经典路由器配置实例.doc

问题:某公司有三个部门，财务部、销售部以及市场部。搭建网络时候的要求是：财务部能够访问另外两个部门；另外两个部门能够互访但是不能访问财务部；实现所有的内部机器上网。公司现在有一台2621路由器、一台交换机、若干集线器。拓扑图:第一步 实现三个部门互访路由器的配置1.配置外网ipR1(config)#in s1/0R1(config-if)#ip add 202.88.88.88 255.255.255.0R1(config-if)#no shut%LINK-3-UPDOWN: Interface Serial1/0, changed state to upR1(config-if)#exi%LINK-3-UPDOWN: Interface Serial1/0, changed state to down%LINEPROTO-5-UPDOWN: Line protocol on Interface Serial1/0, changed state to down2.启用f0/0端口，启用3个子接口R1(config)#in f0/0R1(config-if)#no ip addR1(config-if)#no shut%LINK-3-UPDOWN: Interface FastEthernet0/0, changed state to upR1(config-if)#exiR1(config)#in f0/0.1R1(config-subif)#ip add 192.168.1.1 255.255.255.0R1(config-subif)#encapsulation dot1q 10R1(config-subif)#no shutR1(config-subif)#exiR1(config)#in f0/0.2R1(config-subif)#ip add 192.168.2.1 255.255.255.0R1(config-subif)#encapsulation dot1q 20R1(config-subif)#no shutR1(config-subif)#exiR1(config)#in f0/0.3R1(config-subif)#ip add 192.168.3.1 255.255.255.0R1(config-subif)#encapsulation dot1q 30R1(config-subif)#no shutR1(config-subif)#exi交换机的配置1.在与路由器连接的f0/12口开启trunkSwitch#Switch#conf tEnter configuration commands, one per line. End with CNTL/Z.Switch(config)#in f0/12Switch(config-if)#switchport mode trunkSwitch(config-if)#exiSwitch(config)#exiSwitch#sh run!interface FastEthernet0/12switchport mode trunkbackup interface no fair-queue!2.划分vlanSwitch#vlan database Switch(vlan)#vlan 10 name shichangbuVLAN 10 added:Name:shichangbuSwitch(vlan)#vlan 20 name xiaoshoubuVLAN 20 added:Name:xiaoshoubuSwitch(vlan)#vlan 30 name caiwubuVLAN 30 added:Name:caiwubuSwitch(vlan)#exiAPPLY completed.Exiting.3.将端口加入vlanSwitch#conf tEnter configuration commands, one per line. End with CNTL/Z.Switch(config)#in range f0/1 - 3Switch(config-range)#switchport mode access Switch(config-range)#switchport access vlan 10Switch(config-range)#exiSwitch(config)#in range f0/4 - 6Switch(config-range)#switchport mode access Switch(config-range)#switchport access vlan 20Switch(config-range)#exiSwitch(config)#in range f0/7 - 9Switch(config-range)#switchport mode access Switch(config-range)#switchport access vlan 30Switch(config-range)#exi将各部门的计算机的ip和网关设置好以后，便可以互访了。第二步 做ACL拒绝市场部和销售部访问财务部R1(config)#access-list 101 deny ip 192.168.2.0 0.0.0.255 192.168.3.0 0.0.0.255R1(config)#access-list 101 deny ip 192.168.1.0 0.0.0.255 192.168.3.0 0.0.0.255R1(config)#access-list 101 permit ip any any R1(config)#in f0/0.3R1(config-subif)#ip access-group 101 in R1(config-subif)#exiR1(config)#exi第三步 利用NAT的PAT技术让内部计算机上网R1(config)#access-list 1 permit 192.168.1.0 0.0.0.255R1(config)#access-list 1 permit 192.168.2.0 0.0.0.255R1(config)#access-list 1 permit 192.168.3.0 0.0.0.255R1(config)#ip nat inside source list 1 interface s1/0 overloadR1(config)#in f0/0R1(config-if)#ip nat inside R1(config-if)#exiR1(config)#in s1/0R1(config-if)#ip nat outsideR1(config-if)#exiR1(config)#exi第一步 实现三个部门互访路由器的配置1.配置外网ipR1(config)#in s1/0R1(config-if)#ip add 202.88.88.88 255.255.255.0R1(config-if)#no shut%LINK-3-UPDOWN: Interface Serial1/0, changed state to upR1(config-if)#exi%LINK-3-UPDOWN: Interface Serial1/0, changed state to down%LINEPROTO-5-UPDOWN: Line protocol on Interface Serial1/0, changed state to down2.启用f0/0端口，启用3个子接口R1(config)#in f0/0R1(config-if)#no ip addR1(config-if)#no shut%LINK-3-UPDOWN: Interface FastEthernet0/0, changed state to upR1(config-if)#exiR1(config)#in f0/0.1R1(config-subif)#ip add 192.168.1.1 255.255.255.0R1(config-subif)#encapsulation dot1q 10R1(config-subif)#no shutR1(config-subif)#exiR1(config)#in f0/0.2R1(config-subif)#ip add 192.168.2.1 255.255.255.0R1(config-subif)#encapsulation dot1q 20R1(config-subif)#no shutR1(config-subif)#exiR1(config)#in f0/0.3R1(config-subif)#ip add 192.168.3.1 255.255.255.0R1(config-subif)#encapsulation dot1q 30R1(config-subif)#no shutR1(config-subif)#exi交换机的配置1.在与路由器连接的f0/12口开启trunkSwitch#Switch#conf tEnter configuration commands, one per line. End with CNTL/Z.Switch(config)#in f0/12Switch(config-if)#switchport mode trunkSwitch(config-if)#exiSwitch(config)#exiSwitch#sh run!interface FastEthernet0/12switchport mode trunkbackup interface no fair-queue!2.划分vlanSwitch#vlan database Switch(vlan)#vlan 10 name shichangbuVLAN 10 added:Name:shichangbuSwitch(vlan)#vlan 20 name xiaoshoubuVLAN 20 added:Name:xiaoshoubuSwitch(vlan)#vlan 30 name caiwubuVLAN 30 added:Name:caiwubuSwitch(vlan)#exiAPPLY completed.Exiting.3.将端口加入vlanSwitch#conf tEnter configuration commands, one per line. End with CNTL/Z.Switch(config)#in range f0/1 - 3Switch(config-range)#switchport mode access Switch(config-range)#switchport access vlan 10Switch(config-range)#exiSwitch(config)#in range f0/4 - 6Switch(config-range)#switchport mode access Switch(config-range)#switchport access vlan 20Switch(config-range)#exiSwitch(config)#in range f0/7 - 9Switch(config-range)#switchport mode access Switch(config-range)#switchport access vlan 30Switch(config-range)#exi将各部门的计算机的ip和网关设置好以后，便可以互访了。第二步 做ACL拒绝市场部和销售部访问财务部R1(config)#access-list 101 deny ip 192.168.2.0 0.0.0.255 192.168.3.0 0.0.0.255R1(config)#access-list 101 deny ip 192.168.1.0 0.0.0.255 192.168.3.0 0.0.0.255R1(config)#access-list 101 permit ip any any R1(config)#in f0/0.3R1(config-subif)#ip access-group 101 in R1(config-subif)#exiR1(config)#exi第三步 利用NAT的PAT技术让内部计算机上网R1(config)#access-list 1 permit 192.168.1.0 0.0.0.255R1(config)#access-list 1 per