2025-10-31

一：实验拓扑

屏幕截图 2025-10-31 210843.png

二：实验需求

1.所有PC均需要通过DHCP获取IP地址-地址池名称和设备VLAN一致，例如PC1-ip pool vlan10,其中只有业务B网络用户需要访问互联网web服务-需要DN信息。

2.交换机配置VLAN需要遵循最小VLAN透传原则

3.利用OSPF协议使内外用户互相访问-全网可达（设备Router-ID需要手工配置，和设备编号一致，例如R1-RID：1.1.1.1），并采用精准宣告的方式进行宣告（例如：172.16.64.1/24接口，宣告：172.16.64.1 0.0.0.0）

4.内网全网可达，并且需要尽可能减小路由表条目数量（汇总采用精确汇总方式），能够利用缺省省去的配置可省略，防止环路，并且保障安全（在OSPF区域0需要配置认证-采用MD5认证，密码为123456）

5.内网所有用户均可访问互联网（边界路由器配置NAT），ACL采用基础ACL，编号为2000，R3-0/0/2接口不允许宣告在内网中（包含静态）。

6.test设备需要远程登陆到内网telnet-server设备,登录账号为 huawei 密码 123456，登录权限为最高。

7.不允许VLAN 40和VLAN 50 用户访问内网B业务，acl编号为2001，不允许PC1访问PC5，ACL编号为3000。

8.R3-R4中间百兆链路作为备份链路，不允许正常情况下数据通过，需要降低优先级数值配置为100。

9.所有设备严格按照拓扑图标识进行配置，注意大小写。

10.图示中所有服务器和client设备均为体现需求，地址固定，不做更改，在配置时需求注意。

clinet1用来模拟内网用户访问互联网（ISP-服务器），test设备用来测试互联网用户远程登陆内网telent-server主机。

三：实验思路

1．网段规划：按172.16.0.0/16划分子网，明确各设备接口、VLAN对应的网段及网关；

2.交换机配置：创建所需VLAN，配置接口为access/trunk类型，放行对应VLAN，路由器配置：配置物理接口／子接口IP，实现设备基础连通；

4.DHCP配置：在R1、R2、R7上配置地址池，使PC自动获取IP;

5.OSPF配置：在R1、R2、R3上启动OSPF,精确宣告网段，实现内网A路由互通；

6．静态路由配置：在R3、R4、R5、R6、R7上配置静态路由，结合默认路由实现内网B互联互通；

7.OSPF与静态路由联动：在R3上配置重发布，使内网A与内网B路由互通；

8.ACL配置：实现PC1与PC5的访问限制；

9.NAT配置：在R3上配置Easy IP和NATServer映射Telnet端口，满足公网访问需求；

10．主备链路配置：通过静态路由优先级实现R3-R4链路备份。

四：实验步骤

  1. 路由器配置

[R1]dhcp enable

[R1]interface GigabitEthernet0/0/0

[R1-GigabitEthernet0/0/0]ip address 172.16.67.1 24

[R1]interface GigabitEthernet0/0/1.1

[R1-GigabitEthernet0/0/1.1]dot1q termination vid 10

[R1-GigabitEthernet0/0/1.1]ip address 172.16.64.1 24

[R1-GigabitEthernet0/0/1.1]arp broadcast enable

[R1]interface GigabitEthernet0/0/1.2

[R1-GigabitEthernet0/0/1.2]dot1q termination vid 20

[R1-GigabitEthernet0/0/1.2]ip address 172.16.65.1 24

[R1-GigabitEthernet0/0/1.2]arp broadcast enable

[R1]interface GigabitEthernet0/0/1.3

[R1-GigabitEthernet0/0/1.3]dot1q termination vid 30

[R1-GigabitEthernet0/0/1.3]ip address 172.16.66.1 24

[R1-GigabitEthernet0/0/1.3]arp broadcast enable

[R2]interface GigabitEthernet0/0/0

[R2-GigabitEthernet0/0/0]ip address 172.16.67.2 24

[R2]interface GigabitEthernet0/0/1.1

[R2-GigabitEthernet0/0/1.1]dot1q termination vid 40

[R2-GigabitEthernet0/0/1.1]ip address 172.16.0.1 24

[R2-GigabitEthernet0/0/1.1]arp broadcast enable

[R2]interface GigabitEthernet0/0/1.2

[R2-GigabitEthernet0/0/1.2]dot1q termination vid 50

[R2-GigabitEthernet0/0/1.2]ip address 172.16.1.1 24

[R2-GigabitEthernet0/0/1.2]arp broadcast enable

[R2]interface GigabitEthernet0/0/2

[R2-GigabitEthernet0/0/2]ip address 172.16.2.1 24

[R3]interface GigabitEthernet0/0/0

[R3-GigabitEthernet0/0/0]ip address 172.16.2.2 24

[R3]interface GigabitEthernet0/0/1

[R3-GigabitEthernet0/0/1]ip address 172.16.129.1 24

[R3]interface GigabitEthernet0/0/2

[R3-GigabitEthernet0/0/2]ip address 100.0.0.1 24

[R3]interface Ethernet4/0/0

[R3-Ethernet4/0/0]ip address 172.16.130.1 24

[R4]interface GigabitEthernet0/0/0

[R4-GigabitEthernet0/0/0]ip address 172.16.129.2 24

[R4]interface Ethernet4/0/0

[R4-Ethernet4/0/0]ip address 172.16.130.2 24

[R4]interface GigabitEthernet0/0/1

[R4-GigabitEthernet0/0/1]ip address 172.16.131.1 24

[R4]interface GigabitEthernet0/0/2

[R4-GigabitEthernet0/0/2]ip address 172.16.132.1 24

[R5]interface GigabitEthernet0/0/0

[R5-GigabitEthernet0/0/0]ip address 172.16.131.2 24

[R5]interface GigabitEthernet0/0/1

[R5-GigabitEthernet0/0/1]ip address 172.16.133.1 24

[R6]interface GigabitEthernet0/0/0

[R6-GigabitEthernet0/0/0]ip address 172.16.132.2 24

[R6]interface GigabitEthernet0/0/1

[R6-GigabitEthernet0/0/1]ip address 172.16.134.1 24

[R7]interface GigabitEthernet0/0/0

[R7-GigabitEthernet0/0/0]ip address 172.16.133.2 24

[R7]interface GigabitEthernet0/0/1

[R7-GigabitEthernet0/0/1]ip address 172.16.134.2 24

[R7]interface GigabitEthernet0/0/2.1

[R7-GigabitEthernet0/0/2.1]dot1q termination vid 60

[R7-GigabitEthernet0/0/2.1]ip address 172.16.128.1 25

[R7-GigabitEthernet0/0/2.1]arp broadcast enable

[R7]interface GigabitEthernet0/0/2.2

[R7-GigabitEthernet0/0/2.2]dot1q termination vid 70

[R7-GigabitEthernet0/0/2.2]ip address 172.16.128.129 25

[R7-GigabitEthernet0/0/2.2]arp broadcast enable

[test]interface GigabitEthernet0/0/0

[test-GigabitEthernet0/0/0]ip address 100.0.0.2 24

  1. 接口配置情况
屏幕截图 2025-10-31 212122.png
  1. 交换机配置

[SW1]vlan batch 10 20 30

[SW1]interface GigabitEthernet0/0/1

[SW1-GigabitEthernet0/0/1]port link-type trunk

[SW1-GigabitEthernet0/0/1]port trunk allow-pass vlan 10 20 30

[SW1]interface GigabitEthernet0/0/2

[SW1-GigabitEthernet0/0/2]port link-type access

[SW1-GigabitEthernet0/0/2]port default vlan 10

[SW1]interface GigabitEthernet0/0/3

[SW1-GigabitEthernet0/0/3]port link-type access

[SW1-GigabitEthernet0/0/3]port default vlan 20

[SW1]interface GigabitEthernet0/0/4

[SW1-GigabitEthernet0/0/4]port link-type access

[SW1-GigabitEthernet0/0/4]port default vlan 30

[SW2]vlan batch 30 40 50

[SW2]int g0/0/2

[SW2-GigabitEthernet0/0/2]port link-type access

[SW2-GigabitEthernet0/0/2]port default vlan 40

[SW2]int g0/0/3

[SW2-GigabitEthernet0/0/3]port link-type access

[SW2-GigabitEthernet0/0/3]port default vlan 50

[SW2]int g0/0/1

[SW2-GigabitEthernet0/0/1]port link-type trunk

[SW2-GigabitEthernet0/0/1]port trunk allow-pass vlan 40 50

[SW3]vlan batch 60 70

[SW3]interface GigabitEthernet0/0/1

[SW3-GigabitEthernet0/0/1]port link-type trunk

[SW3-GigabitEthernet0/0/1]port trunk allow-pass vlan 60 70

[SW3]interface GigabitEthernet0/0/2

[SW3-GigabitEthernet0/0/2]port link-type access

[SW3-GigabitEthernet0/0/2]port default vlan 70

[SW3]interface GigabitEthernet0/0/3

[SW3-GigabitEthernet0/0/3]port link-type access

[SW3-GigabitEthernet0/0/3]port default vlan 60

[SW3]interface GigabitEthernet0/0/4

[SW3-GigabitEthernet0/0/4]port link-type access

[SW3-GigabitEthernet0/0/4]port default vlan 60

  1. DHCP协议配置

[R1]dhcp enable

[R1]ip pool vlan10

[R1-ip-pool-vlan10]network 172.16.64.0 mask 24

[R1-ip-pool-vlan10]gateway-list 172.16.64.1

[R1]ip pool vlan20

[R1-ip-pool-vlan20]network 172.16.65.0 mask 24

[R1-ip-pool-vlan20]gateway-list 172.16.65.1

[R1]interface GigabitEthernet0/0/1.1

[R1-GigabitEthernet0/0/1.1]dhcp select global

[R1]interface GigabitEthernet0/0/1.2

[R1-GigabitEthernet0/0/1.2]dhcp select global

[R2]dhcp enable

[R2]ip pool vlan40

[R2-ip-pool-vlan40]network 172.16.0.0 mask 24

[R2-ip-pool-vlan40]gateway-list 172.16.0.1

[R2]ip pool vlan50

[R2-ip-pool-vlan50]network 172.16.1.0 mask 24

[R2-ip-pool-vlan50]gateway-list 172.16.1.1

[R2]interface GigabitEthernet0/0/1.1

[R2-GigabitEthernet0/0/1.1]dhcp select global

[R2]interface GigabitEthernet0/0/1.2

[R2-GigabitEthernet0/0/1.2]dhcp select global

[R7]dhcp enable

[R7]ip pool vlan60

[R7-ip-pool-vlan60]network 172.16.128.0 mask 25

[R7-ip-pool-vlan60]gateway-list 172.16.128.1

[R7]ip pool vlan70

[R7-ip-pool-vlan70]network 172.16.128.128 mask 25

[R7-ip-pool-vlan70]gateway-list 172.16.128.129

[R7]interface GigabitEthernet0/0/2.1

[R7-GigabitEthernet0/0/2.1]dhcp select global

[R7]interface GigabitEthernet0/0/2.2

[R7-GigabitEthernet0/0/2.2]dhcp select global

  1. 测试地址获取情况

[图片上传失败...(image-2d049c-1761916469082)]

[图片上传失败...(image-da2a4e-1761916469082)]

  1. ospf协议配置

[R1]ospf 1 router-id 1.1.1.1

[R1-ospf-1]area 1

[R1-ospf-1-area-0.0.0.1]network 172.16.64.1 0.0.0.0

[R1-ospf-1-area-0.0.0.1]network 172.16.65.1 0.0.0.0

[R1-ospf-1-area-0.0.0.1]network 172.16.66.1 0.0.0.0

[R1-ospf-1-area-0.0.0.1]network 172.16.67.1 0.0.0.0

[R1-ospf-1]silent-interface g0/0/1.1

[R1-ospf-1]silent-interface g0/0/1.2

[R1-ospf-1]silent-interface g0/0/1.3

[R2]ospf 1 router-id 2.2.2.2

[R2-ospf-1]silent-interface g0/0/1.1

[R2-ospf-1]silent-interface g0/0/1.2

[R2-ospf-1]area 0

[R2-ospf-1-area-0.0.0.0]network 172.16.0.1 0.0.0.0

[R2-ospf-1-area-0.0.0.0]network 172.16.1.1 0.0.0.0

[R2-ospf-1-area-0.0.0.0]network 172.16.2.1 0.0.0.0

[R2-ospf-1]area 1

[R2-ospf-1-area-0.0.0.1]network 172.16.67.2 0.0.0.0

[R3]ospf 1 router-id 3.3.3.3

[R3-ospf-1]area 0

[R3-ospf-1-area-0.0.0.0]network 172.16.2.2 0.0.0.0

[R3-ospf-1-area-0.0.0.0]authentication-mode md5 1 cipher 123456

[R3-ospf-1]default-route-advertise always

  1. 进行area1 和area0的ping测试

PC4pingPC1

[图片上传失败...(image-f0c9e2-1761916469082)]

7.静态路由配置

[R3]ip route-static 172.16.128.0 255.255.255.0 172.16.129.2

[R3]Ip route-static 172.16.128.0 255.255.255.0 172.16.130.2 pre100

[R3]ip route-static 172.16.131.0 255.255.255.0 172.16.129.2

[R3]ip route-static 172.16.131.0 255.255.255.0 172.16.130.2 pre100

[R3]ip route-static 172.16.132.0 255.255.255.0 172.16.129.2

[R3]ip route-static 172.16.132.0 255.255.255.0 172.16.130.2 pre 100

[R3]ip route-static 172.16.133.0 255.255.255.0 172.16.129.2

[R3]ip route-static 172.16.133.0 255.255.255.0 172.16.130.2 pre 100

[R3]ip route-static 172.16.134.0 255.255.255.0 172.16.129.2

[R3]ip route-static 172.16.134.0 255.255.255.0 172.16.130.2 pre100

[R4]ip route-static 172.16.128.0 24 172.16.131.2

[R4]ip route-static 172.16.128.0 24 172.16.132.2

[R4]ip route-static 172.16.133.0 24 172.16.132.2

[R4]ip route-static 172.16.134.0 24 172.16.132.2

[R4]ip route-static 0.0.0.0 0.0.0.0 172.16.129.1

[R4]ip route-static 0.0.0.0 0.0.0.0 172.16.130.1 pre 100

[R5]ip route-static 172.16.128.0 24 172.16.133.2

[R5]ip route-static 172.16.132.0 24 172.16.133.2

[R5]ip route-static 172.16.132.0 24 172.16.129

[R6]ip route-static 172.16.133.0 24 172.16.134.2

[R6]ip route-static 172.16.128.0 24 172.16.134.2

[R6]ip route-static 0.0.0.0 0.0.0.0 172.16.132.1

[R7]ip route-static 0.0.0.0 0.0.0.0 172.16.133.1

[R7]ip route-static 0.0.0.0 0.0.0.0 172.16.134.1

[R7]ip route-static 172.16.128.0 255.255.255.0 NULL0

[R7]ip route-static 172.16.131.0 255.255.255.0 172.16.133.1

[R7]ip route-static 172.16.132.0 255.255.255.0 172.16.134.1

  1. 测试全网可达

PC5pingPC1和R5

[图片上传失败...(image-6c2c70-1761916469082)]

[图片上传失败...(image-c932a6-1761916469082)]

  1. 路由汇总和MD5认证

[R2]ospf 1

[R2-ospf-1]area 0

[R2-ospf-1-area-0.0.0.0]abr-summary 172.16.0.0 255.255.192.0

[R2-ospf-1-area-0.0.0.0]area 1

[R2-ospf-1-area-0.0.0.1]abr-summary 172.16.64.0 255.255.19

[R3]ospf 1

[R3-ospf-1]area 0

[R3-ospf-1-area-0.0.0.0]authentication-mode md5 1 cipher 123456

  1. ACL的配置

[R3]acl number 2000

[R3-acl-basic-2000]rule 5 permit source 172.16.0.0 0.0.255.255

[R3-acl-basic-2000]acl number 2001

[R3-acl-basic-2001]rule 5 deny source 172.16.0.0 0.0.0.255

[R3-acl-basic-2001]rule 10 deny source 172.16.1.0 0.0.0.255

[R3]int g0/0/0

[R3-GigabitEthernet0/0/0]traffic-filter inbound acl 2001

[R1]acl number 3000

[R1-acl-adv-3000]rule 5 deny ip source 172.16.64.254 0 destination 172.16.128.254 0

  1. ACL配置ping测试结果

[图片上传失败...(image-a32591-1761916469082)]

  1. NAT配置

[R3]int g0/0/2

[R3-GigabitEthernet0/0/2]nat server protocol tcp global current-interface telnet inside 172.16.66.254 telnet

  1. telent-server服务

[telnet-server]aaa

[telnet-server-aaa]local-user huawei privilege level 15passwordcipher123456

©著作权归作者所有,转载或内容合作请联系作者
【社区内容提示】社区部分内容疑似由AI辅助生成，浏览时请结合常识与多方信息审慎甄别。
平台声明：文章内容（如有图片或视频亦包括在内）由作者上传并发布，文章内容仅代表作者本人观点，简书系信息发布平台，仅提供信息存储服务。

相关阅读更多精彩内容

友情链接更多精彩内容