0
0

基于eNSP加防火墙的千人中型校园/企业网络规划与设计(附所有配置命令)

作者：BSXY_19计科_陈永跃

BSXY_信息学院

注：未经允许禁止转发任何内容

基于eNSP加防火墙的千人中型校园/企业网络规划与设计

前言及资源下载说明（ 未经允许禁止转发任何内容 ）

有什么问题可以在评论区说明自己遇到的情况，博主看到会第一时间回复，希望其他人也可以回复别人的问题，。
可根据以下所提供的设计与实现步骤过程一步一步自行实现（每一条命令都是关键的命令）；但是如果有需要的也可以根据以下地址进行下载完整的topo图和完整的配置进行参考与借鉴，如若拿到topo图可多display查看配置，查看相应的命令，配套资源连接如下：

基于eNSP加防火墙的千人中型校园/企业网络规划与设计topo图(有线+无线).rar + 所有配置命令(order.txt)

(注：order.txt, 以下加红色标记及注释的图片 是为了照顾一下拿到topo及配置不display查看topo配置的人加的(当然以上基于eNSP加防火墙的千人中型校园/企业网络规划与设计topo图及其配置是全的))在这里插入图片描述

一、设计topo图与设计要求(15个要求)

拓扑图1：
请添加图片描述
拓扑图2：
请添加图片描述
设计要求：

01、完成服务器、防火墙、路由器等接口地址的配置
02、配置Eth-Trunk 链路捆绑实现链路冗余
03、企业内部划分多个vlan,减小广播域大小，提高网络的可靠性
04、配置MSTP+VRRP实现流量负载分担，同时实现冗余，并配置相应的stp优化技术stp收敛，减少stp震荡
05、所有用户均为自动获取IP地址
06、配置相应的DHCP snooping隔绝非法DHCP server
07、配置OSPF和静态路由实现三层路由互通
08、防火墙配置安全策略，放行内网区域到dmz区的流量
09、防火墙配置NAT策略和安全策略，使得用户可以访问外网百度
10、防火墙配置服务器映射和安全策略，允许外网用户Client通过公网地址100.100.100.100访问web服务器
11、防火墙配置相应策略，允许外网用户Client通过公网http://100.100.100.100访问登录web服务器
12、用户能够通过域名(www.baidu.com)访问外网百度
13、内部财务服务器只允许vlan 50用户访问
14、LSW1-LSW12交换机都能被telnet(huawei 5555)
15、无线WLAN配置，且业务vlan 101 102也可以通过域名(www.baidu.com)访问外网百度

二、改造前topo无防火墙(插曲:可看可不看)

插曲部分：改造前的冗余型的网络设计，改造前基于eNSP的千人规模 冗余型 中型校园/企业网络设计与规划 如下图所示（但是并不在该篇文章中做详细介绍和说明，如查看可点击连接自行查看阅读）：

请添加图片描述请添加图片描述

三、配置全过程

1、VLAN Trunk配置

  1.     HX_SW1:<Huawei>sy
  2. [Huawei]un in en
  3. [Huawei]sysname HX_SW1
  4. [HX_SW1]intEth-Trunk1[HX_SW1-Eth-Trunk1]mode lacp-static[HX_SW1-Eth-Trunk1]trunkport  g0/0/7[HX_SW1-Eth-Trunk1]trunkport g0/0/8[HX_SW1-Eth-Trunk1]q
  5. ------------------------------------ 
  6.     
  7.     HX_SW2:<Huawei>sys
  8. [Huawei]un in en
  9. [Huawei]sysname HX_SW2
  10. [HX_SW2]intEth-Trunk1[HX_SW2-Eth-Trunk1]mode lacp-static[HX_SW2-Eth-Trunk1]trunkport g0/0/7[HX_SW2-Eth-Trunk1]trunkport g0/0/8[HX_SW2-Eth-Trunk1]q
  11. ------------------------------------
  12.     
  13.     HJ_SW4:<Huawei>sy
  14. [Huawei]sysname HJ_SW4
  15. [HJ_SW4]intEth-Trunk2[HJ_SW4-Eth-Trunk2]mode lacp-static[HJ_SW4-Eth-Trunk2]trunkport g0/0/4[HJ_SW4-Eth-Trunk2]trunkport g0/0/5[HJ_SW4-Eth-Trunk2]q
  16. ------------------------------------
  17.     
  18.     JR_SW9:<Huawei>sy
  19. [Huawei]un in en
  20. [Huawei]sysname JR_SW9
  21. [JR_SW9]intEth-Trunk2[JR_SW9-Eth-Trunk2]mode lacp-static[JR_SW9-Eth-Trunk2]trunkport g0/0/4[JR_SW9-Eth-Trunk2]trunkport g0/0/5[JR_SW9-Eth-Trunk2]dis eth-trunk//查看eth-trunk的配置

在这里插入图片描述

2、VLAN底层配置

  1.     JR_SW6:<Huawei>SY
  2. [Huawei]un in en    
  3. [Huawei]sysname JR_SW6
  4. [JR_SW6]vlan batch 20304050607080200900[JR_SW6]int g0/0/1[JR_SW6-GigabitEthernet0/0/1]port link-type trunk 
  5. [JR_SW6-GigabitEthernet0/0/1]port trunk allow-pass vlan 2030900[JR_SW6-GigabitEthernet0/0/1]int g0/0/2[JR_SW6-GigabitEthernet0/0/2]port link-type access 
  6. [JR_SW6-GigabitEthernet0/0/2]port default vlan 20[JR_SW6-GigabitEthernet0/0/2]int g0/0/3[JR_SW6-GigabitEthernet0/0/3]port link-type access     
  7. [JR_SW6-GigabitEthernet0/0/3]port default vlan 30[JR_SW6-GigabitEthernet0/0/3]------------------------------------
  8.     
  9.     JR_SW7:<Huawei>SYS
  10. [Huawei]un in en
  11. [Huawei]sysname JR_SW7
  12. [JR_SW7]vlan batch 20304050607080200900[JR_SW7]int g0/0/1[JR_SW7-GigabitEthernet0/0/1]port link-type trunk 
  13. [JR_SW7-GigabitEthernet0/0/1]port trunk allow-pass vlan 40900[JR_SW7-GigabitEthernet0/0/1]int g0/0/2[JR_SW7-GigabitEthernet0/0/2]port link-type access 
  14. [JR_SW7-GigabitEthernet0/0/2]port default vlan 40[JR_SW7-GigabitEthernet0/0/2]qui
  15. ------------------------------------
  16.     
  17.     HJ_SW3:<Huawei>system-view 
  18. [Huawei]un in en
  19. [Huawei]sysname HJ_SW3
  20. [HJ_SW3]vlan batch 20304050607080200900[HJ_SW3]int g0/0/1[HJ_SW3-GigabitEthernet0/0/1]port link-type trunk 
  21. [HJ_SW3-GigabitEthernet0/0/1]port trunk allow-pass vlan 203040900[HJ_SW3-GigabitEthernet0/0/1]int g0/0/2[HJ_SW3-GigabitEthernet0/0/2]port link-type trunk
  22. [HJ_SW3-GigabitEthernet0/0/2]port trunk allow-pass vlan 203040900[HJ_SW3-GigabitEthernet0/0/2]int g0/0/3[HJ_SW3-GigabitEthernet0/0/3]port link-type trunk
  23. [HJ_SW3-GigabitEthernet0/0/3]port trunk allow-pass vlan 2030900[HJ_SW3-GigabitEthernet0/0/3]int g0/0/4[HJ_SW3-GigabitEthernet0/0/4]port link-type trunk
  24. [HJ_SW3-GigabitEthernet0/0/4]port trunk allow-pass vlan 40900------------------------------------
  25.     
  26.     JR_SW8:<Huawei>SYS
  27. [Huawei]sys    
  28. [Huawei]sysname JR_SW8
  29. [JR_SW8]vlan batch 20304050607080200900[JR_SW8]int g0/0/1[JR_SW8-GigabitEthernet0/0/1]port link-type trunk 
  30. [JR_SW8-GigabitEthernet0/0/1]port trunk allow-pass vlan 50900[JR_SW8-GigabitEthernet0/0/1]int g0/0/2[JR_SW8-GigabitEthernet0/0/2]port link-type access 
  31. [JR_SW8-GigabitEthernet0/0/2]port default vlan 50------------------------------------
  32.     
  33.     JR_SW9:<JR_SW9>SYS
  34. [JR_SW9]vlan batch 20304050607080200900[JR_SW9]int g0/0/3[JR_SW9-GigabitEthernet0/0/3]port link-type access 
  35. [JR_SW9-GigabitEthernet0/0/3]port default vlan 60[JR_SW9-GigabitEthernet0/0/3]qui
  36. [JR_SW9]intEth-Trunk2[JR_SW9-Eth-Trunk2]port link-type trunk 
  37. [JR_SW9-Eth-Trunk2]port trunk allow-pass vlan 60900[JR_SW9-Eth-Trunk2]qui
  38. ------------------------------------
  39.     HJ_SW4:<HJ_SW4>sys
  40. [HJ_SW4]vlan batch 20304050607080200900[HJ_SW4]int g0/0/1[HJ_SW4-GigabitEthernet0/0/1]port link-type trunk 
  41. [HJ_SW4-GigabitEthernet0/0/1]port trunk allow-pass vlan 5060900[HJ_SW4-GigabitEthernet0/0/1]int g0/0/2[HJ_SW4-GigabitEthernet0/0/2]port link-type trunk
  42. [HJ_SW4-GigabitEthernet0/0/2]port trunk allow-pass vlan 5060900[HJ_SW4-GigabitEthernet0/0/2]int g0/0/3[HJ_SW4-GigabitEthernet0/0/3]port link-type trunk
  43. [HJ_SW4-GigabitEthernet0/0/3]port trunk allow-pass vlan 50900[HJ_SW4-GigabitEthernet0/0/3]qui
  44. [HJ_SW4]intEth-Trunk2[HJ_SW4-Eth-Trunk2]port link-type trunk 
  45. [HJ_SW4-Eth-Trunk2]port trunk allow-pass vlan 60900[HJ_SW4-Eth-Trunk2]qui
  46. [HJ_SW4]------------------------------------
  47.     
  48.     JR_SW10:<Huawei>sys
  49. [Huawei]un in en
  50. [Huawei]sysname JR_SW10
  51. [JR_SW10]vlan batch 20304050607080200900[JR_SW10]int g0/0/1[JR_SW10-GigabitEthernet0/0/1]port link-type trunk 
  52. [JR_SW10-GigabitEthernet0/0/1]port trunk allow-pass vlan 70900[JR_SW10-GigabitEthernet0/0/1]int g0/0/2[JR_SW10-GigabitEthernet0/0/2]port link-type access 
  53. [JR_SW10-GigabitEthernet0/0/2]port default vlan 70[JR_SW10-GigabitEthernet0/0/2]qui
  54. ------------------------------------
  55.     
  56.     JR_SW11:<JR_SW11>sys
  57. [JR_SW11]vlan batch 20304050607080200900[JR_SW11]int g0/0/1[JR_SW11-GigabitEthernet0/0/1]port link-type trunk 
  58. [JR_SW11-GigabitEthernet0/0/1]port trunk allow-pass vlan 80900[JR_SW11-GigabitEthernet0/0/1]int g0/0/2[JR_SW11-GigabitEthernet0/0/2]port link-type access 
  59. [JR_SW11-GigabitEthernet0/0/2]port default vlan 80[JR_SW11-GigabitEthernet0/0/2]int g0/0/3[JR_SW11-GigabitEthernet0/0/3]port link-type access
  60. [JR_SW11-GigabitEthernet0/0/3]port default vlan 80------------------------------------
  61.     
  62.     HJ_SW5:<Huawei>system-view
  63. [Huawei]un in en
  64. [Huawei]sysname HJ_SW5
  65. [HJ_SW5]vlan batch 20304050607080200900[HJ_SW5]int g0/0/1[HJ_SW5-GigabitEthernet0/0/1]port link-type trunk 
  66. [HJ_SW5-GigabitEthernet0/0/1]port trunk allow-pass vlan 7080900[HJ_SW5-GigabitEthernet0/0/1]int g0/0/2[HJ_SW5-GigabitEthernet0/0/2]port link-type trunk
  67. [HJ_SW5-GigabitEthernet0/0/2]port trunk allow-pass vlan 7080900[HJ_SW5-GigabitEthernet0/0/2]int g0/0/3[HJ_SW5-GigabitEthernet0/0/3]port link-type trunk
  68. [HJ_SW5-GigabitEthernet0/0/3]port trunk allow-pass vlan 70900[HJ_SW5-GigabitEthernet0/0/3]int g0/0/4[HJ_SW5-GigabitEthernet0/0/4]port link-type trunk
  69. [HJ_SW5-GigabitEthernet0/0/4]port trunk allow-pass vlan 80900[HJ_SW5-GigabitEthernet0/0/4]qui
  70. ------------------------------------
  71.     
  72.     JR_SW12:<Huawei>sy
  73. [Huawei]un in en
  74. [Huawei]sysname JR_SW12
  75. [JR_SW12]vlan batch 20304050607080200900[JR_SW12]int g0/0/1[JR_SW12-GigabitEthernet0/0/1]port link-type trunk 
  76. [JR_SW12-GigabitEthernet0/0/1]port trunk allow-pass vlan 200900[JR_SW12-GigabitEthernet0/0/1]int g0/0/2[JR_SW12-GigabitEthernet0/0/2]port link-type trunk
  77. [JR_SW12-GigabitEthernet0/0/2]port trunk allow-pass vlan 200900[JR_SW12-GigabitEthernet0/0/2]int g0/0/3[JR_SW12-GigabitEthernet0/0/3]port link-type access 
  78. [JR_SW12-GigabitEthernet0/0/3]port default vlan 200[JR_SW12-GigabitEthernet0/0/3]int g0/0/4[JR_SW12-GigabitEthernet0/0/4]port link-type access
  79. [JR_SW12-GigabitEthernet0/0/4]port default vlan 200[JR_SW12-GigabitEthernet0/0/4]qui
  80. ------------------------------------
  81.     
  82.     XH_SW1:<HX_SW1>SY
  83. [HX_SW1]vlan batch 2030405060708020090010[HX_SW1]vlan batch 4[HX_SW1]int g0/0/6[HX_SW1-GigabitEthernet0/0/6]port link-type trunk 
  84. [HX_SW1-GigabitEthernet0/0/6]port trunk  allow-pass vlan 200900[HX_SW1-GigabitEthernet0/0/6]int g0/0/1[HX_SW1-GigabitEthernet0/0/1]port link-type access 
  85. [HX_SW1-GigabitEthernet0/0/1]port default vlan 10[HX_SW1-GigabitEthernet0/0/1]int g0/0/2[HX_SW1-GigabitEthernet0/0/2]port link-type access
  86. [HX_SW1-GigabitEthernet0/0/2]port default vlan 4[HX_SW1-GigabitEthernet0/0/2]int g0/0/3[HX_SW1-GigabitEthernet0/0/3]port link-type trunk 
  87. [HX_SW1-GigabitEthernet0/0/3]port trunk allow-pass vlan 203040900[HX_SW1-GigabitEthernet0/0/3]int g0/0/4[HX_SW1-GigabitEthernet0/0/4]port link-type trunk 
  88. [HX_SW1-GigabitEthernet0/0/4]port trunk allow-pass vlan 5060900[HX_SW1-GigabitEthernet0/0/4]int g0/0/5[HX_SW1-GigabitEthernet0/0/5]port link-type trunk
  89. [HX_SW1-GigabitEthernet0/0/5]port trunk allow-pass vlan 7080900[HX_SW1-GigabitEthernet0/0/5]qui
  90. [HX_SW1]intEth-Trunk1[HX_SW1-Eth-Trunk1]port link-type trunk 
  91. [HX_SW1-Eth-Trunk1]port trunk allow-pass vlan 20304050607080200900[HX_SW1-Eth-Trunk1]dis this[HX_SW1-Eth-Trunk1]------------------------------------
  92.     
  93.     HX_SW2:<HX_SW2>sys
  94. [HX_SW2]vlan batch 20304050607080200900[HX_SW2]vlan batch 25[HX_SW2]int g0/0/1[HX_SW2-GigabitEthernet0/0/1]port link-type access 
  95. [HX_SW2-GigabitEthernet0/0/1]port default vlan 2[HX_SW2-GigabitEthernet0/0/1]int g0/0/2[HX_SW2-GigabitEthernet0/0/2]port link-type access 
  96. [HX_SW2-GigabitEthernet0/0/2]port default vlan 5[HX_SW2-GigabitEthernet0/0/2]int g0/0/3[HX_SW2-GigabitEthernet0/0/3]port link-type trunk 
  97. [HX_SW2-GigabitEthernet0/0/3]port trunk allow-pass vlan 203040900[HX_SW2-GigabitEthernet0/0/3]int g0/0/4[HX_SW2-GigabitEthernet0/0/4]port link-type trunk
  98. [HX_SW2-GigabitEthernet0/0/4]port trunk allow-pass vlan 5060900[HX_SW2-GigabitEthernet0/0/4]int g0/0/5[HX_SW2-GigabitEthernet0/0/5]port link-type trunk
  99. [HX_SW2-GigabitEthernet0/0/5]port trunk allow-pass vlan 7080900[HX_SW2-GigabitEthernet0/0/5]int g0/0/6[HX_SW2-GigabitEthernet0/0/6]port link-type trunk
  100. [HX_SW2-GigabitEthernet0/0/6]port trunk allow-pass vlan 200900[HX_SW2-GigabitEthernet0/0/6]qui
  101. [HX_SW2]intEth-Trunk1[HX_SW2-Eth-Trunk1]port link-type trunk 
  102. [HX_SW2-Eth-Trunk1]port trunk allow-pass vlan 20304050607080200900[HX_SW2-Eth-Trunk1]dis this

3、MSTP配置

  1.     HX_SW1:<HX_SW1>sy
  2. [HX_SW1]stp region-configuration 
  3. [HX_SW1-mst-region]instance 1 vlan 203040200[HX_SW1-mst-region]region-name aa
  4. [HX_SW1-mst-region]revision-level 1[HX_SW1-mst-region]instance 2 vlan 50607080[HX_SW1-mst-region]active region-configuration 
  5. [HX_SW1-mst-region]dis this/*#所有汇聚层交换机和服务器组交换机都需要配置以下命令
  6. stp region-configuration
  7.  region-name aa
  8.  revision-level 1
  9.  instance 1 vlan 20 30 40 50 60 200
  10.  instance 2 vlan 70 80
  11.  active region-configuration
  12. #*/[HX_SW1-mst-region]qui
  13. [HX_SW1]stp instance 1 root primary 
  14. [HX_SW1]stp instance 2 root secondary 
  15. [HX_SW1]dis this//查看配置------------------------------------
  17.     HX_SW2:<HX_SW2>sys
  18. [HX_SW2]stp region-configuration 
  19. [HX_SW2-mst-region]region-name aa
  20. [HX_SW2-mst-region]revision-level 1[HX_SW2-mst-region]instance 1 vlan 203040200[HX_SW2-mst-region]instance 2 vlan 50607080[HX_SW2-mst-region]active region-configuration 
  21. [HX_SW2-mst-region]qui
  22. [HX_SW2]stp instance 2 root primary
  23. [HX_SW2]stp instance 1 root secondary 
  24. [HX_SW2]dis this------------------------------------
  25.     
  26.     JR_SW12:<JR_SW12>sy
  27. [JR_SW12]stp region-configuration
  28. [JR_SW12-mst-region]region-name aa
  29. [JR_SW12-mst-region]revision-level 1[JR_SW12-mst-region]instance 1 vlan 203040200[JR_SW12-mst-region]instance 2 vlan 50607080[JR_SW12-mst-region]active region-configuration
  30. [JR_SW12-mst-region]qui
  31. ------------------------------------
  32.     
  33.     HJ_SW3:[HJ_SW3]stp region-configuration
  34. [HJ_SW3-mst-region]region-name aa
  35. [HJ_SW3-mst-region]revision-level 1[HJ_SW3-mst-region]instance 1 vlan 203040200[HJ_SW3-mst-region]instance 2 vlan 50607080[HJ_SW3-mst-region]active region-configuration
  36. [HJ_SW3-mst-region]qui
  37. [HJ_SW3]dis stp br
  38.  /* MSTID  Port                        Role  STP State     Protection
  39.    0    GigabitEthernet0/0/1        ROOT  FORWARDING      NONE
  40.    0    GigabitEthernet0/0/2        ALTE  DISCARDING      NONE
  41. 发现这是g0/0/2处于堵塞状态即可
  42.    */------------------------------------
  43.     
  44.     HJ_SW4:<HJ_SW4>sy
  45. [HJ_SW4]stp region-configuration
  46. [HJ_SW4-mst-region]region-name aa
  47. [HJ_SW4-mst-region]revision-level 1[HJ_SW4-mst-region]instance 1 vlan 203040200[HJ_SW4-mst-region]instance 2 vlan 50607080[HJ_SW4-mst-region]active region-configuration
  48. [HJ_SW4-mst-region]qui
  49. [HJ_SW4]dis stp br
  50. /* MSTID  Port                        Role  STP State     Protection
  51.    2    GigabitEthernet0/0/1        ALTE  DISCARDING      NONE
  52.    2    GigabitEthernet0/0/2        ROOT  FORWARDING      NONE
  53.    此时g0/0/1堵塞即可*/------------------------------------
  54.     
  55.     HJ_SW5:[HJ_SW5]stp region-configuration
  56. [HJ_SW5-mst-region] region-name aa
  57. [HJ_SW5-mst-region] revision-level 1[HJ_SW5-mst-region] instance 1 vlan 203040200[HJ_SW5-mst-region] instance 2 vlan 50607080[HJ_SW5-mst-region] active region-configuration
  58. [HJ_SW5-mst-region]qui
  59. [HJ_SW5]dis stp br
  60.  /*MSTID  Port                        Role  STP State     Protection
  61.    1    GigabitEthernet0/0/2        ALTE  DISCARDING      NONE
  62.    1    GigabitEthernet0/0/1       ROOT  FORWARDING      NONE
  63.    此时g0/0/1堵塞即可*/

4、VRRP网关冗余

  1.     HX_SW1:[HX_SW1]int vlan 20[HX_SW1-Vlanif20]ip add 192.168.20.25424[HX_SW1-Vlanif20]vrrp vrid 20 virtual-ip 192.168.20.1[HX_SW1-Vlanif20]vrrp vrid 20 priority 105[HX_SW1-Vlanif20]dis this[HX_SW1-Vlanif20]qui
  2. [HX_SW1]int vlan 30[HX_SW1-Vlanif30]ip add 192.168.30.25424[HX_SW1-Vlanif30]vrrp vrid 30 virtual-ip 192.168.30.1[HX_SW1-Vlanif30]vrrp vrid 30 priority 105[HX_SW1-Vlanif30]qui
  3. [HX_SW1]int vlan 40[HX_SW1-Vlanif40]ip add 192.168.40.25424[HX_SW1-Vlanif40]vrrp vrid 40 virtual-ip 192.168.40.1[HX_SW1-Vlanif40]vrrp vrid 40 priority 105[HX_SW1-Vlanif40]int vlan 50[HX_SW1-Vlanif50]ip add 192.168.50.25424[HX_SW1-Vlanif50]vrrp vrid 50 virtual-ip 192.168.50.1[HX_SW1-Vlanif50]int vlan 60[HX_SW1-Vlanif60]ip add 192.168.60.25424[HX_SW1-Vlanif60]vrrp vrid 60 virtual-ip 192.168.60.1[HX_SW1-Vlanif60]int vlan 200[HX_SW1-Vlanif200]ip add 192.168.200.25424[HX_SW1-Vlanif200]vrrp vrid 200 virtual-ip 192.168.200.1[HX_SW1-Vlanif200]vrrp vrid 200 priority 105[HX_SW1-Vlanif200]int vlan 70[HX_SW1-Vlanif70]ip add 192.168.70.25424[HX_SW1-Vlanif70]vrrp vrid 70 virtual-ip 192.168.70.1[HX_SW1-Vlanif70]int vlan 80[HX_SW1-Vlanif80]ip add 192.168.80.25424[HX_SW1-Vlanif80]vrrp vrid 80 virtual-ip 192.168.80.1[HX_SW1-Vlanif80]int vlan 10[HX_SW1-Vlanif10]ip add 192.168.10.224[HX_SW1-Vlanif10]int vlan 4[HX_SW1-Vlanif4]ip add 192.168.4.124[HX_SW1-Vlanif4]qui
  4. [HX_SW1]------------------------------------
  5.     
  6.     HX_SW2
  7. [HX_SW2]int vlan 70[HX_SW2-Vlanif70]ip add 192.168.70.25324[HX_SW2-Vlanif70]vrrp vrid 70 virtual-ip 192.168.70.1[HX_SW2-Vlanif70]vrrp vrid 70 priority 105[HX_SW2-Vlanif70]int vlan 80[HX_SW2-Vlanif80]ip add 192.168.80.25324[HX_SW2-Vlanif80]vrrp vrid 80 virtual-ip 192.168.80.1[HX_SW2-Vlanif80]vrrp vrid 80 priority 105[HX_SW2-Vlanif80]int vlan 200[HX_SW2-Vlanif200]ip add 192.168.200.25324[HX_SW2-Vlanif200]vrrp vrid 200 virtual-ip 192.168.200.1[HX_SW2-Vlanif200]int vlan 20[HX_SW2-Vlanif20]ip add 192.168.20.25324[HX_SW2-Vlanif20]vrrp vrid 20 virtual-ip 192.168.20.1[HX_SW2-Vlanif20]int vlan 30[HX_SW2-Vlanif30]ip add 192.168.30.25324[HX_SW2-Vlanif30]vrrp vrid 30 virtual-ip 192.168.30.1[HX_SW2-Vlanif30]int vlan 40[HX_SW2-Vlanif40]ip add 192.168.40.25324[HX_SW2-Vlanif40]vrrp vrid 40 virtual-ip 192.168.40.1[HX_SW2-Vlanif40]int vlan 50[HX_SW2-Vlanif50]ip add 192.168.50.25324[HX_SW2-Vlanif50]vrrp vrid 50 virtual-ip 192.168.50.1[HX_SW2-Vlanif50]vrrp vrid 50 priority 105[HX_SW2-Vlanif50]int vlan 60[HX_SW2-Vlanif60]ip add 192.168.60.25324[HX_SW2-Vlanif60]vrrp vrid 60 virtual-ip 192.168.60.1[HX_SW2-Vlanif60]vrrp vrid 60 priority 105[HX_SW2-Vlanif60]int vlan 2[HX_SW2-Vlanif2]ip add 192.168.2.224[HX_SW2-Vlanif2]int vlan 5[HX_SW2-Vlanif5]ip add 192.168.5.124[HX_SW2-Vlanif5]qui

5、验证VRRP网关冗余

  1. [HX_SW1]dis vrrp br
  2. VRID  StateInterfaceTypeVirtual IP     
  3. ----------------------------------------------------------------20MasterVlanif20Normal192.168.20.130MasterVlanif30Normal192.168.30.140MasterVlanif40Normal192.168.40.150BackupVlanif50Normal192.168.50.160BackupVlanif60Normal192.168.60.170BackupVlanif70Normal192.168.70.180BackupVlanif80Normal192.168.80.1200MasterVlanif200Normal192.168.200.1[HX_SW1]------------------------------------<HX_SW2>dis vrrp br
  4. VRID  StateInterfaceTypeVirtual IP     
  5. ----------------------------------------------------------------20BackupVlanif20Normal192.168.20.130BackupVlanif30Normal192.168.30.140BackupVlanif40Normal192.168.40.150MasterVlanif50Normal192.168.50.160MasterVlanif60Normal192.168.60.170MasterVlanif70Normal192.168.70.180MasterVlanif80Normal192.168.80.1200BackupVlanif200Normal192.168.200.1<HX_SW2>

6、测试PC通网关

  1. /*手动给PC配置IP地址访问网关，如给vlan3下的PC配置
  2.     IP：192.168.30.3
  3.     GW：192.168.30.1  测试访问网关，ping 192.168.30.1通了即可*//*手动给PC配置IP地址访问网关，如给vlan3下的PC配置
  4.     IP：192.168.70.7
  5.     GW：192.168.70.1  测试访问网关，ping 192.168.70.1通了即可*/

在这里插入图片描述

7、BFD路由联动

  1. [HX_SW1]bfd
  2. [HX_SW1-bfd]qui //进去再退出来即可[HX_SW1]int vlan 20[HX_SW1-Vlanif20]vrrp vrid 20 track interface g0/0/1[HX_SW1-Vlanif20]vrrp vrid 20 track interface g0/0/2[HX_SW1-Vlanif20]int vlan 30[HX_SW1-Vlanif30]vrrp vrid 30 track interface g0/0/1[HX_SW1-Vlanif30]vrrp vrid 30 track interface g0/0/2[HX_SW1-Vlanif30]int vlan 40[HX_SW1-Vlanif40]vrrp vrid 40 track interface g0/0/1[HX_SW1-Vlanif40]vrrp vrid 40 track interface g0/0/2[HX_SW1-Vlanif40]int vlan 50[HX_SW1-Vlanif50]vrrp vrid 50 track interface g0/0/1[HX_SW1-Vlanif50]vrrp vrid 50 track interface g0/0/2[HX_SW1-Vlanif50]int vlan 60[HX_SW1-Vlanif60]vrrp vrid 60 track interface g0/0/1[HX_SW1-Vlanif60]vrrp vrid 60 track interface g0/0/2[HX_SW1-Vlanif60]int vlan 70[HX_SW1-Vlanif70]vrrp vrid 70 track interface g0/0/1[HX_SW1-Vlanif70]vrrp vrid 70 track interface g0/0/2[HX_SW1-Vlanif70]int vlan 80[HX_SW1-Vlanif80]vrrp vrid 80 track interface g0/0/1[HX_SW1-Vlanif80]vrrp vrid 80 track interface g0/0/2[HX_SW1-Vlanif80]int vlan 200[HX_SW1-Vlanif200]vrrp vrid 200 track interface g0/0/1[HX_SW1-Vlanif200]vrrp vrid 200 track interface g0/0/2[HX_SW1-Vlanif200]dis this------------------------------------
  3.     
  4.     HX_SW2:[HX_SW1]bfd
  5. qui 
  6. int vlan 20
  7. vrrp vrid 20 track interface g0/0/1
  8. vrrp vrid 20 track interface g0/0/2int vlan 30
  9. vrrp vrid 30 track interface g0/0/1
  10. vrrp vrid 30 track interface g0/0/2int vlan 40
  11. vrrp vrid 40 track interface g0/0/1
  12. vrrp vrid 40 track interface g0/0/2int vlan 50
  13. vrrp vrid 50 track interface g0/0/1
  14. vrrp vrid 50 track interface g0/0/2int vlan 60
  15. vrrp vrid 60 track interface g0/0/1
  16. vrrp vrid 60 track interface g0/0/2int vlan 70
  17. vrrp vrid 70 track interface g0/0/1
  18. vrrp vrid 70 track interface g0/0/2int vlan 80
  19. vrrp vrid 80 track interface g0/0/1
  20. vrrp vrid 80 track interface g0/0/2int vlan 200
  21. vrrp vrid 200 track interface g0/0/1
  22. vrrp vrid 200 track interface g0/0/2[HX_SW1-Vlanif200]dis this

8、核心层路由器地址配置

  1.     R1:<Huawei>sys
  2. [Huawei]un in en
  3. [Huawei]sysname R1
  4. [R1]int g0/0/0[R1-GigabitEthernet0/0/0]ip add 192.168.6.124[R1-GigabitEthernet0/0/0]int g0/0/1[R1-GigabitEthernet0/0/1]ip add 192.168.10.124[R1-GigabitEthernet0/0/1]int g0/0/2[R1-GigabitEthernet0/0/2]ip add 192.168.2.124[R1-GigabitEthernet0/0/2]int g4/0/0[R1-GigabitEthernet4/0/0]ip add 192.168.3.124[R1-GigabitEthernet4/0/0]qui
  5. [R1]------------------------------------
  6.     
  7.     R2:<Huawei>sys
  8. [Huawei]un in en    
  9. [Huawei]sysname R2
  10. [R2]int g0/0/0[R2-GigabitEthernet0/0/0]ip add 192.168.7.124[R2-GigabitEthernet0/0/0]int g0/0/1[R2-GigabitEthernet0/0/1]ip add 192.168.4.224[R2-GigabitEthernet0/0/1]int g0/0/2[R2-GigabitEthernet0/0/2]ip add 192.168.5.224[R2-GigabitEthernet0/0/2]int g4/0/0[R2-GigabitEthernet4/0/0]ip add 192.168.3.224[R2-GigabitEthernet4/0/0]qui
  11. [R2]

9、防火墙基本配置

IP地址配置和区域划分

  1. <USG6000V1>sys
  2. [USG6000V1]un in en
  3. [USG6000V1]sysname FW
  4. [FW]int g1/0/0[FW-GigabitEthernet1/0/0]ip add 192.168.8.130[FW-GigabitEthernet1/0/0]service-manage all permit
  5. [FW-GigabitEthernet1/0/0]int g1/0/1[FW-GigabitEthernet1/0/1]ip add 192.168.6.224[FW-GigabitEthernet1/0/1]service-manage all permit
  6. [FW-GigabitEthernet1/0/1]int g1/0/2[FW-GigabitEthernet1/0/2]ip add 192.168.7.224[FW-GigabitEthernet1/0/2]service-manage all permit
  7. [FW-GigabitEthernet1/0/2]int g1/0/3[FW-GigabitEthernet1/0/3]ip add 192.168.111.124[FW-GigabitEthernet1/0/3]service-manage all permit
  8. [FW-GigabitEthernet1/0/3]quit    
  9. [FW]firewall zone untrust 
  10. [FW-zone-untrust]add int g1/0/0[FW-zone-untrust]qui
  11. [FW]firewall zone dmz
  12. [FW-zone-dmz]add int g1/0/3[FW-zone-dmz]quit 
  13. [FW]firewall zone trust 
  14. [FW-zone-trust]add int g1/0/1[FW-zone-trust]add int g1/0/2[FW-zone-trust]qui

10、OSPF配置

  1.     HX_SW1:[HX_SW1]ospf 1[HX_SW1-ospf-1]area 0[HX_SW1-ospf-1-area-0.0.0.0]net 192.168.4.00.0.0.255[HX_SW1-ospf-1-area-0.0.0.0]net 192.168.10.00.0.0.255[HX_SW1-ospf-1-area-0.0.0.0]net 192.168.20.00.0.0.255[HX_SW1-ospf-1-area-0.0.0.0]net 192.168.30.00.0.0.255[HX_SW1-ospf-1-area-0.0.0.0]net 192.168.40.00.0.0.255[HX_SW1-ospf-1-area-0.0.0.0]net 192.168.50.00.0.0.255[HX_SW1-ospf-1-area-0.0.0.0]net 192.168.60.00.0.0.255[HX_SW1-ospf-1-area-0.0.0.0]net 192.168.70.00.0.0.255[HX_SW1-ospf-1-area-0.0.0.0]net 192.168.80.00.0.0.255[HX_SW1-ospf-1-area-0.0.0.0]net 192.168.200.00.0.0.255[HX_SW1-ospf-1-area-0.0.0.0]qui
  2. [HX_SW1-ospf-1]qui
  3. [HX_SW1]------------------------------------
  4.     HX_SW2:[HX_SW2]ospf 1[HX_SW2-ospf-1]area 0[HX_SW2-ospf-1-area-0.0.0.0]net 192.168.2.00.0.0.255[HX_SW2-ospf-1-area-0.0.0.0]net 192.168.5.00.0.0.255[HX_SW2-ospf-1-area-0.0.0.0]net 192.168.20.00.0.0.255[HX_SW2-ospf-1-area-0.0.0.0]net 192.168.30.00.0.0.255[HX_SW2-ospf-1-area-0.0.0.0]net 192.168.40.00.0.0.255[HX_SW2-ospf-1-area-0.0.0.0]net 192.168.50.00.0.0.255[HX_SW2-ospf-1-area-0.0.0.0]net 192.168.60.00.0.0.255[HX_SW2-ospf-1-area-0.0.0.0]net 192.168.70.00.0.0.255[HX_SW2-ospf-1-area-0.0.0.0]net 192.168.80.00.0.0.255[HX_SW2-ospf-1-area-0.0.0.0]net 192.168.200.00.0.0.255[HX_SW2-ospf-1-area-0.0.0.0]net 192.168.100.00.0.0.255//无线管理vlan[HX_SW2-ospf-1-area-0.0.0.0]net 192.168.101.00.0.0.255//无线业务vlan[HX_SW2-ospf-1-area-0.0.0.0]net 192.168.102.00.0.0.255//无线业务vlan[HX_SW2-ospf-1-area-0.0.0.0]qui
  5. [HX_SW2-ospf-1]qui
  6. [HX_SW2]------------------------------------
  7.     R1:[R1]ospf 1[R1-ospf-1]area 0[R1-ospf-1-area-0.0.0.0]net 192.168.2.00.0.0.255[R1-ospf-1-area-0.0.0.0]net 192.168.10.00.0.0.255[R1-ospf-1-area-0.0.0.0]net 192.168.3.00.0.0.255[R1-ospf-1-area-0.0.0.0]qui
  8. [R1-ospf-1]qui
  9. [R1]------------------------------------ 
  10.     R2:[R2]ospf 1[R2-ospf-1]area 0[R2-ospf-1-area-0.0.0.0]net 192.168.5.00.0.0.255[R2-ospf-1-area-0.0.0.0]net 192.168.3.00.0.0.255[R2-ospf-1-area-0.0.0.0]net 192.168.4.00.0.0.255[R2-ospf-1-area-0.0.0.0]quit
  11. [R2-ospf-1]quit
  12. [R2]

11、防火墙策略配置

  1. //放行trust->dmz流量[FW]security-policy 
  2. [FW-policy-security]rule name trust_to_dmz    
  3. [FW-policy-security-rule-trust_to_dmz]source-zone trust 
  4. [FW-policy-security-rule-trust_to_dmz]destination-zone dmz
  5. [FW-policy-security-rule-trust_to_dmz]action permit 
  6. [FW-policy-security-rule-trust_to_dmz]qui
  7. [FW-policy-security]qui
  8. //防火墙可以访问任何区域    [FW]security-policy 
  9. [FW-policy-security]rule name local_to_any    
  10. [FW-policy-security-rule-local_to_any]source-zone local 
  11. [FW-policy-security-rule-local_to_any]destination-zone any 
  12. [FW-policy-security-rule-local_to_any]action permit 
  13. [FW-policy-security-rule-local_to_any]qui
  14. [FW-policy-security]qui
  15. //trust->untrust[FW]security-policy
  16. [FW-policy-security]rule name trust_to_untrust
  17. [FW-policy-security-rule-trust_to_untrust]source-zone trust
  18. [FW-policy-security-rule-trust_to_untrust]destination-zone untrust
  19. [FW-policy-security-rule-trust_to_untrust]action permit
  20. [FW-policy-security-rule-trust_to_untrust]quit
  21. [FW-policy-security]quit
  22. [FW]nat-policy
  23. [FW-policy-nat]rule name trust_nat_untrsut
  24. [FW-policy-nat-rule-trust_nat_untrsut]source-zone trust
  25. [FW-policy-nat-rule-trust_nat_untrsut]destination-zone untrust
  26. [FW-policy-nat-rule-trust_nat_untrsut]action source-nat easy-ip 
  27. [FW-policy-nat-rule-trust_nat_untrsut]dis this[FW-policy-nat-rule-trust_nat_untrsut]quit
  28. //untrust->dmz[FW-policy-security]rule name untrust_to_dmz
  29. [FW-policy-security-rule-untrust_to_dmz]source-zone untrust
  30. [FW-policy-security-rule-untrust_to_dmz]destination-zone dmz
  31. [FW-policy-security-rule-untrust_to_dmz]action permit
  32. [FW-policy-security-rule-untrust_to_dmz]qui
  33. //dmz->untrust[FW-policy-security]rule name dmz_to_untrust    
  34. [FW-policy-security-rule-dmz_to_untrust]source-zone dmz 
  35. [FW-policy-security-rule-dmz_to_untrust]destination-zone untrust     
  36. [FW-policy-security-rule-dmz_to_untrust]action permit 
  37. [FW-policy-security-rule-dmz_to_untrust]qui
  38. [FW-policy-security]

12、外网路由器基本配置

  1.     ISP_R:<Huawei>sys
  2. [Huawei]un in en
  3. [Huawei]sysname ISP_R
  4. [ISP_R]int g0/0/1[ISP_R-GigabitEthernet0/0/1]ip add 192.168.8.230[ISP_R-GigabitEthernet0/0/1]int g0/0/0[ISP_R-GigabitEthernet0/0/0]ip add 10.10.10.124[ISP_R-GigabitEthernet0/0/0]qui
  5. [ISP_R]------------------------------------

13、静态路由配置

  1.     FW:[FW]ip route-static0.0.0.00192.168.8.2[FW]ip route-static192.168.0.0255.255.0.0192.168.6.1//默认优先级为60，越小越优先[FW]ip route-static192.168.0.0255.255.0.0192.168.7.1 preference 70------------------------------------ 
  2.     
  3.     R1:[R1]ip route-static0.0.0.00.0.0.0192.168.6.2[R1]ip route-static0.0.0.00192.168.3.2 preference 70------------------------------------ 
  4.     
  5.     R2:[R2]ip route-static0.0.0.00192.168.7.2[R2]ip route-static0.0.0.00192.168.3.1 preference 70------------------------------------ 
  6.     
  7.     HX_SW1:[HX_SW1]ip route-static0.0.0.00.0.0.0192.168.10.1[HX_SW1]ip route-static0.0.0.00.0.0.0192.168.4.2 preference 70------------------------------------ 
  8.     
  9.     HX_SW2:[HX_SW2]ip route-static0.0.0.00.0.0.0192.168.5.2[HX_SW2]ip route-static0.0.0.00.0.0.0192.168.2.1 preference 70------------------------------------ 
  10.     
  11.     ISP:[ISP]ip route-static0.0.0.00.0.0.0192.168.8.1

14、Server地址映射

  1. [FW]nat server untrust_dmz zone untrust protocol icmp global 100.100.100.100 inside 192.168.111.2 no-reverse //让外网可以通过ping 100.100.100.100访问web服务器[FW]nat server untust_dmz_web protocol tcp global 100.100.100.10080 inside 192.168.111.280 no-reverse //让外网用户可以通过http://100.100.100.100 登录我们的web服务器

15、DHCP中继

  1.     DHCP：
  2. <Huawei>sys
  3. [Huawei]un in en
  4. [Huawei]sysname DHCP
  5. [DHCP]dhcp enable 
  6. [DHCP]ip pool vlan20
  7. Info:It's successful tocreate an IP address pool.[DHCP-ip-pool-vlan20]network 192.168.20.0 mask 24[DHCP-ip-pool-vlan20]gateway-list 192.168.20.1[DHCP-ip-pool-vlan20]dns-list 192.168.111.38.8.8.8[DHCP-ip-pool-vlan20]excluded-ip-address 192.168.20.250192.168.20.254[DHCP-ip-pool-vlan20]q
  8. [DHCP]ip pool vlan30
  9. Info:It's successful tocreate an IP address pool.[DHCP-ip-pool-vlan30]gateway-list 192.168.30.1[DHCP-ip-pool-vlan30]network 192.168.30.0 mask 255.255.255.0[DHCP-ip-pool-vlan30]dns-list 192.168.111.38.8.8.8[DHCP-ip-pool-vlan30]excluded-ip-address 192.168.30.250192.168.30.254[DHCP-ip-pool-vlan30]q
  10. [DHCP]ip pool vlan40
  11. Info:It's successful tocreate an IP address pool.[DHCP-ip-pool-vlan40]gateway-list 192.168.40.1[DHCP-ip-pool-vlan40]network 192.168.40.0 mask 255.255.255.0[DHCP-ip-pool-vlan40]dns-list 192.168.111.38.8.8.8[DHCP-ip-pool-vlan40]excluded-ip-address 192.168.40.250192.168.40.254[DHCP-ip-pool-vlan40]q
  12. [DHCP]ip pool vlan50
  13. Info:It's successful tocreate an IP address pool.[DHCP-ip-pool-vlan50]gateway-list 192.168.50.1[DHCP-ip-pool-vlan50]network 192.168.50.0 mask 255.255.255.0[DHCP-ip-pool-vlan50]dns-list 192.168.111.38.8.8.8[DHCP-ip-pool-vlan50]excluded-ip-address 192.168.50.250192.168.50.254[DHCP-ip-pool-vlan50]q
  14. [DHCP]ip pool vlan60
  15. Info:It's successful tocreate an IP address pool.[DHCP-ip-pool-vlan60]network 192.168.60.0 mask 24[DHCP-ip-pool-vlan60]gateway-list 192.168.60.1[DHCP-ip-pool-vlan60]dns-list 192.168.111.38.8.8.8[DHCP-ip-pool-vlan60]excluded-ip-address 192.168.60.250192.168.60.254[DHCP-ip-pool-vlan60]q
  16. [DHCP]ip pool vlan70
  17. Info:It's successful tocreate an IP address pool.[DHCP-ip-pool-vlan70]gateway-list 192.168.70.1[DHCP-ip-pool-vlan70]network 192.168.70.0 mask 255.255.255.0[DHCP-ip-pool-vlan70]dns-list 192.168.111.38.8.8.8[DHCP-ip-pool-vlan70]excluded-ip-address 192.168.70.250192.168.70.254[DHCP-ip-pool-vlan70]q
  18. [DHCP]ip pool vlan80
  19. Info:It's successful tocreate an IP address pool.[DHCP-ip-pool-vlan80]gateway-list 192.168.80.1[DHCP-ip-pool-vlan80]network 192.168.80.0 mask 255.255.255.0[DHCP-ip-pool-vlan80]dns-list 192.168.111.38.8.8.8[DHCP-ip-pool-vlan80]excluded-ip-address 192.168.80.250192.168.80.254[DHCP-ip-pool-vlan80]q
  20. [DHCP]int g0/0/0[DHCP-GigabitEthernet0/0/0]ip add 192.168.200.324[DHCP-GigabitEthernet0/0/0]dhcp select global 
  21. [DHCP-GigabitEthernet0/0/0]qui
  22. ------------------------------------
  23.     
  24.     HX_SW1:<HX_SW1>sy
  25. [HX_SW1]dhcp enable 
  26. [HX_SW1]int vlanif20
  27. [HX_SW1-Vlanif20]dhcp select relay 
  28. [HX_SW1-Vlanif20]dhcp relay server-ip 192.168.200.3[HX_SW1-Vlanif20]int vlanif30
  29. [HX_SW1-Vlanif30]dhcp select relay     
  30. [HX_SW1-Vlanif30]dhcp select relay 
  31. [HX_SW1-Vlanif30]dhcp relay server-ip 192.168.200.3[HX_SW1-Vlanif30]int vlanif40
  32. [HX_SW1-Vlanif40]dhcp select relay 
  33. [HX_SW1-Vlanif40]dhcp relay server-ip 192.168.200.3.......................[HX_SW1]------------------------------------
  34.     
  35.     HX_SW2:<HX_SW2>SYS
  36. [HX_SW2]dhcp enable 
  37. [HX_SW2]int vlanif20
  38. [HX_SW2-Vlanif20]dhcp select relay 
  39. [HX_SW2-Vlanif20]dhcp relay server-ip 192.168.200.3[HX_SW2-Vlanif20]dis this
  40. #
  41. interfaceVlanif20
  42.  ip address 192.168.20.254255.255.255.0
  43.  vrrp vrid 20 virtual-ip 192.168.20.1
  44.  vrrp vrid 20 priority 105
  45.  vrrp vrid 20 track interfaceGigabitEthernet0/0/1
  46.  vrrp vrid 20 track interfaceGigabitEthernet0/0/2
  47.  dhcp select relay
  48.  dhcp relay server-ip 192.168.200.3
  49. #
  50. return[HX_SW2-Vlanif20]int vlanif30
  51. [HX_SW2-Vlanif30]dhcp select relay 
  52. [HX_SW2-Vlanif30]dhcp relay server-ip 192.168.200.3[HX_SW2-Vlanif30]int vlanif40
  53. [HX_SW2-Vlanif40]dhcp select relay 
  54. [HX_SW2-Vlanif40]dhcp relay server-ip 192.168.200.3[HX_SW2-Vlanif40]int vlanif50
  55. [HX_SW2-Vlanif50]dhcp select relay
  56. [HX_SW2-Vlanif50]dhcp relay server-ip 192.168.200.3[HX_SW2-Vlanif50]int vlanif60
  57. [HX_SW2-Vlanif60]dhcp select relay 
  58. [HX_SW2-Vlanif60]dhcp relay server-ip 192.168.200.3[HX_SW2-Vlanif60]int vlanif70
  59. [HX_SW2-Vlanif70]dhcp select relay 
  60. [HX_SW2-Vlanif70]dhcp relay server-ip 192.168.200.3[HX_SW2-Vlanif70]int vlanif80
  61. [HX_SW2-Vlanif80]dhcp select relay 
  62. [HX_SW2-Vlanif80]dhcp relay server-ip 192.168.200.3[HX_SW2-Vlanif80]

16、Snooping配置

  1.     JR_SW6:[JR_SW6]dhcp enable     
  2. [JR_SW6]dhcp snooping enable 
  3. [JR_SW6]vlan 20[JR_SW6-vlan20]dhcp snooping en
  4. [JR_SW6-vlan20]vlan 30[JR_SW6-vlan30]dhcp snooping enable 
  5. [JR_SW6-vlan30]qui
  6. [JR_SW6]int g0/0/1[JR_SW6-GigabitEthernet0/0/1]dhcp snooping trusted 
  7. [JR_SW6-GigabitEthernet0/0/1]dis this------------------------------------
  8.     
  9.     JR_SW7:<JR_SW7>sys
  10. [JR_SW7]dhcp enable     
  11. [JR_SW7]dhcp snooping enable 
  12. [JR_SW7]vlan 40[JR_SW7-vlan40]dhcp snooping enable 
  13. [JR_SW7-vlan40]qui
  14. [JR_SW7]int g0/0/1[JR_SW7-GigabitEthernet0/0/1]dhcp snooping trusted 
  15. [JR_SW7-GigabitEthernet0/0/1]qui   
  16. ------------------------------------
  17.     
  18.     JR_SW8:略
  19. ------------------------------------
  20.     
  21.     JR_SW9:略

在这里插入图片描述
能获取得到地址即可，这里PC1获取得到的地址应该是30.254（配图只是为了演示）

16、Telnet远程配置

  1.     HX_SW1:[HX_SW1]aaa
  2. [HX_SW1-aaa]local-user huawei privilege level 3 password cipher 5555[HX_SW1-aaa]local-user huawei service-type telnet 
  3. [HX_SW1-aaa]quit 
  4. [HX_SW1]user-interface vty 04[HX_SW1-ui-vty0-4]authentication-mode aaa
  5. [HX_SW1-ui-vty0-4]protocol inbound telnet 
  6. [HX_SW1-ui-vty0-4]qui
  7. [HX_SW1]int vlanif 900[HX_SW1-Vlanif900]ip add 192.168.255.25424[HX_SW1-Vlanif900]vrrp vrid 255 virtual-ip 192.168.255.1[HX_SW1-Vlanif900]dis this
  8. #
  9. interfaceVlanif900
  10.  ip address 192.168.255.254255.255.255.0
  11.  vrrp vrid 255 virtual-ip 192.168.255.1
  12. #
  13. return[HX_SW1-Vlanif900]q
  14. ------------------------------------
  15.     
  16.     HX_SW2:[HX_SW2]aaa
  17. [HX_SW2-aaa]local-user huawei privilege level 3 password cipher 5555Info:Add a new user.[HX_SW2-aaa]local-user huawei service-type telnet 
  18. [HX_SW2-aaa]quit 
  19. [HX_SW2]user-interface vty 04[HX_SW2-ui-vty0-4]authentication-mode aaa
  20. [HX_SW2-ui-vty0-4]protocol inbound telnet 
  21. [HX_SW2-ui-vty0-4]qui
  22. [HX_SW2]int vlanif 900[HX_SW2-Vlanif900]ip add 192.168.255.25324[HX_SW2-Vlanif900]vrrp vrid 255 virtual-ip 192.168.255.1[HX_SW2-Vlanif900]dis this
  23. #
  24. interfaceVlanif900
  25.  ip address 192.168.255.253255.255.255.0
  26.  vrrp vrid 255 virtual-ip 192.168.255.1
  27. #
  28. return[HX_SW2-Vlanif900]q
  29. ------------------------------------
  30.     
  31.     HJ_SW3:[HJ_SW3]aaa
  32. [HJ_SW3-aaa]local-user huawei privilege level 3 password cipher 5555[HJ_SW3-aaa]local-user huawei service-type telnet 
  33. [HJ_SW3-aaa]quit 
  34. [HJ_SW3]user-interface vty 04[HJ_SW3-ui-vty0-4]authentication-mode aaa
  35. [HJ_SW3-ui-vty0-4]protocol inbound telnet 
  36. [HJ_SW3-ui-vty0-4]qui
  37. [HJ_SW3]int vlanif 900[HJ_SW3-Vlanif900]ip add 192.168.255.324[HJ_SW3-Vlanif900]q
  38. [HJ_SW3]ip route-static0.0.0.00192.168.255.1[HJ_SW3]
  39.     
  40.     HJ_SW4:[HJ_SW4]aaa
  41. [HJ_SW4-aaa]local-user huawei privilege level 3 password cipher 5555[HJ_SW4-aaa]local-user huawei service-type telnet 
  42. [HJ_SW4-aaa]quit 
  43. [HJ_SW4]user-interface vty 04[HJ_SW4-ui-vty0-4]authentication-mode aaa
  44. [HJ_SW4-ui-vty0-4]protocol inbound telnet 
  45. [HJ_SW4-ui-vty0-4]qui
  46. [HJ_SW4]int vlanif 900[HJ_SW4-Vlanif900]ip add 192.168.255.424[HJ_SW4-Vlanif900]q
  47. [HJ_SW4]ip route-static0.0.0.00192.168.255.1[HJ_SW4]qui
  48. /*...................剩余的交换机也是一样的配置SW1-SW12*///这个时候接可以telnet了192.168.255.3-8 254 253、和相应的路由器接口地址/*<PC>telnet 192.168.255.7
  49. Trying 192.168.255.7 ...
  50. Press CTRL+K to abort
  51. Connected to 192.168.255.7 ...
  53. Username:huawei
  54. Password:5555
  55. Info: The max number of VTY users is 5, and the number
  56.       of current VTY users on line is 1.
  57.       The current login time is 2022-04-19 17:27:13.
  58. <JR_SW7>*/

17、ACL策略

  1. [HX_SW1]acl 3001[HX_SW1-acl-adv-3001]rule permit ip source 192.168.50.00.0.0.255 destination 192.168.200.20[HX_SW1-acl-adv-3001]rule deny ip source any destination 192.168.200.20[HX_SW1-acl-adv-3001]dis this
  2. #
  3. acl number 3001
  4.  rule 5 permit ip source 192.168.50.00.0.0.255 destination 192.168.200.20
  5.  rule 10 deny ip destination 192.168.200.20
  6. #
  7. return[HX_SW1-acl-adv-3001]qui
  8. [HX_SW1]int g0/0/6[HX_SW1-GigabitEthernet0/0/6]traffic-filter outbound acl 3001[HX_SW1-GigabitEthernet0/0/6]qui
  9. ------------------------------------
  10.     
  11.     HX_SW2:[HX_SW2]acl 3001[HX_SW2-acl-adv-3001]rule permit ip source 192.168.50.00.0.0.255 destination 192.168.200.20[HX_SW2-acl-adv-3001]rule deny ip source any destination 192.168.200.20[HX_SW2-acl-adv-3001]dis this
  12. #
  13. acl number 3001
  14.  rule 5 permit ip source 192.168.50.00.0.0.255 destination 192.168.200.20
  15.  rule 10 deny ip destination 192.168.200.20
  16. #
  17. return[HX_SW2-acl-adv-3001]qui
  18. [HX_SW2][HX_SW2]int g0/0/6[HX_SW2-GigabitEthernet0/0/6]traffic-filter outbound acl 3001[HX_SW2-GigabitEthernet0/0/6]qui

18、无线WLAN配置

请添加图片描述

  1.     HX_SW2:<HX_SW2>sy
  2. [HX_SW2]vlan batch 100101102[HX_SW2]int g0/0/9[HX_SW2-GigabitEthernet0/0/9]port link-type trunk
  3. [HX_SW2-GigabitEthernet0/0/9]port trunk allow-pass vlan all
  4. [HX_SW2-GigabitEthernet0/0/9]int g0/0/3[HX_SW2-GigabitEthernet0/0/3]port trunk allow-pass vlan 100101102[HX_SW2-GigabitEthernet0/0/3]int g0/0/5[HX_SW2-GigabitEthernet0/0/5]port trunk allow-pass vlan 100101102[HX_SW2-GigabitEthernet0/0/5]qui
  5. [HX_SW2]int vlan 100[HX_SW2-Vlanif100]ip add 192.168.100.124[HX_SW2-Vlanif100]int vlan 101[HX_SW2-Vlanif101]ip add 192.168.101.124[HX_SW2-Vlanif101]int vlan 102[HX_SW2-Vlanif102]ip add 192.168.102.124[HX_SW2-Vlanif102]qui
  6. [HX_SW2]dhcp enable
  7. [HX_SW2]ip pool ap_pool
  8. Info:It's successful tocreate an IP address pool.[HX_SW2-ip-pool-ap_pool]gateway-list 192.168.100.1[HX_SW2-ip-pool-ap_pool]network 192.168.100.0 mask 24[HX_SW2-ip-pool-ap_pool]excluded-ip-address 192.168.100.100[HX_SW2-ip-pool-ap_pool]dns-list 192.168.111.3[HX_SW2-ip-pool-ap_pool]qui
  9. [HX_SW2]ip pool hua_1
  10. Info:It's successful tocreate an IP address pool.[HX_SW2-ip-pool-hua_1]gateway-list 192.168.101.1[HX_SW2-ip-pool-hua_1]network 192.168.101.0 mask 24[HX_SW2-ip-pool-hua_1]dns-list 192.168.111.3[HX_SW2-ip-pool-hua_1]qui
  11. [HX_SW2]ip pool hua_2
  12. Info:It's successful tocreate an IP address pool.[HX_SW2-ip-pool-hua_2]gateway-list 192.168.102.1[HX_SW2-ip-pool-hua_2]network 192.168.102.0 mask 24[HX_SW2-ip-pool-hua_2]dns-list 192.168.111.3[HX_SW2-ip-pool-hua_2]qui
  13. [HX_SW2]int vlan 100[HX_SW2-Vlanif100]dhcp select global 
  14. [HX_SW2-Vlanif100]int vlan 101[HX_SW2-Vlanif101]dhcp select global
  15. [HX_SW2-Vlanif101]int vlan 102[HX_SW2-Vlanif102]dhcp select global
  16. [HX_SW2-Vlanif102]qui
  17. [HX_SW2]qui
  18. <HX_SW2>save
  19. -------------------------------------
  20.     
  21.     HJ_SW3:<HJ_SW3>sy
  22. [HJ_SW3]vlan batch 100101102[HJ_SW3]int g0/0/2[HJ_SW3-GigabitEthernet0/0/2]port trunk allow-pass  vlan 100101102[HJ_SW3-GigabitEthernet0/0/2]int g0/0/5[HJ_SW3-GigabitEthernet0/0/5]port link-type trunk
  23. [HJ_SW3-GigabitEthernet0/0/5]port trunk pvid vlan 100[HJ_SW3-GigabitEthernet0/0/5]port trunk allow-pass vlan 100101[HJ_SW3-GigabitEthernet0/0/5]qui
  24. [HJ_SW3]qui
  25. ---------------------------------
  26.     
  27.     HJ_SW5:[HJ_SW5]vlan batch 100101102[HJ_SW5]int g0/0/2[HJ_SW5-GigabitEthernet0/0/2]port trunk allow-pass vlan 100101102[HJ_SW5-GigabitEthernet0/0/2]int g0/0/5[HJ_SW5-GigabitEthernet0/0/5]port link-type trunk
  28. [HJ_SW5-GigabitEthernet0/0/5]port trunk pvid vlan 100[HJ_SW5-GigabitEthernet0/0/5]port trunk allow-pass vlan 100102[HJ_SW5-GigabitEthernet0/0/5]qui
  29. [HJ_SW5]qu
  30. ---------------------------------
  31.     
  32.     AC:<AC6605>sy
  33. [AC6605]un in en
  34. [AC6605]sysname AC1
  35. [AC1]vlan batch 100to103[AC1]int g0/0/1[AC1-GigabitEthernet0/0/1]port link-type trunk
  36. [AC1-GigabitEthernet0/0/1]port trunk allow-pass vlan all
  37. [AC1-GigabitEthernet0/0/1]qui
  38. [AC1]int vlan 100[AC1-Vlanif100]ip add 192.168.100.10024[AC1-Vlanif100]qui
  39. [AC1]capwap source int vlanif100
  40. [AC1]wlan
  41. [AC1-wlan-view]ap-group name CYY
  42. [AC1-wlan-ap-group-CYY]q
  43. [AC1-wlan-view]regulatory-domain-profile name domain1
  44. [AC1-wlan-regulate-domain-domain1]country-code cn
  45. [AC1-wlan-regulate-domain-domain1]q
  46. [AC1-wlan-view]ap-group name CYY
  47. [AC1-wlan-ap-group-CYY]regulatory-domain-profile domain1
  48. Warning:Modifying the country code will clear channel, power and antenna gain c
  49. onfigurations of the radio and reset the AP. Continue?[Y/N]:y
  50. [AC1-wlan-ap-group-CYY]qui
  51. [AC1-wlan-view]qui
  52. [AC1]wlan
  53. [AC1-wlan-view]ap-group name YYC
  54. [AC1-wlan-ap-group-YYC]q
  55. [AC1-wlan-view]regulatory-domain-profile name domain2
  56. [AC1-wlan-regulate-domain-domain2]country-code cn
  57. Info:The current country code is same withthe input country code.[AC1-wlan-regulate-domain-domain2]q
  58. [AC1-wlan-view]ap-group name YYC
  59. [AC1-wlan-ap-group-YYC]regulatory-domain-profile domain2
  60. Warning:Modifying the country code will clear channel, power and antenna gain c
  61. onfigurations of the radio and reset the AP. Continue?[Y/N]:y
  62. [AC1-wlan-ap-group-YYC]qui
  63. [AC1-wlan-view]ap auth-mode mac-auth
  64. [AC1-wlan-view]ap-id 0 ap-mac 00e0-fc82-0a90
  65. [AC1-wlan-ap-0]ap-name area_0
  66. [AC1-wlan-ap-0]ap-group CYY
  67. Warning:This operation may cause AP reset. If the country code changes, it will
  68.  clear channel, power and antenna gain configurations of the radio,Whethertoc
  69. ontinue?[Y/N]:y
  70. [AC1-wlan-ap-0]qui
  71. [AC1-wlan-view]ap auth-mode mac-auth
  72. [AC1-wlan-view]ap-id 1 ap-mac 00e0-fc2d-1bd0
  73. [AC1-wlan-ap-1]ap-name area_1
  74. [AC1-wlan-ap-1]ap-group YYC
  75. Warning:This operation may cause AP reset. If the country code changes, it will
  76.  clear channel, power and antenna gain configurations of the radio,Whethertoc
  77. ontinue?[Y/N]:y
  78. Info:This operation may take a few seconds. Please wait for a moment.. done.[AC1-wlan-ap-1]qui
  79. [AC1-wlan-view]qui
  80. [AC1]wlan
  81. [AC1-wlan-view]security-profile name A[AC1-wlan-sec-prof-A]security wpa2 psk pass-phrase a1234567 aes
  82. [AC1-wlan-sec-prof-A]q
  83. [AC1-wlan-view]security-profile name X[AC1-wlan-sec-prof-X]security wpa2 psk pass-phrase huawei@123 aes
  84. [AC1-wlan-sec-prof-X]qui
  85. [AC1-wlan-view]ssid-profile name B[AC1-wlan-ssid-prof-B]ssid CYY-CY
  86. Info:This operation may take a few seconds, please wait.done.[AC1-wlan-ssid-prof-B]q
  87. [AC1-wlan-view]ssid-profile name Y[AC1-wlan-ssid-prof-Y]ssid YYC-YC
  88. Info:This operation may take a few seconds, please wait.done.[AC1-wlan-ssid-prof-Y]q
  89. [AC1-wlan-view]vap-profile name C[AC1-wlan-vap-prof-C]forward-mode tunnel
  90. Info:This operation may take a few seconds, please wait.done.[AC1-wlan-vap-prof-C]service-vlan vlan-id 101Info:This operation may take a few seconds, please wait.done.[AC1-wlan-vap-prof-C]security-profile AInfo:This operation may take a few seconds, please wait.done.[AC1-wlan-vap-prof-C]ssid-profile BInfo:This operation may take a few seconds, please wait.done.[AC1-wlan-vap-prof-C]qui
  91. [AC1-wlan-view]vap-profile name Z[AC1-wlan-vap-prof-Z]forward-mode tunnel
  92. Info:This operation may take a few seconds, please wait.done.[AC1-wlan-vap-prof-Z]service-vlan vlan-id 102Info:This operation may take a few seconds, please wait.done.[AC1-wlan-vap-prof-Z]security-profile XInfo:This operation may take a few seconds, please wait.done.[AC1-wlan-vap-prof-Z]ssid-profile YInfo:This operation may take a few seconds, please wait.done.[AC1-wlan-vap-prof-Z]qui
  93. [AC1-wlan-view]ap-group name CYY
  94. [AC1-wlan-ap-group-CYY]vap-profile C wlan 1 radio 0Info:This operation may take a few seconds, please wait...done.[AC1-wlan-ap-group-CYY]vap-profile C wlan 1 radio 1Info:This operation may take a few seconds, please wait...done.[AC1-wlan-ap-group-CYY]qui
  95. [AC1-wlan-view]ap-group name YYC
  96. [AC1-wlan-ap-group-YYC]vap-profile Z wlan 1 radio 0Info:This operation may take a few seconds, please wait...done.[AC1-wlan-ap-group-YYC]vap-profile Z wlan 1 radio 1
标签： 网络协议 网络安全 ensp
本文转载自: https://blog.csdn.net/m0_46179473/article/details/125121176
版权归原作者 小猿网 所有， 如有侵权，请联系我们删除。
登录后发布评论

“基于eNSP加防火墙的千人中型校园/企业网络规划与设计(附所有配置命令)”的评论:

还没有评论
关于作者
...
overfit同步小助手
文章同步
相关阅读

网络安全法-网络运行安全

使用selenium/drissionpage时如何阻止chrome自动跳转http到https

docker desktop 里部署的Open WebUI 管理员密码忘记了的处理方法

在ubuntu20.04中搭建onsite比赛运行环境

利用开源的低代码表单设计器FcDesigner高效管理和渲染复杂表单结构

Kafka学习笔记

【前端】浏览器输入url到页面呈现发生了什么？