Cisco组建中小型企业网络实例

1、3、VTP信息组建中小型网络xni/k/i p 1訟仔2询h gg如 JFliM3;"I " J1W vLn 2 轴堆舟1 C4 22OO-MMI)jiyJUJDUI1心广丁為“IMblCL轨： 坤P琏时同梟止Ji iW mtrat阳补I二2绢挨中駅膚国翻虫玄啣車弘勦t询Hft陀郎X酣召研符品恤I实趾岭譲和仏昭皆删曲单闻访月 1.汨卄川BI实凰甘也加理、厘蜩甬单胃苗薛4 ft if :,畑|*亠!-邙 VLIII>1 1 ulmA出诵削命希<Vian ID网络地址名称描述1、Vian信息172.16.10.0/24无本地via n2172.16.20.0/24y

2、fzx研发中心3172.16.30.0/24zbb质保部4172.16.40.0/24zzb制造部5172.16.50.0/24sbb设备部6172.16.60.0/24cgb采购部7172.16.70.0/24xsb销售部8172.16.80.0/24cwb财务部9172.16.90.0/24gib管理部100172.16.100.0/24zjb总经办设备名称Domai nPrunningPasswordMode3550-S-1vtplEn able123Server2950-S-1vtplEn able123Clie nt2950-S-2vtplEn able123Clie nt2950-

3、S-3vtplEn able123Clie nt2950-S-4vtplEn able123Clie nt3、设备IP 地址分配设备名称接口IP地址描述2600-R-1F0/0221.215.31.129/29WANF0/1192.168.1.1/24-3550-S-1F0/1192.168.1.2/243L-Switch交换机、路由器详细配置1 IP地址设置2600-R-1 (config) # int F0/02600-R-1 (config-if) #ip add221.215.31.129 255.255.255.0 2600-R-1 (con fig-if) #no shutdow

4、n2600-R-1 (config-if) # int F0/12600-R-1 (con fig-if) #ip add192.168.1.1 255.255.255.02600-R-1 (con fig-if) #no shutdow n3550-S-1 (co nfig) # int F0/13550-S-1 (config-f) # no switchport 路由端口3550-S-1 (co nfig-if) # ip add192.168.1.2 255.255.255.03550-S-1 (config) # int vian 1管理vlarr.3550-S-1 (con fig

5、-if) # ip add172.16.10.1 255.255.255.0 3550-S-1 (con fig-f) # in t vlan 2研发中心3550-S-1 (con fig-if) # ip add172.16.20.1 255.255.255.03550-S-1(config if)3550-S-1(config ifj3550-S-1(config if)3550-S-1(config-if)3550-S-1(config if)3550-S-1(config if)3550-S-1(config if)3550-S-1(config if)3550-S-1(config

6、if)3550-S-1(config if)3550-S-1(config if)3550-S-1(config if)3550-S-1(config if)3550-S-1(config-if)3550-S-1(config if)(c on3550-S-1fig-if)中部部部部 剪发保造备购 修研质制设采in t vlan 3质保部ip add 172.16.30.1 255.255.255.0 in t vlan 4制造部ip add 172.16.40.1 255.255.255.0 int via n 5 设备部ip add 172.16.50.1 255.255.255.0 in

7、 t vlan 6采购部ip add 172.16.60.1 255.255.255.0 in t vlan 7销售部ip add 172.16.70.1 255.255.255.0 in t vlan 8财务部ip add 172.16.80.1 255.255.255.0 in t vlan 9管理部ip add 172.16.90.1 255.255.255.0 int vlan 100 总经办ip add 172.16.100.1 255.255.255.0VTP配置3550-S-1 # vlan database3550-S-1(vlan)# vtp domainvtp13550-S

8、-1(vlan)# vtp server3550-S-1(vlan)# vtp password1233550-S-1(vlan)# vtp pruning3550-S-1 (vlan) # vlan 2 name yfzx3550-S-1 (vlan) # vlan 3 name zbb3550-S-1 (vlan) # vlan 4 name zzb3550-S-1 (vlan) # vlan 5 name sbb3550-S-1 (vlan) # vlan 6 name cgb3550-S-1 (van) # via n 7 n ame xsb 销售部3550-S-1 (via n)#

9、via n 8 n ame xsb财务部3550-S-1 (via n) # via n 9 n ame xsb管理部2950-S-1 (vlan) #vtp domain vtp12950-S-1 (vlan) #vtp tran透明模式(配置修改编号清零)2950-S-1 (vlan) #vtp client客户模式2950-S-1 (vlan) #vtp password 1232950-S-2 (vlan) #vtp domain vtp12950-S2 (vlan) #vtp tran 透明模式(配置修改编号清零)2950-S-2 (vlan) #vtp client客户模式2950

10、-S-2 (vlan) #vtp password 1232950-S-3 (vlan) #vtp domain vtp12950-S-3 (vlan) #vtp tran透明模式(配置修改编号清零)客户模式2950-S-3 (vlan) #vtp client2950-S-32950-S-42950-S-42950-S-42950-S-4d d d d d z( /( /( /( zlp p p p p t* t* t* t- t* #v#v#v#v#vpassword 123 domain vtp1tran 透明模式（配置修改编号清零）client客户模式password 1233.路由配

11、置2600-R-1 (config) # ip route 0.0.0.0 0.0.0.0 fO/2缺省路由2600-R-1 (config) # ip route 192.168.0.0 255.255.0.0 192.168.1.23550-R-1 (config) # ip route 0.0.0.0 0.0.0.0 192.168.1.1 4 NAT2600-R-1 (config) # access-list 101 permit ip 192.168.0.00.0.255.255 192.168.0.00.0.255.255 内部局部地址2600-R-1 (config) # ip

12、 nat pool WAN 221.215.31.131221.215.31.134 prefix-len 29定义合法 IP 地址池 2600-R-1 (config) # ip nat in side sour list 101 pool WAN 实地址转换2600-R-1 (config) # int f0/12600-R-1 (con fig-if) # ip nat in side定 义 NAT inside2600-R-1 (config) # int f0/02600-R-1 (config-if) # ip nat outside定义NAT现5Vian流量控制制造部、设备部vl

13、an实现互访，禁止访问其它部门vlan制造部、设备部上班 时间禁止访问internet(8:00-12:00 2:00-6:00)研发中心、质保部vlan实现互 访,禁止访问其它部门vlan财务部vlan实现与采购部、销售部vlan的单向 访问总经办vlan实现与财务部、管理部vlan的单向访问 管理部vlan禁止 访问其它部门vlan各部门vlan都能访问服务器区3550-S(config) # time-range restrict 3550-S(configtimerange) #periodic daily start 12:00 to 2:00设置时间范围3550-S-1 (conf

14、ig) # ip access-list extenqfzx研发中心 ACL3550-S-1 (config-ext-nacl) # permit ip any172.16.20.00.0.0.255访问质保部3550-S-1 (config-ext-nacl) # permit ip any 172.16.100.0 0.0.0.255 访问服务器区3550-S-1 (config-ext-nacl) # deny ip any 192.168.0.0 0.0.255.255 禁止访问其它部门3550-S-1 (config-ext-nacl) # permit ip any any3550

15、-S-1 (config) # ip access-list exten (Zbb 质保部 ACL3550-S-1 (config-ext-nacl) # permit ip any172.16.10.00.0.0.255访问研发中心3550-S-1 (config-ext-nacl) # permit ip any 172.16.100.0 0.0.0.255 访问服务器区3550-S-1 (config-ext-nacl) # deny ip any 192.168.0.0 0.0.255.255 禁止访问其它部门3550-S(configextnacl) # permit ip any

16、any3550-S-1 (config) # ip access-list exten (Zzb 制造部 ACL3550-S-1 (config-ext-nacl) # permit ip any172.16.40.00.0.0.255访问设备部3550-S-1 (config-ext-nacl) # permit ip any 172.16.100.0 0.0.0.255访问服务器区3550-S-1 (config-ext-nacl) # deny ip any 192.168.0.0 0.0.255.255禁止访问其它部门3550-S (configextnacl) # permit ip

17、 any any time-range restrict上班时间禁止上网3550-S-1 (config) # ip access-list exten (sbb设备部 ACL3550-S-1 (config-ext-nacl) # permit ip any 172.16.30.0 0.0.0.255访问制造部3550-S-1 (config-ext-nacl) # permit ip any 172.16.100.0 0.0.0.255访问服务器区3550-S-1 (config-ext-nacl) # deny ip any 192.168.0.0 0.0.255.255禁止访问其它部门

18、3550-S(configextnacl) # permit ip any any3550-S-1 (config) # ip access-list extendtgb采购部 ACL3550-S-1 (config-ext-nacl) #evaluate cwb-cgb 计.算匹配自反 ACL3550-S-1 (config-ext-nacl) # permit ip any 172.16.100.0 0.0.0.255访问服务器区3550-S-1 (config-ext-nacl) #deny ip any 192.168.0.0 0.0.255.25593550-S1 (configex

19、tnacl) #permit ip any any 3550-S-1 (config) # ip access-list exten (tsb .销售部 ACL3550-S-1 (config-ext-nacl) #evaluate cwb-xsb -计算匹配自反 ACL3550-S-1 (config-ext-nacl) # permit ip any 172.16.100.0 0.0.0.255 访问服务器区3550-S-1 (config-ext-nacl) #deny ip any 192.168.0.0 0.0.255.2553550-S(config-ext-nacl) #perm

20、it ip any any3550-S-1 (config) # ip access-list extendwb财务部 ACL3550-S-1 (config-ext-nacl) #permint ip any 172.16.60.0 0.0.0.255 reflect cwb- cgb 创建自反 ACL cwb-cgb3550-S-1 (config-ext-nacl) #permint ip any 172.16.70.0 0.0.0.255 reflect cwb- xsb 创建自反ACL cwb-xsb3550-S-1 (config-ext-nacl) #evaluate zjb-c

21、wb 计算匹配自反 ACL 3550-S-1 (config-ext-nacl) # permit ip any 172.16.100.0 0.0.0.255访问服务器区3550-S-1 (config-ext-nacl) # deny ip any 192.168.0.0 0.0.255.255禁止访问其它部门3550-S(configext-nacl) # permit ip any any3550-S-1 (config) # ip access-list extendwb管理部 ACL3550-S-1 (config-ext-nacl) #evaluate zjb-glb 计算匹配自反

22、 ACL3550-S-1 (config-ext-nacl) # permit ip any 172.16.100.0 0.0.0.255 访问服务器区3550-S-1 (config-ext-nacl) # deny ip any 192.168.0.0 0.0.255.255禁止访问其它部门3550-S(configextnacl) # permit ip any any3550-S-1 (config) # ip access-list extendjb总经办 ACL3550-S-1 (config-ext-nacl) #permint ip any 172.16.80.0 0.0.0.

23、255 reflect zjb- cwb 建自反 ACL zjb-cwb仓ij.3550-S-1 (config-ext-nacl) #permint ip any 172.16.90.0 0.0.0.255 reflect zjb-. gib 建自反 ACL zjb-glb3550-S-1 (config-ext-nacl) # permit ip any 172.16.100.0 0.0.0.255访问服务器区3550-S-1 (config-ext-nacl) # deny ip any 192.168.0.0 0.0.255.255 禁止访问其它部 门3550-S(con fig-ex

24、t acl) # permit ip any anyACL应用：3550-S-1 (con fig) # int via n 2研发中3550-S(con fig-if) #ip access-group yfzx in3550-S-1 (con fig) # int via n 3质保部3550-S(con fig-if) #ip access-group zbb in3550-S-1 (con fig) # int via n4制造部3550-S(con fig-if) #ip access-group zzb in略）附：关键字established的ACL应用（单向访问）3550-S-

25、1 (config) # ip access-list extenotgb采购部 ACL3550-S-1 (config-ext-nacl) # permit ip any 172.16.80.0 0.0.0.0.255 estab3550-S-1 (config-ext-nacl) # permit ip any 172.16.100.0 0.0.0.255访问服务器区3550-S-1 (config-ext-nacl) #deny ip any 192.168.0.0 0.0.255.2553550-S(con fig-ext acl) #permit ip any any3550-S-1

26、 (config) # ip access-list exten (tsb 销售部 ACL3550-S-1 (config-ext-nacl) # permit ip any 172.16.80.0 0.0.0.0.255 estab3550-S-1 (config-ext-nacl) # permit ip any 172.16.100.0 0.0.0.255访问服务器区3550-S-1 (config-ext-nacl) #deny ip any 192.168.0.0 0.0.255.255 3550-S-1 (con fig-ext -n acl) #permit ip any any

27、1、Vian信息Vian ID网络地址名称描述1172.16.10.0/24无本地via n2172.16.20.0/24yfzx研发中心3172.16.30.0/24zbb质保部4172.16.40.0/24zzb制造部5172.16.50.0/24sbb设备部6172.16.60.0/24cgb采购部7172.16.70.0/24xsb销售部8172.16.80.0/24cwb财务部9172.16.90.0/24gib管理部100172.16.100.0/24zjb总经办2、VTP信息设备名称Domai nPrunningPasswordMode3550-S-1vtp1En able123

28、Server2950-S-1vtp1En able123Clie nt2950-S-2vtp1En able123Clie nt2950-S-3vtp1En able123Clie nt2950-S-4vtp1En able123Clie nt3、设备IP地址分配设备名称接口IP地址描述2600-R-1F0/0221.215.31.129/29WANF0/1192.168.1.1/24-3550-S-1F0/1192.168.1.2/243L-Switch交换机、路由器详细配置1. IP地址设置2600-R-1 (config) # int F0/02600-R-1 (config-if) #

29、ip add221.215.31.129 255.255.255.02600-R-1 (config-if) #no shutdown2600-R-1 ( config-if)# int F0/12600-R-1 (config-if) #ip add192.168.1.1 255.255.255.0 2600-R-1 (config-if) #noshutdown3550-S-1 (config) # int FO/13550-S-1 (config-f) # no switchport路由端口3550-S-1 (config-if) # ip add192.168.1.2 255.255.

30、255.0 3550-S-1 (config) # int vlan 1管理vlarr.3550-S-1 (config-if) # ip add192.168.10.1 255.255.255.0 3550-S-1 (config-f) # in t vlan 2研发中心3550-S-1 (config-if) # ip add192.168.20.1 255.255.255.0 3550-S-1 (config-f) # in t vlan 3质保部3550-S-1 (config-if) # ip add192.168.30.1 255.255.255.0 3550-S-1 (con f

31、ig-if) # int van 4制造部3550-S-1 (config-if) # ip add192.168.40.1 255.255.255.0 3550-S-1 (configi-f) # int vlan 5设备-部3550-S-1 (config-if) # ip add192.168.50.1 255.255.255.0 3550-S-1 (configi-f) # int vlan 6采购部3550-S-1 (config-if) # ip add192.168.60.1 255.255.255.0 3550-S-1 (configi-f) # int vlan 7卡肖售部3

32、550-S-1 (config-if) # ip add192.168.70.1 255.255.255.0 3550-S-1 (configi-f) # int vlan 8财务部3550-S-1 (config-if) # ip add192.168.80.1 255.255.255.0 3550-S-1 (configi-f) # int vlan 9管理部3550-S-1 (config-if) # ip add192.168.90.1 255.255.255.0 3550-S-1 (configi-f) # int vlan 100总经办3550-S-1 (config-if) #

33、ip add192.168.100.1 255.255.255.02. VTP配置3550-S-1 (config)# vlan database 3550-S-1 (vlan) # vtp domain vtp1 3550-S-1(vlan) # vtp server 3550-S-1 (vlan) # vtp password 1233550-S-1 (vlan) # vtp pruningvlan 2 name yfzx3550-S-1 (vlan) # vlan 3 name zbb3550-S-1 (vlan) # vlan 4 name zzb修剪 3550-S-1 (vlan)

34、#研发中 心质保部 制造部3550-S-1 (vian) # vain 5 name sbb设备部 3550-S-1(vian)#vlan6name cgb 采购部3550-S-1 (vlan)# vlan 7name xsb 销售部3550-S-1 (vlan)# vlan 8name xsb 财务部3550-S-1 (vlan)# vlan 9name xsb 管理部2950-S-1 (vlan) #vtp domain vtp12950-S-1 (vian) #vtp tran 透明模式(配置修改编号清零)客户模式 2950-S-1 (vlan) #vtp client2950-S-1

35、(vian) #vtp password 1232950-S-2 (vian) #vtp domain vtp12950-S-2 (Van) #vtp tran 透明模式(配置修改编号清零)2950-S-2 (vian) #vtp ciient客户模式142950-S-2 (vian) #vtp password 1232950-S-3 (vian) #vtp domain vtp12950-S-3 (vian) #vtp tran 透明模式(配置修改编号清零)2950-S-3 (vian) #vtp ciient客户模式2950-S-3 (vian) #vtp password 123295

36、0-S-4 (vian) #vtp domain vtp12950-S-4 (vian) #vtp tran 透明模式(配置修改编号清零)2950-S-4 (vian) #vtp ciient客户模式2950-S-4 (vian) #vtp password 123 3.路由配置2600-R-1 (config) # ip route 0.0.0.0 0.0.0.0 fO/2缺省路由2600-R-1 (config) # ip route 192.168.0.0 255.255.0.0 192.168.1.2 3550- R -1 (config) # ip route 0.0.0.0 0.0

37、.0.0 192.168.1.14 NAT2600-R-1 (config) # access-iist 101 permit ip 192.168.0.00.0.255.255 192.168.0.00.0.255.255 内部局部地址2600-R-1 (config) # ip nat pooi WAN 221.215.31.131221.215.31.134 prefix-ien 29 定义合法IP地址池2600-R-1 (con fig) # ip nat in side sour list 101 pool WAN 实现地址转换2600-R-1 (config) # int f0/1

38、2600-R-1 (con fig-if) # ip nat in side定义-.NAT i nside2600-R-1 (config) # int f0/02600-R-1 (config-if) # ip nat outside定义 NAToutside 端 口5. Vian流量控制制造部、设备部vian实现互访，禁止访问其它部门vian制造部、设备部 上班时间禁止访问internet(8:00-12:00 2:00-6:00)研发中心、质保部 vian实现互访，禁止访问其它部门vian财务部vian实现与采购部、销 售部vian的单向访问总经办vian实现与财务部、管理部vian的单

39、向访问管理部vian禁止访问其它部门vian各部门vian都能访问服务器区3550-S(config) # time-range restrict3550-S-1 (config-time-range) #periodic daily start 12:00 to 2:00设置时间范围3550-S-1 (config) # ip access-list exten (yfzx研发中心 ACL3550-S-1 (config-ext-nacl) # permit ip any172.16.20.00.0.0.255访问质保部3550-S-1 (config-ext-nacl) # permit

40、ip any 172.16.100.0 0.0.0.255访问服务器区3550-S-1 (config-ext-nacl) # deny ip any 192.168.0.0 0.0.255.255禁止访问其它部门3550-S(con fig-ext acl) # permit ip any any23550-S-1 (config) # ip access-list extendtbb质保部 ACL3550-S-1 (config-ext-nacl) # permit ip any172.16.10.00.0.0.255访问研发中心3550-S-1 (config-ext-nacl) # p

41、ermit ip any 172.16.100.0 0.0.0.255访问服务器区3550-S-1 (config-ext-nacl) # deny ip any 192.168.0.0 0.0.255.255禁止访问其它部门3550-S(configextnacl) # permit ip any any3550-S-1 (config) # ip access-list extendtzb制造部 ACL3550-S-1 (config-ext-nacl) # permit ip any172.16.40.00.0.0.255访问设备部3550-S-1 (config-ext-nacl) #

42、 permit ip any 172.16.100.0 0.0.0.255访问服务器区3550-S-1 (config-ext-nacl) # deny ip any 192.168.0.0 0.0.255.255禁止访问其它部门3550-S (configextnacl) # permit ip any any time-range restrict上班时间禁止上网3550-S-1 (config) # ip access-list exten (sbb设备部 ACL3550-S-1 (config-ext-nacl) # permit ip any 172.16.30.0 0.0.0.25

43、5访问制造部3550-S-1 (config-ext-nacl) # permit ip any 172.16.100.0 0.0.0.255访问服务器区3550-S-1 (config-ext-nacl) # deny ip any 192.168.0.0 0.0.255.255 禁止访问其它部门3550-S(configextnacl) # permit ip any any3550-S-1 (config) # ip access-list exten (Cgb.采购部 ACL3550-S-1 (config-ext-nacl) #evaluate cwb-cgb -计算匹配自反 ACL

44、3550-S-1 (config-ext-nacl) # permit ip any 17216.100.0 0.0.0.255 访问服务器区3550-S-1 (config-ext-nacl) #deny ip any 192.168.0.0 0.0.255.2553550-S(configextnacl) #permit ip any any3550-S-1 (config) # ip access-list extencXsb 销售部 ACL3550-S-1 (config-ext-nacl) #evaluate cwb-xsb -计算匹配自反 ACL3550-S-1 (config-e

45、xt-nacl) # permit ip any 172.16.100.0 0.0.0.255访问服务器区3550-S-1 (config-ext-nacl) #deny ip any 192.168.0.0 0.0.255.2553550-S(config-ext-nacl) #permit ip any any3550-S-1 (config) # ip access-list extendwb财务部 ACL3550-S-1 (config-ext-nacl) #permint ip any 172.16.60.0 0.0.0.255 reflect cwb-cgb 创建自反 ACL cw

46、b-cgb3550-S-1 (config-ext-nacl) #permint ip any 172.16.70.0 0.0.0.255 reflect cwb-xsb 创建自反 ACL cwb-xsb3550-S-1 (config-ext-nacl) #evaluate zjb-cwb 计算匹配自反 ACL 3550- S-1 (config-ext-nacl) # permit ip any 172.16.100.0 0.0.0.255访问服务器区3550-S-1 (config-ext-nacl) # deny ip any 192.168.0.0 0.0.255.255禁止访问其它部门3550-S(config-ext-nacl) # permit ip any any3550-S-1 (config) # ip access-list extendwb管理部 ACL35