华为1000人校园实验记录

bash 复制代码
在这里插入代码片1000人校园区网设计
1、配置Eth-trunk实现链路冗余 vlan 900 管理WLAN
#接入SW8 操作:

sys
undo in en
sysname JR-SW8
int Eth-Trunk 1
mode lacp-static
trunkport g0/0/1 0/0/2
port link-type trunk 
port trunk allow-pass vlan 200 900
qu
vlan batch 200  900


port-g g eth 0/0/2 eth 0/0/3  #批量操作
port link-type access 
port default vlan 200 

#核心 SW1
sys
sysname HX_SW1
int Eth-Trunk 1
trunkport g 0/0/2  0/0/5
port link-type trunk
port trunk allow-pass vlan 200 900
qu
vlan batch 10 20 30 40 200 900


#接入 SW5
sys
sysname JR_SW5
vlan batch 10 900
port group g e0/0/2 e0/0/3  #批量配置
port link-type access
port default vlan 10

#上联口
int g 0/0/1 
port link-type trunk
port trunk allow-pass vlan 10 900
q

#接入SW6
sys
sysname JR_SW6
vlan batch 20 900
int e0/0/1
port link-type access
port default vlan20
q
int g0/0/1
port link-type trunk
port trunk allow-pass vlan 20 900

#汇聚SW2
sys
sysname HJ_SW2
vlan batch 10 20 900
int g0/0/2
port link-type trunk
port trunk allow-pass vlan  10 900

int g0/0/3
port-type trunk
port trunk allow-pass vlan 20 900

int g0/0/1
port link-type trunk
port trunk allow-pass vlan 10 20 900

#接入SW7
sys
sysname JR_SW7
undo in en
vlan batch 30 900
port-g g e0/0/1 to e0/0/22
port link-type access
port default vlan 30 

int g0/0/1
port link-type trunk
port trunk allow-pass vlan 30 900

#汇聚SW3
sys
sysname HJ_SW3
undo in en
vlan batch 30 900
qu
port-g g g0/0/1 g0/0/2
port link-type trunk
port trunk allow-pass vlan 30 900
qu

#接入SW9
sys
sysname JR_SW9
undo  in en
vlan batch 40 900
int e0/0/2
port link-type access
port default vlan 40
int g0/0/1   #上联口
port link-type trunk
port trunk allow-pass vlan 40 900
#汇聚SW4
sys
sysname HJ_SW4
vlan batch 40 900
port-g g g0/0/1 g0/0/2
port link-type trunk
port trunk allow-pass vlan 20 900
qu

#核心 SW1
vlan 800
int g0/0/0 
port link-type trunk
port trunk allow-pass vlan 10 20 900

int g0/0/3
port link-type trunk
port trunk allow-pass vlan 30 900

int g0/0/4
port link-type trunk 
port trunk allow-pass vlan 40 900

int g0/0/24
port link-type access
port default vlan 800
qu

#网关SIV配置
#核心SW1
int vlan 10
ip add 192.168.10.1 24
1000人校园区网设计
1、配置Eth-trunk实现链路冗余 vlan 900 管理WLAN
#接入SW8 操作:

sys
undo in en
sysname JR-SW8
int Eth-Trunk 1
mode lacp-static
trunkport g0/0/1 g/0/2
port link-type trunk vlan 
port trunk allow-pass vlan 200 900
qu
vlan batch 200  900


port-g g eth 0/0/2 eth 0/0/3  #批量操作
port link-type access 
port default vlan 200 

#核心 SW1
sys
sysname HX_SW1
int Eth-Trunk 1
trunkport g0/0/2 g0/0/5
port link-type trunk
port trunk allow-pass vlan 200 900
qu
vlan batch 10 20 30 40 200 900


#接入 SW5
sys
sysname JR_SW5
vlan batch 10 900
port group g e0/0/2 e0/0/3  #批量配置
port link-type access
port default vlan 10

#上联口
int g 0/0/1 
port link-type trunk
port trunk allow-pass vlan 10 900
q

#接入SW6
sys
sysname JR_SW6
vlan batch 20 900
int g0/0/1
port link-type access
port default vlan20
q
int g0/0/1
port link-type trunk
port trunk allow-pass vlan 20 900

#汇聚SW2
sys
sysname HJ_SW2
vlan batch 10 20 900
int g0/0/2
port link-type trunk
port allow-pass vlan  10 900

int g0/0/3
port-type trunk
port trunk allow-pass vlan 20 900

int g0/0/1
port link-type trunk
port trunk allow-pass vlan 10 20 900

#接入SW7
sys
sysname JR_SW7
undo in en
vlan batch 30 900
port-g g e0/0/1 to e0/0/22
port link-type access
port default vlan 30 

int g0/0/1
port link-type trunk
port trunk allow-pass vlan 30 900

#汇聚SW3
sys
sysname HJ_SW3
undo in en
vlan batch 30 900
qu
port-g g g0/0/1 g0/0/2
port link-type trunk
port trunk allow-pass vlan 30 900
qu

#接入SW9
sys
sysname JR_SW9
undo  in en
vlan batch 40 900
int e0/0/2
port link-type access
port default vlan 40
int g0/0/1   #上联口
port link-type trunk
port trunk allow-pass vlan 40 900
#汇聚SW4
sys
sysname HJ_SW4
vlan batch 40 900
port-g g g0/0/1 g0/0/2
port link-type trunk
port trunk allow-pass vlan 20 900
qu

#核心 SW1
vlan 800
int g0/0/0 
port link-type trunk
port trunk allow-pass vlan 10 20 900

int g0/0/3
port link-type trunk
port trunk allow-pass vlan 30 900

int g0/0/4
port link-type trunk 
port trunk allow-pass vlan 40 900

int g0/0/24
port link-type access
port default vlan 800
qu

#网关SIV配置
#核心SW1
int vlan 10
ip add 192.168.10.1 24
int vlan 20
ip add 192.168.20.1 24
int vlan 30
ip add 192.168.30.1 24
int vlan 40
ip add 192.168.40.1 24
int vlan 200
ip add 192.168.200.1 24
int vlan 800
ip add 192.168.254.2 24

#DHP配置
#核心SW1
DHCP enable
ip pool SYL_vlan10  #SYL_vlan10地址池名
network 192.168.10.0 mask 24
gateway-list 192.168.10.1
dns-list 114.114.114.114  8.8.8.8

ip pool SYL_vlan20  #SYL_vlan20地址池名
network 192.168.20.0 mask 24
gateway-list 192.168.20.1
dns-list 114.114.114.114  8.8.8.8

ip pool JXL_vlan30  #SYL_vlan10地址池名
network 192.168.30.0 mask 24
gateway-list 192.168.30.1
dns-list 114.114.114.114  8.8.8.8

ip pool XZL_vlan40  #SYL_vlan10地址池名
network 192.168.40.0 mask 24
gateway-list 192.168.40.1
dns-list 114.114.114.114  8.8.8.8

#配置select
int vlan 10
dhcp select global

int vlan 20
dhcp select global

int vlan 30
dhcp select global

int vlan 40
dhcp select global

#OSPF配置,先配置接口地址
#出口AR1配置
int g4/0/0
ip add 192.168.254.1 24

int g3/0/0
ip add 12.1.1.1 29

int g0/0/1
ip add 13.1.1.1 29

int g1/0/0
ip add 192.168.104.1 30

int g2/0/0
ip add 192.168.105.1 30
qu

#移动R6
sysname YD_R2
int e0/0/0
ip add 12.1.1.6 29
int loo 0
ip add 9.9.9.9 24
description baidu #描述
#联通
sysname LT_R3
int e0/0/0
ip add 13.1.1.6 29
int loo  0
ip add 9.9.9.9 24
#新校区1
sysname XXQ1_R4
int e0/0/1
ip add 192.168.104.2 30
int e0/0/0
ip add 192.168.100.1 24

#新校区2
sysname XXQ2_R5
int e0/0/0
ip add 192.168.105.2 30
int e0/0/1
ip add 192.168.150.1 24

#核心SW1
sys
ospf 1 route-id 1.1.1.1  # route 随便起
#宣告网段
area 0
network 192.168.200.0 0.0.0.255
network 192.168.10.0 0.0.0.255
network 192.168.20.0 0.0.0.255
network 192.168.30.0 0.0.0.255
network 192.168.40.0 0.0.0.255
network 192.168.254.0 0.0.0.255

#AR2 宣告网段
sys
ospf 1 route-id 2.2.2.2
area 0
network 192.168.254.0 0.0.0.255
network 192.168.104.1 0.0.0.0
network 192.168.105.1 0.0.0.0

#新校区1R4宣告
sys
ospf 1 route-id 4.4.4.4
area 0
network 192.168.104.2 0.0.0.0
network 192.168.100.1 0.0.0.0

#新校区2R5宣告
sys
ospf 1 route-id 5.5.5.5
area 0
network 192.168.105.2 0.0.0.0
network 192.168.150.1 0.0.0.0


#广域网出口选择
#核心SW1写个缺省路由
ip route-static 0.0.0.0 0 192.168.254.1
#出口AR1上配置
sys
ip route-static 0.0.0.0 0 12.1.1.6  #移动
ip route-static 0.0.0.0 0 13.1.1.6 preference 70  #优先级默认60改70,数值越小优先级越高 联通

#NAT配置,出口AR1上配置
acl 2000
rule 5 permit source 192.168.0.0 0.0.255.255
qu
int g3/0/0
nat server protocol tcp global curretn-intface www inside 192.168.200.10 www 
nat outbound 2000
int g0/0/1
nat server protocol tcp global curretn-intface www inside 192.168.200.10 www
nat outbound 2000

#telnet 配置
#规划管理
#管理vlan 900,管理IP 192.168.255.x/24
#核心255.1,汇聚SW2 255.2 汇聚SW3 255.3 汇聚SW4 255.4 
#接入SW5 255.5 接入SW6 255.6 接入SW7 255.7 接入SW8 255.8  

#核心SW1
sys
aaa 
local-user aa privilege level 3 password cipher 123  #设置本地用户aa, privilege level权限级别 3 
local-user aa service-type telnet  #服务类型为telnet
qu
user-interface vty 0 4   #同时允许5个人登录
protocol inbound telnet  #物理机运行telnet进来
telnet server enable
authentication-mode aaa  # 从aaa拿用户认证
int vlan 900
ip add 192.168.255.1 24
#汇聚SW8
sys
aaa 
local-user aa privilege level 3 password cipher 123  #设置本地用户aa, privilege level权限级别 3 
local-user aa service-type telnet  #服务类型为telnet
qu
user-interface vty 0 4   #同时允许5个人登录
protocol inbound telnet  #物理机运行telnet进来
telnet server enable
authentication-mode aaa  # 从aaa拿用户认证
int vlan 900
ip add 192.168.255.8 24
qu
ip route-static 0.0.0.0 192.168.255.1  #让管理流量拿来之后能够回去,所有的汇聚和接入必须做

#
#ACL访问控制链表
#财务服务器192.168.200.20
#核心SW1配置访问控制链表
acl 3000
rule 5 permit ip source 192.168.40.0 0.0.0.255 destination 192.168.200.20 0
rule 10 deny ip source any destination 192.168.200.20 0
int   Eth-Trunk1
traffic-filter outbound acl 3000

#禁止vlan20的员工访问外网
#出口AR1上配置
sys
acl 3001
rule permit ip destination 192.168.0.0 0.0.255.255
rule deny ip source 192.168.20.0 0.0.0.255
# 配置入方向口上
int g4/0/0
traffic-filter inbound acl 3001

#开启SNMP监控
snmp-agent sys-info version allo
snmp-agent community write 123
snmp-agent community read 456


#DHP配置
#核心SW1
DHCP enable
ip pool SYL_vlan10  #SYL_vlan10地址池名
network 192.168.10.0 mask 24
gateway-list 192.168.10.1
dns-list 114.114.114.114  8.8.8.8

ip pool SYL_vlan20  #SYL_vlan20地址池名
network 192.168.20.0 mask 24
gateway-list 192.168.20.1
dns-list 114.114.114.114  8.8.8.8

ip pool JXL_vlan30  #SYL_vlan10地址池名
network 192.168.30.0 mask 24
gateway-list 192.168.30.1
dns-list 114.114.114.114  8.8.8.8

ip pool XZL_vlan40  #SYL_vlan10地址池名
network 192.168.40.0 mask 24
gateway-list 192.168.40.1
dns-list 114.114.114.114  8.8.8.8

#配置select
int vlan 10
dhcp select global

int vlan 20
dhcp select global

int vlan 30
dhcp select global

int vlan 40
dhcp select global

#OSPF配置,先配置接口地址
#出口AR1配置
int g4/0/0
ip add 192.168.254.1 24

int g3/0/0
ip add 12.1.1.1 29

int g0/0/1
ip add 13.1.1.1 29

int g1/0/0
ip add 192.168.104.1 30

int g2/0/0
ip add 192.168.105.1 30
qu

#移动
sysname YD_R2
int e0/0/0
ip add 12.1.1.6 29
int loo 0
ip add 9.9.9.9 24
description baidu #描述
#联通
sysname LT_R3
int e0/0/0
ip add 13.1.1.6 29
loo  0
ip add 9.9.9.9 24
#新校区1
sysname XXQ1_R4
int e0/0/1
ip add 192.168.104.2 30
int e0/0/0
ip add 192.168.100.1 24

#新校区2
sysname XXQ2_R5
int e0/0/0
ip add 192.168.105.2 30
int e0/0/1
ip add 192.168.105.1 24

#核心SW1
sys
ospf 1 route-id 1.1.1.1  # route 随便起
#宣告网段
area 0
network 192.168.200.0 0.0.0.255
network 192.168.10.0 0.0.0.255
network 192.168.20.0 0.0.0.255
network 192.168.30.0 0.0.0.255
network 192.168.40.0 0.0.0.255
network 192.168.254.0 0.0.0.255

#AR2 宣告网段
sys
ospf 1 route-id 2.2.2.2
area 0
network 192.168.254.0 0.0.0.255
network 192.168.104.1 0.0.0.0
network 192.168.105.1 0.0.0.0

#新校区1R4宣告
sys
ospf 1 route-id 4.4.4.4
area 0
network 192.168.104.2 0.0.0.0
network 192.168.100.1 0.0.0.0

#新校区2R5宣告
sys
ospf 1 route-id 5.5.5.5
area 0
network 192.168.105.2 0.0.0.0
network 192.168.150.1 0.0.0.0


#广域网出口选择
#核心SW1写个缺省路由
sys
ip route-static 0.0.0.0 0 12.1.1.6  #移动
ip route-static 0.0.0.0 0 13.1.1.6 preference 70  #优先级默认60改70,数值越小优先级越高 联通

#NAT配置,出口AR1上配置
acl 2000
rule 5 permit source 192.168.0.0 0.0.255.255
qu
int g3/0/0
nat outbound 2000
int g 0/0/1p
int g3/0/0
nat server protocol tcp global curretn-intface www inside 192.168.200.10 www 
nat outbound 2000
int g0/0/1
nat server protocol tcp global curretn-intface www inside 192.168.200.10 www 
nat outbound 2000

#telnet 配置
#规划管理
#管理vlan 900,管理IP 192.168.255.x/24
#核心255.1,汇聚SW2 255.2 汇聚SW3 255.3 汇聚SW4 255.4 
#接入SW5 255.5 接入SW6 255.6 接入SW7 255.7 接入SW8 255.8  

#核心SW1
sys
aaa 
local-user aa privilege level 3 password cipher 123  #设置本地用户aa, privilege level权限级别 3 
local-user aa service-type telnet  #服务类型为telnet
qu
user-interface vty 0 4   #同时允许5个人登录
protocol inbound telnet  #物理机运行telnet进来
authentication-mode aaa 
q
telnet server enable
# 从aaa拿用户认证
int vlan 900
ip add 192.168.255.1 24
#汇聚SW8   #所有汇聚和接入都做
sys
aaa 
local-user aa privilege level 3 password cipher 123  #设置本地用户aa, privilege level权限级别 3 
local-user aa service-type telnet  #服务类型为telnet
qu
user-interface vty 0 4   #同时允许5个人登录
protocol inbound telnet  #物理机运行telnet进来

authentication-mode aaa  # 从aaa拿用户认证
int vlan 900
ip add 192.168.255.8 24
qu
telnet server enable
ip route-static 0.0.0.0 0 192.168.255.1  #让管理流量拿来之后能够回去,所有的汇聚和接入必须做

#
#ACL访问控制链表
#财务服务器192.168.200.20
#核心SW1配置访问控制链表
acl 3000
rule 5 permit ip source 192.168.40.0 0.0.0.255 destination 192.168.200.20 0
rule 10 deny ip source any destination 192.168.200.20 0
int   Eth-Trunk1
traffic-filter outbound acl 3000

#禁止vlan20的员工访问外网
#出口AR1上配置
sys
acl 3001
rule permit ip destination 192.168.0.0 0.0.255.255
rule deny ip source 192.168.20.0 0.0.0.255
# 配置入方向口上
int g4/0/0
traffic-filter inbound acl 3001

#开启SNMP监控
snmp-agent sys-info version allo
snmp-agent community write 123
snmp-agent community read 456
相关推荐
白帽黑客沐瑶2 天前
【网络安全就业】信息安全专业的就业前景(非常详细)零基础入门到精通,收藏这篇就够了
网络·安全·web安全·计算机·程序员·编程·网络安全就业
树码小子2 天前
Java网络编程:(socket API编程:TCP协议的 socket API -- 回显程序的服务器端程序的编写)
java·网络·tcp/ip
绿箭柠檬茶3 天前
Ubuntu 服务器配置转发网络访问
服务器·网络·ubuntu
real 13 天前
传输层协议UDP
网络·网络协议·udp
路由侠内网穿透3 天前
本地部署 GPS 跟踪系统 Traccar 并实现外部访问
运维·服务器·网络·windows·tcp/ip
喵手3 天前
玩转Java网络编程:基于Socket的服务器和客户端开发!
java·服务器·网络
徐子元竟然被占了!!3 天前
实验-基本ACL
网络
ftpeak3 天前
从零开始使用 axum-server 构建 HTTP/HTTPS 服务
网络·http·https·rust·web·web app
LabVIEW开发3 天前
LabVIEW气体污染无线监测
网络·labview·labview知识·labview功能·labview程序
error:(3 天前
【从零到公网】本地电脑部署服务并实现公网访问(IPv4/IPv6/DDNS 全攻略)
网络·智能路由器