实验拓扑
实验要求
1、按照图示配置IP地址
2、sw1和sw2之间的直连链路配置链路聚合
3、 公司内部业务网段为VLAN10和VLAN20; VLAN 10是市场部，vlan20是技术部，要求对VLAN进行命名以便识别；PC1属于vlan10，PC2属于vlan20，vlan30用于SW1和SW2建立OSPF邻居；VLAN111为SW1和R1的互联vlan，vlan222为sw2和R2的互联vlan
4、所有交换机相连的端口配置为TRUNK，允许相关流量通过
5、交换机连接PC的端口配置为边缘端口
6、在SW1上配置DHCP服务，为vlan10和vlan20的PC动态分配IP地址，网关和DNS地址；要求vlan10的网关是192.168.1.252，vlan20的网关是192.168.2.253
7、按图示分区域配置OSPF实现公司内部网络全网互通，ABR的环回口宣告进骨干区域；业务网段不允许出现协议报文
8、R1上配置默认路由指向互联网，并引入到OSPF
9、R1通过双线连接到互联网，配置PPP-MP，并配置双向CHAP验证
10、配置EASY IP，只有业务网段192.168.1.0/24和192.168.2.0/24 的数据流可以通过R1访问互联网
11、R1开启TELNET远程管理，使用用户ABC登录，密码ABC，只允许技术部远程管理R1
实验解法
1、给PC配置IP地址
为R1配置IP地址
<H3C>sys
System View: return to User View with Ctrl+Z.
[H3C]int g0/1
[H3C-GigabitEthernet0/1]ip ad
[H3C-GigabitEthernet0/1]ip address 10.0.0.1 30
[H3C-GigabitEthernet0/1]int g0/0
[H3C-GigabitEthernet0/0]ip ad 10.0.0.5 30
[H3C-GigabitEthernet0/0]int g0/2
[H3C-GigabitEthernet0/2]ip ad 10.0.0.14 30
[H3C-GigabitEthernet0/2]int lo0
[H3C-LoopBack0]ip ad 10.1.1.1 32
[H3C-LoopBack0]int mp-group 1
[H3C-MP-group1]ip address 202.100.1.2 30
[H3C]di ip int b
*down: administratively down
(s): spoofing (l): loopback
Interface Physical Protocol IP address/Mask VPN instance Description
GE0/0 up up 10.0.0.5/30 -- --
GE0/1 up up 10.0.0.1/30 -- --
GE0/2 up up 10.0.0.14/30 -- --
GE5/0 down down -- -- --
GE5/1 down down -- -- --
GE6/0 down down -- -- --
GE6/1 down down -- -- --
Loop0 up up(s) 10.1.1.1/32 -- --
MP1 down down 202.100.1.2/30 -- --
Ser1/0 up up -- -- --
Ser2/0 up up -- -- --
Ser3/0 down down -- -- --
Ser4/0 down down -- -- --
[H3C]R2上配置IP地址
<H3C>sys
System View: return to User View with Ctrl+Z.
[H3C]
[H3C]sysn
[H3C]sysname r2
[r2]int g0/0
[r2-GigabitEthernet0/0]ip ad 10.0.0.9 30
[r2-GigabitEthernet0/0]int g0/2
[r2-GigabitEthernet0/2]ip ad 10.0.0.2 30
[r2-GigabitEthernet0/2]int g0/1
[r2-GigabitEthernet0/1]ip ad 10.0.0.18 30
[r2-GigabitEthernet0/1]int lo0
[r2-LoopBack0]ip ad 10.1.1.2 32
[r2-LoopBack0]qu
[r2]di ip in b
*down: administratively down
(s): spoofing (l): loopback
Interface Physical Protocol IP address/Mask VPN instance Description
GE0/0 up up 10.0.0.9/30 -- --
GE0/1 up up 10.0.0.18/30 -- --
GE0/2 up up 10.0.0.2/30 -- --
GE5/0 down down -- -- --
GE5/1 down down -- -- --
GE6/0 down down -- -- --
GE6/1 down down -- -- --
Loop0 up up(s) 10.1.1.2/32 -- --
Ser1/0 down down -- -- --
Ser2/0 down down -- -- --
Ser3/0 down down -- -- --
Ser4/0 down down -- -- --
[r2]R3上配置IP地址
<H3C>sys
System View: return to User View with Ctrl+Z.
[H3C]sysn
[H3C]sysname r3
[r3]int g0/0
[r3-GigabitEthernet0/0]ip ad 10.0.0.13 30
[r3-GigabitEthernet0/0]int g0/1
[r3-GigabitEthernet0/1]ip ad 10.0.0.17 30
[r3-GigabitEthernet0/1]int g0/2
[r3-GigabitEthernet0/2]ip ad 192.168.3.254 24
[r3-GigabitEthernet0/2]int lo0
[r3-LoopBack0]ip ad 10.1.1.3 32
[r3-LoopBack0]qu
[r3]di ip int b
*down: administratively down
(s): spoofing (l): loopback
Interface Physical Protocol IP address/Mask VPN instance Description
GE0/0 up up 10.0.0.13/30 -- --
GE0/1 up up 10.0.0.17/30 -- --
GE0/2 up up 192.168.3.254/24 -- --
GE5/0 down down -- -- --
GE5/1 down down -- -- --
GE6/0 down down -- -- --
GE6/1 down down -- -- --
Loop0 up up(s) 10.1.1.3/32 -- --
Ser1/0 down down -- -- --
Ser2/0 down down -- -- --
Ser3/0 down down -- -- --
Ser4/0 down down -- -- --
[r3]
在SW1上配置IP地址
<H3C>sys
System View: return to User View with Ctrl+Z.
[H3C]sysn
[H3C]sysname sw1
[sw1]vlan 10
[sw1-vlan10]qu
[sw1]vlan 20
[sw1-vlan20]qu
[sw1]vlan 30
[sw1-vlan30]qu
[sw1]vlan 111
[sw1-vlan111]po
[sw1-vlan111]port g1/0/4
[sw1-vlan111]qu
[sw1]int vlan 10
[sw1-Vlan-interface10]ip ad 192.168.1.252 24
[sw1-Vlan-interface10]di th
#
interface Vlan-interface10ip address 192.168.1.252 255.255.255.0
#
return
[sw1-Vlan-interface10]int vlan 20
[sw1-Vlan-interface20]ip ad 192.168.2.252 24
[sw1-Vlan-interface20]int vlan 30
[sw1-Vlan-interface30]ip ad 10.1.2.1 30
[sw1-Vlan-interface30]int vlan 111[sw1-Vlan-interface111]ip ad 10.0.0.6 30
[sw1-Vlan-interface111]int lo0
[sw1-LoopBack0]ip ad 10.1.1.11 32
[sw1-LoopBack0]
在SW2上配置IP地址
<H3C>sys
System View: return to User View with Ctrl+Z.
[H3C]sysn
[H3C]sysname sw2
[sw2]vlan 10
[sw2-vlan10]vlan 20
[sw2-vlan20]vlan 30
[sw2-vlan30]vlan 222
[sw2-vlan222]po
[sw2-vlan222]port g1/0/4
[sw2-vlan222]int vlan 10
[sw2-Vlan-interface10]ipad
[sw2-Vlan-interface10]ip ad 192.168.1.253 24
[sw2-Vlan-interface10]int vlan 20
[sw2-Vlan-interface20]ip ad 192.168.2.253 24
[sw2-Vlan-interface20]int vlan 30
[sw2-Vlan-interface30]ip ad 10.1.2.2 30
[sw2-Vlan-interface30]int vlan 222
[sw2-Vlan-interface222]ip ad 10.0.0.10 30
[sw2-Vlan-interface222]int lo0
[sw2-LoopBack0]ip ad 10.1.1.12 32
[sw2-LoopBack0]qu
[sw2]di ip in b
*down: administratively down
(s): spoofing (l): loopback
Interface Physical Protocol IP Address Description
Loop0 up up(s) 10.1.1.12 --
MGE0/0/0 down down -- --
Vlan10 down down 192.168.1.253 --
Vlan20 down down 192.168.2.253 --
Vlan30 down down 10.1.2.2 --
Vlan222 up up 10.0.0.10 --
在 lneternet上配置IP地址
<H3C>sys
System View: return to User View with Ctrl+Z.
[H3C]sysn
[H3C]sysname lnternet
[lnternet]int mp-group 1
[lnternet-MP-group1]ip ad 202.100.1.1 30
[lnternet-MP-group1]int lo0
[lnternet-LoopBack0]ip ad 100.1.1.1 32
[lnternet-LoopBack0]qu在SW1和SW2之间的直连链路配置链路聚合
[sw1]int Bridge-Aggregation 1
[sw1-Bridge-Aggregation1]int g1/0/1
[sw1-GigabitEthernet1/0/1]port link-aggregation group 1
[sw1-GigabitEthernet1/0/1]int g1/0/2
[sw1-GigabitEthernet1/0/2]port link-aggregation group 1[sw2]interface Bridge-Aggregation 1
[sw2-Bridge-Aggregation1]int g1/0/1
[sw2-GigabitEthernet1/0/1]port link-aggregation group 1
[sw2-GigabitEthernet1/0/1]int g1/0/2
[sw2-GigabitEthernet1/0/2]port link-aggregation group 1
[sw1]display link-aggregation verbose
Loadsharing Type: Shar -- Loadsharing, NonS -- Non-Loadsharing
Port: A -- Auto
Port Status: S -- Selected, U -- Unselected, I -- Individual
Flags: A -- LACP_Activity, B -- LACP_Timeout, C -- Aggregation,D -- Synchronization, E -- Collecting, F -- Distributing,G -- Defaulted, H -- ExpiredAggregate Interface: Bridge-Aggregation1
Aggregation Mode: Static
Loadsharing Type: SharPort Status Priority Oper-Key
--------------------------------------------------------------------------------GE1/0/1 S 32768 1GE1/0/2 S 32768 1
[sw1]
公司内部业务网段为VLAN10和VLAN20; VLAN 10是市场部，vlan20是技术部，要求对VLAN进行命名以便识别；PC1属于vlan10，PC2属于vlan20，vlan30用于SW1和SW2建立OSPF邻居；VLAN111为SW1和R1的互联vlan，vlan222为sw2和R2的互联vlan
vlan以及IP已经配好
[sw1]int GigabitEthernet 1/0/4
[sw1-GigabitEthernet1/0/4]di th
#
interface GigabitEthernet1/0/4port link-mode bridgeport access vlan 111combo enable fiber[sw2]int g1/0/4
[sw2-GigabitEthernet1/0/4]di th
#
interface GigabitEthernet1/0/4port link-mode bridgeport access vlan 222combo enable fiber
<H3C>sys
System View: return to User View with Ctrl+Z.
[H3C]sysn
[H3C]sysname sw3
[sw3]vlan 10
[sw3-vlan10]name scb
[sw3-vlan10]vlan 20
[sw3-vlan20]name jsb
[sw3-vlan20]int g1/0/3
[sw3-GigabitEthernet1/0/3]port access vlan 10
[sw3-GigabitEthernet1/0/3]int g1/0/4
[sw3-GigabitEthernet1/0/4]port access vlan 20
[sw3-GigabitEthernet1/0/4]qu
将端口配置为Ttrunk允许相关的vlan通过
[sw1]int g1/0/3
[sw1-GigabitEthernet1/0/3]port link-type trunk
[sw1-GigabitEthernet1/0/3]port trunk permit vlan 10 20
[sw1-GigabitEthernet1/0/3]qu
[sw1]int Bridge-Aggregation 1
[sw1-Bridge-Aggregation1]port link-type trunk
Configuring GigabitEthernet1/0/1 done.
Configuring GigabitEthernet1/0/2 done.
[sw1-Bridge-Aggregation1]port trunk permit vlan 10 20 30
Configuring GigabitEthernet1/0/1 done.
Configuring GigabitEthernet1/0/2 done.
[sw1-Bridge-Aggregation1]qu[sw2]int g1/0/3
[sw2-GigabitEthernet1/0/3]port link-type trunk
[sw2-GigabitEthernet1/0/3]port trunk permit vlan 10 20
[sw2-GigabitEthernet1/0/3]qu
[sw2]int Bridge-Aggregation 1
[sw2-Bridge-Aggregation1]port link-type trunk
Configuring GigabitEthernet1/0/1 done.
Configuring GigabitEthernet1/0/2 done.
[sw2-Bridge-Aggregation1]port trunk permit vlan 10 20 30
Configuring GigabitEthernet1/0/1 done.
Configuring GigabitEthernet1/0/2 done.
[sw2-Bridge-Aggregation1]qu
[sw2][sw3]int g1/0/1
[sw3-GigabitEthernet1/0/1]port link-type trunk
[sw3-GigabitEthernet1/0/1]port trunk permit vlan 10 20
[sw3-GigabitEthernet1/0/1]int g1/0/2
[sw3-GigabitEthernet1/0/2]port link-type trunk
[sw3-GigabitEthernet1/0/2]port trunk permit vlan 10 20
[sw3-GigabitEthernet1/0/2]
[sw3-GigabitEthernet1/0/2]qu
[sw3]交换机连接PC的端口配置为边缘端口
边缘端口（Edge Port） 是生成树协议（STP, Spanning Tree Protocol）中的一个概念，特指那些直接连接到终端设备（如PC、服务器等）的端口，而不是连接到其他交换机或网桥的端口。在STP中，边缘端口具有一些特殊的属性和行为，以优化网络性能和避免不必要的延迟。
[sw3]int g1/0/3
[sw3-GigabitEthernet1/0/3]stp edged-port
[sw3-GigabitEthernet1/0/3]int g1/0/4
[sw3-GigabitEthernet1/0/4]stp edged-port在SW1上配置DHCP服务，为vlan10和vlan20的PC动态分配IP地址，网关和DNS地址；要求vlan10的网关是192.168.1.252，vlan20的网关是192.168.2.253
[sw1]dhcp enable
[sw1]dhcp server ip-pool vlan10
[sw1-dhcp-pool-vlan10]network 192.168.1.0 mask
[sw1-dhcp-pool-vlan10]network 192.168.1.0 mask 255.255.255.0
[sw1-dhcp-pool-vlan10]gateway
[sw1-dhcp-pool-vlan10]gateway-list 192.168.1.252
[sw1-dhcp-pool-vlan10]dhcp server ip-pool vlan20
[sw1-dhcp-pool-vlan20]network 192.168.2.0 mask 255.255.255.0
[sw1-dhcp-pool-vlan20]gateway
[sw1-dhcp-pool-vlan20]gateway-list 192.168.2.253
按图示分区域配置OSPF实现公司内部网络全网互通，ABR的环回口宣告进骨干区域；业务网段不允许出现协议报文
命令的大致意思是将VLAN 10的接口设置为“静默接口”（silent interface）。当设置为静默接口时，该接口将不会发送与该路由协议相关的路由更新或Hello报文。
[sw1]ospf 1 router-id 3.3.3.3
[sw1-ospf-1]silent-interface vlan 10
[sw1-ospf-1]area 1
[sw1-ospf-1-area-0.0.0.1]ne
[sw1-ospf-1-area-0.0.0.1]network 192.168.1.252 0.0.0.255
[sw1-ospf-1-area-0.0.0.1]network 192.168.2.252 0.0.0.255
[sw1-ospf-1-area-0.0.0.1]network 10.1.2.1 0.0.0.3
[sw1-ospf-1-area-0.0.0.1]network 10.0.0.6 0.0.0.3
[sw1-ospf-1-area-0.0.0.1]network 10.1.1.11 0.0.0.0
[sw1-ospf-1-area-0.0.0.1]quit
[sw1-ospf-1][sw2]ospf router-id 4.4.4.4
[sw2-ospf-1]sil
[sw2-ospf-1]silent-interface vlan 20
[sw2-ospf-1]area 1
[sw2-ospf-1-area-0.0.0.1]net
[sw2-ospf-1-area-0.0.0.1]network 192.168.1.253 0.0.0.255
[sw2-ospf-1-area-0.0.0.1]network 192.168.2.253 0.0.0.255
[sw2-ospf-1-area-0.0.0.1]network 10.0.0.10 0.0.0.3
[sw2-ospf-1-area-0.0.0.1]network 10.1.1.12 0.0.0.0
[sw2-ospf-1-area-0.0.0.1]quit
[sw2-ospf-1][r1]ospf 1 router-id 1.1.1.1
[r1-ospf-1]area
[r1-ospf-1]silent-interface LoopBack 0
[r1-ospf-1]area 1
[r1-ospf-1-area-0.0.0.1]network 10.0.0.1 0.0.0.3
[r1-ospf-1-area-0.0.0.1]network 10.0.0.5 0.0.0.3
[r1-ospf-1-area-0.0.0.1]area 0
[r1-ospf-1-area-0.0.0.0]network 10.0.0.14 0.0.0.3
[r1-ospf-1-area-0.0.0.0]network 10.1.1.1 0.0.0.3
[r1-ospf-1-area-0.0.0.0]quit
[r1-ospf-1][r2]ospf 1 router-id 2.2.2.2
[r2-ospf-1]area 1
[r2-ospf-1-area-0.0.0.1]network 10.0.0.2 0.0.0.3
[r2-ospf-1-area-0.0.0.1]network 10.0.0.9 0.0.0.3
[r2-ospf-1-area-0.0.0.1]area 0
[r2-ospf-1-area-0.0.0.0]network 10.0.0.18 0.0.0.3
[r2-ospf-1-area-0.0.0.0]network 10.1.1.2 0.0.0.3
[r2-ospf-1-area-0.0.0.0][r3]ospf 1 router-id 5.5.5.5
[r3-ospf-1]silent-interface LoopBack 0
[r3-ospf-1]area 0
[r3-ospf-1-area-0.0.0.0]network 10.0.0.13 0.0.0.3
[r3-ospf-1-area-0.0.0.0]network 10.0.0.17 0.0.0.3
[r3-ospf-1-area-0.0.0.0]network 192.168.3.254 0.0.0.255
[r3-ospf-1-area-0.0.0.0]network 10.1.1.3 0.0.0.0
[r3-ospf-1-area-0.0.0.0]qu
R1上配置默认路由指向互联网，并引入到OSPF
[r1]ip route-static 0.0.0.0 0 202.100.1.1
[r1]ospf 1
[r1-ospf-1]default-route-advertise
[r1-ospf-1]R1通过双线连接到互联网，配置PPP-MP，并配置双向CHAP验证
[r1]int mp-grou 1
[r1-MP-group1]ip ad 202.100.1.2 30
[r1-MP-group1]quit
[r1]int s1/0
[r1-Serial1/0]ppp mp M-group 1
[r1-Serial1/0]ppp mp MP-group 1
[r1-Serial1/0]int s2/0
[r1-Serial2/0]ppp mp MP-group 1[lnternet]int mp-group 1
[lnternet-MP-group1]ip ad 202.100.1.1 30
[lnternet-MP-group1]quit
[lnternet]int s1/0
[lnternet-Serial1/0]ppp mp MP-group 1
[lnternet-Serial1/0]int s2/0
[lnternet-Serial2/0]ppp mp MP-group 1
[lnternet-Serial2/0]qu创建用户双向验证的用户
[lnternet]local-user zhangsan class network
New local user added.
[lnternet-luser-network-zhangsan]pas
[lnternet-luser-network-zhangsan]password sim
[lnternet-luser-network-zhangsan]password simple 123456
[lnternet-luser-network-zhangsan]serv
[lnternet-luser-network-zhangsan]service-type ppp
[lnternet-luser-network-zhangsan]quit
[lnternet][r1]local-user zhangsan class network
New local user added.
[r1-luser-network-zhangsan]pas
[r1-luser-network-zhangsan]password sim
[r1-luser-network-zhangsan]password simple 123456
[r1-luser-network-zhangsan]servic
[r1-luser-network-zhangsan]service-type ppp
[r1-luser-network-zhangsan]quit
[r1]
选择认证方式+认证
[r1]int s1/0
[r1-Serial1/0]ppp an
[r1-Serial1/0]ppp au
[r1-Serial1/0]ppp authentication-mode ch
[r1-Serial1/0]ppp authentication-mode chap
[r1-Serial1/0]ppp ch
[r1-Serial1/0]ppp chap us
[r1-Serial1/0]ppp chap user zhangsan
[r1-Serial1/0]ppp chap pass
[r1-Serial1/0]ppp chap password sim
[r1-Serial1/0]ppp chap password simple 123456
[r1-Serial1/0]int s2/0
[r1-Serial2/0]ppp authentication-mode chap
[r1-Serial2/0]ppp chap user zhangsan
[r1-Serial2/0]ppp chap password simple 123456
[r1-Serial2/0]quit
[r1]
[lnternet]int s1/0
[lnternet-Serial1/0]ppp authentication-mode chap
[lnternet-Serial1/0]ppp chap user zhangsan
[lnternet-Serial1/0]ppp chap password simple 123456
[lnternet-Serial1/0]int s2/0
[lnternet-Serial2/0]ppp authentication-mode chap
[lnternet-Serial2/0]ppp chap user zhangsan
[lnternet-Serial2/0]ppp chap password simple 123456
[lnternet-Serial2/0]quit
[lnternet]
配置EASY IP，只有业务网段192.168.1.0/24和192.168.2.0/24 的数据流可以通过R1访问互联网
[lnternet]acl basic 2000
[lnternet-acl-ipv4-basic-2000]rule 0 permit source 192.168.1.0 0.0.0.255
[lnternet-acl-ipv4-basic-2000]rule 5 permit source 192.168.2.0 0.0.0.255
[lnternet-acl-ipv4-basic-2000]quit
[lnternet]int mp-group 1
[lnternet-MP-group1]nat outbound 2000用PC ping Internet
R1开启TELNET远程管理，使用用户ABC登录，密码ABC，只允许技术部远程管理R1
[r1]telnet server enable
[r1]local-user abc class manage
New local user added.
[r1-luser-manage-abc]password simple abc
The new password is too short. It must contain at least 10 characters.
[r1-luser-manage-abc]authorization-attribute user-role level-15
[r1-luser-manage-abc]quit
[r1]user-interface vty 0 4
[r1-line-vty0-4]authentication-mode scheme
[r1-line-vty0-4]user
[r1-line-vty0-4]user-role le
[r1-line-vty0-4]user-role level-15
[r1-line-vty0-4]quit
[r1]acl advanced 3000
[r1-acl-ipv4-adv-3000]rule 0 permit tcp source 192.168.2.0 0.0.0.255 destination10.0.0.0 0.0.0.255 destination-port eq 23
[r1-acl-ipv4-adv-3000]rule 6 deny tcp
[r1-acl-ipv4-adv-3000]quit
[r1]int g0/0
[r1-GigabitEthernet0/0]packet-filter 3000 inbound
[r1-GigabitEthernet0/0]int g0/1
[r1-GigabitEthernet0/1]packet-filter 3000 inbound
[r1-GigabitEthernet0/1]int g0/2
[r1-GigabitEthernet0/2]packet-filter 3000 inbound
[r1-GigabitEthernet0/2]
[r1-GigabitEthernet0/2]int MP-group 1
[r1-MP-group1]packet-filter 3000 inbound
[r1-MP-group1]quitpc2登录测试
