HCIA复习实验

拓扑图

要求:

分析:

1.先对所有设备进行基础配置，配置好ip地址和网关及环回等

2.完成vlan配置，将pc1和pc2划分为vlan3,将client1划分为vlan2

3.完成学校内部的静态路由和R1和R2间的浮动静态路由

4.运营商内部使用rip动态路由协议

5.对R1和R6进行acl配置，完成私网和公网间的连接

6.在pc1和pc2的网关接口上完成对pc2的屏蔽

7.在R1上完成telnet配置

搭建

1.在R1和R6上完成缺省路由的补充

[AR1]ip route-static 0.0.0.0 0 13.0.0.2
[AR6]ip route-static 0.0.0.0 0 56.0.0.1

2.vlan配置

[sw1]vlan batch 2 3
[sw1]int g0/0/1
[sw1-GigabitEthernet0/0/1]port link-type access
[sw1-GigabitEthernet0/0/1]port default vlan 3
[sw1-GigabitEthernet0/0/1]int g0/0/2
[sw1-GigabitEthernet0/0/2]port link-type access
[sw1-GigabitEthernet0/0/2]port default vlan 3
[sw1-GigabitEthernet0/0/2]int g0/0/3
[sw1-GigabitEthernet0/0/3]port link-type access
[sw1-GigabitEthernet0/0/3]port default vlan 2
[sw1-GigabitEthernet0/0/3]int g0/0/4
[sw1-GigabitEthernet0/0/4]port link-type trunk
[sw1-GigabitEthernet0/0/4]port trunk allow-pass vlan 2 to 3
[AR2-GigabitEthernet0/0/0.2]int g0/0/0.3
[AR2-GigabitEthernet0/0/0.3]ip add 192.168.1.1 26
[AR2-GigabitEthernet0/0/0.3]int g0/0/0.2
[AR2-GigabitEthernet0/0/0.2]ip add 192.168.1.65 26

3.完成静态路由配置

[AR1]ip route-static 192.168.1.0 25 g0/0/1 192.168.1.129
[AR1]ip route-static 192.168.1.0 25 g0/0/0 192.168.1.193 preference 70
[AR2]ip route-static 0.0.0.0 0 192.168.1.130
[AR2]ip route-static 0.0.0.0 0 192.168.1.194 preference 70

4.运营商内部的rip配置

[AR4]rip 1
[AR4-rip-1]version 2
[AR4-rip-1]net 34.0.0.0
[AR4-rip-1]net 100.0.0.0
[AR3-LoopBack0]rip 1
[AR3-rip-1]version 2
[AR3-rip-1]net 13.0.0.0
[AR3-rip-1]net 35.0.0.0
[AR3-rip-1]net 34.0.0.0
[AR3-rip-1]net 3.0.0.0
[AR5]rip 1
[AR5-rip-1]version 2
[AR5-rip-1]net 35.0.0.0
[AR5-rip-1]net 56.0.0.0

5.对R1和R6进行acl配置

[AR1]acl 2000
[AR1-acl-basic-2000]rule permit source 192.168.1.0 0.0.0.255
[AR1-acl-basic-2000]int g0/0/2
[AR1-GigabitEthernet0/0/2]nat outbound 2000
[AR6]acl 2000
[AR6-acl-basic-2000]rule permit source 172.16.1.0 0.0.0.255
[AR6-acl-basic-2000]int g0/0/0
[AR6-GigabitEthernet0/0/0]nat outbound 2000
[AR6-GigabitEthernet0/0/0]nat server protocol tcp global current-interface 80 in
side 172.16.1.2 www
Warning:The port 80 is well-known port. If you continue it may cause function fa
ilure.
Are you sure to continue?[Y/N]:y

6.完成对pc2的屏蔽

[AR2]acl 3000
[AR2-acl-adv-3000]rule deny ip source 192.168.1.3 0 destination 3.3.3.1 0
[AR2-acl-adv-3000]int g0/0/0.3
[AR2-GigabitEthernet0/0/0.3]traffic-filter inbound acl 3000

7.在R1上完成telnet配置

[AR1]telnet server enable
[AR1]user-interface vty 0 4
[AR1-ui-vty0-4]authentication-mode aaa
[AR1-ui-vty0-4]quit
[AR1-aaa]local-user  hcip password cipher 123456
[AR1-aaa]local-user hcip service-type telnet 
[AR1-aaa]local-user hcip privilege level 15

结果

1.学校内客户端可以访问百度服务器

2.pc1可以访问,pc2不能访问3.3.3.0/24网段