综合组网实验(eNSP)(vlan、vlan间通信、nat地址转换、acl、dhcp、ospf……)

综合组网实验 一、概述

本次实验模拟学校实验室的网络环境，通过虚拟环境进行组网，通过vlan、路由、访问控制等，实现不同实验室之间的通信，并且可以通过ACL控制某一个实验室的网络通信，进行简单的组网分析

二、应用的网络知识 Vlan Vlan间通信 静态路由 动态路由 链路聚合 链路备份 Nat地址转换 ACL访问控制 DHCP 三、实验拓扑

四、实验分析 五、实验详细配置 1. LSW1的配置 1.1 划分vlan 将G0/0/1接口划入vlan201，G0/0/2接口划入vlan202 sys Enter system view, return user view with Ctrl+Z. [Huawei]vlan batch 201 202 20 Info: This operation may take a few seconds. Please wait for a moment...done. [Huawei]q //使用此命令可以关闭日志 undo terminal monitor Info: Current terminal monitor is off. sys [Huawei]int g0/0/1 [Huawei-GigabitEthernet0/0/1]port link-type access [Huawei-GigabitEthernet0/0/1]port default vlan 201 [Huawei-GigabitEthernet0/0/1]int g0/0/2 [Huawei-GigabitEthernet0/0/2]port link-type access [Huawei-GigabitEthernet0/0/2]port default vlan 202 vlan介绍可以参考：虚拟局域网 1.2 vlan间通信 配置命令 [Huawei]int vlanif 201 [Huawei-Vlanif201]ip address 10.1.1.1 24 [Huawei-Vlanif201]int vlanif 202 [Huawei-Vlanif202]ip add 10.1.2.1 24 //此处配置vlan20是为了保证与上层的通信 [Huawei]vlan 20 [Huawei]int vlanif 20 [Huawei-Vlanif20]ip add 192.168.2.2 24 vlan间通信可参考：vlan间通信 1.3 链路聚合

为了保证LSW1与核心交换机之间的数据传输，在他们之间进行链路聚合，即将三条链路聚合为一两条逻辑链路Eth-Trunk1，从而保证他们之间数据的转发(此处采用的链路聚合模式为LACP模式)

LACP模式：此模式下链路中有转发链路和备份链路，此处采用两条转发链路，一条备份链路 配置命令 [Huawei]int Eth-Trunk 1 //将模式改为lacp [Huawei-Eth-Trunk1]mode lacp-static [Huawei-Eth-Trunk1]trunkport g0/0/4 Info: This operation may take a few seconds. Please wait for a moment...done. [Huawei-Eth-Trunk1]trunkport g0/0/5 Info: This operation may take a few seconds. Please wait for a moment...done. [Huawei-Eth-Trunk1]trunkport g0/0/3 Info: This operation may take a few seconds. Please wait for a moment...done. [Huawei-Eth-Trunk1]q //改变优先级，优先级小越优先，默认值为32768，此处改为100，则LSW1端为主动方 [Huawei]lacp priority 100 [Huawei]int Eth-Trunk 1 //此命令表示LACP模式下有两条活跃链路，一条备份链路 [Huawei-Eth-Trunk1]max active-linknumber 2 通过命令查看链路聚合后的链路状态(此处查看到的效果需要对端及LSW3配置完成) [Huawei]dis interface Eth-Trunk 1 Eth-Trunk1 current state : UP Line protocol current state : UP Description: Switch Port, PVID : 1, Hash arithmetic : According to SIP-XOR-DIP,Maximal BW: 3G, Current BW: 2G, The Maximum Frame Length is 9216 IP Sending Frames' Format is PKTFMT_ETHNT_2, Hardware address is 4c1f-cc45-6681 Current system time: 2020-04-20 21:14:48-08:00 Input bandwidth utilization : 0% Output bandwidth utilization : 0% ----------------------------------------------------- PortName Status Weight ----------------------------------------------------- GigabitEthernet0/0/3 UP 1 GigabitEthernet0/0/4 DOWN 1 GigabitEthernet0/0/5 UP 1 ----------------------------------------------------- The Number of Ports in Trunk : 3 The Number of UP Ports in Trunk : 2 1.4 配置DHCP

在vlanif接口中配置DHCP

配置命令

[Huawei]dhcp enable [Huawei]int vlanif 201 [Huawei-Vlanif201]dhcp select interface [Huawei-Vlanif201]int vlanif 202 [Huawei-Vlanif202]dhcp select interface

此处201教室可以分配的地址为10.1.1.0网段，202教室可以分配的地址是10.1.2.0网段

dhcp详细内容可以参考：DHCP协议分析

1.5 与上层核心交换机通信 将Eth-Trunk 1逻辑端口类型改为trunk，并且允许vlan 201 202 20 通过 配置命令 [Huawei]int Eth-Trunk 1 [Huawei-Eth-Trunk1]port link-type trunk [Huawei-Eth-Trunk1]port trunk allow-pass vlan 201 202 20 对端端口的配置在LSW3的配置中介绍 1.6 路由配置 此处需要配置静态默认路由，保证可以与上层网段通信 配置命令 [Huawei]ip route-static 0.0.0.0 0.0.0.0 192.168.2.1 2. LSW3核心交换机的配置 2.1 划分vlan

将所有二楼的实验室划入vlan20

并且在此处配置链路聚合

配置命令

//此处创建三个vlan是为了保证与上层路由器和三楼所有主机的通信 [Huawei]vlan batch 20 30 100 Info: This operation may take a few seconds. Please wait for a moment...done. [Huawei]int vlanif 20 [Huawei-Vlanif20]ip add 192.168.2.1 24 [Huawei]int vlanif 30 [Huawei-Vlanif30]ip add 192.168.3.1 24 //此处配置vlanif100是为了保证与上层的通信 [Huawei]int vlanif 100 [Huawei-Vlanif100]ip add 192.168.6.2 24 2.2 链路聚合

LSW3是LSW1的对端，我们将LSW1配置为了主动方，则LSW3为被动方

与二楼交换机通信的配置命令

[Huawei]int Eth-Trunk 2 [Huawei-Eth-Trunk2]mode lacp-static [Huawei-Eth-Trunk2]trunkport g0/0/1 Info: This operation may take a few seconds. Please wait for a moment...done. [Huawei-Eth-Trunk2]trunkport g0/0/7 Info: This operation may take a few seconds. Please wait for a moment...done. [Huawei-Eth-Trunk2]trunkport g0/0/8 Info: This operation may take a few seconds. Please wait for a moment...done. 与三楼交换机通信的配置命令 //此处的链路聚合为手工负载分担 [Huawei]int Eth-Trunk 1 [Huawei-Eth-Trunk1]trunkport g0/0/5 Info: This operation may take a few seconds. Please wait for a moment...done. [Huawei-Eth-Trunk1]trunkport g0/0/6 Info: This operation may take a few seconds. Please wait for a moment...done. [Huawei-Eth-Trunk1]trunkport g0/0/2 Info: This operation may take a few seconds. Please wait for a moment...done. 查看链路聚合后的链路状态(不用配置) [Huawei-Eth-Trunk1]dis eth-trunk 1 Eth-Trunk1's state information is: WorkingMode: NORMAL Hash arithmetic: According to SIP-XOR-DIP Least Active-linknumber: 1 Max Bandwidth-affected-linknumber: 8 Operate status: up Number Of Up Port In Trunk: 3 -------------------------------------------------------------------------------- PortName Status Weight GigabitEthernet0/0/5 Up 1 GigabitEthernet0/0/6 Up 1 GigabitEthernet0/0/2 Up 1 此处我们可以看到三条链路都是up状态，即三条链路同时转发数据 2.3 与下层交换机通信 此处的原理即为vlan间通信 配置命令 //与二楼通信 [Huawei]int vlanif 20 [Huawei-Vlanif20]ip add 192.168.2.1 24 [Huawei]int Eth-Trunk 2 [Huawei-Eth-Trunk2]port link-type trunk [Huawei-Eth-Trunk2]port trunk allow-pass vlan 201 202 20 [Huawei-Eth-Trunk2]q //与三楼通信 [Huawei]int vlanif 30 [Huawei-Vlanif30]ip add 192.168.3.1 24 [Huawei]int Eth-Trunk 1 [Huawei-Eth-Trunk1]port link-type trunk [Huawei-Eth-Trunk1]port trunk allow-pass vlan 301 302 30 [Huawei-Eth-Trunk1]q 2.4 与上层路由器通信

将所有的下层的vlan都统一汇聚为vlan100，从而与上层路由器进行通信

配置命令 //通过此逻辑地址与上层路由器进行通信 [Huawei]int vlanif 100 [Huawei-Vlanif100]ip add 192.168.6.2 24 [Huawei-Vlanif100]q //与左侧路由器通信 [Huawei]int g0/0/3 [Huawei-GigabitEthernet0/0/3]port trunk allow-pass vlan 100 [Huawei-GigabitEthernet0/0/3]q //与右侧路由器通信 [Huawei]int g0/0/4 [Huawei-GigabitEthernet0/0/4]port trunk allow-pass vlan 100 2.5 路由配置 此处需要配置默认路由保证与上层的通信 配置命令 [Huawei]ip route-static 0.0.0.0 0.0.0.0 192.168.6.1 3. AR2的配置 3.1 与下层通信

因为从LSW3发送的数据包它含有vlan标签，但是路由器不能处理带标签的数据帧，所以此处想到了通过单臂路由的方式去解决这以问题，及通过配置逻辑子接口，从而可以剥离vlan标签

详细介绍可以参考：vlan间通信中单臂路由部分 配置命令 [Huawei]int g0/0/0.1 [Huawei-GigabitEthernet0/0/0.1]ip add 192.168.6.1 24 [Huawei-GigabitEthernet0/0/0.1]dotlq termination vid 100 3.2 与上层通信 此处采用ospf协议 [Huawei]int g0/0/1 [Huawei-GigabitEthernet0/0/1]ip add 192.168.7.2 24 [Huawei-GigabitEthernet0/0/1]q [Huawei]ospf [Huawei-ospf-1]area 0 [Huawei-ospf-1-area-0.0.0.0]network 192.168.7.0 0.0.0.255 ospf详细介绍可参考：ospf协议分析与配置 4. AR1的配置 4.1 Nat配置 Nat协议可以保证内网与公网进行通信，此处不详细介绍 配置命令 //此处为可转换的的地址池 [Huawei]nat address-group 1 200.10.10.1 200.10.10.200 [Huawei]acl 2000 [Huawei-acl-basic-2000]rule 5 permit source 10.0.0.0 0.255.255.255 [Huawei-acl-basic-2000]q [Huawei]int g0/0/0 [Huawei-GigabitEthernet0/0/0]nat outbound 2000 address-group 1 no-pat 4.2 路由配置 [Huawei]int g0/0/0 [Huawei-GigabitEthernet0/0/0]ip add 192.168.7.1 24 [Huawei-GigabitEthernet0/0/0]q [Huawei]ospf [Huawei-ospf-1]area 0 [Huawei-ospf-1-area-0.0.0.0]network 192.168.7.0 0.0.0.255 5. 访问控制 业务需要：使302教室不能访问其他网络，只能内部进行通信 通过访问控制列表进行实现 配置命令(在LSW2中配置) //创建访问控制列表2000 [Huawei]acl 2000 [Huawei-acl-basic-2000] //控制规则为拒绝源地址10.2.2.0网段，及302教室 [Huawei-acl-basic-2000]rule deny source 10.2.2.0 0.0.0.255 [Huawei-acl-basic-2000]q //在链路聚合后的逻辑接口Eth-Trunk1中配置：在出方向上执行此规则 [Huawei]int Eth-Trunk 1 [Huawei-Eth-Trunk1]traffic-filter outbound acl 2000 6. 链路备份

在核心交换机与上层路由器进行通信时，为了防止左侧链路出现故障，从而配置右侧备份链路

配置命令 AR3的配置 //此处配置的含义可以参考AR2的配置 [Huawei]int g0/0/0.1 [Huawei-GigabitEthernet0/0/0.1]ip add 192.168.6.3 24 [Huawei-GigabitEthernet0/0/0.1]dotlq termination vid 100 LSW3的配置 //改变路由优先级，当左侧链路出现故障时，则会选择右侧链路 [Huawei]ip route-static 0.0.0.0 0.0.0.0 192.168.6.3 preference 70 同样AR3的G0/0/1接口需要配置ospf，此处不多赘述，配置命令可参考AR2的路由配置 7. 注意

以上配置只能保证二楼的所有主机正常通信，三楼的主机配置此处不多赘述。LSW2中vlan划分及通信可参考LSW1的配置，链路聚合可参考LSW3的配置

作者：ysw！不将就

ensp ospf acl dhcp 通信