最近通过某个平台接的单子，最后Kali做的测试没有公开可以私聊给教程。

下面是规划与配置

1.vlan方面：推荐一个vlan下的所有主机为一个子网网段

连接电脑和http客户端的接口配置为access接口

          交换机与交换机或路由器连接的接口配置为trunk接口---也可以配置为access接口但是为了扩展性，trunk接口更佳，允许vlan10到vlan100通过

          对汇聚层交换配置对应的vlanif的ip地址

          两个汇聚层交换机间配置eth-trunk，模式采用静态lacp

配置代码：

交换机1

sys

 sys sw1

 vlan 10

 quit

 int g0/0/3

   port link-type access

   port defult vlan 10

 int g0/0/4

    port link-type access

    port defult vlan 10

 int g0/0/1

    port link-type trunk

    port trunk allow-pass vlan 10 to 100

 int g0/0/2

    port link-type trunk

    port trunk allow-pass vlan 10 to 100

交换机2：

sys

 sys sw2

 vlan batch 20 30

 int g0/0/3

   port link-type access

   port defult vlan 30

int g0/0/4

   port link-type access

   port defult vlan 20

int g0/0/1

    port link-type trunk

    port trunk allow-pass vlan 10 to 100

   int g0/0/2

    port link-type trunk

    port trunk allow-pass vlan 10 to 100

交换机3：

sys

 sys sw3

 vlan batch 40 50

int g0/0/5

   port link-type access

   port defult vlan 40

int g0/0/3

   port link-type access

   port defult vlan 50

int g0/0/4

   port link-type access

   port defult vlan 50

int g0/0/1

    port link-type trunk

   port trunk allow-pass vlan 10 to 100

int g0/0/2

    port link-type trunk

    port trunk allow-pass vlan 10 to 100

交换机4：

sys

 sys sw4

 vlan 60

 quit

 int g0/0/3

   port link-type access

   port defult vlan 60

int g0/0/1

    port link-type trunk

    port trunk allow-pass vlan 10 to 100

  int g0/0/2

    port link-type trunk

port trunk allow-pass vlan 10 to 100

交换机5

sys

 sys sw5

 vlan batch 10 20 30 91 92

 int eth-trunk 1

   mode lacp

 quit

 int g0/0/2

   eth-trunk 1

 int g0/0/6

   eth-trunk 1

 quit

 lacp priority 100                      //将优先级配置为100，使改侧成为主动端

 int g0/0/1

   port link-type trunk

   port trunk allow-pass vlan 10 to 100

 int g0/0/3

   port link-type trunk

   port trunk allow-pass vlan 10 to 100

 int eth-trunk 1

   port link-type trunk

   port trunk allow-pass vlan 10 to 100

 int g0/0/4

   port link-type access

   port defult vlan 91

 int g0/0/5

   port link-type access

   port defult vlan 92

 int vlanif 10

   ip address 172.22.10.100 24

 int vlanif 20

ip address 172.22.20.100 24

int vlanif 30

   ip address 172.22.30.100 24

int vlanif 91

   ip address 172.22.1.1 24

int vlanif 92

   ip address 172.22.2.1 24

交换机6：

sys

 sys sw6

 vlan batch 10 20 30 93 94

 int eth-trunk 1

   mode lacp

 quit

 int g0/0/2

   eth-trunk 1

 int g0/0/6

   eth-trunk 1

 quit

 int g0/0/1

   port link-type trunk

   port trunk allow-pass vlan 10 to 100

 int g0/0/3

   port link-type trunk

   port trunk allow-pass vlan 10 to 100

 int eth-trunk 1

   port link-type trunk

   port trunk allow-pass vlan 10 to 100

 int g0/0/4

   port link-type access

   port defult vlan 93

 int g0/0/5

   port link-type access

   port defult vlan 94

 int vlanif 10

   ip address 172.22.10.200 24

 int vlanif 20

ip address 172.22.20.200 24

int vlanif 30

   ip address 172.22.30.200 24

int vlanif 93

   ip address 172.22.3.1 24

int vlanif 94

   ip address 172.22.4.1 24

交换机7：

sys

 sys sw7

 vlan batch 40 50 60 95 96

 int eth-trunk 1

   mode lacp

 quit

 int g0/0/1

   eth-trunk 1

 int g0/0/7

   eth-trunk 1

 quit

 lacp priority 100                      //将优先级配置为100，使改侧成为主动端

 int g0/0/2

   port link-type trunk

   port trunk allow-pass vlan 10 to 100

 int g0/0/3

   port link-type trunk

   port trunk allow-pass vlan 10 to 100

 int eth-trunk 1

   port link-type trunk

   port trunk allow-pass vlan 10 to 100

 int g0/0/4

   port link-type access

   port default vlan 95

 int g0/0/5

   port link-type access

   port default vlan 96

 int vlanif 40

   ip address 172.22.40.100 24

 int vlanif 50

ip address 172.22.50.100 24

int vlanif 60

   ip address 172.22.60.100 24

int vlanif 95

   ip address 172.22.5.1 24

int vlanif 96

   ip address 172.22.6.1 24

交换机8：

sys

 sys sw8

 vlan batch 40 50 60 97 98

 int eth-trunk 1

   mode lacp

 quit

 int g0/0/1

   eth-trunk 1

 int g0/0/6

   eth-trunk 1

 quit

 int g0/0/2

   port link-type trunk

   port trunk allow-pass vlan 10 to 100

 int g0/0/3

   port link-type trunk

   port trunk allow-pass vlan 10 to 100

 int eth-trunk 1

   port link-type trunk

   port trunk allow-pass vlan 10 to 100

 int g0/0/4

   port link-type access

   port default vlan 97

 int g0/0/5

   port link-type access

   port default vlan 98

 int vlanif 40

   ip address 172.22.40.200 24

 int vlanif 50

ip address 172.22.50.200 24

int vlanif 60

   ip address 172.22.60.200 24

int vlanif 97

   ip address 172.22.7.1 24

int vlanif 98

   ip address 172.22.8.1 24

路由器1：---IP地址配置

sys

 sys r1

 int g5/0/3

ip address 172.22.1.2 24

 int g0/0/1

ip address 172.22.3.2 24

 int g0/0/2

ip address 172.22.5.2 24

int g0/0/0

ip address 172.22.7.2 24

int g5/0/0

 ip address 172.22.9.1 24

int g5/0/1

 ip address 115.200.60.1 24

int g5/0/2

 ip address 172.22.70.1 24  

int loop 1

 ip address 1.1.1.1 32                //用于组播和测试

路由器2：---IP地址配置

sys

 sys r2

 int g0/0/0

ip address 172.22.2.2 24

 int g0/0/1

ip address 172.22.4.2 24

 int g0/0/2

ip address 172.22.6.2 24

int g2/0/0

ip address 172.22.8.2 24

int g2/0/1

 ip address 172.22.9.2 24

int g2/0/2

 ip address 223.104.244.1 24

int g2/0/3

 ip address 172.22.80.1 24  

int loop 1

 ip address 2.2.2.2 32                //用于组播

2.dhcp方面：在汇聚层交换机上配置dhcp用于给接入层的主机分配地址---http客户端可能得自己设置地址不能dhcp自动获得，因此在配置dhcp地址池的时候应预先保留一部分的地址空间

交换机5：

sys

 dhcp enable

 ip pool forvlan10

   gateway-list 172.22.10.254

   network 172.22.10.0 mask 24

   lease day 1

   excluded-ip-address 172.22.10.100 172.22.10.253

 ip pool forvlan20

   gateway-list 172.22.20.254

   network 172.22.20.0 mask 24

   lease day 1

   excluded-ip-address 172.22.20.100 172.22.20.253

 ip pool forvlan30

   gateway-list 172.22.30.254

   network 172.22.30.0 mask 24

   lease day 1

   excluded-ip-address 172.22.30.100 172.22.30.253

 interface vlanif 10

   dhcp select global

interface vlanif 20

   dhcp select global

interface vlanif 30

   dhcp select global

交换机6：

sys

 dhcp enable

 ip pool forvlan10

   gateway-list 172.22.10.254

   network 172.22.10.0 mask 24

   lease day 1

   excluded-ip-address 172.22.10.1 172.22.10.100

   excluded-ip-address 172.22.10.200 172.22.10.253

 ip pool forvlan20

   gateway-list 172.22.20.254

   network 172.22.20.0 mask 24

   lease day 1

   excluded-ip-address 172.22.20.1 172.22.20.100

   excluded-ip-address 172.22.20.200 172.22.20.253

 ip pool forvlan30

   gateway-list 172.22.30.254

   network 172.22.30.0 mask 24

   lease day 1

   excluded-ip-address 172.22.30.1 172.22.30.100

   excluded-ip-address 172.22.30.200 172.22.30.253

 interface vlanif 10

   dhcp select global

interface vlanif 20

   dhcp select global

interface vlanif 30

   dhcp select global

交换机7：

sys

 dhcp enable

 ip pool forvlan40

   gateway-list 172.22.40.254

   network 172.22.40.0 mask 24

   lease day 1

   excluded-ip-address 172.22.40.100 172.22.40.253

 ip pool forvlan50

   gateway-list 172.22.50.254

   network 172.22.50.0 mask 24

   lease day 1

   excluded-ip-address 172.22.50.100 172.22.50.253

 ip pool forvlan60

   gateway-list 172.22.60.254

   network 172.22.60.0 mask 24

   lease day 1

   excluded-ip-address 172.22.60.100 172.22.60.253

 interface vlanif 40

   dhcp select global

interface vlanif 50

   dhcp select global

interface vlanif 60

   dhcp select global

交换机8：

sys

 dhcp enable

 ip pool forvlan40

   gateway-list 172.22.40.254

   network 172.22.40.0 mask 24

   lease day 1

   excluded-ip-address 172.22.40.1 172.22.40.100

   excluded-ip-address 172.22.40.200 172.22.40.253

 ip pool forvlan50

   gateway-list 172.22.50.254

   network 172.22.50.0 mask 24

   lease day 1

   excluded-ip-address 172.22.50.1 172.22.50.100

   excluded-ip-address 172.22.50.200 172.22.50.253

 ip pool forvlan60

   gateway-list 172.22.60.254

   network 172.22.60.0 mask 24

   lease day 1

   excluded-ip-address 172.22.60.1 172.22.60.100

   excluded-ip-address 172.22.60.200 172.22.60.253

 interface vlanif 40

   dhcp select global

interface vlanif 50

   dhcp select global

interface vlanif 60

   dhcp select global

至此各个vlan的主机ping 172.22.x.100和 172.22.x.200 都能ping通

3.mstp方面：接入层和汇聚层的交换机配置mstp协议，实现不同vlan对应的mstp实例的根桥不同以实现负载分担和主备备份-----注意：对于一个vlan来说mstp的根桥和vrrp的主交换机应该一致

交换机5：

sys

 stp region-configuration

    region-name campusnet1

    revision-level 1

    instance 1 vlan 10

    instance 2 vlan 20

    instance 3 vlan 30

    active region- configuration

  stp instance 1 root primary

  stp instance 2 root secondary

  stp instance 3 root secondary

交换机6：

sys

 stp region-configuration

    region-name campusnet1

    revision-level 1

    instance 1 vlan 10

    instance 2 vlan 20

    instance 3 vlan 30

    active region-configuration

  quit

  stp instance 1 root secondary

  stp instance 2 root primary

  stp instance 3 root primary

交换机1：

sys

 stp region-configuration

    region-name campusnet1

    revision-level 1

    instance 1 vlan 10

    active region-configuration

交换机2：

sys

 stp region-configuration

    region-name campusnet1

    revision-level 1

    instance 2 vlan 20

    instance 3 vlan 30

      active region-configuration

交换机7：

sys

 stp region-configuration

    region-name campusnet2

    revision-level 1

    instance 1 vlan 40

    instance 2 vlan 50

    instance 3 vlan 60

    active region-configuration

  stp instance 2 root primary

  stp instance 1 root secondary

  stp instance 3 root secondary

交换机8：

sys

 stp region-configuration

    region-name campusnet2

    revision-level 1

    instance 1 vlan 40

    instance 2 vlan 50

    instance 3 vlan 60

    active region-configuration

  quit

  stp instance 2 root secondary

  stp instance 1 root primary

  stp instance 3 root primary

交换机3：

sys

 stp region-configuration

    region-name campusnet2

    revision-level 1

    instance 1 vlan 40

    instance 2 vlan 50

    active region-configuration

交换机4：

sys

 stp region-configuration

    region-name campusnet2

    revision-level 1

    instance 3 vlan 60

      active region-configuration

4.vrrp方面：对汇聚层和核心层的交换机路由器配置vrrp协议，实现不同vlan的主备备份和负载分担-----注意：对于一个vlan来说mstp的根桥和vrrp的主交换机应该一致

交换机5：

sys

 int vlanif 10

vrrp vrid 1 virtual-ip 172.22.10.254

vrrp vrid 1 priority 110

vrrp vrid 1 preempt-mode timer delay 3

vrrp vrid 1 authentication-mode md5 campus

int vlanif 20

vrrp vrid 2 virtual-ip 172.22.20.254

vrrp vrid 2 priority 90

vrrp vrid 2 preempt-mode timer delay 3

vrrp vrid 2 authentication-mode md5 campus

int vlanif 30

vrrp vrid 3 virtual-ip 172.22.30.254

vrrp vrid 3 priority 90

vrrp vrid 3 preempt-mode timer delay 3

vrrp vrid 3 authentication-mode md5 campus

交换机6：

sys

 int vlanif 10

vrrp vrid 1 virtual-ip 172.22.10.254

vrrp vrid 1 priority 90

vrrp vrid 1 preempt-mode timer delay 3

vrrp vrid 1 authentication-mode md5 campus

int vlanif 20

vrrp vrid 2 virtual-ip 172.22.20.254

vrrp vrid 2 priority 110

vrrp vrid 2 preempt-mode timer delay 3

vrrp vrid 2 authentication-mode md5 campus

int vlanif 30

vrrp vrid 3 virtual-ip 172.22.30.254

vrrp vrid 3 priority 110

vrrp vrid 3 preempt-mode timer delay 3

vrrp vrid 3 authentication-mode md5 campus

交换机7：

sys

 int vlanif 40

vrrp vrid 1 virtual-ip 172.22.40.254

vrrp vrid 1 priority 90

vrrp vrid 1 preempt-mode timer delay 3

vrrp vrid 1 authentication-mode md5 campus

int vlanif 50

vrrp vrid 2 virtual-ip 172.22.50.254

vrrp vrid 2 priority 110

vrrp vrid 2 preempt-mode timer delay 3

vrrp vrid 2 authentication-mode md5 campus

int vlanif 60

vrrp vrid 3 virtual-ip 172.22.60.254

vrrp vrid 3 priority 90

vrrp vrid 3 preempt-mode timer delay 3

vrrp vrid 3 authentication-mode md5 campus

交换机8：

sys

 int vlanif 40

vrrp vrid 1 virtual-ip 172.22.40.254

vrrp vrid 1 priority 110

vrrp vrid 1 preempt-mode timer delay 3

vrrp vrid 1 authentication-mode md5 campus

int vlanif 50

vrrp vrid 2 virtual-ip 172.22.50.254

vrrp vrid 2 priority 90

vrrp vrid 2 preempt-mode timer delay 3

vrrp vrid 2 authentication-mode md5 campus

int vlanif 60

vrrp vrid 3 virtual-ip 172.22.60.254

vrrp vrid 3 priority 110

vrrp vrid 3 preempt-mode timer delay 3

vrrp vrid 3 authentication-mode md5 campus

5.nat方面：在核心层交换机的出口流量处配置nat映射，acl设置成对内网已知的网段允许nat映射

路由器1和路由器2：

sys

acl 2999  

  rule 5 permit source 0.0.0.0 0.0.255.255

quit

int g5/0/1  | int g2/0/2

 nat out bound 2999

quit

6.ospf方面：

交换机5：

sys

 ospf 1

   area 0

     network 172.22.10.100 0.0.0.255

     network 172.22.20.100 0.0.0.255

     network 172.22.30.100 0.0.0.255

     network 172.22.1.1 0.0.0.255

     network 172.22.2.1 0.0.0.255

交换机6：

sys

 ospf 1

   area 0

     network 172.22.10.200 0.0.0.255

     network 172.22.20.200 0.0.0.255

     network 172.22.30.200 0.0.0.255

     network 172.22.3.1 0.0.0.255

     network 172.22.4.1 0.0.0.255

交换机7：

sys

 ospf 1

   area 0

     network 172.22.40.100 0.0.0.255

     network 172.22.50.100 0.0.0.255

     network 172.22.60.100 0.0.0.255

     network 172.22.5.1 0.0.0.255

     network 172.22.6.1 0.0.0.255

交换机8：

sys

 ospf 1

   area 0

     network 172.22.40.200 0.0.0.255

     network 172.22.50.200 0.0.0.255

     network 172.22.60.200 0.0.0.255

     network 172.22.7.1 0.0.0.255

     network 172.22.8.1 0.0.0.255

路由器1：

sys

 ospf 1

   area 0

     network 172.22.1.2 0.0.0.255

     network 172.22.3.2 0.0.0.255

     network 172.22.5.2 0.0.0.255

     network 172.22.7.2 0.0.0.255

     network 1.1.1.1 0.0.0.0

     network 172.22.9.1 0.0.0.255

     network 115.200.60.1 0.0.0.255

     network 172.22.70.1 0.0.0.255

路由器2：

sys

 ospf 1

   area 0

     network 172.22.2.2 0.0.0.255

     network 172.22.4.2 0.0.0.255

     network 172.22.6.2 0.0.0.255

     network 172.22.8.2 0.0.0.255

     network 2.2.2.2 0.0.0.0

     network 172.22.9.2 0.0.0.255

     network 223.104.244.1 0.0.0.255

     network 172.22.80.1 0.0.0.255

至此各个主机ping 1.1.1.1 ；2.2.2.2；115.200.60.2；223.104.244.2都能ping通

7 igmp和pim方面：

交换机5：

sys

 multicast routing-enable

int vlanif 10

   pim sm

 int vlanif 20

   pim sm

 int vlanif 30

   pim sm

 int vlanif 91

   pim sm

 int vlanif 92

   pim sm

 quit

 int vlanif 10

   igmp enable

   igmp version 2

 int vlanif 20

   igmp enable

   igmp version 2

int vlanif 30

   igmp enable

   igmp version 2

 pim

  static-rp 1.1.1.1

交换机6：

sys

 multicast routing-enable

int vlanif 10

   pim sm

 int vlanif 20

   pim sm

 int vlanif 30

   pim sm

 int vlanif 93

   pim sm

 int vlanif 94

   pim sm

 quit

 int vlanif 10

   igmp enable

   igmp version 2

 int vlanif 20

   igmp enable

   igmp version 2

int vlanif 30

   igmp enable

   igmp version 2

 pim

  static-rp 1.1.1.1

交换机7：

sys

 multicast routing-enable

int vlanif 40

   pim sm

 int vlanif 50

   pim sm

 int vlanif 60

   pim sm

 int vlanif 95

   pim sm

 int vlanif 96

   pim sm

 quit

 int vlanif 40

   igmp enable

   igmp version 2

 int vlanif 50

   igmp enable

   igmp version 2

int vlanif 60

   igmp enable

   igmp version 2

 pim

  static-rp 1.1.1.1

交换机8：

sys

 multicast routing-enable

int vlanif 40

   pim sm

 int vlanif 50

   pim sm

 int vlanif 60

   pim sm

 int vlanif 97

   pim sm

 int vlanif 98

   pim sm

 quit

 int vlanif 40

   igmp enable

   igmp version 2

 int vlanif 50

   igmp enable

   igmp version 2

int vlanif 60

   igmp enable

   igmp version 2

 pim

  static-rp 1.1.1.1

路由器1：

sys

 multicast routing-enable

 int g5/0/3

pim sm

 int g0/0/1

pim sm

 int g0/0/2

pim sm

int g0/0/0

 pim sm

int g5/0/0

 pim sm

int loopback 1

 pim sm

int g5/0/1

 pim sm

int g5/0/2

 pim sm

quit

pim

  static-rp 1.1.1.1

  c-bsr priority 3

  c-bsr loopback 1

  c-rp priority 1

  c-rp loopback 1

 quit

路由器1：

sys

 multicast routing-enable

 int g0/0/0

pim sm

 int g0/0/1

pim sm

 int g0/0/2

pim sm

int g2/0/0

 pim sm

int g2/0/3

 pim sm

int loopback 1

 pim sm

int g2/0/2

 pim sm

int g2/0/1

 pim sm

quit

pim

  static-rp 1.1.1.1

  c-rp priority 3

  c-rp loopback 1

 quit

至此，各个主机都能收到组播源的数据

8.bfd方面：bfd协议用于辅助vrrp和（ospf协议）实现快速切换主备，以减少流量的丢失提高网络健壮性

交换机5：

sys

 bfd

 bfd 1

bfd 1 bind peer-ip 172.22.1.2 source-ip 172.22.1.1

discriminator local 11

discriminator remote 21

detect-multiplier 3

min-tx-interval 100

min-rx-interval 100

commit

 quit

 bfd 2

bfd 2 bind peer-ip 172.22.2.2 source-ip 172.22.2.1

discriminator local 12

discriminator remote 22

detect-multiplier 3

min-tx-interval 100

min-rx-interval 100

commit

 quit

int vlanif 10

 vrrp vrid 1 track bfd-session 10 reduced 10

 vrrp vrid 1 track bfd-session 11 reduced 10

交换机6：

sys

 bfd

 bfd 3

bfd 3 bind peer-ip 172.22.3.2 source-ip 172.22.3.1

discriminator local 13

discriminator remote 23

detect-multiplier 3

min-tx-interval 100

min-rx-interval 100

commit

 quit

 bfd 4

bfd 4 bind peer-ip 172.22.4.2 source-ip 172.22.4.1

discriminator local 14

discriminator remote 24

detect-multiplier 3

min-tx-interval 100

min-rx-interval 100

commit

 quit

int vlanif 20

 vrrp vrid 2 track bfd-session 13 reduced 10

 vrrp vrid 2 track bfd-session 14 reduced 10

int vlanif 30

 vrrp vrid 3 track bfd-session 13 reduced 10

 vrrp vrid 3 track bfd-session 14 reduced 10

交换机7：

sys

 bfd

 quit

 bfd 5

bfd 5 bind peer-ip 172.22.5.2 source-ip 172.22.5.1

discriminator local 15

discriminator remote 25

detect-multiplier 3

min-tx-interval 100

min-rx-interval 100

commit

 quit

 bfd 6

bfd 6 bind peer-ip 172.22.6.2 source-ip 172.22.6.1

discriminator local 16

discriminator remote 26

detect-multiplier 3

min-tx-interval 100

min-rx-interval 100

commit

 quit

int vlanif 50

 vrrp vrid 2 track bfd-session 15 reduced 10

 vrrp vrid 2 track bfd-session 16 reduced 10

交换机8：

sys

 bfd

 quit

 bfd 7

bfd 7 bind peer-ip 172.22.7.2 source-ip 172.22.7.1

discriminator local 17

discriminator remote 27

detect-multiplier 3

min-tx-interval 100

min-rx-interval 100

commit

 quit

 bfd 8

bfd 8 bind peer-ip 172.22.8.2 source-ip 172.22.8.1

discriminator local 18

discriminator remote 28

detect-multiplier 3

min-tx-interval 100

min-rx-interval 100

commit

 quit

int vlanif 40

 vrrp vrid 1 track bfd-session 17 reduced 10

 vrrp vrid 1 track bfd-session 18 reduced 10

int vlanif 60

 vrrp vrid 3 track bfd-session 17 reduced 10

 vrrp vrid 3 track bfd-session 18 reduced 10

路由器1：

sys

 bfd

 quit

 bfd 1

   bfd 1 bind peer-ip 172.22.1.1 source-ip 172.22.1.2

 discriminator local 21

discriminator remote 11

detect-multiplier 3

min-tx-interval 100

min-rx-interval 100

commit

 quit

bfd 3

   bfd 3 bind peer-ip 172.22.3.1 source-ip 172.22.3.2

 discriminator local 23

discriminator remote 13

detect-multiplier 3

min-tx-interval 100

min-rx-interval 100

commit

 quit

bfd 5

   bfd 5 bind peer-ip 172.22.5.1 source-ip 172.22.5.2

 discriminator local 25

discriminator remote 15

detect-multiplier 3

min-tx-interval 100

min-rx-interval 100

commit

 quit

bfd 7

   bfd 7 bind peer-ip 172.22.7.1 source-ip 172.22.7.2

 discriminator local 27

discriminator remote 17

detect-multiplier 3

min-tx-interval 100

min-rx-interval 100

commit

 quit

路由器2：

sys

 bfd

 quit

 bfd 2

   bfd 2 bind peer-ip 172.22.2.1 source-ip 172.22.2.2

 discriminator local 22

discriminator remote 12

detect-multiplier 3

min-tx-interval 100

min-rx-interval 100

commit

 quit

bfd 4

   bfd 4 bind peer-ip 172.22.4.1 source-ip 172.22.4.2

 discriminator local 24

discriminator remote 14

detect-multiplier 3

min-tx-interval 100

min-rx-interval 100

commit

 quit

bfd 6

   bfd 6 bind peer-ip 172.22.6.1 source-ip 172.22.6.2

 discriminator local 26

discriminator remote 16

detect-multiplier 3

min-tx-interval 100

min-rx-interval 100

commit

 quit

bfd 8

   bfd 8 bind peer-ip 172.22.8.1 source-ip 172.22.8.2

 discriminator local 28

discriminator remote 18

detect-multiplier 3

min-tx-interval 100

min-rx-interval 100

commit

 quit

display vrrp brief

display vrrp 1

9.端口镜像/防火墙方面：在核心层路由器连接防火墙侧配置端口镜像，使其通过流量同时复制到防火墙，用于入侵检测或者攻击分析

路由器1：

sys

 observe-port interface GigabitEthernet 5/0/2

 int g5/0/3

   mirror to observe-port both

 int g0/0/1

   mirror to observe-port both

 int g0/0/2

   mirror to observe-port both

 int g0/0/0

   mirror to observe-port both

 int g5/0/0

   mirror to observe-port both

 int g5/0/1

   mirror to observe-port both

路由器2：

sys

 observe-port interface GigabitEthernet 2/0/3

 int g0/0/0

   mirror to observe-port both

 int g0/0/1

   mirror to observe-port both

 int g0/0/2

   mirror to observe-port both

 int g2/0/0

   mirror to observe-port both

 int g2/0/2

   mirror to observe-port both

 int g2/0/1

   mirror to observe-port both

10.配置kali虚拟机到目标网络

配置VMware中的虚拟网卡（此配置为172.22.30.x网段），并将其连接到交换机上（注意交换机要配置端口类型为access；并确保无ip地址冲突—真机的ip地址； kali虚拟机从交换机的dhcp服务器上获取ip地址）

kali注意要先nat联网下载Dsniff套装工具集，之后再连接到ensp虚拟环境（切记不要在nat模式下使用macof）

macof的攻击指令 sudo macof

交换机2：(实际是在所有上下行接口配置，此处演示需要只在一个接口配置)

sys

int g0/0/5

  port-security enable

  port-security protect-action shutdown

port-security max-mac-num 50

port-security aging-time 1000

arp anti-attack entry-check fixed-all enable

arp gratuitous-arp send enable

arp gratuitous-arp send interval 1

（启用ip报文转发模式：echo 1 | sudo tee /proc/sys/net/ipv4/ip_forward）

arp欺骗的指令：sudo arpspoof -i eth0 -t 172.22.30.199 172.22.30.254

                arp –d：清理arp表

                arp –a 查看arp表

第一条配置arp固化，实验中没法显示（将本来接入的正常主机替换为攻击的kali机再发送arp欺骗时，可能可以显示效果）

第二第三条，配置免费arp并设置时间间隔为0.5s，只能在一定程度上抵抗已经接入的“可信”主机

还可以配置dhcp snooping，并在其基础上配置动态arp检测，以在新主机接入时就防范于未然

还可以直接在主机上指定静态arp来预防

11.端口安全和密钥方面：vrrp中使用了md5认证，交换机2配置了端口安全用于限制mac地址最大学习数量，交换机2.5.6配置了免费arp和arp固话用于预防arp欺骗，telnet远程认证配置了aaa认证,nat配置了对应的acl

12.主机侧的http 

学习到的：

1~~~导入已有的包需要设置tomcat环境，配置项目结构

2~~~leaflet的access_token已经过期，需要自己去Account | Mapbox注册账号并替换

3~~~leaflet的地图库似乎更新了，需要更换参数和导入方式

注意：要开启mysql服务

ensp虚拟环境的任意http客户端通过该网址获取内容：http://223.104.244.33:8888/Idea_war_exploded/index.html     （主机记得关闭防火墙，否则ping不通）

13.telnet配置交换机和路由器

路由器1、2和交换机5-8：

sys

 aaa

  local-user campaus privilege level 15

  local-user campaus password cipher campaus

 quit

 user-interface vty 0 4

authentication-mode aaa

 quit

 ctrl+]退出telnet界面  

13.ftp：在外网服务器上直接开启ftp服务即可

14.dns：

交换机5，6：

sys

 ip pool forvlan10

  dns-list 223.104.244.2

 ip pool forvlan20

  dns-list 223.104.244.2

ip pool forvlan30

  dns-list 223.104.244.2

交换机7，8：

sys

 ip pool forvlan40

  dns-list 223.104.244.2

 ip pool forvlan50

  dns-list 223.104.244.2

ip pool forvlan60

  dns-list 223.104.244.2

15.m0n0wall防火墙：于172.22.70.x网段处配置了m0n0wall防火墙，可用于如流量控制，流量监控的作用

16.wireshark 统计---捕获文件属性，协议分级

snmp-agent

snmp-agent community read campaus

snmp-agent community read campaus1

snmp-agent sys-info version all

snmp-agent target-host trap-hostname zjut address 223.104.244.33 udp-port 162 trap-paramsname zjut

snmp-agent trap enable

开启步骤：主机联网并关闭防火墙（kali虚拟机端的云可能需要手动undo shutdown下）--->开启kali虚拟机和windows虚拟机（windows 7为snmp用）

有待改进的地方：

内网ospf可以划分多个区域，将核心层至出口路由器组成区域0，核心层和汇聚层间的路由器/三层交换机组成区域x

snmp-网管系统；dhcp安全àipsg（防止用户私自修改ip或防止非法用户使用静态ip地址私自接入）和dai（新开个端口接入设备模拟arp和dhcp攻击），mac地址防漂移