本期模擬中小型企業(yè)的萬(wàn)能組網(wǎng),該場(chǎng)景為總部與分部之間的跨運(yùn)營(yíng)商互訪,如果拆開(kāi)來(lái),就是小型企業(yè)的內(nèi)網(wǎng)環(huán)境,技術(shù)可以任意搭配
場(chǎng)景1:總部部署STP\RSTP\VRRP\OSPF\靜態(tài),基于防火墻的GRE VPN\IPSEC VPN、NAT
場(chǎng)景2:總部部署STP\MSTP\VRRP負(fù)載\OSPF\靜態(tài),基于防火墻的GRE VPN\IPSEC VPN、NAT
場(chǎng)景3:只有總部,沒(méi)有分部,部署STP\MSTP\VRRP負(fù)載\OSPF\靜態(tài),基于防火墻的NAT
本期模擬的是場(chǎng)景2,選配GRE隧道方式實(shí)現(xiàn)總部與分部之間訪問(wèn),灰色區(qū)域?yàn)榻尤雽釉O(shè)備,橘色為核心層設(shè)備,直接上配置
總部接入層配置
sysname sw1
#
vlan batch 10
#
stp region-configuration
?region-name huawei
?instance 1 vlan 10 20?
?instance 2 vlan 30 40?
?active region-configuration
#
interface GigabitEthernet0/0/1
?port link-type access
?port default vlan 10
#
interface GigabitEthernet0/0/2
?port link-type trunk
?port trunk allow-pass vlan 10
#
interface GigabitEthernet0/0/3
?port link-type trunk
?port trunk allow-pass vlan 10
#
interface GigabitEthernet0/0/4
?port link-type access
?port default vlan 10
總部核心交換機(jī)1
sysname HX-1
#
vlan batch 10 20 30 40 100
#
stp instance 1 root primary
stp instance 2 root secondary
#
dhcp enable
#
stp region-configuration
?region-name huawei
?instance 1 vlan 10 20?
?instance 2 vlan 30 40?
?active region-configuration
#
ip pool vlan10
gateway-list 192.168.10.254
network 192.168.10.0 mask 255.255.255.0
dns-list 192.168.50.3
#
ip pool vlan20
gateway-list 192.168.20.254
network 192.168.20.0 mask 255.255.255.0
dns-list 192.168.50.3
#
ip pool vlan30
gateway-list 192.168.30.254
network 192.168.30.0 mask 255.255.255.0
dns-list 192.168.50.3
#
ip pool vlan40
gateway-list 192.168.40.254
network 192.168.40.0 mask 255.255.255.0
dns-list 192.168.50.3
#
interface Vlanif10
ip address 192.168.10.252 255.255.255.0
vrrp vrid 10 virtual-ip 192.168.10.254
vrrp vrid 10 priority 120
vrrp vrid 10 track interface GigabitEthernet0/0/7 reduced 30
dhcp select global
#
interface Vlanif20
ip address 192.168.20.252 255.255.255.0
vrrp vrid 20 virtual-ip 192.168.20.254
vrrp vrid 20 priority 120
vrrp vrid 20 track interface GigabitEthernet0/0/7 reduced 30
dhcp select global
#
interface Vlanif30
ip address 192.168.30.252 255.255.255.0
vrrp vrid 30 virtual-ip 192.168.30.254
dhcp select global
#
interface Vlanif40
ip address 192.168.40.252 255.255.255.0
vrrp vrid 40 virtual-ip 192.168.40.254
dhcp select global
#
interface Vlanif100
?ip address 192.168.1.1 255.255.255.252?
#
interface Eth-Trunk1
?port link-type trunk
?port trunk allow-pass vlan 10 20 30 40
#
interface GigabitEthernet0/0/1
?port link-type trunk
?port trunk allow-pass vlan 10
#
interface GigabitEthernet0/0/2
?port link-type trunk
?port trunk allow-pass vlan 20
#
interface GigabitEthernet0/0/3
?port link-type trunk
?port trunk allow-pass vlan 30
#
interface GigabitEthernet0/0/4
?port link-type trunk
?port trunk allow-pass vlan 40
#
interface GigabitEthernet0/0/5
?eth-trunk 1
#
interface GigabitEthernet0/0/6
?eth-trunk 1
#
interface GigabitEthernet0/0/7
?port link-type access
?port default vlan 100
#
ospf 1?
?area 0.0.0.0?
? network 192.168.1.1 0.0.0.0?
?area 0.0.0.1?
? network 192.168.10.0 0.0.0.255?
? network 192.168.20.0 0.0.0.255?
? network 192.168.30.0 0.0.0.255?
? network 192.168.40.0 0.0.0.255?
總部核心交換機(jī)2
sysname HX-2
#
vlan batch 10 20 30 40 100
#
stp instance 1 root secondary
stp instance 2 root primary
#
dhcp enable
#
stp region-configuration
?region-name huawei
?instance 1 vlan 10 20?
?instance 2 vlan 30 40?
?active region-configuration
#
ip pool vlan10
gateway-list 192.168.10.254
network 192.168.10.0 mask 255.255.255.0
dns-list 192.168.50.3
#
ip pool vlan20
gateway-list 192.168.20.254
network 192.168.20.0 mask 255.255.255.0
dns-list 192.168.50.3
#
ip pool vlan30
gateway-list 192.168.30.254
network 192.168.30.0 mask 255.255.255.0
dns-list 192.168.50.3
#
ip pool vlan40
gateway-list 192.168.40.254
network 192.168.40.0 mask 255.255.255.0
dns-list 192.168.50.3
#
interface Vlanif10
ip address 192.168.10.253 255.255.255.0
vrrp vrid 10 virtual-ip 192.168.10.254
dhcp select global
#
interface Vlanif20
ip address 192.168.20.253 255.255.255.0
vrrp vrid 20 virtual-ip 192.168.20.254
dhcp select global
#
interface Vlanif30
ip address 192.168.30.253 255.255.255.0
vrrp vrid 30 virtual-ip 192.168.30.254
vrrp vrid 30 priority 120
vrrp vrid 30 track interface GigabitEthernet0/0/7 reduced 30
dhcp select global
#
interface Vlanif40
ip address 192.168.40.253 255.255.255.0
vrrp vrid 40 virtual-ip 192.168.40.254
vrrp vrid 40 priority 120
vrrp vrid 40 track interface GigabitEthernet0/0/7 reduced 30
dhcp select global
#
interface Vlanif100
?ip address 192.168.1.5 255.255.255.252?
#
interface Eth-Trunk1
?port link-type trunk
?port trunk allow-pass vlan 10 20 30 40
#
interface GigabitEthernet0/0/1
?port link-type trunk
?port trunk allow-pass vlan 10
#
interface GigabitEthernet0/0/2
?port link-type trunk
?port trunk allow-pass vlan 20
#
interface GigabitEthernet0/0/3
?port link-type trunk
?port trunk allow-pass vlan 30
#
interface GigabitEthernet0/0/4
?port link-type trunk
?port trunk allow-pass vlan 40
#
interface GigabitEthernet0/0/5
?eth-trunk 1
#
interface GigabitEthernet0/0/6
?eth-trunk 1
#
interface GigabitEthernet0/0/7
?port link-type access
?port default vlan 100
#
ospf 1?
?area 0.0.0.0?
? network 192.168.1.5 0.0.0.0?
?area 0.0.0.1?
? network 192.168.10.0 0.0.0.255?
? network 192.168.20.0 0.0.0.255?
? network 192.168.30.0 0.0.0.255?
? network 192.168.40.0 0.0.0.255?
出口防火墻
sysname FW1
IP地址配置
interface GigabitEthernet1/0/0
?ip address 192.168.1.2 255.255.255.252
#
interface GigabitEthernet1/0/1
?ip address 192.168.1.6 255.255.255.252
#
interface GigabitEthernet1/0/2
?ip address 200.1.1.1 255.255.255.252
#
interface GigabitEthernet1/0/3
?ip address 192.168.50.254 255.255.255.0
GRE隧道配置
interface Tunnel0
?ip address 10.1.12.1 255.255.255.0
?tunnel-protocol gre
?source 200.1.1.1
?destination 210.1.1.2
接口劃分區(qū)域
firewall zone trust
?add interface GigabitEthernet1/0/0
?add interface GigabitEthernet1/0/1
?add interface Tunnel0
#
firewall zone untrust
?add interface GigabitEthernet1/0/2
#
firewall zone dmz
?add interface GigabitEthernet1/0/3
ospf路由配置
ospf 1
?default-route-advertise
?area 0.0.0.0
? network 192.168.1.0 0.0.0.3
? network 192.168.1.4 0.0.0.3
? network 192.168.50.0 0.0.0.255
缺省路由和gre隧道路由
ip route-static 0.0.0.0 0.0.0.0 200.1.1.2
ip route-static 172.16.10.0 255.255.255.0 Tunnel0
ip route-static 172.16.20.0 255.255.255.0 Tunnel0
security-policy
?rule name t-u //放行nat策略
? source-zone trust
? destination-zone untrust
? source-address 192.168.10.0 mask 255.255.255.0
? source-address 192.168.20.0 mask 255.255.255.0
? source-address 192.168.30.0 mask 255.255.255.0
? source-address 192.168.50.0 mask 255.255.255.0
? action permit
?rule name t-dmz //放行內(nèi)網(wǎng)到dmz的流量
? source-zone trust
? destination-zone dmz
? source-address 192.168.10.0 mask 255.255.255.0
? source-address 192.168.20.0 mask 255.255.255.0
? source-address 192.168.30.0 mask 255.255.255.0
? destination-address 192.168.50.0 mask 255.255.255.0
? action permit
?rule name u-dmz //放行分支到總部dmz的流量
? source-zone untrust
? destination-zone dmz
? source-address 172.16.10.0 mask 255.255.255.0
? source-address 172.16.20.0 mask 255.255.255.0
? destination-address 192.168.50.0 mask 255.255.255.0
? action permit
?rule name l-u //gre建立隧道策略
? source-zone local
? source-zone untrust
? destination-zone local
? destination-zone untrust
? action permit
?rule name gre //gre正向的流量
? source-zone trust
? destination-zone untrust
? source-address 192.168.10.0 mask 255.255.255.0
? source-address 192.168.20.0 mask 255.255.255.0
? source-address 192.168.30.0 mask 255.255.255.0
? source-address 192.168.50.0 mask 255.255.255.0
? destination-address 172.16.10.0 mask 255.255.255.0
? destination-address 172.16.20.0 mask 255.255.255.0
? action permit
?rule name gre- //gre反向的流量
? source-zone untrust
? destination-zone trust
? source-address 172.16.10.0 mask 255.255.255.0
? source-address 172.16.20.0 mask 255.255.255.0
? destination-address 192.168.10.0 mask 255.255.255.0
? destination-address 192.168.20.0 mask 255.255.255.0
? destination-address 192.168.30.0 mask 255.255.255.0
? destination-address 192.168.50.0 mask 255.255.255.0
? action permit
#
nat-policy
?rule name gre //nat中禁止gre的流量
? source-zone trust
? destination-zone untrust
? source-address 192.168.10.0 mask 255.255.255.0
? source-address 192.168.20.0 mask 255.255.255.0
? source-address 192.168.30.0 mask 255.255.255.0
? source-address 192.168.50.0 mask 255.255.255.0
? destination-address 172.16.10.0 mask 255.255.255.0
? destination-address 172.16.20.0 mask 255.255.255.0
? action no-nat
?rule name t-u //nat策略
? source-zone trust
? destination-zone untrust
? source-address 192.168.10.0 mask 255.255.255.0
? source-address 192.168.20.0 mask 255.255.255.0
? source-address 192.168.30.0 mask 255.255.255.0
? action source-nat easy-ip
?
分部接入交換機(jī)
sysname xiaoshoubu
#
vlan batch 10 20
#
interface Ethernet0/0/1
?port link-type trunk
?port trunk allow-pass vlan 10 20
#
interface Ethernet0/0/2
?port link-type access
?port default vlan 10
#
interface Ethernet0/0/3
?port link-type access
?port default vlan 20
分部核心交換機(jī)
sysname hx
#
vlan batch 10 20 100
#
stp instance 0 root primary
#
interface Vlanif10
?ip address 172.16.10.254 255.255.255.0?
#
interface Vlanif20
?ip address 172.16.20.254 255.255.255.0?
#
interface Vlanif100
?ip address 192.168.1.9 255.255.255.252?
#
interface GigabitEthernet0/0/1
?port link-type access
?port default vlan 100
#
interface GigabitEthernet0/0/2
?port link-type trunk
?port trunk allow-pass vlan 10 20
#
interface GigabitEthernet0/0/3
?port link-type trunk
?port trunk allow-pass vlan 10 20
#
ospf 1?
?area 0.0.0.0?
? network 192.168.1.8 0.0.0.3?
? network 172.16.10.0 0.0.0.255?
? network 172.16.20.0 0.0.0.255?
分部出口防火墻
sysname FW2 # interface GigabitEthernet1/0/0 ?ip address 192.168.1.10 255.255.255.252 # interface GigabitEthernet1/0/1 ?ip address 210.1.1.2 255.255.255.252 # interface Tunnel0 ?ip address 10.1.12.2 255.255.255.0 ?tunnel-protocol gre ?source 210.1.1.2 ?destination 200.1.1.1 # firewall zone trust ?add interface GigabitEthernet1/0/0 ?add interface Tunnel0 # firewall zone untrust ?add interface GigabitEthernet1/0/1 # ospf 1 ?default-route-advertise ?area 0.0.0.0 ? network 192.168.1.8 0.0.0.3 # ip route-static 0.0.0.0 0.0.0.0 210.1.1.1 ip route-static 192.168.10.0 255.255.255.0 Tunnel0 ip route-static 192.168.20.0 255.255.255.0 Tunnel0 ip route-static 192.168.30.0 255.255.255.0 Tunnel0 ip route-static 192.168.50.0 255.255.255.0 Tunnel0 # security-policy ?rule name t-u ? source-zone trust ? destination-zone untrust ? source-address 172.16.10.0 mask 255.255.255.0 ? source-address 172.16.20.0 mask 255.255.255.0 ? action permit ?rule name l-u ? source-zone local ? source-zone untrust ? destination-zone local ? destination-zone untrust ? action permit ?rule name gre ? source-zone untrust ? destination-zone trust ? source-address 192.168.10.0 mask 255.255.255.0 ? source-address 192.168.20.0 mask 255.255.255.0 ? source-address 192.168.30.0 mask 255.255.255.0 ? source-address 192.168.50.0 mask 255.255.255.0 ? destination-address 172.16.10.0 mask 255.255.255.0 ? destination-address 172.16.20.0 mask 255.255.255.0 ? action permit ?rule name gre- ? source-zone trust ? destination-zone untrust ? source-address 172.16.10.0 mask 255.255.255.0 ? source-address 172.16.20.0 mask 255.255.255.0 ? destination-address 192.168.10.0 mask 255.255.255.0 ? destination-address 192.168.20.0 mask 255.255.255.0 ? destination-address 192.168.30.0 mask 255.255.255.0 ? destination-address 192.168.50.0 mask 255.255.255.0 ? action permit # nat-policy ?rule name gre ? source-zone trust ? destination-zone untrust ? source-address 172.16.10.0 mask 255.255.255.0 ? destination-address 192.168.10.0 mask 255.255.255.0 ? destination-address 192.168.20.0 mask 255.255.255.0 ? destination-address 192.168.30.0 mask 255.255.255.0 ? destination-address 192.168.50.0 mask 255.255.255.0 ? action no-nat ?rule name isp ? source-zone trust ? destination-zone untrust ? source-address 172.16.10.0 mask 255.255.255.0 ? source-address 172.16.20.0 mask 255.255.255.0 ? action source-nat easy-ip
實(shí)驗(yàn)測(cè)試驗(yàn)證
MSTP驗(yàn)證
Vrrp驗(yàn)證
Dhcp驗(yàn)證
Ospf驗(yàn)證
Nat驗(yàn)證
?
連通性測(cè)試
所有配置全部公開(kāi),復(fù)制居然都做不通,反倒私信說(shuō)我實(shí)驗(yàn)有問(wèn)題!
2023-12-21-23:49?實(shí)驗(yàn)二次校驗(yàn),再次驗(yàn)證,再不通的不要說(shuō)我的作品有問(wèn)題文章來(lái)源:http://www.zghlxwxcb.cn/news/detail-471842.html
文章來(lái)源地址http://www.zghlxwxcb.cn/news/detail-471842.html
到了這里,關(guān)于中小型企業(yè)網(wǎng)網(wǎng)絡(luò)搭建ensp模擬的文章就介紹完了。如果您還想了解更多內(nèi)容,請(qǐng)?jiān)谟疑辖撬阉鱐OY模板網(wǎng)以前的文章或繼續(xù)瀏覽下面的相關(guān)文章,希望大家以后多多支持TOY模板網(wǎng)!