欢迎来到尧图网

客户服务 关于我们

您的位置：首页 > 科技 > 名人名企 > NE 综合实验3：基于 IP 配置、链路聚合、VLAN 管理、路由协议及安全认证的企业网络互联与外网访问技术实现（H3C）

NE 综合实验3：基于 IP 配置、链路聚合、VLAN 管理、路由协议及安全认证的企业网络互联与外网访问技术实现（H3C）

2025/4/3 6:05:46 来源：https://blog.csdn.net/m0_54349799/article/details/146812877  浏览:  次   关键词：NE 综合实验3：基于 IP 配置、链路聚合、VLAN 管理、路由协议及安全认证的企业网络互联与外网访问技术实现（H3C）

综合实验3

实验拓扑

在这里插入图片描述

设备名称接口IP地址
R1Ser_1/0与Ser_2/0做捆绑MP202.100.1.1/24
G0/0202.100.2.1/24
R2Ser_1/0与Ser_2/0做捆绑MP202.100.1.2/24
G0/0172.16.2.1/24
G0/1172.16.1.1/24
G0/2172.16.5.1/24
R3G5/0202.100.2.2/24
G0/0172.16.2.2/24
G0/1172.16.3.1/24
G0/2172.16.7.1/24
R4G0/0172.16.1.2/24
G0/1172.16.4.1/24
G0/210.1.3.1/24
G5/010.1.1.1/24
G5/1172.16.6.2/24
R5G0/0172.16.4.2/24
G0/1172.16.3.2/24
G0/210.1.4.1/24
G5/010.1.2.1/24
G5/1172.16.8.2/24
R12G0/0172.15.5.2/24
G0/1172.16.6.1/24
R13G0/0172.16.7.2/24
G0/1172.16.8.1/24
SW6G1/0/1Vlan100:10.1.3.2/24
G1/0/2Vlan90:10.1.4.2/24
G1/0/3Vlan50:10.1.5.1/24
G1/0/4Vlan60:10.1.6.1/24
SW7G1/0/1Vlan50:10.1.5.2/24
G1/0/2Vlan30:192.168.3.1/24
G1/0/6Vlan70:10.1.1.2/24
G1/0/3-5做聚合组为1Vlan110:192.168.5.1/24
SW8G1/0/1Vlan60:10.1.6.2/24
G1/0/2Vlan40:192.168.4.1/24
G1/0/6Vlan80:10.1.2.2/24
G1/0/3-5做聚合组为1Vlan110:192.168.5.2/24
SW9G1/0/1Vlan30:192.168.3.2/24
G1/0/2Vlan40:192.168.4.2/24
G1/0/3Vlan10:192.168.1.254/24
G1/0/4Vlan20:192.168.2.254/24
PC10G0/1IP：192.168.1.1/24 GW：192.168.1.254
PC11G0/1IP：192.168.2.1/24 GW：192.168.2.254

实验需求

  1. 按照图示配置IP地址；
  2. sw7和sw8之间的直连链路配置链路聚合；
  3. 公司内部业务网段为vlan10和vlan20，vlan10是市场部，vlan20是技术部，对vlan进行命名以便区分识别；pc10属于vlan10，pc11属于vlan20，其中vlan30，vlan40，vlan50，vlan60，vlan70，vlan80，vlan90，vlan100，vlan110，vlan120，vlan130，vlan140，vlan150用于交换机之间建立rip动态路由协议及互联vlan；
  4. 所有交换机相连的端口配置为trunk，允许相关流量通过；
  5. 交换机连接pc的端口配置为边缘端口；
  6. 将sw9选举为生成树的根网桥；
  7. 在sw9上配置dhcp服务，为vlan10和vlan20的pc动态分配IP地址、网关和dns地址，vlan10的网关是192.168.1.254，vlan20的网关是192.168.2.254，dns为114.114.114.114；
  8. 按照图示分区域配置ospf协议，环回口宣告进对应区域中；
  9. 按照图示区域配置rip协议，环回口宣告进对应区域中，业务网段不允许出现协议报文；
  10. 要求实现内网全网互通；
  11. R1和R2之间通过双线连接到互联网配置ppp-mp，并配置双向chap验证；
  12. 配置easy ip，只有业务网段192.168.1.0/24和192.168.2.0/24的数据流可以通过R2和R3访问互联网；
  13. R12开启telent远程登录服务，只允许192.168.3.0/24登录访问；
  14. R13开启ftp文件传输服务，只允许192.168.4.0/24登录访问；

实验步骤

步骤1:

按照图示配置IP地址；

R1和R2之间通过双线连接到互联网配置ppp-mp，并配置双向chap验证；

[R1]int g0/0 
[R1-GigabitEthernet0/0]ip add 202.100.2.1 24 [R1]int l0
[R1-LoopBack0]ip add 1.1.1.1 32

[R2]int g0/0 
[R2-GigabitEthernet0/0]ip add 172.16.2.1 24 
[R2-GigabitEthernet0/0]int g0/1 
[R2-GigabitEthernet0/1]ip add 172.16.1.1 24 
[R2-GigabitEthernet0/1]int g0/2 
[R2-GigabitEthernet0/2]ip add 172.16.5.1 24 [R2]int l0 
[R2-LoopBack0]ip add 2.2.2.2 32

[R3]int g5/0 
[R3-GigabitEthernet5/0]ip add 202.100.2.2 24 
[R3-GigabitEthernet5/0]int g0/0
[R3-GigabitEthernet0/0]ip add 172.16.2.2 24 
[R3-GigabitEthernet0/0]int g0/1
[R3-GigabitEthernet0/1]ip add 172.16.3.1 24 
[R3-GigabitEthernet0/1]int g0/2 
[R3-GigabitEthernet0/2]ip add 172.16.7.1 24 [R3]int l0
[R3-LoopBack0]ip add 3.3.3.3 32 

[R4]int g0/0 
[R4-GigabitEthernet0/0]ip add 172.16.1.2 24 
[R4-GigabitEthernet0/0]int g0/1 
[R4-GigabitEthernet0/1]ip add 172.16.4.1 24 
[R4-GigabitEthernet0/1]int g0/2 
[R4-GigabitEthernet0/2]ip add 10.1.3.1 24
[R4-GigabitEthernet0/2]int g5/0 
[R4-GigabitEthernet5/0]ip add 10.1.1.1 24 
[R4-GigabitEthernet5/0]int g5/1 
[R4-GigabitEthernet5/1]ip add 172.16.6.2 24 [R4]int l0
[R4-LoopBack0]ip add 4.4.4.4 32 

[R5]int g0/0 
[R5-GigabitEthernet0/0]ip add 172.16.4.2 24 
[R5-GigabitEthernet0/2]int g0/1 
[R5-GigabitEthernet0/1]ip add 172.16.3.2 24 
[R5-GigabitEthernet0/1]int g0/2 
[R5-GigabitEthernet0/2]ip add 10.1.4.1 24 
[R5-GigabitEthernet0/2]int g5/0 
[R5-GigabitEthernet5/0]ip add 10.1.2.1 24
[R5-GigabitEthernet5/0]int g5/1 
[R5-GigabitEthernet5/1]ip add 172.16.8.2 24[R5]int l0 
[R5-LoopBack0]ip add 5.5.5.5 32 

[R12]int g0/0 
[R12-GigabitEthernet0/0]ip add 172.15.5.2 24 
[R12-GigabitEthernet0/0]int g0/1 
[R12-GigabitEthernet0/1]ip add 172.16.6.1 24[R12]int l0
[R12-LoopBack0]ip add 12.12.12.12 32

[R13]int g0/0  
[R13-GigabitEthernet0/0]ip add 172.16.7.2 24 
[R13-GigabitEthernet0/0]int g0/1 
[R13-GigabitEthernet0/1]ip add 172.16.8.1 24[R13]int l0
[R13-LoopBack0]ip add 13.13.13.13 32 

[SW6]vlan 100 
[SW6-vlan100]vlan 90 
[SW6-vlan150]vlan 50
[SW6-vlan50]vlan 60[SW6-vlan90]int vlan 100
[SW6-Vlan-interface100]ip add 10.1.3.2 24 
[SW6-Vlan-interface100]int vlan 90 
[SW6-Vlan-interface90]ip add 10.1.4.2 24
[SW6-Vlan-interface150]int vlan 50
[SW6-Vlan-interface50]ip add 10.1.5.1 24 
[SW6-Vlan-interface50]int vlan 60
[SW6-Vlan-interface60]ip add 10.1.6.1 24 [SW6]int g1/0/1
[SW6-GigabitEthernet1/0/1]port access vlan 100
[SW6-GigabitEthernet1/0/1]int g1/0/2 
[SW6-GigabitEthernet1/0/2]port access vlan 90[SW6]int l0 
[SW6-LoopBack0]ip add 6.6.6.6 32 

[SW7]vlan 50
[SW7-vlan50]vlan 30
[SW7-vlan30]vlan 70 
[SW7-vlan70]vlan 110[SW7-vlan110]int vlan 50
[SW7-Vlan-interface50]ip add 10.1.5.2 24 
[SW7-Vlan-interface50]int vlan 30
[SW7-Vlan-interface30]ip add 192.168.3.1 24
[SW7-Vlan-interface30]int vlan 70
[SW7-Vlan-interface70]ip add 10.1.1.2 24 
[SW7-Vlan-interface70]int vlan 110 
[SW7-Vlan-interface110]ip add  192.168.5.1 24[SW7]int g1/0/6 
[SW7-GigabitEthernet1/0/6]port access vlan 70[SW7]int l0
[SW7-LoopBack0]ip add 7.7.7.7 32 

[SW8]vlan 60
[SW8-vlan60]vlan 40
[SW8-vlan40]vlan 80
[SW8-vlan80]vlan 110
[SW8-vlan110]int vlan 60
[SW8-Vlan-interface60]ip add 10.1.6.2 24 
[SW8-Vlan-interface60]int vlan 40
[SW8-Vlan-interface40]ip add 192.168.5.1 24 
[SW8-Vlan-interface40]ip add 192.168.4.1 24 
[SW8-Vlan-interface40]int vlan 80
[SW8-Vlan-interface80]ip add 10.1.2.2 24 
[SW8-Vlan-interface80]int vlan 110
[SW8-Vlan-interface110]ip add 192.168.5.2 24 [SW8]int g1/0/6 
[SW8-GigabitEthernet1/0/6]port access vlan 80[SW8]int l0
[SW8-LoopBack0]ip add 8.8.8.8 32

[SW9]vlan 30
[SW9-vlan30]vlan 40
[SW9-vlan40]vlan 10
[SW9-vlan10]vlan 20
[SW9-vlan20]int vlan 30 
[SW9-Vlan-interface30]ip add 192.168.3.2 24 
[SW9-Vlan-interface30]int vlan 40
[SW9-Vlan-interface40]ip add 192.168.4.2 24 
[SW9-Vlan-interface40]int vlan 10 
[SW9-Vlan-interface10]ip add 192.168.1.254 24
[SW9-Vlan-interface10]int vlan 20 
[SW9-Vlan-interface20]ip add 192.168.2.254 24 [SW9-GigabitEthernet1/0/2]int g1/0/3 
[SW9-GigabitEthernet1/0/3]port access vlan 10
[SW9-GigabitEthernet1/0/3]int g1/0/4 
[SW9-GigabitEthernet1/0/4]port access vlan 20 [SW9]int l0
[SW9-LoopBack0]ip add 9.9.9.9 32

[R1]int MP-group 1
[R1-MP-group1]ip add 202.100.1.1 24 [R1]local-user ikun class network 
[R1-luser-network-ikun]password simple 123
[R1-luser-network-ikun]service-type ppp[R1]int s1/0
[R1-Serial1/0]ppp mp MP-group 1
[R1-Serial1/0]ppp authentication-mode chap 
[R1-Serial1/0]ppp chap user ikun
[R1-Serial1/0]int s2/0
[R1-Serial2/0]ppp mp MP-group 1
[R1-Serial2/0]ppp authentication-mode chap 
[R1-Serial2/0]ppp chap user ikun

[R2]int MP-group 1
[R2-MP-group1]ip add 202.100.1.2 24[R2]local-user ikun class network 
[R2-luser-network-ikun]password simple 123
[R2-luser-network-ikun]service-type ppp[R2]int s1/0
[R2-Serial1/0]ppp mp MP-group 1
[R2-Serial1/0]ppp authentication-mode chap 
[R2-Serial1/0]ppp chap user ikun
[R2-Serial1/0]int s2/0
[R2-Serial2/0]ppp mp MP-group 1
[R2-Serial2/0]ppp authentication-mode chap 
[R2-Serial2/0]ppp chap user ikun
步骤2：

在sw7和sw8之间的直连链路配置链路聚合；

[SW7]int Bridge-Aggregation 1[SW7]int range g1/0/3 to g1/0/5 
[SW7-if-range]port link-aggregation group 1 

[SW8]int Bridge-Aggregation 1 [SW8-if-range]int range g1/0/3 to g1/0/5 
[SW8-if-range]port link-aggregation group 1
步骤3：

给Vlan命名，划分Vlan；

所有交换机相连的端口配置为Trunk，放行相关Vlan；

将sw9选举为生成树的根网桥；

交换机链接PC的端口配置为边缘端口；

[SW9]vlan 10
[SW9-vlan10]name shichangbu
[SW9-vlan10]vlan 20 
[SW9-vlan20]name jishubu 

[SW6]int g1/0/3 
[SW6-GigabitEthernet1/0/3]port link-type trunk
[SW6-GigabitEthernet1/0/3]port trunk permit vlan all
[SW6-GigabitEthernet1/0/3]port trunk pvid vlan 50[SW6-GigabitEthernet1/0/3]int g1/0/4 
[SW6-GigabitEthernet1/0/4]port link-type trunk 
[SW6-GigabitEthernet1/0/4]port trunk permit vlan all 
[SW6-GigabitEthernet1/0/4]port trunk pvid vlan 60

[SW7]int g1/0/1
[SW7-GigabitEthernet1/0/1]port link-type trunk
[SW7-GigabitEthernet1/0/1]port trunk permit vlan all
[SW7-GigabitEthernet1/0/1]port trunk pvid vlan 50 [SW7-GigabitEthernet1/0/1]int g1/0/2 
[SW7-GigabitEthernet1/0/2]port link-type trunk 
[SW7-GigabitEthernet1/0/2]port trunk permit vlan all
[SW7-GigabitEthernet1/0/2]port trunk pvid vlan 30[SW7-GigabitEthernet1/0/2]int Bridge-Aggregation 1
[SW7-Bridge-Aggregation1]port link-type trunk
[SW7-Bridge-Aggregation1]port trunk permit vlan all
[SW7-Bridge-Aggregation1]port trunk pvid vlan 110 

[SW8]int g1/0/1 
[SW8-GigabitEthernet1/0/1]port link-type trunk 
[SW8-GigabitEthernet1/0/1]port trunk permit vlan all
[SW8-GigabitEthernet1/0/1]port trunk pvid vlan 60[SW8]int g1/0/2 
[SW8-GigabitEthernet1/0/2]port link-type trunk 
[SW8-GigabitEthernet1/0/2]port trunk permit vlan all
[SW8-GigabitEthernet1/0/2]port trunk pvid vlan 40[SW8]int Bridge-Aggregation 1
[SW8-Bridge-Aggregation1]port link-type trunk 
[SW8-Bridge-Aggregation1]port trunk permit vlan all
[SW8-Bridge-Aggregation1]port trunk pvid vlan 110

[SW9]int g1/0/1
[SW9-GigabitEthernet1/0/1]port link-type trunk 
[SW9-GigabitEthernet1/0/1]port trunk permit vlan all
[SW9-GigabitEthernet1/0/1]port trunk pvid vlan 30[SW9-GigabitEthernet1/0/1]int g1/0/2 
[SW9-GigabitEthernet1/0/2]port link-type trunk 
[SW9-GigabitEthernet1/0/2]port trunk permit vlan all
[SW9-GigabitEthernet1/0/2]port trunk pvid vlan 40[SW9]stp priority 4096

[SW9]int g1/0/3 
[SW9-GigabitEthernet1/0/3]stp edged-port 
[SW9-GigabitEthernet1/0/3]int g1/0/4 
[SW9-GigabitEthernet1/0/4]stp edged-port
步骤4：

按照图示分区域配置ospf协议，环回口宣告进对应区域中；

按照图示区域配置rip协议，环回口宣告进对应区域中，业务网段不允许出现协议报文；

[R2]ospf 1 router-id 2.2.2.2 
[R2-ospf-1]area 1
[R2-ospf-1-area-0.0.0.1]network 172.16.5.0 0.0.0.255
[R2-ospf-1-area-0.0.0.1]area 0
[R2-ospf-1-area-0.0.0.0]network 172.16.2.0 0.0.0.255
[R2-ospf-1-area-0.0.0.0]network 172.16.1.0 0.0.0.255
[R2-ospf-1-area-0.0.0.0]network 2.2.2.2 0.0.0.0

[R3]ospf 1 router-id 3.3.3.3
[R3-ospf-1]area 0
[R3-ospf-1-area-0.0.0.0]network 3.3.3.3 0.0.0.0
[R3-ospf-1-area-0.0.0.0]network 172.16.3.0 0.0.0.255
[R3-ospf-1-area-0.0.0.0]network 172.16.2.0 0.0.0.255 
[R3-ospf-1-area-0.0.0.0]area 2 
[R3-ospf-1-area-0.0.0.2]network 172.16.7.0 0.0.0.255

[R4]ospf 1 router-id 4.4.4.4 
[R4-ospf-1]area 0 
[R4-ospf-1-area-0.0.0.0]network 4.4.4.4 0.0.0.0
[R4-ospf-1-area-0.0.0.0]network 172.16.1.0 0.0.0.255 
[R4-ospf-1-area-0.0.0.0]network 172.16.4.0 0.0.0.255
[R4-ospf-1-area-0.0.0.0]area 1 
[R4-ospf-1-area-0.0.0.1]network 172.16.6.0 0.0.0.255[R4-ospf-1]import-route rip 
[R4-ospf-1]import-route direct [R4]rip 1
[R4-rip-1]version 2
[R4-rip-1]undo summary 
[R4-rip-1]network 10.0.0.0[R4-rip-1]import-route ospf 1
[R4-rip-1]import-route direct

[R5]ospf 1 router-id 5.5.5.5
[R5-ospf-1]area 0 
[R5-ospf-1-area-0.0.0.0]network 5.5.5.5 0.0.0.0
[R5-ospf-1-area-0.0.0.0]network 172.16.3.0 0.0.0.255
[R5-ospf-1-area-0.0.0.0]network 172.16.4.0 0.0.0.255
[R5-ospf-1-area-0.0.0.0]area 2 
[R5-ospf-1-area-0.0.0.2]network 172.16.8.0 0.0.0.255[R5-ospf-1]import-route rip 
[R5-ospf-1]import-route direct [R5]rip 1
[R5-rip-1]version 2
[R5-rip-1]undo summary 
[R5-rip-1]network 10.0.0.0[R5-rip-1]import-route ospf 1
[R5-rip-1]import-route direct 

[R12]ospf 1 router-id 12.12.12.12 
[R12-ospf-1]area 1 
[R12-ospf-1-area-0.0.0.1]network 12.12.12.12 0.0.0.0
[R12-ospf-1-area-0.0.0.1]network 172.16.5.0 0.0.0.255
[R12-ospf-1-area-0.0.0.1]network 172.16.6.0 0.0.0.255

[R13]ospf 1 router-id 13.13.13.13
[R13-ospf-1]area 2 
[R13-ospf-1-area-0.0.0.2]network 13.13.13.13 0.0.0.0
[R13-ospf-1-area-0.0.0.2]network 172.16.7.0 0.0.0.255
[R13-ospf-1-area-0.0.0.2]network 172.16.8.0 0.0.0.255
步骤5：

在sw9上配置dhcp服务，为vlan10和vlan20的pc动态分配IP地址、网关和dns地址，vlan10的网关是192.168.1.254，vlan20的网关是192.168.2.254，dns为114.114.114.114；

实现内网全网互通；

[SW9]dhcp enable
[SW9]dhcp server ip-pool 1
[SW9-dhcp-pool-1]network 192.168.1.0 24
[SW9-dhcp-pool-1]gateway-list 192.168.1.254 
[SW9-dhcp-pool-1]dns-list 114.114.114.114[SW9]dhcp server ip-pool 2
[SW9-dhcp-pool-2]network 192.168.2.0 24 
[SW9-dhcp-pool-2]gateway-list 192.168.2.254
[SW9-dhcp-pool-2]dns-list 114.114.114.114

dhcp下发成功
在这里插入图片描述
在这里插入图片描述

测试是否实现内网全网互通
在这里插入图片描述
在这里插入图片描述

步骤6：

在R12上开启telnet远程登录服务，并做登录测试；

在R13上开启ftp文件传输服务，并做登录测试；

[R12]telnet server enable 
[R12]local-user ikun23 class manage 
[R12-luser-manage-ikun23]password simple 123456abcd
[R12-luser-manage-ikun23]service-type telnet
[R12-luser-manage-ikun23]authorization-attribute user-role level-15[R12]line vty 0 4
[R12-line-vty0-4]authentication-mode scheme 
[R12-line-vty0-4]user-role level-15

[R13]ftp server enable 
[R13]local-user ikun2021 class manage 
[R13-luser-manage-ikun2021]password simple 123456abcd
[R13-luser-manage-ikun2021]service-type ftp 
[R13-luser-manage-ikun2021]authorization-attribute user-role level-15[R13]line vty 0 4
[R13-line-vty0-4]authentication-mode scheme 
[R13-line-vty0-4]user-role level-15
步骤7：

配置easy ip，只有业务网段192.168.1.0/24和192.168.2.0/24的数据流可以通过R2和R3访问互联网；

配置acl，只允许192.168.3.0/24网段远程登录访问R12；

配置acl，只允许192.168.4.0/24网段远程登录访问R13；

[R1]ip route-static 0.0.0.0 0 202.100.1.2
[R1]ip route-static 0.0.0.0 0 202.100.2.2

[R2]ip route-static 202.100.1.0 24 202.100.1.1
[R2]ip route-static 202.100.2.0 24 202.100.2.1[R2]ospf 1
[R2-ospf-1]import-route direct 
[R2-ospf-1]import-route static [R2]acl basic 2000
[R2-acl-ipv4-basic-2000]rule permit source 192.168.1.0 0.0.0.255
[R2-acl-ipv4-basic-2000]rule permit source 192.168.2.0 0.0.0.255[R2]int MP-group 1
[R2-MP-group1]nat outbound 2000

[R3]ip route-static 202.100.1.0 24 202.100.1.1
[R3]ip route-static 202.100.2.0 24 202.100.2.1[R3]ospf 1
[R3-ospf-1]import-route direct 
[R3-ospf-1]import-route static [R3]acl basic 2000
[R3-acl-ipv4-basic-2000]rule permit source 192.168.1.0 0.0.0.255
[R3-acl-ipv4-basic-2000]rule permit source 192.168.2.0 0.0.0.255[R3]int g5/0
[R3-GigabitEthernet5/0]packet-filter 2000 outbound
步骤8：

测试是否只有业务网段192.168.1.0/24和192.168.2.0/24的数据流可以通过R2和R3访问互联网；

测试R12是否只允许192.168.3.0/24网段远程登录访问；

测试R13是否只允许192.168.4.0/24网段远程登录访问；

在这里插入图片描述
在这里插入图片描述

版权声明:

本网仅为发布的内容提供存储空间，不对发表、转载的内容提供任何形式的保证。凡本网注明“来源：XXX网络”的作品，均转载自其它媒体，著作权归作者所有，商业转载请联系作者获得授权，非商业转载请注明出处。

我们尊重并感谢每一位作者，均已注明文章来源和作者。如因作品内容、版权或其它问题，请及时与我们联系，联系邮箱：809451989@qq.com，投稿邮箱：809451989@qq.com

相关资讯

热文排行

最新新闻

推荐新闻

热搜词