拓?fù)?/h2>

一、基礎(chǔ)配置

1.根據(jù)附錄1、附錄2，配置設(shè)備接口信息。

在做配置之前需要先配置VSU

S6:
switch virtual domain 1
 switch 1
 switch 1 priority 150
 switch 1 description S6
 port-member interface TenGigabitEthernet 0/49
 port-member interface TenGigabitEthernet 0/50
switch convert mode virtual   //在用戶視圖配置，yes回車后設(shè)備自動重啟
設(shè)備重啟后S6就是master，重命名位VSU

S7:
switch virtual domain 1
 switch 2
 switch 2 priority 120
 switch 2 description S7
 port-member interface TenGigabitEthernet 0/49
 port-member interface TenGigabitEthernet 0/50
switch convert mode virtual

根據(jù)地址規(guī)劃表配置即可，需要在S1和S2創(chuàng)建無線用戶vlan60

2.所有交換機(jī)和無線控制器開啟SSH服務(wù)，用戶名密碼分別為admin、admin1234；密碼為明文類型,特權(quán)密碼為admin。

enable service ssh-server
username admin passowrd 0 admin1234

crypto key generate rsa   //yes然后回車

line vty 0 4
 transport input ssh 
 login loca
 
enable password admin

3.交換機(jī)配置SNMP功能，向主機(jī)172.16.0.254發(fā)送Trap消息版本采用V2C，讀寫的Community為“Test”，只讀的Community為“public”，開啟Trap消息。

enable service snmp-agent
snmp-server enable traps
snmp-server enable version v2c
snmp-server community Test rw 
snmp-server community Public ro 
snmp-server host 172.16.0.254 traps version 2c Test
snmp-server host 172.16.0.254 traps version 2c Public

二、有線網(wǎng)絡(luò)配置

1.在全網(wǎng)Trunk鏈路上做VLAN修剪。

S1:
interface range GigabitEthernet 0/21-22  //地址表和拓?fù)鋱D接口不一致，根據(jù)拓?fù)鋪淼?/span>
 switchport mode trunk
 switchport trunk native vlan 50
 switchport trunk allowed vlan only 50,60   //地址表沒有vlan60，自己創(chuàng)建
 
interface range GigabitEthernet 0/23-24
 switchport mode trunk
 switchport trunk allowed vlan only 10,20,30,40,50,60,100

S2:
interface range GigabitEthernet 0/1-20
 switchport mode trunk
 switchport trunk native vlan 50
 switchport trunk allowed vlan only 50,60
 
interface range GigabitEthernet 0/23-24
 switchport mode trunk
 switchport trunk allowed vlan only 10,20,50,60,100  //vlan60自己創(chuàng)建

S3-S4:
interface GigabitEthernet 0/1
 switchport mode trunk
 switchport trunk allowed vlan only 10,20,30,40,50,60,100
 
interface AggregatePort 1
 switchport mode trunk
 switchport trunk allowed vlan only 10,20,30,40,50,60,100
 
interface range GigabitEthernet 0/21-22
 port-group 1 mode active

VSU:
interface range GigabitEthernet 1/0/1,2/0/1
 switchport mode trunk
 switchport trunk allowed vlan only 10,20,50,60,100
VSU和S2之間會環(huán)路，要開啟STP，也可以將這兩個接口配置成聚合組

AC1-AC2:
interface GigabitEthernet 0/1
 switchport mode trunk
 switchport trunk allowed vlan only 100

S5:
interface range GigabitEthernet 0/1-2
 switchport mode trunk
 switchport trunk allowed vlan only 100

2.為隔離部分終端用戶間的二層互訪，在交換機(jī)S5的Gi0/1-Gi0/10端口啟用端口保護(hù)。

S5：
interface range GigabitEthernet 0/1-10
 switchport protected

3.為規(guī)避網(wǎng)絡(luò)末端接入設(shè)備上出現(xiàn)環(huán)路影響全網(wǎng)，要求在總部接入設(shè)備S1進(jìn)行防環(huán)處理。具體要求如下：終端接口開啟BPDU防護(hù)不能接收 BPDU報(bào)文；終端接口下開啟 RLDP防止環(huán)路，檢測到環(huán)路后處理方式為Shutdown-Port；連接PC終端的所有端口配置為邊緣端口；如果端口被 BPDU Guard檢測進(jìn)入Err-Disabled狀態(tài)，再過 300 秒后會自動恢復(fù)（基于接口部署策略），重新檢測是否有環(huán)路。

S1：
rldp enable
interface range GigabitEthernet 0/1-16
 errdisable recovery interval 300
 spanning-tree bpduguard enable
 spanning-tree bpdufilter enable
 rldp port loop-detect shutdown-port

4.在交換機(jī)S3、S4上配置DHCP中繼，對VLAN10內(nèi)的用戶進(jìn)行中繼，使得總部PC1用戶使用DHCP Relay方式獲取IP地址。

S3-S4:
service dhcp 
int vlan 10
 ip helper-address 11.1.0.11

5.DHCP服務(wù)器搭建于EG1上，地址池命名為Pool_VLAN10，DHCP對外服務(wù)使用loopback 0地址。

EG1：
service dhcp 
ip dhcp pool Pool_VLAN10
 network 192.1.10.0 255.255.255.0
 default-router 192.1.10.254

6.為了防御動態(tài)環(huán)境局域網(wǎng)偽DHCP服務(wù)欺騙，在S1交換機(jī)部署DHCP Snooping功能。

S1:
ip dhcp snooping
interface range GigabitEthernet 0/23-24
 ip dhcp snooping trust

7.在總部交換機(jī)S1、S3、S4上配置MSTP防止二層環(huán)路；要求VLAN10、VLAN20、VLAN50、VLAN60、VLAN100數(shù)據(jù)流經(jīng)過S3轉(zhuǎn)發(fā)，S3失效時經(jīng)過S4轉(zhuǎn)發(fā)；VLAN30、VLAN40數(shù)據(jù)流經(jīng)過S4轉(zhuǎn)發(fā)，S4失效時經(jīng)過S3轉(zhuǎn)發(fā)。所配置的參數(shù)要求如下：region-name為test；revision版本為1；S3作為實(shí)例1的主根、實(shí)例2的從根，
S4作為實(shí)例2的主根、實(shí)例2的從根；生成樹優(yōu)先級可設(shè)置為4096、8192或保持默認(rèn)值；在S3和S4上配置VRRP，實(shí)現(xiàn)主機(jī)的網(wǎng)關(guān)冗余，所配置的參數(shù)要求如下表；S3、S4各VRRP組中高優(yōu)先級設(shè)置為150，低優(yōu)先級設(shè)置為120。

S1:
spanning-tree mst configuration
 revision 1
 name test
 instance 1 vlan 10, 20, 50, 60, 100
 instance 2 vlan 30, 40
!
spanning-tree

S3:
spanning-tree mst configuration
 revision 1
 name test
 instance 1 vlan 10, 20, 50, 60, 100
 instance 2 vlan 30, 40
!
spanning-tree mst 1 priority 4096
spanning-tree mst 2 priority 8192
spanning-tree

interface VLAN 10
 vrrp 10 ip 192.1.10.254
 vrrp 10 priority 150
!
interface VLAN 20
 vrrp 20 ip 192.1.20.254
 vrrp 20 priority 150
!
interface VLAN 30
 vrrp 30 ip 192.1.30.254
 vrrp 30 priority 120
!
interface VLAN 40
 vrrp 40 ip 192.1.40.254
 vrrp 40 priority 120
!
interface VLAN 50
 vrrp 50 ip 192.1.50.254
 vrrp 50 priority 150
!
interface VLAN 60
 vrrp 60 ip 192.1.60.254
 vrrp 60 priority 150
!
interface VLAN 100
 vrrp 100 ip 192.1.100.254
 vrrp 100 priority 150

S4:
spanning-tree mst configuration
 revision 1
 name test
 instance 1 vlan 10, 20, 50, 60, 100
 instance 2 vlan 30, 40
!
spanning-tree mst 1 priority 8192
spanning-tree mst 2 priority 4096
spanning-tree

interface VLAN 10
 vrrp 10 ip 192.1.10.254
 vrrp 10 priority 120
!
interface VLAN 20
 vrrp 20 ip 192.1.20.254
 vrrp 20 priority 120
!
interface VLAN 30
 vrrp 30 ip 192.1.30.254
 vrrp 30 priority 150
!
interface VLAN 40
 vrrp 40 ip 192.1.40.254
 vrrp 40 priority 150
!
interface VLAN 50
 vrrp 50 ip 192.1.50.254
 vrrp 50 priority 120
!
interface VLAN 60
 vrrp 60 ip 192.1.60.254
 vrrp 60 priority 120
!
interface VLAN 100
 vrrp 100 ip 192.1.100.254
 vrrp 100 priority 120

8.分部兩臺數(shù)據(jù)中心交換機(jī)通過虛擬化為一臺設(shè)備進(jìn)行管理，其中S6為主，S7為備；規(guī)劃S6和S7間的Gi0/48端口作為雙主機(jī)檢測鏈路，配置基于BFD的雙主機(jī)檢；主設(shè)備：Domain id：1,switch id:1,priority 150;備設(shè)備：Domain id：1,switch id:2,priority120。

VSU:
基礎(chǔ)配置那配置過了
switch virtual domain 1
 dual-active detection bfd
 dual-active bfd interface GigabitEthernet 1/0/48
 dual-active bfd interface GigabitEthernet 2/0/48

9.總部與分部內(nèi)網(wǎng)均使用OSPF協(xié)議組網(wǎng)，總部、分部與互聯(lián)網(wǎng)間使用靜態(tài)路由協(xié)議。具體要求如下：總部S3、S4、EG1間運(yùn)行OSPF，進(jìn)程號為10，規(guī)劃單區(qū)域0；分部S6/S7、EG2間運(yùn)行OSPF，進(jìn)程號為20，規(guī)劃單區(qū)域0；服務(wù)器區(qū)使用靜態(tài)路由組網(wǎng)；重發(fā)布路由進(jìn)OSPF中使用類型1。

EG1:
ip route 0.0.0.0 0.0.0.0 20.1.0.2
router ospf 10
 network 10.1.0.0 0.0.0.3 area 0
 network 10.1.0.4 0.0.0.3 area 0
 network 11.1.0.11 0.0.0.0 area 0
 default-information originate metric-type 1

S3:
router ospf 10
 passive-interface VLAN 10
 passive-interface VLAN 20
 passive-interface VLAN 30
 passive-interface VLAN 40
 passive-interface VLAN 50
 passive-interface VLAN 60
 network 10.1.0.0 0.0.0.3 area 0
 network 11.1.0.33 0.0.0.0 area 0
 network 192.1.10.0 0.0.0.255 area 0
 network 192.1.20.0 0.0.0.255 area 0
 network 192.1.30.0 0.0.0.255 area 0
 network 192.1.40.0 0.0.0.255 area 0
 network 192.1.50.0 0.0.0.255 area 0
 network 192.1.60.0 0.0.0.255 area 0
 network 192.1.100.0 0.0.0.255 area 0

S4:
router ospf 10
 passive-interface VLAN 10
 passive-interface VLAN 20
 passive-interface VLAN 30
 passive-interface VLAN 40
 passive-interface VLAN 50
 passive-interface VLAN 60
 network 10.1.0.4 0.0.0.3 area 0
 network 11.1.0.34 0.0.0.0 area 0
 network 192.1.10.0 0.0.0.255 area 0
 network 192.1.20.0 0.0.0.255 area 0
 network 192.1.30.0 0.0.0.255 area 0
 network 192.1.40.0 0.0.0.255 area 0
 network 192.1.50.0 0.0.0.255 area 0
 network 192.1.60.0 0.0.0.255 area 0
 network 192.1.100.0 0.0.0.255 area 0

EG2:
ip route 0.0.0.0 0.0.0.0 30.1.0.2
router ospf 20
 network 10.1.0.12 0.0.0.3 area 0
 network 10.1.0.16 0.0.0.3 area 0
 network 11.1.0.12 0.0.0.0 area 0
 default-information originate metric-type 1

VSU:
router ospf 20
 redistribute connected metric-type 1 subnets
 network 10.1.0.12 0.0.0.3 area 0
 network 10.1.0.16 0.0.0.3 area 0
 network 11.1.0.67 0.0.0.0 area 0

S5:
ip route 0.0.0.0 0.0.0.0 40.1.0.2
ip route 11.1.0.204 255.255.255.255 194.1.100.2
ip route 11.1.0.205 255.255.255.255 194.1.100.3

10.總部與分部部署IPV6網(wǎng)絡(luò)實(shí)現(xiàn)總分機(jī)構(gòu)內(nèi)網(wǎng)IPV6終端可通過無狀態(tài)自動從網(wǎng)關(guān)處獲取地址。IPV6地址規(guī)劃如下：
11.在S3和S4上配置VRRP for IPv6，實(shí)現(xiàn)主機(jī)的IPv6網(wǎng)關(guān)冗余;在S3和S4上VRRP與MSTP的主備狀態(tài)與IPV4網(wǎng)絡(luò)一致。

S3:
ipv6 unicast-routing
interface VLAN 10
 ip address 192.1.10.252 255.255.255.0
 vrrp 10 ip 192.1.10.254
 vrrp 10 ipv6 FE80::
 ipv6 address 2001:192:10::252/64
 ipv6 enable
 no ipv6 nd suppress-ra
 vrrp ipv6 10 priority 150
 vrrp 10 priority 150
!
interface VLAN 20
 ip address 192.1.20.252 255.255.255.0
 vrrp 20 ip 192.1.20.254
 vrrp 20 ipv6 FE80::
 ipv6 address 2001:192:20::252/64
 ipv6 enable
 no ipv6 nd suppress-ra
 vrrp ipv6 20 priority 150
 vrrp 20 priority 150
!
interface VLAN 30
 ip address 192.1.30.252 255.255.255.0
 vrrp 30 ip 192.1.30.254
 vrrp 30 ipv6 FE80::
 ipv6 address 2001:192:30::252/64
 ipv6 enable
 no ipv6 nd suppress-ra
 vrrp ipv6 30 priority 120
 vrrp 30 priority 120
!
interface VLAN 40
 ip address 192.1.40.252 255.255.255.0
 vrrp 40 ip 192.1.40.254
 vrrp 40 ipv6 FE80::
 ipv6 address 2001:192:40::252/64
 ipv6 enable
 vrrp ipv6 40 priority 120
 vrrp 40 priority 120
!
interface VLAN 50
 ip address 192.1.50.252 255.255.255.0
 vrrp 50 ip 192.1.50.254
 vrrp 50 priority 150
!
interface VLAN 60
 ip address 192.1.60.252 255.255.255.0
 vrrp 60 ip 192.1.60.254
 vrrp 60 ipv6 FE80::
 ipv6 address 2001:192:60::252/64
 ipv6 enable
 no ipv6 nd suppress-ra
 vrrp ipv6 60 priority 150
 vrrp 60 priority 150
!
interface VLAN 100
 ip address 192.1.100.252 255.255.255.0
 vrrp 100 ip 192.1.100.254
 vrrp 100 ipv6 FE80::
 ipv6 address 2001:192:100::252/64
 ipv6 enable
 no ipv6 nd suppress-ra
 vrrp ipv6 100 priority 150
 vrrp 100 priority 150

S4:
interface VLAN 10
 ip address 192.1.10.253 255.255.255.0
 vrrp 10 ip 192.1.10.254
 vrrp 10 ipv6 FE80::
 ipv6 address 2001:192:10::253/64
 ipv6 enable
 no ipv6 nd suppress-ra
 vrrp ipv6 10 priority 120
 vrrp 10 priority 120
!
interface VLAN 20
 ip address 192.1.20.253 255.255.255.0
 vrrp 20 ip 192.1.20.254
 vrrp 20 ipv6 FE80::
 ipv6 address 2001:192:20::253/64
 ipv6 enable
 no ipv6 nd suppress-ra
 vrrp ipv6 20 priority 120
 vrrp 20 priority 120
!
interface VLAN 30
 ip address 192.1.30.253 255.255.255.0
 vrrp 30 ip 192.1.30.254
 vrrp 30 ipv6 FE80::
 ipv6 address 2001:192:30::253/64
 ipv6 enable
 no ipv6 nd suppress-ra
 vrrp ipv6 30 priority 150
 vrrp 30 priority 150
!
interface VLAN 40
 ip address 192.1.40.253 255.255.255.0
 vrrp 40 ip 192.1.40.254
 vrrp 40 ipv6 FE80::
 ipv6 address 2001:192:40::253/64
 ipv6 enable
 vrrp ipv6 40 priority 150
 vrrp 40 priority 150
!
interface VLAN 50
 ip address 192.1.50.253 255.255.255.0
 vrrp 50 ip 192.1.50.254
 vrrp 50 priority 120
!
interface VLAN 60
 ip address 192.1.60.253 255.255.255.0
 vrrp 60 ip 192.1.60.254
 vrrp 60 ipv6 FE80::
 ipv6 address 2001:192:60::253/64
 ipv6 enable
 no ipv6 nd suppress-ra
 vrrp ipv6 60 priority 120
 vrrp 60 priority 120
!
interface VLAN 100
 ip address 192.1.100.253 255.255.255.0
 vrrp 100 ip 192.1.100.254
 vrrp 100 ipv6 FE80::
 ipv6 address 2001:192:100::253/64
 ipv6 enable
 no ipv6 nd suppress-ra
 vrrp ipv6 100 priority 120
 vrrp 100 priority 120

12.R1、R2、R3直連接口封裝PPP協(xié)議，部署IGP中OSPF動態(tài)路由實(shí)現(xiàn)直連網(wǎng)段互聯(lián)互通。

R1:
router ospf 100
 redistribute connected metric-type 1 subnets
 network 11.1.0.1 0.0.0.0 area 0
 network 12.1.0.0 0.0.0.15 area 0
 network 13.1.0.0 0.0.0.15 area 0
 summary-address 20.1.0.0 255.255.0.0
interface Serial 2/0    
 encapsulation PPP
 ip ospf network point-to-point
 ip address 12.1.0.1 255.255.255.240
interface Serial 2/1    //路由器s2/1表示S3/0接口
 encapsulation PPP
 ip ospf network point-to-point
 ip address 13.1.0.1 255.255.255.240

R2:
router ospf 100
 redistribute connected metric-type 1 subnets
 network 11.1.0.2 0.0.0.0 area 0
 network 12.1.0.0 0.0.0.15 area 0
 network 23.1.0.0 0.0.0.15 area 0
 summary-address 30.1.0.0 255.255.0.0
interface Serial 2/0
 encapsulation PPP
 ip ospf network point-to-point
 ip address 12.1.0.2 255.255.255.240
interface Serial 2/1
 encapsulation PPP
 ip ospf network point-to-point
 ip address 23.1.0.2 255.255.255.240

R3:
router ospf 100
 redistribute connected metric-type 1 subnets
 network 11.1.0.3 0.0.0.0 area 0
 network 13.1.0.0 0.0.0.15 area 0
 network 23.1.0.0 0.0.0.15 area 
interface Serial 2/0
 encapsulation PPP
 ip ospf network point-to-point
 ip address 13.1.0.3 255.255.255.240
interface Serial 2/1
 encapsulation PPP
 ip ospf network point-to-point
 ip address 23.1.0.3 255.255.255.240

13.R1、R2、R3間部署IBGP,AS號為100, 使用Loopback接口建立Peer。
14.運(yùn)營商通告EG1、EG2專線至服務(wù)器區(qū)，R1、R2均以匯總B段靜態(tài)路由的方式進(jìn)行發(fā)布。服務(wù)器區(qū)通過R3將AC1、AC2通告到BGP中。

R1:
router bgp 100
 bgp router-id 11.1.0.1
 neighbor 11.1.0.2 remote-as 100
 neighbor 11.1.0.2 update-source Loopback 0
 neighbor 11.1.0.3 remote-as 100
 neighbor 11.1.0.3 update-source Loopback 0

R2:
router bgp 100
 bgp router-id 11.1.0.2
 neighbor 11.1.0.1 remote-as 100
 neighbor 11.1.0.1 update-source Loopback 0
 neighbor 11.1.0.3 remote-as 100
 neighbor 11.1.0.3 update-source Loopback 0

R3:
router bgp 100
 neighbor 11.1.0.1 remote-as 100
 neighbor 11.1.0.1 update-source Loopback 0
 neighbor 11.1.0.2 remote-as 100
 neighbor 11.1.0.2 update-source Loopback 0
 network 11.1.0.204 mask 255.255.255.255
 network 11.1.0.205 mask 255.255.255.255

ip route 11.1.0.204 255.255.255.255 40.1.0.1
ip route 11.1.0.205 255.255.255.255 40.1.0.1

15.可通過修改OSPF 路由COST達(dá)到分流的目的，且其值必須為5或10。
16.總部財(cái)務(wù)、銷售IPV4用戶與互聯(lián)網(wǎng)互通主路徑規(guī)劃為：S3-EG1。
17.總部研發(fā)、市場IPV4用戶與互聯(lián)網(wǎng)互通主路徑規(guī)劃為：S4-EG1。
18.主鏈路故障可無縫切換到多條備用鏈路上。

S3:
int vlan 10
 ip ospf cost 5
int vlan 20
 ip ospf cost 5
int vlan 30
 ip ospf cost 10
int vlan 40
 ip ospf cost 10

S4:
int vlan 10
 ip ospf cost 10
int vlan 20
 ip ospf cost 10
int vlan 30
 ip ospf cost 5
int vlan 40
 ip ospf cost 5

三、無線網(wǎng)絡(luò)配置

1.繪制AP點(diǎn)位圖（包括：AP型號、編號、信道等信息，其中信道采用2.4G的1、6、11三個信道進(jìn)行規(guī)劃）。

2.使用無線地勘軟件，輸出AP點(diǎn)位圖的2.4G頻道的信號仿真熱圖（仿真信號強(qiáng)度要求大于-65db）。

3.根據(jù)表3無線產(chǎn)品價格表，制定該無線網(wǎng)絡(luò)工程項(xiàng)目設(shè)備的預(yù)算表。

4.使用S3、S4作為總部無線用戶和無線AP的DHCP 服務(wù)器，使用S6/S7作為分部無線用戶和無線AP的DHCP服務(wù)器。

S3:
service dhcp
ip dhcp pool ap
 option 138 ip 11.1.0.204 11.1.0.205 
 network 192.1.50.0 255.255.255.0
 default-router 192.1.50.254 
!
ip dhcp pool sta
 network 192.1.60.0 255.255.255.0
 default-router 192.1.60.254

S4:
service dhcp 
ip dhcp pool ap
 option 138 ip 11.1.0.204 11.1.0.205 
 network 192.1.50.0 255.255.255.0
 default-router 192.1.50.254 
!
ip dhcp pool sta
 network 192.1.60.0 255.255.255.0
 default-router 192.1.60.254

VSU:
service dhcp 
ip dhcp pool ap
 option 138 ip 11.1.0.204 11.1.0.205 
 network 193.1.50.0 255.255.255.0
 default-router 193.1.50.254 
!
ip dhcp pool sta
 network 193.1.60.0 255.255.255.0
 default-router 193.1.60.254

5.創(chuàng)建總部內(nèi)網(wǎng) SSID 為 test-ZB_XX(XX現(xiàn)場提供)，WLAN ID 為1，AP-Group為ZB，總部內(nèi)網(wǎng)無線用戶關(guān)聯(lián)SSID后可自動獲取地址。
6.創(chuàng)建分部內(nèi)網(wǎng) SSID 為 test-FB_XX(XX現(xiàn)場提供)，WLAN ID 為2，AP-Group為FB，總部內(nèi)網(wǎng)無線用戶關(guān)聯(lián)SSID后可自動獲取地址。

7.AC1為主用，AC2為備用。AP與AC1、AC2均建立隧道，當(dāng)AP與AC1失去連接時能無縫切換至AC2并提供服務(wù)。

AC1:
wlan hot-backup 11.1.0.205
 local-ip 11.1.0.204
 !
 context 10
  priority level 7
  ap-group FB
  ap-group ZB
 !
 wlan hot-backup enable

AC2:
wlan hot-backup 11.1.0.204
 local-ip 11.1.0.205
 !        
 context 10
  ap-group FB
  ap-group ZB
 !
 wlan hot-backup enable

注意：AP上線后需要將AP劃分至對應(yīng)的AP組中

8.分部無線用戶接入無線網(wǎng)絡(luò)時需要采用WPA2加密方式，加密密碼為XX(現(xiàn)場提供)。

9.要求總部分部內(nèi)網(wǎng)無線網(wǎng)絡(luò)啟用本地轉(zhuǎn)發(fā)模式。

10.為了保障每個用戶的無線體驗(yàn)，針對WLAN ID2下的每個用戶的下行平均速率為 800KB/s ，突發(fā)速率為1600KB/s。

wlan-config 2 
 wlan-based per-user-limit down-streams average-data-rate 800 burst-data-rate 1600

11.總部每AP最大帶點(diǎn)人數(shù)為30人。

ap-group BZ
 sta-limit 30

12.分部通過時間調(diào)度，要求每周一至周五的21:00至23:30期間關(guān)閉無線服務(wù)。

13.總部設(shè)置AP信號發(fā)送強(qiáng)度為30。

ap-config AP1
 assoc-rssi 30 radio 1
ap-config AP2
 assoc-rssi 30 radio 1

14.總部關(guān)閉低速率（11b/g 1M、2M、5M，11a 6M、9M）應(yīng)用接入。

ac-controller
 802.11g network rate 1 disabled
 802.11g network rate 2 disabled
 802.11g network rate 5 disabled
 802.11b network rate 1 disabled
 802.11b network rate 2 disabled
 802.11b network rate 5 disabled
 802.11a network rate 6 disabled
 802.11a network rate 9 disabled

注意：以上除熱備以外所有配置，在AC1和AC都配置一遍

四、出口網(wǎng)絡(luò)配置

1.出口網(wǎng)關(guān)上進(jìn)行NAT配置實(shí)現(xiàn)總部與分部的所有用戶(ACL 110)均可訪問互聯(lián)網(wǎng)，通過NAPT方式將內(nèi)網(wǎng)用戶IP地址轉(zhuǎn)換到互聯(lián)網(wǎng)接口上。

EG1：
int range g 0/0-1
 ip nat inside
int g 0/4
 ip nat outside   //要將g0/4切換為wan口才能配上，specify int g 0/4 wan
ip access-list extended 110
 5 deny ip 192.1.0.0 0.0.255.255 193.1.0.0 0.0.255.255  //排除ipsec的流量
 10 permit ip 192.1.0.0 0.0.255.255 any
ip nat inside source list 110 interface GigabitEthernet 0/4 overload

EG2:
int range g 0/0-1
 ip nat inside
int g 0/4
 ip nat outside
ip access-list extended 110
 5 deny ip 193.1.0.0 0.0.255.255 192.1.0.0 0.0.255.255 
 10 permit ip 193.1.0.0 0.0.255.255 any
ip nat inside source list 110 interface GigabitEthernet 0/4 overload

2.在總部EG1上配置，使總部核心交換S4（11.1.0.34）設(shè)備的SSH服務(wù)可以通過互聯(lián)網(wǎng)被訪問，將其地址映射至聯(lián)通線路上，映射地址為20.1.0.1。

EG1:
ip nat inside source static tcp 11.1.0.34 22 20.1.0.1 22 permit-inside

3.在總部網(wǎng)關(guān)上啟用Web Portal認(rèn)證服務(wù)，并創(chuàng)建Caiwu1、Xiaoshou2，密碼均為XX（現(xiàn)場提供）。
4.總部有線用戶需進(jìn)行WEB認(rèn)證訪問互聯(lián)網(wǎng)。

5.分部EG2針對訪問外網(wǎng)WEB流量限速每IP 1000Kbps，內(nèi)網(wǎng)WEB總流量不超過50Mbps。

6.分部EG2基于網(wǎng)站訪問、郵件收發(fā)、IM聊天、論壇發(fā)帖、搜索引擎多應(yīng)用啟用審計(jì)功能。

7.對創(chuàng)建的用戶user1用戶上網(wǎng)活動不進(jìn)行監(jiān)控審計(jì)。

8.要求使用IPSec隧道主模式，安全協(xié)議采用esp協(xié)議，加密算法采用3des，認(rèn)證算法采用md5，以IKE方式建立IPsec SA。在EG1和EG2上所配置的參數(shù)要求如下：ipsec加密轉(zhuǎn)換集名稱為myset；預(yù)共享密鑰為明文123456；靜態(tài)的ipsec加密圖mymap。ACL編號為101。文章來源地址http://www.zghlxwxcb.cn/news/detail-713519.html

EG1:
ip access-list extended 101
 10 permit ip 192.1.0.0 0.0.255.255 193.1.0.0 0.0.255.255
crypto isakmp policy 10
 encryption 3des
 authentication pre-share
 hash md5
 group 2
!
crypto isakmp key 0 123456 address 30.1.0.1 
crypto ipsec transform-set myset esp-3des esp-md5-hmac
!
crypto map mymap 10 ipsec-isakmp
 set peer 30.1.0.1  
 set transform-set myset
 set autoup
 match address 101
int g 0/4
 crypto map mymap

EG2:
ip access-list extended 101
 10 permit ip 193.1.0.0 0.0.255.255 192.1.0.0 0.0.255.255
crypto isakmp policy 10
 encryption 3des
 authentication pre-share
 hash md5
 group 2
!
crypto isakmp key 7 021211644c5368 address 20.1.0.1 
crypto ipsec transform-set myset esp-3des esp-md5-hmac
!
crypto map mymap 10 ipsec-isakmp
 set peer 20.1.0.1  
 set transform-set myset
 set autoup
 match address 101
int g 0/4
 crypto map mymap 

到了這里，關(guān)于2022網(wǎng)絡(luò)系統(tǒng)管理-A模塊網(wǎng)絡(luò)構(gòu)建-樣題1-解法的文章就介紹完了。如果您還想了解更多內(nèi)容，請?jiān)谟疑辖撬阉鱐OY模板網(wǎng)以前的文章或繼續(xù)瀏覽下面的相關(guān)文章，希望大家以后多多支持TOY模板網(wǎng)！