项目制作人:
以下路由交换设备为神州数码
项目完成限时:2小时00分 <?XML:NAMESPACE PREFIX = O />
一、项目背景
在一个公司网络中,有总公司与分公司两地,分开办公。
总公司使用两台二层交换机SW1、SW2作为接入设备,接入PC机若干,两台交换机使用链路汇聚功能加大交换机之间的数据传输带宽。在交换机之下有VLAN11、12、13、14分别用于四个部门办公, VLAN中对应的网关地址分别为:10.10.11.1/24、10.10.12.1/24、10.10.13.1/24、10.10.14.1/24,使用R1作为DHCP服务器为每个VLAN分别提供IP地址,SW1上接路由器R1,并使用路由器R1的PAT功能为PC提供网络服务。
分公司有WEB服务器一台,PC若干,连接在三层交换上。在三层中,WEB服务器属于VLAN6(10.10.6.1/24),PC机属于VLAN7(10.10.7.1/24)。三层交换与电信以及网通的路由器R2、R3相连,为连接在三层上的设备提供服务。
广域网中,有电信路由器R2与网通路由器R3,分别与R1与SW3相连(R2 R3没有相连、R1与SW3也没有相连)。购买到的电信地址为202.103.96.9/30与202.103.96.13/30,购买到的网通地址为58.20.200.20/30与58.20.200.26/30。
二、项目要求
1、 总公司PC采用PAT上网,其中: 总公司 VLAN11的PC只能访问网站、VLAN12的PC能够正常上网、VLAN13与VLAN14不能上网。分公司中PC能正常上网,服务器须对外提供远程协助服务以及WEB服务。
2、 广域网中使用RIP v 2交换路由表,并且相互之间需要通过认证,密文密钥自拟。
3、 配置策略,总公司PC访问SERVER时默认使用电信线路,当电信线路无效时使用网通线路。
4、 总公司中对于内网的安全有严格的控制。VLAN11能与其他VLAN互相访问,VLAN12能主动访问其他VLAN,VLAN13与VLAN14只能访问VLAN11与被VLAN12访问。并且要求在网内能防范日常的***(震荡波、冲击波、ARP病毒)。
5、 三层交换中的VLAN采用动态VLAN与IP地址相绑定,并且严格控制三层上接入设备的带宽。
6、 所有设备需定义好设备名,设备之间都要能使用SSH进行登录,用户名密码自拟。
三、项目最终上交资料
1、 网络结构拓朴图;
2、 所有设备配置文件,每个设备单独一个DOC文件,文件名以设备名命名。
四、项目提供设备
交换机 | 型号 | 数量 |
DCRS-5950 | 1 | |
DCS-3950 | 2 | |
路由器 | 型号 | 数量 |
DCR- 2659 | 3 | |
PC | 系统 | 数量 |
WinXP | 3 | |
服务器 | 服务 | 数量 |
Web服务 | 1 |
以下为配置文件:
SW1(二层交换):
- hostname SW1
- vendorlocation China
- vendorContact 800-810-9119
- ssh-server enable
- ssh-user admin password 0 admin
- spanning-tree
- vlan 1
- vlan 11
- vlan 12
- vlan 13
- vlan 14
- port-group 1
- Interface Ethernet0/0/1
- switchport access vlan 11
- Interface Ethernet0/0/2
- switchport access vlan 11
- !
- Interface Ethernet0/0/3
- switchport access vlan 11
- !
- Interface Ethernet0/0/4
- switchport access vlan 12
- !
- Interface Ethernet0/0/5
- switchport access vlan 12
- !
- Interface Ethernet0/0/6
- switchport access vlan 12
- !
- Interface Ethernet0/0/7
- switchport access vlan 13
- !
- Interface Ethernet0/0/8
- switchport access vlan 13
- !
- Interface Ethernet0/0/9
- switchport access vlan 13
- !
- Interface Ethernet0/0/10
- switchport access vlan 14
- !
- Interface Ethernet0/0/11
- switchport access vlan 14
- !
- Interface Ethernet0/0/12
- switchport access vlan 14
- !
- Interface Ethernet0/0/13
- !
- Interface Ethernet0/0/22
- switchport mode trunk
- !
- Interface Ethernet0/0/23
- switchport mode trunk
- port-group 1 mode on
- !
- Interface Ethernet0/0/24
- switchport mode trunk
- port-group 1 mode on
- !
SW2(二层交换):
- hostname SW2
- vendorlocation China
- vendorContact 800-810-9119
- !
- !
- ssh-server enable
- ssh-user admin password 0 admin
- spanning-tree
- vlan 1
- vlan 11
- vlan 12
- vlan 13
- vlan 14
- port-group 1
- Interface Ethernet0/0/1
- switchport access vlan 11
- Interface Ethernet0/0/2
- switchport access vlan 11
- Interface Ethernet0/0/3
- switchport access vlan 11
- Interface Ethernet0/0/4
- switchport access vlan 12
- Interface Ethernet0/0/5
- switchport access vlan 12
- Interface Ethernet0/0/6
- switchport access vlan 12
- Interface Ethernet0/0/7
- switchport access vlan 13
- Interface Ethernet0/0/8
- switchport access vlan 13
- Interface Ethernet0/0/9
- switchport access vlan 13
- Interface Ethernet0/0/10
- switchport access vlan 14
- Interface Ethernet0/0/11
- switchport access vlan 14
- Interface Ethernet0/0/12
- switchport access vlan 14
- Interface Ethernet0/0/13
- Interface Ethernet0/0/23
- switchport mode trunk
- port-group 1 mode on
- Interface Ethernet0/0/24
- switchport mode trunk
- port-group 1 mode on
SW3(三层交换):
- hostname sw3
- sysLocation China
- sysContact 800-810-9119
- !
- username admin privilege 15 password 0 admin
- ssh-server enable
- vlan 1
- !
- vlan 6
- !
- vlan 7
- !
- vlan 100
- !
- vlan 200
- !
- Interface Ethernet1/1
- switchport mode hybrid
- switchport hybrid allowed vlan 1-100 untag
- !
- Interface Ethernet1/2
- switchport mode hybrid
- switchport hybrid allowed vlan 1-100 untag
- !
- Interface Ethernet1/3
- switchport mode hybrid
- switchport hybrid allowed vlan 1-100 untag
- !
- Interface Ethernet1/4
- switchport mode hybrid
- switchport hybrid allowed vlan 1-100 untag
- !
- Interface Ethernet1/5
- switchport mode hybrid
- switchport hybrid allowed vlan 1-100 untag
- !
- Interface Ethernet1/6
- switchport mode hybrid
- switchport hybrid allowed vlan 1-100 untag
- !
- Interface Ethernet1/7
- switchport mode hybrid
- switchport hybrid allowed vlan 1-100 untag
- !
- Interface Ethernet1/8
- switchport mode hybrid
- switchport hybrid allowed vlan 1-100 untag
- !
- Interface Ethernet1/9
- switchport mode hybrid
- switchport hybrid allowed vlan 1-100 untag
- !
- Interface Ethernet1/10
- switchport mode hybrid
- switchport hybrid allowed vlan 1-100 untag
- !
- Interface Ethernet1/11
- switchport mode hybrid
- switchport hybrid allowed vlan 1-100 untag
- !
- Interface Ethernet1/12
- switchport mode hybrid
- switchport hybrid allowed vlan 1-100 untag
- !
- Interface Ethernet1/13
- switchport mode hybrid
- switchport hybrid allowed vlan 1-100 untag
- !
- Interface Ethernet1/14
- switchport mode hybrid
- switchport hybrid allowed vlan 1-100 untag
- !
- Interface Ethernet1/15
- switchport mode hybrid
- switchport hybrid allowed vlan 1-100 untag
- !
- Interface Ethernet1/16
- !
- Interface Ethernet1/17
- !
- Interface Ethernet1/18
- !
- Interface Ethernet1/19
- !
- Interface Ethernet1/20
- !
- Interface Ethernet1/21
- !
- Interface Ethernet1/22
- !
- Interface Ethernet1/23
- switchport access vlan 100
- !
- Interface Ethernet1/24
- switchport access vlan 200
- !
- Interface Ethernet1/25
- !
- Interface Ethernet1/26
- !
- Interface Ethernet1/27
- !
- Interface Ethernet1/28
- !
- interface Vlan1
- ip address 192.168.10.1 255.255.255.0
- !
- interface Vlan6
- ip address 10.10.6.1 255.255.255.0
- !
- interface Vlan7
- ip address 10.10.7.1 255.255.255.0
- !
- interface Vlan100
- ip rip authentication mode md5
- ip rip authentication string aaa
- ip address 202.103.96.13 255.255.255.252
- !
- interface Vlan200
- ip rip authentication mode md5
- ip rip authentication string aaa
- ip address 58.20.200.26 255.255.255.0
- !
- router rip
- network 10.10.6.0/24
- network 10.10.7.0/24
- network 58.20.200.0/24
- network 202.103.96.0/24
- no login
- !
- subnet-vlan ip-address 10.10.7.2 mask 255.255.255.0 vlan 7 priority 0
- subnet-vlan ip-address 10.10.6.2 mask 255.255.255.0 vlan 6 priority 0
- end
R1(总公司接入路由):
- hostname R1
- gbsc group default
- aaa authentication login default local none
- aaa authentication enable default enable
- !
- username admin password 0 admin privilege 15
- !
- enable password 0 admin level 15
- !
- !
- !
- interface FastEthernet0/0
- no ip address
- no ip directed-broadcast
- !
- interface FastEthernet0/0.1
- ip address 10.10.11.1 255.255.255.0
- no ip directed-broadcast
- encapsulation dot1Q 11
- bandwidth 100000
- delay 1
- ip nat inside
- !
- interface FastEthernet0/0.2
- ip address 10.10.12.1 255.255.255.0
- no ip directed-broadcast
- encapsulation dot1Q 12
- bandwidth 100000
- delay 1
- ip nat inside
- !
- interface FastEthernet0/0.3
- ip address 10.10.13.1 255.255.255.0
- no ip directed-broadcast
- encapsulation dot1Q 13
- bandwidth 100000
- delay 1
- ip nat inside
- !
- interface FastEthernet0/0.4
- ip address 10.10.14.1 255.255.255.0
- no ip directed-broadcast
- encapsulation dot1Q 14
- bandwidth 100000
- delay 1
- ip nat inside
- !
- interface GigaEthernet0/3
- ip address 192.168.100.1 255.255.255.0
- no ip directed-broadcast
- !
- interface GigaEthernet0/4
- ip address 58.20.200.21 255.255.255.252
- no ip directed-broadcast
- ip rip authentication md5
- ip rip md5-key 1 md5 aaa
- ip nat outside
- !
- interface GigaEthernet0/5
- ip address 202.103.96.9 255.255.255.252
- no ip directed-broadcast
- ip rip authentication md5
- ip rip md5-key 1 md5 aaa
- ip nat outside
- !
- interface GigaEthernet0/6
- no ip address
- no ip directed-broadcast
- !
- interface Serial0/1
- no ip address
- no ip directed-broadcast
- !
- interface Serial0/2
- no ip address
- no ip directed-broadcast
- !
- interface Async0/0
- no ip address
- no ip directed-broadcast
- !
- !
- !
- !
- router rip
- version 2
- no auto-summary
- network 202.103.96.8 255.255.255.252
- network 58.20.200.20 255.255.255.252
- ip access-list standard namepat
- permit 10.10.11.0 255.255.255.0
- permit 10.10.12.0 255.255.255.0
- permit 10.10.13.0 255.255.255.0
- permit 10.10.14.0 255.255.255.0
- deny any
- !
- ip access-list extended vlan13-14
- deny tcp 10.10.13.0 255.255.255.0 any eq www
- deny tcp 10.10.14.0 255.255.255.0 any eq www
- permit ip any any
- ip dhcpd pool vlan11
- network 10.10.11.0 255.255.255.0
- range 10.10.11.10 10.10.11.100
- default-router 10.10.11.1
- !
- ip dhcpd pool vlan13
- network 10.10.13.0 255.255.255.0
- range 10.10.13.10 10.10.13.100
- default-router 10.10.13.1 255.255.255.0
- !
- ip dhcpd pool vlan14
- network 10.10.14.0 255.255.255.0
- range 10.10.14.10 10.10.14.100
- default-router 10.10.14.1
- !
- ip dhcpd pool vlan12
- network 10.10.12.0 255.255.255.0
- range 10.10.12.10 10.10.12.100
- default-router 10.10.12.1
- !
- ip dhcpd enable
- !
- ip nat inside source list namepat interface GigaEthernet0/4
- ip nat inside source list namepat interface GigaEthernet0/5
R2(为电信路由):
- hostname R2
- gbsc group default
- !
- interface FastEthernet0/0
- no ip address
- no ip directed-broadcast
- !
- interface GigaEthernet0/3
- no ip address
- no ip directed-broadcast
- !
- interface GigaEthernet0/4
- ip address 202.103.96.14 255.255.255.252
- no ip directed-broadcast
- !
- interface GigaEthernet0/5
- ip address 202.103.96.10 255.255.255.252
- no ip directed-broadcast
- ip rip authentication md5
- ip rip md5-key 1 md5 aaa
- !
- interface GigaEthernet0/6
- no ip address
- no ip directed-broadcast
- ip rip authentication md5
- ip rip md5-key 1 md5 aaa
- !
- interface Serial0/1
- no ip address
- no ip directed-broadcast
- !
- interface Serial0/2
- no ip address
- no ip directed-broadcast
- !
- interface Async0/0
- no ip address
- no ip directed-broadcast
- router rip
- version 2
- no auto-summary
- network 202.103.96.0 255.255.255.0
R3(为网通路由):
- hostname R3
- !
- gbsc group default
- interface FastEthernet0/0
- no ip address
- no ip directed-broadcast
- !
- interface GigaEthernet0/3
- no ip address
- no ip directed-broadcast
- !
- interface GigaEthernet0/4
- ip address 58.20.200.22 255.255.255.252
- no ip directed-broadcast
- !
- interface GigaEthernet0/5
- no ip address
- no ip directed-broadcast
- ip rip authentication md5
- ip rip md5-key 1 md5 aaa
- !
- interface GigaEthernet0/6
- ip address 58.20.200.25 255.255.255.252
- no ip directed-broadcast
- ip rip authentication md5
- ip rip md5-key 1 md5 aaa
- !
- interface Serial0/1
- no ip address
- no ip directed-broadcast
- !
- interface Serial0/2
- no ip address
- no ip directed-broadcast
- !
- interface Async0/0
- no ip address
- no ip directed-broadcast
- router rip
- version 2
- no auto-summary
- network 58.20.200.20 255.255.255.252
- network 58.20.200.24 255.255.255.252