文章
文章用户商铺文档快讯圈子网址导航

弹性路由网络设计 、 双出口Internet访问实现 、 设备远程管理 、 内网服务器发布 、 网络冗余方案实施

1 案例：园区网项目建设 – 网络冗余方案实施

1.1 需求

  1. 为了增强网关稳定性和冗余性，每个部门都使用了网关冗余技术
  2. 在交换机之间添加多根链路，提高链路稳定性，提高链路利用率
  3. 要求每个部门的主机互相访问时，使用的都是最优的转发路径

1.2 方案

使用eNSP搭建实验环境，如图-1所示。

弹性路由网络设计 、 双出口Internet访问实现 、 设备远程管理 、 内网服务器发布 、 网络冗余方案实施图-1

1.3 步骤

实现此案例需要按照如下步骤进行。[hidecontent type=”payshow”]

在SW5上配置 VLAN10/20/30/40的网关IP

  1. [SW5]interface vlanif 10
  2. [SW5–Vlanif10]ip address 192.168.10.252 24
  3. [SW5–Vlanif10]quit
  4. [SW5]interface vlanif 20
  5. [SW5–Vlanif20]ip address 192.168.20.252 24
  6. [SW5–Vlanif20]quit
  7. [SW5]interface vlanif 30
  8. [SW5–Vlanif30]ip address 192.168.30.252 24
  9. [SW5–Vlanif30]quit
  10. [SW5]interface vlanif 40
  11. [SW5–Vlanif40]ip address 192.168.40.252 24
  12. [SW5–Vlanif40]quit

在DHCP服务器上，排除SW5上的网关IP地址

  1. [DHCP]ip pool VLAN10
  2. [DHCP–ip–pool–VLAN10]excluded–ip–address 192.168.10.251
  3. [DHCP–ip–pool–VLAN10]quit
  4. [DHCP]ip pool VLAN20
  5. [DHCP–ip–pool–VLAN20]excluded–ip–address 192.168.20.251
  6. [DHCP–ip–pool–VLAN20]quit
  7. [DHCP]ip pool VLAN30
  8. [DHCP–ip–pool–VLAN30]excluded–ip–address 192.168.30.251
  9. [DHCP–ip–pool–VLAN30]quit
  10. [DHCP]ip pool VLAN40
  11. [DHCP–ip–pool–VLAN40]excluded–ip–address 192.168.40.251
  12. [DHCP–ip–pool–VLAN40]quit

配置VRRP，SW5是VLAN10/20的主网关，VLAN30/40的备份网关

  1. [SW5]interface Vlanif 10
  2. [SW5–Vlanif10]vrrp vrid 10 virtual–ip 192.168.10.254
  3. [SW5–Vlanif10]vrrp vrid 10 priority 200
  4. [SW5–Vlanif10]quit
  5. [SW5]interface Vlanif 20
  6. [SW5–Vlanif20]vrrp vrid 20 virtual–ip 192.168.20.254
  7. [SW5–Vlanif20]vrrp vrid 20 priority 200
  8. [SW5–Vlanif20]quit
  9. [SW5]interface Vlanif 30
  10. [SW5–Vlanif30]vrrp vrid 30 virtual–ip 192.168.30.254
  11. [SW5–Vlanif30]quit
  12. [SW5]interface Vlanif 40
  13. [SW5–Vlanif40]vrrp vrid 40 virtual–ip 192.168.40.254
  14. [SW5–Vlanif40]quit

配置 VRRP，SW6是VLAN30/40的主网关，VLAN10/20的备份网关

  1. [SW6]interface Vlanif 30
  2. [SW6–Vlanif30]vrrp vrid 30 virtual–ip 192.168.30.254
  3. [SW6–Vlanif30]vrrp vrid 30 priority 200
  4. [SW6–Vlanif30]quit
  6. [SW6]interface Vlanif 40
  7. [SW6–Vlanif40]vrrp vrid 40 virtual–ip 192.168.40.254
  8. [SW6–Vlanif40]vrrp vrid 40 priority 200
  9. [SW6–Vlanif40]quit
  11. [SW6]interface Vlanif 10
  12. [SW6–Vlanif10]vrrp vrid 10 virtual–ip 192.168.10.254
  13. [SW6–Vlanif10]quit
  15. [SW6]interface Vlanif 20
  16. [SW6–Vlanif20]vrrp vrid 20 virtual–ip 192.168.20.254
  17. [SW6–Vlanif20]quit

配置 SW5 为 DHCP中继，确保与 DHCP 服务器互通

  1. [SW5]dhcp enable
  2. [SW5]interface Vlanif 10
  3. [SW5–Vlanif10]dhcp select relay
  4. [SW5–Vlanif10]dhcp relay server–ip 192.168.66.1
  5. [SW5–Vlanif10]quit
  6. [SW5]interface Vlanif 20
  7. [SW5–Vlanif20]dhcp select relay
  8. [SW5–Vlanif20]dhcp relay server–ip 192.168.66.1
  9. [SW5–Vlanif20]quit
  10. [SW5]interface Vlanif 30
  11. [SW5–Vlanif30]dhcp select relay
  12. [SW5–Vlanif30]dhcp relay server–ip 192.168.66.1
  13. [SW5–Vlanif30]quit
  14. [SW5]interface Vlanif 40
  15. [SW5–Vlanif40]dhcp select relay
  16. [SW5–Vlanif40]dhcp relay server–ip 192.168.66.1
  17. [SW5–Vlanif40]quit
  19. [SW5]interface Vlanif 66 #确保SW5与DHCP服务器互通
  20. [SW5–Vlanif66]ip address 192.168.66.2 24
  21. [SW5–Vlanif66]quit

配置SW6的 vlanif 88，确保 VLAN30/40的PC可以访问 Web服务器

  1. [SW6]interface Vlanif 88
  2. [SW6–Vlanif88]ip address 192.168.88.2 24
  3. [SW6–Vlanif88]quit

配置MSTP，确保每个网段的PC互相访问时，数据转发路径最优

  1. [SW1]stp mode mstp
  2. [SW1]stp region–configuration
  3. [SW1–mst–region]region–name HCIP
  4. [SW1–mst–region]instance 10 vlan 10
  5. [SW1–mst–region]instance 20 vlan 20
  6. [SW1–mst–region]instance 30 vlan 30
  7. [SW1–mst–region]instance 40 vlan 40
  8. [SW1–mst–region]active region–configuration
  9. [SW1–mst–region]quit
  11. [SW2]stp mode mstp
  12. [SW2]stp region–configuration
  13. [SW2–mst–region]region–name HCIP
  14. [SW2–mst–region]instance 10 vlan 10
  15. [SW2–mst–region]instance 20 vlan 20
  16. [SW2–mst–region]instance 30 vlan 30
  17. [SW2–mst–region]instance 40 vlan 40
  18. [SW2–mst–region]active region–configuration
  19. [SW2–mst–region]quit
  21. [SW3]stp mode mstp
  22. [SW3]stp region–configuration
  23. [SW3–mst–region]region–name HCIP
  24. [SW3–mst–region]instance 10 vlan 10
  25. [SW3–mst–region]instance 20 vlan 20
  26. [SW3–mst–region]instance 30 vlan 30
  27. [SW3–mst–region]instance 40 vlan 40
  28. [SW3–mst–region]active region–configuration
  29. [SW3–mst–region]quit
  31. [SW4]stp mode mstp
  32. [SW4]stp region–configuration
  33. [SW4–mst–region]region–name HCIP
  34. [SW4–mst–region]instance 10 vlan 10
  35. [SW4–mst–region]instance 20 vlan 20
  36. [SW4–mst–region]instance 30 vlan 30
  37. [SW4–mst–region]instance 40 vlan 40
  38. [SW4–mst–region]active region–configuration
  39. [SW4–mst–region]quit
  41. [SW5]stp mode mstp
  42. [SW5]stp region–configuration
  43. [SW5–mst–region]region–name HCIP
  44. [SW5–mst–region]instance 10 vlan 10
  45. [SW5–mst–region]instance 20 vlan 20
  46. [SW5–mst–region]instance 30 vlan 30
  47. [SW5–mst–region]instance 40 vlan 40
  48. [SW5–mst–region]active region–configuration
  49. [SW5–mst–region]quit
  51. [SW6]stp mode mstp
  52. [SW6]stp region–configuration
  53. [SW6–mst–region]region–name HCIP
  54. [SW6–mst–region]instance 10 vlan 10
  55. [SW6–mst–region]instance 20 vlan 20
  56. [SW6–mst–region]instance 30 vlan 30
  57. [SW6–mst–region]instance 40 vlan 40
  58. [SW6–mst–region]active region–configuration
  59. [SW6–mst–region]quit
  61. [SW5]stp instance 10 priority 0 #配置SW5为 vlan10的根交换机
  62. [SW5]stp instance 20 priority 0 #配置SW5为 vlan20的根交换机
  63. [SW6]stp instance 30 priority 0 #配置SW6为 vlan30的根交换机
  64. [SW6]stp instance 40 priority 0 #配置SW6为 vlan40的根交换机

2 案例：园区网项目建设 – 弹性路由网络设计

2.1 需求

  1. 合理配置OSPF区域，确保各部门之间的互相访问
  2. 不同部门分别属于不同的OSPF区域，要求 web/dhcp 服务器所在的区域不能受到外部链路以及其他区域的链路的影响
  3. 在骨干区域中，设备之间能够快速建立邻接关系

2.2 方案

使用eNSP搭建实验环境，如图-2所示。

弹性路由网络设计 、 双出口Internet访问实现 、 设备远程管理 、 内网服务器发布 、 网络冗余方案实施图-2

2.3 步骤

实现此案例需要按照如下步骤进行。

1）现网中添加SW7和SW8，并增加 VLAN 15 和 16，与 R1 相连

  1. <Huawei>undo terminal monitor
  2. <Huawei>system–view
  3. [Huawei]sysname SW7
  4. [SW7]vlan batch 10 20 30 40 66 88 15 16
  5. [SW7]port–group group–member gi0/0/10 gi0/0/20 gi0/0/21
  6. [SW7–port–group]port link–type trunk
  7. [SW7–port–group]port trunk allow–pass vlan all
  8. [SW7–port–group]quit
  9. [SW7]interface GigabitEthernet 0/0/1
  10. [SW7–GigabitEthernet0/0/1]port link access
  11. [SW7–GigabitEthernet0/0/1]port default vlan 15
  12. [SW7–GigabitEthernet0/0/1]quit
  13. [SW7]stp mode mstp
  14. [SW7]stp region–configuration
  15. [SW7–mst–region]region–name HCIP
  16. [SW7–mst–region]instance 10 vlan 10
  17. [SW7–mst–region]instance 20 vlan 20
  18. [SW7–mst–region]instance 30 vlan 30
  19. [SW7–mst–region]instance 40 vlan 40
  20. [SW7–mst–region]active region–configuration
  21. [SW7–mst–region]quit
  23. <Huawei>undo terminal monitor
  24. <Huawei>system–view
  25. [Huawei]sysname SW8
  26. [SW8]vlan batch 10 20 30 40 66 88 15 16
  27. [SW8]port–group group–member gi0/0/10 gi0/0/20 gi0/0/21
  28. [SW8–port–group]port link–type trunk
  29. [SW8–port–group]port trunk allow–pass vlan all
  30. [SW8–port–group]quit
  31. [SW8]interface GigabitEthernet 0/0/2
  32. [SW8–GigabitEthernet0/0/1]port link access
  33. [SW8–GigabitEthernet0/0/1]port default vlan 16
  34. [SW8–GigabitEthernet0/0/1]quit
  35. [SW8]stp mode mstp
  36. [SW8]stp region–configuration
  37. [SW8–mst–region]region–name HCIP
  38. [SW8–mst–region]instance 10 vlan 10
  39. [SW8–mst–region]instance 20 vlan 20
  40. [SW8–mst–region]instance 30 vlan 30
  41. [SW8–mst–region]instance 40 vlan 40
  42. [SW8–mst–region]active region–configuration
  43. [SW8–mst–region]quit
  45. [SW1]vlan batch 15 16
  46. [SW2]vlan batch 15 16
  47. [SW3]vlan batch 15 16
  48. [SW4]vlan batch 15 16
  49. [SW5]vlan batch 15 16
  50. [SW6]vlan batch 15 16

2）配置SW5/6 与 SW7/8 的互联 Trunk 接口

  1. [SW5]port–group group–member gi0/0/20 gi0/0/21
  2. [SW5–port–group]port link–type trunk
  3. [SW5–port–group]port trunk allow–pass vlan all
  4. [SW5–port–group]quit
  6. [SW6]port–group group–member gi0/0/20 gi0/0/21
  7. [SW6–port–group]port link–type trunk
  8. [SW6–port–group]port trunk allow–pass vlan all
  9. [SW6–port–group]quit

3）配置R1的接口IP地址，并启用 OSPF以及优化接口网络类型

  1. <Huawei>undo terminal monitor
  2. <Huawei>system–view
  3. [Huawei]sysname R1
  5. [R1]interface GigabitEthernet 0/0/1
  6. [R1–GigabitEthernet0/0/1]ip address 192.168.15.1 24
  7. [R1–GigabitEthernet0/0/1]quit
  9. [R1]interface GigabitEthernet 0/0/2
  10. [R1–GigabitEthernet0/0/2]ip address 192.168.16.1 24
  11. [R1–GigabitEthernet0/0/2]quit
  13. [R1]ospf 1 router–id 1.1.1.1
  14. [R1–ospf-1]area 0
  15. [R1–ospf-1–area-0.0.0.0]network 192.168.15.0 0.0.0.255
  16. [R1–ospf-1–area-0.0.0.0]network 192.168.16.0 0.0.0.255
  17. [R1–ospf-1–area-0.0.0.0]quit
  19. [R1]interface GigabitEthernet 0/0/1
  20. [R1–GigabitEthernet0/0/1]ospf network–type p2p
  21. [R1–GigabitEthernet0/0/1]quit
  23. [R1]interface GigabitEthernet 0/0/2
  24. [R1–GigabitEthernet0/0/2]ospf network–type p2p
  25. [R1–GigabitEthernet0/0/2]quit

4）配置SW5/6的接口IP地址，并启用 OSPF以及优化接口网络类型

  1. [SW5]interface Vlanif 15
  2. [SW5–Vlanif15]ip address 192.168.15.5 24
  3. [SW5–Vlanif15]ospf network–type p2p
  4. [SW5–Vlanif15]quit
  6. [SW5]ospf 1 router–id 5.5.5.5
  7. [SW5–ospf-1]area 0
  8. [SW5–ospf-1–area-0.0.0.0]network 192.168.15.0 0.0.0.255
  9. [SW5–ospf-1–area-0.0.0.0]quit
  10. [SW5–ospf-1]area 10
  11. [SW5–ospf-1–area-0.0.0.10]network 192.168.10.0 0.0.0.255
  12. [SW5–ospf-1–area-0.0.0.10]quit
  13. [SW5–ospf-1]area 20
  14. [SW5–ospf-1–area-0.0.0.20]network 192.168.20.0 0.0.0.255
  15. [SW5–ospf-1–area-0.0.0.20]quit
  16. [SW5–ospf-1]area 30
  17. [SW5–ospf-1–area-0.0.0.30]network 192.168.30.0 0.0.0.255
  18. [SW5–ospf-1–area-0.0.0.30]quit
  19. [SW5–ospf-1]area 40
  20. [SW5–ospf-1–area-0.0.0.40]network 192.168.40.0 0.0.0.255
  21. [SW5–ospf-1–area-0.0.0.40]quit
  22. [SW5–ospf-1]area 88
  23. [SW5–ospf-1–area-0.0.0.88]network 192.168.88.0 0.0.0.255
  24. [SW5–ospf-1–area-0.0.0.88]stub no–summary
  25. [SW5–ospf-1–area-0.0.0.88]quit
  27. [SW6]interface Vlanif 16
  28. [SW6–Vlanif16]ip address 192.168.16.6 24
  29. [SW6–Vlanif16]ospf network–type p2p
  30. [SW6–Vlanif16]quit
  32. [SW6]ospf 1 router–id 6.6.6.6
  33. [SW6–ospf-1]area 0
  34. [SW6–ospf-1–area-0.0.0.0]network 192.168.16.0 0.0.0.255
  35. [SW6–ospf-1–area-0.0.0.0]quit
  36. [SW6–ospf-1]area 10
  37. [SW6–ospf-1–area-0.0.0.10]network 192.168.10.0 0.0.0.255
  38. [SW6–ospf-1–area-0.0.0.10]quit
  39. [SW6–ospf-1]area 20
  40. [SW6–ospf-1–area-0.0.0.20]network 192.168.20.0 0.0.0.255
  41. [SW6–ospf-1–area-0.0.0.20]quit
  42. [SW6–ospf-1]area 30
  43. [SW6–ospf-1–area-0.0.0.30]network 192.168.30.0 0.0.0.255
  44. [SW6–ospf-1–area-0.0.0.30]quit
  45. [SW6–ospf-1]area 40
  46. [SW6–ospf-1–area-0.0.0.40]network 192.168.40.0 0.0.0.255
  47. [SW6–ospf-1–area-0.0.0.40]quit
  48. [SW6–ospf-1]area 66
  49. [SW6–ospf-1–area-0.0.0.66]network 192.168.66.0 0.0.0.255
  50. [SW6–ospf-1–area-0.0.0.66]stub no–summary
  51. [SW6–ospf-1–area-0.0.0.66]quit

3 案例：园区网项目建设 – 双出口Internet访问实现

3.1 需求

  1. 公司有两个出口设备 R1 和 R2，R1是主出口，R2是备份出口
  2. 内网大量主机都需要访问 Internet ，要求使用最节省IP地址的方案
  3. 内网中财务部的主机属于敏感业务部门，不能访问互联

3.2 方案

使用eNSP搭建实验环境，如图-3所示。

弹性路由网络设计 、 双出口Internet访问实现 、 设备远程管理 、 内网服务器发布 、 网络冗余方案实施图-3

3.3 步骤

实现此案例需要按照如下步骤进行。

1）添加备份出口设备 R2，并通过 VLAN25/26 与SW5/6 建立 OSPF邻居

  1. <Huawei>undo terminal monitor
  2. <Huawei>system–view
  3. [Huawei]sysname R2
  5. [R2]interface GigabitEthernet 0/0/1
  6. [R2–GigabitEthernet0/0/1]ip address 192.168.25.2 24
  7. [R2–GigabitEthernet0/0/1]quit
  9. [R2]interface GigabitEthernet 0/0/2
  10. [R2–GigabitEthernet0/0/2]ip address 192.168.26.2 24
  11. [R2–GigabitEthernet0/0/2]quit
  13. [R2]ospf 1 router–id 2.2.2.2
  14. [R2–ospf-1]area 0
  15. [R2–ospf-1–area-0.0.0.0]network 192.168.25.0 0.0.0.255
  16. [R2–ospf-1–area-0.0.0.0]network 192.168.26.0 0.0.0.255
  17. [R2–ospf-1–area-0.0.0.0]quit
  19. [R2]interface GigabitEthernet 0/0/1
  20. [R2–GigabitEthernet0/0/1]ospf network–type p2p
  21. [R2–GigabitEthernet0/0/1]quit
  23. [R2]interface GigabitEthernet 0/0/2
  24. [R2–GigabitEthernet0/0/2]ospf network–type p2p
  25. [R2–GigabitEthernet0/0/2]quit

2）在交换机网络中添加 VLAN25/26

  1. [SW1]vlan batch 25 26
  2. [SW2]vlan batch 25 26
  3. [SW3]vlan batch 25 26
  4. [SW4]vlan batch 25 26
  5. [SW5]vlan batch 25 26
  6. [SW6]vlan batch 25 26
  7. [SW7]vlan batch 25 26
  8. [SW8]vlan batch 25 26
  10. [SW7]interface GigabitEthernet 0/0/2
  11. [SW7–GigabitEthernet0/0/2]port link access
  12. [SW7–GigabitEthernet0/0/2]port default vlan 25
  13. [SW7–GigabitEthernet0/0/2]quit
  15. [SW8]interface GigabitEthernet 0/0/1
  16. [SW8–GigabitEthernet0/0/1]port link access
  17. [SW8–GigabitEthernet0/0/1]port default vlan 26
  18. [SW8–GigabitEthernet0/0/1]quit

3）在SW5/6上通过 VLAN25/26 与 R2 建立 OSPF 邻居关系，优化OSPF

  1. [SW5]interface Vlanif 25
  2. [SW5–Vlanif25]ip address 192.168.25.5 24
  3. [SW5–Vlanif25]ospf network–type p2p
  4. [SW5–Vlanif25]quit
  5. [SW5]ospf 1
  6. [SW5–ospf-1]area 0
  7. [SW5–ospf-1–area-0.0.0.0]network 192.168.25.0 0.0.0.255
  8. [SW5–ospf-1–area-0.0.0.0]quit
  10. [SW6]interface Vlanif 26
  11. [SW6–Vlanif26]ip address 192.168.26.6 24
  12. [SW6–Vlanif26]ospf network–type p2p
  13. [SW6–Vlanif26]quit
  14. [SW6]ospf 1
  15. [SW6–ospf-1]area 0
  16. [SW6–ospf-1–area-0.0.0.0]network 192.168.26.0 0.0.0.255
  17. [SW6–ospf-1–area-0.0.0.0]quit

4）R1/R2配置默认路由访问外网，并通过 OSPF 下发给内网SW5/6

  1. [R1]interface GigabitEthernet 0/0/0
  2. [R1–GigabitEthernet0/0/0]ip address 100.1.1.1 24
  3. [R1–GigabitEthernet0/0/0]quit
  4. [R1]ip route–static 0.0.0.0 0 100.1.1.3 # 100.1.1.3是运营商设备的接口IP地址
  5. [R1]ospf 1
  6. [R1–ospf-1]default–route–advertise #产生OSPF默认路由，cost 为1
  7. [R1–ospf-1]quit
  9. [R2]interface GigabitEthernet 0/0/0
  10. [R2–GigabitEthernet0/0/0]ip address 200.1.1.2 24
  11. [R2–GigabitEthernet0/0/0]quit
  12. [R2]ip route–static 0.0.0.0 0 200.1.1.3 # 200.1.1.3是运营商设备的接口IP地址
  13. [R2]ospf 1
  14. [R2–ospf-1]default–route–advertise cost 10 #产生OSPF默认路由，cost为10
  15. [R2–ospf-1]quit

5）配置R1/R2的 ACL 和 NAT（EasyIP）

  1. [R1]acl 2000
  2. [R1–acl–basic-2000]rule 10 deny source 192.168.40.0 0.0.0.255
  3. [R1–acl–basic-2000]rule 20 permit source any
  4. [R1–acl–basic-2000]quit
  5. [R1]interface GigabitEthernet 0/0/0
  6. [R1–GigabitEthernet0/0/0]nat outbound 2000
  7. [R1–GigabitEthernet0/0/0]quit
  9. [R2]acl 2000
  10. [R2–acl–basic-2000]rule 10 deny source 192.168.40.0 0.0.0.255
  11. [R2–acl–basic-2000]rule 20 permit source any
  12. [R2–acl–basic-2000]quit
  13. [R2]interface GigabitEthernet 0/0/0
  14. [R2–GigabitEthernet0/0/0]nat outbound 2000
  15. [R2–GigabitEthernet0/0/0]quit

6）配置运营商的设备以及测试设备

  1. <Huawei>undo terminal monitor
  2. <Huawei>system–view
  3. [Huawei]sysname DianXin
  4. [DianXin]interface GigabitEthernet 0/0/1
  5. [DianXin–GigabitEthernet0/0/1]ip address 100.1.1.3 24
  6. [DianXin–GigabitEthernet0/0/1]quit
  7. [DianXin]interface GigabitEthernet 0/0/2
  8. [DianXin–GigabitEthernet0/0/1]ip address 200.1.1.3 24
  9. [DianXin–GigabitEthernet0/0/1]quit
  10. [DianXin]interface GigabitEthernet 0/0/0
  11. [DianXin–GigabitEthernet0/0/1]ip address 110.1.1.254 24
  12. [DianXin–GigabitEthernet0/0/1]quit
  14. Client1:
  15. 110.1.1.11
  16. 255.255.255.0
  17. 110.1.1.254

4 案例：园区网项目建设 – 内网服务器发布

4.1 需求

  1. 内网中 的 web 服务器，可以被互联网设备访问
  2. 内网中 的 交换机设备，可以被互联网设备远程访问

4.2 方案

使用eNSP搭建实验环境，如图-4所示。

弹性路由网络设计 、 双出口Internet访问实现 、 设备远程管理 、 内网服务器发布 、 网络冗余方案实施图-4

4.3 步骤

实现此案例需要按照如下步骤进行。

配置 Web服务器IP，开启Web服务

在边界设备 R1 配置 NAT Server

  1. [R1]interface GigabitEthernet 0/0/0
  2. [R1–GigabitEthernet0/0/0] nat server protocol tcp global 100.1.1.100 2008 inside 192.168.88.1 80
  4. [R2]interface GigabitEthernet 0/0/0
  5. [R2–GigabitEthernet0/0/0] nat server protocol tcp global 200.1.1.200 2008 inside 192.168.88.1 80

5 案例：园区网项目建设 – 设备远程管理

5.1 需求

  1. 为内网中的交换机单独划分一个IP网段，作为设备的管理IP地址
  2. 内网中的 交换机设备的远程用户名和密码为：HuaWei / HCIE
  3. 内网用户中，只有技术部的 PC-2 可以远程登录内网的所有设备

5.2 方案

使用eNSP搭建实验环境，如图-5所示。

弹性路由网络设计 、 双出口Internet访问实现 、 设备远程管理 、 内网服务器发布 、 网络冗余方案实施图-5

5.3 步骤

实现此案例需要按照如下步骤进行。

1）在交换机上配置管理 vlan 199，并设置管理IP地址，开启远程登录功能

  1. [SW1]vlan 199
  2. [SW1–vlan199]quit
  3. [SW1]interface vlanif 199
  4. [SW1–Vlanif199]ip address 192.168.199.1 24
  5. [SW1–Vlanif199]quit
  6. [SW1]aaa
  7. [SW1–aaa]local–user HuaWei password cipher HCIE
  8. [SW1–aaa]local–user HuaWei service–type telnet
  9. [SW1–aaa]quit
  10. [SW1]user–interface vty 0 4
  11. [SW1–ui–vty0-4]authentication–mode aaa
  12. [SW1–ui–vty0-4]quit
  14. [SW2]vlan 199
  15. [SW2–vlan199]quit
  16. [SW2]interface vlanif 199
  17. [SW2–Vlanif199]ip address 192.168.199.2 24
  18. [SW2–Vlanif199]quit
  19. [SW2]aaa
  20. [SW2–aaa]local–user HuaWei password cipher HCIE
  21. [SW2–aaa]local–user HuaWei service–type telnet
  22. [SW2–aaa]quit
  23. [SW2]user–interface vty 0 4
  24. [SW2–ui–vty0-4]authentication–mode aaa
  25. [SW2–ui–vty0-4]quit
  27. [SW3]vlan 199
  28. [SW3–vlan199]quit
  29. [SW3]interface vlanif 199
  30. [SW3–Vlanif199]ip address 192.168.199.3 24
  31. [SW3–Vlanif199]quit
  32. [SW3]aaa
  33. [SW3–aaa]local–user HuaWei password cipher HCIE
  34. [SW3–aaa]local–user HuaWei service–type telnet
  35. [SW3–aaa]quit
  36. [SW3]user–interface vty 0 4
  37. [SW3–ui–vty0-4]authentication–mode aaa
  38. [SW3–ui–vty0-4]quit
  40. [SW4]vlan 199
  41. [SW4–vlan199]quit
  42. [SW4]interface vlanif 199
  43. [SW4–Vlanif199]ip address 192.168.199.4 24
  44. [SW4–Vlanif199]quit
  45. [SW4]aaa
  46. [SW4–aaa]local–user HuaWei password cipher HCIE
  47. [SW4–aaa]local–user HuaWei service–type telnet
  48. [SW4–aaa]quit
  49. [SW4]user–interface vty 0 4
  50. [SW4–ui–vty0-4]authentication–mode aaa
  51. [SW4–ui–vty0-4]quit
  53. [SW5]vlan 199
  54. [SW5–vlan]quit
  56. [SW6]vlan 199
  57. [SW6–vlan]quit
  59. [SW7]vlan 199
  60. [SW7–vlan]quit
  62. [SW8]vlan 199
  63. [SW8–vlan]quit

2）配置 vlan 199 的网关冗余，将SW5配置为主网关，SW6配置为备份网关

  1. [SW5]interface vlanif 199
  2. [SW5–Vlanif199]ip address 192.168.199.251 24
  3. [SW5–Vlanif199]vrrp vrid 199 virtual–ip 192.168.199.254
  4. [SW5–Vlanif199]vrrp vrid 199 priority 200
  5. [SW5–Vlanif199]quit
  7. [SW6]interface vlanif 199
  8. [SW6–Vlanif199]ip address 192.168.199.252 24
  9. [SW6–Vlanif199]vrrp vrid 199 virtual–ip 192.168.199.254
  10. [SW6–Vlanif199]quit

3）为每个交换机添加默认路由，指向 vlan 199 的虚拟网关

  1. [SW1]ip route–static 0.0.0.0 0.0.0.0 192.168.199.254
  2. [SW2]ip route–static 0.0.0.0 0.0.0.0 192.168.199.254
  3. [SW3]ip route–static 0.0.0.0 0.0.0.0 192.168.199.254
  4. [SW4]ip route–static 0.0.0.0 0.0.0.0 192.168.199.254

4）在SW5和SW6的OSPF协议中，宣告 vlan199 ，通告给 R1和R2

  1. [SW5]ospf 1
  2. [SW5–ospf-1]area 199
  3. [SW5–ospf-1–area-0.0.0.199]network 192.168.199.0 0.0.0.255
  4. [SW5–ospf-1–area-0.0.0.199]quit
  6. [SW6]ospf 1
  7. [SW6–ospf-1]area 199
  8. [SW6–ospf-1–area-0.0.0.199]network 192.168.199.0 0.0.0.255
  9. [SW6–ospf-1–area-0.0.0.199]quit

5）在边界设备调整 OSPF cost，确保去往 vlan199 时，优先走 SW5的路径

  1. [R1]interface GigabitEthernet 0/0/2
  2. [R1–GigabitEthernet0/0/2]ospf cost 6
  3. [R1–GigabitEthernet0/0/2]quit
  5. [R2]interface GigabitEthernet 0/0/1
  6. [R2–GigabitEthernet0/0/1]ospf cost 6
  7. [R2–GigabitEthernet0/0/1]quit

6）在边界设备配置 NAT server，确保外网可以远程登录内网交换机

  1. [R1]interface GigabitEthernet 0/0/0
  2. [R1–GigabitEthernet0/0/0]nat server protocol tcp global 100.1.1.100 2001 inside 192.168.199.1 23
  3. [R1–GigabitEthernet0/0/0]nat server protocol tcp global 100.1.1.100 2002 inside 192.168.199.2 23
  4. [R1–GigabitEthernet0/0/0]nat server protocol tcp global 100.1.1.100 2003 inside 192.168.199.3 23
  5. [R1–GigabitEthernet0/0/0]nat server protocol tcp global 100.1.1.100 2004 inside 192.168.199.4 23
  7. [R2]interface GigabitEthernet 0/0/0
  8. [R2–GigabitEthernet0/0/0]nat server protocol tcp global 200.1.1.200 2001 inside 192.168.199.1 23
  9. [R2–GigabitEthernet0/0/0]nat server protocol tcp global 200.1.1.200 2002 inside 192.168.199.2 23
  10. [R2–GigabitEthernet0/0/0]nat server protocol tcp global 200.1.1.200 2003 inside 192.168.199.3 23
  11. [R2–GigabitEthernet0/0/0]nat server protocol tcp global 200.1.1.200 2004 inside 192.168.199.4 23

7）确保内网用户中，只有 PC2 可以远程登录内网设备

  1. [DHCP–Server]ip pool VLAN20
  2. [DHCP–Server–ip–pool–VLAN20]static–bind ip–address 192.168.20.2 mac–address 5489–98F0–74FC # 后面是PC的 MAC地址
  4. [SW1]acl 2000
  5. [SW1–acl–basic-2000]rule 10 permit source 192.168.20.2 0.0.0.255
  6. [SW1–acl–basic-2000]rule 20 permit source 110.1.1.11 0.0.0.0
  7. [SW1–acl–basic-2000]quit
  8. [SW1]user–interface vty 0 4
  9. [SW1–ui–vty0-4]acl 2000 inbound
  10. [SW1–ui–vty0-4]quit
  11. [SW1]
  13. [SW2]acl 2000
  14. [SW2–acl–basic-2000]rule 10 permit source 192.168.20.2 0.0.0.255
  15. [SW2–acl–basic-2000]rule 20 permit source 110.1.1.11 0.0.0.0
  16. [SW2–acl–basic-2000]quit
  17. [SW2]user–interface vty 0 4
  18. [SW2–ui–vty0-4]acl 2000 inbound
  19. [SW2–ui–vty0-4]quit
  20. [SW2]
  22. [SW1]acl 2000
  23. [SW3–acl–basic-2000]rule 10 permit source 192.168.20.2 0.0.0.255
  24. [SW3–acl–basic-2000]rule 20 permit source 110.1.1.11 0.0.0.0
  25. [SW3–acl–basic-2000]quit
  26. [SW3]user–interface vty 0 4
  27. [SW3–ui–vty0-4]acl 2000 inbound
  28. [SW3–ui–vty0-4]quit
  29. [SW3]
  31. [SW4]acl 2000
  32. [SW4–acl–basic-2000]rule 10 permit source 192.168.20.2 0.0.0.255
  33. [SW4–acl–basic-2000]rule 20 permit source 110.1.1.11 0.0.0.0
  34. [SW4–acl–basic-2000]quit
  35. [SW4]user–interface vty 0 4
  36. [SW4–ui–vty0-4]acl 2000 inbound
  37. [SW4–ui–vty0-4]quit
  38. [SW4][/hidecontent]

给TA打赏
共{{data.count}}人
人已打赏
华为数通

园区网需求分析 、 园区网项目流程 、 技术方案选型 、 服务器部署 、 网络拓扑绘制 、 基础交换网络设计

2021-12-28 13:06:56

华为数通网络随笔

STP生成树协议实战

2023-8-31 15:26:20

0 条回复 A文章作者 M管理员
    暂无讨论，说说你的看法吧
❯

解锁会员权限

开通会员

解锁海量优质VIP资源

立刻开通
个人中心
购物车
优惠劵
今日签到
有新私信 私信列表
搜索

  • 扫码打开当前页

返回顶部