网络配置综合实验报告

综合实验需求分析通过合理的三层网络架构，实现用户接入网络的安全、快捷，不允许VLAN10的用户去访问VLAN30的FTP服务，VLAN20不受限制；VLAN10的用户接口需要配置端口安全，设置最大连接数为3，如果违规则采取shutdown措施，VLAN20的用户接口需要配置端口安全，设置最大连接数为2，如果违规则采取shutdown措施；配置静态路由使用全网互通；配置NAT功能，使用内网用户使用—这段地址去访问互联网；将内网的FTP服务发不到互联网上，使用内网地址为54，公网地址为，并要求可以通过内网地址访问FTP服务器，使用ACL防止冲击波病毒。实验拓扑图实验设备二层交换机2台（Switch0，Switch1）。三层交换机2台（MultilayeSwitch1，MultilayeSwitch0）路由器2台（router0，router1）。服务器一台（Server0）。主机两台（PC0，PC1）。IP地址规划三层SW0：VLAN10/24VLAN20/24VLAN30/24三层SW1VLAN10/24VLAN20/24VLAN30/24F0/11/30R0F0/0/30F0/1/28R1F0/1/28主要三层交换机，路由器的配置：Switch0ConftIntf0/1//SwitchportmodeaccessSwitchportport-securitySwitchportport-securitymaximum3Switchportport-securityviolationshutdownIntf0/2SwitchportmodeaccessSwitchportport-securitySwitchportport-securitymaximum2Switchportport-securityviolationshutdownIntvlan10IpaddNoshutIntvlan20IpaddNoshutIntvlan30IpaddNoshutIntrangef0/1//SwitchportmodeaccessSwitchportaccessvlan10Intrangef0/2SwitchportmodeaccessSwitchportaccessvlan20Intrangef0/3SwitchportmodetrunkSwithporttrunkallowedvlan1,10,20,30Switchporttrunkencapsulationdot1qIntvlan2Ipadd52NoshutIntrangef0/5Switchportaccessvlan2IproutingIproutef0/3Iproute52f0/3Iproute40f0/3EndRouterripNetworkNetworkEndSwitch1ConftIntvlan30IpaddNoshutIntrangef0/1Switchport accessvlan30Intrangef0/3SwitchportmodetrunkSwithporttrunkallowedvlan1,10,20,30Switchporttrunkencapsulationdot1qIproutingIntvlan2Ipadd52NoshutAccess-list1025555Intvlan30Ipaccess-group102inEndIntrangef0/2Switchportaccessvlan2Iproutef0/1Iproutef0/3Iproutef0/3Iproute52f0/2Iproute40f0/2EndRouterripNetworkNetworkEndRouter0ConftIntf0/0Ipadd52IpnatinsideNoshutIntf0/1Ipadd40IpnatoutsideNoshutAccess-list1permit55Ipnatpooltestnetmask40Ipnatinsidesourcelist1pooltestoverloadIpnatinsidesourcestatic54Iproutef0/0Iproute52f0/0Iproute40f0/1EndRouterripNetworkNetworkEndaccess-list120denytcpanyanyeq135

access-list120denytcpanyanyeq136

access-list120denytcpanyanyeq137

access-list120denytcpanyanyeq138

access-list120denytcpanyanyeq139

access-list120denytcpanyanyeq389

access-list120denytcpanyanyeq445

access-list120denytcpanyanyeq4444

access-list120denyudpanyanyeq69

access-list120denyudpanyanyeq135

access-list120denyudpanyanyeq136

access-list120denyudpanyanyeq137

access-list120denyudpanyanyeq138

access-list120denyudpanyanyeq139

access-list120denyudpanyanyeqsnmp

access-list120denyudpanyanyeq389

access-list120denyudpanyanyeq445

access-list120denyudpanyanyeq1434

access-list120denyudpanyanyeq1433

access-list120permitipanyanyintf0/0ipaccess-group120inend验证测试使用showvlan命令测试vlan的划分：使用shipnattranslations：使用shaccess—lists查看：输入ship