实验三 综合性训练（搭建中小企业园区网）

实验三  综合性训练（搭建中小企业园区网）

  一、实验目的： 

1.通过对网络设备的连通和对拓扑的分析，加深对常见典型局域网拓扑的理解； 

2.通过路由建立起网络之间的连接，了解网络路由的设计与配置；

3.进一步熟悉交换机、路由器的基本操作命令。

二、项目背景：

以企业为计划建设自己的企业园区网络，希望对通过新建的网络提供一个安全可靠可扩展性以及高效的网络环境，将两个办公地点连接在一起，使企业内能够实现方便快捷的网络资源共享。 企业有两个办公地点A和B，且相距较远。A办公地点具有较多的部门，综合部、财务部、业务部，为主要的办公场所，因此这部分的交换网络对可用性和可靠性要求较高。现有其中三个部门的连通方式以及网络连通的验证。

三、实验设备：

计算机、二层交换机、路由器、外网服务器

四、实验拓扑图：

 

 

五、实验过程：

1在4台交换机上创建vlan10/20/30

Switch>en

Switch#config

Configuring from terminal, memory, or network [terminal]?

Enter configuration commands, one per line.End with CNTL/Z.

Switch(config)#

Switch(config)#vlan 10

switch(config-vlan)#name 1

Switch(config-vlan)#exit

Switch(config)#vlan 20

switch(config-vlan)#name 2

Switch(config-vlan)#exit

Switch(config)#vlan 20

Switch(config-vlan)#exit

switch(config)#vlan 30

switch(config-vlan)#name 3

Switch(config-vlan)#exit

Switch(config)#

 

2在交换机s2_01,s2_02（二层交换机）上分别将6-10端口，11-15端口，16-20端口分别划分到vlan10，20，30中

Switch#conf t

Enter configuration commands, one per line. End with CNTL/Z.

Switch(config)#int range fa0/6-10

Switch(config-if-range)#switchport mode access

Switch(config-if-range)#switchport access vlan 10

Switch(config-if-range)#exit

Switch(config)#int range fa0/11-15

Switch(config-if-range)#switchport mode access

Switch(config-if-range)#switchport access vlan 20

Switch(config-if-range)#exit

Switch(config)#int range fa0/16-20

Switch(config-if-range)#switchport mode access

Switch(config-if-range)#switchport access vlan 30

Switch(config-if-range)#exit

Switch(config)#

 

 

3把s2_01,s2_02连s3_01,s3_02的端口设置都为Trunk模式

Switch>enable

Switch#conf t

Enter configuration commands, one per line.End with CNTL/Z.

Switch(config)#interface FastEthernet0/1

Switch(config-if)#switchport mode trunk

Switch(config-if)#

LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/1, changed state to down

LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/1, changed state to up

Switch(config-if)#exit

Switch(config)#interface FastEthernet0/2

Switch(config-if)#switchport mode trunk

Switch(config-if)#

LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/2, changed state to down

LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/2, changed state to up

Switch(config-if)#

 

4将两台三层交换机之间的fa0/3,fa0/4端口配置为聚合端口 两台三层交换机

Switch>enable

switch#int range fa0/1-2

%Invalid input detected at '^' marker.

switch#conf t

Enter configuration commands, one per line.End with CNTL/Z.

Switch(config)#int range fa0/1-2

Switch(config-if-range)#channel-group 1 mode on

Switch(config-if-range)#

Creating a port-channel interface Port-channel 1

LINK-5-CHANGED: Interface Port-channell, changed state to up

LINEPROTO-5-UPDOWN: Line protocol on Interface Port-channell, changed state to up

Switch(config-if-range)#exit

Switch(config)#int port-channel 1

Switch(config-if)#switchport mode trunk

Command rejected: An interface whose trunk encapsulation is "Auto" can not be configured to"trunk" mode.

switch(config-if)#exit

 

5在四台交换机上配置RSTP

Switch>en

switch#config

Configuring from terminal, memory, or network [terminal]?

Enter configuration commands, one per line. End with CNTL/Z.

Switch(config)#spanning-tree mode pvst

Switch(config)#

 

Switch#config

Configuring from terminal, memory, or network [terminal]?

Enter configuration commands, one per line.End with CNTL/Z.

Switch(config)#spanning-tree mode pvst

Switch(config)#spanning-tree vlan 10,20,30 priority 16384

Switch(config)#show spanning-tree

Invalid input detected at '^' marker.

Switch(config)#spanning-tree mode pvst

Switch(config)#spanning-tree vlan 10,20,30 priority 16384

Switch(config)#exit

Switch#

SYS-5-CONFIG_I: Configured from console by console

Switch#show spanning-tree

 

验证配置结果

 

 

6在接入交换机的access链路上实现端口安全

Switch>en

Switch#config

Configuring from terminal, memory, or network [terminal]?

Enter configuration commands, one per line.End with CNTL/Z.

Switch(config)#

Switch(config)#int range fa0/6-20

Switch(config-if-range)#switchport mode access

Switch(config-if-range)#switchport port-security

Switch(config-if-range)#switchport port-security maximum 4

Switch(config-if-range)#switchport port-security violation shutdown

Switch(config-if-range)#

 

7在三层交换机上配置SVI实现vlan间的路由

左边

Switch>en

Switch#conf

Configuring from terminal, memory, or network [terminal]?

Enter configuration commands, one per line. End with CNTL/Z.

Switch(config)#int vlan 10

Switch(config-if)#

LINK-5-CHANGED: Interface Vlan10, changed state to up

LINEPROTO-5-UPDOWN: Line protocol on Interface Vlan10, changed state to up

switch(config-if)#ip address 192.168.10.1255.255.255.0

Switch(config-if)#no shutdown

Switch(config-if)#exit

Switch(config)#int vlan 20

Switch(config-if)#

LINK-5-CHANGED: Interface Vlan20, changed state to up

LINEPROTO-5-UPDOWN: Line protocol on Interface Vlan20, changed state to up

switch(config-if)#ip address 192.168.20.1  255.255.255.0

Switch(config-if)#no shutdown

Switch(config-if)#exit

Switch(config)#int vlan 30

Switch(config-if)#

LINK-5-CHANGED: Interface Vlan30, changed state to up

LINEPROTO-5-UPDOWN: Line protocol on Interface Vlan30, changed state to upip address

192.168.30.1 255.255.255.0

switch(config-if)#ip address 192.168.30.1  255.255.255.0

Switch(config-if)#no shutdown

Switch(config-if)#exit

Switch(config)#

 

 

右边

Switch>en

Switch#conf t

Enter configuration commands, one per line.End with CNTL/Z.

Switch(config)#int vlan 10

Switch(config-if)#

LINK-5-CHANGED: Interface Vlan10,changed state to up

SLINEPROTO-5-UPDOWN: Line protocol on Interface Vlan10, changed state to up

switch(config-if)#ip address 192.168.10.2  255.255.255.0

Switch(config-if)tno shutdown

Switch(config-if)#exit

Switch(config)#int vlan 20

Switch(config-if)#

LINK-5-CHANGED: Interface Vlan20,changed state to up

LINEPROTO-5-UPDOWN: Line protocol on Interface Vlan20, changed state to up

Switch(config-if)#ip address 192.168.20.2  255.255.255.0

Switch(config-if)tno shutdown

Switch(config-if)#exit

Switch(config)#int vlan 30

switch(config-if)#

LINK-5-CHANGED: Interface Vlan30, changed state to up

LINEPROTO-5-UPDOWN:Line protocol on Interface Vlan30,changed state to up

Switch(config-if)#ip address 192.168.30.2  255.255.255.0

Switch(config-if)#no shutdown

Switch(config-if)#exit

Switch(config)#

 

 

8在三层交换机的路由端口，R0和R1及模拟Internet的路由上配置接口IP地址

左边

Switch(config)#int fa0/24

Switch(config-if)#no switchport

Switch(config-if)#ip address 10.1.1.2 255.255.255.0

Switch(config-if)#no shutdown

右边

Switch(config)#int fa0/24

Switch(config-if)#no switchport

Switch(config-if)#ip address 20.2.2.2 255.255.255.0

Switch(config-if)#no shutdown

R0路由器

Router(config)#int fa0/0

Router(config-if)#ip address 10.1.1.1 255.255.255.0

Router(config-if)#clock rate 64000

Router(config)#interface FastEthernet1/0

Router(config-if)#ip address 20.2.2.1 255.255.255.0

Router(config-if)#no shutdown

 

Router(config-if)#

%LINK-5-CHANGED: Interface FastEthernet1/0, changed state to up

 

%LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet1/0, changed state to up

Router(config)#interface Serial2/0

Router(config-if)#ip address 192.168.1.1 255.255.255.0

Router(config-if)#ip address 192.168.1.1 255.255.255.0

Router(config-if)#no shutdown

 

R1路由器

Router>enable

Router#

Router#configure terminal

Enter configuration commands, one per line. End with CNTL/Z.

Router(config)#interface Serial2/0

Router(config-if)#ip address 192.168.1.2 255.255.255.0

Router(config-if)#ip address 192.168.1.2 255.255.255.0

Router(config-if)#clock rate 64000

This command applies only to DCE interfaces

Router(config-if)#no shutdown

Router(config-if)#

%LINK-5-CHANGED: Interface Serial2/0, changed state to up

 

Router(config-if)#exit

Router(config)#interface FastEthernet0/0

Router(config-if)#

%LINEPROTO-5-UPDOWN: Line protocol on Interface Serial2/0, changed state to up

ip address 201.10.8.1 255.255.255.0

Router(config-if)#ip address 201.10.8.1 255.255.255.0

Router(config-if)#no shutdown

 

Rs路由器

Router>enable

Router#

Router#configure terminal

Enter configuration commands, one per line. End with CNTL/Z.

Router(config)#interface FastEthernet0/0

Router(config-if)#ip address 201.10.8.2 255.255.255.0

Router(config-if)#ip address 201.10.8.2 255.255.255.0

Router(config-if)#no shutdown

Router(config-if)#

%LINK-5-CHANGED: Interface FastEthernet0/0, changed state to up

 

%LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/0, changed state to up

 

Router(config-if)#interface loopback 0

 

Router(config-if)#

%LINK-5-CHANGED: Interface Loopback0, changed state to up

 

%LINEPROTO-5-UPDOWN: Line protocol on Interface Loopback0, changed state to up

 

Router(config-if)#ip address 201.1.1.1 255.255.255.0

Router(config-if)#no shutdown

 

 

9在R0和R1上配置广域网链路，启用PPP协议和配置PAP认证 

 

R0路由器

Router(config)#interface Serial2/0

Router(config-if)#encapsulation ppp

Router(config-if)#

%LINEPROTO-5-UPDOWN: Line protocol on Interface Serial2/0, changed state to down

 

Router(config-if)#ppp pap sent-username Ra password 0 123

Router(config-if)#exit

 

R1路由器

Router(config)#username Ra password 0 123

Router(config)#Enter configuration commands, one per line. End with CNTL/Z.

Router(config)#

Router(config)#interface Serial2/0

Router(config-if)#encapsulation ppp

Router(config-if)#

%LINEPROTO-5-UPDOWN: Line protocol on Interface Serial2/0, changed state to up

 

Router(config-if)#ppp authentication pap

Router(config-if)#

%LINEPROTO-5-UPDOWN: Line protocol on Interface Serial2/0, changed state to down

 

Router(config-if)#exit

10运用RIPv2路由协议，在企业内网实现全网路由互通，用静态路由实现企业内网到互联网的访问 两台三层交换机（上面）和两台路由器 

左边

Switch(config)#route rip

Switch(config-router)#version 2

Switch(config-router)#network 10.1.1.0

Switch(config-router)#network 192.168.10.0

Switch(config-router)#network 192.168.20.0

Switch(config-router)#network 192.168.30.0

Switch(config-router)#exit

Switch(config)#ip route 0.0.0.0 0.0.0.0 10.1.1.1

 

右边

Switch(config)#route rip

Switch(config-router)#version 2

Switch(config-router)#network 20.2.2.0

Switch(config-router)#network 192.168.10.0

Switch(config-router)#network 192.168.20.0

Switch(config-router)#network 192.168.30.0

Switch(config-router)#exit

Switch(config)#ip route 0.0.0.0 0.0.0.0 20.2.2.1

 

R0

Router(config)#route rip

Router(config-router)#version 2

Router(config-router)#no auto-summary

Router(config-router)#network 192.168.1.0

Router(config-router)#network 10.1.1.0

Router(config-router)#network 20.2.2.0

Router(config-router)#exit

Router(config)#ip route 0.0.0.0 0.0.0.0 192.168.1.2

 

Router#show ip route

Codes: C - connected, S - static, I - IGRP, R - RIP, M - mobile, B - BGP

D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area

N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2

E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGP

i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area

* - candidate default, U - per-user static route, o - ODR

P - periodic downloaded static route

 

Gateway of last resort is 192.168.1.2 to network 0.0.0.0

 

10.0.0.0/8 is variably subnetted, 2 subnets, 2 masks

R 10.0.0.0/8 [120/7] via 10.1.1.2, 00:00:03, FastEthernet0/0

C 10.1.1.0/24 is directly connected, FastEthernet0/0

20.0.0.0/8 is variably subnetted, 2 subnets, 2 masks

R 20.0.0.0/8 [120/6] via 10.1.1.2, 00:00:03, FastEthernet0/0

C 20.2.2.0/24 is directly connected, FastEthernet1/0

192.168.1.0/24 is variably subnetted, 2 subnets, 2 masks

C 192.168.1.0/24 is directly connected, Serial2/0

C 192.168.1.2/32 is directly connected, Serial2/0

R 192.168.10.0/24 [120/1] via 10.1.1.2, 00:00:25, FastEthernet0/0

[120/1] via 20.2.2.2, 00:00:03, FastEthernet1/0

R 192.168.20.0/24 [120/1] via 10.1.1.2, 00:00:25, FastEthernet0/0

--More--

 

 

R1

Router(config)#router rip

Router(config-router)#version 2

Router(config-router)#no auto-summary

Router(config-router)#network 192.168.1.0

Router(config-router)#exit

Router(config)#ip route 0.0.0.0 0.0.0.0 201.10.8.2

 

Router#show ip route

Codes: C - connected, S - static, I - IGRP, R - RIP, M - mobile, B - BGP

D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area

N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2

E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGP

i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area

* - candidate default, U - per-user static route, o - ODR

P - periodic downloaded static route

 

Gateway of last resort is 201.10.8.2 to network 0.0.0.0

 

192.168.1.0/32 is subnetted, 1 subnets

C 192.168.1.1 is directly connected, Serial2/0

C 201.10.8.0/24 is directly connected, FastEthernet0/0

S* 0.0.0.0/0 [1/0] via 201.10.8.2

 

11在路由器R1上做NAT实现内网对外网的访问

R1

Router(config)#interface Serial2/0

Router(config-if)#ip nat inside

Router(config-if)#exit

Router(config)#Enter configuration commands, one per line. End with CNTL/Z.

Router(config)#

Router(config)#interface Serial2/0

Router(config-if)#

Router(config-if)#exit

Router(config)#interface FastEthernet0/0

Router(config-if)#ip nat outside

Router(config-if)#exit

Router(config)#access-list 1 permit 192.168.10.0 0.0.0.255

Router(config)#access-list 1 permit 192.168.20.0 0.0.0.255

Router(config)#access-list 1 permit 192.168.30.0 0.0.0.255

Router(config)#ip nat pool internet 201.10.8.3 201.10.8.10 netmask 255.255.255.0

Router(config)#ip nat inside source list 1 pool internet

Router(config)#exit

 

12为了控制内网对互联网的访问，在路由器R1上做访问控制列表 一台路由器

R1

Router(config)#access-list 101 deny ip 192.168.20.0 0.0.0.255 any

Router(config)#access-list 101 permit tcp 192.168.10.0 0.0.0.255 any eq 80

Router(config)#access-list 101 permit tcp 192.168.30.0 0.0.0.255 any eq 80

Router(config)#access-list 101 permit tcp 192.168.10.0 0.0.0.255 any eq 21

Router(config)#access-list 101 permit tcp 192.168.10.0 0.0.0.255 any eq 20

Router(config)#access-list 101 deny tcp 192.168.10.0 0.0.0.255 any

Router(config)#access-list 101 deny tcp 192.168.30.0 0.0.0.255 any

Router(config)#access-list 101 permit ip any any

Router(config)#Enter configuration commands, one per line. End with CNTL/Z.

Router(config)#

Router(config)#interface Serial2/0

Router(config-if)#ip access-group 101 in

Router(config-if)#exit

 

Router#show access-lists

Standard IP access list 1

10 permit 192.168.10.0 0.0.0.255

20 permit 192.168.20.0 0.0.0.255

30 permit 192.168.30.0 0.0.0.255

Extended IP access list 101

10 deny ip 192.168.20.0 0.0.0.255 any

20 permit tcp 192.168.10.0 0.0.0.255 any eq www

30 permit tcp 192.168.30.0 0.0.0.255 any eq www

40 permit tcp 192.168.10.0 0.0.0.255 any eq ftp

50 permit tcp 192.168.10.0 0.0.0.255 any eq 20

60 deny tcp 192.168.10.0 0.0.0.255 any

70 deny tcp 192.168.30.0 0.0.0.255 any

80 permit ip any any

13验证是否连通

业务部可以访问ftp

 

财务部不能访问Internet，如下所示：

 

综合部能访问www服务，但不能访问ftp服务，如下所示：

 

六、实验总结：

在实验中，我们通过实际操作学习了如何配置动态路由协议，使得路由器可以自动适应网络变化。同时，我们也掌握了更多的路由器配置命令，可以更灵活地处理网络路由设置。通过本次实验的学习，我们进一步提升了网络路由的设计和配置技能，可以更好地应对现实网络环境的需求。通过对网络设备连通和拓扑的分析，加深了对常见局域网拓扑的理解。