一、实验拓扑

二、实验需求
1,内网Ip地址使用172.16.0.0/16分配
2,sw1和SW2之间互为备份
3, VRRP/STP/VLAN/Eth-trunk均使用
4,所有Pc均通过DHCP获取IP地址
5,ISP只能配置IP地址
6,所有电脑可以正常访问IsP路由器环回
三、需求分析
1、先在二层设备上创建VLAN,下面配置access口,交换机之间配置trunk
2、然后配置三层交换机,创建VLAN,干道之间配置trunk,SW1和SW2之间配置Eth-trunk聚合
3、在三层交换机SW1的g0/0/5口配置access,通过VLAN10,SW2的g0/0/5口配置access通过VLAN20
4、然后配置vlanif,创建vlanif1和vlanif2,然后IP add <地址>(SW1 上面配置vlanif10,SW2上面配置vlanif20)
5、配置R1,各个接口配置IP地址
6、配置ISP的IP地址和环回IP
7、所有交换机配置SMTP
8、准备根桥,连接PC的交换机需要做边缘端口的保护
9、在SW1和SW2上面配置vrrp,
10、做DHCP,分别在SW1和SW2的vlanif2\3上面激活DHCP
11、R1、SW1、SW2配置路由协议
12、内外网通信
四、实验步骤
1、二层设备上的VLAN配置
cs
#交换机3 上的配置
[SW3]vlan batch 2 to 3
交换机与客户端之间配置access
[SW3-GigabitEthernet0/0/1]p l a
[SW3-GigabitEthernet0/0/1]p d v 2
[SW3-GigabitEthernet0/0/2]p l a
[SW3-GigabitEthernet0/0/2]p d v 3
交换机之间配置trunk
[SW3]port-group group-member g0/0/3 g0/0/4
[SW3-port-group]p l t
[SW3-GigabitEthernet0/0/3]p l t
[SW3-GigabitEthernet0/0/4]p l t
[SW2-port-group]p t a v 2 3
[SW2-GigabitEthernet0/0/3]p t a v 2 3
[SW2-GigabitEthernet0/0/4]p t a v 2 3
#交换机4 上面的配置
[SW4]vlan batch 2 to 3
[SW4-GigabitEthernet0/0/1]p l a
[SW4-GigabitEthernet0/0/1]p d v 2
[SW4-GigabitEthernet0/0/2]p l a
[SW4-GigabitEthernet0/0/2]p d v 3
[SW4]port-group group-member g0/0/3 g0/0/4
[SW4-port-group]p l t
[SW4-GigabitEthernet0/0/3]p l t
[SW4-GigabitEthernet0/0/4]p l t
[SW4-port-group]p t a v 2 3
[SW4-GigabitEthernet0/0/3]p t a v 2 3
[SW4-GigabitEthernet0/0/4]p t a v 2 3
2、三层设备上面的VLAN配置
cs
#创建VLAN,干道之间配置trunk,SW1和SW2之间配置Eth-trunk聚合,与路由器接口配置access
[SW1]v b 2 3 10 20
[SW1]int Eth-Trunk 0
[SW1-Eth-Trunk0]trun
[SW1-Eth-Trunk0]trunkport g 0/0/1 0/0/2
[SW1]port-group group-member g0/0/3 to g0/0/4
[SW1-port-group]port link-type trunk
[SW1-GigabitEthernet0/0/3]port link-type trunk
[SW1-GigabitEthernet0/0/4]port link-type trunk
[SW1-port-group]p t a v 2 3
[SW1-GigabitEthernet0/0/3]p t a v 2 3
[SW1-GigabitEthernet0/0/4]p t a v 2 3
[SW1-Eth-Trunk0]int g0/0/5
[SW1-GigabitEthernet0/0/5]p l ac
[SW1-GigabitEthernet0/0/5]port default vlan 10
[SW2]v b 2 3 10 20
[SW2]int Eth-Trunk 0
[SW2-Eth-Trunk0]tru
[SW2-Eth-Trunk0]trunkport g 0/0/1 0/0/2
[SW2]port-group group-member g0/0/3 to g0/0/4
[SW2-port-group]p l trunk
[SW2-GigabitEthernet0/0/3]p l trunk
[SW2-GigabitEthernet0/0/4]p l trunk
[SW2-port-group]p t a v 2 3
[SW2-GigabitEthernet0/0/3]p t a v 2 3
[SW2-GigabitEthernet0/0/4]p t a v 2 3
[SW2-Eth-Trunk0]int g0/0/5
[SW2-GigabitEthernet0/0/5]p l ac
[SW2-GigabitEthernet0/0/5]port default vlan 20
3、配置IP
cs
#创建vlanif,配置IP
[SW1]interface Vlanif 2
[SW1-Vlanif2]ip add 172.16.0.1 26
[SW1-Vlanif2]int v 3
[SW1-Vlanif3]ip add 172.16.0.65 26
[SW1]int v 10
[SW1-Vlanif10]ip add 172.16.0.129 26
[SW2]int v 2
[SW2-Vlanif2]ip add 172.16.0.2 26
[SW2-Vlanif2]int v 3
[SW2-Vlanif3]ip add 172.16.0.66 26
[SW2-Vlanif20]ip add 172.16.0.193 26
#R1的IP配置
[R1-GigabitEthernet0/0/1]ip add 172.16.0.130 26
[R1-GigabitEthernet0/0/1]int g 0/0/2
[R1-GigabitEthernet0/0/2]ip add 172.16.0.194 26
[R1-GigabitEthernet0/0/2]int g 0/0/0
[R1-GigabitEthernet0/0/0]ip add 12.0.0.1 24
#ISP的IP配置
[ISP]int g 0/0/0
[ISP-GigabitEthernet0/0/0]ip add 12.0.0.2 24
[ISP-GigabitEthernet0/0/0]int l0
[ISP-LoopBack0]ip add 2.2.2.2 24

4、 所有交换机配置SMTP,准备根桥
cs
[SW1]stp enable
[SW1]stp mode mstp
[SW1]stp region-configuration
[SW1-mst-region]region-name aa
[SW1-mst-region]instance 1 vlan 2
[SW1-mst-region]instance 2 vlan 3
[SW1-mst-region]active region-configuration
[SW2]stp enable
[SW2]stp mode mstp
[SW2]stp region-configuration
[SW2-mst-region]region-name aa
[SW2-mst-region]instance 1 vlan 2
[SW2-mst-region]instance 2 vlan 3
[SW2-mst-region]active region-configuration
[SW3]stp enable
[SW3]stp mode mstp
[SW3]stp region-configuration
SW3-mst-region]region-name aa
[SW3-mst-region]instance 1 vlan 2
[SW3-mst-region]instance 2 vlan 3
[SW3-mst-region]active region-configuration
[SW4]stp enable
[SW4]stp mode mstp
[SW4]stp region-configuration
[SW4-mst-region]region-name aa
[SW4-mst-region]instance 1 vlan 2
[SW4-mst-region]instance 2 vlan 3
[SW4-mst-region]active region-configuration
准备根桥:
[SW1]stp instance 1 root primary
[SW2]stp instance 1 root secondary
[SW1]stp instance 2 root secondary
[SW2]stp instance 2 root primary
连有pc,需要做边缘端口的保护:
[SW3]port-group group-member GigabitEthernet 0/0/1 to 0/0/2
[SW3-port-group]stp edged-port enable
[SW3-GigabitEthernet0/0/1]stp edged-port enable
[SW3-GigabitEthernet0/0/2]stp edged-port enable
[SW3]stp bpdu-protection
[SW4]port-group group-member GigabitEthernet 0/0/1 to g 0/0/2
[SW4-port-group]stp enable
[SW4-GigabitEthernet0/0/1]stp enable
[SW4-GigabitEthernet0/0/2]stp enable
[SW4-port-group]stp edged-port enable
[SW4-GigabitEthernet0/0/1]stp edged-port enable
[SW4-GigabitEthernet0/0/2]stp edged-port enable
[SW4]stp bpdu-protection
然后通过dis stp bri检查
5、在SW1和SW2上面配置vrrp
cs
[SW1]int v 2
[SW1-Vlanif2]vrrp vrid 1 virtual-ip 172.16.0.62
[SW1-Vlanif2]vrrp vrid 1 priority 120
[SW1-Vlanif2]vrrp vrid 1 track interface g0/0/5 reduced 30
[SW1]int v 3
[SW1-Vlanif3]vrrp vrid 2 virtual-ip 172.16.0.126
[SW2]int v 2
[SW2-Vlanif2]vrrp vrid 1 virtual-ip 172.16.0.62
[SW2-Vlanif2]int v 3
[SW2-Vlanif3]vrrp vrid 2 virtual-ip 172.16.0.126
[SW2-Vlanif3]vrrp vrid 2 priority 120
[SW2-Vlanif3]vrrp vrid 2 track interface Vlanif 20 reduced 30
然后通过dis vrrp bri 去查看他的配置情况


6、做DHCP,分别在SW1和SW2的vlanif2\3上面激活DHCP
cs
[SW1]dhcp enable
[SW1]ip pool pool_vlan2
[SW1-ip-pool-pool_vlan2]network 172.16.0.0 mask 26
[SW1-ip-pool-pool_vlan2]gateway-list 172.16.0.62
[SW1-ip-pool-pool_vlan2]dns-list 8.8.8.8
[SW1]int vl 2
[SW1-Vlanif2]dhcp select global
[SW2]dhcp enable
[SW2]ip pool pool_vlan2
[SW2-ip-pool-pool_vlan2]network 172.16.0.0 mask 26
[SW2-ip-pool-pool_vlan2]gateway-list 172.16.0.62
[SW2-ip-pool-pool_vlan2]dns-list 8.8.8.8
[SW2-ip-pool-pool_vlan2]int v 2
[SW2-Vlanif2]dhcp select global
[SW1]ip pool pool_vlan3
[SW1-ip-pool-pool_vlan3]netw 172.16.0.64 mask 26
[SW1-ip-pool-pool_vlan3]gateway-list 172.16.0.126
[SW1-ip-pool-pool_vlan3]dns-list 8.8.8.8
[SW1]int v 3
[SW1-Vlanif3]dhcp select global
[SW2]ip pool pool_vlan3
[SW2-ip-pool-pool_vlan3]netw 172.16.0.64 mask 26
[SW2-ip-pool-pool_vlan3]gateway-list 172.16.0.126
[SW2-ip-pool-pool_vlan3]dns-list 8.8.8.8
[SW2-ip-pool-pool_vlan3]int v 3
[SW2-Vlanif3]dhcp select global
通过dis ip pool查看创建情况:


然后查看PC机是否获得地址:

7、R1、SW1、SW2配置路由协议
cs
[R1]ospf 1 router-id 1.1.1.1
[R1-ospf-1]area 0
[R1-ospf-1-area-0.0.0.0]ne
[R1-ospf-1-area-0.0.0.0]network 172.16.0.128 0.0.0.63
[R1-ospf-1-area-0.0.0.0]network 172.16.0.192 0.0.0.63
[SW1]ospf 1 router-id 2.2.2.2
[SW1-ospf-1]a 0
[SW1-ospf-1-area-0.0.0.0]ne 172.16.0.128 0.0.0.63
[SW1-ospf-1-area-0.0.0.0]ne 172.16.0.0 0.0.0.63
[SW1-ospf-1-area-0.0.0.0]ne 172.16.0.64 0.0.0.63
[SW2]ospf 1 router-id 3.3.3.3
[SW2-ospf-1]a 0
[SW2-ospf-1-area-0.0.0.0]ne 172.16.0.192 0.0.0.63
[SW2-ospf-1-area-0.0.0.0]ne 172.16.0.0 0.0.0.63
[SW2-ospf-1-area-0.0.0.0]ne 172.16.0.64 0.0.0.63
通过dis ospf peer bri 查看配置:


8、内外网通信
cs
[R1]ip route-static 0.0.0.0 0 12.0.0.2
[R1]acl 2000
[R1-acl-basic-2000]rule permit source 172.16.0.0 0.0.0.255
[R1]int g 0/0/0
[R1-GigabitEthernet0/0/0]nat outbound 2000
[R1]ospf 1
[R1-ospf-1]default-route-advertise--下发一条默认缺省
查看路由表:
五、实验结果
通过ping ISP路由器的环回接口进行测试:



