基于OSPF的企业内网安全优化

1.拓扑

2.IP地址规划

|------------------|-----------------|
| 设备/地址/vlan | 设备/地址 |
| 汇聚交换机/VLAN10 | 192.200.10.0/24 |
| 汇聚交换机/VLAN20 | 192.200.20.0/24 |
| 汇聚交换机/VLAN30 | 192.200.30.0/24 |
| 汇聚交换机/VLAN40 | 192.200.40.0/24 |
| 汇聚交换机/VLAN50 | 192.200.50.0/24 |
| 汇聚交换机/VLAN60 | 192.200.60.0/24 |
| 防火墙/VLAN70/服务器网段 | 192.200.70.0/24 |
| 防火墙/VLAN80/服务器网段 | 192.200.80.0/24 |

3.使用协议说明

VLAN-----------------隔离广播域,优化内网用户上网体验

SVI-------------Vlan间三层通信

DHCP---------------内网主机 自动获取IP地址

OSPF------------------提供内网路由的学习

MSTP--------------------多实例生成树,打破二层环路的同时,实现多vlan的负载均衡

VRRP------------------起到网关冗余作用

NAT--------------------地址转换,提供用户访问互联网

防火墙安全策略----------------------------提供安全策略的访问控制,以及高级的防病毒、入侵检测功能

链路聚合----------------提供链路带宽

4.设备选型

|----|-------|----|---------------------------|-----|-------------------------------------------------------------------|----|---|-------|----|--------------------------|---|----------------------------------------------------------------------|---|
| 序号 | 设备名称 | 品牌 | 规格 | 单位及 | 性能及指标 | 产地 |
| 序号 | 设备名称 | 品牌 | 型号 | 数量 | 性能及指标 | 产地 |
| 1 | 接入交换机 | 华为 | CloudEngine S5731-H24P4XC | 30 | S5731-H24P4XC(24个10/100/1000BASE-T以太网端口,4个万兆SFP+,单子卡槽位,PoE+,不含电源) | |
| 1 | 接入交换机 | 华为 | CloudEngine S5731-H24P4XC | 30 | S5731-H24P4XC(24个10/100/1000BASE-T以太网端口,4个万兆SFP+,单子卡槽位,PoE+,不含电源) | | 2 | 汇聚交换机 | 华为 | CloudEngine S6730-H24X6C | 2 | S6730-H24X6C(24个万兆SFP+,6个40GE QSFP28,可选license升级到6个100GE QSFP28,不含电源 | |
| 3 | 核心路由器 | 华为 | AR2204-24GE | 4 | AR2204-24GE(3GE WAN(1GE Combo),24 GE,1 USB,4 SIC,60W AC Power) | |
| 4 | 防火墙 | 华为 | Secospace USG6310S | 3 | USG6310S-W交流主机(8GE电,1GB内存),WIFI 2.4G+5G | |

5.网络配置实施

二层划分vlan、以及接口配置

interface Ethernet0/0/1

port link-type access

port default vlan 10

interface Ethernet0/0/2

port link-type access

port default vlan 10

interface Ethernet0/0/3

port link-type trunk

port trunk allow-pass vlan 2 to 4094

interface Ethernet0/0/4

port link-type trunk

port trunk allow-pass vlan 2 to 4094

interface Ethernet0/0/1

port link-type access

port default vlan 20

interface Ethernet0/0/2

port link-type access

port default vlan 20

interface Ethernet0/0/3

port link-type trunk

port trunk allow-pass vlan 2 to 4094

interface Ethernet0/0/4

port link-type trunk

port trunk allow-pass vlan 2 to 4094

interface Ethernet0/0/1

port link-type access

port default vlan 30

interface Ethernet0/0/2

port link-type access

port default vlan 30

interface Ethernet0/0/3

port link-type trunk

port trunk allow-pass vlan 2 to 4094

interface Ethernet0/0/4

port link-type trunk

port trunk allow-pass vlan 2 to 4094

interface Ethernet0/0/1

port link-type access

port default vlan 40

interface Ethernet0/0/2

port link-type access

port default vlan 40

interface Ethernet0/0/3

port link-type trunk

port trunk allow-pass vlan 2 to 4094

interface Ethernet0/0/4

port link-type trunk

port trunk allow-pass vlan 2 to 4094

interface Ethernet0/0/1

port link-type access

port default vlan 50

interface Ethernet0/0/2

port link-type access

port default vlan 50

interface Ethernet0/0/3

port link-type trunk

port trunk allow-pass vlan 2 to 4094

interface Ethernet0/0/4

port link-type trunk

port trunk allow-pass vlan 2 to 4094

interface Ethernet0/0/1

port link-type access

port default vlan 60

interface Ethernet0/0/2

port link-type access

port default vlan 60

interface Ethernet0/0/3

port link-type trunk

port trunk allow-pass vlan 2 to 4094

interface Ethernet0/0/4

port link-type trunk

port trunk allow-pass vlan 2 to 4094

双汇聚交换机上,进行三层SIV接口配置及路由器物理接口以及VRRP配置

汇聚交换机1:

Huawei\]int vlan 10 \[Huawei-Vlanif10\]ip add 192.200.10.1 255.255.255.0 \[Huawei-Vlanif10\]vrrp vrid 10 virtual-ip 192.200.10.254 \[Huawei-Vlanif10\] vrrp vrid 10 priority 120 \[Huawei-Vlanif10\]int vlan 20 \[Huawei-Vlanif20\]ip add 192.200.20.1 255.255.255.0 \[Huawei-Vlanif20\]vrrp vrid 20 virtual-ip 192.200.20.254 \[Huawei-Vlanif20\] vrrp vrid 20 priority 120 \[Huawei-Vlanif20\]int vlan 30 \[Huawei-Vlanif30\]ip add 192.200.30.1 255.255.255.0 \[Huawei-Vlanif30\]vrrp vrid 30 virtual-ip 192.200.30.254 \[Huawei-Vlanif30\] vrrp vrid 30 priority 120 \[Huawei-Vlanif30\]int vlan 40 \[Huawei-Vlanif40\]ip add 192.200.40.1 255.255.255.0 \[Huawei-Vlanif40\]vrrp vrid 40 virtual-ip 192.200.40.254 \[Huawei-Vlanif40\]int vlan 50 \[Huawei-Vlanif50\]ip add 192.200.50.1 255.255.255.0 \[Huawei-Vlanif50\]vrrp vrid 50 virtual-ip 192.200.50.254 \[Huawei-Vlanif50\]int vlan 60 \[Huawei-Vlanif60\]ip add 192.200.60.1 255.255.255.0 \[Huawei-Vlanif60\]vrrp vrid 60 virtual-ip 192.200.60.254 汇聚交换机2: \[Huawei\]int vlan 10 \[Huawei-Vlanif10\]ip add 192.200.10.2 255.255.255.0 \[Huawei-Vlanif10\]vrrp vrid 10 virtual-ip 192.200.10.254 \[Huawei-Vlanif10\]int vlan 20 \[Huawei-Vlanif20\]ip add 192.200.20.2 255.255.255.0 \[Huawei-Vlanif20\]vrrp vrid 20 virtual-ip 192.200.20.254 \[Huawei-Vlanif20\]int vlan 30 \[Huawei-Vlanif30\]ip add 192.200.30.2 255.255.255.0 \[Huawei-Vlanif30\]vrrp vrid 30 virtual-ip 192.200.30.254 \[Huawei-Vlanif30\]int vlan 40 \[Huawei-Vlanif40\]ip add 192.200.40.2 255.255.255.0 \[Huawei-Vlanif40\]vrrp vrid 40 virtual-ip 192.200.40.254 \[Huawei-Vlanif40\] vrrp vrid 40 priority 120 \[Huawei-Vlanif40\]int vlan 50 \[Huawei-Vlanif50\]ip add 192.200.50.2 255.255.255.0 \[Huawei-Vlanif50\]vrrp vrid 50 virtual-ip 192.200.50.254 \[Huawei-Vlanif50\] vrrp vrid 50 priority 120 \[Huawei-Vlanif50\]int vlan 60 \[Huawei-Vlanif60\]ip add 192.200.60.2 255.255.255.0 \[Huawei-Vlanif60\]vrrp vrid 60 virtual-ip 192.200.60.254 \[Huawei-Vlanif60\] vrrp vrid 60 priority 120 MSTP配置 stp region region-name Huawei instance 1 vlan 10 20 30 instance 2 vlan 40 50 60 active region-configuration 调整MSTP实例优先级 \[Huawei\]stp instance 1 root primary \[Huawei\]stp instance 2 root secondary 链路聚合配置 \[Huawei-Eth-Trunk0\]trunkport GigabitEthernet 0/0/23 to 0/0/24 \[Huawei-Eth-Trunk0\]port link-type t \[Huawei-Eth-Trunk0\]port trunk allow-pass vlan all DHCP配置 定义DHCP地址池: ip pool vlan10 network 192.200.10.0 mask 255.255.255.0 dns-list 114.114.114.114 gateway-list 192.200.10.254 ip pool vlan20 network 192.200.20.0 mask 255.255.255.0 dns-list 114.114.114.114 gateway-list 192.200.20.254 ip pool vlan30 network 192.200.30.0 mask 255.255.255.0 dns-list 114.114.114.114 gateway-list 192.200.30.254 ip pool vlan40 network 192.200.40.0 mask 255.255.255.0 dns-list 114.114.114.114 gateway-list 192.200.40.254 ip pool vlan50 network 192.200.50.0 mask 255.255.255.0 dns-list 114.114.114.114 gateway-list 192.200.50.254 ip pool vlan60 network 192.200.60.0 mask 255.255.255.0 dns-list 114.114.114.114 gateway-list 192.200.60.254 开启DHCP以及接口下调用 \[Huawei\] dhcp enable \[Huawei\] int vlan 10 \[Huawei-Vlanif10\] dhcp se g \[Huawei-Vlanif10\] int vlan 20 \[Huawei-Vlanif20\] dhcp se g \[Huawei-Vlanif20\] int vlan 30 \[Huawei-Vlanif30\] dhcp se g \[Huawei-Vlanif30\] int vlan 40 \[Huawei-Vlanif40\] dhcp se g \[Huawei-Vlanif40\] int vlan 50 \[Huawei-Vlanif50\] dhcp se g \[Huawei-Vlanif50\] int vlan 60 \[Huawei-Vlanif60\] dhcp se g 路由协议OSPF配置 ospf 1 area 0.0.0.0 network 10.0.0.0 0.0.255.255 area 0.0.0.1 network 192.200.0.0 0.0.255.255 配置OSPF优化,配置静默端口 \[Huawei-ospf-1\]silent-interface Vlanif 10 \[Huawei-ospf-1\]silent-interface Vlanif 20 \[Huawei-ospf-1\]silent-interface Vlanif 30 \[Huawei-ospf-1\]silent-interface Vlanif 40 \[Huawei-ospf-1\]silent-interface Vlanif 50 \[Huawei-ospf-1\]silent-interface Vlanif 60 核心层配置 \[Huawei\]ospf 1 \[Huawei-ospf-1\]a 0 \[Huawei-ospf-1-area-0.0.0.0\]network 10.0.0.0 0.0.255.255 出口防火墙配置安全策略 security-policy rule name ISP source-zone trust destination-zone untrust action permit 防火墙NAT策略 rule name ISP source-zone trust destination-zone untrust action source-nat easy-ip 防火墙做NAT SERVER 映射 \[USG6000V1\]nat server protocol tcp global 100.100.100.100 8080 inside 192.2 00.80.10 www 服务器区域防火墙配置 security-policy rule name server source-zone trust destination-zone dmz action permit # ## 6.网络测试 私信获取

相关推荐
Nuyoah11klay17 小时前
华清远见25072班网络编程day1
linux·服务器·网络·网络编程
liulilittle1 天前
OPENPPP2 —— IP标准校验和算法深度剖析:从原理到SSE2优化实现
网络·c++·网络协议·tcp/ip·算法·ip·通信
北极光SD-WAN组网1 天前
从0到1搭建某铝箔智慧工厂网络:5G与WiFi 6助力智能制造
网络·5g·制造
阿昭L1 天前
HTTP原理
网络·网络协议·http
hazy1k1 天前
STM32H750 RTC介绍及应用
网络·stm32·实时音视频
没书读了1 天前
考研复习-计算机网络-第三章-数据链路层
网络·计算机网络·考研
zhao3266857511 天前
2025年代理IP三强横评:LoongProxy、神龙海外动态IP代理、全民HTTP怎么选?看完这篇不踩坑
网络协议·tcp/ip·http
on the way 1231 天前
多线程之HardCodedTarget(type=OssFileClient, name=file, url=http://file)异常
网络·网络协议·http
WhoisXMLAPI1 天前
WhoisXML API再次荣登2025年美国Inc. 5000快速成长企业榜单
网络·安全
阿sir1981 天前
ZYNQ 自定义IP
服务器·网络·tcp/ip