园区网络搭建实验

跟着B站上的老师，用华为ensp模拟搭建了一个园区网络，感觉挺好玩的

虽然老师说这个很简单，但还是比我公司里的拓扑复杂

LSW3配置

上行端口3/4配置为串口，下行端口1/2为access口用于连接终端

[Huawei]vlan batch 10 20  --创建vlan
[Huawei]port-group  group-member e0/0/3 e0/0/4  --端口组
[Huawei-port-group]p l t   --串口
[Huawei-port-group]p t a v 10 20  --放行vlan
[Huawei]int e0/0/1
[Huawei-Ethernet0/0/1]p l a   --A口
[Huawei-Ethernet0/0/1]p d v 20  --默认vlan
[Huawei-Ethernet0/0/1]int e0/0/2
[Huawei-Ethernet0/0/2]p l a
[Huawei-Ethernet0/0/2]p d v 10

LSW4配置

[Huawei]sys LSW4  --重命名
[LSW4]vlan batch 30 40 50  --创建vlan
[LSW4]port-group group-member e0/0/3 e0/0/4  --端口组
[LSW4-port-group]p l t  --串口
[LSW4-port-group]p t a v 30 40 50 --放行vlan
[LSW4]int e0/0/1
[LSW4-Ethernet0/0/1]p l a  --A口
[LSW4-Ethernet0/0/1]p d v 30  --默认vlan
[LSW4-Ethernet0/0/1]int e0/0/2
[LSW4-Ethernet0/0/2]p l a
[LSW4-Ethernet0/0/2]p d v 40
[LSW4-Ethernet0/0/2]int e0/0/5
[LSW4-Ethernet0/0/5]p l a
[LSW4-Ethernet0/0/5]p d v 50

LSW5配置

[LSW5]port-group group-member g0/0/1 g0/0/2 g0/0/3
[LSW5-port-group]p l a
[LSW5-port-group]p d v 70
[LSW5]int vlan70
[LSW5-Vlanif70]ip address 10.20.70.2 24

LSW1配置

[Huawei]sys LSW1
[LSW1]vlan batch 10 20 30 40 50 60 70 80 90 --创建vlan
[LSW1]port-group group-member g0/0/1 g0/0/4  --端口组
[LSW1-port-group]p l t  
[LSW1-port-group]p t a v 10 20 30 40 50 70 80
[LSW1-Eth-Trunk1]trunkport g 0/0/2 0/0/3  --链路聚合
[LSW1-Eth-Trunk1]p l t
[LSW1-Eth-Trunk1]p t a v 10 20 30 40 50 70 80
[LSW1-Eth-Trunk1]int g0/0/5
[LSW1-GigabitEthernet0/0/5]p l a
[LSW1-GigabitEthernet0/0/5]p d v 90  --vlan90为边界，连接出口路由器
[LSW1-GigabitEthernet0/0/5]int g0/0/6
[LSW1-GigabitEthernet0/0/6]p l a 
[LSW1-GigabitEthernet0/0/6]p d v 70
[LSW1]int vlan80
[LSW1-Vlanif80]ip address 10.20.80.1 24  --创建vlanif 用于ospf连接
[LSW1]int vlan70
[LSW1-Vlanif70]ip address 10.20.70.1 24  --创建vlanif 用于数据中心连接
[LSW1-Vlanif70]int vlan90
[LSW1-Vlanif90]ip address 10.20.90.1 24  --创建vlanif 用于边界路由连接

LSW2配置

[Huawei]sys LSW2
[LSW2]vlan batch 10 20 30 40 50 60 70 80  --创建vlan
[LSW2]port-group group-member g0/0/1 g0/0/4  --端口组
[LSW2-port-group]p l t  --串口
[LSW2-port-group]p t a v 10 20 30 40 50 60 70 80  --放行vlan
[LSW2]int g0/0/5
[LSW2-GigabitEthernet0/0/5]p l t
[LSW2-GigabitEthernet0/0/5]p t a v 50 60  --放行无线vlan
[LSW2]int Eth-Trunk 1  --链路聚合
[LSW2-Eth-Trunk1]trunkport g 0/0/2  0/0/3
[LSW2-Eth-Trunk1]p t a v 10 20 30 40 50 60 70 80 
[LSW2]int vlan 50
[LSW2-Vlanif50]ip address 10.20.50.1 24 --50用于连接AC
[LSW2-Vlanif50]int vlan 80
[LSW2-Vlanif80]ip address  10.20.80.2 24  --80用于ospf
[LSW2-Vlanif60]ip address 10.20.60.2 24  --AC的业务VLAN

AC配置

配置通过隧道转发的WLAN

[AC6005]vlan batch 50 60  --创建vlan
[AC6005]dhcp enable   --启用dhcp
[AC6005]int g0/0/1
[AC6005-GigabitEthernet0/0/1]p l t
[AC6005-GigabitEthernet0/0/1]p t a v 50 60 
[AC6005]int vlan 50
[AC6005-Vlanif50]ip address 10.20.50.2 24 
[AC6005-Vlanif50]dhcp select interface  --基于接口的dhcp
[AC6005-Vlanif50]dhcp server gateway-list 10.20.50.1  
[AC6005-Vlanif50]dhcp server lease  day 0 hour 8
[AC6005]capwap source interface vlanif 50   --指定capwap源
[AC6005]wlan
[AC6005-wlan-view]ssid-profile name jd  --创建ssid模板
[AC6005-wlan-ssid-prof-jd]ssid jd  --定义wifi名称
[AC6005-wlan-view]security-profile name jd  --创建sec模版
[AC6005-wlan-sec-prof-jd]security wpa2 psk  pass-phrase Lyu123!! aes --定义密码
[AC6005-wlan-view]vap-profile name jd  --创建vap模板
[AC6005-wlan-vap-prof-jd]ssid-profile jd
[AC6005-wlan-vap-prof-jd]security-profile jd
[AC6005-wlan-vap-prof-jd]forward-mode tunnel  --配置转发模式
[AC6005-wlan-vap-prof-jd]service-vlan vlan-id 60  --定义业务vlan
[AC6005-wlan-view]ap-id 0 ap-mac 00e0-fcfe-2c00  --绑定AP
[AC6005-wlan-ap-0]ap-name AP1  --AP命名
[AC6005-wlan-ap-group-jd]vap-profile jd  --创建AP组
[AC6005-wlan-ap-group-jd]vap-profile jd wlan 1 radio 1 --领用vap模板 配置射频
[AC6005-wlan-ap-group-jd]ap-id 0
[AC6005-wlan-ap-0]ap-group jd --AP加组
[AC6005-Vlanif60]ip address 10.20.60.1 24 --创建业务vlan的dhcp
[AC6005-Vlanif60]dhcp select interface

DHCP配置

#LSW1
[LSW1]dhcp enable 
[LSW1]ip pool vlan10  --创建地址池
[LSW1-ip-pool-vlan10]network 10.20.10.0 mask 24
[LSW1-ip-pool-vlan10]gateway-list 10.20.10.1
[LSW1-ip-pool-vlan10]lease day 0 hour 8
[LSW1-ip-pool-vlan10]dns-list 8.8.8.8
[LSW1]int Vlanif 10
[LSW1-Vlanif10]ip address  10.20.10.1 24
[LSW1-Vlanif10]dhcp select global  --启用全局dhcp[LSW1]ip pool vlan20
[LSW1-ip-pool-vlan20]network 10.20.20.0 mask 24
[LSW1-ip-pool-vlan20]gateway-list 10.20.20.1
[LSW1-ip-pool-vlan20]dns-list 202.96.128.86
[LSW1-ip-pool-vlan20]lease day 0 hour 8
[LSW1]int vlan20
[LSW1-Vlanif20]ip address 10.20.20.1 24
[LSW1-Vlanif20]dhcp select global#LSW2
[LSW2]dhcp enable 
[LSW2]int vlan30
[LSW2-Vlanif30]ip address 10.20.30.1 24
[LSW2-Vlanif30]dhcp select interface 
[LSW2-Vlanif30]dhcp server dns-list 114.114.114.114
[LSW2-Vlanif30]dhcp server lease day 0 hour 8[LSW2]int vlan40
[LSW2-Vlanif40]ip address 10.20.40.1 24
[LSW2-Vlanif40]dhcp select interface 
[LSW2-Vlanif40]dhcp server  dns-list 202.96.128.86
[LSW2-Vlanif40]dhcp server lease day 0 hour 8

IPS配置

模拟运营商设备

#创建地址池
[IPS]ip pool BH  --创建地址池
[IPS-ip-pool-BH]network 10.20.100.0 mask 24  --宣告地址池网段
[IPS-ip-pool-BH]gateway-list 10.20.100.1#创建3A认证用户
[IPS]aaa
[IPS-aaa]local-user huawei password cipher 123  --创建本地用户
[IPS-aaa]local-user huawei service-type ppp   --创建服务模式为ppp 
[IPS]int Virtual-Template 1   --进入虚拟模板
[IPS-Virtual-Template1]ip address 10.20.100.2 24
[IPS-Virtual-Template1]ppp authentication-mode chap --挑战握手，密码通过哈希计算，安全性高 
[IPS-Virtual-Template1]remote address pool BH#进入接口绑定vt
[IPS-GigabitEthernet0/0/0]pppoe-server bind virtual-template 1

AR1配置-NAT-PPP

配置ospf 与NAT地址转换

只允许10 40 50 访问网络

#配置ospf
[Huawei]sys AR1
[AR1]int g0/0/1
[AR1-GigabitEthernet0/0/1]ip address 10.20.90.2 24#配置NAT
[AR1]acl 2000  --创建acl
[AR1-acl-basic-2000]rule permit source 10.20.10.0 0.0.0.255
[AR1-acl-basic-2000]rule permit source 10.20.40.0 0.0.0.255
[AR1-acl-basic-2000]rule permit source 10.20.50.0 0.0.0.255
[AR1-acl-basic-2000]rule deny source any
[AR1]int Dialer 0  --在拨号端口领用acl 2000
[AR1-Dialer0]nat outbound 2000
[AR1-Dialer0]ip address 10.20.100.1 24  --对端IPS网段为100
[AR1]ip route-static 0.0.0.0 0 Dialer 0  --配置缺省路由
[AR1-ospf-1]default-route-advertise   --下发缺省路由#配置拨号上网
[AR1]int Dialer 0
[AR1-Dialer0]dialer  user  user1
[AR1-Dialer0]dialer  bundle 1
[AR1-Dialer0]ppp chap user huawei
[AR1-Dialer0]ppp chap password cipher 123
[AR1-Dialer0]ip address ppp-negotiate  ---ppp协商获取IP
[AR1-Dialer0]int g0/0/0  --进入物理接口
[AR1-GigabitEthernet0/0/0]pppoe-client dial-bundle-number 1  --绑定bundle[AR1]dis ip int brief  --查看接口IP，验证是否拨号成功
Interface                         IP Address/Mask      Physical   Protocol  
Dialer0                           10.20.100.254/32     up

OSPF配置

用于设备之间互相学习路由

#创建OSPF
[LSW1]ospf 1  --LSW1
[LSW1-ospf-1]a	
[LSW1-ospf-1]area 0
[LSW1-ospf-1-area-0.0.0.0]  network 10.20.80.0 0.0.0.255
[LSW1-ospf-1-area-0.0.0.0]  network 10.20.70.0 0.0.0.255 --宣告接口IP
[LSW1-ospf-1-area-0.0.0.0]  network 10.20.20.0 0.0.0.255
[LSW1-ospf-1-area-0.0.0.0]  network 10.20.10.0 0.0.0.255
[LSW1-ospf-1-area-0.0.0.0]  network 10.20.90.0 0.0.0.255 
-- LSW2配置
[LSW2]ospf 1
[LSW2-ospf-1]ar	
[LSW2-ospf-1]area 0
[LSW2-ospf-1-area-0.0.0.0]network 10.20.80.0 0.0.0.255
[LSW2-ospf-1-area-0.0.0.0]network 10.20.30.0 0.0.0.255
[LSW2-ospf-1-area-0.0.0.0]network 10.20.40.0 0.0.0.255
[LSW2-ospf-1-area-0.0.0.0]network 10.20.50.0 0.0.0.255
[LSW2-ospf-1-area-0.0.0.0]network 10.20.60.0 0.0.0.255
--AR1配置
[AR1]ospf 1
[AR1-ospf-1-area-0.0.0.0]network 10.20.90.0 0.0.0.255

STP配置

通过STP阻塞LSW3的4接口和 LSW4的3接口


[LSW1]stp root primary  --设置为根网桥
[LSW2]stp root  secondary  --设置为备用网桥[LSW3]dis stp brief MSTID  Port                        Role  STP State     Protection0    Ethernet0/0/1               DESI  FORWARDING      NONE0    Ethernet0/0/2               DESI  FORWARDING      NONE0    Ethernet0/0/3               ROOT  FORWARDING      NONE0    Ethernet0/0/4               ALTE  DISCARDING      NONE[LSW4]dis stp brief MSTID  Port                        Role  STP State     Protection0    Ethernet0/0/1               DESI  FORWARDING      NONE0    Ethernet0/0/2               DESI  FORWARDING      NONE0    Ethernet0/0/3               **ALTE  DISCARDING**      NONE0    Ethernet0/0/4               ROOT  FORWARDING      NONE0    Ethernet0/0/5               DESI  FORWARDING      NONE