项目三 大型双核心网络

1、 项目三 双核心网络【案例背景】 某高校随着学校教学和学生网上应用的增长，校园网以光纤连接了全校近 70 栋楼宇，覆盖了 90%的教学办公场所和 75%的学生宿舍。共布有 2 万多个网络端口，其中约 1.2 万多个布线端口连通了网络设备，共接入计算机 6 千多台，有固定注册用户约 6000 人。原有网络设备已经无法满足新环境下的网络应用，因此该校决定重新规划建设校园网。 【案例拓扑结构】 如图 3-1 所示网络拓扑是某高校双核心网络拓扑，具体的设备规划详见其上。图 3-1某高校双核心网络拓扑【需求分析】 需求 1：要能够达到轻载要求：低负载，高带宽，最简单，最有效； 分析 1：网络核心冗余，核

2、心到汇聚双链路备份。 需求 2：要具有先进的技术性：支持线速转发，具备高密度的万兆端口，核心设备支持 T 级以上的背板设计，硬件实现 ACL、QoS、组播等功能； 分析 2：核心交换机可选择 RG-S6800E 系列，以上功能可实现。 需求 3、要稳定、可靠：确保物理层、链路层、网络层、病毒环境下的稳定、可靠； 分析 3：要求各层设备能够有防病毒的功能，项目中所选设备均可通过配置防止病毒泛滥。需求 4：要有健壮的安全：不以牺牲网络性能为代价，实现病毒和攻击的防护、用户接入控制、 路由协议安全； 分析 4：核心交换机具有的 SPOH 功能，保证在实现防护病毒和攻击的情况下，核心交换机性能不受影响

3、，接入采用安全智能接入层交换机 RG-S2100 系列 需求 5：要易于管理：具备网络拓朴发现、网络设备集中统一管理、性能监视和预警、分类查看管理的能力； 分析 5：所有项目中设备均支持 SNMP，并通过锐捷 star-view软件进行整理。 【实验拓扑】 如图 3-2 所示网络拓扑是某高校双核心网络拓扑，根据其网络应用和功能在实验室中进行了网络环境的搭建，具体应用的设备和地址信息的规划详见其上。 图 3-2实验室中搭建的某高校双核心网络环境【地址规划】【实验设备】 出口设备：RG-WALL 100（或 1000） 1 台；设备 接口 IP 地址 6806E-AVLAN1014192.168.

4、128.45/29VLAN1016192.168.128.67/29F0/5192.168.128.1/296806E-BVLAN1024192.168.129.45/29VLAN1026192.168.129.67/29F0/5192.168.128.2/29VLAN30192.168.86.17/28 核心设备：S68 系列（或S65/S35 系列设备）2 台，配置千兆光纤接口 4 块；汇聚设备：S3550-24 2 台，每台配置 2 块千兆光纤接口；接入设备：S2126G 二层交换机 4 台；实验 PC：8 台；【实验步骤】 实验配置分为： 第一步：网络设备的基本配置； 第二步：OSPF

5、 配置及其测试； （以下配置默认在全局配置模式下进行）第一步 设备基本配置(1) S2150G-A1 基本配置hostname S2150G-A!交换机更名为 S2150G-A vlan 1!vlan 10vlan 20vlan 30interface range fastEthernet 0/1-10 switchport access vlan 10interface range fastEthernet 0/11-20 switchport access vlan 20interface range fastEthernet 0/21-30 switchport access vlan

6、30interface gigabitEthernet 1/1switchport mode trunk!创建 VLAN10!创建 VLAN20!创建 VLAN30!设置 110 号端口 ! 将其加入 VLAN10!设置 1120 号端口 !将其加入 VLAN20!设置 2130 号端口 !将其加入 VLAN30!配置 S2150G-A 的上连光纤模块! 将其配置为 TRUNK 模式 S2150G-B 与 S2150G-A 的配置内容基本相同，在此略过。(2) S3550-A 基本配置!version 1.0!hostname S3550-A vlan 1!vlan 10vlan 20!交换机

7、更名为 S3550-A!创建 VLAN10!创建 VLAN20 vlan 30interface FastEthernet 0/1 switchport mode trunk switchport trunk native vlan 4093 interface FastEthernet 0/2 switchport mode trunk switchport trunk native vlan 4093 interface FastEthernet 0/10 switchport mode trunk switchport trunk native vlan 4093!interface F

8、astEthernet 0/20 switchport mode trunk switchport trunk native vlan 4093!interface Vlan 10ip address 172.16.10.1 255.255.255.0interface Vlan 20ip address 172.16.20.1 255.255.255.0!interface Vlan 30ip address 172.16.30.1 255.255.255.0!interface Vlan 1014!创建 VLAN30!配置 1 号端口 !设置其运行模式为 trunk 模式!设置其nativ

9、e vlan 号为 4093!配置 2 号端口 !设置其运行模式为 trunk 模式设置其 native vlan 号为 4093!配置 10 号端口 !配置 20 号端口!配置 VLAN10!设置其 IP 地址!配置 VLAN20!配置 VLAN30!配置 VLAN1014ip address 192.168.128.44 255.255.255.248!interface Vlan 1024ip address 192.168.129.44 255.255.255.248!end!配置 VLAN1024S3550-A#ping 192.168.128.44/测试 VLAN1014 是否启用

10、Sending 5, 100-byte ICMP Echos to 192.168.128.44, timeout is 2000 milliseconds.!Success rate is 100 percent (5/5)Minimum = 1ms Maximum = 1ms, Average = 1msS3550-A#ping 192.168.129.44/测试 VLAN1024 是否启用Sending 5, 100-byte ICMP Echos to 192.168.129.44, timeout is 2000 milliseconds.! Success rate is 100

11、percent (5/5)Minimum = 1ms Maximum = 1ms, Average = 1msS3550-A#ping 172.16.10.1/测试 VLAN10是否启用Sending 5, 100-byte ICMP Echos to 172.16.10.1, timeout is 2000 milliseconds.!Success rate is 100 percent (5/5)Minimum = 1ms Maximum = 1ms, Average = 1msS3550-A#ping 172.16.20.1/测试 VLAN20是否启用Sending 5, 100-by

12、te ICMP Echos to 172.16.20.1, timeout is 2000 milliseconds.!Success rate is 100 percent (5/5)Minimum = 1ms Maximum = 1ms, Average = 1msS3550-A#ping 172.16.30.1/测试 VLAN30 是否启用Sending 5, 100-byte ICMP Echos to 172.16.30.1, timeout is 2000 milliseconds.!Success rate is 100 percent (5/5)Minimum = 1ms Ma

13、ximum = 1ms, Average = 1msS3550B 的配置基本相同，在此略过。 (3) S6810E-B 基本配置!version 1.0!hostname S6806E-B!交换机更名为 S6806E-Bvlan 1!interface FastEthernet 0/1!配置 1 号端口switchport mode trunk!设置运行模式为 trunk模式switchport trunk native vlan 4093!设置 native vlan 为 4093interface FastEthernet 0/2!配置 2 号端口 switchport mode trun

14、kswitchport trunk native vlan 4093!interface FastEthernet 0/5!配置 5 号端口no switchportip address 192.168.128.2 255.255.255.248!interface Vlan 1024!配置 VLAN1024ip address 192.168.129.45 255.255.255.248!interface Vlan 1026!配置 VLAN1026ip address 192.168.129.67 255.255.255.248!endS6806E-B#ping 192.168.128.2

15、/测试 5 号端口是否启用Sending 5, 100-byte ICMP Echos to 192.168.128.2,timeout is 2000 milliseconds.!Success rate is 100 percent (5/5)Minimum = 1ms Maximum = 1ms, Average = 1msS6806E-B#ping 192.168.129.45/测试 VLAN1024 是否启用Sending 5, 100-byte ICMP Echos to 192.168.129.45,timeout is 2000 milliseconds.!Success ra

16、te is 100 percent (5/5)Minimum = 1ms Maximum = 1ms, Average = 1msS6806E-B#ping 192.168.129.67/测试 VLAN1026 是否启用Sending 5, 100-byte ICMP Echos to 192.168.129.67,timeout is 2000 milliseconds. !Success rate is 100 percent (5/5)Minimum = 1ms Maximum = 1ms, Average = 1msS6810E-A 的配置基本相同，在此略过。第二步：设备 OSPF 配

17、置(1) S3550A 的路由配置interface Vlan 1024ip address 192.168.129.44 255.255.255.248ip ospf cost 100 router ospfarea 0.0.0.0! 设置此链路 OSPF 代价为 100!启用 OSPF 路由协议 !区域 0network 192.168.0.0 255.255.0.0 area 0.0.0.0netword 172.16.0.0 255.255.0.0 area 0.0.0.0!S3550B 的路由配置基本相同，在此略过。!公布本交换机的路由信息(2) S6806E-A 的路由配置inte

18、rface FastEthernet 0/5 no switchportip address 192.168.128.1 255.255.255.248ip ospf cost 1!interface Vlan 1016!设置 5 号端口的链路 OSPF 代价为 1ip address 192.168.128.67 255.255.255.248ip ospf cost 60!router ospf area 0.0.0.0!设置 VLAN1016 的链路 OSPF 代价为 60!启动 OSPF 路由协议!区域 0network 192.168.0.0 255.255.0.0 area 0.0

19、.0.0!（3）路由的测试 !公布本交换机的路由信息因为在核心 S6806E 上，基本都是直连路由，所以选择 S3550 进行路由的测试。S3550-A#ping 192.168.128.1/测试与 S6806E-A 的连通性Sending 5, 100-byte ICMP Echos to 192.168.128.1, timeout is 2000 milliseconds.!Success rate is 100 percent (5/5)Minimum = 1ms Maximum = 1ms, Average = 1msS3550-A#traceroute 192.168.128.1T

20、ype esc/CTRLc/CTRLz/q to abort./测试与 S6806E-A 的路由 13ms1ms1ms192.168.128.1Trace complete successfully.S3550-A#ping 192.168.129.67/测试与 S6806E-B 的连通性Sending 5, 100-byte ICMP Echos to 192.168.129.67, timeout is 2000 milliseconds.!Success rate is 100 percent (5/5)Minimum = 1ms Maximum = 1ms, Average = 1ms

21、S3550-A#traceroute 192.168.129.67Type esc/CTRLc/CTRLz/q to abort./测试与 S6806E-B 的路由123ms1ms1ms1ms1ms1ms192.168.128.45192.168.129.67Trace complete successfully.S3550-A#ping 172.18.50.1/测试与 S3550-B 的连通性Sending 5, 100-byte ICMP Echos to 172.18.50.1, timeout is 2000 milliseconds.!Success rate is 100 perc

22、ent (5/5)Minimum = 1ms Maximum = 1ms, Average = 1msS3550-A#traceroute 172.18.50.1Type esc/CTRLc/CTRLz/q to abort./测试与 S3550-B 的路由1231ms 1ms1ms1ms 1ms1ms1ms 1ms3ms192.168.128.45192.168.128.2172.18.50.1Trace complete successfully.从 S3550-B 同样进行一次全面的路由检查S3550-B#ping 192.168.128.2/测试与 S6806E-B 的连通性Sendi

23、ng 5, 100-byte ICMP Echos to 192.168.128.2, timeout is 2000 milliseconds.!Success rate is 100 percent (5/5)Minimum = 1ms Maximum = 1ms, Average = 1msS3550-B#traceroute 192.168.128.2Type esc/CTRLc/CTRLz/q to abort./测试与 S6806E-B 的路由13ms1ms1ms192.168.128.2Trace complete successfully.S3550-B#ping 192.16

24、8.128.45/测试与 S6806E-A 的连通性Sending 5, 100-byte ICMP Echos to 192.168.128.45, timeout is 2000 milliseconds.! Success rate is 100 percent (5/5)Minimum = 1ms Maximum = 2ms, Average = 1msS3550-B#traceroute 192.168.128.45Type esc/CTRLc/CTRLz/q to abort./测试与 S6806E-A 的路由121ms1ms1ms1ms1ms1ms192.168.129.6719

25、2.168.128.45Trace complete successfully.S3550-B#ping 172.16.10.1/测试与 S3550-A 的连通性Sending 5, 100-byte ICMP Echos to 172.16.10.1, timeout is 2000 milliseconds.!Success rate is 100 percent (5/5)Minimum = 1ms Maximum = 1ms, Average = 1msS3550-B#traceroute 172.16.10.1Type esc/CTRLc/CTRLz/q to abort./测试与

26、S3550-A 的路由1233ms 1ms1ms1ms 1ms1ms1ms 1ms1ms192.168.129.67192.168.128.1172.16.10.1Trace complete successfully. S3550-B#【问题与思考】 1、 为什么把 VLAN 作为三层接口，这样做的好处是什么？ 2、 为什么把端口配置为 TRUNK 模式，这样做的好处是什么？ 3、 【参考配置】 (1) S6806E-A 的配置S6806E-A#sh run Building configuration. Current configuration : 696 bytes ! version

27、 1.0 ! hostname S6806E-A vlan 1 ! enable secret level 1 5 $2H.Y*T3;C,tZV4H.41u_;C,tQ8U0D+S! interface FastEthernet 0/1 switchport mode trunk switchport trunk native vlan 4093 ! interface FastEthernet 0/2 switchport mode trunk switchport trunk native vlan 4093 ! interface FastEthernet 0/5 no switchpo

28、rt ip address 192.168.128.1 255.255.255.248 ip ospf cost 1 ! interface Vlan 1014 ip address 192.168.128.45 255.255.255.248! interface Vlan 1016 ip address 192.168.128.67 255.255.255.248ip ospf cost 60 ! router ospf area 0.0.0.0 0.0.0.0network 192.168.0.0 255.255.0.0 area! end (2) S6806E-B 的配置S6806E-

29、B#sh run Building configuration. Current configuration : 577 bytes ! version 1.0 ! hostname S6806E-B vlan 1 ! interface FastEthernet 0/1 switchport mode trunk switchport trunk native vlan 4093 ! interface FastEthernet 0/2 switchport mode trunk switchport trunk native vlan 4093 ! interface FastEthern

30、et 0/5 no switchport ip address 192.168.128.2 255.255.255.248 ip ospf cost 20 ! interface Vlan 1024 ip address 192.168.129.45 255.255.255.248ip ospf cost 50 ! interface Vlan 1026 ip address 192.168.129.67 255.255.255.248! router ospf area 0.0.0.0 network 192.168.0.0 255.255.0.0 area! end (3) S3550-A

31、 的配置S3550-A#sh run Building configuration. 0.0.0.0Current configuration : 1012! version 1.0 ! hostname S3550-A bytesvlan! vlan! vlan! vlan! 1102030interface FastEthernet 0/1 switchport mode trunk switchport trunk native vlan! interface FastEthernet 0/2 switchport mode trunk switchport trunk native v

32、lan! interface FastEthernet 0/10 switchport mode trunk switchport trunk native vlan! interface FastEthernet 0/20 switchport mode trunk switchport trunk native vlan! 4093409340934093 interface FastEthernet 0/24 switchport mode trunk ! interface Vlan 1 ip address 192.168.1.254 255.255.255.0! interface

33、 Vlan 10 ip address 172.16.10.1 255.255.255.0! interface Vlan 20 ip address 172.16.20.1 255.255.255.0! interface Vlan 30 255.255.255.0ip address 172.16.30.1! interface Vlan 1014 ip address 192.168.128.44 255.255.255.248! interface Vlan 1024 ip address 192.168.129.44 255.255.255.248 ip ospf cost 100

34、! router ospf area 0.0.0.0 network 172.16.0.0 255.255.0.0 area 0.0.0.0network 192.168.0.0 255.255.0.0 area! end (4) S3550-B 的配置S3550-B#sh run Building configuration. Current configuration : 1011 bytes ! version 1.0 ! hostname S3550-B 0.0.0.01vlan! vlan! vlan! vlan! 506070 interface FastEthernet 0/1

35、switchport mode trunk switchport trunk native vlan! interface FastEthernet 0/2 switchport mode trunk switchport trunk native vlan! interface FastEthernet 0/10 switchport mode trunk switchport trunk native vlan! interface FastEthernet 0/20 switchport mode trunk switchport trunk native vlan! interface

36、 FastEthernet 0/24 switchport mode trunk ! interface Vlan 1 4093409340934093ip address 192.168.2.254 255.255.255.0! interface Vlan 50 255.255.255.0ip address 172.18.50.1! interface Vlan 60 ip address 172.18.60.1! interface Vlan 70 ip address 172.18.70.1! interface Vlan 1016 255.255.255.0255.255.255.

37、0ip address 192.168.128.66 255.255.255.248 ip ospf cost 60 ! interface Vlan 1026 ip address 192.168.129.66 255.255.255.248 ! router ospf area 0.0.0.0 network 172.18.0.0 255.255.0.0 area 0.0.0.0 network 192.168.0.0 255.255.0.0 area 0.0.0.0! end (5) S2150G-A1 的配置S2150G-A#sh run Building configuration.

38、 Current configuration : 2083 bytes! version 1.0 ! hostname S2150G-Avlan! vlan! vlan! vlan! 1102030enable secret level 1 5 #E,1u_;Cq&-8U0H enable secret level 15 5 #/-aehq1dfimLqtbcknAq7zyglow! interface fastEthernet 0/1 switchport access vlan 10 ! interface fastEthernet 0/2 switchport access vlan 1

39、0 ! interface fastEthernet 0/3 switchport access vlan 10 ! interface fastEthernet 0/4 switchport access vlan 10 ! interface fastEthernet 0/5 switchport access vlan 10 ! interface fastEthernet 0/6 switchport access vlan 10 ! interface fastEthernet 0/7 switchport access vlan 10 ! interface fastEtherne

40、t 0/8 switchport access vlan 10 ! interface fastEthernet 0/9 switchport access vlan 10! interface fastEthernet 0/10 switchport access vlan 10! interface fastEthernet 0/11 switchport access vlan 20! interface fastEthernet 0/12 switchport access vlan 20! interface fastEthernet 0/13 switchport access v

41、lan 20! interface fastEthernet0/14switchport access vlan 20! interface fastEthernet 0/15 switchport access vlan 20! interface fastEthernet 0/16 switchport access vlan 20! interface fastEthernet 0/17 switchport access vlan 20! interface fastEthernet 0/18 switchport access vlan 20! interface fastEther

42、net 0/19 switchport access vlan 20! interface fastEthernet 0/20 switchport access vlan 20! interface fastEthernet 0/21 switchport access vlan 30! interface fastEthernet 0/22 switchport access vlan 30! interface fastEthernet 0/23switchport access vlan 30 ! interface fastEthernet 0/24 switchport acces

43、s vlan 30 ! interface fastEthernet 0/25 switchport access vlan 30 ! interface fastEthernet 0/26 switchport access vlan 30 ! interface fastEthernet 0/27 switchport access vlan 30 ! interface fastEthernet 0/28 switchport access vlan 30 ! interface fastEthernet 0/29 switchport access vlan 30 ! interfac

44、e fastEthernet 0/30 switchport access vlan 30 ! interface fastEthernet 0/48 switchport mode trunk ! interface Vlan 1 ip address 192.168.1.1 255.255.255.0 ! ip default-gateway 192.168.1.254 ! end S2150G-A# (6) S2150G-B1 的配置S2150G-B#sh run Building configuration. Current configuration : 2061 bytes ! v

45、ersion 1.0 ! hostname S2150G-B vlan 1 ip address 172.18.50.10 255.255.255.0! vlan 50 ! vlan 60 ! vlan 70 ! enable secret level 1 5 #E,1u_;Cq&-8U0H5 #/-aehq1dfimLqtbcknAq7zyglowenable secret level 15! interface fastEthernet 0/1 switchport access vlan 50! interface fastEthernet 0/2 switchport access vlan 50! interface fastEthernet 0/3 switchport access vlan 50! interface fastEthernet 0/4 switchport access vlan 50! interface fastEthernet 0/5 switchport access vlan 50!