交換機(jī)、路由器防火墻配置
VLAN及VLAN間路由
首先配置兩個三層交換機(jī)作為內(nèi)網(wǎng)通信使用的三層交換機(jī)LSW1、2
創(chuàng)建VLAN
三層交換機(jī)與下面的二層交換機(jī)連接設(shè)置trunk
三層交換機(jī)與路由器連接設(shè)置access
三層1:
vlan batch 30 40 50 60 70 100
interface Vlanif30
ip address 192.168.3.1 255.255.255.0
interface Vlanif40
ip address 192.168.4.1 255.255.255.0
interface Vlanif50
ip address 192.168.5.1 255.255.255.0
interface Vlanif60
ip address 192.168.6.1 255.255.255.0
interface Vlanif70
ip address 192.168.7.1 255.255.255.0
interface Vlanif100
ip address 192.168.8.11 255.255.255.0
interface GigabitEthernet0/0/1
port link-type trunk
port trunk allow-pass vlan 30 40 50 60 70
interface GigabitEthernet0/0/2
port link-type trunk
port trunk allow-pass vlan 30 40 50 60 70
interface GigabitEthernet0/0/3
port link-type access
port default vlan 100
interface GigabitEthernet0/0/4
port link-type access
port default vlan 100
三層2:
vlan batch 30 40 50 60 70 200
interface Vlanif30
ip address 192.168.3.1 255.255.255.0
interface Vlanif40
ip address 192.168.4.1 255.255.255.0
interface Vlanif50
ip address 192.168.5.1 255.255.255.0
interface Vlanif60
ip address 192.168.6.1 255.255.255.0
interface Vlanif70
ip address 192.168.7.1 255.255.255.0
interface Vlanif200
ip address 192.168.9.11 255.255.255.0
interface GigabitEthernet0/0/1
port link-type trunk
port trunk allow-pass vlan 30 40 50 60 70
interface GigabitEthernet0/0/2
port link-type trunk
port trunk allow-pass vlan 30 40 50 60 70
interface GigabitEthernet0/0/3
port link-type access
port default vlan 200
interface GigabitEthernet0/0/4
port link-type access
port default vlan 200
再進(jìn)行內(nèi)網(wǎng)通信的二層交換機(jī)的配置
SW1：
vlan batch 10 20
interface Vlanif10
ip address 172.16.1.1 255.255.255.0
interface Vlanif20
ip address 172.16.2.1 255.255.255.0
interface Ethernet0/0/1
port link-type access
port default vlan 10
interface Ethernet0/0/2
port link-type access
port default vlan 20
interface Ethernet0/0/3
port link-type trunk
port trunk allow-pass vlan 10 20 30 40 50 60 70 100 200
SW2:
vlan batch 30 40 50 60 70
interface Vlanif30
ip address 192.168.3.1 255.255.255.0
interface Vlanif40
ip address 192.168.4.1 255.255.255.0
interface Ethernet0/0/1
port link-type trunk
port trunk allow-pass vlan 30 40 50 60 70
interface Ethernet0/0/2
port link-type access
port default vlan 30
interface Ethernet0/0/3
port link-type access
port default vlan 40
SW3:
vlan batch 30 40 50 60 70
interface Vlanif50
ip address 192.168.5.1 255.255.255.0
interface Vlanif60
ip address 192.168.6.1 255.255.255.0
interface Vlanif70
ip address 192.168.7.1 255.255.255.0
interface MEth0/0/1
interface Eth-Trunk0
interface Ethernet0/0/1
port link-type trunk
port trunk allow-pass vlan 30 40 50 60 70
interface Ethernet0/0/2
port link-type access
port default vlan 50
interface Ethernet0/0/3
port link-type access
port default vlan 60
interface Ethernet0/0/4
port link-type access
port default vlan 70
最后配置連接防火墻、路由器以及服務(wù)器的三層交換機(jī)
LSW3:
vlan batch 300 400 500 600
interface Vlanif300
ip address 13.0.0.1 255.255.255.252
interface Vlanif400
ip address 14.0.0.1 255.255.255.252
interface Vlanif500
ip address 192.168.10.2 255.255.255.0
interface Vlanif600
ip address 192.168.1.1 255.255.255.0
interface GigabitEthernet0/0/1
port link-type access
port default vlan 300
interface GigabitEthernet0/0/2
port link-type access
port default vlan 400
interface GigabitEthernet0/0/3
port link-type access
port default vlan 500
interface GigabitEthernet0/0/4
port link-type access
port default vlan 500
interface GigabitEthernet0/0/5
port link-type access
port default vlan 600
4.2 單臂路由
先配置二層交換機(jī)
二層交換機(jī)與pc相連設(shè)置access
二層交換機(jī)與路由器相連設(shè)置trunk
再配置路由器AR1子接口和單臂路由
此處AR1屬于RIP區(qū)域所以不需要配置靜態(tài)路由
AR1:
interface GigabitEthernet0/0/0.1
dot1q termination vid 10
ip address 172.16.1.1 255.255.255.0
arp broadcast enable
interface GigabitEthernet0/0/0.2
dot1q termination vid 20
ip address 172.16.2.1 255.255.255.0
arp broadcast enable
interface GigabitEthernet0/0/1
ip address 10.0.0.2 255.255.255.252
4.3 RIP及OSPF配置
RIP區(qū)域
AR1配置端口IP和回環(huán)口IP宣告網(wǎng)段
AR4作為ASBR需要在G0/0/0接口上配置端口IP并宣告網(wǎng)段
AR1:
int loopback 0
ip add 1.1.1.1 32
rip 1
undo summary
version 2
network 10.0.0.0
network 192.168.0.0
network 1.0.0.0
network 172.16.0.0
AR2:
rip 1
undo summary
version 2
network 10.0.0.0
network 4.0.0.0
network 11.0.0.0
network 12.0.0.0
OSPF區(qū)域
配置AR2、3、4，三層1、2，LSW，F(xiàn)W1、2端口IP地址，和回環(huán)口IP并宣告網(wǎng)段
AR2:
interface LoopBack0
ip address 2.2.2.2 255.255.255.255
ospf 1
area 0.0.0.0
network 13.0.0.0 0.0.0.3
area 0.0.0.1
network 2.2.2.2 0.0.0.0
network 11.0.0.0 0.0.0.3
network 192.168.8.0 0.0.0.255
network 192.168.9.0 0.0.0.255
AR3:
interface LoopBack0
ip address 3.3.3.3 255.255.255.255
ospf 1
area 0.0.0.0
network 14.0.0.0 0.0.0.3
area 0.0.0.1
network 3.3.3.3 0.0.0.0
network 12.0.0.0 0.0.0.3
network 192.168.8.0 0.0.0.255
network 192.168.9.0 0.0.0.255
AR4:
interface LoopBack0
ip address 4.4.4.4 255.255.255.255
ospf 1
area 0.0.0.1
network 4.4.4.4 0.0.0.0
network 11.0.0.0 0.0.0.3
network 12.0.0.0 0.0.0.3
三層1：
ospf 1
area 0.0.0.1
network 192.168.8.0 0.0.0.255
network 192.168.3.0 0.0.0.255
network 192.168.4.0 0.0.0.255
network 192.168.5.0 0.0.0.255
network 192.168.6.0 0.0.0.255
network 192.168.7.0 0.0.0.255
三層2:
ospf 1
area 0.0.0.1
network 192.168.9.0 0.0.0.255
network 192.168.8.0 0.0.0.255
network 192.168.7.0 0.0.0.255
network 192.168.6.0 0.0.0.255
network 192.168.5.0 0.0.0.255
network 192.168.4.0 0.0.0.255
network 192.168.3.0 0.0.0.255
network 192.168.2.0 0.0.0.255
network 192.168.1.0 0.0.0.255
LSW1:
interface LoopBack0
ip address 7.7.7.7 255.255.255.255
ospf 1
area 0.0.0.0
network 13.0.0.0 0.0.0.3
network 14.0.0.0 0.0.0.3
network 192.168.10.0 0.0.0.255
network 7.7.7.7 0.0.0.0
FW1:
interface LoopBack0
ip address 5.5.5.5 255.255.255.255
ospf 1
area 0.0.0.0
network 5.5.5.5 0.0.0.0
network 61.139.1.0 0.0.0.255
network 172.30.1.0 0.0.0.255
network 192.168.10.0 0.0.0.255
FW2:
interface LoopBack0
ip address 6.6.6.6 255.255.255.255
ospf 1
area 0.0.0.0
network 6.6.6.6 0.0.0.0
network 61.139.1.0 0.0.0.255
network 172.30.1.0 0.0.0.255
network 192.168.10.0 0.0.0.255
如圖為AR4學(xué)到的路由表
4.4配置重分發(fā)實現(xiàn)內(nèi)網(wǎng)互通
重分發(fā)：
在AR1、4中配置重分發(fā)使得rip區(qū)域和ospf區(qū)域可以相互學(xué)習(xí)獲得網(wǎng)段
AR1:
rip 1
import-route ospf 1
AR4:
ospf 1
import-route rip 1 cost 100
rip 1
import-route ospf 1
如圖是AR1學(xué)到的路由條目
驗證：
至此內(nèi)網(wǎng)已經(jīng)可以全部ping通
4.5 核心路由器VRRP
核心路由器AR2、3配置雙機(jī)熱備
AR2:
interface gigabitethernet 0/0/1
vrrp vrid 1 virtual-ip 192.168.8.1
vrrp vrid 1 priority 120
vrrp vrid 1 preempt-mode timer delay 20
vrrp vrid 1 track interface g0/0/1 reduced 30
interface gigabitethernet 4/0/0
vrrp vrid 2 virtual-ip 192.168.9.1
AR3:
interface gigabitethernet 0/0/2
vrrp vrid 2 virtual-ip 192.168.9.1
vrrp vrid 2 priority 120
vrrp vrid 2 preempt-mode timer delay 20
vrrp vrid 2 track interface g0/0/1 reduced 30
interface gigabitethernet 0/0/0
vrrp vrid 1 virtual-ip 192.168.8.1
vrid1完成雙機(jī)熱備:
vrid2完成雙機(jī)熱備:
4.6防火墻VRRP
防火墻配置VRRP
FW1:
安全策略配置
firewall zone trust
add int g1/0/0
firewall zone dmz
add int g1/0/2
firewall zone untrust
add int g1/0/1
security-policy
rule name aaa
source-zone local
destination-zone dmz
action permit
quit
rule name trust_to_untrust
source-zone trust
destination-zone untrust
action permit
配置VRRP備份組
int g1/0/0
vrrp vrid 1 virtual-ip 192.168.10.1 active
int g1/0/1
vrrp vrid 2 virtual-ip 61.139.1.1 active
hrp interface GigabitEthernet 1/0/2 remote 172.30.1.2
hrp enable
hrp auto-sync
監(jiān)控上行鏈路:
hrp track interface GigabitEthernet 1/0/0
配置快速會話備份功能
hrp mirror session enable
FW2:
安全策略配置
firewall zone trust
add int g1/0/0
firewall zone dmz
add int g1/0/2
firewall zone untrust
add int g1/0/1
security-policy
rule name aaa
source-zone local
destination-zone dmz
action permit
quit
rule name trust_to_untrust
source-zone trust
destination-zone untrust
action permit
配置VRRP備份組
int g1/0/0
vrrp vrid 1 virtual-ip 192.168.10.1 standby
int g1/0/1
vrrp vrid 2 virtual-ip 61.139.1.1 standby
hrp interface GigabitEthernet 1/0/2 remote 172.30.1.1
hrp enable
hrp auto-sync
配置快速會話備份功能
hrp mirror session enable
至此主備份已經(jīng)完成
FW1:
FW2:文章來源：http://www.zghlxwxcb.cn/news/detail-481548.html
文章來源地址http://www.zghlxwxcb.cn/news/detail-481548.html
到了這里，關(guān)于交換機(jī)、路由器防火墻配置的文章就介紹完了。如果您還想了解更多內(nèi)容，請在右上角搜索TOY模板網(wǎng)以前的文章或繼續(xù)瀏覽下面的相關(guān)文章，希望大家以后多多支持TOY模板網(wǎng)！
