2025-10-31

一、实验拓扑

image.png

二、实验需求
1.所有PC均需要通过DHCP获取IP地址-地址池名称和设备VLAN一致，例如PC1-ip pool vlan10,其中
只有业务B网络用户需要访问互联网web服务-需要DNS信息。
2.交换机配置VLAN需要遵循最小VLAN透传原则
3.利用OSPF协议使内外用户互相访问-全网可达（设备Router-ID需要手工配置，和设备编号一致，例
如R1-RID：1.1.1.1），并采用精准宣告的方式进行宣告（例如：172.16.64.1/24接口，宣告：
172.16.64.1 0.0.0.0）
4.内网全网可达，并且需要尽可能减小路由表条目数量（汇总采用精确汇总方式），能够利用缺省省去
的配置可省略，防止环路，并且保障安全（在OSPF区域0需要配置认证-采用MD5认证，密码为123456）
5.内网所有用户均可访问互联网（边界路由器配置NAT），ACL采用基础ACL，编号为2000，R3-0/0/2
接口不允许宣告在内网中（包含静态）。
6.test设备需要远程登陆到内网telnet-server设备,登录账号为 huawei 密码 123456，登录权限
为最高。
7.不允许VLAN 40和VLAN 50 用户访问内网B业务，acl编号为2001，不允许PC1访问PC5，ACL编号为
3000。
8.R3-R4中间百兆链路作为备份链路，不允许正常情况下数据通过，需要降低优先级数值配置为100。
9.所有设备严格按照拓扑图标识进行配置，注意大小写。
10.图示中所有服务器和client设备均为体现需求，地址固定，不做更改，在配置时需求注意。
clinet1用来模拟内网用户访问互联网（ISP-服务器），test设备用来测试互联网用户远程登陆内网
telent-server主机。
三、实验思路
以“满足业务需求+保障网络稳定”为核心，遵循“分层划分、协议适配、精准配置”的思路，将网络按功能拆分为OSPF内网区、静态业务区、互联网出口区，通过子网规划、路由协议配置、访问控制策略，实现“全网可达、动态分配、安全可控”的目标。

子网与IP规划思路：基于总网段 172.16.0.0/16 ，按业务类型拆分： 172.16.0.0/17 分配给OSPF内网（再细分为Area 0骨干区和Area 1非骨干区）， 172.16.128.0/17 分配给静态业务B，互联网出口区单独使用 100.0.0.0/24 公有网段，避免地址冲突；终端设备（PC、服务器）按VLAN绑定独立/24子网，路由器互联链路使用专属/24子网，确保“一链路一网段、一VLAN一地址池”，简化路由管理。
OSPF内网配置思路：Router-ID手工指定为设备编号（如R1：1.1.1.1），保证唯一性；采用“精准宣告”（如 172.16.64.1 0.0.0.0 ），仅发布必要接口路由，减少LSA泛洪；Area 0启用MD5认证（密码123456），防止非法路由更新；非骨干区（Area 1）向骨干区做路由汇总（如 172.16.64.0 255.255.248.0 ），压缩路由表条目；R3-R4百兆链路通过设置OSPF成本值（cost=100）降低优先级，实现“千兆为主、百兆备份”的链路冗余。
终端接入与DHCP配置思路：路由器子接口封装802.1Q协议，与交换机VLAN一一对应（如VLAN 10对应子接口0/0/1.1），实现不同VLAN终端的隔离与互联；DHCP地址池名称与VLAN编号一致（如VLAN 10对应ip pool vlan10），自动分配IP、网关、DNS，仅业务B区域终端配置DNS信息，满足互联网访问需求。
访问控制与互联网访问思路：边界路由器R3配置NAT（PAT模式），通过ACL 2000允许内网网段（172.16.0.0/17、172.16.128.0/17）访问互联网，R3互联网接口（0/0/2）不参与OSPF宣告，避免外网路由侵入；用ACL 2001禁止VLAN 40/50（172.16.0.0/24、172.16.1.0/24）访问业务B区域，ACL 3000精准禁止PC1（172.16.64.254）访问PC5（172.16.128.254），实现细粒度访问控制。
远程登录配置思路：Telnet-server启用本地认证，创建最高权限账号（huawei/123456），开放VTY线路（0-4）支持多用户并发登录；借助NAT映射，互联网test设备（100.0.0.2）通过R3公网IP（100.0.0.1）远程登录内网Telnet-server，验证跨网段访问能力。
验证思路：按“基础连通性→功能验证→异常测试”分步验证：先确认PC动态获取IP、路由器邻居状态FULL；再测试内网互访、互联网访问、ACL过滤效果；最后断开主链路验证备份链路切换，确保所有需求达标。

四、实验验收
R1

[R1]display current-configuration
[V200R003C00]

sysname R1

snmp-agent local-engineid 800007DB03000000000000
snmp-agent

clock timezone China-Standard-Time minus 08:00:00

portal local-server load flash:/portalpage.zip

drop illegal-mac alarm

wlan ac-global carrier id other ac id 0

set cpu-usage threshold 80 restore 75

dhcp enable

acl number 3000
rule 5 deny ip source 172.16.64.254 0 destination 172.16.128.254 0

ip pool vlan10
gateway-list 172.16.64.1
network 172.16.64.0 mask 255.255.255.0

ip pool vlan20
gateway-list 172.16.65.1
network 172.16.65.0 mask 255.255.255.0

firewall zone Local
priority 15

interface GigabitEthernet0/0/0
ip address 172.16.67.1 255.255.255.0

interface GigabitEthernet0/0/1
traffic-filter inbound acl 3000

interface GigabitEthernet0/0/1.1
dot1q termination vid 10
ip address 172.16.64.1 255.255.255.0
arp broadcast enable
dhcp select global

interface GigabitEthernet0/0/1.2
dot1q termination vid 20
ip address 172.16.65.1 255.255.255.0
arp broadcast enable
dhcp select global

interface GigabitEthernet0/0/1.3
dot1q termination vid 30
ip address 172.16.66.1 255.255.255.0
arp broadcast enable
dhcp select global

interface GigabitEthernet0/0/2

interface NULL0

ospf 1 router-id 1.1.1.1
silent-interface GigabitEthernet0/0/1.1
silent-interface GigabitEthernet0/0/1.2
silent-interface GigabitEthernet0/0/1.3
area 0.0.0.0
area 0.0.0.1
network 172.16.64.0 0.0.0.0
network 172.16.64.1 0.0.0.0
network 172.16.65.0 0.0.0.0
network 172.16.65.1 0.0.0.0
network 172.16.66.0 0.0.0.0
network 172.16.66.1 0.0.0.0
network 172.16.67.0 0.0.0.0
network 172.16.67.0 0.0.0.255

ip route-static 172.16.0.0 255.255.255.0 172.16.67.2

user-interface con 0
authentication-mode password
user-interface vty 0 4
user-interface vty 16 20

wlan ac

return

R2
<R2>display current-configuration
[V200R003C00]

sysname R2

snmp-agent local-engineid 800007DB03000000000000
snmp-agent

clock timezone China-Standard-Time minus 08:00:00

portal local-server load flash:/portalpage.zip

drop illegal-mac alarm

wlan ac-global carrier id other ac id 0

set cpu-usage threshold 80 restore 75

dhcp enable

ip pool vlan40
gateway-list 172.16.0.1
network 172.16.0.0 mask 255.255.255.0

ip pool vlan50
gateway-list 172.16.1.1
network 172.16.1.0 mask 255.255.255.0

firewall zone Local
priority 15

interface GigabitEthernet0/0/0
ip address 172.16.67.2 255.255.255.0

interface GigabitEthernet0/0/1

interface GigabitEthernet0/0/1.1
dot1q termination vid 40
ip address 172.16.0.1 255.255.255.0
arp broadcast enable
dhcp select global

interface GigabitEthernet0/0/1.2
dot1q termination vid 50
ip address 172.16.1.1 255.255.255.0
arp broadcast enable
dhcp select global

interface GigabitEthernet0/0/2
ip address 172.16.2.1 255.255.255.0

interface NULL0

ospf 1 router-id 2.2.2.2
area 0.0.0.0
network 172.16.0.0 0.0.0.0
network 172.16.1.0 0.0.0.0
network 172.16.2.0 0.0.0.0
area 0.0.0.1
abr-summary 172.16.64.0 255.255.192.0
network 172.16.67.0 0.0.0.0

user-interface con 0
authentication-mode password
user-interface vty 0 4
user-interface vty 16 20

wlan ac

return

R3
<R3>display current-configuration
[V200R003C00]

sysname R3

board add 0/4 2FE

snmp-agent local-engineid 800007DB03000000000000
snmp-agent

clock timezone China-Standard-Time minus 08:00:00

portal local-server load flash:/portalpage.zip

drop illegal-mac alarm

wlan ac-global carrier id other ac id 0

set cpu-usage threshold 80 restore 75

acl number 2000
rule 5 permit source 172.16.0.0 0.0.255.255
acl number 2001
rule 5 deny source 172.16.0.0 0.0.0.255
rule 10 deny source 172.16.1.0 0.0.0.255

firewall zone Local
priority 15

interface Ethernet4/0/0
ip address 172.16.130.1 255.255.255.0

interface Ethernet4/0/1

interface GigabitEthernet0/0/0
ip address 172.16.2.2 255.255.255.0
traffic-filter inbound acl 2001

interface GigabitEthernet0/0/1
ip address 172.16.129.1 255.255.255.0

interface GigabitEthernet0/0/2
nat server protocol tcp global current-interface telnet inside 172.16.66.254 te
lnet
nat outbound 2000

interface NULL0

ospf 1 router-id 3.3.3.3
default-route-advertise always
area 0.0.0.0
authentication-mode md5 1 cipher % $%$ x~gHKYL.p2_LBy"9FIIS[Qz/% $%$
network 172.16.2.2 0.0.0.0

ip route-static 172.16.128.0 255.255.255.0 172.16.130.2 preference 100
ip route-static 172.16.128.0 255.255.255.0 172.16.129.2
ip route-static 172.16.131.0 255.255.255.0 172.16.130.2 preference 100
ip route-static 172.16.132.0 255.255.255.0 172.16.130.2 preference 100
ip route-static 172.16.132.0 255.255.255.0 172.16.129.2
ip route-static 172.16.133.0 255.255.255.0 172.16.130.2 preference 100
ip route-static 172.16.133.0 255.255.255.0 172.16.129.2
ip route-static 172.16.134.0 255.255.255.0 172.16.130.2 preference 100
ip route-static 172.16.134.0 255.255.255.0 172.16.129.2

user-interface con 0
authentication-mode password
user-interface vty 0 4
user-interface vty 16 20

wlan ac

return

R4
<R4>display current-configuration
[V200R003C00]

sysname R4

board add 0/4 2FE

snmp-agent local-engineid 800007DB03000000000000
snmp-agent

clock timezone China-Standard-Time minus 08:00:00

portal local-server load flash:/portalpage.zip

drop illegal-mac alarm

wlan ac-global carrier id other ac id 0

set cpu-usage threshold 80 restore 75

firewall zone Local
priority 15

interface Ethernet4/0/0
ip address 172.16.130.2 255.255.255.0

interface Ethernet4/0/1

interface GigabitEthernet0/0/0
ip address 172.16.129.2 255.255.255.0

interface GigabitEthernet0/0/1
ip address 172.16.131.1 255.255.255.0

interface GigabitEthernet0/0/2
ip address 172.16.132.1 255.255.255.0

interface NULL0

ip route-static 0.0.0.0 0.0.0.0 172.16.129.1
ip route-static 0.0.0.0 0.0.0.0 172.16.130.1 preference 100
ip route-static 172.16.128.0 255.255.255.0 172.16.132.2
ip route-static 172.16.128.0 255.255.255.0 172.16.131.2
ip route-static 172.16.133.0 255.255.255.0 172.16.131.2
ip route-static 172.16.134.0 255.255.255.0 172.16.132.2

user-interface con 0
authentication-mode password
user-interface vty 0 4
user-interface vty 16 20

wlan ac

return

R5
<R5>display current-configuration
[V200R003C00]

sysname R5

snmp-agent local-engineid 800007DB03000000000000
snmp-agent

clock timezone China-Standard-Time minus 08:00:00

portal local-server load flash:/portalpage.zip

drop illegal-mac alarm

wlan ac-global carrier id other ac id 0

set cpu-usage threshold 80 restore 75

firewall zone Local
priority 15

interface GigabitEthernet0/0/0
ip address 172.16.130.2 255.255.255.0

interface GigabitEthernet0/0/1
ip address 172.16.133.1 255.255.255.0

interface GigabitEthernet0/0/2

interface NULL0

ip route-static 0.0.0.0 0.0.0.0 172.16.131.1
ip route-static 172.16.128.0 255.255.255.0 172.16.133.2
ip route-static 172.16.134.0 255.255.255.0 172.16.133.2

user-interface con 0
authentication-mode password
user-interface vty 0 4
user-interface vty 16 20

wlan ac

return

R6
<Huawei>display current-configuration
[V200R003C00]

snmp-agent local-engineid 800007DB03000000000000
snmp-agent

clock timezone China-Standard-Time minus 08:00:00

portal local-server load flash:/portalpage.zip

drop illegal-mac alarm

wlan ac-global carrier id other ac id 0

set cpu-usage threshold 80 restore 75

firewall zone Local
priority 15

interface GigabitEthernet0/0/0

interface GigabitEthernet0/0/1

interface GigabitEthernet0/0/2

interface NULL0

user-interface con 0
authentication-mode password
user-interface vty 0 4
user-interface vty 16 20

wlan ac

return

R7
<R7>display current-configuration
[V200R003C00]

sysname R7

snmp-agent local-engineid 800007DB03000000000000
snmp-agent

clock timezone China-Standard-Time minus 08:00:00

portal local-server load flash:/portalpage.zip

drop illegal-mac alarm

wlan ac-global carrier id other ac id 0

set cpu-usage threshold 80 restore 75

dhcp enable

ip pool vlan60
gateway-list 172.16.128.1
network 172.16.128.0 mask 255.255.255.128
dns-list 172.16.128.126

ip pool vlan70
gateway-list 172.16.128.129
network 172.16.128.128 mask 255.255.255.128
dns-list 172.16.128.126

firewall zone Local
priority 15

interface GigabitEthernet0/0/0
ip address 172.16.133.2 255.255.255.0

interface GigabitEthernet0/0/1
ip address 172.16.134.2 255.255.255.0

interface GigabitEthernet0/0/2

interface GigabitEthernet0/0/2.1
dot1q termination vid 60
ip address 172.16.28.1 255.255.255.128
arp broadcast enable
dhcp select global

interface GigabitEthernet0/0/2.2
dot1q termination vid 70
ip address 172.16.128.129 255.255.255.128
arp broadcast enable
dhcp select global

interface NULL0

ip route-static 0.0.0.0 0.0.0.0 172.16.133.1
ip route-static 0.0.0.0 0.0.0.0 172.16.134.1
ip route-static 172.16.0.0 255.255.192.0 NULL0
ip route-static 172.16.64.0 255.255.192.0 NULL0
ip route-static 172.16.131.0 255.255.255.0 172.16.133.1
ip route-static 172.16.132.0 255.255.255.0 172.16.134.1

user-interface con 0
authentication-mode password
user-interface vty 0 4
user-interface vty 16 20

wlan ac

return

SW1
<SW1>display current-configuration

sysname SW1

vlan batch 10 20 30

cluster enable
ntdp enable
ndp enable

drop illegal-mac alarm

diffserv domain default

drop-profile default

aaa
authentication-scheme default
authorization-scheme default
accounting-scheme default
domain default
domain default_admin
local-user admin password simple admin
local-user admin service-type http

interface Vlanif1

interface MEth0/0/1

interface GigabitEthernet0/0/1
port link-type trunk
port trunk allow-pass vlan 10 20 30

interface GigabitEthernet0/0/2
port link-type access
port default vlan 10

interface GigabitEthernet0/0/3
port link-type access
port default vlan 20

interface GigabitEthernet0/0/4
port link-type access
port default vlan 30

interface GigabitEthernet0/0/5

interface GigabitEthernet0/0/6

interface GigabitEthernet0/0/7

interface GigabitEthernet0/0/8

interface GigabitEthernet0/0/9

interface GigabitEthernet0/0/10

interface GigabitEthernet0/0/11

interface GigabitEthernet0/0/12

interface GigabitEthernet0/0/13

interface GigabitEthernet0/0/14

interface GigabitEthernet0/0/15

interface GigabitEthernet0/0/16

interface GigabitEthernet0/0/17

interface GigabitEthernet0/0/18

interface GigabitEthernet0/0/19

interface GigabitEthernet0/0/20

interface GigabitEthernet0/0/21

interface GigabitEthernet0/0/22

interface GigabitEthernet0/0/23

interface GigabitEthernet0/0/24

interface NULL0

user-interface con 0
user-interface vty 0 4

return

SW2
<SW2>display current-configuration

sysname SW2

vlan batch 40 50

cluster enable
ntdp enable
ndp enable

drop illegal-mac alarm

diffserv domain default

drop-profile default

aaa
authentication-scheme default
authorization-scheme default
accounting-scheme default
domain default
domain default_admin
local-user admin password simple admin
local-user admin service-type http

interface Vlanif1

interface MEth0/0/1

interface GigabitEthernet0/0/1
port link-type trunk
port trunk allow-pass vlan 40 50

interface GigabitEthernet0/0/2
port link-type access
port default vlan 40

interface GigabitEthernet0/0/3
port link-type access
port default vlan 50

interface GigabitEthernet0/0/4

interface GigabitEthernet0/0/5

interface GigabitEthernet0/0/6

interface GigabitEthernet0/0/7

interface GigabitEthernet0/0/8

interface GigabitEthernet0/0/9

interface GigabitEthernet0/0/10

interface GigabitEthernet0/0/11

interface GigabitEthernet0/0/12

interface GigabitEthernet0/0/13

interface GigabitEthernet0/0/14

interface GigabitEthernet0/0/15

interface GigabitEthernet0/0/16

interface GigabitEthernet0/0/17

interface GigabitEthernet0/0/18

interface GigabitEthernet0/0/19

interface GigabitEthernet0/0/20

interface GigabitEthernet0/0/21

interface GigabitEthernet0/0/22

interface GigabitEthernet0/0/23

interface GigabitEthernet0/0/24

interface NULL0

user-interface con 0
user-interface vty 0 4

return

SW3
<SW3>display current-configuration

sysname SW3

vlan batch 60 70

cluster enable
ntdp enable
ndp enable

drop illegal-mac alarm

diffserv domain default

drop-profile default

aaa
authentication-scheme default
authorization-scheme default
accounting-scheme default
domain default
domain default_admin
local-user admin password simple admin
local-user admin service-type http

interface Vlanif1

interface MEth0/0/1

interface GigabitEthernet0/0/1
port link-type trunk
port trunk allow-pass vlan 60 70

interface GigabitEthernet0/0/2
port link-type access
port default vlan 70

interface GigabitEthernet0/0/3
port link-type access
port default vlan 60

interface GigabitEthernet0/0/4
port link-type access
port default vlan 60

interface GigabitEthernet0/0/5

interface GigabitEthernet0/0/6

interface GigabitEthernet0/0/7

interface GigabitEthernet0/0/8

interface GigabitEthernet0/0/9

interface GigabitEthernet0/0/10

interface GigabitEthernet0/0/11

interface GigabitEthernet0/0/12

interface GigabitEthernet0/0/13

interface GigabitEthernet0/0/14

interface GigabitEthernet0/0/15

interface GigabitEthernet0/0/16

interface GigabitEthernet0/0/17

interface GigabitEthernet0/0/18

interface GigabitEthernet0/0/19

interface GigabitEthernet0/0/20

interface GigabitEthernet0/0/21

interface GigabitEthernet0/0/22

interface GigabitEthernet0/0/23

interface GigabitEthernet0/0/24

interface NULL0

user-interface con 0
user-interface vty 0 4

return

telnet-server
<telnet-server>display current-configuration
[V200R003C00]

sysname telnet-server

snmp-agent local-engineid 800007DB03000000000000
snmp-agent

clock timezone China-Standard-Time minus 08:00:00

portal local-server load flash:/portalpage.zip

drop illegal-mac alarm

wlan ac-global carrier id other ac id 0

set cpu-usage threshold 80 restore 75

aaa
authentication-scheme default
authorization-scheme default
accounting-scheme default
domain default
domain default_admin
local-user admin password cipher % $%$ K8m.Nt84DZ}e#<08bmE3Uw}%$%$ local-user admin service-type http local-user huawei password cipher %$%$-~946Xa++')7nVv $yl>[btI%$ %$
local-user huawei privilege level 15
local-user huawei service-type telnet

firewall zone Local
priority 15

interface GigabitEthernet0/0/0
ip address 172.16.66.254 255.255.255.0

interface GigabitEthernet0/0/1

interface GigabitEthernet0/0/2

interface NULL0

ip route-static 0.0.0.0 0.0.0.0 172.16.66.1

user-interface con 0
authentication-mode password
user-interface vty 0 4
authentication-mode aaa
user-interface vty 16 20

wlan ac

return

image.png

五、实验心得
写完了这个实验，实现了OSPF内网与静态业务区的全网可达，满足“内网访问互联网、远程登录、访问控制”等核心需求。
通过OSPF精准宣告、路由汇总及MD5认证，既减少了路由表大小，又保障了网络安全性与稳定性；备份链路与ACL的配置，进一步提升了网络的可靠性与可控性。实验过程中暴露了“协议参数不一致、地址池冲突”等问题，通过排查配置细节、核对规划表得以解决，加深了对网络协议原理与实操逻辑的理解。

2025-10-31

2025-10-31

相关阅读更多精彩内容

友情链接更多精彩内容