路由交换配置综合实验

1、实验二简单的路由交换配置综合实验一、实验目的1、掌握交换机的常规配置方法，包括接口、STP、VLAN与VLAN间路由、DHCP等。2、掌握路由器的常规配置方法，包括接口、路由、NAT、PPP、PPPoE、VPN、ACL等。二、实验学时4学时三、实验任务1、按图示网络拓扑，为各VLAN（私有地址）规划IP地址、子网掩码及网关，为各接口规范IP地址及子网掩码（与ISP相关的接口使用公网地址），并为这些接口配置IP地址。请列出相关规划与配置命令。总部：Vlan10为：192.168.10.0/24Vlan20为：192.168.20.0/24Vlan30为：192.168.30.0/24Vlan40

2、为：192.168.40.0/24分部：Vlan10为：10.10.10.0/24Vlan20为：10.10.20.0/24HeadGateint g0/0/1HeadGate-GigabitEthernet0/0/1ip add 123.123.123.1 24ISPint g0/0/1ISP-GigabitEthernet0/0/1ip add 123.123.123.2 24ISPint s1/0/0ISP-Serial1/0/0ip add 123.123.120.2 24PartGateint s1/0/0PartGate-Serial1/0/0ip add 123.123.120.

3、1 242、划分VLAN，并将交换机的相关接口分配给相应的VLAN。总部由交换机LSW1提供总部各VLAN间路由；分部由路由器分部Gate提供分部各VLAN间路由。请写出相关配置命令。LSW1vlan batch 10 20 30 40LSW1int e0/0/1LSW1-Ethernet0/0/1port link-type accessLSW1-Ethernet0/0/1port default vlan 10LSW1int e0/0/2LSW1-Ethernet0/0/1port link-type accessLSW1-Ethernet0/0/1port default vlan 20

4、LSW1int e0/0/3LSW1-Ethernet0/0/3port link-type accessLSW1-Ethernet0/0/3port default vlan 30LSW1int g0/0/1LSW1-GigabitEthernet0/0/1port link-type trunk LSW1-GigabitEthernet0/0/1port trunk allow-pass vlan 10 20 30 40HeadGate-GigabitEthernet0/0/0.1dot1q termination vid 10HeadGate-GigabitEthernet0/0/0.1

5、ip add 192.168.10.254 24 HeadGate-GigabitEthernet0/0/0.1arp broadcast enableHeadGate-GigabitEthernet0/0/0.2dot1q termination vid 20HeadGate-GigabitEthernet0/0/0.2ip add 192.168.20.254 24 HeadGate-GigabitEthernet0/0/0.2arp broadcast enableHeadGate-GigabitEthernet0/0/0.3dot1q termination vid 30HeadGat

6、e-GigabitEthernet0/0/0.3ip add 192.168.30.254 24 HeadGate-GigabitEthernet0/0/0.3arp broadcast enableHeadGate-GigabitEthernet0/0/0.4dot1q termination vid 40HeadGate-GigabitEthernet0/0/0.4ip add 192.168.40.254 24 HeadGate-GigabitEthernet0/0/0.4arp broadcast enableLSW2vlan batch 10 20LSW2int e0/0/1LSW2

7、-Ethernet0/0/1port link-type accessLSW2-Ethernet0/0/1port default vlan 10LSW2int e0/0/2LSW2-Ethernet0/0/1port link-type accessLSW2-Ethernet0/0/1port default vlan 20PartGate-GigabitEthernet0/0/0.1dot1q termination vid 10PartGate -GigabitEthernet0/0/0.1ip add 10.10.10.254 24 PartGate -GigabitEthernet0

8、/0/0.1arp broadcast enablePartGate -GigabitEthernet0/0/0.2dot1q termination vid 20PartGate -GigabitEthernet0/0/0.2ip add 10.10.20.254 24 PartGate -GigabitEthernet0/0/0.2arp broadcast enable3、在总部的LWS1交换机上为总部各VLAN的主机提供DHCP服务；在分部的路由器分部Gate上为分部各VLAN的主机提供DHCP服务。请写出相关配置命令。HeadGateip pool vlan10HeadGate-ip

9、-pool-vlan10gateway-list 192.168.10.254HeadGate-ip-pool-vlan10network 192.168.10.0 mask 255.255.255.0HeadGateip pool vlan20HeadGate-ip-pool-vlan20gateway-list 192.168.20.254HeadGate-ip-pool-vlan20network 192.168.20.0 mask 255.255.255.0HeadGateip pool vlan30HeadGate-ip-pool-vlan30gateway-list 192.168

10、.30.254HeadGate-ip-pool-vlan30network 192.168.30.0 mask 255.255.255.0HeadGatedhcp enableHeadGate -GigabitEthernet0/0/0.1dhcp select globalHeadGatedhcp enableHeadGate -GigabitEthernet0/0/0.2dhcp select globalHeadGatedhcp enableHeadGate -GigabitEthernet0/0/0.3dhcp select globalHeadGatedhcp enableHeadG

11、ate -GigabitEthernet0/0/0.4dhcp select globalPartGateip pool vlan10PartGate -ip-pool-vlan10gateway-list 10.10.10.254PartGate -ip-pool-vlan10network 10.10.10.0 mask 255.255.255.0PartGateip pool vlan20PartGate -ip-pool-vlan20gateway-list 10.10.10.254PartGate -ip-pool-vlan20network 10.10.10.0 mask 255.

12、255.255.0PartGatedhcp enablePartGate -GigabitEthernet0/0/0.1dhcp select globalPartGatedhcp enablePartGate -GigabitEthernet0/0/0.2dhcp select global4、在总部路由器上配置静态PAT，为总部各VLAN中的主机提供NAT服务；在分部路由器上提供Easy NAT，为分部中各VLAN中的主机提供NAT服务。请写出相关配置命令。HeadGateacl 2001HeadGate-acl-basic-2001rule 5 permit source 192.168

13、.10.0 0.0.0.255HeadGate-acl-basic-2001rule 10 permit source 192.168.20.0 0.0.0.255HeadGate-acl-basic-2001rule 15 permit source 192.168.30.0 0.0.0.255HeadGate-acl-basic-2001rule 20 permit source 192.168.40.0 0.0.0.255HeadGatenat address-group 1 123.123.123.5 123.123.123.9 HeadGate-Dialer1nat static g

14、lobal 123.123.123.10 inside 192.168.40.253PartGateacl 2001PartGate-acl-basic-2001rule permit source 10.10.10.0 0.0.0.255PartGate-acl-basic-2001rule permit source 10.10.20.0 0.0.0.255PartGate-acl-basic-2001int s1/0/0PartGate-Serial1/0/0nat outbound 20015、在各路由器上配置相关静态路由，实现总部各主机、分部各主机对ISP的访问。请写出相关配置命令。

15、ISPip route-static 123.123.123.0 27 Virtual-Template 1PartGateip route-static 0.0.0.0 0.0.0.0 s1/0/06、配置VPN，实现总部财务部门与分部财务部门之间的安全互访。请写出相关配置命令。HeadGateacl 3001HeadGate-acl-adv-3001rule permit ip source 192.168.20.0 0.0.0.255 destination 10.10.10.0 0.0.0.0HeadGate-acl-adv-3001rule permit ip source 192.

16、168.40.253 0 destination 10.10.10.0 0.0.0.255HeadGate-acl-adv-3001rule permit ip source 192.168.40.253 0 destination 10.10.20.0 0.0.0.255HeadGate-acl-adv-3001rule deny ip source any destination anyHeadGateipsec proposal prop12HeadGate-ipsec-proposal-prop12esp authentication-algorithm sha1HeadGate-ip

17、sec-proposal-prop12esp encryption-algorithm 3desHeadGateike peer head v2HeadGate-ike-peer-headpre-shared-key cipher qwe123HeadGate-ike-peer-headremote-address 123.123.120.1HeadGateipsec policy p123 123 isakmp HeadGate-ipsec-policy-isakmp-p123-123security acl 3001HeadGate-ipsec-policy-isakmp-p123-123

18、ike-peer headHeadGate-ipsec-policy-isakmp-p123-123proposal prop12HeadGateint g0/0/1HeadGate-GigabitEthernet0/0/1ipsec policy p123PartGateacl 3001PartGate-acl-adv-3001rule permit ip source 10.10.10.0 0.0.0.255 destination 192.168.20.0 0.0.0.255PartGate-acl-adv-3001rule permit ip source 10.10.10.0 0.0

19、.0.255 destination 192.168.40.253 0PartGate-acl-adv-3001rule permit ip sour10.0.0 0.0.0.255 destination 192.168.40.253 0PartGate-acl-adv-3001rule permit ip source 10.10.20.0 0.0.0.255 destination 192.168.40.253 0PartGate-acl-adv-3001rule deny ip source any destination anyPartGate-acl-adv-3001ipsec p

20、roposal prop21PartGate-ipsec-proposal-prop21esp authentication-algorithm sha1PartGate-ipsec-proposal-prop21esp encryption-algorithm 3desPartGateike peer branch v2PartGate-ike-peer-branchpre-shared-key cipher qwe123PartGateipsec policy-template pt123 123PartGate-ipsec-policy-templet-pt123-123ike-peer

21、 branchPartGate-ipsec-policy-templet-pt123-123proposal prop21PartGateipsec policy p123 123 isakmp template pt123PartGateint s1/0/0PartGate-Serial1/0/0ipsec policy p1237、分部与ISP之间采用PPP协议且使用chap认证。请写出相关配置命令。ISP-Serial1/0/0ppp authentication-mode chapISPaaaISP-aaalocal-user qweppp password cipher 123456

22、78ISP-aaalocal-user qweppp service-type pppPartGate-Serial1/0/0ppp chap user qwepppPartGate-Serial1/0/0ppp chap password cipher 123456788、（选做）部与ISP之间采用PPPoE协议且使用chap认证。请写出相关配置命令。ISPip pool pool1ISP-ip-pool-pool1network 202.193.80.0 mask 24ISP-ip-pool-pool1gateway-list 202.193.80.254ISPint Virtual-Template