华为：hcia综合实验

小白的孤独历险记2024-11-13 10:42

一、拓扑图

二、实验要求

  1. pc地址请自行规划，vlan已给出

  2. 服务器地址自行规划，vlan，网段已给出

  3. 交换机互联链路捆绑保证冗余性

  4. 内网pc网关集中于核心交换机，交换机vlan 40互联路由器

,地址网段已给出

5.配置静态路由实现内外网互通（内网主机在公网上使用公网地址访问外网）

内网有线无线用户以拨号的形式访问外网（PPPoE）

6.外网主机vlan、地址网段已给出，自行规划地址及网关

  1. 外网客户端可以访问内网FTP服务器(隐藏服务器内网地址)

8.利用基本ACL/高级ACL实现

pc1 不能访问服务器

pc3 不能访问pc4

注意：交换机也可以

调用ACL,可以使用traffic-filter 命令

  1. 无线部分配置要求：管理vlan100，业务vlan101

AC作为服务器，为AP分配地址，接口地址池

SW3作为服务器为用户分配地址，接口地址池

AP管理组、安全模板、域管理模板、SSID模板、VAP模板等请自行规划，

用户能正确获取地址并连接无线网络为准，AC建立CAPWAP隧道源接口地址为vlanfi接口

三、配置命令

AR4:

复制代码 
[ar4]dis cu 
[V200R003C00]
#
 sysname ar4
#
 board add 0/4 2SA 
#
 undo info-center enable
#
acl number 2000  
 rule 10 permit source 192.168.10.0 0.0.0.255 
 rule 20 permit source 192.168.20.0 0.0.0.255 
 rule 101 permit source 192.168.101.0 0.0.0.255 
#
aaa 
 authentication-scheme default
 authorization-scheme default
 accounting-scheme default
 domain default 
 domain default_admin 
 local-user admin password cipher %$%$K8m.Nt84DZ}e#<0`8bmE3Uw}%$%$
 local-user admin service-type http
#
 nat address-group 4 200.1.1.10 200.1.1.20
#
interface Serial4/0/0
 link-protocol ppp
 ppp chap user huawei
 ppp chap password cipher %$%$smyT5"wVxGLN>.Eku2fN,.^~%$%$
 ip address 200.1.1.1 255.255.255.0 
 nat server protocol tcp global 200.1.1.21 ftp inside 192.168.30.1 ftp
 nat outbound 2000 address-group 4 
#
interface Serial4/0/1
 link-protocol ppp
#
interface GigabitEthernet0/0/1
 ip address 10.1.1.2 255.255.255.0 
#
ip route-static 0.0.0.0 0.0.0.0 Serial4/0/0
ip route-static 192.168.10.0 255.255.255.0 10.1.1.1
ip route-static 192.168.20.0 255.255.255.0 10.1.1.1
ip route-static 192.168.30.0 255.255.255.0 10.1.1.1
ip route-static 192.168.100.0 255.255.255.0 10.1.1.1
ip route-static 192.168.101.0 255.255.255.0 10.1.1.1
#
return

S3:

复制代码 
[Sw3]dis cu 
#
sysname Sw3
#
undo info-center enable
#
vlan batch 10 20 30 40 100 to 101
#
dhcp enable
#
acl number 3000
 rule 10 deny ip source 192.168.10.1 0 destination 192.168.30.1 0
#
aaa
 authentication-scheme default
 authorization-scheme default
 accounting-scheme default
 domain default
 domain default_admin
 local-user admin password simple admin
 local-user admin service-type http
#
interface Vlanif1
#
interface Vlanif10
 ip address 192.168.10.254 255.255.255.0
 dhcp select interface
#
interface Vlanif20
 ip address 192.168.20.254 255.255.255.0
 dhcp select interface
#
interface Vlanif30
 ip address 192.168.30.254 255.255.255.0
 dhcp select interface
#
interface Vlanif40
 ip address 10.1.1.1 255.255.255.0
#
interface Vlanif101
 ip address 192.168.101.254 255.255.255.0
 dhcp select interface
#
interface MEth0/0/1
#
interface Eth-Trunk1
 port link-type trunk
 port trunk allow-pass vlan 10 100 to 101
#
interface Eth-Trunk2
 port link-type trunk
 port trunk allow-pass vlan 20 100 to 101
#
interface GigabitEthernet0/0/1
 port link-type access
 port default vlan 40
#
interface GigabitEthernet0/0/2
 port link-type access
 port default vlan 30
 traffic-filter outbound acl 3000
#
interface GigabitEthernet0/0/3
 eth-trunk 1
#
interface GigabitEthernet0/0/4
 eth-trunk 1
#
interface GigabitEthernet0/0/5
 eth-trunk 2
#
interface GigabitEthernet0/0/6
 eth-trunk 2
#
interface GigabitEthernet0/0/7
 port link-type trunk
 port trunk allow-pass vlan 100 to 101
#
interface GigabitEthernet0/0/8
#
ip route-static 0.0.0.0 0.0.0.0 10.1.1.2

#
return

AC:

复制代码 
[AC6605]dis cu 
#
vlan batch 100 to 101
#
dhcp enable
#
interface Vlanif100
 ip address 192.168.100.254 255.255.255.0
 dhcp select interface
#
interface GigabitEthernet0/0/1
 port link-type trunk
 port trunk allow-pass vlan 100 to 101
#
interface GigabitEthernet0/0/2
#
 undo info-center enable
#
capwap source interface vlanif100
#
wlan
 traffic-profile name default
 security-profile name default
 security-profile name wlan-net
  security wpa-wpa2 psk pass-phrase %^%#.],$1'A0v3fyOs28$.VWFo(}Xn*W@G&FB.*W!@V~
%^%# aes
 security-profile name default-wds
 security-profile name default-mesh
 ssid-profile name default
 ssid-profile name wlan-net
  ssid wlan-net
 vap-profile name default
 vap-profile name wlan-net
  forward-mode tunnel
  service-vlan vlan-id 101
  ssid-profile wlan-net
  security-profile wlan-net
 wds-profile name default
 mesh-handover-profile name default
 mesh-profile name default
 regulatory-domain-profile name default
 air-scan-profile name default
 rrm-profile name default
 radio-2g-profile name default
 radio-5g-profile name default
 wids-spoof-profile name default
 wids-profile name default
 wireless-access-specification
 ap-system-profile name default
 port-link-profile name default
 wired-port-profile name default
 serial-profile name preset-enjoyor-toeap 
 ap-group name default
 ap-group name ap-group1
  radio 0
   vap-profile wlan-net wlan 1
  radio 1
   vap-profile wlan-net wlan 1
 ap-id 1 type-id 61 ap-mac 00e0-fc39-4180 ap-sn 210235448310AD5CEC06
  ap-name area1
  ap-group ap-group1
 ap-id 2 type-id 61 ap-mac 00e0-fcf9-1830 ap-sn 2102354483102877682D
  ap-name area2
  ap-group ap-group1
 provision-ap
#
return

S7:

复制代码 
[s7]]dis cu 
#
sysname s7]
#
undo info-center enable
#
vlan batch 10 100 to 101
#
interface Vlanif1
#
interface MEth0/0/1
#
interface Eth-Trunk1
 port link-type trunk
 port trunk allow-pass vlan 10 100 to 101
#
interface GigabitEthernet0/0/1
 port link-type access
 port default vlan 10
#
interface GigabitEthernet0/0/2
 port link-type access
 port default vlan 10
#
interface GigabitEthernet0/0/3
 eth-trunk 1
#
interface GigabitEthernet0/0/4
 eth-trunk 1
#
interface GigabitEthernet0/0/5
 port link-type trunk
 port trunk pvid vlan 100
 port trunk allow-pass vlan 100 to 101
#
interface GigabitEthernet0/0/6
#
return

S8:

复制代码 
[s8]dis cu 
#
sysname s8
#
undo info-center enable
#
vlan batch 20 100 to 101
#
acl number 3001
 rule 10 deny ip source 192.168.20.3 0 destination 192.168.20.4 0
#
drop-profile default
#
aaa
 authentication-scheme default
 authorization-scheme default
 accounting-scheme default
 domain default
 domain default_admin
 local-user admin password simple admin
 local-user admin service-type http
#
interface Vlanif1
#
interface MEth0/0/1
#
interface Eth-Trunk2
 port link-type trunk
 port trunk allow-pass vlan 20 100 to 101
#
interface GigabitEthernet0/0/1
 port link-type access
 port default vlan 20
#
interface GigabitEthernet0/0/2
 port link-type access
 port default vlan 20
 traffic-filter outbound acl 3001
#
interface GigabitEthernet0/0/3
#
interface GigabitEthernet0/0/4
 port link-type trunk
 port trunk pvid vlan 100
 port trunk allow-pass vlan 100 to 101
#
interface GigabitEthernet0/0/5
 eth-trunk 2
#
interface GigabitEthernet0/0/6
 eth-trunk 2
#
interface GigabitEthernet0/0/7
#
interface NULL0
#
return

AR5:

复制代码 
[ar5]dis cu 
[V200R003C00]
#
 sysname ar5
#
 board add 0/4 2SA 
#
 undo info-center enable
#
dhcp enable
#
aaa 
 authentication-scheme default
 authorization-scheme default
 accounting-scheme default
 domain default 
 domain default_admin 
 local-user admin password cipher %$%$K8m.Nt84DZ}e#<0`8bmE3Uw}%$%$
 local-user admin service-type http
 local-user huawei password cipher %$%$"5_":.XY0UJ:+GUN5>^>>I#9%$%$
 local-user huawei privilege level 15
 local-user huawei service-type ppp
#
firewall zone Local
 priority 15
#
interface Serial4/0/0
 link-protocol ppp
 ppp authentication-mode chap 
 ip address 200.1.1.2 255.255.255.0 
#
interface Serial4/0/1
 link-protocol ppp
#
interface GigabitEthernet0/0/0
#
interface GigabitEthernet0/0/0.1
#
interface GigabitEthernet0/0/0.2
#
interface GigabitEthernet0/0/1
#
interface GigabitEthernet0/0/1.1
 dot1q termination vid 100
 ip address 172.16.100.254 255.255.255.0 
 arp broadcast enable
#
interface GigabitEthernet0/0/1.2
 dot1q termination vid 200
 ip address 172.16.200.254 255.255.255.0 
 arp broadcast enable
#
interface GigabitEthernet0/0/2
#
interface NULL0
#
ip route-static 0.0.0.0 0.0.0.0 Serial4/0/0
#
return

S6:

复制代码 
[s6]dis cu 
#
sysname s6
#
undo info-center enable
#
vlan batch 100 200
#
interface Vlanif1
#
interface MEth0/0/1
#
interface GigabitEthernet0/0/1
 port link-type trunk
 port trunk allow-pass vlan 100 200
#
interface GigabitEthernet0/0/2
 port link-type access
 port default vlan 100
#
interface GigabitEthernet0/0/3
 port link-type access
 port default vlan 200
#
interface GigabitEthernet0/0/4
#
interface GigabitEthernet0/0/5
#
interface NULL0
#
user-interface con 0
user-interface vty 0 4
#
return

完成过程可参照前面其他文章，文章仅为个人学习资料

相关推荐
KOYUELEC光与电子努力加油9 分钟前
JAE日本航空电子推出满足汽车市场小型防水最新需求的MX80系列连接器
服务器·科技·单片机·汽车
Zeku18 分钟前
虚拟机网络设置
网络·stm32·freertos·linux驱动开发·linux应用开发
攻城狮在此24 分钟前
华三交换机ACL配置（封禁内网高危端口）
网络·安全
123过去26 分钟前
hashid使用教程
linux·网络·测试工具·安全
cdprinter37 分钟前
信刻安全加密光盘，保障光盘保密安全
网络·安全·自动化
XZY0281 小时前
如何使用grpc
运维·服务器
rleS IONS1 小时前
SQL2000在win10上安装的方法
运维·服务器
xiaomo22491 小时前
javaee-网络原理2
网络
云边云科技_云网融合1 小时前
基于深度学习的设备监控技术：从被动报警到主动预警的革新
网络·人工智能·云计算
zly35001 小时前
centos7 sshd无法启动
linux·运维·服务器
热门推荐
01GitHub 镜像站点022026年3月AI领域大事件：DeepSeek引领开源风暴03Qwen3.5-Omni与Qwen3.6模型全面解析（含测评/案例/使用教程）04Claude Code + GLM4.7 避坑指南：解决 Unable to connect to Anthropic services05AI 编程效率翻倍：Superpowers Skills 上手清单 + 完整指南06UV安装并设置国内源07Mac 本地部署 OMLX + 通义千问 Qwen3.5-27B 保姆级教程08让 Trae IDE 智能体 “读懂”文档 Excel+PDF+DOCX ：mcp-documents-reader 工具使用指南09深扒 Claude Code Buddy 模式：一只仙人掌背后的确定性随机算法10如何解决 OpenClaw “Pairing required” 报错：两种官方解决方案详解