1.拓?fù)湟约靶枨?/h2>

2.需求分析

需要的核心技術(shù)

1、虛擬局域網(wǎng)（VLAN）

2、鏈路聚合（E-trunk）

3、多生成樹(shù)協(xié)議（MSTP）

4、VLANIF三層邏輯接口

5、虛擬路由冗余協(xié)議（VRRP）

6、動(dòng)態(tài)主機(jī)配置協(xié)議（DHCP）

7、放式最短路徑優(yōu)先（OSPF）

8、網(wǎng)絡(luò)地址轉(zhuǎn)換協(xié)議（NAT）

第一步先從接入層入手劃分vlan并放通，進(jìn)行鏈路聚合等操作，第二步防止成環(huán)并給交換機(jī)做備份配置MSTP與VRRP，然后配置DHCP給PC分配IP（這里的DHCP也要做備份），此時(shí)二層交換部分就已經(jīng)做完了。到了三層部分配置動(dòng)態(tài)路由協(xié)議OSPF，在邊界路由器配置NAT訪問(wèn)外網(wǎng)。

3.詳細(xì)配置

3.1VLAN規(guī)劃

LSW3

<SW3>system-view //進(jìn)入用戶試圖
[SW3]vlan batch 2 3 20 30 //創(chuàng)建VLAN
[SW3]interface GigabitEthernet 0/0/1 //進(jìn)入接口
[SW3-GigabitEthernet0/0/1]port link-type access //將接口設(shè)為接入模式
[SW3-GigabitEthernet0/0/1]port default vlan 2 //將VLAN劃入接口<SW3>system-view 
[SW3]vlan batch 2 3 20 30
[SW3]interface GigabitEthernet 0/0/2
[SW3-GigabitEthernet0/0/2]port link-type access 
[SW3-GigabitEthernet0/0/2]port default vlan 3<SW3>system-view 
[SW3]vlan batch 2 3 20 30
[SW3]port-group group-member GigabitEthernet 0/0/3 GigabitEthernet 0/0/4 //創(chuàng)建組接口批量操作
[SW3-GigabitEthernet0/0/3]port link-type trunk  //將接口設(shè)為干道模式
[SW3-port-group]port trunk allow-pass vlan 2 3 20 30 //放行接口

LSW4

<SW4>system-view
[SW4]vlan batch 2 3 20 30
[SW4]interface GigabitEthernet 0/0/1 
[SW4-GigabitEthernet0/0/1]port link-type access 
[SW4-GigabitEthernet0/0/1]port default vlan 20 <SW4>system-view 
[SW4]vlan batch 2 3 20 30
[SW4]interface GigabitEthernet 0/0/2
[SW4-GigabitEthernet0/0/2]port link-type access 
[SW4-GigabitEthernet0/0/2]port default vlan 30<SW4>system-view 
[SW4]vlan batch 2 3 20 30
[SW4]port-group group-member GigabitEthernet 0/0/3 GigabitEthernet 0/0/4 
[SW4-GigabitEthernet0/0/3]port link-type trunk 
[SW4-port-group]port trunk allow-pass vlan 2 3 20 30 

LSW1

<SW1>system-view	
[SW1]port-group group-member GigabitEthernet 0/0/3 GigabitEthernet 0/0/4
[SW1-port-group]port link-type trunk 
[SW1-port-group]port trunk allow-pass vlan 2 3 20 30

LSW2

<SW2>system-view	
[SW2]port-group group-member GigabitEthernet 0/0/3 GigabitEthernet 0/0/4
[SW2-port-group]port link-type trunk 
[SW2-port-group]port trunk allow-pass vlan 2 3 20 30

3.2鏈路聚合

將多個(gè)物理接口捆綁成一個(gè)邏輯接口起到增加帶寬，負(fù)載分擔(dān)的作用。邏輯接口也要放通VLAN。

LSW1

[SW1]int Eth-Trunk 0 //創(chuàng)建邏輯接口
[SW1-Eth-Trunk0]trunkport GigabitEthernet 0/0/1 to 0/0/2 

LSW2

[SW2]int Eth-Trunk 0 //創(chuàng)建邏輯接口
[SW2-Eth-Trunk0]trunkport GigabitEthernet 0/0/1 to 0/0/2 

3.3配置MSTP

LSW1

[SW1]stp enable //啟用生成樹(shù)協(xié)議
[SW1]stp mode mstp //將模式設(shè)置為mstp
[SW1]stp region-configuration //進(jìn)入mstp域配置視圖
[SW1-mst-region]region-name aa //修改域名，默認(rèn)域名為本地MAC地址
[SW1-mst-region]instance 1 vlan 2 3 //配置實(shí)例與VLAN的映射關(guān)系
[SW1-mst-region]instance 2 vlan 20 30
[SW1-mst-region]active region-configuration //激活域配置，如果沒(méi)有激活，則前面的配置無(wú)效
[SW1]quit [SW1]stp instance 1 root primary //將SW1設(shè)定為實(shí)例1的主根
[SW1]stp instance 2 root secondary // //將SW1設(shè)定為實(shí)例2的副根

LSW2

[SW2]stp enable 
[SW2]stp mode mstp 
[SW2]stp region-configuration 
[SW2-mst-region]region-name aa 
[SW2-mst-region]instance 1 vlan 2 3 
[SW2-mst-region]instance 2 vlan 20 30
[SW2-mst-region]active region-configuration 
[SW2]quit [SW2]stp instance 2 root primary 
[SW2]stp instance 1 root secondary 

LSW3

[SW3]stp enable 
[SW3]stp mode mstp 
[SW3]stp region-configuration 
[SW3-mst-region]region-name aa 
[SW3-mst-region]instance 1 vlan 2 3 
[SW3-mst-region]instance 2 vlan 20 30
[SW3-mst-region]active region-configuration 

LSW4

[SW4]stp enable 
[SW4]stp mode mstp 
[SW4]stp region-configuration 
[SW4-mst-region]region-name aa 
[SW4-mst-region]instance 1 vlan 2 3 
[SW4-mst-region]instance 2 vlan 20 30
[SW4-mst-region]active region-configuration [SW1]display stp region-configuration 
[SW1]display stp brief 

3.4配置VLANIF

LSW1

[SW1]int Vlanif 2 //創(chuàng)建vlanif接口---邏輯三層接口
[SW1-Vlanif2]ip address 10.0.2.1 24[SW1]int Vlanif 3
[SW1-Vlanif3]ip address 10.0.3.1 24[SW1]int Vlanif 20
[SW1-Vlanif20]ip address 10.0.20.1 24[SW1]int Vlanif 30
[SW1-Vlanif30]ip address 10.0.30.1 24

LSW2

[SW2]int Vlanif 2 //創(chuàng)建vlanif接口---邏輯三層接口
[SW2-Vlanif2]ip address 10.0.2.129 24 //主機(jī)位配置129方便后續(xù)配置DHCP排除IP[SW2]int Vlanif 3
[SW2-Vlanif3]ip address 10.0.3.129 24[SW2]int Vlanif 20
[SW2-Vlanif20]ip address 10.0.20.129 24[SW2]int Vlanif 30
[SW2-Vlanif30]ip address 10.0.30.129 24

3.5配置VRRP

LSW1

[SW1]int Vlanif 2
[SW1-Vlanif2]vrrp vrid 2 virtual-ip 10.0.2.254 //配置虛擬路由器IP作為PC網(wǎng)關(guān)
[SW1-Vlanif2]vrrp vrid  2 priority 120 //提高優(yōu)先級(jí)為master狀態(tài)[SW1]int Vlanif 3
[SW1-Vlanif3]vrrp vrid 3 virtual-ip 10.0.3.254
[SW1-Vlanif3]vrrp vrid  3 priority 120[SW1]int Vlanif 20
[SW1-Vlanif20]vrrp vrid 20 virtual-ip 10.0.20.254 //作為虛擬路由器的備份網(wǎng)關(guān)，不需要提高優(yōu)先級(jí)[SW1]int Vlanif 30
[SW1-Vlanif30]vrrp vrid 30 virtual-ip 10.0.30.254

LSW2

[SW1]int Vlanif 2
[SW1-Vlanif2]vrrp vrid 2 virtual-ip 10.0.2.254[SW1]int Vlanif 3
[SW1-Vlanif3]vrrp vrid 3 virtual-ip 10.0.3.254[SW1]int Vlanif 20
[SW1-Vlanif20]vrrp vrid 20 virtual-ip 10.0.20.254
[SW1-Vlanif20]vrrp vrid  20 priority 120[SW1]int Vlanif 30
[SW1-Vlanif30]vrrp vrid 30 virtual-ip 10.0.30.254
[SW1-Vlanif30]vrrp vrid  30 priority 120<SW1>display vrrp brief 

3.6配置DHCP

配置的DHCP也要備份，因此采用排除一半地址池的辦法 ，留一半給備份設(shè)備分配

LSW1

[SW1]dhcp enable 
[SW1]ip pool vlan2 //創(chuàng)建名為vlan2的IP地址池
[SW1-ip-pool-vlan2]network 10.0.2.0 mask 24 //宣告網(wǎng)段
[SW1-ip-pool-vlan2]gateway-list 10.0.2.254 //設(shè)置網(wǎng)關(guān)
[SW1-ip-pool-vlan2]dns-list 8.8.8.8 //域名解析服務(wù)器
[SW1-ip-pool-vlan2]excluded-ip-address 10.0.2.129 10.0.2.253 //排除地址池一半的IP[SW1]int Vlanif 2
[SW1-Vlanif2]dhcp select global [SW1]ip pool vlan3 
[SW1-ip-pool-vlan3]network 10.0.3.0 mask 24 
[SW1-ip-pool-vlan3]gateway-list 10.0.3.254 
[SW1-ip-pool-vlan3]dns-list 8.8.8.8 
[SW1-ip-pool-vlan3]excluded-ip-address 10.0.3.129 10.0.3.253 [SW1]int Vlanif 3
[SW1-Vlanif3]dhcp select global [SW1]ip pool vlan20 
[SW1-ip-pool-vlan20]network 10.0.20.0 mask 24 
[SW1-ip-pool-vlan20]gateway-list 10.0.20.254 
[SW1-ip-pool-vlan20]dns-list 8.8.8.8 
[SW1-ip-pool-vlan20]excluded-ip-address 10.0.20.129 10.0.20.253 [SW1]int Vlanif 20
[SW1-Vlanif3]dhcp select global[SW1]ip pool vlan30
[SW1-ip-pool-vlan30]network 10.0.30.0 mask 24 
[SW1-ip-pool-vlan30]gateway-list 10.0.30.254 
[SW1-ip-pool-vlan30]dns-list 8.8.8.8 
[SW1-ip-pool-vlan30]excluded-ip-address 10.0.30.129 10.0.30.253 [SW1]int Vlanif 30
[SW1-Vlanif3]dhcp select global 

LSW2

[SW1]dhcp enable 
[SW1]ip pool vlan2 
[SW1-ip-pool-vlan2]network 10.0.2.0 mask 24 
[SW1-ip-pool-vlan2]gateway-list 10.0.2.254 
[SW1-ip-pool-vlan2]dns-list 8.8.8.8 
[SW1-ip-pool-vlan2]excluded-ip-address 10.0.2.1 10.0.2.128 [SW1]int Vlanif 2
[SW1-Vlanif2]dhcp select global [SW1]ip pool vlan3 
[SW1-ip-pool-vlan3]network 10.0.3.0 mask 24 
[SW1-ip-pool-vlan3]gateway-list 10.0.3.254 
[SW1-ip-pool-vlan3]dns-list 8.8.8.8 
[SW1-ip-pool-vlan3]excluded-ip-address 10.0.3.1 10.0.3.128[SW1]int Vlanif 3
[SW1-Vlanif3]dhcp select global [SW1]ip pool vlan20 
[SW1-ip-pool-vlan20]network 10.0.20.0 mask 24 
[SW1-ip-pool-vlan20]gateway-list 10.0.20.254 
[SW1-ip-pool-vlan20]dns-list 8.8.8.8 
[SW1-ip-pool-vlan20]excluded-ip-address 10.0.20.1 10.0.20.128[SW1]int Vlanif 20
[SW1-Vlanif3]dhcp select global[SW1]ip pool vlan30
[SW1-ip-pool-vlan30]network 10.0.30.0 mask 24 
[SW1-ip-pool-vlan30]gateway-list 10.0.30.254 
[SW1-ip-pool-vlan30]dns-list 8.8.8.8 
[SW1-ip-pool-vlan30]excluded-ip-address 10.0.30.1 10.0.30.128[SW1]int Vlanif 30
[SW1-Vlanif3]dhcp select global 

PC1的IP

PC3的IP

此時(shí)二層的配置就已經(jīng)全部做完了

3.7配置接口IP

AR1

<R1>system-view 
[R1]int g0/0/0
[R1-GigabitEthernet0/0/0]ip address 202.1.1.1 24[R1]int g0/0/1
[R1-GigabitEthernet0/0/1]ip address 10.0.0.2 30[R1]int g0/0/2
[R1-GigabitEthernet0/0/2]ip address 10.0.0.6 30

AR2

<R2>system-view 
[R2]int g0/0/0
[R2-GigabitEthernet0/0/0]ip add 202.1.1.2 30[R2]int LoopBack 0
[R2-LoopBack0]ip add 100.100.100.100 32

SW1

<SW1>system-view 
[SW1]vlan 13 101
[SW1]interface Vlanif 13
[SW1-Vlanif101]ip address 10.0.0.9 30
[SW1]interface Vlanif 101
[SW1-Vlanif101]ip address 10.0.0.1 30[SW1]int Eth-Trunk 12
[SW1-Eth-Trunk12]port link-type trunk 
[SW1-Eth-Trunk12]port trunk allow-pass vlan 13[SW1]int g0/0/5
[SW1-GigabitEthernet0/0/5]port link-type access
[SW1-GigabitEthernet0/0/5]port default vlan 101

SW2

<SW2>system-view 
[SW2]vlan 13 102
[SW2]interface Vlanif 13
[SW2-Vlanif13]ip address 10.0.0.10 30[SW2]interface Vlanif 102
[SW2-Vlanif101]ip address 10.0.0.5 30[SW2]int Eth-Trunk 12
[SW1-Eth-Trunk12]port link-type trunk 
[SW1-Eth-Trunk12]port trunk allow-pass vlan 13[SW2]int g0/0/5
[SW2-GigabitEthernet0/0/5]port link-type access
[SW2-GigabitEthernet0/0/5]port default vlan 102

3.8配置OSPF

這里防止防止上行鏈路故障SW1與SW2也要建立鄰接關(guān)系

AR1

<R1>system-view 
[R1]ospf 1
[R1-ospf-1]area 0
[R1-ospf-1-area-0.0.0.0]network 10.0.0.2 0.0.0.0 
[R1-ospf-1-area-0.0.0.0]network 10.0.0.6 0.0.0.0

SW1

<SW1>system-view 
[SW1]ospf 1
[SW1-ospf-1]area 0
[SW1-ospf-1-area-0.0.0.0]network 10.0.0.1 0.0.0.0
[SW1-ospf-1-area-0.0.0.0]network 10.0.0.9 0.0.0.0
[SW1-ospf-1-area-0.0.0.0]network 10.0.2.1 0.0.0.0
[SW1-ospf-1-area-0.0.0.0]network 10.0.3.1 0.0.0.0
[SW1-ospf-1-area-0.0.0.0]network 10.0.20.1 0.0.0.0
[SW1-ospf-1-area-0.0.0.0]network 10.0.30.1 0.0.0.0[SW1-ospf-1]display ospf peer brief 

SW2

<SW2>system-view 
[SW2]ospf 1
[SW2-ospf-1]area 0
[SW2-ospf-1-area-0.0.0.0]network 10.0.0.5 0.0.0.0
[SW2-ospf-1-area-0.0.0.0]network 10.0.0.10 0.0.0.0
[SW2-ospf-1-area-0.0.0.0]network 10.0.2.129 0.0.0.0
[SW2-ospf-1-area-0.0.0.0]network 10.0.3.129 0.0.0.0
[SW2-ospf-1-area-0.0.0.0]network 10.0.20.129 0.0.0.0
[SW2-ospf-1-area-0.0.0.0]network 10.0.30.129 0.0.0.0[SW1-ospf-1]display ospf peer brief 

從鄰居表中可以看到數(shù)據(jù)的重復(fù)更新，可以配置靜默接口來(lái)使接口不發(fā)送與接收OSPF報(bào)文

[SW1-ospf-1]silent-interface Vlanif 2
[SW1-ospf-1]silent-interface Vlanif 3
[SW1-ospf-1]silent-interface Vlanif 20
[SW1-ospf-1]silent-interface Vlanif 30[SW2-ospf-1]silent-interface Vlanif 2
[SW2-ospf-1]silent-interface Vlanif 3
[SW2-ospf-1]silent-interface Vlanif 20
[SW2-ospf-1]silent-interface Vlanif 30

3.9配置NAT

AR1

<R1>system-view 
[R1]acl 2000 //創(chuàng)建ACL列表2000  2000-2999為標(biāo)準(zhǔn)ACL，一個(gè)編號(hào)為一張大表
[R1-acl-basic-2000]rule 5 permit source 10.0.0.0 0.0.255.255 使用通配符進(jìn)行匹配，通配符支持0，1混編[R1]int g0/0/0
[R1-GigabitEthernet0/0/0]nat outbound 2000 //出接口調(diào)用acl 2000

實(shí)驗(yàn)補(bǔ)充

邊界路由器配置缺省

[R1]ip route-static 0.0.0.0 0 202.1.1.2

OSPF邊界路由器下發(fā)缺省

[R1]ospf 1
[R1-ospf-1]default-route-advertise //后面不用跟always，因?yàn)橐呀?jīng)配置了指向外網(wǎng)的靜態(tài)缺省路由

使用PC1去ping100.100.100.100