

PC1(config-if)#ip address 172.16.10.10 255.255.255.0

PC1(config-if)#no shutdown

PC1(config-if)#exit

PC1(config)#ip route 0.0.0.0 0.0.0.0 172.16.10.1

PC1(config)#end

PC1#show ip route

Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP

D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area

N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2

E1 - OSPF external type 1, E2 - OSPF external type 2

i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2

ia - IS-IS inter area, * - candidate default, U - per-user static route

o - ODR, P - periodic downloaded static route

Gateway of last resort is 172.16.10.1 to network 0.0.0.0

172.16.0.0/24 is subnetted, 1 subnets

C 172.16.10.0 is directly connected, FastEthernet0/0

S* 0.0.0.0/0 [1/0] via 172.16.10.1

PC1#ping 172.16.10.1 //可以ping通网关

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 172.16.10.1, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 16/88/160 ms

PC1#ping 172.16.20.1 //配置子接口后不同网段不同vlan可以通信

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 172.16.20.1, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 44/99/168 ms

PC1#ping 172.16.30.1

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 172.16.30.1, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 32/69/108 ms

PC1#ping 172.31.31.2

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 172.31.31.2, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 28/86/208 ms

PC1#ping 172.31.31.1 //未宣告时不能ping通

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 172.31.31.1, timeout is 2 seconds:

.....

Success rate is 0 percent (0/5)

PC1#ping 172.31.31.1 //宣告后内网都可以通信

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 172.31.31.1, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 180/305/560 ms

PC1#ping 202.101.224.2 //未宣告外网时不能ping通外网

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 202.101.224.2, timeout is 2 seconds:

U.U.U

Success rate is 0 percent (0/5)

PC1#ping 202.101.224.2 //R2发布默认路由信息后可以ping通外网

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 202.101.224.2, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 188/294/404 ms

PC1#ping 202.101.224.1 //未做NAT时不能ping通外部网络

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 202.101.224.1, timeout is 2 seconds:

.....

Success rate is 0 percent (0/5)

PC1#ping 202.101.224.1 //在R2上做NAT后可以ping通外部网络

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 202.101.224.1, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 440/745/1212 ms

PC1#ping 202.101.225.1

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 202.101.225.1, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 320/487/672 ms

PC1#ping 202.101.225.2 //在R1上做扩展ACL后，PC1可以访问所有外部网络

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 202.101.225.2, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 372/605/996 ms

PC1#telnet 202.101.225.2 //telnet真机PC

Trying 202.101.225.2 ... Open

Welcome to Microsoft Telnet Service

login: administrator

password: (huayu)

*=====================================================

Welcome to Microsoft Telnet Server.

*=====================================================

C:\Documents and Settings\Administrator&gt;cd \

C:\&gt;ipconfig

Windows IP Configuration

Ethernet adapter 本地连接 2:

Connection-specific DNS Suffix . :

IP Address. . . . . . . . . . . . : 202.101.225.2

Subnet Mask . . . . . . . . . . . : 255.255.255.0

Default Gateway . . . . . . . . . : 202.101.225.1

C:\&gt;exit //退出

[Connection to 202.101.225.2 closed by foreign host]

PC1#

路由器PC2的配置：

Router&gt; //用户模式

Router&gt;enable //从用户模式进入到特权模式

Router#configure terminal //从特权模式进入到全局模式

Router(config)#no ip domain-lookup //关闭域名查找

Router (config)#line console 0 //进入控制口

Router (config-line)#logging synchronous //光标跟随

Router (config-line)#exec-timeout 0 0 //关闭延迟

Router(config-line)#hostname PC2 //给路由器重命名为PC2

PC2(config)#interface f0/0

PC2(config-if)#ip address 172.16.20.20 255.255.255.0

PC2(config-if)#no shutdown

PC2(config-if)#exit

PC2(config)#ip route 0.0.0.0 0.0.0.0 172.16.20.1

PC2(config)#end

PC2#show ip route

Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP

D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area

N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2

E1 - OSPF external type 1, E2 - OSPF external type 2

i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2

ia - IS-IS inter area, * - candidate default, U - per-user static route

o - ODR, P - periodic downloaded static route

Gateway of last resort is 172.16.20.1 to network 0.0.0.0

172.16.0.0/24 is subnetted, 1 subnets

C 172.16.20.0 is directly connected, FastEthernet0/0

S* 0.0.0.0/0 [1/0] via 172.16.20.1

PC2#ping 172.16.20.1 //可以ping通网关

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 172.16.20.1, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 80/140/236 ms

PC2#telnet 202.101.225.2 //在R2上做NAT后可以访问外部网络

Trying 202.101.225.2 ... Open

Welcome to Microsoft Telnet Service

login: administrator

password: (huayu)

*=====================================================

Welcome to Microsoft Telnet Server.

*=====================================================

C:\Documents and Settings\Administrator&gt;cd \

C:\&gt;ipconfig

Windows IP Configuration

Ethernet adapter 本地连接 2:

Connection-specific DNS Suffix . :

IP Address. . . . . . . . . . . . : 202.101.225.2

Subnet Mask . . . . . . . . . . . : 255.255.255.0

Default Gateway . . . . . . . . . : 202.101.225.1

C:\&gt;exit

[Connection to 202.101.225.2 closed by foreign host]

PC2#ping 202.101.225.2

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 202.101.225.2, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 520/652/1056 ms

PC2#telnet 202.101.225.2 //在R1上做ACL后只能telnet外部网络

Trying 202.101.225.2 ... Open

Welcome to Microsoft Telnet Service

login: administrator

password: (huayu)

*=====================================================

Welcome to Microsoft Telnet Server.

*=====================================================

C:\Documents and Settings\Administrator&gt;cd \

C:\&gt;ipconfig

Windows IP Configuration

Ethernet adapter 本地连接 2:

Connection-specific DNS Suffix . :

IP Address. . . . . . . . . . . . : 202.101.225.2

Subnet Mask . . . . . . . . . . . : 255.255.255.0

Default Gateway . . . . . . . . . : 202.101.225.1

C:\&gt;exit

[Connection to 202.101.225.2 closed by foreign host]

PC2#ping 202.101.225.2 //PC2不能ping通外部网络

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 202.101.225.2, timeout is 2 seconds:

U.U.U

Success rate is 0 percent (0/5)

PC2#

路由器PC3的配置：

Router&gt; //用户模式

Router&gt;enable //从用户模式进入到特权模式

Router#configure terminal //从特权模式进入到全局模式

Router(config)#no ip domain-lookup //关闭域名查找

Router (config)#line console 0 //进入控制口

Router (config-line)#logging synchronous //光标跟随

Router (config-line)#exec-timeout 0 0 //关闭延迟

Router(config-line)#hostname PC3 //给路由器重命名为PC3

PC3(config)#interface f0/0

PC3(config-if)#ip address 172.16.30.30 255.255.255.0

PC3(config-if)#no shutdown

PC3(config-if)#exit

PC3(config)#ip route 0.0.0.0 0.0.0.0 172.16.30.1

PC3(config)#end

PC3#show ip route

Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP

D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area

N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2

E1 - OSPF external type 1, E2 - OSPF external type 2

i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2

ia - IS-IS inter area, * - candidate default, U - per-user static route

o - ODR, P - periodic downloaded static route

Gateway of last resort is 172.16.30.1 to network 0.0.0.0

172.16.0.0/24 is subnetted, 1 subnets

C 172.16.30.0 is directly connected, FastEthernet0/0

S* 0.0.0.0/0 [1/0] via 172.16.30.1

PC3#ping 172.16.30.1 //可以ping通网关

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 172.16.30.1, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 64/127/172 ms

PC3#ping 202.101.225.2 //在R2上做NAT后可以访问外部网络

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 202.101.225.2, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 240/475/776 ms

PC3#telnet 202.101.225.2

Trying 202.101.225.2 ... Open

Welcome to Microsoft Telnet Service

login: administrator

password: (huayu)

*====================================================

Welcome to Microsoft Telnet Server.

*====================================================

C:\Documents and Settings\Administrator&gt;cd \

C:\&gt;ipconfig

Windows IP Configuration

Ethernet adapter 本地连接 2:

Connection-specific DNS Suffix . :

IP Address. . . . . . . . . . . . : 202.101.225.2

Subnet Mask . . . . . . . . . . . : 255.255.255.0

Default Gateway . . . . . . . . . : 202.101.225.1

C:\&gt;exit

[Connection to 202.101.225.2 closed by foreign host]

PC3#ping 202.101.225.2 //在R1上做ACL后只能ping外部网络

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 202.101.225.2, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 468/687/1076 ms

PC3#telnet 202.101.225.2 //PC3不能telnet通外部网络

Trying 202.101.225.2 ...

% Destination unreachable; gateway or host down

PC3#

路由器S1的配置：

Router&gt; //用户模式

Router&gt;enable //从用户模式进入到特权模式

Router#configure terminal //从特权模式进入到全局模式

Router(config)#no ip domain-lookup //关闭域名查找

Router (config)#line console 0 //进入控制口

Router (config-line)#logging synchronous //光标跟随

Router (config-line)#exec-timeout 0 0 //关闭延迟

Router(config-line)#hostname S1 //给路由器重命名为S1

S1(config)#exit

S1#vlan database

S1(vlan)#vtp domain huayu

S1(vlan)#vtp client //定义为vtp客户端

S1(vlan)#exit

S1#configure terminal

S1(config)#interface range f0/13 �C 14 //接口做trunk

S1(config-if-range)#switchport mode trun

S1(config-if-range)#switchport trunk encapsulation dot1q

S1(config-if-range)#no shutdown

S1(config-if-range)#end

S1#show vlan-switch brief //查看学习到的vlan信息

VLAN Name Status Ports

---- -------------------------------- --------- -------------------------------

1 default active Fa0/0, Fa0/9, Fa0/15

10 aa active Fa0/1, Fa0/2, Fa0/3, Fa0/4

20 bb active Fa0/5, Fa0/6, Fa0/7, Fa0/8

30 cc active Fa0/10, Fa0/11, Fa0/12

1002 fddi-default active

1003 token-ring-default active

1004 fddinet-default active

1005 trnet-default active

S1#configure terminal

S1(config)#interface range f0/1 �C 4 //接口划分vlan

S1(config-if-range)#switchport mode access

S1(config-if-range)#switchport access vlan 10

S1(config-if-range)#no shutdown

S1(config-if-range)#interface range f0/5 - 8

S1(config-if-range)#switchport mode access

S1(config-if-range)#switchport access vlan 20

S1(config-if-range)#no shutdown

S1(config-if-range)#interface range f0/10 - 12

S1(config-if-range)#switchport mode access

S1(config-if-range)#switchport access vlan 30

S1(config-if-range)#no shutdown

S1(config-if-range)#end

S1#show running-config

Building configuration...

Current configuration : 1212 bytes

!

version 12.4

service timestamps debug datetime msec

service timestamps log datetime msec

no service password-encryption

!

hostname S1

!

boot-start-marker

boot-end-marker

!

!

no aaa new-model

memory-size iomem 5

!

!

ip cef

!

!

no ip domain lookup

!

!

interface FastEthernet0/0

!

interface FastEthernet0/1

switchport access vlan 10

!

interface FastEthernet0/2

switchport access vlan 10

!

interface FastEthernet0/3

switchport access vlan 10

!

interface FastEthernet0/4

switchport access vlan 10

!

interface FastEthernet0/5

switchport access vlan 20

!

interface FastEthernet0/6

switchport access vlan 20

!

interface FastEthernet0/7

switchport access vlan 20

!

interface FastEthernet0/8

switchport access vlan 20

!

interface FastEthernet0/9

!

interface FastEthernet0/10

switchport access vlan 30

!

interface FastEthernet0/11

switchport access vlan 30

!

interface FastEthernet0/12

switchport access vlan 30

!

interface FastEthernet0/13

switchport mode trunk

!

interface FastEthernet0/14

switchport mode trunk

!

interface FastEthernet0/15

!

interface Vlan1

no ip address

!

ip http server

!

!

control-plane

!

!

line con 0

exec-timeout 0 0

logging synchronous

line aux 0

line vty 0 4

!

end

S1#

路由器S2的配置：

Router&gt; //用户模式

Router&gt;enable //从用户模式进入到特权模式

Router#configure terminal //从特权模式进入到全局模式

Router(config)#no ip domain-lookup //关闭域名查找

Router (config)#line console 0 //进入控制口

Router (config-line)#logging synchronous //光标跟随

Router (config-line)#exec-timeout 0 0 //关闭延迟

Router(config-line)#hostname S2 //给路由器重命名为S2

S2(config)#exit

S2#vlan database //创建三个vlan

S1(vlan)#vlan 10 name aa

S1(vlan)#vlan 20 name bb

S1(vlan)#vlan 30 name cc

S2(vlan)#vtp domain huayu

S2(vlan)#vtp server //定义为vtp服务器端

S2(vlan)#exit

S2#configure terminal

S2(config)#interface range f0/13 �C 15 //接口做trunk

S2(config-if-range)#switchport mode trun

S2(config-if-range)#switchport trunk encapsulation dot1q

S2(config-if-range)#no shutdown

S2(config-if-range)#end

S2#show vlan-switch brief

VLAN Name Status Ports

---- -------------------------------- --------- -------------------------------

1 default active Fa0/0, Fa0/1, Fa0/2, Fa0/3

Fa0/4, Fa0/5, Fa0/6, Fa0/7

Fa0/8, Fa0/9, Fa0/10, Fa0/11

Fa0/12

10 aa active

20 bb active

30 cc active

1002 fddi-default active

1003 token-ring-default active

1004 fddinet-default active

1005 trnet-default active

S2#

路由器R1的配置：

Router&gt; //用户模式

Router&gt;enable //从用户模式进入到特权模式

Router#configure terminal //从特权模式进入到全局模式

Router(config)#no ip domain-lookup //关闭域名查找

Router (config)#line console 0 //进入控制口

Router (config-line)#logging synchronous //光标跟随

Router (config-line)#exec-timeout 0 0 //关闭延迟

Router(config-line)#hostname R1 //给路由器重命名为R1

R1(config)#interface f1/0

R1(config-if)#no shutdown

R1(config-if)#interface f1/0.1 //配置子接口

R1(config-subif)#encapsulation dot1Q 10 //封装协议做vlan10标记

R1(config-subif)#ip address 172.16.10.1 255.255.255.0 //配置子接口的ip地址

R1(config-subif)#no shutdown

R1(config-subif)#interface f1/0.2

R1(config-subif)#encapsulation dot1Q 20

R1(config-subif)#ip address 172.16.20.1 255.255.255.0

R1(config-subif)#no shutdown

R1(config-subif)#interface f1/0.3

R1(config-subif)#encapsulation dot1Q 30

R1(config-subif)#ip address 172.16.30.1 255.255.255.0

R1(config-subif)#no shutdown

R1(config-subif)#interface s0/0

R1(config-if)#ip address 172.31.31.2 255.255.255.252

R1(config-if)#no shutdown

R1(config-if)#end

R1#show ip route

Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP

D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area

N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2

E1 - OSPF external type 1, E2 - OSPF external type 2

i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2

ia - IS-IS inter area, * - candidate default, U - per-user static route

o - ODR, P - periodic downloaded static route

Gateway of last resort is not set

172.16.0.0/24 is subnetted, 3 subnets

C 172.16.30.0 is directly connected, FastEthernet1/0.3

C 172.16.20.0 is directly connected, FastEthernet1/0.2

C 172.16.10.0 is directly connected, FastEthernet1/0.1

172.31.0.0/30 is subnetted, 1 subnets

C 172.31.31.0 is directly connected, Serial0/0

R1#configure terminal

R1(config)#router ospf 1 //宣告内部网络

R1(config-router)#network 172.16.10.1 0.0.0.0 area 0

R1(config-router)#network 172.16.20.1 0.0.0.0 area 0

R1(config-router)#network 172.16.30.1 0.0.0.0 area 0

R1(config-router)#network 172.31.31.2 0.0.0.0 area 0

R1(config-router)#end

R1#show ip route

Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP

D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area

N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2

E1 - OSPF external type 1, E2 - OSPF external type 2

i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2

ia - IS-IS inter area, * - candidate default, U - per-user static route

o - ODR, P - periodic downloaded static route

Gateway of last resort is not set

172.16.0.0/24 is subnetted, 3 subnets

C 172.16.30.0 is directly connected, FastEthernet1/0.3

C 172.16.20.0 is directly connected, FastEthernet1/0.2

C 172.16.10.0 is directly connected, FastEthernet1/0.1

172.31.0.0/30 is subnetted, 1 subnets

C 172.31.31.0 is directly connected, Serial0/0

R1#show ip route //R2发布默认路由信息后路由表

Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP

D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area

N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2

E1 - OSPF external type 1, E2 - OSPF external type 2

i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2

ia - IS-IS inter area, * - candidate default, U - per-user static route

o - ODR, P - periodic downloaded static route

Gateway of last resort is 172.31.31.1 to network 0.0.0.0

172.16.0.0/24 is subnetted, 3 subnets

C 172.16.30.0 is directly connected, FastEthernet1/0.3

C 172.16.20.0 is directly connected, FastEthernet1/0.2

C 172.16.10.0 is directly connected, FastEthernet1/0.1

172.31.0.0/30 is subnetted, 1 subnets

C 172.31.31.0 is directly connected, Serial0/0

O*E2 0.0.0.0/0 [110/1] via 172.31.31.1, 00:00:36, Serial0/0

R1#configure terminal //做三条扩展ACL

R1(config)#access-list 100 permit ip 172.16.10.0 0.0.0.255 any //允许任何

R1(config)#access-list 100 permit tcp 172.16.20.0 0.0.0.255 any eq telnet //只能telnet

R1(config)#access-list 100 permit icmp 172.16.30.0 0.0.0.255 any echo //只能ping

R1(config)#interface f1/0 //扩展ACL应用在接口上

R1(config-if)#ip access-group 100 in

R1(config -subif)#interface f1/0.1

R1(config -subif)#ip access-group 100 in

R1(config -subif)#interface f1/0.2

R1(config -subif)#ip access-group 100 in

R1(config -subif)#interface f1/0.3

R1(config -subif)#ip access-group 100 in

R1(config -subif)#end

R1#show running-config

Building configuration...

Current configuration : 1478 bytes

!

version 12.4

service timestamps debug datetime msec

service timestamps log datetime msec

no service password-encryption

!

hostname R1

!

boot-start-marker

boot-end-marker

!

!

no aaa new-model

memory-size iomem 5

!

!

ip cef

!

!

no ip domain lookup

!

!

interface Serial0/0

ip address 172.31.31.2 255.255.255.252

serial restart-delay 0

!

interface Serial0/1

no ip address

shutdown

serial restart-delay 0

!

interface Serial0/2

no ip address

shutdown

serial restart-delay 0

!

interface Serial0/3

no ip address

shutdown

serial restart-delay 0

!

interface FastEthernet1/0

no ip address

ip access-group 100 in

duplex auto

speed auto

!

interface FastEthernet1/0.1

encapsulation dot1Q 10

ip address 172.16.10.1 255.255.255.0

ip access-group 100 in

!

interface FastEthernet1/0.2

encapsulation dot1Q 20

ip address 172.16.20.1 255.255.255.0

ip access-group 100 in

!

interface FastEthernet1/0.3

encapsulation dot1Q 30

ip address 172.16.30.1 255.255.255.0

ip access-group 100 in

!

router ospf 1

log-adjacency-changes

network 172.16.10.1 0.0.0.0 area 0

network 172.16.20.1 0.0.0.0 area 0

network 172.16.30.1 0.0.0.0 area 0

network 172.31.31.2 0.0.0.0 area 0

!

ip http server

!

!

access-list 100 permit icmp 172.16.30.0 0.0.0.255 any echo

access-list 100 permit tcp 172.16.20.0 0.0.0.255 any eq telnet

access-list 100 permit ip 172.16.10.0 0.0.0.255 any

!

!

control-plane

!

!

line con 0

exec-timeout 0 0

logging synchronous

line aux 0

line vty 0 4

!

end

R1#

路由器R2的配置：

Router&gt; //用户模式

Router&gt;enable //从用户模式进入到特权模式

Router#configure terminal //从特权模式进入到全局模式

Router(config)#no ip domain-lookup //关闭域名查找

Router (config)#line console 0 //进入控制口

Router (config-line)#logging synchronous //光标跟随

Router (config-line)#exec-timeout 0 0 //关闭延迟

Router(config-line)#hostname R2 //给路由器重命名为R2

R2(config)#interface s0/0

R2(config-if)#ip address 172.31.31.1 255.255.255.252

R2(config-if)#no shutdown

R2(config-if)#interface s0/1

R2(config-if)#ip address 202.101.224.2 255.255.255.0

R2(config-if)#no shutdown

R2(config-if)#end

R2#show ip route

Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP

D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area

N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2

E1 - OSPF external type 1, E2 - OSPF external type 2

i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2

ia - IS-IS inter area, * - candidate default, U - per-user static route

o - ODR, P - periodic downloaded static route

Gateway of last resort is not set

172.31.0.0/30 is subnetted, 1 subnets

C 172.31.31.0 is directly connected, Serial0/0

C 202.101.224.0/24 is directly connected, Serial0/1

R2#configure terminal

R2(config)#router ospf 1

R2(config-router)#network 172.31.31.1 0.0.0.0 area 0

R2(config-router)#end

R2#show ip route

Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP

D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area

N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2

E1 - OSPF external type 1, E2 - OSPF external type 2

i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2

ia - IS-IS inter area, * - candidate default, U - per-user static route

o - ODR, P - periodic downloaded static route

Gateway of last resort is not set

172.16.0.0/24 is subnetted, 3 subnets

O 172.16.30.0 [110/65] via 172.31.31.2, 00:01:04, Serial0/0

O 172.16.20.0 [110/65] via 172.31.31.2, 00:01:04, Serial0/0

O 172.16.10.0 [110/65] via 172.31.31.2, 00:01:04, Serial0/0

172.31.0.0/30 is subnetted, 1 subnets

C 172.31.31.0 is directly connected, Serial0/0

C 202.101.224.0/24 is directly connected, Serial0/1

R2#configure terminal

R2(config)#router ospf 1

R2(config-router)#default-information originate //向内部网络发布缺省路由

R2(config-router)#exit

R2(config)#ip route 0.0.0.0 0.0.0.0 202.101.224.1 //指定网关后缺省路由才生效

R2(config)#end

R2#show ip route

Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP

D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area

N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2

E1 - OSPF external type 1, E2 - OSPF external type 2

i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2

ia - IS-IS inter area, * - candidate default, U - per-user static route

o - ODR, P - periodic downloaded static route

Gateway of last resort is 202.101.224.1 to network 0.0.0.0

172.16.0.0/24 is subnetted, 3 subnets

O 172.16.30.0 [110/65] via 172.31.31.2, 00:00:24, Serial0/0

O 172.16.20.0 [110/65] via 172.31.31.2, 00:00:24, Serial0/0

O 172.16.10.0 [110/65] via 172.31.31.2, 00:00:24, Serial0/0

172.31.0.0/30 is subnetted, 1 subnets

C 172.31.31.0 is directly connected, Serial0/0

C 202.101.224.0/24 is directly connected, Serial0/1

S* 0.0.0.0/0 [1/0] via 202.101.224.1

R2#configure terminal

R2(config)#interface S0/0 //定义内外网接口

R2(config-if)#ip nat insid

R2(config-if)#interface S0/1

R2(config-if)#ip nat outside

R2(config-if)#exit //做NAT

R2(config)#access-list 1 permit 172.16.0.0 0.0.255.255

R2(config)#ip nat inside source list 1 interface S0/1 overload

R2(config)#end

R2#debug ip nat

IP NAT debugging is on

*Mar 1 00:20:02.959: NAT*: s=172.16.10.10-&gt;202.101.224.2, d=202.101.224.1 [50]

*Mar 1 00:20:03.367: NAT*: s=202.101.224.1, d=202.101.224.2-&gt;172.16.10.10 [50]

*Mar 1 00:20:11.851: NAT*: s=172.16.20.20-&gt;202.101.224.2, d=202.101.224.1 [20]

*Mar 1 00:20:12.023: NAT*: s=202.101.224.1, d=202.101.224.2-&gt;172.16.20.20 [20]

*Mar 1 00:20:15.727: NAT*: s=172.16.30.30-&gt;202.101.224.2, d=202.101.224.1 [21]

*Mar 1 00:20:15.907: NAT*: s=202.101.224.1, d=202.101.224.2-&gt;172.16.30.30 [21]

*Mar 1 00:20:25.407: NAT*: s=172.16.10.10-&gt;202.101.224.2, d=202.101.225.1 [55]

*Mar 1 00:20:25.543: NAT*: s=202.101.225.1, d=202.101.224.2-&gt;172.16.10.10 [55]

*Mar 1 00:20:31.695: NAT*: s=172.16.10.10-&gt;202.101.224.2, d=202.101.225.2 [60]

*Mar 1 00:20:32.007: NAT*: s=202.101.225.2, d=202.101.224.2-&gt;172.16.10.10 [14454]

R2#no debug all

All possible debugging has been turned off

R2#show ip nat translations

Pro Inside global Inside local Outside local Outside global

icmp 202.101.224.2:10 172.16.10.10:10 202.101.224.1:10 202.101.224.1:10

icmp 202.101.224.2:11 172.16.10.10:11 202.101.225.1:11 202.101.225.1:11

icmp 202.101.224.2:12 172.16.10.10:12 202.101.225.2:12 202.101.225.2:12

icmp 202.101.224.2:4 172.16.20.20:4 202.101.224.1:4 202.101.224.1:4

icmp 202.101.224.2:0 172.16.30.30:4 202.101.224.1:4 202.101.224.1:0

R2#show running-config

Building configuration...

Current configuration : 1019 bytes

!

version 12.4

service timestamps debug datetime msec

service timestamps log datetime msec

no service password-encryption

!

hostname R2

!

boot-start-marker

boot-end-marker

!

!

no aaa new-model

memory-size iomem 5

!

ip cef

!

no ip domain lookup

!

interface Serial0/0

ip address 172.31.31.1 255.255.255.252

ip nat inside

ip virtual-reassembly

serial restart-delay 0

!

interface Serial0/1

ip address 202.101.224.2 255.255.255.0

ip nat outside

ip virtual-reassembly

serial restart-delay 0

!

interface Serial0/2

no ip address

shutdown

serial restart-delay 0

!

interface Serial0/3

no ip address

shutdown

serial restart-delay 0

!

router ospf 1

log-adjacency-changes

network 172.31.31.1 0.0.0.0 area 0

default-information originate

!

ip http server

ip route 0.0.0.0 0.0.0.0 202.101.224.1

!

ip nat inside source list 1 interface Serial0/1 overload

!

access-list 1 permit 172.16.0.0 0.0.255.255

!

control-plane

!

line con 0

exec-timeout 0 0

logging synchronous

line aux 0

line vty 0 4

!

end

R2#

路由器R3的配置：

Router&gt; //用户模式

Router&gt;enable //从用户模式进入到特权模式

Router#configure terminal //从特权模式进入到全局模式

Router(config)#no ip domain-lookup //关闭域名查找

Router (config)#line console 0 //进入控制口

Router (config-line)#logging synchronous //光标跟随

Router (config-line)#exec-timeout 0 0 //关闭延迟

Router(config-line)#hostname R3 //给路由器重命名为R3

R3(config)#interface s0/0

R3(config-if)#ip address 202.101.224.1 255.255.255.0

R3(config-if)#no shutdown

R3(config-if)#interface f1/0

R3(config-if)#ip address 202.101.225.1 255.255.255.0

R3(config-if)#no shutdown

R3(config-if)#exit

R3(config)#ip route 0.0.0.0 0.0.0.0 202.101.225.2

R3(config)#end

R3#show ip route

Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP

D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area

N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2

E1 - OSPF external type 1, E2 - OSPF external type 2

i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2

ia - IS-IS inter area, * - candidate default, U - per-user static route

o - ODR, P - periodic downloaded static route

Gateway of last resort is 202.101.225.2 to network 0.0.0.0

C 202.101.224.0/24 is directly connected, Serial0/0

C 202.101.225.0/24 is directly connected, FastEthernet1/0

S* 0.0.0.0/0 [1/0] via 202.101.225.2

R3#