华为设备总部与分部配置

1.要求：

（1）总部实现高可靠性设计，接入层断掉一根线或汇聚、核心设备故障都不能影响数据正常转发

（2）分部1人数较少，采用单臂路由互通

（3）总部、分部1、2之间都能访问互联网

（4）外网能够访问总部的HTTP server 和FTP server

（5）总部和两个分部之间通过DSVPN实现内网互通

2.总部配置

（1）创建vlan并加入接口，将核心交换机之间链路捆绑为e-trunk，确保任何一台故障时另一台能正常转发数据

[LSW3]vlan batch 10 20 30

[LSW3]int g0/0/3

[LSW3-GigabitEthernet0/0/3]port link-type access

[LSW3-GigabitEthernet0/0/3]port default vlan 10

[LSW3-GigabitEthernet0/0/3]int g0/0/1

[LSW3-GigabitEthernet0/0/1]port link-type trunk

[LSW3-GigabitEthernet0/0/1]port trunk allow-pass vlan 10 20 30

[LSW3-GigabitEthernet0/0/1]int g0/0/2

[LSW3-GigabitEthernet0/0/2]port link-type trunk

[LSW3-GigabitEthernet0/0/2]port trunk allow-pass vlan 10 20 30

[LSW4]vlan batch 10 20 30

[LSW4]int g0/0/3

[LSW4-GigabitEthernet0/0/3]port link-type access

[LSW4-GigabitEthernet0/0/3]port default vlan 20

[LSW4-GigabitEthernet0/0/3]int g0/0/1

[LSW4-GigabitEthernet0/0/1]port link-type trunk

[LSW4-GigabitEthernet0/0/1]port trunk allow-pass vlan 10 20 30

[LSW4-GigabitEthernet0/0/1]int g0/0/2

[LSW4-GigabitEthernet0/0/2]port link-type trunk

[LSW4-GigabitEthernet0/0/2]port trunk allow-pass vlan 10 20 30

[LSW5]vlan batch 10 20 30

[LSW5]int g0/0/3

[LSW5-GigabitEthernet0/0/3]port link-type access

[LSW5-GigabitEthernet0/0/3]port default vlan 30

[LSW5-GigabitEthernet0/0/3]int g0/0/1

[LSW5-GigabitEthernet0/0/1]port link-type trunk

[LSW5-GigabitEthernet0/0/1]port trunk allow-pass vlan 10 20 30

[LSW5-GigabitEthernet0/0/1]int g0/0/2

[LSW5-GigabitEthernet0/0/2]port link-type trunk

[LSW5-GigabitEthernet0/0/2]port trunk allow-pass vlan 10 20 30

[LSW1]vlan batch 10 20 30 11 12

[LSW1]int g0/0/1

[LSW1-GigabitEthernet0/0/1]port link-type access

[LSW1-GigabitEthernet0/0/1]port default vlan 11

[LSW1-GigabitEthernet0/0/1]int g0/0/2

[LSW1-GigabitEthernet0/0/2]port link-type access

[LSW1-GigabitEthernet0/0/2]port default vlan 12

[LSW1-GigabitEthernet0/0/2]int g0/0/3

[LSW1-GigabitEthernet0/0/3]port link-type trunk

[LSW1-GigabitEthernet0/0/3]port trunk allow-pass vlan 10 20 30 11 12

[LSW1-GigabitEthernet0/0/3]int g0/0/4

[LSW1-GigabitEthernet0/0/4]port link-type trunk

[LSW1-GigabitEthernet0/0/4]port trunk allow-pass vlan 10 20 30 11 12 13 14

[LSW1-GigabitEthernet0/0/4]int g0/0/5

[LSW1-GigabitEthernet0/0/5]port link-type trunk

[LSW1-GigabitEthernet0/0/5]port trunk allow-pass vlan 10 20 30 11 12 13 14

[LSW1-GigabitEthernet0/0/5]quit

[LSW1]int Eth-Trunk 1

[LSW1-Eth-Trunk1]trunkport GigabitEthernet 0/0/6 to 0/0/7

[LSW1-Eth-Trunk1]port link-type trunk

[LSW1-Eth-Trunk1]port trunk allow-pass vlan 10 20 30 11 12 13 14

[LSW2]vlan batch 10 20 30 13 14

[LSW2]int g0/0/1

[LSW2-GigabitEthernet0/0/1]port link-type access

[LSW2-GigabitEthernet0/0/1]port default vlan 14

[LSW2-GigabitEthernet0/0/1]int g0/0/2

[LSW2-GigabitEthernet0/0/2]port link-type access

[LSW2-GigabitEthernet0/0/2]port default vlan 13

[LSW2-GigabitEthernet0/0/2]int g0/0/3

[LSW2-GigabitEthernet0/0/3]port link-type t

[LSW2-GigabitEthernet0/0/3]port link-type trunk

[LSW2-GigabitEthernet0/0/3]port trunk allow-pass vlan 10 20 30 11 12 13 14

[LSW2-GigabitEthernet0/0/3]int g0/0/4

[LSW2-GigabitEthernet0/0/4]port link-type trunk

[LSW2-GigabitEthernet0/0/4]port trunk allow-pass vlan 10 20 30 11 12 13 14

[LSW2-GigabitEthernet0/0/4]int g0/0/5

[LSW2-GigabitEthernet0/0/5]port link-type trunk

[LSW2-GigabitEthernet0/0/5]port trunk allow-pass vlan 10 20 30 11 12 13 14

[LSW2-GigabitEthernet0/0/5]quit

[LSW2]int Eth-Trunk 1

[LSW2-Eth-Trunk1]trunkport GigabitEthernet 0/0/6 to 0/0/7

[LSW2-Eth-Trunk1]port link-type trunk

[LSW2-Eth-Trunk1]port trunk allow-pass vlan 10 20 30 11 12 13 14

（2）配置MSTP破除环路：LSW1为vlan 10 20的根桥、vlan 30 的次根，LSW2为vlan 30的根桥、vlan 10 20的次根；将连接终端的接口配置为边缘端口

[LSW1]stp region-configuration

[LSW1-mst-region]region-name 1

[LSW1-mst-region]revision-level 1

[LSW1-mst-region]instance 1 vlan 10 20

[LSW1-mst-region]instance 2 vlan 30

[LSW1-mst-region]active region-configuration

[LSW1]stp instance 1 priority 0

[LSW1]stp instance 2 priority 4096

[LSW2]stp region-configuration

[LSW2-mst-region]region-name 1

[LSW2-mst-region]revision-level 1

[LSW2-mst-region]instance 1 vlan 10 20

[LSW2-mst-region]instance 2 vlan 30

[LSW2-mst-region]active region-configuration

[LSW2]stp instance 1 priority 4096

[LSW2]stp instance 2 priority 0

[LSW3]stp region-configuration

[LSW3-mst-region]region-name 1

[LSW3-mst-region]revision-level 1

[LSW3-mst-region]instance 1 vlan 10 20

[LSW3-mst-region]instance 2 vlan 30

[LSW3-mst-region]active region-configuration

[LSW3-mst-region]quit

[LSW4]stp region-configuration

[LSW4-mst-region]region-name 1

[LSW4-mst-region]revision-level 1

[LSW4-mst-region]instance 1 vlan 10 20

[LSW4-mst-region]instance 2 vlan 30

[LSW4-mst-region]active region-configuration

[LSW4-mst-region]quit

[LSW5]stp region-configuration

[LSW5-mst-region]region-name 1

[LSW5-mst-region]revision-level 1

[LSW5-mst-region]instance 1 vlan 10 20

[LSW5-mst-region]instance 2 vlan 30

[LSW5-mst-region]active region-configuration

[LSW3]int g0/0/3

[LSW3-GigabitEthernet0/0/3]stp edged-port enable

[LSW4]int g0/0/3

[LSW4-GigabitEthernet0/0/3]stp edged-port enable

[LSW5]int g0/0/3

[LSW5-GigabitEthernet0/0/3]stp edged-port enable

（3）配置vlan间路由，使内网互通：配置vrrp，LSW1为vlan 10 20的master、为vlan 30的backup，LSW2为vlan 10 20的backup、为vlan 30的master

[LSW1]int Vlanif 10

[LSW1-Vlanif10]ip add 10.1.1.1 24

[LSW1-Vlanif10]int Vlanif 20

[LSW1-Vlanif20]ip add 10.1.2.1 24

[LSW1-Vlanif20]int Vlanif 30

[LSW1-Vlanif30]ip add 10.1.3.1 24

[LSW2]int Vlanif 10

[LSW2-Vlanif10]ip add 10.1.1.2 24

[LSW2-Vlanif10]int Vlanif 20

[LSW2-Vlanif20]ip add 10.1.2.2 24

[LSW2-Vlanif20]int Vlanif 30

[LSW2-Vlanif30]ip add 10.1.3.2 24

[LSW1]int Vlanif 10

[LSW1-Vlanif10]vrrp vrid 1 virtual-ip 10.1.1.254

[LSW1-Vlanif10]vrrp vrid 1 priority 200

[LSW1-Vlanif10]vrrp vrid 1 preempt-mode timer delay 60

[LSW1-Vlanif10]vrrp vrid 1 track interface GigabitEthernet 0/0/1 reduced 120

[LSW1]int Vlanif 20

[LSW1-Vlanif20]vrrp vrid 2 virtual-ip 10.1.2.254

[LSW1-Vlanif20]vrrp vrid 2 priority 200

[LSW1-Vlanif20]vrrp vrid 2 preempt-mode timer delay 60

[LSW1-Vlanif20]vrrp vrid 2 track interface GigabitEthernet 0/0/1 reduced 120

[LSW1]int Vlanif 30

[LSW1-Vlanif30]vrrp vrid 3 virtual-ip 10.1.3.254

[LSW2]int Vlanif 10

[LSW2-Vlanif10]vrrp vrid 1 virtual-ip 10.1.1.254

[LSW2-Vlanif10]int Vlanif 20

[LSW2-Vlanif20]vrrp vrid 2 virtual-ip 10.1.2.254

[LSW2-Vlanif20]int Vlanif 30

[LSW2-Vlanif30]vrrp vrid 3 virtual-ip 10.1.3.254

[LSW2-Vlanif30]vrrp vrid 3 priority 200

[LSW2-Vlanif30]vrrp vrid 3 preempt-mode timer delay 60

[LSW2-Vlanif30]vrrp vrid 3 track interface GigabitEthernet 0/0/1 reduced 120

（4）配置三层互联接口

[LSW1]int Vlanif 11

[LSW1-Vlanif11]ip add 192.168.11.1 24

[LSW1-Vlanif11]int Vlanif 12

[LSW1-Vlanif12]ip add 192.168.12.1 24

[LSW2]int Vlanif 13

[LSW2-Vlanif13]ip add 192.168.13.2 24

[LSW2-Vlanif13]int Vlanif 14

[LSW2-Vlanif14]ip add 192.168.14.2 24

[FW1]firewall zone trust

[FW1-zone-trust]add interface GigabitEthernet 1/0/2

[FW1-zone-trust]add interface GigabitEthernet 1/0/0

[FW1]firewall zone untrust

[FW1-zone-untrust]add interface GigabitEthernet 1/0/1

[FW1-zone-untrust]firewall zone dmz

[FW1-zone-dmz]add interface GigabitEthernet 1/0/3

[FW1-zone-dmz]add interface GigabitEthernet 1/0/4

[FW1]int g1/0/1

[FW1-GigabitEthernet1/0/1]ip add 20.1.1.3 24

[FW1-GigabitEthernet1/0/1]int g1/0/0

[FW1-GigabitEthernet1/0/0]ip add 192.168.13.3 24

[FW1-GigabitEthernet1/0/0]int g1/0/2

[FW1-GigabitEthernet1/0/2]ip add 192.168.11.3 24

[FW1-GigabitEthernet1/0/2]int g1/0/3

[FW1-GigabitEthernet1/0/3]ip add 192.168.15.3 24

[FW1-GigabitEthernet1/0/3]int g1/0/4

[FW1-GigabitEthernet1/0/4]ip add 192.168.16.3 24

[AR2]int g0/0/0

[AR2-GigabitEthernet0/0/0]ip add 192.168.12.4 24

[AR2-GigabitEthernet0/0/0]int g0/0/1

[AR2-GigabitEthernet0/0/1]ip add 192.168.14.4 24

[AR2-GigabitEthernet0/0/1]int g0/0/2

[AR2-GigabitEthernet0/0/2]ip add 20.1.1.4 24

[AR1]int g4/0/0

[AR1-GigabitEthernet4/0/0]ip add 50.1.1.5 24

[AR1-GigabitEthernet4/0/0]int g0/0/1

[AR1-GigabitEthernet0/0/1]ip add 30.1.1.5 24

[AR1-GigabitEthernet0/0/1]int g0/0/2

[AR1-GigabitEthernet0/0/2]ip add 40.1.1.5 24

[AR1-GigabitEthernet0/0/2]int g0/0/0

[AR1-GigabitEthernet0/0/0]ip add 20.1.1.5 24

（5）配置DMZ区域

1）配置vlan

[LSW10]vlan batch 100 101

[LSW10]int g0/0/3

[LSW10-GigabitEthernet0/0/3]port link-type access

[LSW10-GigabitEthernet0/0/3]port default vlan 100

[LSW10-GigabitEthernet0/0/3]int g0/0/4

[LSW10-GigabitEthernet0/0/4]port link-type access

[LSW10-GigabitEthernet0/0/4]port default vlan 101

[LSW10-GigabitEthernet0/0/4]int g0/0/1

[LSW10-GigabitEthernet0/0/1]port link-type trunk

[LSW10-GigabitEthernet0/0/1]port trunk allow-pass vlan 100 101

[LSW10-GigabitEthernet0/0/1]int g0/0/2

[LSW10-GigabitEthernet0/0/2]port link-type trunk

[LSW10-GigabitEthernet0/0/2]port trunk allow-pass vlan 100 101

[LSW8]vlan batch 15 100 101

[LSW8]int g0/0/1

[LSW8-GigabitEthernet0/0/1]port link-type access

[LSW8-GigabitEthernet0/0/1]port default vlan 15

[LSW8-GigabitEthernet0/0/1]int g0/0/2

[LSW8-GigabitEthernet0/0/2]port link-type trunk

[LSW8-GigabitEthernet0/0/2]port trunk allow-pass vlan 15 100 101

[LSW8-GigabitEthernet0/0/2]quit

[LSW8]int Eth-Trunk 1

[LSW8-Eth-Trunk1]trunkport GigabitEthernet 0/0/3 to 0/0/4

[LSW8-Eth-Trunk1]port link-type trunk

[LSW8-Eth-Trunk1]port trunk allow-pass vlan 15 100 101

[LSW9]vlan batch 16 100 101

[LSW9]int g0/0/1

[LSW9-GigabitEthernet0/0/1]port link-type access

[LSW9-GigabitEthernet0/0/1]port default vlan 16

[LSW9-GigabitEthernet0/0/1]int g0/0/2

[LSW9-GigabitEthernet0/0/2]port link-type trunk

[LSW9-GigabitEthernet0/0/2]po

[LSW9-GigabitEthernet0/0/2]port trunk allow-pass vlan 16 100 101

[LSW9-GigabitEthernet0/0/2]quit

[LSW9]int Eth-Trunk 1

[LSW9-Eth-Trunk1]trunkport GigabitEthernet 0/0/3 to 0/0/4

[LSW9-Eth-Trunk1]port link-type trunk

[LSW9-Eth-Trunk1]port trunk allow-pass vlan 16 100 101

2）配置MSTP（要求vlan 100的根桥为LSW8，vlan 101的根桥为LSW9）

[LSW10]stp region-configuration

[LSW10-mst-region]region-name DMZ1

[LSW10-mst-region]revision-level 1

[LSW10-mst-region]instance 1 vlan 100

[LSW10-mst-region]instance 2 vlan 101

[LSW10-mst-region]active region-configuration

[LSW8]stp region-configuration

[LSW8-mst-region]region-name DMZ1

[LSW8-mst-region]revision-level 1

[LSW8-mst-region]instance 1 vlan 100

[LSW8-mst-region]instance 2 vlan 101

[LSW8-mst-region]active region-configuration

[LSW9]stp region-configuration

[LSW9-mst-region]region-name DMZ1

[LSW9-mst-region]revision-level 1

[LSW9-mst-region]instance 1 vlan 100

[LSW9-mst-region]instance 2 vlan 101

[LSW9-mst-region]active region-configuration

[LSW8]stp instance 1 priority 0

[LSW8]stp instance 2 priority 4096

[LSW9]stp instance 1 priority 4096

[LSW9]stp instance 2 priority 0

[LSW10]int g0/0/3

[LSW10-GigabitEthernet0/0/3]stp edged-port enable

[LSW10-GigabitEthernet0/0/3]int g0/0/4

[LSW10-GigabitEthernet0/0/4]stp edged-port enable

3）配置VLAN间路由

[LSW8]int Vlanif 15

[LSW8-Vlanif15]ip add 192.168.15.1 24

[LSW8]int Vlanif 100

[LSW8-Vlanif100]ip add 10.1.100.1 24

[LSW8-Vlanif100]int Vlanif 101

[LSW8-Vlanif101]ip add 10.1.101.1 24

[LSW9]int Vlanif 16

[LSW9-Vlanif16]ip add 192.168.16.2 24

[LSW9]int Vlanif 100

[LSW9-Vlanif100]ip add 10.1.100.2 24

[LSW9-Vlanif100]int Vlanif 101

[LSW9-Vlanif101]ip add 10.1.101.2 24

4）配置VRRP，保证链路备份

[LSW8]int Vlanif 100

[LSW8-Vlanif100]vrrp vrid 1 virtual-ip 10.1.100.254

[LSW8-Vlanif100]vrrp vrid 1 priority 200

[LSW8-Vlanif100]vrrp vrid 1 preempt-mode timer delay 60

[LSW8-Vlanif100]vrrp vrid 1 track interface g0/0/1 reduced 120

[LSW8-Vlanif100]quit

[LSW8]int Vlanif 101

[LSW8-Vlanif101]vrrp vrid 2 virtual-ip 10.1.101.254

[LSW9]int Vlanif 100

[LSW9-Vlanif100]vrrp vrid 1 virtual-ip 10.1.100.254

[LSW9-Vlanif100]int Vlanif 101

[LSW9-Vlanif101]vrrp vrid 2 virtual-ip 10.1.101.254

[LSW9-Vlanif101]vrrp vrid 2 preempt-mode timer delay 60

[LSW9-Vlanif101]vrrp vrid 2 priority 200

[LSW9-Vlanif101]vrrp vrid 2 track interface g0/0/1 reduced 120

（6）配置全网路由：将总部在OSFP的area 0区域，服务器在 area 1区域，分部1在area 2区域，分部2在area 3区域

1）配置OSPF

[LSW1]ospf 1 router-id 11.1.1.1

[LSW1-ospf-1]area 0

[LSW1-ospf-1-area-0.0.0.0]ne

[LSW1-ospf-1-area-0.0.0.0]network 10.1.1.0 0.0.0.255

[LSW1-ospf-1-area-0.0.0.0]network 10.1.2.0 0.0.0.255

[LSW1-ospf-1-area-0.0.0.0]network 10.1.3.0 0.0.0.255

[LSW1-ospf-1-area-0.0.0.0]network 192.168.11.0 0.0.0.255

[LSW1-ospf-1-area-0.0.0.0]network 192.168.12.0 0.0.0.255

[LSW2]ospf 1 router-id 22.1.1.1

[LSW2-ospf-1]area 0

[LSW2-ospf-1-area-0.0.0.0]network 10.1.1.0 0.0.0.255

[LSW2-ospf-1-area-0.0.0.0]network 10.1.2.0 0.0.0.255

[LSW2-ospf-1-area-0.0.0.0]network 10.1.3.0 0.0.0.255

[LSW2-ospf-1-area-0.0.0.0]network 192.168.13.0 0.0.0.255

[LSW2-ospf-1-area-0.0.0.0]network 192.168.14.0 0.0.0.255

[FW1]ospf router-id 33.1.1.1

[FW1-ospf-1]ospf 1

[FW1-ospf-1]area 0

[FW1-ospf-1-area-0.0.0.0]network 192.168.11.0 0.0.0.255

[FW1-ospf-1-area-0.0.0.0]network 192.168.13.0 0.0.0.255

[FW1-ospf-1-area-0.0.0.0]network 192.168.15.0 0.0.0.255

[FW1-ospf-1-area-0.0.0.0]network 192.168.16.0 0.0.0.255

[AR2]ospf router-id 44.1.1.1

[AR2-ospf-1]area 0

[AR2-ospf-1-area-0.0.0.0]network 192.168.12.0 0.0.0.255

[AR2-ospf-1-area-0.0.0.0]network 192.168.14.0 0.0.0.255

[LSW8]ospf router-id 111.1.1.1

[LSW8-ospf-1]area 0

[LSW8-ospf-1-area-0.0.0.0]network 192.168.15.0 0.0.0.255

[LSW8-ospf-1-area-0.0.0.0]area 1

[LSW8-ospf-1-area-0.0.0.1]network 10.1.100.0 0.0.0.255

[LSW8-ospf-1-area-0.0.0.1]network 10.1.101.0 0.0.0.255

[LSW9]ospf router-id 222.1.1.1

[LSW9-ospf-1]area 0

[LSW9-ospf-1-area-0.0.0.0]net

[LSW9-ospf-1-area-0.0.0.0]network 192.168.16.0 0.0.0.255

[LSW9-ospf-1-area-0.0.0.0]area 1

[LSW9-ospf-1-area-0.0.0.1]network 10.1.101.0 0.0.0.255

[LSW9-ospf-1-area-0.0.0.1]network 10.1.100.0 0.0.0.255

2）将vlanif接口静默

[LSW1]ospf 1

[LSW1-ospf-1]silent-interface Vlanif 10

[LSW1-ospf-1]silent-interface Vlanif 20

[LSW1-ospf-1]silent-interface Vlanif 30

[LSW2]ospf 1

[LSW2-ospf-1]silent-interface Vlanif 10

[LSW2-ospf-1]silent-interface Vlanif 20

[LSW2-ospf-1]silent-interface Vlanif 30

[LSW8-ospf-1]silent-interface Vlanif 100

[LSW8-ospf-1]silent-interface Vlanif 101

[LSW9-ospf-1]silent-interface Vlanif 100

[LSW9-ospf-1]silent-interface Vlanif 101

（7）配置trust到dmz的安全策略

[FW1]security-policy

[FW1-policy-security]rule name t-to-dmz

[FW1-policy-security-rule-t-to-dmz]source-zone trust

[FW1-policy-security-rule-t-to-dmz]source-address 10.1.0.0 16

[FW1-policy-security-rule-t-to-dmz]destination-zone dmz

[FW1-policy-security-rule-t-to-dmz]action permit

（8）配置 NAT

[FW1]nat-policy

[FW1-policy-nat]rule name to-ISP

[FW1-policy-nat-rule-to-ISP]source-zone trust

[FW1-policy-nat-rule-to-ISP]destination-zone untrust

[FW1-policy-nat-rule-to-ISP]source-address 10.1.0.0 16

[FW1-policy-nat-rule-to-ISP]action source-nat easy-ip

[FW1]security-policy

[FW1-policy-security]rule name to-ISP

[FW1-policy-security-rule-to-ISP]source-zone trust

[FW1-policy-security-rule-to-ISP]destination-zone untrust

[FW1-policy-security-rule-to-ISP]source-address 10.1.0.0 16

[FW1-policy-security-rule-to-ISP]action permit

[FW1]ip route-static 0.0.0.0 0.0.0.0 20.1.1.5

[FW1]ospf 1

[FW1-ospf-1]default-route-advertise

（9）公网访问 dmz 区域的 http 服务和 FTP 服务：通过 nat-server 进行映射

[FW1]nat server protocol tcp global 20.1.1.100 80 inside 10.1.100.10 80

[FW1]nat server protocol tcp global 20.1.1.101 21 inside 10.1.101.10 21

[FW1]security-policy

[FW1-policy-security]rule name u-to-dmz

[FW1-policy-security-rule-u-to-dmz]source-zone untrust

[FW1-policy-security-rule-u-to-dmz]destination-zone dmz

[FW1-policy-security-rule-u-to-dmz]destination-address 10.1.100.10 32

[FW1-policy-security-rule-u-to-dmz]destination-address 10.1.101.10 32

[FW1-policy-security-rule-u-to-dmz]action permit

4.分部1的配置：单臂路由和NAT

（1）单臂路由配置

[LSW11]vlan batch 10 20

[LSW11]int g0/0/2

[LSW11-GigabitEthernet0/0/2]port link-type access

[LSW11-GigabitEthernet0/0/2]port default vlan 10

[LSW11-GigabitEthernet0/0/2]int g0/0/3

[LSW11-GigabitEthernet0/0/3]port link-type access

[LSW11-GigabitEthernet0/0/3]port default vlan 20

[LSW11-GigabitEthernet0/0/3]int g0/0/1

[LSW11-GigabitEthernet0/0/1]port link-type trunk

[LSW11-GigabitEthernet0/0/1]port trunk allow-pass vlan 10 20

[AR4]int g0/0/1.10

[AR4-GigabitEthernet0/0/1.10]dot1q termination vid 10

[AR4-GigabitEthernet0/0/1.10]arp broadcast enable

[AR4-GigabitEthernet0/0/1.10]ip add 10.2.1.1 2

[AR4-GigabitEthernet0/0/1.10]int g0/0/1.20

[AR4-GigabitEthernet0/0/1.20]dot1q termination vid 20

[AR4-GigabitEthernet0/0/1.20]arp broadcast enable

[AR4-GigabitEthernet0/0/1.20]ip add 10.2.2.1 24

[AR4]int g0/0/0

[AR4-GigabitEthernet0/0/0]ip add 40.1.1.1 24

[AR4]ip route-static 0.0.0.0 0.0.0.0 40.1.1.5

[AR4]acl 2000

[AR4-acl-basic-2000]rule permit source 10.2.0.0 0.0.255.255

[AR4-acl-basic-2000]int g0/0/0

[AR4-GigabitEthernet0/0/0]nat outbound 2000

5.分部2的配置

（1）配置vlan

[LSW13]vlan batch 10 20 17

[LSW13]int g0/0/1

[LSW13-GigabitEthernet0/0/1]port link-type access

[LSW13-GigabitEthernet0/0/1]port default vlan 17

[LSW13-GigabitEthernet0/0/1]int g0/0/2

[LSW13-GigabitEthernet0/0/2]port link-type trunk

[LSW13-GigabitEthernet0/0/2]port trunk allow-pass vlan 10 20 17

[LSW13-GigabitEthernet0/0/2]int g0/0/3

[LSW13-GigabitEthernet0/0/3]port link-type trunk

[LSW13-GigabitEthernet0/0/3]port trunk allow-pass vlan 10 20 17

[LSW13-GigabitEthernet0/0/3]quit

[LSW13]int Eth-Trunk 1

[LSW13-Eth-Trunk1]trunkport GigabitEthernet 0/0/4 to 0/0/5

[LSW13-Eth-Trunk1]port link-type trunk

[LSW13-Eth-Trunk1]port trunk allow-pass vlan 10 20 17

[LSW14]vlan batch 10 20 18

[LSW14]int g0/0/1

[LSW14-GigabitEthernet0/0/1]port link-type access

[LSW14-GigabitEthernet0/0/1]port default vlan 18

[LSW14-GigabitEthernet0/0/1]int g0/0/2

[LSW14-GigabitEthernet0/0/2]port link-type trunk

[LSW14-GigabitEthernet0/0/2]port trunk allow-pass vlan 10 20 18

[LSW14-GigabitEthernet0/0/2]int g0/0/3

[LSW14-GigabitEthernet0/0/3]port link-type trunk

[LSW14-GigabitEthernet0/0/3]port trunk allow-pass vlan 10 20 18

[LSW14-GigabitEthernet0/0/3]quit

[LSW14]int Eth-Trunk 1

[LSW14-Eth-Trunk1]trunkport GigabitEthernet 0/0/4 to 0/0/5

[LSW14-Eth-Trunk1]port link-type trunk

[LSW14-Eth-Trunk1]port trunk allow-pass vlan 10 20 18

[LSW15]vlan batch 10 20

[LSW15]int g0/0/3

[LSW15-GigabitEthernet0/0/3]port link-type access

[LSW15-GigabitEthernet0/0/3]port default vlan 10

[LSW15-GigabitEthernet0/0/3]int g0/0/1

[LSW15-GigabitEthernet0/0/1]port link-type trunk

[LSW15-GigabitEthernet0/0/1]port trunk allow-pass vlan 10 20

[LSW15-GigabitEthernet0/0/1]int g0/0/2

[LSW15-GigabitEthernet0/0/2]port link-type trunk

[LSW15-GigabitEthernet0/0/2]port trunk allow-pass vlan 10 20

[LSW16]vlan batch 10 20

[LSW16]int g0/0/3

[LSW16-GigabitEthernet0/0/3]port link-type access

[LSW16-GigabitEthernet0/0/3]port default vlan 20

[LSW16-GigabitEthernet0/0/3]int g0/0/1

[LSW16-GigabitEthernet0/0/1]port link-type trunk

[LSW16-GigabitEthernet0/0/1]port trunk allow-pass vlan 10 20

[LSW16-GigabitEthernet0/0/1]int g0/0/2

[LSW16-GigabitEthernet0/0/2]port link-type trunk

[LSW16-GigabitEthernet0/0/2]port trunk allow-pass vlan 10 20

（2）配置MSTP：LSW13为vlan 10的主根、vlan 20的次根，LSW14为vlan 20的主根、vlan 10的次根

[LSW13]stp region-configuration

[LSW13-mst-region]region-name FB2

[LSW13-mst-region]revision-level 1

[LSW13-mst-region]instance 1 vlan 10

[LSW13-mst-region]instance 2 vlan 20

[LSW13-mst-region]active region-configuration

[LSW14]stp region-configuration

[LSW14-mst-region]region-name FB2

[LSW14-mst-region]revision-level 1

[LSW14-mst-region]instance 1 vlan 10

[LSW14-mst-region]instance 2 vlan 20

[LSW14-mst-region]active region-configuration

[LSW15]stp region-configuration

[LSW15-mst-region]region-name FB2

[LSW15-mst-region]revision-level 1

[LSW15-mst-region]instance 1 vlan 10

[LSW15-mst-region]instance 2 vlan 20

[LSW15-mst-region]active region-configuration

[LSW16]stp region-configuration

[LSW16-mst-region]region-name FB2

[LSW16-mst-region]revision-level 1

[LSW16-mst-region]instance 1 vlan 10

[LSW16-mst-region]instance 2 vlan 20

[LSW16-mst-region]active region-configuration

[LSW13]stp instance 1 priority 0

[LSW13]stp instance 2 priority 4096

[LSW14]stp instance 1 priority 4096

[LSW14]stp instance 2 priority 0

[LSW16-GigabitEthernet0/0/3]stp edged-port enable

[LSW15-GigabitEthernet0/0/3]stp edged-port enable

（3）配置vlan间路由

[LSW13]int Vlanif 10

[LSW13-Vlanif10]ip add 10.3.1.1 24

[LSW13-Vlanif10]int Vlanif 20

[LSW13-Vlanif20]ip add 10.3.2.1 24

[LSW13-Vlanif20]int Vlanif 10

[LSW13-Vlanif10]vrrp vrid 1 virtual-ip 10.3.1.254

[LSW13-Vlanif10]vrrp vrid 1 priority 200

[LSW13-Vlanif10]vrrp vrid 1 preempt-mode timer delay 60

[LSW13-Vlanif10]vrrp vrid 1 track interface g0/0/1 reduced 120

[LSW13-Vlanif10]int Vlanif 20

[LSW13-Vlanif20]vrrp vrid 2 virtual-ip 10.3.2.254

[LSW14]int Vlanif 10

[LSW14-Vlanif10]ip add 10.3.1.2 24

[LSW14-Vlanif10]int Vlanif 20

[LSW14-Vlanif20]ip add 10.3.2.2 24

[LSW14-Vlanif20]vrrp vrid 2 virtual-ip 10.3.2.254

[LSW14-Vlanif20]vrrp vrid 2 priority 200

[LSW14-Vlanif20]vrrp vrid 2 preempt-mode timer delay 60

[LSW14-Vlanif20]vrrp vrid 2 track interface GigabitEthernet 0/0/1 reduced 120

[LSW14-Vlanif20]int Vlanif 10

[LSW14-Vlanif10]vrrp vrid 1 virtual-ip 10.3.1.254

（4）配置全网路由

[LSW13]int Vlanif 17

[LSW13-Vlanif17]ip add 192.168.17.1 24

[LSW13-Vlanif17]quit

[LSW13]ospf 1 router-id 17.1.1.1

[LSW13-ospf-1]area 2

[LSW13-ospf-1-area-0.0.0.2]ne

[LSW13-ospf-1-area-0.0.0.2]network 192.168.17.0 0.0.0.255

[LSW13-ospf-1-area-0.0.0.2]network 10.3.1.0 0.0.0.255

[LSW13-ospf-1-area-0.0.0.2]network 10.3.2.0 0.0.0.255

[LSW13-ospf-1-area-0.0.0.2]qui

[LSW13-ospf-1]silent-interface Vlanif 10

[LSW13-ospf-1]silent-interface Vlanif 20

[LSW14]int Vlanif 18

[LSW14-Vlanif18]ip add 192.168.18.1 24

[LSW14-Vlanif18]quit

[LSW14]ospf 1 router-id 18.1.1.1

[LSW14-ospf-1]area 2

[LSW14-ospf-1-area-0.0.0.2]network 10.3.1.0 0.0.0.255

[LSW14-ospf-1-area-0.0.0.2]network 10.3.2.0 0.0.0.255

[LSW14-ospf-1-area-0.0.0.2]network 192.168.18.0 0.0.0.255

[LSW14-ospf-1-area-0.0.0.2]quit

[LSW14-ospf-1]silent-interface Vlanif 10

[LSW14-ospf-1]silent-interface Vlanif 20

[AR5]int g0/0/1

[AR5-GigabitEthernet0/0/1]ip add 192.168.17.6 24

[AR5-GigabitEthernet0/0/1]int g0/0/2

[AR5-GigabitEthernet0/0/2]ip add 192.168.18.6 24

[AR5-GigabitEthernet0/0/2]int g0/0/0

[AR5-GigabitEthernet0/0/0]ip add 50.1.1.6 24

[AR5]ospf 1 router-id 55.1.1.1

[AR5-ospf-1]area 2

[AR5-ospf-1-area-0.0.0.2]network 192.168.17.0 0.0.0.255

[AR5-ospf-1-area-0.0.0.2]network 192.168.18.0 0.0.0.255

[AR5]ip route-static 0.0.0.0 0.0.0.0 50.1.1.5

[AR5]ospf 1

[AR5-ospf-1]default-route-advertise

（5）源NAT地址转换

[AR5]acl 2000

[AR5-acl-basic-2000]rule permit source 10.3.0.0 0.0.255.255

[AR5]int g0/0/0

[AR5-GigabitEthernet0/0/0]nat outbound 2000

6.总校分校DSVPN配置：AR2作为hub端，AR4、AR5作为spoke端，三个接口配置在172.1.1.0网段

[AR2]int Tunnel 0/0/0

[AR2-Tunnel0/0/0]tunnel-protocol gre p2mp

[AR2-Tunnel0/0/0]ip add 172.1.1.1 24

[AR2-Tunnel0/0/0]source GigabitEthernet 0/0/2

[AR2-Tunnel0/0/0]nhrp entry multicast dynamic

[AR2-Tunnel0/0/0]ospf dr-priority 255 //调整优先级至最大，使其成为 DR

[AR4]int Tunnel 0/0/0

[AR4-Tunnel0/0/0]tunnel-protocol gre p2mp

[AR4-Tunnel0/0/0]ip add 172.1.1.3 24

[AR4-Tunnel0/0/0]source GigabitEthernet 0/0/0

[AR4-Tunnel0/0/0]nhrp entry 172.1.1.1 20.1.1.4 register

[AR4-Tunnel0/0/0]ospf network-type broadcast

[AR4-Tunnel0/0/0]ospf dr-priority 0

[AR5]int Tunnel 0/0/0

[AR5-Tunnel0/0/0]tunnel-protocol gre p2mp

[AR5-Tunnel0/0/0]ip add 172.1.1.2 24

[AR5-Tunnel0/0/0]source GigabitEthernet 0/0/0

[AR5-Tunnel0/0/0]nhrp entry 172.1.1.1 20.1.1.4 register

[AR5-Tunnel0/0/0]ospf network-type broadcast

[AR5-Tunnel0/0/0]ospf dr-priority 0

[AR2]ospf 1

[AR2-ospf-1]area 0

[AR2-ospf-1-area-0.0.0.0]network 172.1.1.0 0.0.0.255

[AR4]ospf 1

[AR4-ospf-1]area 0

[AR4-ospf-1-area-0.0.0.0]network 172.1.1.0 0.0.0.255

[AR5]ospf 1

[AR5-ospf-1]area 0

[AR5-ospf-1-area-0.0.0.0]network 172.1.1.0 0.0.0.255