华为网络工程师认证HCNA——两层架构综合实验（详细）
两层架构综合实验
实验要求：
1.用户的网关配置在核心交换机
2.企业内网划分成多个vlan，减少广播域大小，提高网络稳定性。
接入层交换机配置vlan，并将用户划入相应的vlan
配置trunk链路
核心上面配置vlan和SVI虚拟接口添加网关
<JRSW2>sy Enter system view, return user view with Ctrl+Z. []vlan 10
[]vlan 30
[]port-group group-member e0/0/1 to e0/0/12 //多个接口捆绑为一组
[]port link-type access //配置为access
[]port default vlan 10 //一组接口划入vlan 10
[]port-group group-member e0/0/13 to e0/0/22
[]port link-type access []port default vlan 30
[]int gi0/0/1
[]port link-type trunk //配置trunk
[]port trunk allow-pass vlan 10 30 //划入两个vlan 10和30
[]q
<Huawei>sy Enter system view, return user view with Ctrl+Z. []sy JRSW3 []un in en //关闭日志提示
[]vlan 200
[]int e0/0/1
[]port link-type access []port default vlan 200
[]int e0/0/3
[]port link-type access []port default vlan 200
[]int gi0/0/1
[]port link-type trunk []port trunk allow-pass vlan 200
[]sy HXSW1 []un in en Info: Information center is disabled. []vlan batch 10 30 200 //捆绑创建vlan 10、30、200
Info: This operation may take a few seconds. Please wait for a moment...done. []int gi0/0/2
[]port link-type trunk []port trunk allow-pass vlan 10 30
[]int gi0/0/1
[]port link-type trunk []port trunk allow-pass vlan 200
[]q []int vlan 10
[]ip add 192.168.10.1 24 //添加vlan所对应网段的网关
[]int vlan 30
[]ip add 192.168.30.1 24
[]int vlan 200
[]ip add 192.168.200.1 24
[]
3.所有用户均为自动获取IP地址
<HXSW1> <HXSW1>syEnter system view, return user view with Ctrl+Z. [HXSW1]ip pool vlan_10 //创建IP地址池名为vlan_10 Info:It's successful to create an IP address pool. //指定以下三个属性就可以分配IP [HXSW1-ip-pool-vlan_10]network 192.168.10.0 mask 24 //地址池的网段和掩码 [HXSW1-ip-pool-vlan_10]gateway-list 192.168.10.1 //地址池的网关 [HXSW1-ip-pool-vlan_10]dns-list 8.8.8.8 //dns服务 [HXSW1]ip pool vlan_30Info:It's successful to create an IP address pool. [HXSW1-ip-pool-vlan_30]network 192.168.30.0 mask 24 [HXSW1-ip-pool-vlan_30]gateway-list 192.168.30.1 [HXSW1-ip-pool-vlan_30]dns-list 8.8.8.8 [HXSW1]dhcp enable //开启DHCP服务 Info: The operation may take a few seconds. Please wait for a moment.done. [HXSW1]int vlan 10 [HXSW1-Vlanif10]dhcp select global [HXSW1-Vlanif10]int vlan 30 [HXSW1-Vlanif30]dhcp select global
4.所有设备在任何位置都可以telnet远程管理（三个交换机进行同样的配置）
<HXSW1> <HXSW1>sy Enter system view, return user view with Ctrl+Z. [HXSW1]telnet server enable //开启telnet功能 Info: The Telnet server has been enabled. [HXSW1]aaa //进入aaa模式 [HXSW1-aaa]local-user hcnp password simple hcnp123 privilege level 3 //创建账号hcnp密码为明文hcnp123,优先级3Info: Add a new user. [HXSW1-aaa]local-user hcnp service-type telnet //hcnp用户用于远程telnet [HXSW1-aaa]q [HXSW1]user-interface vty 0 4 //容纳同时登陆的人数 [HXSW1-ui-vty0-4]authentication-mode aaa //认证模式为aaa [HXSW1-ui-vty0-4]
出口R1配置telnet
<Huawei>sy Enter system view, return user view with Ctrl+Z. [Huawei]sy CKR1 [CKR1]telnet server enable Error: TELNET server has been enabled [CKR1]aaa [CKR1-aaa]local-user hcnp password **cipher** hcnp123 privilege level 3 //创建hcnp，密码为密文hcnp123，优先级为3Info: Add a new user. [CKR1-aaa]local-user hcnp service-type telnet [CKR1-aaa]q [CKR1]user-interface vty 0 4[CKR1-ui-vty0-4]authentication-mode aaa [CKR1-ui-vty0-4]
配置telnet管理vlan 999
管理地址段：192.168.255.x/24
5.出口配置NAT
<HXSW1>sy Enter system view, return user view with Ctrl+Z. [HXSW1]vlan 800 [HXSW1-vlan800]int gi0/0/3 [HXSW1-GigabitEthernet0/0/3]port link-type access [HXSW1-GigabitEthernet0/0/3]port default vlan 800 [HXSW1-GigabitEthernet0/0/3]int vlan 800 //虚拟端口 [HXSW1-Vlanif800]ip add 192.168.254.1 24 //虚拟端口配置IP
出口R1、R2接口配置IP
[CKR1]int gi0/0/0 [CKR1-GigabitEthernet0/0/0]ip add 192.168.254.2 24 [CKR1]int gi0/0/1 [CKR1-GigabitEthernet0/0/1]ip add 12.1.1.1 29 [R2]int gi0/0/0 [R2-GigabitEthernet0/0/0]ip add 12.1.1.6 29 [R2]int LoopBack 9 [R2-LoopBack9]ip add 9.9.9.9 24 [HXSW1]ip route-static 0.0.0.0 0 192.168.254.2 [CKR1]ip route-static 0.0.0.0 0 12.1.1.6 //出包 [CKR1]ip route-static 192.168.0.0 255.255.0.0 192.168.254.1 //将回包交给SW1 [CKR1]acl number 2000 [CKR1-acl-basic-2000]rule permit source 192.168.0.0 0.0.255.255 [CKR1-acl-basic-2000]int gi0/0/1 [CKR1-GigabitEthernet0/0/1]nat outbound 2000
6.stp运行RSTP模式，确保核心交换机为根桥。并将接入用户的接口配置为边缘端口加快收敛
[JRSW2]stp mode rstp //stp模式换为rstp [JRSW3]stp mode rstp [JRSW2]port-group group-member e0/0/1 to e0/0/21 //所有e0/0/x的接口都设置为边缘接口 只能接PC [JRSW2-port-group]stp edged-port enable //设置边缘接口 [JRSW3]port-group group-member e0/0/1 to e0/0/22 [JRSW3-port-group]stp edged-port enable