神码设备，实验配置案例(一)

项目制作人：都市网达

以下路由交换设备为神州数码

项目完成限时：2小时00分

一、项目背景

在一个公司网络中，有总公司与分公司两地，分开办公。

总公司使用两台二层交换机SW1、SW2作为接入设备，接入PC机若干，两台交换机使用链路汇聚功能加大交换机之间的数据传输带宽。在交换机之下有VLAN11、12、13、14分别用于四个部门办公， VLAN中对应的网关地址分别为：10.10.11.1/24、10.10.12.1/24、10.10.13.1/24、10.10.14.1/24，使用R1作为DHCP服务器为每个VLAN分别提供IP地址，SW1上接路由器R1，并使用路由器R1的PAT功能为PC提供网络服务。

分公司有WEB服务器一台，PC若干，连接在三层交换上。在三层中，WEB服务器属于VLAN6（10.10.6.1/24），PC机属于VLAN7（10.10.7.1/24）。三层交换与电信以及网通的路由器R2、R3相连，为连接在三层上的设备提供服务。

广域网中，有电信路由器R2与网通路由器R3，分别与R1与SW3相连（R2 R3没有相连、R1与SW3也没有相连）。购买到的电信地址为202.103.96.9/30与202.103.96.13/30，购买到的网通地址为58.20.200.20/30与58.20.200.26/30。

二、项目要求

1、  总公司PC采用PAT上网，其中： 总公司 VLAN11的PC只能访问网站、VLAN12的PC能够正常上网、VLAN13与VLAN14不能上网。分公司中PC能正常上网，服务器须对外提供远程协助服务以及WEB服务。

2、  广域网中使用RIP v 2交换路由表，并且相互之间需要通过认证，密文密钥自拟。

3、  配置策略，总公司PC访问SERVER时默认使用电信线路，当电信线路无效时使用网通线路。

4、  总公司中对于内网的安全有严格的控制。VLAN11能与其他VLAN互相访问，VLAN12能主动访问其他VLAN，VLAN13与VLAN14只能访问VLAN11与被VLAN12访问。并且要求在网内能防范日常的攻击（震荡波、冲击波、ARP病毒）。

5、  三层交换中的VLAN采用动态VLAN与IP地址相绑定，并且严格控制三层上接入设备的带宽。

6、  所有设备需定义好设备名，设备之间都要能使用SSH进行登录，用户名密码自拟。

三、项目最终上交资料

1、 网络结构拓朴图；

2、 所有设备配置文件，每个设备单独一个DOC文件，文件名以设备名命名。

四、项目提供设备

交换机	型号	数量
	DCRS-5950	1
	DCS-3950	2
路由器	型号	数量
	DCR- 2659	3
PC	系统	数量
	WinXP	3
服务器	服务	数量
	Web服务	1

 

 

以下为配置文件：

SW1（二层交换）:

hostname SW1
vendorlocation China
vendorContact 800-810-9119
ssh-server enable
ssh-user admin password 0 admin
spanning-tree
vlan 1
vlan 11
vlan 12
vlan 13
vlan 14
port-group 1
Interface Ethernet0/0/1
 switchport access vlan 11
Interface Ethernet0/0/2
 switchport access vlan 11
!
Interface Ethernet0/0/3
 switchport access vlan 11
!
Interface Ethernet0/0/4
 switchport access vlan 12
!
Interface Ethernet0/0/5
 switchport access vlan 12
!
Interface Ethernet0/0/6
 switchport access vlan 12
!
Interface Ethernet0/0/7
 switchport access vlan 13
!
Interface Ethernet0/0/8
 switchport access vlan 13
!
Interface Ethernet0/0/9
 switchport access vlan 13
!
Interface Ethernet0/0/10
 switchport access vlan 14
!
Interface Ethernet0/0/11
 switchport access vlan 14
!
Interface Ethernet0/0/12
 switchport access vlan 14
!
Interface Ethernet0/0/13
!
Interface Ethernet0/0/22
 switchport mode trunk
!
Interface Ethernet0/0/23
 switchport mode trunk
 port-group 1 mode on
!
Interface Ethernet0/0/24
 switchport mode trunk
 port-group 1 mode on
!

SW2（二层交换）:

hostname SW2
vendorlocation China
vendorContact 800-810-9119
!
!
ssh-server enable
ssh-user admin password 0 admin
spanning-tree

vlan 1

vlan 11

vlan 12

vlan 13

vlan 14

port-group 1

Interface Ethernet0/0/1
 switchport access vlan 11

Interface Ethernet0/0/2
 switchport access vlan 11

Interface Ethernet0/0/3
 switchport access vlan 11

Interface Ethernet0/0/4
 switchport access vlan 12

Interface Ethernet0/0/5
 switchport access vlan 12

Interface Ethernet0/0/6
 switchport access vlan 12

Interface Ethernet0/0/7
 switchport access vlan 13

Interface Ethernet0/0/8
 switchport access vlan 13

Interface Ethernet0/0/9
 switchport access vlan 13

Interface Ethernet0/0/10
 switchport access vlan 14

Interface Ethernet0/0/11
 switchport access vlan 14

Interface Ethernet0/0/12
 switchport access vlan 14

Interface Ethernet0/0/13

Interface Ethernet0/0/23
 switchport mode trunk
 port-group 1 mode on

Interface Ethernet0/0/24
 switchport mode trunk
 port-group 1 mode on

SW3（三层交换）：

hostname sw3
sysLocation China
sysContact 800-810-9119
!
username admin privilege 15 password 0 admin
ssh-server enable
vlan 1
!
vlan 6
!
vlan 7
!
vlan 100
!
vlan 200
!
Interface Ethernet1/1
 switchport mode hybrid
 switchport hybrid allowed vlan 1-100 untag
!
Interface Ethernet1/2
 switchport mode hybrid
 switchport hybrid allowed vlan 1-100 untag
!
Interface Ethernet1/3
 switchport mode hybrid
 switchport hybrid allowed vlan 1-100 untag
!
Interface Ethernet1/4
 switchport mode hybrid
 switchport hybrid allowed vlan 1-100 untag
!
Interface Ethernet1/5
 switchport mode hybrid
 switchport hybrid allowed vlan 1-100 untag
!
Interface Ethernet1/6
 switchport mode hybrid
 switchport hybrid allowed vlan 1-100 untag
!
Interface Ethernet1/7
 switchport mode hybrid
 switchport hybrid allowed vlan 1-100 untag
!
Interface Ethernet1/8
 switchport mode hybrid
 switchport hybrid allowed vlan 1-100 untag
!
Interface Ethernet1/9
 switchport mode hybrid
 switchport hybrid allowed vlan 1-100 untag
!
Interface Ethernet1/10
 switchport mode hybrid
 switchport hybrid allowed vlan 1-100 untag
!
Interface Ethernet1/11
 switchport mode hybrid
 switchport hybrid allowed vlan 1-100 untag
!
Interface Ethernet1/12
 switchport mode hybrid
 switchport hybrid allowed vlan 1-100 untag
!
Interface Ethernet1/13
 switchport mode hybrid
 switchport hybrid allowed vlan 1-100 untag
!
Interface Ethernet1/14
 switchport mode hybrid
 switchport hybrid allowed vlan 1-100 untag
!
Interface Ethernet1/15
 switchport mode hybrid
 switchport hybrid allowed vlan 1-100 untag
!
Interface Ethernet1/16
!
Interface Ethernet1/17
!
Interface Ethernet1/18
!
Interface Ethernet1/19
!
Interface Ethernet1/20
!
Interface Ethernet1/21
!
Interface Ethernet1/22
!
Interface Ethernet1/23
 switchport access vlan 100
!
Interface Ethernet1/24
 switchport access vlan 200
!
Interface Ethernet1/25
!
Interface Ethernet1/26
!
Interface Ethernet1/27
!
Interface Ethernet1/28
!
interface Vlan1
 ip address 192.168.10.1 255.255.255.0
!
interface Vlan6
 ip address 10.10.6.1 255.255.255.0
!
interface Vlan7
 ip address 10.10.7.1 255.255.255.0
!
interface Vlan100
 ip rip authentication mode md5
 ip rip authentication string aaa
 ip address 202.103.96.13 255.255.255.252
!
interface Vlan200
 ip rip authentication mode md5
 ip rip authentication string aaa
 ip address 58.20.200.26 255.255.255.0
!
router rip
 network 10.10.6.0/24
 network 10.10.7.0/24
 network 58.20.200.0/24
 network 202.103.96.0/24
no login
!
subnet-vlan ip-address 10.10.7.2 mask 255.255.255.0 vlan 7 priority 0
subnet-vlan ip-address 10.10.6.2 mask 255.255.255.0 vlan 6 priority 0
end

R1（总公司接入路由）:

hostname R1

gbsc group default

aaa authentication login default local none
aaa authentication enable default enable
!
username admin password 0 admin privilege 15
!
enable password 0 admin level 15
!
!
!
interface FastEthernet0/0
 no ip address
 no ip directed-broadcast
!
interface FastEthernet0/0.1
 ip address 10.10.11.1 255.255.255.0
 no ip directed-broadcast
 encapsulation dot1Q 11
 bandwidth 100000
 delay 1
 ip nat inside
!
interface FastEthernet0/0.2
 ip address 10.10.12.1 255.255.255.0
 no ip directed-broadcast
 encapsulation dot1Q 12
 bandwidth 100000
 delay 1
 ip nat inside
!
interface FastEthernet0/0.3
 ip address 10.10.13.1 255.255.255.0
 no ip directed-broadcast
 encapsulation dot1Q 13
 bandwidth 100000
 delay 1
 ip nat inside
!
interface FastEthernet0/0.4
 ip address 10.10.14.1 255.255.255.0
 no ip directed-broadcast
 encapsulation dot1Q 14
 bandwidth 100000
 delay 1
 ip nat inside
!
interface GigaEthernet0/3
 ip address 192.168.100.1 255.255.255.0
 no ip directed-broadcast
!
interface GigaEthernet0/4
 ip address 58.20.200.21 255.255.255.252
 no ip directed-broadcast
 ip rip authentication md5
 ip rip md5-key 1 md5 aaa
 ip nat outside
!
interface GigaEthernet0/5
 ip address 202.103.96.9 255.255.255.252
 no ip directed-broadcast
 ip rip authentication md5
 ip rip md5-key 1 md5 aaa
 ip nat outside
!
interface GigaEthernet0/6
 no ip address
 no ip directed-broadcast
!
interface Serial0/1
 no ip address
 no ip directed-broadcast
!
interface Serial0/2
 no ip address
 no ip directed-broadcast
!
interface Async0/0
 no ip address
 no ip directed-broadcast
!
!
!
!
router rip
 version 2
 no auto-summary
 network 202.103.96.8 255.255.255.252
 network 58.20.200.20 255.255.255.252

ip access-list standard namepat
 permit 10.10.11.0 255.255.255.0
 permit 10.10.12.0 255.255.255.0
 permit 10.10.13.0 255.255.255.0
 permit 10.10.14.0 255.255.255.0
 deny   any
!
ip access-list extended vlan13-14
 deny   tcp 10.10.13.0 255.255.255.0 any eq www
 deny   tcp 10.10.14.0 255.255.255.0 any eq www
 permit ip any any

ip dhcpd pool vlan11
 network 10.10.11.0 255.255.255.0
 range 10.10.11.10 10.10.11.100
 default-router 10.10.11.1
!
ip dhcpd pool vlan13
 network 10.10.13.0 255.255.255.0
 range 10.10.13.10 10.10.13.100
 default-router 10.10.13.1 255.255.255.0
!
ip dhcpd pool vlan14
 network 10.10.14.0 255.255.255.0
 range 10.10.14.10 10.10.14.100
 default-router 10.10.14.1
!
ip dhcpd pool vlan12
 network 10.10.12.0 255.255.255.0
 range 10.10.12.10 10.10.12.100
 default-router 10.10.12.1
!
ip dhcpd enable
!
ip nat inside source list namepat interface GigaEthernet0/4
ip nat inside source list namepat interface GigaEthernet0/5

 R2（为电信路由）：

hostname R2

gbsc group default
!
interface FastEthernet0/0
 no ip address
 no ip directed-broadcast
!
interface GigaEthernet0/3
 no ip address
 no ip directed-broadcast
!
interface GigaEthernet0/4
 ip address 202.103.96.14 255.255.255.252
 no ip directed-broadcast
!
interface GigaEthernet0/5
 ip address 202.103.96.10 255.255.255.252
 no ip directed-broadcast
 ip rip authentication md5
 ip rip md5-key 1 md5 aaa
!
interface GigaEthernet0/6
 no ip address
 no ip directed-broadcast
 ip rip authentication md5
 ip rip md5-key 1 md5 aaa
!
interface Serial0/1
 no ip address
 no ip directed-broadcast
!
interface Serial0/2
 no ip address
 no ip directed-broadcast
!
interface Async0/0
 no ip address
 no ip directed-broadcast

router rip
 version 2
 no auto-summary
 network 202.103.96.0 255.255.255.0

R3（为网通路由）:

hostname R3

!
gbsc group default

interface FastEthernet0/0
 no ip address
 no ip directed-broadcast
!
interface GigaEthernet0/3
 no ip address
 no ip directed-broadcast
!
interface GigaEthernet0/4
 ip address 58.20.200.22 255.255.255.252
 no ip directed-broadcast
!
interface GigaEthernet0/5
 no ip address
 no ip directed-broadcast
 ip rip authentication md5
 ip rip md5-key 1 md5 aaa
!
interface GigaEthernet0/6
 ip address 58.20.200.25 255.255.255.252
 no ip directed-broadcast
 ip rip authentication md5
 ip rip md5-key 1 md5 aaa
!
interface Serial0/1
 no ip address
 no ip directed-broadcast
!
interface Serial0/2
 no ip address
 no ip directed-broadcast
!
interface Async0/0
 no ip address
 no ip directed-broadcast
router rip
 version 2
 no auto-summary
 network 58.20.200.20 255.255.255.252
 network 58.20.200.24 255.255.255.252