校园网搭建方案.doc

校园网搭建方案条件：60名教师分为办公组(bg)、信息技术组(xx)和综合组(zh)三个工作部门，三间办公室，每间办公室混坐三个部门的人；另有两个64座机房。需求：按组和机房分5个子网，所有用户均登录外网，办公组除本组相互通信外，拒绝其他用户访问；学生机只能访问本子网内用户，其它用户均能相互通信。设备选购：1、出口路由器1台；2、二层交换机3台；3、三层交换机1台。具体设置步骤：一、连接设备，标记端口。二、设置计算机IP地址。tsw1、tsw2、tsw3的2-15、16-20和21-24端口分别分配给办公组(vlen2)、信息组(vlan3)和综合组(vlan4)。三、出口路由器的设置1、设置端口方向enconf thost outint f0/1ip nat outside int f0/0ip nat inside 2、编写所有用户上外网ACLexaccess-list 1 permit host 192.168.5.253access-list 1 permit host 192.168.6.253access-list 1 deny 192.168.5.0 0.0.0.255access-list 1 deny 192.168.6.0 0.0.0.255access-list 1 permit any3、编写动态IP地址池ip nat pool aaa 202.101.97.8 202.101.97.8 netmask 255.255.255.04、设置端口映射ip nat inside source list 1 pool aaa overload5、设置缺省路由ip route 0.0.0.0 0.0.0.0 f0/1 6、设置返回内网的静态路由ip route 192.168.2.0 255.255.255.0 f0/0ip route 192.168.3.0 255.255.255.0 f0/0ip route 192.168.4.0 255.255.255.0 f0/0ip route 192.168.5.0 255.255.255.0 f0/0ip route 192.168.6.0 255.255.255.0 f0/0四、三层交换机设置（一）出口IP地址设置enconf thost serverint f0/1no switchport ip add 192.168.1.8 255.255.255.0no sh（二）设置VTP1、设置f0/2至f0/6为trunkexint range f0/2 - 6switchport mode trunk2、设置VTP的modeexvtp mode server 3、设置VTP的DOMAINvtp domain abc4、创建VLANvlan 2vlan 3vlan 4vlan 5vlan 6（三）设置VLAN的IP地址1、启用路由功能exip routing 2、设置VLAN的IPint vlan 2ip add 192.168.2.254 255.255.255.0no shint vlan 3ip add 192.168.3.254 255.255.255.0no shint vlan 4ip add 192.168.4.254 255.255.255.0no shint vlan 5ip add 192.168.5.254 255.255.255.0no shint vlan 6ip add 192.168.6.254 255.255.255.0no sh（四）设置缺省路由exip route 0.0.0.0 0.0.0.0 f0/1（五）编写ACL协议access-list 2 deny 192.168.3.0 0.0.0.255access-list 2 deny 192.168.4.0 0.0.0.255access-list 2 deny 192.168.5.0 0.0.0.255access-list 2 deny 192.168.6.0 0.0.0.255access-list 2 permit anyaccess-list 34 permit host 192.168.5.253access-list 34 permit host 192.168.6.253access-list 34 deny 192.168.5.0 0.0.0.255access-list 34 deny 192.168.6.0 0.0.0.255access-list 34 permit anyaccess-list 5 permit host 192.168.6.253access-list 5 deny 192.168.6.0 0.0.0.255access-list 5 permit anyaccess-list 6 permit host 192.168.5.253access-list 6 deny 192.168.5.0 0.0.0.255access-list 6 permit any（六）绑定到相应的端口int vlan 2ip access-group 2 inip access-group 2 outint vlan 3ip access-group 34 inip access-group 34 outint vlan 4ip access-group 34 inip access-group 34 outint vlan 5ip access-group 5 inip access-group 5 outint vlan 6ip access-group 6 inip access-group 6 out五、交换机设置（一）tsw1设置1、设置模式与域名en conf thost tsw1vtp mode clientvtp domain abc2、设置VLAN端口int range f0/2 - 15sw mo accsw acc vlan 2int range f0/16 - 20sw mo accsw acc vlan 3int range f0/21 - 24sw mo accsw acc vlan 4（二）tsw2设置1、设置模式与域名en conf thost tsw2vtp mode clientvtp domain abc2、设置VLAN端口int range f0/2 - 15sw mo accsw acc vlan 2int range f0/16 - 20sw mo accsw acc vlan 3int range f0/21 - 24sw mo accsw acc vlan 4（三）tsw3设置1、设置模式与域名en conf thost tsw3vtp mode clientvtp domain abc2、设置VLAN端口int range f0/2 - 15sw mo accsw acc vlan 2int range f0/16 - 20sw mo accsw acc vlan 3int range f0/21 - 24sw mo accsw acc vlan 4（四）fsw11交换机的设置1、设置模式与域名en conf thost fsw11vtp mode clientvtp domain abc2、设置VLAN端口int range f0/3 - 24sw mo accsw acc vlan 5int range f0/1 - 2sw mo trunk（五）fsw12交换机的设置1、设置模式与域名en conf thost fsw12vtp mode clientvtp domain abc2、设置VLAN端口int range f0/3 - 24sw mo accsw acc vlan 5int range f0/1 - 2sw mo trunk（六）fsw13交换机的设置1、设置模式与域名en conf thost fsw13vtp mode clientvtp domain abc2、设置VLAN端口int range f0/2 - 24sw mo accsw acc vlan 5int f0/1sw mo trunk（七）fsw21交换机的设置1、设置模式与域名en conf thost fsw21vtp mode clientvtp domain abc2、设置VLAN端口int range f0/3 - 24sw mo accsw acc vlan 6int range f0/1 - 2sw mo trunk（八）fsw22交换机的设置1、设置模式与域名en conf thost fsw22vtp mode clientvtp domain abc2、设置VLAN端口int range f0/3 - 2