华为设备总部与分部配置

Tony_long74832024-03-06 0:04

1.要求：

（1）总部实现高可靠性设计，接入层断掉一根线或汇聚、核心设备故障都不能影响数据正常转发

（2）分部1人数较少，采用单臂路由互通

（3）总部、分部1、2之间都能访问互联网

（4）外网能够访问总部的HTTP server 和FTP server

（5）总部和两个分部之间通过DSVPN实现内网互通

2.总部配置

（1）创建vlan并加入接口，将核心交换机之间链路捆绑为e-trunk，确保任何一台故障时另一台能正常转发数据

LSW3\]vlan batch 10 20 30 \[LSW3\]int g0/0/3 \[LSW3-GigabitEthernet0/0/3\]port link-type access \[LSW3-GigabitEthernet0/0/3\]port default vlan 10 \[LSW3-GigabitEthernet0/0/3\]int g0/0/1 \[LSW3-GigabitEthernet0/0/1\]port link-type trunk \[LSW3-GigabitEthernet0/0/1\]port trunk allow-pass vlan 10 20 30 \[LSW3-GigabitEthernet0/0/1\]int g0/0/2 \[LSW3-GigabitEthernet0/0/2\]port link-type trunk \[LSW3-GigabitEthernet0/0/2\]port trunk allow-pass vlan 10 20 30 \[LSW4\]vlan batch 10 20 30 \[LSW4\]int g0/0/3 \[LSW4-GigabitEthernet0/0/3\]port link-type access \[LSW4-GigabitEthernet0/0/3\]port default vlan 20 \[LSW4-GigabitEthernet0/0/3\]int g0/0/1 \[LSW4-GigabitEthernet0/0/1\]port link-type trunk \[LSW4-GigabitEthernet0/0/1\]port trunk allow-pass vlan 10 20 30 \[LSW4-GigabitEthernet0/0/1\]int g0/0/2 \[LSW4-GigabitEthernet0/0/2\]port link-type trunk \[LSW4-GigabitEthernet0/0/2\]port trunk allow-pass vlan 10 20 30 \[LSW5\]vlan batch 10 20 30 \[LSW5\]int g0/0/3 \[LSW5-GigabitEthernet0/0/3\]port link-type access \[LSW5-GigabitEthernet0/0/3\]port default vlan 30 \[LSW5-GigabitEthernet0/0/3\]int g0/0/1 \[LSW5-GigabitEthernet0/0/1\]port link-type trunk \[LSW5-GigabitEthernet0/0/1\]port trunk allow-pass vlan 10 20 30 \[LSW5-GigabitEthernet0/0/1\]int g0/0/2 \[LSW5-GigabitEthernet0/0/2\]port link-type trunk \[LSW5-GigabitEthernet0/0/2\]port trunk allow-pass vlan 10 20 30 \[LSW1\]vlan batch 10 20 30 11 12 \[LSW1\]int g0/0/1 \[LSW1-GigabitEthernet0/0/1\]port link-type access \[LSW1-GigabitEthernet0/0/1\]port default vlan 11 \[LSW1-GigabitEthernet0/0/1\]int g0/0/2 \[LSW1-GigabitEthernet0/0/2\]port link-type access \[LSW1-GigabitEthernet0/0/2\]port default vlan 12 \[LSW1-GigabitEthernet0/0/2\]int g0/0/3 \[LSW1-GigabitEthernet0/0/3\]port link-type trunk \[LSW1-GigabitEthernet0/0/3\]port trunk allow-pass vlan 10 20 30 11 12 \[LSW1-GigabitEthernet0/0/3\]int g0/0/4 \[LSW1-GigabitEthernet0/0/4\]port link-type trunk \[LSW1-GigabitEthernet0/0/4\]port trunk allow-pass vlan 10 20 30 11 12 13 14 \[LSW1-GigabitEthernet0/0/4\]int g0/0/5 \[LSW1-GigabitEthernet0/0/5\]port link-type trunk \[LSW1-GigabitEthernet0/0/5\]port trunk allow-pass vlan 10 20 30 11 12 13 14 \[LSW1-GigabitEthernet0/0/5\]quit \[LSW1\]int Eth-Trunk 1 \[LSW1-Eth-Trunk1\]trunkport GigabitEthernet 0/0/6 to 0/0/7 \[LSW1-Eth-Trunk1\]port link-type trunk \[LSW1-Eth-Trunk1\]port trunk allow-pass vlan 10 20 30 11 12 13 14 \[LSW2\]vlan batch 10 20 30 13 14 \[LSW2\]int g0/0/1 \[LSW2-GigabitEthernet0/0/1\]port link-type access \[LSW2-GigabitEthernet0/0/1\]port default vlan 14 \[LSW2-GigabitEthernet0/0/1\]int g0/0/2 \[LSW2-GigabitEthernet0/0/2\]port link-type access \[LSW2-GigabitEthernet0/0/2\]port default vlan 13 \[LSW2-GigabitEthernet0/0/2\]int g0/0/3 \[LSW2-GigabitEthernet0/0/3\]port link-type t \[LSW2-GigabitEthernet0/0/3\]port link-type trunk \[LSW2-GigabitEthernet0/0/3\]port trunk allow-pass vlan 10 20 30 11 12 13 14 \[LSW2-GigabitEthernet0/0/3\]int g0/0/4 \[LSW2-GigabitEthernet0/0/4\]port link-type trunk \[LSW2-GigabitEthernet0/0/4\]port trunk allow-pass vlan 10 20 30 11 12 13 14 \[LSW2-GigabitEthernet0/0/4\]int g0/0/5 \[LSW2-GigabitEthernet0/0/5\]port link-type trunk \[LSW2-GigabitEthernet0/0/5\]port trunk allow-pass vlan 10 20 30 11 12 13 14 \[LSW2-GigabitEthernet0/0/5\]quit \[LSW2\]int Eth-Trunk 1 \[LSW2-Eth-Trunk1\]trunkport GigabitEthernet 0/0/6 to 0/0/7 \[LSW2-Eth-Trunk1\]port link-type trunk \[LSW2-Eth-Trunk1\]port trunk allow-pass vlan 10 20 30 11 12 13 14 ![在这里插入图片描述](https://file.jishuzhan.net/article/1765045779333910529/c68a3dcbfae1a14addfa137033d3f7b5.webp) ![在这里插入图片描述](https://file.jishuzhan.net/article/1765045779333910529/37ff6bac8e790e6d2563d1af9b9de2af.webp) （2）配置MSTP破除环路：LSW1为vlan 10 20的根桥、vlan 30 的次根，LSW2为vlan 30的根桥、vlan 10 20的次根；将连接终端的接口配置为边缘端口 \[LSW1\]stp region-configuration \[LSW1-mst-region\]region-name 1 \[LSW1-mst-region\]revision-level 1 \[LSW1-mst-region\]instance 1 vlan 10 20 \[LSW1-mst-region\]instance 2 vlan 30 \[LSW1-mst-region\]active region-configuration \[LSW1\]stp instance 1 priority 0 \[LSW1\]stp instance 2 priority 4096 ![在这里插入图片描述](https://file.jishuzhan.net/article/1765045779333910529/c7154840be89c106d7db5edb63bdb092.webp) \[LSW2\]stp region-configuration \[LSW2-mst-region\]region-name 1 \[LSW2-mst-region\]revision-level 1 \[LSW2-mst-region\]instance 1 vlan 10 20 \[LSW2-mst-region\]instance 2 vlan 30 \[LSW2-mst-region\]active region-configuration \[LSW2\]stp instance 1 priority 4096 \[LSW2\]stp instance 2 priority 0 ![在这里插入图片描述](https://file.jishuzhan.net/article/1765045779333910529/2e2b2f101f92aa7f86f84b1bed914550.webp) \[LSW3\]stp region-configuration \[LSW3-mst-region\]region-name 1 \[LSW3-mst-region\]revision-level 1 \[LSW3-mst-region\]instance 1 vlan 10 20 \[LSW3-mst-region\]instance 2 vlan 30 \[LSW3-mst-region\]active region-configuration \[LSW3-mst-region\]quit \[LSW4\]stp region-configuration \[LSW4-mst-region\]region-name 1 \[LSW4-mst-region\]revision-level 1 \[LSW4-mst-region\]instance 1 vlan 10 20 \[LSW4-mst-region\]instance 2 vlan 30 \[LSW4-mst-region\]active region-configuration \[LSW4-mst-region\]quit \[LSW5\]stp region-configuration \[LSW5-mst-region\]region-name 1 \[LSW5-mst-region\]revision-level 1 \[LSW5-mst-region\]instance 1 vlan 10 20 \[LSW5-mst-region\]instance 2 vlan 30 \[LSW5-mst-region\]active region-configuration ![在这里插入图片描述](https://file.jishuzhan.net/article/1765045779333910529/c7fdf037a7317ffdafa609474f060c01.webp) ![在这里插入图片描述](https://file.jishuzhan.net/article/1765045779333910529/998a2737be7d50db1254d0159753279b.webp) ![在这里插入图片描述](https://file.jishuzhan.net/article/1765045779333910529/367ea97e05d07ec1672f2840792c0d5a.webp) \[LSW3\]int g0/0/3 \[LSW3-GigabitEthernet0/0/3\]stp edged-port enable \[LSW4\]int g0/0/3 \[LSW4-GigabitEthernet0/0/3\]stp edged-port enable \[LSW5\]int g0/0/3 \[LSW5-GigabitEthernet0/0/3\]stp edged-port enable （3）配置vlan间路由，使内网互通：配置vrrp，LSW1为vlan 10 20的master、为vlan 30的backup，LSW2为vlan 10 20的backup、为vlan 30的master \[LSW1\]int Vlanif 10 \[LSW1-Vlanif10\]ip add 10.1.1.1 24 \[LSW1-Vlanif10\]int Vlanif 20 \[LSW1-Vlanif20\]ip add 10.1.2.1 24 \[LSW1-Vlanif20\]int Vlanif 30 \[LSW1-Vlanif30\]ip add 10.1.3.1 24 \[LSW2\]int Vlanif 10 \[LSW2-Vlanif10\]ip add 10.1.1.2 24 \[LSW2-Vlanif10\]int Vlanif 20 \[LSW2-Vlanif20\]ip add 10.1.2.2 24 \[LSW2-Vlanif20\]int Vlanif 30 \[LSW2-Vlanif30\]ip add 10.1.3.2 24 \[LSW1\]int Vlanif 10 \[LSW1-Vlanif10\]vrrp vrid 1 virtual-ip 10.1.1.254 \[LSW1-Vlanif10\]vrrp vrid 1 priority 200 \[LSW1-Vlanif10\]vrrp vrid 1 preempt-mode timer delay 60 \[LSW1-Vlanif10\]vrrp vrid 1 track interface GigabitEthernet 0/0/1 reduced 120 \[LSW1\]int Vlanif 20 \[LSW1-Vlanif20\]vrrp vrid 2 virtual-ip 10.1.2.254 \[LSW1-Vlanif20\]vrrp vrid 2 priority 200 \[LSW1-Vlanif20\]vrrp vrid 2 preempt-mode timer delay 60 \[LSW1-Vlanif20\]vrrp vrid 2 track interface GigabitEthernet 0/0/1 reduced 120 \[LSW1\]int Vlanif 30 \[LSW1-Vlanif30\]vrrp vrid 3 virtual-ip 10.1.3.254 \[LSW2\]int Vlanif 10 \[LSW2-Vlanif10\]vrrp vrid 1 virtual-ip 10.1.1.254 \[LSW2-Vlanif10\]int Vlanif 20 \[LSW2-Vlanif20\]vrrp vrid 2 virtual-ip 10.1.2.254 \[LSW2-Vlanif20\]int Vlanif 30 \[LSW2-Vlanif30\]vrrp vrid 3 virtual-ip 10.1.3.254 \[LSW2-Vlanif30\]vrrp vrid 3 priority 200 \[LSW2-Vlanif30\]vrrp vrid 3 preempt-mode timer delay 60 \[LSW2-Vlanif30\]vrrp vrid 3 track interface GigabitEthernet 0/0/1 reduced 120 ![在这里插入图片描述](https://file.jishuzhan.net/article/1765045779333910529/0c28e7036479d8506f2e62db2d055192.webp) ![在这里插入图片描述](https://file.jishuzhan.net/article/1765045779333910529/396567ba5ab6916ffabaac49f7ad8753.webp) ![在这里插入图片描述](https://file.jishuzhan.net/article/1765045779333910529/caa632670bcf08f899c6575e62cb1987.webp) ![在这里插入图片描述](https://file.jishuzhan.net/article/1765045779333910529/4eed1f03f8ce401320ea2149aa74c228.webp) ![在这里插入图片描述](https://file.jishuzhan.net/article/1765045779333910529/086801a051c98e9814d1500a94e049a4.webp) ![在这里插入图片描述](https://file.jishuzhan.net/article/1765045779333910529/1a7e1c3363fd0da2cde2e476e3005414.webp) （4）配置三层互联接口 \[LSW1\]int Vlanif 11 \[LSW1-Vlanif11\]ip add 192.168.11.1 24 \[LSW1-Vlanif11\]int Vlanif 12 \[LSW1-Vlanif12\]ip add 192.168.12.1 24 \[LSW2\]int Vlanif 13 \[LSW2-Vlanif13\]ip add 192.168.13.2 24 \[LSW2-Vlanif13\]int Vlanif 14 \[LSW2-Vlanif14\]ip add 192.168.14.2 24 \[FW1\]firewall zone trust \[FW1-zone-trust\]add interface GigabitEthernet 1/0/2 \[FW1-zone-trust\]add interface GigabitEthernet 1/0/0 \[FW1\]firewall zone untrust \[FW1-zone-untrust\]add interface GigabitEthernet 1/0/1 \[FW1-zone-untrust\]firewall zone dmz \[FW1-zone-dmz\]add interface GigabitEthernet 1/0/3 \[FW1-zone-dmz\]add interface GigabitEthernet 1/0/4 \[FW1\]int g1/0/1 \[FW1-GigabitEthernet1/0/1\]ip add 20.1.1.3 24 \[FW1-GigabitEthernet1/0/1\]int g1/0/0 \[FW1-GigabitEthernet1/0/0\]ip add 192.168.13.3 24 \[FW1-GigabitEthernet1/0/0\]int g1/0/2 \[FW1-GigabitEthernet1/0/2\]ip add 192.168.11.3 24 \[FW1-GigabitEthernet1/0/2\]int g1/0/3 \[FW1-GigabitEthernet1/0/3\]ip add 192.168.15.3 24 \[FW1-GigabitEthernet1/0/3\]int g1/0/4 \[FW1-GigabitEthernet1/0/4\]ip add 192.168.16.3 24 ![在这里插入图片描述](https://file.jishuzhan.net/article/1765045779333910529/cbb994cb85b0b5f4748cadcefeefd891.webp) \[AR2\]int g0/0/0 \[AR2-GigabitEthernet0/0/0\]ip add 192.168.12.4 24 \[AR2-GigabitEthernet0/0/0\]int g0/0/1 \[AR2-GigabitEthernet0/0/1\]ip add 192.168.14.4 24 \[AR2-GigabitEthernet0/0/1\]int g0/0/2 \[AR2-GigabitEthernet0/0/2\]ip add 20.1.1.4 24 \[AR1\]int g4/0/0 \[AR1-GigabitEthernet4/0/0\]ip add 50.1.1.5 24 \[AR1-GigabitEthernet4/0/0\]int g0/0/1 \[AR1-GigabitEthernet0/0/1\]ip add 30.1.1.5 24 \[AR1-GigabitEthernet0/0/1\]int g0/0/2 \[AR1-GigabitEthernet0/0/2\]ip add 40.1.1.5 24 \[AR1-GigabitEthernet0/0/2\]int g0/0/0 \[AR1-GigabitEthernet0/0/0\]ip add 20.1.1.5 24 （5）配置DMZ区域 1）配置vlan \[LSW10\]vlan batch 100 101 \[LSW10\]int g0/0/3 \[LSW10-GigabitEthernet0/0/3\]port link-type access \[LSW10-GigabitEthernet0/0/3\]port default vlan 100 \[LSW10-GigabitEthernet0/0/3\]int g0/0/4 \[LSW10-GigabitEthernet0/0/4\]port link-type access \[LSW10-GigabitEthernet0/0/4\]port default vlan 101 \[LSW10-GigabitEthernet0/0/4\]int g0/0/1 \[LSW10-GigabitEthernet0/0/1\]port link-type trunk \[LSW10-GigabitEthernet0/0/1\]port trunk allow-pass vlan 100 101 \[LSW10-GigabitEthernet0/0/1\]int g0/0/2 \[LSW10-GigabitEthernet0/0/2\]port link-type trunk \[LSW10-GigabitEthernet0/0/2\]port trunk allow-pass vlan 100 101 \[LSW8\]vlan batch 15 100 101 \[LSW8\]int g0/0/1 \[LSW8-GigabitEthernet0/0/1\]port link-type access \[LSW8-GigabitEthernet0/0/1\]port default vlan 15 \[LSW8-GigabitEthernet0/0/1\]int g0/0/2 \[LSW8-GigabitEthernet0/0/2\]port link-type trunk \[LSW8-GigabitEthernet0/0/2\]port trunk allow-pass vlan 15 100 101 \[LSW8-GigabitEthernet0/0/2\]quit \[LSW8\]int Eth-Trunk 1 \[LSW8-Eth-Trunk1\]trunkport GigabitEthernet 0/0/3 to 0/0/4 \[LSW8-Eth-Trunk1\]port link-type trunk \[LSW8-Eth-Trunk1\]port trunk allow-pass vlan 15 100 101 \[LSW9\]vlan batch 16 100 101 \[LSW9\]int g0/0/1 \[LSW9-GigabitEthernet0/0/1\]port link-type access \[LSW9-GigabitEthernet0/0/1\]port default vlan 16 \[LSW9-GigabitEthernet0/0/1\]int g0/0/2 \[LSW9-GigabitEthernet0/0/2\]port link-type trunk \[LSW9-GigabitEthernet0/0/2\]po \[LSW9-GigabitEthernet0/0/2\]port trunk allow-pass vlan 16 100 101 \[LSW9-GigabitEthernet0/0/2\]quit \[LSW9\]int Eth-Trunk 1 \[LSW9-Eth-Trunk1\]trunkport GigabitEthernet 0/0/3 to 0/0/4 \[LSW9-Eth-Trunk1\]port link-type trunk \[LSW9-Eth-Trunk1\]port trunk allow-pass vlan 16 100 101 2）配置MSTP（要求vlan 100的根桥为LSW8，vlan 101的根桥为LSW9） \[LSW10\]stp region-configuration \[LSW10-mst-region\]region-name DMZ1 \[LSW10-mst-region\]revision-level 1 \[LSW10-mst-region\]instance 1 vlan 100 \[LSW10-mst-region\]instance 2 vlan 101 \[LSW10-mst-region\]active region-configuration \[LSW8\]stp region-configuration \[LSW8-mst-region\]region-name DMZ1 \[LSW8-mst-region\]revision-level 1 \[LSW8-mst-region\]instance 1 vlan 100 \[LSW8-mst-region\]instance 2 vlan 101 \[LSW8-mst-region\]active region-configuration \[LSW9\]stp region-configuration \[LSW9-mst-region\]region-name DMZ1 \[LSW9-mst-region\]revision-level 1 \[LSW9-mst-region\]instance 1 vlan 100 \[LSW9-mst-region\]instance 2 vlan 101 \[LSW9-mst-region\]active region-configuration \[LSW8\]stp instance 1 priority 0 \[LSW8\]stp instance 2 priority 4096 \[LSW9\]stp instance 1 priority 4096 \[LSW9\]stp instance 2 priority 0 ![在这里插入图片描述](https://file.jishuzhan.net/article/1765045779333910529/324989f2b1bc6897541cbaa23435e492.webp) \[LSW10\]int g0/0/3 \[LSW10-GigabitEthernet0/0/3\]stp edged-port enable \[LSW10-GigabitEthernet0/0/3\]int g0/0/4 \[LSW10-GigabitEthernet0/0/4\]stp edged-port enable 3）配置VLAN间路由 \[LSW8\]int Vlanif 15 \[LSW8-Vlanif15\]ip add 192.168.15.1 24 \[LSW8\]int Vlanif 100 \[LSW8-Vlanif100\]ip add 10.1.100.1 24 \[LSW8-Vlanif100\]int Vlanif 101 \[LSW8-Vlanif101\]ip add 10.1.101.1 24 \[LSW9\]int Vlanif 16 \[LSW9-Vlanif16\]ip add 192.168.16.2 24 \[LSW9\]int Vlanif 100 \[LSW9-Vlanif100\]ip add 10.1.100.2 24 \[LSW9-Vlanif100\]int Vlanif 101 \[LSW9-Vlanif101\]ip add 10.1.101.2 24 4）配置VRRP，保证链路备份 \[LSW8\]int Vlanif 100 \[LSW8-Vlanif100\]vrrp vrid 1 virtual-ip 10.1.100.254 \[LSW8-Vlanif100\]vrrp vrid 1 priority 200 \[LSW8-Vlanif100\]vrrp vrid 1 preempt-mode timer delay 60 \[LSW8-Vlanif100\]vrrp vrid 1 track interface g0/0/1 reduced 120 \[LSW8-Vlanif100\]quit \[LSW8\]int Vlanif 101 \[LSW8-Vlanif101\]vrrp vrid 2 virtual-ip 10.1.101.254 \[LSW9\]int Vlanif 100 \[LSW9-Vlanif100\]vrrp vrid 1 virtual-ip 10.1.100.254 \[LSW9-Vlanif100\]int Vlanif 101 \[LSW9-Vlanif101\]vrrp vrid 2 virtual-ip 10.1.101.254 \[LSW9-Vlanif101\]vrrp vrid 2 preempt-mode timer delay 60 \[LSW9-Vlanif101\]vrrp vrid 2 priority 200 \[LSW9-Vlanif101\]vrrp vrid 2 track interface g0/0/1 reduced 120 ![在这里插入图片描述](https://file.jishuzhan.net/article/1765045779333910529/33793d0215df6865986c1b38e026265c.webp) （6）配置全网路由：将总部在OSFP的area 0区域，服务器在 area 1区域，分部1在area 2区域，分部2在area 3区域 1）配置OSPF \[LSW1\]ospf 1 router-id 11.1.1.1 \[LSW1-ospf-1\]area 0 \[LSW1-ospf-1-area-0.0.0.0\]ne \[LSW1-ospf-1-area-0.0.0.0\]network 10.1.1.0 0.0.0.255 \[LSW1-ospf-1-area-0.0.0.0\]network 10.1.2.0 0.0.0.255 \[LSW1-ospf-1-area-0.0.0.0\]network 10.1.3.0 0.0.0.255 \[LSW1-ospf-1-area-0.0.0.0\]network 192.168.11.0 0.0.0.255 \[LSW1-ospf-1-area-0.0.0.0\]network 192.168.12.0 0.0.0.255 \[LSW2\]ospf 1 router-id 22.1.1.1 \[LSW2-ospf-1\]area 0 \[LSW2-ospf-1-area-0.0.0.0\]network 10.1.1.0 0.0.0.255 \[LSW2-ospf-1-area-0.0.0.0\]network 10.1.2.0 0.0.0.255 \[LSW2-ospf-1-area-0.0.0.0\]network 10.1.3.0 0.0.0.255 \[LSW2-ospf-1-area-0.0.0.0\]network 192.168.13.0 0.0.0.255 \[LSW2-ospf-1-area-0.0.0.0\]network 192.168.14.0 0.0.0.255 \[FW1\]ospf router-id 33.1.1.1 \[FW1-ospf-1\]ospf 1 \[FW1-ospf-1\]area 0 \[FW1-ospf-1-area-0.0.0.0\]network 192.168.11.0 0.0.0.255 \[FW1-ospf-1-area-0.0.0.0\]network 192.168.13.0 0.0.0.255 \[FW1-ospf-1-area-0.0.0.0\]network 192.168.15.0 0.0.0.255 \[FW1-ospf-1-area-0.0.0.0\]network 192.168.16.0 0.0.0.255 \[AR2\]ospf router-id 44.1.1.1 \[AR2-ospf-1\]area 0 \[AR2-ospf-1-area-0.0.0.0\]network 192.168.12.0 0.0.0.255 \[AR2-ospf-1-area-0.0.0.0\]network 192.168.14.0 0.0.0.255 \[LSW8\]ospf router-id 111.1.1.1 \[LSW8-ospf-1\]area 0 \[LSW8-ospf-1-area-0.0.0.0\]network 192.168.15.0 0.0.0.255 \[LSW8-ospf-1-area-0.0.0.0\]area 1 \[LSW8-ospf-1-area-0.0.0.1\]network 10.1.100.0 0.0.0.255 \[LSW8-ospf-1-area-0.0.0.1\]network 10.1.101.0 0.0.0.255 \[LSW9\]ospf router-id 222.1.1.1 \[LSW9-ospf-1\]area 0 \[LSW9-ospf-1-area-0.0.0.0\]net \[LSW9-ospf-1-area-0.0.0.0\]network 192.168.16.0 0.0.0.255 \[LSW9-ospf-1-area-0.0.0.0\]area 1 \[LSW9-ospf-1-area-0.0.0.1\]network 10.1.101.0 0.0.0.255 \[LSW9-ospf-1-area-0.0.0.1\]network 10.1.100.0 0.0.0.255 2）将vlanif接口静默 \[LSW1\]ospf 1 \[LSW1-ospf-1\]silent-interface Vlanif 10 \[LSW1-ospf-1\]silent-interface Vlanif 20 \[LSW1-ospf-1\]silent-interface Vlanif 30 \[LSW2\]ospf 1 \[LSW2-ospf-1\]silent-interface Vlanif 10 \[LSW2-ospf-1\]silent-interface Vlanif 20 \[LSW2-ospf-1\]silent-interface Vlanif 30 \[LSW8-ospf-1\]silent-interface Vlanif 100 \[LSW8-ospf-1\]silent-interface Vlanif 101 \[LSW9-ospf-1\]silent-interface Vlanif 100 \[LSW9-ospf-1\]silent-interface Vlanif 101 ![在这里插入图片描述](https://file.jishuzhan.net/article/1765045779333910529/fbdd78ebb7622a91162308e686ed7c75.webp) （7）配置trust到dmz的安全策略 \[FW1\]security-policy \[FW1-policy-security\]rule name t-to-dmz \[FW1-policy-security-rule-t-to-dmz\]source-zone trust \[FW1-policy-security-rule-t-to-dmz\]source-address 10.1.0.0 16 \[FW1-policy-security-rule-t-to-dmz\]destination-zone dmz \[FW1-policy-security-rule-t-to-dmz\]action permit ![在这里插入图片描述](https://file.jishuzhan.net/article/1765045779333910529/c36979f2266a37ecacc797f6d3c567a7.webp) （8）配置 NAT \[FW1\]nat-policy \[FW1-policy-nat\]rule name to-ISP \[FW1-policy-nat-rule-to-ISP\]source-zone trust \[FW1-policy-nat-rule-to-ISP\]destination-zone untrust \[FW1-policy-nat-rule-to-ISP\]source-address 10.1.0.0 16 \[FW1-policy-nat-rule-to-ISP\]action source-nat easy-ip \[FW1\]security-policy \[FW1-policy-security\]rule name to-ISP \[FW1-policy-security-rule-to-ISP\]source-zone trust \[FW1-policy-security-rule-to-ISP\]destination-zone untrust \[FW1-policy-security-rule-to-ISP\]source-address 10.1.0.0 16 \[FW1-policy-security-rule-to-ISP\]action permit \[FW1\]ip route-static 0.0.0.0 0.0.0.0 20.1.1.5 \[FW1\]ospf 1 \[FW1-ospf-1\]default-route-advertise ![在这里插入图片描述](https://file.jishuzhan.net/article/1765045779333910529/26b3b0ad83632a5fb6131def61a58c26.webp) ![在这里插入图片描述](https://file.jishuzhan.net/article/1765045779333910529/c4fb17a22394069571c56624ba7e592b.webp) （9）公网访问 dmz 区域的 http 服务和 FTP 服务：通过 nat-server 进行映射 \[FW1\]nat server protocol tcp global 20.1.1.100 80 inside 10.1.100.10 80 \[FW1\]nat server protocol tcp global 20.1.1.101 21 inside 10.1.101.10 21 \[FW1\]security-policy \[FW1-policy-security\]rule name u-to-dmz \[FW1-policy-security-rule-u-to-dmz\]source-zone untrust \[FW1-policy-security-rule-u-to-dmz\]destination-zone dmz \[FW1-policy-security-rule-u-to-dmz\]destination-address 10.1.100.10 32 \[FW1-policy-security-rule-u-to-dmz\]destination-address 10.1.101.10 32 \[FW1-policy-security-rule-u-to-dmz\]action permit ![在这里插入图片描述](https://file.jishuzhan.net/article/1765045779333910529/381aca96f06aa2f72e83a80995b16286.webp) ![在这里插入图片描述](https://file.jishuzhan.net/article/1765045779333910529/346864a71f6bbe46f32a4458836f57a7.webp) 4.分部1的配置：单臂路由和NAT （1）单臂路由配置 \[LSW11\]vlan batch 10 20 \[LSW11\]int g0/0/2 \[LSW11-GigabitEthernet0/0/2\]port link-type access \[LSW11-GigabitEthernet0/0/2\]port default vlan 10 \[LSW11-GigabitEthernet0/0/2\]int g0/0/3 \[LSW11-GigabitEthernet0/0/3\]port link-type access \[LSW11-GigabitEthernet0/0/3\]port default vlan 20 \[LSW11-GigabitEthernet0/0/3\]int g0/0/1 \[LSW11-GigabitEthernet0/0/1\]port link-type trunk \[LSW11-GigabitEthernet0/0/1\]port trunk allow-pass vlan 10 20 \[AR4\]int g0/0/1.10 \[AR4-GigabitEthernet0/0/1.10\]dot1q termination vid 10 \[AR4-GigabitEthernet0/0/1.10\]arp broadcast enable \[AR4-GigabitEthernet0/0/1.10\]ip add 10.2.1.1 2 \[AR4-GigabitEthernet0/0/1.10\]int g0/0/1.20 \[AR4-GigabitEthernet0/0/1.20\]dot1q termination vid 20 \[AR4-GigabitEthernet0/0/1.20\]arp broadcast enable \[AR4-GigabitEthernet0/0/1.20\]ip add 10.2.2.1 24 \[AR4\]int g0/0/0 \[AR4-GigabitEthernet0/0/0\]ip add 40.1.1.1 24 \[AR4\]ip route-static 0.0.0.0 0.0.0.0 40.1.1.5 \[AR4\]acl 2000 \[AR4-acl-basic-2000\]rule permit source 10.2.0.0 0.0.255.255 \[AR4-acl-basic-2000\]int g0/0/0 \[AR4-GigabitEthernet0/0/0\]nat outbound 2000 ![在这里插入图片描述](https://file.jishuzhan.net/article/1765045779333910529/4e49c2d02deab7ab5964699049b626c4.webp) 5.分部2的配置 （1）配置vlan \[LSW13\]vlan batch 10 20 17 \[LSW13\]int g0/0/1 \[LSW13-GigabitEthernet0/0/1\]port link-type access \[LSW13-GigabitEthernet0/0/1\]port default vlan 17 \[LSW13-GigabitEthernet0/0/1\]int g0/0/2 \[LSW13-GigabitEthernet0/0/2\]port link-type trunk \[LSW13-GigabitEthernet0/0/2\]port trunk allow-pass vlan 10 20 17 \[LSW13-GigabitEthernet0/0/2\]int g0/0/3 \[LSW13-GigabitEthernet0/0/3\]port link-type trunk \[LSW13-GigabitEthernet0/0/3\]port trunk allow-pass vlan 10 20 17 \[LSW13-GigabitEthernet0/0/3\]quit \[LSW13\]int Eth-Trunk 1 \[LSW13-Eth-Trunk1\]trunkport GigabitEthernet 0/0/4 to 0/0/5 \[LSW13-Eth-Trunk1\]port link-type trunk \[LSW13-Eth-Trunk1\]port trunk allow-pass vlan 10 20 17 \[LSW14\]vlan batch 10 20 18 \[LSW14\]int g0/0/1 \[LSW14-GigabitEthernet0/0/1\]port link-type access \[LSW14-GigabitEthernet0/0/1\]port default vlan 18 \[LSW14-GigabitEthernet0/0/1\]int g0/0/2 \[LSW14-GigabitEthernet0/0/2\]port link-type trunk \[LSW14-GigabitEthernet0/0/2\]port trunk allow-pass vlan 10 20 18 \[LSW14-GigabitEthernet0/0/2\]int g0/0/3 \[LSW14-GigabitEthernet0/0/3\]port link-type trunk \[LSW14-GigabitEthernet0/0/3\]port trunk allow-pass vlan 10 20 18 \[LSW14-GigabitEthernet0/0/3\]quit \[LSW14\]int Eth-Trunk 1 \[LSW14-Eth-Trunk1\]trunkport GigabitEthernet 0/0/4 to 0/0/5 \[LSW14-Eth-Trunk1\]port link-type trunk \[LSW14-Eth-Trunk1\]port trunk allow-pass vlan 10 20 18 \[LSW15\]vlan batch 10 20 \[LSW15\]int g0/0/3 \[LSW15-GigabitEthernet0/0/3\]port link-type access \[LSW15-GigabitEthernet0/0/3\]port default vlan 10 \[LSW15-GigabitEthernet0/0/3\]int g0/0/1 \[LSW15-GigabitEthernet0/0/1\]port link-type trunk \[LSW15-GigabitEthernet0/0/1\]port trunk allow-pass vlan 10 20 \[LSW15-GigabitEthernet0/0/1\]int g0/0/2 \[LSW15-GigabitEthernet0/0/2\]port link-type trunk \[LSW15-GigabitEthernet0/0/2\]port trunk allow-pass vlan 10 20 \[LSW16\]vlan batch 10 20 \[LSW16\]int g0/0/3 \[LSW16-GigabitEthernet0/0/3\]port link-type access \[LSW16-GigabitEthernet0/0/3\]port default vlan 20 \[LSW16-GigabitEthernet0/0/3\]int g0/0/1 \[LSW16-GigabitEthernet0/0/1\]port link-type trunk \[LSW16-GigabitEthernet0/0/1\]port trunk allow-pass vlan 10 20 \[LSW16-GigabitEthernet0/0/1\]int g0/0/2 \[LSW16-GigabitEthernet0/0/2\]port link-type trunk \[LSW16-GigabitEthernet0/0/2\]port trunk allow-pass vlan 10 20 （2）配置MSTP：LSW13为vlan 10的主根、vlan 20的次根，LSW14为vlan 20的主根、vlan 10的次根 \[LSW13\]stp region-configuration \[LSW13-mst-region\]region-name FB2 \[LSW13-mst-region\]revision-level 1 \[LSW13-mst-region\]instance 1 vlan 10 \[LSW13-mst-region\]instance 2 vlan 20 \[LSW13-mst-region\]active region-configuration \[LSW14\]stp region-configuration \[LSW14-mst-region\]region-name FB2 \[LSW14-mst-region\]revision-level 1 \[LSW14-mst-region\]instance 1 vlan 10 \[LSW14-mst-region\]instance 2 vlan 20 \[LSW14-mst-region\]active region-configuration \[LSW15\]stp region-configuration \[LSW15-mst-region\]region-name FB2 \[LSW15-mst-region\]revision-level 1 \[LSW15-mst-region\]instance 1 vlan 10 \[LSW15-mst-region\]instance 2 vlan 20 \[LSW15-mst-region\]active region-configuration \[LSW16\]stp region-configuration \[LSW16-mst-region\]region-name FB2 \[LSW16-mst-region\]revision-level 1 \[LSW16-mst-region\]instance 1 vlan 10 \[LSW16-mst-region\]instance 2 vlan 20 \[LSW16-mst-region\]active region-configuration \[LSW13\]stp instance 1 priority 0 \[LSW13\]stp instance 2 priority 4096 \[LSW14\]stp instance 1 priority 4096 \[LSW14\]stp instance 2 priority 0 ![在这里插入图片描述](https://file.jishuzhan.net/article/1765045779333910529/b1a3c417749ac08a8273d2ee8881f778.webp) ![在这里插入图片描述](https://file.jishuzhan.net/article/1765045779333910529/3513642bed01b327bbf58a0149cff9fd.webp) \[LSW16-GigabitEthernet0/0/3\]stp edged-port enable \[LSW15-GigabitEthernet0/0/3\]stp edged-port enable （3）配置vlan间路由 \[LSW13\]int Vlanif 10 \[LSW13-Vlanif10\]ip add 10.3.1.1 24 \[LSW13-Vlanif10\]int Vlanif 20 \[LSW13-Vlanif20\]ip add 10.3.2.1 24 \[LSW13-Vlanif20\]int Vlanif 10 \[LSW13-Vlanif10\]vrrp vrid 1 virtual-ip 10.3.1.254 \[LSW13-Vlanif10\]vrrp vrid 1 priority 200 \[LSW13-Vlanif10\]vrrp vrid 1 preempt-mode timer delay 60 \[LSW13-Vlanif10\]vrrp vrid 1 track interface g0/0/1 reduced 120 \[LSW13-Vlanif10\]int Vlanif 20 \[LSW13-Vlanif20\]vrrp vrid 2 virtual-ip 10.3.2.254 \[LSW14\]int Vlanif 10 \[LSW14-Vlanif10\]ip add 10.3.1.2 24 \[LSW14-Vlanif10\]int Vlanif 20 \[LSW14-Vlanif20\]ip add 10.3.2.2 24 \[LSW14-Vlanif20\]vrrp vrid 2 virtual-ip 10.3.2.254 \[LSW14-Vlanif20\]vrrp vrid 2 priority 200 \[LSW14-Vlanif20\]vrrp vrid 2 preempt-mode timer delay 60 \[LSW14-Vlanif20\]vrrp vrid 2 track interface GigabitEthernet 0/0/1 reduced 120 \[LSW14-Vlanif20\]int Vlanif 10 \[LSW14-Vlanif10\]vrrp vrid 1 virtual-ip 10.3.1.254 ![在这里插入图片描述](https://file.jishuzhan.net/article/1765045779333910529/5184b3793be9aec5f7d905eb3f837383.webp) ![在这里插入图片描述](https://file.jishuzhan.net/article/1765045779333910529/0fdd948c52cfa7fdbf0d16874c0dddeb.webp) （4）配置全网路由 \[LSW13\]int Vlanif 17 \[LSW13-Vlanif17\]ip add 192.168.17.1 24 \[LSW13-Vlanif17\]quit \[LSW13\]ospf 1 router-id 17.1.1.1 \[LSW13-ospf-1\]area 2 \[LSW13-ospf-1-area-0.0.0.2\]ne \[LSW13-ospf-1-area-0.0.0.2\]network 192.168.17.0 0.0.0.255 \[LSW13-ospf-1-area-0.0.0.2\]network 10.3.1.0 0.0.0.255 \[LSW13-ospf-1-area-0.0.0.2\]network 10.3.2.0 0.0.0.255 \[LSW13-ospf-1-area-0.0.0.2\]qui \[LSW13-ospf-1\]silent-interface Vlanif 10 \[LSW13-ospf-1\]silent-interface Vlanif 20 \[LSW14\]int Vlanif 18 \[LSW14-Vlanif18\]ip add 192.168.18.1 24 \[LSW14-Vlanif18\]quit \[LSW14\]ospf 1 router-id 18.1.1.1 \[LSW14-ospf-1\]area 2 \[LSW14-ospf-1-area-0.0.0.2\]network 10.3.1.0 0.0.0.255 \[LSW14-ospf-1-area-0.0.0.2\]network 10.3.2.0 0.0.0.255 \[LSW14-ospf-1-area-0.0.0.2\]network 192.168.18.0 0.0.0.255 \[LSW14-ospf-1-area-0.0.0.2\]quit \[LSW14-ospf-1\]silent-interface Vlanif 10 \[LSW14-ospf-1\]silent-interface Vlanif 20 \[AR5\]int g0/0/1 \[AR5-GigabitEthernet0/0/1\]ip add 192.168.17.6 24 \[AR5-GigabitEthernet0/0/1\]int g0/0/2 \[AR5-GigabitEthernet0/0/2\]ip add 192.168.18.6 24 \[AR5-GigabitEthernet0/0/2\]int g0/0/0 \[AR5-GigabitEthernet0/0/0\]ip add 50.1.1.6 24 \[AR5\]ospf 1 router-id 55.1.1.1 \[AR5-ospf-1\]area 2 \[AR5-ospf-1-area-0.0.0.2\]network 192.168.17.0 0.0.0.255 \[AR5-ospf-1-area-0.0.0.2\]network 192.168.18.0 0.0.0.255 \[AR5\]ip route-static 0.0.0.0 0.0.0.0 50.1.1.5 \[AR5\]ospf 1 \[AR5-ospf-1\]default-route-advertise （5）源NAT地址转换 \[AR5\]acl 2000 \[AR5-acl-basic-2000\]rule permit source 10.3.0.0 0.0.255.255 \[AR5\]int g0/0/0 \[AR5-GigabitEthernet0/0/0\]nat outbound 2000 ![在这里插入图片描述](https://file.jishuzhan.net/article/1765045779333910529/133bfb96f800d2738feaa75171196f0f.webp) 6.总校分校DSVPN配置：AR2作为hub端，AR4、AR5作为spoke端，三个接口配置在172.1.1.0网段 \[AR2\]int Tunnel 0/0/0 \[AR2-Tunnel0/0/0\]tunnel-protocol gre p2mp \[AR2-Tunnel0/0/0\]ip add 172.1.1.1 24 \[AR2-Tunnel0/0/0\]source GigabitEthernet 0/0/2 \[AR2-Tunnel0/0/0\]nhrp entry multicast dynamic \[AR2-Tunnel0/0/0\]ospf dr-priority 255 //调整优先级至最大，使其成为 DR \[AR4\]int Tunnel 0/0/0 \[AR4-Tunnel0/0/0\]tunnel-protocol gre p2mp \[AR4-Tunnel0/0/0\]ip add 172.1.1.3 24 \[AR4-Tunnel0/0/0\]source GigabitEthernet 0/0/0 \[AR4-Tunnel0/0/0\]nhrp entry 172.1.1.1 20.1.1.4 register \[AR4-Tunnel0/0/0\]ospf network-type broadcast \[AR4-Tunnel0/0/0\]ospf dr-priority 0 \[AR5\]int Tunnel 0/0/0 \[AR5-Tunnel0/0/0\]tunnel-protocol gre p2mp \[AR5-Tunnel0/0/0\]ip add 172.1.1.2 24 \[AR5-Tunnel0/0/0\]source GigabitEthernet 0/0/0 \[AR5-Tunnel0/0/0\]nhrp entry 172.1.1.1 20.1.1.4 register \[AR5-Tunnel0/0/0\]ospf network-type broadcast \[AR5-Tunnel0/0/0\]ospf dr-priority 0 ![在这里插入图片描述](https://file.jishuzhan.net/article/1765045779333910529/ad5b002ef29aa19dcbd2eb462bc5ea7b.webp) \[AR2\]ospf 1 \[AR2-ospf-1\]area 0 \[AR2-ospf-1-area-0.0.0.0\]network 172.1.1.0 0.0.0.255 \[AR4\]ospf 1 \[AR4-ospf-1\]area 0 \[AR4-ospf-1-area-0.0.0.0\]network 172.1.1.0 0.0.0.255 \[AR5\]ospf 1 \[AR5-ospf-1\]area 0 \[AR5-ospf-1-area-0.0.0.0\]network 172.1.1.0 0.0.0.255

相关推荐
zzr9151 小时前
多线程网络编程：粘包问题、多线程/多进程服务器实战与常见问题解析
linux·运维·服务器·网络·ubuntu
Bob99981 小时前
基于晶晨S905L3B单网线盒子的Armbian 或openwrt应用
java·javascript·网络·数据结构·c++·python·eclipse
～央千澈～3 小时前
鸿蒙系统被抹黑的深层解析：技术、商业与地缘政治的复杂博弈-优雅草卓伊凡
华为·harmonyos
马剑威（威哥爱编程）3 小时前
HarmonyOS 5.0 低时延音视频开发
华为·音视频·harmonyos
Nicolas8933 小时前
【大模型实战篇】华为信创环境采用vllm部署QwQ-32B模型
华为·信创·模型部署·昇腾·ascend·vllm·模型推理
IT主机CV3 小时前
端口安全基本配置
服务器·网络·安全
lurw9263 小时前
HarmonyOS Device Connector（hdc）
华为·harmonyos
叫我王富贵i6 小时前
0基础学习鸿蒙开发-HarmonyOS4
学习·华为·harmonyos·arkts
可怜的Tom被玩弄于股掌之中8 小时前
sqli-labs靶场通关保姆级教学（Get传输篇）Less-1Less-10
网络·sql·安全·web安全·网络安全
浪前9 小时前
【网络篇】传输层TCP协议的确认应答，超时重传机制
网络·网络协议·tcp/ip
热门推荐
01从零安装 LLaMA-Factory 微调 Qwen 大模型成功及所有的坑02KGG转MP3工具|非KGM文件|解密音频03YOLOv8入门 | 重要性能衡量指标、训练结果评价及分析及影响mAP的因素【发论文关注的指标】04【SpeedAI科研小助手】2分钟极速解决知网维普重复率、AIGC率过高，一键全文降！文件格式不变，公式都保留的！05YOLOv8目标检测在RK3588部署全过程06西电B测-计算机网络综合实验(含验收问题)07苍穹外卖面试总结08Coze扣子平台完整体验和实践（附国内和国际版对比）09DeepSeek各版本说明与优缺点分析10Android studio如何导入外部项目至成功运行（适合纯新手、小白、初学者的详细教程）导入安卓项目时规避报错，鹿溪IT工作室为您服务