齐齐哈尔市建设工程监察网站,程序员代做网站违法,英迈思做网站怎么样,合肥好的app开发公司前言
哈喽#xff0c;我是ICT大龙。本次更新了使用ENSP仿真软件设计校园网实验。时间比较着急#xff0c;可能会有错误#xff0c;欢迎大家指出。 获取本次工程文件方式在文章结束部分。
拓扑设计 拓扑介绍---A校区 如图#xff0c;XYZ大学校园网设计分为3部分#xff0…前言
哈喽我是ICT大龙。本次更新了使用ENSP仿真软件设计校园网实验。时间比较着急可能会有错误欢迎大家指出。 获取本次工程文件方式在文章结束部分。
拓扑设计 拓扑介绍---A校区 如图XYZ大学校园网设计分为3部分分别是A校区、B校区与互联网区域 A校区分为3个部门教学楼、办公楼、图书馆与一个服务器机房 A校区的网络架构为接入层、汇聚层与核心层。终端设备上的网关设在接入层上面 为了有效的隔离广播风暴按照每个部门属于一个VLAN的方式进行划分 学校共有两台服务器分别提供WEB和DNS服务通过一台接入交换机进行接入并连接到服务器机房的网关上面。为了保证服务器不被非法用户进行恶意攻击服务器机房采用一台防火墙设备充当网关 核心层、汇聚层与接入层使用OSPF协议计算路由与开销使得A校区网络内部可以实现通信。 A校区使用一台防火墙来充当网关设备这样不仅可以进行路由还能有效的保证内网的安全。
拓扑介绍---B校区 上图中可以看到B校区的出口网关也是一台防火墙设备。下面连接了一台核心层交换机再往下就是客户端了。 B校区的拓扑并没有设计的很复杂直接使用了VLANIF接口进行模拟。
拓扑介绍---互联网区域 互联网区域使用一台路由器来充当ISP设备。可以看到连接了一台公网服务器用来充当百度服务器后期需要终端用户对该域名进行访问。 A校区网关、B校区网关与ISP设备之间运行了ISIS路由协议实现互通。A校区与B校区之间通过互联网建立了虚拟的专用网络即VPN隧道。
需求规划
1.两个校区的所有终端设备可以访问公网的百度服务器与A校区中学校官网服务器的WEB服务。 2.终端用户访问互联网时需要进行NAT地址转换转换为出口网关的出口地址。 3.因为B校区中没有学生居住只有行政岗位的老师在此办公所以A校区中只有办公楼可以与B校区通信。 4.A校区与B校区需要经过VPN隧道进行通信。 5.在学校中学生接入局域网后。经常使用对校内服务器进行ping测试的方式来验证是否成功接入局域网这样对校内服务器造成了压力。为了杜绝以上行为决定在相关设备上进行策略配置。 6.公网中的用户配置DNS地址为公网DNS服务器。校内用户配置DNS地址为校内DNS服务器。
A校区配置
1.配置终端用户的IP地址、网关等信息教学楼客户端1 教学楼客户端 办公楼客户端 图书馆客户端 2.接入层设备划分VLAN配置VLANIF接口。
[JR-A]vlan 10
[JR-A-vlan10]int g0/0/4
[JR-A-GigabitEthernet0/0/4]port link acc
[JR-A-GigabitEthernet0/0/4]port de vlan 10
[JR-A-GigabitEthernet0/0/4]int g0/0/5
[JR-A-GigabitEthernet0/0/5]port link ac
[JR-A-GigabitEthernet0/0/5]port de vlan 10
[JR-A]vlan 100
[JR-A-vlan100]int g0/0/1
[JR-A-GigabitEthernet0/0/1]port link tr
[JR-A-GigabitEthernet0/0/1]port tr allow vlan 100
[JR-A-GigabitEthernet0/0/1]int g0/0/2
[JR-A-GigabitEthernet0/0/2]port link tr
[JR-A-GigabitEthernet0/0/2]port tr allow vlan 100
[JR-A-GigabitEthernet0/0/2]int g0/0/3
[JR-A-GigabitEthernet0/0/3]port link tr
[JR-A-GigabitEthernet0/0/3]port tr allow vlan 100
[JR-A]int vlan 100
[JR-A-Vlanif100]ip add 192.168.2.7 24
[JR-A-Vlanif100]int vlan 10
[JR-A-Vlanif10]ip add 172.16.3.254 22[JR-B]vlan 100
[JR-B-vlan100]vlan 20
[JR-B-vlan20]int g0/0/4
[JR-B-GigabitEthernet0/0/4]port link ac
[JR-B-GigabitEthernet0/0/4]port de vlan 20
[JR-B-GigabitEthernet0/0/4]int g0/0/1
[JR-B-GigabitEthernet0/0/1]port link trunk
[JR-B-GigabitEthernet0/0/1]port trunk allow vlan 100
[JR-B-GigabitEthernet0/0/1]int g0/0/2
[JR-B-GigabitEthernet0/0/2]port link trunk
[JR-B-GigabitEthernet0/0/2]port trunk allow vlan 100
[JR-B-GigabitEthernet0/0/2]int g0/0/3
[JR-B-GigabitEthernet0/0/3]port link trunk
[JR-B-GigabitEthernet0/0/3]port trunk allow vlan 100
[JR-B-GigabitEthernet0/0/3]int vlan 100
[JR-B-Vlanif100]ip add 192.168.2.8 24
[JR-B-Vlanif100]int vlan 20
[JR-B-Vlanif20]ip add 172.16.7.254 22[JR-C]vlan batch 30 100
[JR-C]int g0/0/1
[JR-C-GigabitEthernet0/0/1]port link trunk
[JR-C-GigabitEthernet0/0/1]port trunk allow vlan 100
[JR-C-GigabitEthernet0/0/1]int g0/0/2
[JR-C-GigabitEthernet0/0/2]port link trunk
[JR-C-GigabitEthernet0/0/2]port trunk allow vlan 100
[JR-C-GigabitEthernet0/0/2]int g0/0/3
[JR-C-GigabitEthernet0/0/3]port link trunk
[JR-C-GigabitEthernet0/0/3]port trunk allow vlan 100
[JR-C-GigabitEthernet0/0/3]int g0/0/4
[JR-C-GigabitEthernet0/0/4]port link ac
[JR-C-GigabitEthernet0/0/4]port de vlan 1003.汇聚层与核心层分别放通相应VLAN并配置VLANIF地址
[HJ-A]vlan 100
[HJ-A-vlan100]int vlan 100
[HJ-A-Vlanif100]ip add 192.168.2.3 24
[HJ-A-Vlanif100]int g0/0/1
[HJ-A-GigabitEthernet0/0/1]port link trunk
[HJ-A-GigabitEthernet0/0/1]port tr allow vlan 100
[HJ-A-GigabitEthernet0/0/1]int g0/0/2
[HJ-A-GigabitEthernet0/0/2]port link trunk
[HJ-A-GigabitEthernet0/0/2]port tr allow vlan 100
[HJ-A-GigabitEthernet0/0/2]int g0/0/3
[HJ-A-GigabitEthernet0/0/3]port tr allow vlan 100
[HJ-A-GigabitEthernet0/0/3]port link trunk
[HJ-A-GigabitEthernet0/0/3]int g0/0/4
[HJ-A-GigabitEthernet0/0/4]port link trunk
[HJ-A-GigabitEthernet0/0/4]port tr allow vlan 100[HJ-B]vlan 100
[HJ-B-vlan100]int vlan 100
[HJ-B-Vlanif100]ip add 192.168.2.4 24
[HJ-B-Vlanif100]int g0/0/1
[HJ-B-GigabitEthernet0/0/1]port link trunk
[HJ-B-GigabitEthernet0/0/1]port tr allow vlan 100
[HJ-B-GigabitEthernet0/0/1]int g0/0/2
[HJ-B-GigabitEthernet0/0/2]port link trunk
[HJ-B-GigabitEthernet0/0/2]port tr allow vlan 100
[HJ-B-GigabitEthernet0/0/2]int g0/0/3
[HJ-B-GigabitEthernet0/0/3]port tr allow vlan 100
[HJ-B-GigabitEthernet0/0/3]port link trunk
[HJ-B-GigabitEthernet0/0/3]int g0/0/4
[HJ-B-GigabitEthernet0/0/4]port link trunk
[HJ-B-GigabitEthernet0/0/4]port tr allow vlan 100[HJ-Cvlan 100
[HJ-C-vlan100]int vlan 100
[HJ-C-Vlanif100]ip add 192.168.2.5 24
[HJ-C-Vlanif100]int g0/0/1
[HJ-C-GigabitEthernet0/0/1]port link trunk
[HJ-C-GigabitEthernet0/0/1]port tr allow vlan 100
[HJ-B-GigabitEthernet0/0/1]int g0/0/2
[HJ-C-GigabitEthernet0/0/2]port link trunk
[HJ-C-GigabitEthernet0/0/2]port tr allow vlan 100
[HJ-C-GigabitEthernet0/0/2]int g0/0/3
[HJ-C-GigabitEthernet0/0/3]port tr allow vlan 100
[HJ-C-GigabitEthernet0/0/3]port link trunk
[HJ-C-GigabitEthernet0/0/3]int g0/0/4
[HJ-C-GigabitEthernet0/0/4]port link trunk
[HJ-C-GigabitEthernet0/0/4]port tr allow vlan 100[LSW-HX]vlan 100
[LSW-HX-vlan100]int vlan 100
[LSW-HX-Vlanif100]ip add 192.168.2.2 24
[LSW-HX-Vlanif100]int g0/0/2
[LSW-HX-GigabitEthernet0/0/2]port link tr
[LSW-HX-GigabitEthernet0/0/2]port tr allow vlan 100
[LSW-HX-GigabitEthernet0/0/2]int g0/0/3
[LSW-HX-GigabitEthernet0/0/3]port link tr
[LSW-HX-GigabitEthernet0/0/3]port tr allow vlan 100
[LSW-HX-GigabitEthernet0/0/3]int g0/0/4
[LSW-HX-GigabitEthernet0/0/4]port link tr
[LSW-HX-GigabitEthernet0/0/4]port tr allow vlan 100
[LSW-HX-GigabitEthernet0/0/4]int g0/0/1
[LSW-HX-GigabitEthernet0/0/1]port link access
[LSW-HX-GigabitEthernet0/0/1]port de vlan 1004.配置STP优先级
[LSW-HX]stp priority 0
[HJ-A]stp priority 4096
[HJ-B]stp priority 4096
[HJ-C]stp priority 4096
[JR-A]stp priority 8192
[JR-B]stp priority 8192
[JR-C]stp priority 81925.配置出口网关地址并在A校区设备上面启用OSPF协议
[GW-A]int g1/0/0
[GW-A-GigabitEthernet1/0/0]ip add 192.168.2.1 24
[GW-A]ospf 1
[GW-A-ospf-1]default-route-advertise always //后期会配置下发默认路由
[GW-A-ospf-1]area 0
[GW-A-ospf-1]int g1/0/0
[GW-A-GigabitEthernet1/0/0]ospf enable 1 area 0
[LSW-HX]ospf 1
[LSW-HX]int vlan 100
[LSW-HX-Vlanif100]ospf enable 1 area 0
[HJ-A]ospf 1
[HJ-A-ospf-1]int vlan 100
[HJ-A-Vlanif100]ospf enable 1 area 0
[HJ-B]ospf 1
[HJ-B-ospf-1]int vlan 100
[HJ-B-Vlanif100]ospf enable 1 area 0
[HJ-C]ospf 1
[HJ-C-ospf-1]int vlan 100
[HJ-C-Vlanif100]ospf enable 1 area 0
[JR-A]ospf 1
[JR-A-ospf-1]int vlan 100
[JR-A-Vlanif100]ospf enable 1 area 0
[JR-A-Vlanif100]int vlan 10
[JR-A-Vlanif10]ospf enable 1 area 0
[JR-B]ospf 1
[JR-B-ospf-1]int vlan 100
[JR-B-Vlanif100]ospf enable 1 area 0
[JR-B-Vlanif100]int vlan 20
[JR-B-Vlanif10]ospf enable 1 area 0
[JR-C]ospf 1
[JR-C-ospf-1]int vlan 100
[JR-C-Vlanif100]ospf enable 1 area 0
[JR-C-Vlanif100]int vlan 30
[JR-C-Vlanif10]ospf enable 1 area 0
[Server-GW]ospf 1
[Server-GW-ospf-1]int g1/0/0
[Server-GW-GigabitEthernet1/0/0]ospf enable 1 area 0
[Server-GW-GigabitEthernet1/0/0]int g1/0/1
[Server-GW-GigabitEthernet1/0/1]ospf enable 1 area 06.配置服务器网关策略
[Server-GW-policy-security]rule name b
[Server-GW-policy-security-rule-b] source-zone untrust
[Server-GW-policy-security-rule-b] destination-zone dmz
[Server-GW-policy-security-rule-b] service icmp
[Server-GW-policy-security-rule-b] service icmpv6
[Server-GW-policy-security-rule-b] action deny
[Server-GW-policy-security-rule-b] rule name a
[Server-GW-policy-security-rule-a] action permit
[Server-GW]firewall zone untrust
[Server-GW-zone-untrust]add int g1/0/0
[Server-GW]firewall zone dmz
[Server-GW-zone-untrust]add int g1/0/17.出口网关配置IP地址、默认路由、NAT配置以及策略
[GW-A]int g0/0/0
[GW-A-GigabitEthernet0/0/0]ip add 192.168.66.2 24
[GW-A-GigabitEthernet0/0/0]int g1/0/0
[GW-A-GigabitEthernet1/0/0]ip add 192.168.2.1 24
[GW-A-GigabitEthernet1/0/0]int g1/0/1
[GW-A-GigabitEthernet1/0/1]ip add 223.0.23.2 30
[GW-A-GigabitEthernet1/0/1]int l0
[GW-A-LoopBack0]ip add 2.2.2.2 32
[GW-A-LoopBack0]int l10
[GW-A-LoopBack10]ip add 6.6.6.6 32
[GW-A]firewall zone trust
[GW-A-zone-trust]add inter g1/0/0
[GW-A-zone-untrust]dis this
[GW-A-zone-trust]add inter g1/0/1
[GW-A]firewall zone dmz
[GW-A-zone-dmz]add interface Tunnel 1
[GW-A]ip address-set b type object ip address-set b type object
[GW-A-object-address-set-b] address 0 172.16.4.0 mask 22
[GW-A]ip address-set c type object
[GW-A-object-address-set-c] address 0 192.168.1.0 mask 24
[GW-A]ip address-set d type object
[GW-A-object-address-set-d] address 0 172.16.0.0 mask 22
[GW-A-object-address-set-d] address 1 172.16.8.0 mask 22
[GW-A]security-policy
[GW-A-policy-security]rule name c
[GW-A-policy-security-rule-c] source-zone trust
[GW-A-policy-security-rule-c] destination-zone dmz
[GW-A-policy-security-rule-c] source-address address-set d
[GW-A-policy-security-rule-c] destination-address address-set c
[GW-A-policy-security-rule-c] action deny
[GW-A-policy-security-rule-c] rule name b
[GW-A-policy-security-rule-b] source-zone trust
[GW-A-policy-security-rule-b] destination-zone dmz
[GW-A-policy-security-rule-b] source-address address-set b
[GW-A-policy-security-rule-b] destination-address address-set c
[GW-A-policy-security-rule-b] action permit
[GW-A-policy-security-rule-b] rule name a
[GW-A-policy-security-rule-a] action permit
[GW-A]nat-policy
[GW-A-policy-nat] rule name a
[GW-A-policy-nat-rule-a] destination-zone untrust
[GW-A-policy-nat-rule-a] action source-nat easy-ip
[GW-A]ip route-static 0.0.0.0 0.0.0.0 223.0.23.1B校区配置
1.终端用户IP地址信息 2.配置核心层交换机与出口网关的地址
[LSW-B]vlan 100
[LSW-B-GigabitEthernet0/0/1]port link-ty access
[LSW-B-GigabitEthernet0/0/1]port de vlan 100
[LSW-B]interface GigabitEthernet0/0/2
[LSW-B-GigabitEthernet0/0/2] port link-type access
[LSW-B-GigabitEthernet0/0/2] port default vlan 100
[LSW-Binterface Vlanif100
[LSW-B-Vlanif100] ip address 192.168.1.254 255.255.255.0[GW-B]int g0/0/0
[GW-B-GigabitEthernet0/0/0]ip add 192.168.66.2 24
[GW-B-GigabitEthernet0/0/0]int g1/0/0
[GW-B-GigabitEthernet1/0/0]ip add 223.0.12.1 30
[GW-B-GigabitEthernet1/0/0]int g1/0/2
[GW-B-GigabitEthernet1/0/2]ip add 192.168.1.1 24
[GW-B-GigabitEthernet1/0/2]int l9
[GW-B-LoopBack9]ip add 1.1.1.1 32
[GW-B]interface GigabitEthernet1/0/2
[GW-B-GigabitEthernet1/0/2] ip address 192.168.1.1 255.255.255.03.核心与网关分别配置相应路由
[LSW-B]ip route-static 0.0.0.0 0.0.0.0 192.168.1.1
[GW-B]ip route-static 0.0.0.0 0.0.0.0 223.0.12.24.网关配置NAT地址转换技术
[GW-B]nat-policy
[GW-B-policy-nat] rule name a
[GW-B-policy-nat-rule-a] destination-zone untrust
[GW-B-policy-nat-rule-a] action source-nat easy-ip5.防火墙配置相应策略与区域
[GW-B]security-policy
[GW-B-policy-security] rule name a
[GW-B-policy-security-rule-a] action permit
[GW-B-zone-trust]
add interface GigabitEthernet1/0/2
[GW-B-zone-unust]
add interface GigabitEthernet1/0/0
[GW-B-zone-dmz
add interface tun 1互联网区域配置
1.公网服务器IP地址与服务配置 2.设备接口IP以及ISIS配置
[GW-A]isis 1
[GW-A-isis-1] is-level level-2
[GW-A-isis-1] network-entity 49.0001.0000.0030.0003.00
[GW-A]interface GigabitEthernet1/0/1
[GW-A-GigabitEthernet1/0/1] ip address 223.0.23.2 255.255.255.252
[GW-A-GigabitEthernet1/0/1] isis enable 1
[GW-A-GigabitEthernet1/0/1] service-manage ping permit
[GW-A-GigabitEthernet1/0/1] service-manage ping permit
[GW-A]interface LoopBack0
[GW-A-LoopBack0] ip address 2.2.2.2 255.255.255.255
[GW-A-LoopBack0] isis enable 1[ISP]isis 1
[ISP-isis-1] is-level level-2
[ISP-isis-1] network-entity 49.0001.0000.0020.0002.00
[ISP]int g0/0/0
[ISP-GigabitEthernet0/0/0]ip add 223.0.12.2 30
[ISP-GigabitEthernet0/0/0]isis enable 1
[ISP-GigabitEthernet0/0/0]int g0/0/1
[ISP-GigabitEthernet0/0/1]ip add 223.0.23.1 30
[ISP-GigabitEthernet0/0/1]isis enable 1
[ISP-GigabitEthernet0/0/1]int g0/0/2
[ISP-GigabitEthernet0/0/2]ip add 223.0.24.254 24
[ISP-GigabitEthernet0/0/2]isis enable 1
[ISP-GigabitEthernet0/0/2]int l0
[ISP-LoopBack0]ip add 8.8.8.8 32
[ISP-LoopBack0] isis enable 1[GW-B]isis 1
[GW-B-isis-1] is-level level-2
[GW-B-isis-1] network-entity 49.0001.0000.0010.0001.00
[GW-B]interface GigabitEthernet1/0/0
[GW-B-GigabitEthernet1/0/0] ip address 223.0.12.1 255.255.255.252
[GW-B-GigabitEthernet1/0/0] isis enable 1
[GW-B-GigabitEthernet1/0/0] service-manage ping permit
[GW-B]interface LoopBack0
[GW-B-LoopBack0] ip address 1.1.1.1 255.255.255.255
[GW-B-LoopBack0] isis enable 13.A校区网关与B校区网关建立GRE VPN隧道
[GW-B]interface Tunnel1
[GW-B-Tunnel1] ip address 10.10.10.10 255.255.255.0
[GW-B-Tunnel1] tunnel-protocol gre
[GW-B-Tunnel1] source 1.1.1.1
[GW-B-Tunnel1] destination 2.2.2.2
[GW-B-Tunnel1] service-manage ping permit
[GW-B]ip route-static 172.16.0.0 255.255.252.0 Tunnel1
[GW-B]ip route-static 172.16.4.0 255.255.252.0 Tunnel1
[GW-B]ip route-static 172.16.8.0 255.255.252.0 Tunnel1[GW-A]interface Tunnel1
[GW-A-Tunnel1] ip address 20.20.20.20 255.255.255.0
[GW-A-Tunnel1] tunnel-protocol gre
[GW-A-Tunnel1] source 2.2.2.2
[GW-A-Tunnel1] destination 1.1.1.1
[GW-A-Tunnel1] service-manage ping permit
[GW-A]ip route-static 192.168.1.0 255.255.255.0 Tunnel1需求验证
1.AB校区访问公网与校内官网服务器访问百度服务器 访问校内官网服务器 2.终端用户访问互联网需要进行NAT地址转换A校区ping公网服务器抓包验证 B校区ping公网服务器抓包验证 3.A校区办公楼与B校区互访同时测试A校区其他部门无法与B校区互访成功互访 无法互访 4.验证是否经过VPN隧道转发可以看到VPN封装的部分 5.校内服务器不允许客户端进行ping测试 全部验证结束
结束
本次实验到此结束喽如果你感觉本篇文章对你有很大的帮助可以给我点一个关注。
