数据网组建与维护 项目7 安全有效接入互联网-项目实施

表7-3中。表STYLEREF1\s7SEQ表\*ARABIC\s13三层设备和终端的接口IP地址分配表(规划IP不是唯一的)设备节点接口名称IP地址子网掩码PC1Ethernet0/0/1PC2Ethernet0/0/1PC3Ethernet0/0/1PC4Ethernet0/0/1PC5Ethernet0/0/1Server1Ethernet0/0/0Server2Ethernet0/0/0Client1Ethernet0/0/0LSW1VLAN10VLAN20VLAN30VLAN40LSW2VLAN60VLAN70VLAN80AR1GE0/0/0GE0/0/1GE2/0/0GE2/0/1AR2GE0/0/0GE0/0/1AR3GE0/0/0GE0/0/3.设备配置。（1）LSW1接口IP与路由配置。<Huawei>undoterminalmonitor--关闭终端监控<Huawei>system-view[Huawei]sysnameLSW1--命名为LSW1[LSW1]vlanbatch10203040--批量创建VLAN[LSW1]intg0/0/1[LSW1-GigabitEthernet0/0/1]portlinkaccess[LSW1-GigabitEthernet0/0/1]portdefaultvlan10--接口GE0/0/1划分到VLAN10[LSW1-GigabitEthernet0/0/1]intg0/0/2[LSW1-GigabitEthernet0/0/2]portlinkaccess[LSW1-GigabitEthernet0/0/2]portdefaultvlan20--接口GE0/0/2划分到VLAN20[LSW1-GigabitEthernet0/0/2]intg0/0/3[LSW1-GigabitEthernet0/0/3]portlinkaccess[LSW1-GigabitEthernet0/0/3]portdefaultvlan30--接口GE0/0/3划分到VLAN30[LSW1-GigabitEthernet0/0/3]intg0/0/4[LSW1-GigabitEthernet0/0/4]portlinkaccess[LSW1-GigabitEthernet0/0/4]portdefaultvlan40--接口GE0/0/4划分到VLAN40[LSW1]intvlan10[LSW1-Vlanif10]ipaddress24--VLAN10接口配置IP地址[LSW1-Vlanif10]intvlan20[LSW1-Vlanif20]ipaddress24--VLAN10接口配置IP地址[LSW1-Vlanif20]intvlan30[LSW1-Vlanif30]ipaddress--VLAN30接口配置IP地址[LSW1-Vlanif30]intvlan40[LSW1-Vlanif40]ipaddress--VLAN40接口配置IP地址[LSW1-Vlanif40]quit[LSW1]iproute-static--配置1条默认路由（2）LSW2的接口IP与路由配置。<Huawei>undoterminalmonitor<Huawei>system-view[Huawei]sysnameLSW2[LSW2]vlanbatch607080--批量创建VLAN[LSW2]intg0/0/1[LSW2-GigabitEthernet0/0/1]portlinkaccess[LSW2-GigabitEthernet0/0/1]portdefaultvlan80--接口GE0/0/1划分到VLAN80[LSW2-GigabitEthernet0/0/1]intg0/0/2[LSW2-GigabitEthernet0/0/2]portlinkaccess[LSW2-GigabitEthernet0/0/2]portdefaultvlan60--接口GE0/0/2划分到VLAN60[LSW2-GigabitEthernet0/0/2]intg0/0/3[LSW2-GigabitEthernet0/0/3]portlinkaccess[LSW2-GigabitEthernet0/0/3]portdefaultvlan70--接口GE0/0/3划分到VLAN70[LSW2-GigabitEthernet0/0/3]quit[LSW2]intvlan60[LSW2-Vlanif60]ipaddress--VLAN60接口配置IP地址[LSW2-Vlanif60]intvlan70[LSW2-Vlanif70]ipaddress--VLAN70接口配置IP地址[LSW2-Vlanif70]intvlan80[LSW2-Vlanif80]ipaddress--VLAN80接口配置IP地址[LSW2-Vlanif80]quit[LSW2]iproute-static--配置1条默认路由（3）AR1接口IP和路由配置。<Huawei>undoterminalmonitor<Huawei>sy[Huawei]syAR1[AR1]intg0/0/0[AR1-GigabitEthernet0/0/0]ipaddress--GE0/0/0接口配置IP地址[AR1-GigabitEthernet0/0/0]intg0/0/1[AR1-GigabitEthernet0/0/1]ipaddress--GE0/0/1接口配置IP地址[AR1-GigabitEthernet0/0/1]intg2/0/0[AR1-GigabitEthernet2/0/0]ipaddress--GE2/0/0接口配置IP地址[AR1-GigabitEthernet2/0/0]intg2/0/1[AR1-GigabitEthernet2/0/1]ipaddress--GE2/0/1接口配置IP地址[AR1-GigabitEthernet2/0/1]quit[AR1]iproute-static16[AR1]iproute-static16[AR1]iproute-static--AR1的静态路由设置（4）AR2接口IP和路由配置。<Huawei>undoterminalmonitor<Huawei>sy[Huawei]syAR2[AR2]intg0/0/0[AR2-GigabitEthernet0/0/0]ipaddress--GE0/0/0接口配置IP地址[AR2-GigabitEthernet0/0/0]intg0/0/1[AR2-GigabitEthernet0/0/1]ipaddress--GE0/0/1接口配置IP地址[AR2-GigabitEthernet0/0/1]quit[AR2]iproute-static[AR2]iproute-static--AR2的静态路由设置（5）AR3接口IP配置。<Huawei>undoterminalmonitor<Huawei>sy [Huawei]syAR3[AR3]intg0/0/0[AR3-GigabitEthernet0/0/0]ipaddress--GE0/0/0接口配置IP地址[AR3-GigabitEthernet0/0/0]intg0/0/1[AR3-GigabitEthernet0/0/1]ipaddress--GE0/0/1接口配置IP地址[AR3-GigabitEthernet0/0/1]q接下来会配置ACL和NAT，所以互联网路由器AR3上不需要配置路由。（6）AR1的ACL设置。[AR1]time-rangeworking-time08:00to17:00working-day[AR1]ACL2000[AR1-acl-basic-2000]rule5denysource55--拒绝财务部网段访问Internet终端[AR1-acl-basic-2000]rule10permitsource55time-rangeworking-time--允许分公司的PC4和PC5在工作时间可以ping通Internet终端[AR1-acl-basic-2000]rule15permitsource55[AR1-acl-basic-2000]rule20permitsource55[AR1-acl-basic-2000]rule25permitsource55[AR1-acl-basic-2000]rule30deny[AR1-acl-basic-2000]quit（7）