hcia实验报告

网络配置实验报告

一、实验整体配置思路
本实验以企业三层网络架构为基础，围绕“业务隔离、全网可达、安全可控、灵活扩展”的目标，分模块拆解需求并逐一实现：
地址与接入层：通过DHCP和VLAN实现终端的自动化地址分配与业务域隔离，遵循“最小VLAN透传”减少广播干扰；
路由层：采用OSPF协议实现全网路由互通，通过“手工RID、精准宣告、路由汇总”优化路由效率，结合区域认证保障内网安全；
边界与安全层：通过NAT实现内网互联网访问，利用ACL细化流量权限控制，配置备份链路提升网络可靠性，同时支持远程运维需求。
二、分模块配置思路

1. VLAN与DHCP配置：终端接入与地址自动化
   配置思路：
   先规划VLAN与地址池的对应关系，接入层交换机将终端接口设置为access模式并绑定VLAN，汇聚层交换机与接入层的接口设置为trunk模式且仅透传业务必需的VLAN（遵循最小透传原则）；在汇聚层或核心设备上部署DHCP服务，为业务B网络的地址池额外配置DNS服务器地址。
2. OSPF配置：全网路由互通与优化
   配置思路：
   手工配置各路由器的Router-ID（与设备编号一致），在OSPF区域0启用MD5认证（密码123456）保障内网路由安全；对每个接口的网段进行精准宣告，同时对连续内网网段进行精确汇总以减少路由表条目；将无需宣告的接口（如R3-0/0/2）设置为静默模式。
3. NAT与互联网访问：边界流量转发
   配置思路：
   在边界路由器上配置基础ACL（编号2000）放行所有内网流量，再通过nat outbound将内网流量转换为公网地址，实现内网全网访问互联网；同时确保R3-0/0/2接口的路由不被宣告，避免内网路由混乱。
4. ACL访问控制：流量权限细化
   配置思路：
   针对“禁止VLAN40/50访问业务B”需求，配置基础ACL（编号2001）拒绝对应网段流量；针对“禁止PC1访问PC5”需求，配置高级ACL（编号3000）精确匹配源目IP；将ACL应用到业务B所在VLAN的入方向接口和PC1所在VLAN的出方向接口，实现流量拦截。
5. 备份链路与远程登录：可靠性与运维支持
   备份链路配置思路：
   将R3-R4的百兆链路配置较高的OSPF cost值（如100），使正常情况下流量不经过该链路，仅在主链路故障时自动切换，实现备份功能。
   远程登录配置思路：
   在内网telnet-server设备上启用Telnet服务，创建高权限本地用户（账号huawei、密码123456、权限level 15），使test设备可通过互联网远程登录运维。
   三、验证思路与步骤
6. DHCP验证：查看PC的IP获取情况，业务B网络PC需验证DNS解析功能。
7. OSPF验证：通过查看OSPF邻居状态和路由表，确认全网路由可达且条目精简。
8. NAT验证：内网设备ping互联网模拟地址，检查是否通联。
9. ACL验证：分别测试VLAN40/50对业务B的访问、PC1对PC5的访问，确认拦截规则生效。
10. 备份链路验证：断开主链路，观察备份链路是否自动接管流量。
11. 远程登录验证：test设备通过Telnet登录内网服务器，检查账号权限是否正常。
    四、配置思路总结
    本实验以“分层拆解、模块联动”的思路，将复杂需求分解为接入层、路由层、边界层的子任务，每个模块遵循“功能实现→优化→安全”的配置逻辑：
    接入层聚焦“自动化与隔离”，通过DHCP和VLAN实现终端管理；
    路由层聚焦“互通与效率”，通过OSPF的精准配置保障全网可达并精简路由；
    边界与安全层聚焦“访问控制与可靠性”，通过NAT、ACL、备份链路和远程登录满足业务与运维需求。
    这种思路既保证了功能的完整性，又通过“最小化配置原则”（如最小VLAN透传、精准宣告）提升了网络的性能与安全性，是企业网络工程中典型的“需求驱动型”配置方法论。
    具体代码
    R2
    [V200R003C00]
    sysname R2
    snmp-agent local-engineid 800007DB03000000000000
    snmp-agent
    clock timezone China-Standard-Time minus 08:00:00
    portal local-server load flash:/portalpage.zip
    drop illegal-mac alarm
    wlan ac-global carrier id other ac id 0
    set cpu-usage threshold 80 restore 75
    dhcp enable
    ip pool vlan40
    gateway-list 172.16.0.1
    network 172.16.0.0 mask 255.255.255.0
    ip pool vlan50
    gateway-list 172.16.1.1
    network 172.16.1.0 mask 255.255.255.0
    aaa
    authentication-scheme default
    authorization-scheme default
    accounting-scheme default
    domain default
    domain default_admin
    local-user admin password cipher %K8m.Nt84DZ}e#<08bmE3Uw}%$%$ local-user admin service-type http firewall zone Local priority 15 interface GigabitEthernet0/0/0 ip address 172.16.67.2 255.255.255.0 interface GigabitEthernet0/0/1 interface GigabitEthernet0/0/1.1 dot1q termination vid 40 ip address 172.16.0.1 255.255.255.0 arp broadcast enable dhcp select global interface GigabitEthernet0/0/1.2 dot1q termination vid 50 ip address 172.16.1.1 255.255.255.0 arp broadcast enable dhcp select global interface GigabitEthernet0/0/2 ip address 172.16.2.1 255.255.255.0 interface NULL0 ospf 1 router-id 2.2.2.2 silent-interface GigabitEthernet0/0/1.1 silent-interface GigabitEthernet0/0/1.2 area 0.0.0.0 abr-summary 172.16.0.0 255.255.192.0 authentication-mode md5 1 cipher %$%$$V_|'o\_QBYyP2Oz*FJWi4y%
    network 172.16.0.1 0.0.0.0
    network 172.16.1.1 0.0.0.0
    network 172.16.2.1 0.0.0.0
    area 0.0.0.1
    abr-summary 172.16.64.0 255.255.192.0
    network 172.16.67.2 0.0.0.0
    ip route-static 172.16.0.0 255.255.192.0 NULL0
    ip route-static 172.16.64.0 255.255.192.0 NULL0
    user-interface con 0
    authentication-mode password
    user-interface vty 0 4
    user-interface vty 16 20
    wlan ac
    test
    [V200R003C00]
    sysname text
    snmp-agent local-engineid 800007DB03000000000000
    snmp-agent
    clock timezone China-Standard-Time minus 08:00:00
    portal local-server load flash:/portalpage.zip
    drop illegal-mac alarm
    wlan ac-global carrier id other ac id 0
    set cpu-usage threshold 80 restore 75
    aaa
    authentication-scheme default
    authorization-scheme default
    accounting-scheme default
    domain default
    domain default_admin
    local-user admin password cipher %K8m.Nt84DZ}e#<08bmE3Uw}%$%$ local-user admin service-type http firewall zone Local priority 15 interface GigabitEthernet0/0/0 ip address 100.0.0.2 255.255.255.0 interface GigabitEthernet0/0/1 interface GigabitEthernet0/0/2 interface NULL0 user-interface con 0 authentication-mode password user-interface vty 0 4 user-interface vty 16 20 wlan ac R3 [V200R003C00] sysname R3 board add 0/4 2FE snmp-agent local-engineid 800007DB03000000000000 snmp-agent clock timezone China-Standard-Time minus 08:00:00 portal local-server load flash:/portalpage.zip drop illegal-mac alarm wlan ac-global carrier id other ac id 0 set cpu-usage threshold 80 restore 75 acl number 2000 rule 5 permit source 172.16.0.0 0.0.255.255 acl number 2001 rule 5 deny source 172.16.0.0 0.0.0.255 rule 10 deny source 172.16.1.0 0.0.0.255 aaa authentication-scheme default authorization-scheme default accounting-scheme default domain default domain default_admin local-user admin password cipher %$%$K8m.Nt84DZ}e#<08bmE3Uw}%
    local-user admin service-type http
    firewall zone Local
    priority 15
    interface Ethernet4/0/0
    ip address 172.16.130.1 255.255.255.0
    interface Ethernet4/0/1
    interface GigabitEthernet0/0/0
    ip address 172.16.2.2 255.255.255.0
    traffic-filter inbound acl 2001
    interface GigabitEthernet0/0/1
    ip address 172.16.129.1 255.255.255.0
    interface GigabitEthernet0/0/2
    ip address 100.0.0.1 255.255.255.0
    nat server protocol tcp global current-interface telnet inside 172.16.66.254 telnet
    nat outbound 2000
    interface NULL0
    ospf 1 router-id 3.3.3.3
    default-route-advertise always
    area 0.0.0.0
    authentication-mode md5 1 cipher %_&3QFuaGUDla>0VvbGWWsbR%
    network 172.16.2.2 0.0.0.0
    ip route-static 172.16.128.0 255.255.255.0 172.16.129.2
    ip route-static 172.16.128.0 255.255.255.0 172.16.130.2 preference 100
    ip route-static 172.16.131.0 255.255.255.0 172.16.129.2
    ip route-static 172.16.131.0 255.255.255.0 172.16.130.2 preference 100
    ip route-static 172.16.132.0 255.255.255.0 172.16.129.2
    ip route-static 172.16.132.0 255.255.255.0 172.16.130.2 preference 100
    ip route-static 172.16.133.0 255.255.255.0 172.16.129.2
    ip route-static 172.16.133.0 255.255.255.0 172.16.130.2 preference 100
    ip route-static 172.16.134.0 255.255.255.0 172.16.129.2
    ip route-static 172.16.134.0 255.255.255.0 172.16.130.2 preference 100
    user-interface con 0
    authentication-mode password
    user-interface vty 0 4
    user-interface vty 16 20
    wlan ac
    R7
    [V200R003C00]
    sysname R7
    snmp-agent local-engineid 800007DB03000000000000
    snmp-agent
    clock timezone China-Standard-Time minus 08:00:00
    portal local-server load flash:/portalpage.zip
    drop illegal-mac alarm
    wlan ac-global carrier id other ac id 0
    set cpu-usage threshold 80 restore 75
    dhcp enable
    ip pool vlan60
    gateway-list 172.16.128.1
    network 172.16.128.0 mask 255.255.255.128
    dns-list 172.16.128.126
    ip pool vlan70
    gateway-list 172.16.128.129
    network 172.16.128.128 mask 255.255.255.128
    dns-list 172.16.128.126
    aaa
    authentication-scheme default
    authorization-scheme default
    accounting-scheme default
    domain default
    domain default_admin
    local-user admin password cipher %K8m.Nt84DZ}e#<08bmE3Uw}%$%$ local-user admin service-type http firewall zone Local priority 15 interface GigabitEthernet0/0/0 ip address 172.16.133.2 255.255.255.0 interface GigabitEthernet0/0/1 ip address 172.16.134.2 255.255.255.0 interface GigabitEthernet0/0/2 interface GigabitEthernet0/0/2.1 dot1q termination vid 60 ip address 172.16.128.1 255.255.255.128 arp broadcast enable dhcp select global interface GigabitEthernet0/0/2.2 dot1q termination vid 70 ip address 172.16.128.129 255.255.255.128 arp broadcast enable dhcp select global interface NULL0 ip route-static 0.0.0.0 0.0.0.0 172.16.133.1 ip route-static 0.0.0.0 0.0.0.0 172.16.134.1 ip route-static 172.16.128.0 255.255.255.0 NULL0 ip route-static 172.16.131.0 255.255.255.0 172.16.133.1 ip route-static 172.16.132.0 255.255.255.0 172.16.134.1 user-interface con 0 authentication-mode password user-interface vty 0 4 user-interface vty 16 20 wlan ac SW2 sysname sw2 vlan batch 40 50 cluster enable ntdp enable ndp enable drop illegal-mac alarm diffserv domain default drop-profile default aaa authentication-scheme default authorization-scheme default accounting-scheme default domain default domain default_admin local-user admin password simple admin local-user admin service-type http interface Vlanif1 interface MEth0/0/1 interface GigabitEthernet0/0/1 port link-type trunk port trunk allow-pass vlan 40 50 interface GigabitEthernet0/0/2 port link-type access port default vlan 40 interface GigabitEthernet0/0/3 port link-type access port default vlan 50 interface GigabitEthernet0/0/4 interface GigabitEthernet0/0/5 interface GigabitEthernet0/0/6 interface GigabitEthernet0/0/7 interface GigabitEthernet0/0/8 interface GigabitEthernet0/0/9 interface GigabitEthernet0/0/10 interface GigabitEthernet0/0/11 interface GigabitEthernet0/0/12 interface GigabitEthernet0/0/13 interface GigabitEthernet0/0/14 interface GigabitEthernet0/0/15 interface GigabitEthernet0/0/16 interface GigabitEthernet0/0/17 interface GigabitEthernet0/0/18 interface GigabitEthernet0/0/19 interface GigabitEthernet0/0/20 interface GigabitEthernet0/0/21 interface GigabitEthernet0/0/22 interface GigabitEthernet0/0/23 interface GigabitEthernet0/0/24 interface NULL0 user-interface con 0 user-interface vty 0 4 SW1 sysname Huawei vlan batch 10 20 30 cluster enable ntdp enable ndp enable drop illegal-mac alarm diffserv domain default drop-profile default aaa authentication-scheme default authorization-scheme default accounting-scheme default domain default domain default_admin local-user admin password simple admin local-user admin service-type http interface Vlanif1 interface MEth0/0/1 interface GigabitEthernet0/0/1 port link-type trunk port trunk allow-pass vlan 10 20 30 interface GigabitEthernet0/0/2 port link-type access port default vlan 10 interface GigabitEthernet0/0/3 port link-type access port default vlan 20 interface GigabitEthernet0/0/4 port link-type access port default vlan 30 interface GigabitEthernet0/0/5 interface GigabitEthernet0/0/6 interface GigabitEthernet0/0/7 interface GigabitEthernet0/0/8 interface GigabitEthernet0/0/9 interface GigabitEthernet0/0/10 interface GigabitEthernet0/0/11 interface GigabitEthernet0/0/12 interface GigabitEthernet0/0/13 interface GigabitEthernet0/0/14 interface GigabitEthernet0/0/15 interface GigabitEthernet0/0/16 interface GigabitEthernet0/0/17 interface GigabitEthernet0/0/18 interface GigabitEthernet0/0/19 interface GigabitEthernet0/0/20 interface GigabitEthernet0/0/21 interface GigabitEthernet0/0/22 interface GigabitEthernet0/0/23 interface GigabitEthernet0/0/24 interface NULL0 user-interface con 0 user-interface vty 0 4 telnet-server [V200R003C00] sysname telneservert snmp-agent local-engineid 800007DB03000000000000 snmp-agent clock timezone China-Standard-Time minus 08:00:00 portal local-server load flash:/portalpage.zip drop illegal-mac alarm wlan ac-global carrier id other ac id 0 set cpu-usage threshold 80 restore 75 aaa authentication-scheme default authorization-scheme default accounting-scheme default domain default domain default_admin local-user admin password cipher %$%$K8m.Nt84DZ}e#<08bmE3Uw}%
    local-user admin service-type http
    firewall zone Local
    priority 15
    interface GigabitEthernet0/0/0
    ip address 172.16.66.254 255.255.255.0
    interface GigabitEthernet0/0/1
    interface GigabitEthernet0/0/2
    interface NULL0
    user-interface con 0
    authentication-mode password
    user-interface vty 0 4
    user-interface vty 16 20
    wlan ac
    R4
    [V200R003C00]
    sysname R4
    board add 0/4 2FE
    snmp-agent local-engineid 800007DB03000000000000
    snmp-agent
    clock timezone China-Standard-Time minus 08:00:00
    portal local-server load flash:/portalpage.zip
    drop illegal-mac alarm
    wlan ac-global carrier id other ac id 0
    set cpu-usage threshold 80 restore 75
    aaa
    authentication-scheme default
    authorization-scheme default
    accounting-scheme default
    domain default
    domain default_admin
    local-user admin password cipher %K8m.Nt84DZ}e#<08bmE3Uw}%$%$ local-user admin service-type http firewall zone Local priority 15 interface Ethernet4/0/0 ip address 172.16.130.2 255.255.255.0 interface Ethernet4/0/1 interface GigabitEthernet0/0/0 ip address 172.16.129.2 255.255.255.0 interface GigabitEthernet0/0/1 ip address 172.16.131.1 255.255.255.0 interface GigabitEthernet0/0/2 ip address 172.16.132.1 255.255.255.0 interface NULL0 ip route-static 0.0.0.0 0.0.0.0 172.16.129.1 ip route-static 0.0.0.0 0.0.0.0 172.16.130.1 preference 100 ip route-static 172.16.128.0 255.255.255.0 172.16.131.2 ip route-static 172.16.128.0 255.255.255.0 172.16.132.2 ip route-static 172.16.133.0 255.255.255.0 172.16.131.2 ip route-static 172.16.134.0 255.255.255.0 172.16.132.2 user-interface con 0 authentication-mode password user-interface vty 0 4 user-interface vty 16 20 wlan ac R5 [V200R003C00] sysname R5 snmp-agent local-engineid 800007DB03000000000000 snmp-agent clock timezone China-Standard-Time minus 08:00:00 portal local-server load flash:/portalpage.zip drop illegal-mac alarm wlan ac-global carrier id other ac id 0 set cpu-usage threshold 80 restore 75 aaa authentication-scheme default authorization-scheme default accounting-scheme default domain default domain default_admin local-user admin password cipher %$%$K8m.Nt84DZ}e#<08bmE3Uw}%
    local-user admin service-type http
    firewall zone Local
    priority 15
    interface GigabitEthernet0/0/0
    ip address 172.16.133.1 255.255.255.0
    interface GigabitEthernet0/0/1
    interface GigabitEthernet0/0/2
    interface NULL0
    ip route-static 0.0.0.0 0.0.0.0 172.16.131.1
    ip route-static 172.16.128.0 255.255.255.0 172.16.133.2
    ip route-static 172.16.134.0 255.255.255.0 172.16.133.2
    user-interface con 0
    authentication-mode password
    user-interface vty 0 4
    user-interface vty 16 20
    wlan ac
    SW3
    sysname sw3
    vlan batch 60 70
    cluster enable
    ntdp enable
    ndp enable
    drop illegal-mac alarm
    diffserv domain default
    drop-profile default
    aaa
    authentication-scheme default
    authorization-scheme default
    accounting-scheme default
    domain default
    domain default_admin
    local-user admin password simple admin
    local-user admin service-type http
    interface Vlanif1
    interface MEth0/0/1
    interface GigabitEthernet0/0/1
    port link-type trunk
    port trunk allow-pass vlan 60 70
    interface GigabitEthernet0/0/2
    port link-type access
    port default vlan 70
    interface GigabitEthernet0/0/3
    port link-type access
    port default vlan 60
    interface GigabitEthernet0/0/4
    port link-type access
    port default vlan 60
    interface GigabitEthernet0/0/5
    interface GigabitEthernet0/0/6
    interface GigabitEthernet0/0/7
    interface GigabitEthernet0/0/8
    interface GigabitEthernet0/0/9
    interface GigabitEthernet0/0/10
    interface GigabitEthernet0/0/11
    interface GigabitEthernet0/0/12
    interface GigabitEthernet0/0/13
    interface GigabitEthernet0/0/14
    interface GigabitEthernet0/0/15
    interface GigabitEthernet0/0/16
    interface GigabitEthernet0/0/17
    interface GigabitEthernet0/0/18
    interface GigabitEthernet0/0/19
    interface GigabitEthernet0/0/20
    interface GigabitEthernet0/0/21
    interface GigabitEthernet0/0/22
    interface GigabitEthernet0/0/23
    interface GigabitEthernet0/0/24
    interface NULL0
    user-interface con 0
    user-interface vty 0 4
    port-group defau
    R1
    [V200R003C00]
    sysname R1
    snmp-agent local-engineid 800007DB03000000000000
    snmp-agent
    clock timezone China-Standard-Time minus 08:00:00
    portal local-server load flash:/portalpage.zip
    drop illegal-mac alarm
    wlan ac-global carrier id other ac id 0
    set cpu-usage threshold 80 restore 75
    dhcp enable
    ip pool vlan20
    gateway-list 172.16.65.1
    network 172.16.65.0 mask 255.255.255.0
    ip pool vlan10
    gateway-list 172.16.64.1
    network 172.16.64.0 mask 255.255.255.0
    aaa
    authentication-scheme default
    authorization-scheme default
    accounting-scheme default
    domain default
    domain default_admin
    local-user admin password cipher %K8m.Nt84DZ}e#<08bmE3Uw}%$%$ local-user admin service-type http firewall zone Local priority 15 interface GigabitEthernet0/0/0 ip address 172.16.67.1 255.255.255.0 interface GigabitEthernet0/0/1 dhcp select global interface GigabitEthernet0/0/1.1 dot1q termination vid 10 ip address 172.16.64.1 255.255.255.0 arp broadcast enable dhcp select global interface GigabitEthernet0/0/1.2 dot1q termination vid 20 ip address 172.16.65.1 255.255.255.0 arp broadcast enable dhcp select global interface GigabitEthernet0/0/1.3 dot1q termination vid 30 ip address 172.16.66.1 255.255.255.0 arp broadcast enable interface GigabitEthernet0/0/2 interface NULL0 ospf 1 router-id 1.1.1.1 area 0.0.0.1 network 172.16.64.1 0.0.0.0 network 172.16.65.1 0.0.0.0 network 172.16.66.1 0.0.0.0 network 172.16.67.0 0.0.0.255 network 172.16.67.1 0.0.0.0 user-interface con 0 authentication-mode password user-interface vty 0 4 user-interface vty 16 20 wlan ac R6 [V200R003C00] sysname R6 snmp-agent local-engineid 800007DB03000000000000 snmp-agent clock timezone China-Standard-Time minus 08:00:00 portal local-server load flash:/portalpage.zip drop illegal-mac alarm wlan ac-global carrier id other ac id 0 set cpu-usage threshold 80 restore 75 aaa authentication-scheme default authorization-scheme default accounting-scheme default domain default domain default_admin local-user admin password cipher %$%$K8m.Nt84DZ}e#<08bmE3Uw}%
    local-user admin service-type http
    firewall zone Local
    priority 15
    interface GigabitEthernet0/0/0
    ip address 172.16.132.2 255.255.255.0
    interface GigabitEthernet0/0/1
    ip address 172.16.134.1 255.255.255.0
    interface GigabitEthernet0/0/2
    interface NULL0
    ip route-static 0.0.0.0 0.0.0.0 172.16.132.1
    ip route-static 172.16.128.0 255.255.255.0 172.16.134.2
    ip route-static 172.16.133.0 255.255.255.0 172.16.134.2
    user-interface con 0
    authentication-mode password
    user-interface vty 0 4
    user-interface vty 16 20
    wlan ac
    LSW4
    sysname Huawei
    cluster enable
    ntdp enable
    ndp enable
    drop illegal-mac alarm
    diffserv domain default
    drop-profile default
    aaa
    authentication-scheme default
    authorization-scheme default
    accounting-scheme default
    domain default
    domain default_admin
    local-user admin password simple admin
    local-user admin service-type http
    interface Vlanif1
    interface MEth0/0/1
    interface GigabitEthernet0/0/1
    interface GigabitEthernet0/0/2
    interface GigabitEthernet0/0/3
    interface GigabitEthernet0/0/4
    interface GigabitEthernet0/0/5
    interface GigabitEthernet0/0/6
    interface GigabitEthernet0/0/7
    interface GigabitEthernet0/0/8
    interface GigabitEthernet0/0/9
    interface GigabitEthernet0/0/10
    interface GigabitEthernet0/0/11
    interface GigabitEthernet0/0/12
    interface GigabitEthernet0/0/13
    interface GigabitEthernet0/0/14
    interface GigabitEthernet0/0/15
    interface GigabitEthernet0/0/16
    interface GigabitEthernet0/0/17
    interface GigabitEthernet0/0/18
    interface GigabitEthernet0/0/19
    interface GigabitEthernet0/0/20
    interface GigabitEthernet0/0/21
    interface GigabitEthernet0/0/22
    interface GigabitEthernet0/0/23
    interface GigabitEthernet0/0/24
    interface NULL0
    user-interface con 0
    user-interface vty 0 4