一、实验拓扑

二、实验需求

1.所有PC均需要通过DHCP获取IP地址-地址池名称和设备VLAN一致，例如PC1-ip pool vlan10,其中只有业务B网络用户需要访问互联网web服务-需要DNS信息。

2.交换机配置VLAN需要遵循最小VLAN透传原则

3.利用OSPF协议使内外用户互相访问-全网可达（设备Router-ID需要手工配置，和设备编号一致，例如R1-RID：1.1.1.1），并采用精准宣告的方式进行宣告（例如：172.16.64.1/24接口，宣告：172.16.64.1 0.0.0.0）

4.内网全网可达，并且需要尽可能减小路由表条目数量（汇总采用精确汇总方式），能够利用缺省省去的配置可省略，防止环路，并且保障安全（在OSPF区域0需要配置认证-采用MD5认证，密码为123456），企业内网所有用户网段能够汇总都需要尽量汇总;OSPF网络用户终端不能收到OSPF协议报文。

5.内网所有用户均可访问互联网（边界路由器配置NAT），ACL采用基础ACL，编号为2000，R3-0/0/2接口不允许宣告在内网中（包含静态）。

6.test设备需要远程登陆到内网telnet-server设备,登录账号为 huawei 密码 123456，登录权限为最高。

7.不允许VLAN 40和VLAN 50 用户访问内网B业务，acl编号为2001（在R3设备0/0/0接口配置），不允许PC1访问PC5，ACL编号为3000。

8.R3-R4中间百兆链路作为备份链路，不允许正常情况下数据通过，需要降低优先级数值配置为100。

9.所有设备严格按照拓扑图标识进行配置，注意大小写。

10.图示中所有服务器和client设备均为体现需求，地址固定，不做更改，在配置时需求注意。clinet1用来模拟内网用户访问互联网（ISP-服务器），test设备用来测试互联网用户远程登陆内网telent-server主机。

三、实验思路

一、企业A内网配置思路
1、配置IP地址
2、配置vlan技术
（1）创建vlan
（2）将接口加到相应vlan
（3）配置trunk链路，放行相应vlan
（4）配置单臂路由子接口
3、配置DHCP技术
（1）启动DHCP服务
（2）创建地址池
（3）在网关接口下发DHCP服务，是的PC获得IP地址
4、配置OSPF协议
（1）创建OSPF的协议进程，配置RID
（2）进入相应的area，network网段（接口地址）
（3）查看OSPF的邻居表、路由表。做全网通测试---ping测试
5、配置OSPF的区域汇总--ABR汇总，精简路由表的路由条目数量。
6、配置静态路由空接口防环
7、配置OPSF区域0的认证
8、配置easy ip 实现内网访问外网
9、让OSPF协议下发缺省，给内网路由器，保证内网设备访问外网
10、配置telnet服务器，配置NAT SERVER实现外网访问内网的服务
11、配置基础ACL和高级ACL实现访问控制
二、企业B内网配置思路
1、配置IP地址
2、配置vlan技术
3、配置DHCP技术，使得PC获得IP地址
4、配置静态路由协议，使得全网通（PING）
5、配置静态路由空接口防环
6、配置静态缺省保证内网设备访问
7、配置静态浮动路由，实现正常走千兆，千兆故障时，走百兆
三、公网通
1、配置IP地址

四、实验步骤

1.配置IP

R1：

[R1]interface GigabitEthernet 0/0/0

[R1-GigabitEthernet0/0/0]ip address 172.16.67.1 24

[R1]interface GigabitEthernet 0/0/1.10

[R1-GigabitEthernet0/0/1.10]ip address 172.16.64.1 24

[R1]interface GigabitEthernet 0/0/1.20

[R1-GigabitEthernet0/0/1.20]ip address 172.16.65.1 24

[R1]interface GigabitEthernet 0/0/1.30

[R1-GigabitEthernet0/0/1.30]ip address 172.16.66.1 24

R2：

[R2]interface GigabitEthernet 0/0/0

[R2-GigabitEthernet0/0/0]ip address 172.16.67.2 24

[R2]interface GigabitEthernet 0/0/2

[R2-GigabitEthernet0/0/2]ip address 172.16.2.1 24

[R2]interface GigabitEthernet 0/0/1.40

[R2-GigabitEthernet0/0/1.40]ip address 172.16.0.1 24

[R2]interface GigabitEthernet 0/0/1.50

[R2-GigabitEthernet0/0/1.50]ip address 172.16.1.1 24

R3：

[R3]interface GigabitEthernet 0/0/0

[R3-GigabitEthernet0/0/0]ip address 172.16.2.2 24

[R3]interface GigabitEthernet 0/0/2

[R3-GigabitEthernet0/0/2]ip address 100.0.0.1 24

[R3]interface GigabitEthernet 0/0/1

[R3-GigabitEthernet0/0/1]ip address 172.16.129.1 24

[R3]interface Ethernet4/0/0

[R3-Ethernet4/0/0]ip address 172.16.130.1 24

R4：

[r4]interface GigabitEthernet 0/0/0

[r4-GigabitEthernet0/0/0]ip address 172.16.129.2 24

[r4]interface Ethernet4/0/0

[r4-Ethernet4/0/0]ip address 172.16.130.2 24

[r4]interface GigabitEthernet 0/0/1

[r4-GigabitEthernet0/0/1]ip address 172.16.131.1 24

[r4]interface GigabitEthernet 0/0/2

[r4-GigabitEthernet0/0/2]ip address 172.16.132.1 24

R5：

[r5]interface GigabitEthernet 0/0/0

[r5-GigabitEthernet0/0/0]ip address 172.16.131.2 24

[r5]interface GigabitEthernet 0/0/1

[r5-GigabitEthernet0/0/1]ip address 172.16.133.1 24

R6：

[r6]interface GigabitEthernet 0/0/0

[r6-GigabitEthernet0/0/0]ip address 172.16.132.2 24

[r6]interface GigabitEthernet 0/0/1

[r6-GigabitEthernet0/0/1]ip address 172.16.134.1 24

R7：

[r7]interface GigabitEthernet 0/0/0

[r7-GigabitEthernet0/0/0]ip address 172.16.133.2 24

[r7]interface GigabitEthernet 0/0/1

[r7-GigabitEthernet0/0/1]ip address 172.16.134.2 24

[r7]interface GigabitEthernet 0/0/2.60

[r7-GigabitEthernet0/0/2.60]ip address 172.16.128.1 25

[r7-GigabitEthernet0/0/2.70]ip address 172.16.128.129 25

test：

[test-GigabitEthernet0/0/0]ip address 100.0.0.2 24

2.配置vlan

LSW1：

[sw1]vlan batch 10 20 30

[sw1]interface GigabitEthernet 0/0/2

[sw1-GigabitEthernet0/0/2]port link-type access 

[sw1-GigabitEthernet0/0/2]port default vlan 10

[sw1]interface GigabitEthernet 0/0/3

[sw1-GigabitEthernet0/0/3]port link-type access 

[sw1-GigabitEthernet0/0/3]port default vlan 20

[sw1]interface GigabitEthernet 0/0/4

[sw1-GigabitEthernet0/0/4]port link-type access 

[sw1-GigabitEthernet0/0/4]port default vlan 30

[sw1]interface GigabitEthernet 0/0/1

[sw1-GigabitEthernet0/0/1]port link-type trunk 

[sw1-GigabitEthernet0/0/1]port trunk allow-pass vlan 10 20 30

LSW2：

[sw2]vlan batch 40 50

[sw2]interface GigabitEthernet 0/0/2

[sw2-GigabitEthernet0/0/2]port link-type access 

[sw2-GigabitEthernet0/0/2]port default vlan 40

[sw2]interface GigabitEthernet 0/0/3

[sw2-GigabitEthernet0/0/3]port link-type access 

[sw2-GigabitEthernet0/0/3]port default vlan 50

[sw2]interface GigabitEthernet 0/0/1

[sw2-GigabitEthernet0/0/1]port link-type trunk 

[sw2-GigabitEthernet0/0/1]port trunk allow-pass vlan 40 50

LSW3：

[sw3]vlan batch 60 70

[sw3]interface GigabitEthernet 0/0/3

[sw3-GigabitEthernet0/0/3]port link-type access 

[sw3-GigabitEthernet0/0/3]port default vlan 60

[sw3]interface GigabitEthernet 0/0/4

[sw3-GigabitEthernet0/0/4]port link-type access 

[sw3-GigabitEthernet0/0/4]port default vlan 60

[sw3]interface GigabitEthernet 0/0/2

[sw3-GigabitEthernet0/0/2]port link-type access 

[sw3-GigabitEthernet0/0/2]port default vlan 70

[sw3]interface GigabitEthernet 0/0/1

[sw3-GigabitEthernet0/0/1]port link-type trunk 

[sw3-GigabitEthernet0/0/1]port trunk allow-pass vlan 60 70

R1：

[R1]interface GigabitEthernet 0/0/1.10

[R1-GigabitEthernet0/0/1.10]dot1q termination vid 10

[R1-GigabitEthernet0/0/1.10]arp broadcast enable 

[R1]interface GigabitEthernet 0/0/1.20

[R1-GigabitEthernet0/0/1.20]dot1q termination vid 20

[R1-GigabitEthernet0/0/1.20]arp broadcast enable 

[R1]interface GigabitEthernet 0/0/1.30

[R1-GigabitEthernet0/0/1.30]dot1q termination vid 30

[R1-GigabitEthernet0/0/1.30]arp broadcast enable 

R2:

[R2-GigabitEthernet0/0/1.40]dot1q termination vid 40

[R2-GigabitEthernet0/0/1.40]arp broadcast enable 

[R2-GigabitEthernet0/0/1.50]dot1q termination vid 50

[R2-GigabitEthernet0/0/1.50]arp broadcast enable 

R7：

[R7-GigabitEthernet0/0/2.60]dot1q termination vid 60

[R7-GigabitEthernet0/0/2.60]arp broadcast enable 

[R7-GigabitEthernet0/0/2.70]dot1q termination vid 70

[R7-GigabitEthernet0/0/2.70]arp broadcast enable 

3.配置DHCP

R1：

[R1]dhcp enable 

[R1]ip pool vlan10

[R1-ip-pool-vlan10]network 172.16.64.0 mask 24

[R1-ip-pool-vlan10]gateway-list 172.16.64.1

[R1-ip-pool-vlan10]dns-list 8.8.8.8  114.114.114.114

[R1-GigabitEthernet0/0/1.10]dhcp select global 

[R1]ip pool vlan20

[R1-ip-pool-vlan20]network 172.16.65.0 mask 24

[R1-ip-pool-vlan20]gateway-list 172.16.65.1

[R1-ip-pool-vlan20]dns-list 8.8.8.8  114.114.114.114

[R1-GigabitEthernet0/0/1.20]dhcp select global 

R2：

[R2]ip pool vlan40

[R2-ip-pool-vlan40]network 172.16.0.0 mask 24

[R2-ip-pool-vlan40]gateway-list 172.16.0.1

[R2-ip-pool-vlan40]dns-list 8.8.8.8  114.114.114.114

[R2-GigabitEthernet0/0/1.40]dhcp select global 

[R2]ip pool vlan50

[R2-ip-pool-vlan50]network 172.16.1.0 mask 24

[R2-ip-pool-vlan50]gateway-list 172.16.1.1

[R2-ip-pool-vlan50]dns-list 8.8.8.8  114.114.114.114

[R2-GigabitEthernet0/0/1.50]dhcp select global 

R7:

[r7]ip pool vlan70

[r7-ip-pool-vlan70]network 172.16.128.128 mask 25

[r7-ip-pool-vlan70]gateway-list 172.16.128.129

[r7-ip-pool-vlan70]dns-list 8.8.8.8  114.114.114.114

[r7-GigabitEthernet0/0/1.70]dhcp select global 

企业A内网

4.配置ospf并汇总

R1:

[R1]ospf 1 router-id 1.1.1.1

[R1-ospf-1-area-0.0.0.1]network 172.16.67.1 0.0.0.0

[R1-ospf-1-area-0.0.0.1]network 172.16.64.1 0.0.0.0

[R1-ospf-1-area-0.0.0.1]network 172.16.65.1 0.0.0.0

[R1-ospf-1-area-0.0.0.1]network 172.16.66.1 0.0.0.0

汇总

[R2-ospf-1-area-0.0.0.1]abr-summary 172.16.64.0 255.255.252.0

R2:

[R2]ospf 1 router-id 2.2.2.2

[R2-ospf-1-area-0.0.0.0]network 172.16.2.1 0.0.0.0

[R2-ospf-1-area-0.0.0.0]network 172.16.0.1 0.0.0.0

[R2-ospf-1-area-0.0.0.0]network 172.16.1.1 0.0.0.0

[R2-ospf-1-area-0.0.0.1]network 172.16.67.2 0.0.0.0

R3：

[R3]ospf 1 router-id 3.3.3.3

[R3-ospf-1-area-0.0.0.0]network 172.16.2.2 0.0.0.0

汇总

[R2-ospf-1-area-0.0.0.0]abr-summary 172.16.0.0 255.255.252.0 

5.配置静态路由空接口防环

[R3] ip route-static 172.16.64.0 255.255.192.0 NULL0 

6.配置ospf area0认证

[R2-ospf-1-area-0.0.0.0]authentication-mode md5 1 cipher 123456

[R3-ospf-1-area-0.0.0.0]authentication-mode md5 1 cipher 123456

[R3-GigabitEthernet0/0/2]ip address 100.0.0.1 24

7.配置easy ip

[R3]acl 2000

[R3-acl-basic-2000]rule permit source 172.16.0.0 0.0.0.255

[r3-GigabitEthernet0/0/2]nat outbound 2000

[r3-ospf-3]default-route-advertise always

8.配置缺省路由

[R3]ospf 1 router-id 3.3.3.3

[R3-ospf-1]default-route-advertise always

企业B内网

9.配置静态路由

R3:

[R3]ip route-static 172.16.132.0 255.255.255.0 172.16.129.2

[R3]ip route-static 172.16.132.0 255.255.255.0 172.16.130.2

[R3]ip route-static 172.16.134.0 255.255.255.0 172.16.130.2

[R3]ip route-static 172.16.134.0 255.255.255.0 172.16.129.2

[R3]ip route-static 172.16.133.0 255.255.255.0 172.16.129.2

[R3]ip route-static 172.16.133.0 255.255.255.0 172.16.130.2

[R3]ip route-static 172.16.128.0 255.255.255.0 172.16.129.2

[R3]ip route-static 172.16.128.0 255.255.255.0 172.16.130.2 preference 61

[R3]ip route-static 172.16.131.0 255.255.255.0 172.16.130.2

[R3]ip route-static 172.16.131.0 255.255.255.0 172.16.129.2

R4:

[r4]ip route-static 172.16.133.0 255.255.255.0 172.16.131.2

[r4]ip route-static 172.16.128.0 255.255.255.0 172.16.131.2

[r4]ip route-static 172.16.134.0 255.255.255.0 172.16.132.2

R5:

[r5]ip route-static 172.16.134.0 255.255.255.0 172.16.133.2

[r5]ip route-static 172.16.128.0 255.255.255.0 172.16.133.2

[r5]ip route-static 172.16.132.0 255.255.255.0 172.16.131.1

[r5]ip route-static 172.16.129.0 255.255.255.0 172.16.131.1

[r5]ip route-static 172.16.130.0 255.255.255.0 172.16.131.1

R6:

[r6]ip route-static 172.16.129.0 255.255.255.0 172.16.132.1

[r6]ip route-static 172.16.130.0 255.255.255.0 172.16.132.1

[r6]ip route-static 172.16.131.0 255.255.255.0 172.16.132.1

[r6]ip route-static 172.16.133.0 255.255.255.0 172.16.134.2

[r6]ip route-static 172.16.128.0 255.255.255.0 172.16.134.2

R7:

[r7]ip route-static 172.16.132.0 255.255.255.0 172.16.134.1

[r7]ip route-static 172.16.130.0 255.255.255.0 172.16.134.1

[r7]ip route-static 172.16.130.0 255.255.255.0 172.16.133.1

[r7]ip route-static 172.16.129.0 255.255.255.0 172.16.133.1

[r7]ip route-static 172.16.129.0 255.255.255.0 172.16.134.1

[r7]ip route-static 172.16.131.0 255.255.255.0 172.16.133.1

10.配置静态路由空接口防环

[R3]ip route-static 172.16.128.0 24 NULL 0

[r4]ip route-static 172.16.128.0 24 NULL 0

[r5]ip route-static 172.16.128.0 24 NULL 0

[r6]ip route-static 172.16.128.0 24 NULL 0

[r7]ip route-static 172.16.128.0 24 NULL 0

11.配置静态缺省

[r4]ip route-static 0.0.0.0 0 172.16.129.1

[r4]]ip route-static 0.0.0.0 0 172.16.130.1 preference 61

[r5]ip route-static 0.0.0.0 0 172.16.131.1

[r6]ip route-static 0.0.0.0 0 172.16.132.1

[r7]ip route-static 0.0.0.0 0 172.16.133.1

[r7]ip route-static 0.0.0.0 0 172.16.134.1

12.配置telnet服务器

[telnet-server]telnet server enable 

[telnet-server]user-interface vty 0 4  

[telnet-server-ui-vty0-4]authentication-mode aaa 

[telnet-server-aaa]local-user huawei password cipher 123456

[telnet-server-aaa]local-user huawei privilege level 15

[telnet-server-aaa]local-user  huawei service-type telnet

[telnet-server-GigabitEthernet0/0/0]ip address 172.16.66.254 24

[telnet-server]ip route-static 0.0.0.0 0 172.16.66.1

13.配置NAT SEVER

[R3-GigabitEthernet0/0/2]nat server protocol tcp global current-interface 23 inside 172.16.66.254 23

14.配置ACL

[R2-acl-basic-2001]rule deny source 172.16.0.0 0.0.0.255

[R2-acl-basic-2001]rule deny source 172.16.1.0 0.0.0.255

[R2-GigabitEthernet0/0/2]traffic-filter outbound acl 2001

[R1-acl-adv-3000]rule deny icmp source 172.16.64.254 0.0.0.0 destination 172.16.128.254  0.0.0.0

[R1-GigabitEthernet0/0/0]traffic-filter outbound acl 3000

五、实验测试