大型企业网络配置实验报告完整版

实用文档网络配置实验报告一实验名称 3二网络实验功能： 3三网络实验设备： 3四网络实验环境： 34.1功能设备使用类型： 34.2实验网络拓扑示意图： 4五网络配置： 45.1IP统筹规划 45.2VLAN配置 45.3NAT转换以及路由配置 65.5VPN配置 85.6安全配置 8六配置验证： 86.1基本路由测试 86.2VLAN验证 96.3NAT验证 106.4ACL访问控制验证 106.5VPN验证 11七心得体会： 11

一实验名称：大型企业网络设计模拟实验二网络实验功能：面对日益突出的信息安全问题，要求系统集成的安全特性已经相当高。对此，我们在保留企业的现有投资的基础上，我们提供了一个全新的三层架构的网络，将原来的二层网络纳入汇聚层。新网络功能以及设计注意的问题应该如下：1新网络能与现有网络兼容；实现三层架构的网络；2统筹IP规划；3实现按职能划分VLAN；4实现访问控制，以保护内部安全；5实现NAT转换，以及WEB,FTP的固定IP地址映射；6远程网络VPN的接入设计；7网络安全防护，如蠕虫的防护，DOS攻击的防护。三网络实验设备：锐捷S-S2126S两台锐捷RG-S3550-24一台锐捷RG-S3760-24一台锐捷RG-R1700Server一台四网络实验环境：4.1功能设备使用类型：核心层：锐捷RG-S3760-24汇聚层：锐捷RG-S3550-24接入层：锐捷S-S2126S出口路由：锐捷RG-R1700Server4.2实验网络拓扑示意图：五网络配置：5.1IP统筹规划在本实验中，我们内部网络使用了NAT转换。对外我们使用一个（）出口地址。汇聚层到核心层，使用/24；接入层到会聚层，以及用户到接入层，按需使用；实验中我们一共使用四个网络（分别属于不同的VLAN）/24，/24，/24，/24；5.2VLAN配置第一台s2126s上的vlan配置hostnameA//交换机命名vlan1//创建VLANnamevlan1vlan2namevlan2intrangefastethernet0/13-24//进入VLAN配置端口switchportaccessvlan2switchportaccessvlan2//设计端口的VLANinterfacevlan1ipaddress//设计网络段interfacevlan2ipaddressend第二台s2126s上的vlan配置hostnameB//同上vlan3//同上namevlan3vlan4namevlan3intrangefastethernet0/2-12//同上switchportaccessvlan3switchportaccessvlan3//同上intrangefastethernet0/13-24//同上switchportaccessvlan4switchportaccessvlan4//同上interfacevlan3ipaddressinterfacevlan4ipaddressend3550上的VLAN配置l3switch(config)#intf0/1//进入端口2006-12-1608:31:11@5-CONFIG:Configuredfromoutbandl3switch(config-if)#switchportmodetrunk//设置trunk模式2006-12-1608:31:32@5-CONFIG:Configuredfromoutbandl3switch(config-if)#switchporttrunkallowedvlanall//设置允许VLAN2006-12-1608:31:46@5-CONFIG:Configuredfromoutbandl3switch(config-if)#exit2006-12-1608:31:50@5-CONFIG:Configuredfromoutbandl3switch(config)#intf0/2//进入端口2006-12-1608:31:54@5-CONFIG:Configuredfromoutbandl3switch(config-if)#switchportmodetrunk//设置trunk模式2006-12-1608:32:02@5-CONFIG:Configuredfromoutbandl3switch(config-if)#switchporttrunkallowedvlanall//设置允许VLAN2006-12-1608:32:09@5-CONFIG:Configuredfromoutbandl3switch(config-if)#end2006-12-1608:32:14@5-CONFIG:Configuredfromoutbandl3switch#showvlanhostnameS3550vlan1namevlan1vlan2namevlan2vlan3namevlan3vlan4namevlan4interfaceFastEthernet0/1switchportmodetrunkinterfaceFastEthernet0/2switchportmodetrunkinterfaceFastEthernet0/3noswitchport//起用三层路由端口ipaddressinterfaceVlan1//设置网关ipaddressinterfaceVlan2ipaddressinterfaceVlan3ipaddressinterfaceVlan4ipaddressrouterospf//起用OSPF路由协议areanetworkareanetworkareanetworkareanetworkareanetworkareaend5.3NAT转换以及路由配置1700A的基本配置：hostnameR1700Ainterfacefa1/0ipaddress//设置端口IPipnatinside//起用NATnoshutdowninterfacefa1/1ipaddress//同上ipnatoutsidenoshutdown路由协议配置iprouting//起用路由routerospfnetwork55area4network55area0NAT转换配置ipnatpoolnet20netmasktyperotaryipnatpoolnet30netmasktyperotaryipnatinsidesourcelist1poolnet20ipnatinsidesourcelist2poolnet30access-list1permit55access-list2permit55策略路由配置access-list101permitanygt1024anyeqwww//访问控制列表控制access-list101permitanygt1024anyeqftproute-mappmappermitmatchipaddress101setdefaultinterfacefa1/0interfacefa1/1ippolicyroute-mappmap5.4ACL访问控制配置acl实施：网络为财务部网络为股东实施规则：禁止其他网段访问财务部允许股东网段访问财务部实施命令：在S3550上##制定访问控制列表ipaccess-liststandarddeny-4deny55permitany##在SVI接口上实施intvlan2ipaccess-groupdeny-4inintvlan3ipaccess-groupdeny-4in5.5VPN配置由于实验不作要求，暂且先不配置。5.6安全配置在3550实施安全控制：intf0/3防止广播风暴storm-controlbroadcast防止未知名地址风暴storm-controlunicast防止多播storm-controlmulticast指定级数storm-controllevel20六配置验证：6.1基本路由测试名称测试version8.4(building15)hostnameR1700A!IP地址配置测试interfaceFastEthernet1/0ipnatinsideipaddressduplexautospeedauto!interfaceFastEthernet1/1ipnatoutsideipaddressduplexautospeedautoOSPF协议测试routerospfnetwork55areanetwork55area!access-list测试access-list1permit55access-list2permit55access-list101permittcpanygt1024anyeqwwwaccess-list101permittcpanygt1024anyeqftp!策略路由测试R1700A(config)#showroute-mappmaproute-mappmap,permit,sequence10Matchclauses:ipaddress101Setclauses:defaultinterfaceFastEthernet1/0Policyroutingmatches:0packets,0bytes!内网到外网的测试：C:\DocumentsandSettings\Administrator>pingPingingwith32bytesofdata:Replyfrom:bytes=32time<1msTTL=62Replyfrom:bytes=32time<1msTTL=62Replyfrom:bytes=32time<1msTTL=62Replyfrom:bytes=32time<1msTTL=626.2VLAN验证第一台s2126s上的vlan验证1vlan1activeFa0/1,Fa0/2,Fa0/3Fa0/4,Fa0/5,Fa0/6Fa0/7,Fa0/8,Fa0/9Fa0/10,Fa0/11,Fa0/122vlan2activeFa0/1,Fa0/13,Fa0/14Fa0/15,Fa0/16,Fa0/17Fa0/18,Fa0/19,Fa0/20Fa0/21,Fa0/22,Fa0/23Fa0/24第二台s2126s上的vlan验证1vlan3activeFa0/1,Fa0/2,Fa0/3Fa0/4,Fa0/5,Fa0/6Fa0/7,Fa0/8,Fa0/9Fa0/10,Fa0/11,Fa0/122vlan4activeFa0/1,Fa0/13,Fa0/14Fa0/15,Fa0/16,Fa0/17Fa0/18,Fa0/19,Fa0/20Fa0/21,Fa0/22,Fa0/23Fa0/243350的vlan验证S3550#showvlanVLANNameStatusPorts1vlan1activeFa0/1,Fa0/2,Fa0/4,Fa0/5Fa0/6,Fa0/7,Fa0/8,Fa0/9Fa0/10,Fa0/11,Fa0/12,Fa0/13Fa0/14,Fa0/15,Fa0/16,Fa0/17Fa0/18,Fa0/19,Fa0/20,Fa0/21Fa0/22,Fa0/23,Fa0/242vlan2activeFa0/1,Fa0/23vlan3activeFa0/1,Fa0/24vlan4activeFa0/1,Fa0/26.3NAT验证NAT转换结果显示ipnatpoolnet20netmasktyperotaryipnatpoolnet30netmasktyperotaryipnatinsidesourcelist1poolnet20ipnatinsidesourcelist2poolnet30access-list1p