200人 500人 园区网设计

实验要求：
①  设置合理的STP优先级、边缘端口、Eth-trunk
②  企业内网划分多个vlan ，减少广播域大小，提高网络稳定性
③  所有设备，在任何位置都可以telnet远程管理
④  出口配置NAT
⑤  所有用户均为自动获取ip地址
⑥  在企业出口将内网服务器的80端口映射出去，允许外网用户访问
⑦  企业财务服务器，只允许财务部（vlan 30）的员工访问。

 步骤① ：STP Eth-trunk

sw1 ：

stp root  primary（设置核心为根桥）

接入：sw2 sw3 sw4 sw5（接入层的连接用户端口设置为边缘端口）

port-g   g  e0/0/1 to e0/0/22 

stp edged-port enable 

sw2--sw1:eth-trunk（交换机2-交换机1的聚合配置）

sw2:                                        sw1:

interface Eth-Trunk2                        interface Eth-Trunk2

mode lacp-static                              mode lacp-static

trunkport gi 0/0/1 0/0/2                     trunkport gi 0/0/1 0/0/4                          

int eth-trunk 2                                   int eth-trunk 2

stp cost 10000                                  stp cost 10000

sw3--sw1:eth-trunk（交换机3-交换机1的聚合配置）

sw3:                                                sw1:

interface Eth-Trunk3                                interface Eth-Trunk3

mode lacp-static                                      stp cost 10000

trunkport gi 0/0/1 0/0/2                            mode lacp-static

stp cost 10000                                         trunkport gi 0/0/6 0/0/7

Eth-Trunk4、Eth-Trunk5配置相似

步骤②：vlan trunk

创建各vlan，配置对应的端口

sw2：                                                               SW3:

vlan 10                                                                        vlan30

vlan 20                                                                        interface Eth-Trunk3

interface Eth-Trunk2                                                   port link-type trunk                                          

port link-type trunk                                                      port trunk allow-pass vlan 2 to 4094

port trunk allow-pass vlan 2 to 4094                           interface Ethernet0/0/1

interface Ethernet0/0/2                                               port link-type access

port link-type access                                                   port default vlan 30

port default vlan 10                                                     interface Ethernet0/0/2

interface Ethernet0/0/3                                               port link-type access

port link-type access                                                   port default vlan 30

port default vlan 20

sw4 sw5 配置相似

核心SW1：

vlan batch 10 20 30 40 200

port-g g Eth-Trunk 2 to Eth-Trunk 5

port link-ty trunk

port trunk allow-pass vlan all

步骤③ ：网关 SVI

sw1：（在核心上配置各个网段的网关地址）

interface Vlanif10

ip address 192.168.10.1 255.255.255.0

interface Vlanif20

ip address 192.168.20.1 255.255.255.0

interface Vlanif30

ip address 192.168.30.1 255.255.255.0

interface Vlanif40

ip address 192.168.40.1 255.255.255.0

interface Vlanif200

ip address 192.168.200.1 255.255.255.0

sw1：（配置三层接口）

vlan 800

interface GigabitEthernet0/0/24

port link-type access

port default vlan 800

interface Vlanif800

ip address 192.168.254.2 255.255.255.0

步骤④：dhcp配置

sw1：（在核心上给各个部门创建地址池）

dhcp enable

ip pool caiwu                                                                ip pool jishu

gateway-list 192.168.30.1                                            gateway-list 192.168.40.1            

network 192.168.30.0 mask 24                                    network 192.168.40.0 mask 24

dns-list 114.114.114.114 8.8.8.8                                   dns-list 114.114.114.114 8.8.8.8     

ip pool xiaoshou_1 gateway-list 192.168.10.1

network 192.168.10.0 mask 255.255.255.0

dns-list 114.114.114.114 8.8.8.8

#

ip pool xiaoshou_2 gateway-list 192.168.20.1

network 192.168.20.0 mask 255.255.255.0

dns-list 114.114.114.114 8.8.8.8

interface Vlanif10                        interface Vlanif20

dhcp select global                        dhcp select global

interface Vlanif30                        interface Vlanif40

dhcp select global                        dhcp select global

步骤⑤：出口NAT配置

配置路由和策略

[sw1]ip route-static 0.0.0.0 0 192.168.254.1

[R1]ip route-s 0.0.0.0 0 12.1.1.6

[R1]ip route-static 192.168.0.0 16 192.168.254.2

[R1]acl number 2000

rule 5 permit source 192.168.0.0 0.0.255.255

[R1]interface GigabitEthernet0/0/1

nat outbound 2000

步骤⑥：服务器端口映射

R1：

interface GigabitEthernet0/0/1

nat server protocol tcp global 12.1.1.2 80 inside 192.168.200.10 80

步骤⑦：ACL配置

sw1：（根据实验要求，配置限制访问财务的策略）

acl number 3000

rule 5 permit ip source 192.168.30.0 0.0.0.255 destination 192.168.200.20 0

rule 10 deny ip destination 192.168.200.20 0

interface Eth-Trunk5

traffic-filter outbound acl 3000

步骤⑧：telnet远程管理配置

所有设备（路由 交换机）都需如下配置：

telnet server enable （模拟器选配）

aaa

local-user admin privilege level 3 password cipher 123

local-user admin service-type telnet

user-interface vty 0 4 authentication-mode aaa

接入交换机（二层交换机）配置管理地址：

使用专门管理vlan 999 承载telnet 的管理流量，建议将管理ip地址配置在一个网段即可

管理vlan：vlan999

管理网段：192.168.253.0/24

配置：

sw1:                                                                sw2:

vlan 999                                                                vlan 999

int vlanif 999                                                          int vlanif 999      

ip add 192.168.253.1 24                                       ip add 192.168.253.2 24

                                                                              ip route-s 0.0.0.0 0 192.168.253.1

sw3:                                                                 sw4:

vlan 999                                                                vlan 999

int vlanif 999                                                          int vlanif 999      

ip add 192.168.253.3 24                                        ip add 192.168.253.4 24
ip route-s 0.0.0.0 0 192.168.253.1                        ip route-s 0.0.0.0 0 192.168.253.1   

sw5:

vlan 999

int vlanif 999

ip add 192.168.253.5 24

ip route-s 0.0.0.0 0 192.168.253.1（该缺省路由是为了管理流量的回包）

步骤⑨：vlan修剪配置

注意：广播报文默认可以发送到trunk链路上面。

为了进一步减少trunk链路上的广播报文的发送范围，为了进一步缩小广播域，建议在trunk链路上配置 vlan的过滤 （配置只允许使用的vlan通过）。

sw2：                                                                        sw1：

interface Eth-Trunk2                                                        interface Eth-Trunk2

port link-ty trunk                                                               port link-type trunk         

port trunk allow-pass vlan 10 20 999                               port trunk allow-pass vlan 10 20 999

sw3：                                                                        sw1：

interface Eth-Trunk3                                                        interface Eth-Trunk3

port link-type trunk                                                           port link-type trunk     

port trunk allow-pass vlan 30 999                                    port trunk allow-pass vlan 30 999     

其他trunk链路配置和上面类似