综合实验-1
- 格式:pdf
- 大小:163.04 KB
- 文档页数:12
综合实验实验目的:1、熟练配置二层式网络2、了解交换机安全及配置:实验拓扑图实验说明:此实验为典型的2层式构架网络,中小型网络常采用此构架.实验要求:1) core-1与core-2的相互接口做成ethernetchannel 30.再将ethernetchannel30设置成trunk模式.Ed-sw,SF-sw与Core-1,Core-2互连的接口也设置成trunk模式,并验证. interface range fa0/23 - 24switchport trunk encapsulation dot1qswitch mode trunkchannel-group 30 mode oninterface Port-channel 30switchport trunk encapsulation dot1qswitchport mode trunkCore1(config)#int range fa0/21-22Core1(config-if-range)#switchport mode trunkCore1(config-if-range)#switchport trunk encapsulation dot1q2) core-1,core-2,edge-sw,FS-sw设置成同一vtp domain,domain name为step-lab,password为step-labcore-1,core-2设置为vtp server模式edge-sw,SF-SW设置为vtp client模式在core-1上增加vlan64,65,66,67,95在core-2,edge-sw,SF-SW学到vlan信息后,把所有交换机的vtp模式设置成transparent.Core1(config)#vtp domain step_labCore1(config)#vtp mode serverCore1(config)#vlan 64,65,66,67,95Core1(config)#vtp mode transparent3) 设置Core-1为vlan1,64,65的STP主根,为vlan66,67,95的备份STP根.设置Core-2为vlan66,67,95的STP主根,为vlan1,64,65的备份STP根. Core1(config)#spanning-tree vlan 1,64,65 root primaryCore1(config)#spanning-tree vlan 66,67,95 root secondaryCore2(config)#spanning-tree vlan 1,64,65 root secondaryCore2(config)#spanning-tree vlan 66,67,95 root primary4) core-1的1-5 port划分到vlan 64core-1的6-10 port划分到vlan 65core-1的11-15 port划分到vlan 66core-1的16-20 port划分到vlan 67把这些port设置成生成树快速转发模式,启用bpduguard,并测试.启用vlan64,65 port的port-security功能,限制每个port只能学习5个mac地址.Core1(config)#int range fa0/1-5Core1(config-if-range)#switchport access vlan 64Core1(config-if-range)#switchport mode accessCore1(config)#int range fa0/6-10Core1(config-if-range)#switchport access vlan 65Core1(config-if-range)#switchport mode accessCore1(config)#int range fa0/11-15Core1(config-if-range)#switchport access vlan 66Core1(config-if-range)#switchport mode accessCore1(config)#int range fa0/16-20Core1(config-if-range)#switchport access vlan 67Core1(config-if-range)#switchport mode accessCore1(config)#int range fa0/1-20Core1(config-if-range)#spanning-tree portfastCore1(config-if-range)#spanning-tree bpduguard enableCore1(config)#int range fa0/1-10Core1(config-if-range)#switchport port-security maximum 55) core-2的1-5 port划分到vlan 64core-2的6-10 port划分到vlan 65core-2的11-15 port划分到vlan 66core-2的16-20 port划分到vlan 67把这些port设置成生成树快速转发模式,禁止这些port收发BPDU信息,并测试.设置这些port只接收1M/s的broadcast数据包,2M/s的multicast数据包. int range fa0/1-5switchport access vlan 64switchport mode accessint range fa0/6-10switchport access vlan 65switchport mode accessint range fa0/11-15switchport access vlan 66switchport mode accessint range fa0/16-20switchport access vlan 67switchport mode accessCore2(config)#int range fa0/1-20Core2(config-if-range)#spanning-tree portfastCore2(config-if-range)#spanning-tree bpduguard enableCore2(config-if-range)#storm-control broadcast level pps 1mCore2(config-if-range)#storm-control multicast level pps 2m6) 设置vlan ip address:core-1 vlan64: 10.9.64.253/24core-1 vlan65: 10.9.65.253/24core-1 vlan66: 10.9.66.253/24core-1 vlan67: 10.9.67.253/24core-1 vlan95: 10.9.95.253/24core-1 loopback0: 10.9.100.1/32core-1与R1互联的接口: 10.9.96.10/30int vlan 64no shutip add 10.9.64.253 255.255.255.0int vlan 65no shutip add 10.9.65.253 255.255.255.0int vlan 66no shutip add 10.9.66.253 255.255.255.0int vlan 67no shutip add 10.9.67.253 255.255.255.0int vlan 95no shutip add 10.9.95.253 255.255.255.0int loopback 0ip add 10.9.100.1 255.255.255.255int fa0/3no switchportip add 10.9.96.10 255.255.255.252no shutcore-2 vlan64: 10.9.64.252/24core-2 vlan65: 10.9.65.252/24core-2 vlan66: 10.9.66.252/24core-2 vlan67: 10.9.67.252/24core-2 vlan95: 10.9.95.252/24core-2 loopback0: 10.9.100.2/32core-2与R1互联的接口: 10.9.96.6/30int vlan 64no shutip add 10.9.64.252 255.255.255.0int vlan 65no shutip add 10.9.65.252 255.255.255.0int vlan 66no shutip add 10.9.66.252 255.255.255.0int vlan 67no shutip add 10.9.67.252 255.255.255.0int vlan 95no shutip add 10.9.95.252 255.255.255.0int loopback 0ip add 10.9.100.2 255.255.255.255int fa0/4no switchportip add 10.9.96.6 255.255.255.252no shutsw2 vlan95: 10.9.95.1/24,缺省网关为10.9.95.254,测试可以相互ping通. int vlan 95no shutip add 10.9.95.1 255.255.255.0exitip default-gateway 10.9.95.254sw1 vlan95:10.9.95.2/24,缺省网关为10.9.95.254,测试可以相互ping通.int vlan 95no shutip add 10.9.95.2 255.255.255.0exitip default-gateway 10.9.95.2547) sw2上启用uplinkfast,并验证.sw2(config)#spanning-tree uplinkfast8) Core-1与Core-2的每个vlan接口都做HSRP,core-1设置成vlan64,65主用设备.core-2设置成vlan66,67,95主用设备.虚拟的IP地址为:10.9.xx.254/24,xx为vlan NO.Core1(config)#int vlan 64Core1(config-if)#standby 1 ip 10.9.64.254Core1(config-if)#standby 1 priority 105Core1(config-if)#standby 1 preemptCore1(config-if)#standby 1 track fastEthernet 0/3 20Core1(config-if)#exitCore1(config)#int vlan 65Core1(config-if)#standby 1 ip 10.9.65.254Core1(config-if)#standby 1 priority 105Core1(config-if)#standby 1 preemptCore1(config-if)#standby 1 track fastEthernet 0/3 20Core1(config-if)#exitCore1(config)#int vlan 66Core1(config-if)#standby 1 ip 10.9.66.254Core1(config-if)#standby 1 preemptCore1(config-if)#exitCore1(config)#int vlan 67Core1(config-if)#standby 1 ip 10.9.67.254Core1(config-if)#standby 1 preemptCore1(config-if)#exitCore1(config)#int vlan 95Core1(config-if)#standby 1 ip 10.9.95.254Core1(config-if)#standby 1 preemptCore1(config-if)#exitCore2中:int vlan 66standby 1 ip 10.9.66.254standby 1 priority 105standby 1 preemptstandby 1 track fastEthernet 0/4 20exitint vlan 67standby 1 ip 10.9.67.254standby 1 priority 105standby 1 preemptstandby 1 track fastEthernet 0/4 20exitint vlan 95standby 1 ip 10.9.95.254standby 1 track fastEthernet 0/4 20standby 1 preemptexitint vlan 64standby 1 ip 10.9.64.254standby 1 preemptexitint vlan 65standby 1 ip 10.9.65.254standby 1 preemptexit9) 设置R1:F0/0:10.9.96.9/30F0/1:10.9.96.5/30loopback0:10.9.100.3/32R1,core-1,core-2启用eigrp路由协议,使所有网络互通,并验证.int fa0/0ip add 10.9.96.9 255.255.255.252no shutexitint fa0/1ip add 10.9.96.5 255.255.255.252no shutexitint loopback 0ip add 10.9.100.3 255.255.255.255exitrouter eigrp 100network 10.0.0.0no auto-summaryCore1(config-router)#ip routingCore1(config-router)#router eigrp 100Core1(config-router)#network 10.0.0.0Core1(config-router)#no auto-summaryCore2(config)#ip routingCore2(config)#router eigrp 100Core2(config-router)#network 10.0.0.0Core2(config-router)#no auto-summary10) R1上启用dhcp server功能,为以下网段提供dhcp服务:10.9.64.0/2410.9.65.0/2410.9.66.0/2410.9.67.0/24分配10.9.xx.11-10.9.xx.200,xx为vlan NODNS server: 10.9.100.3Default-gateway: 10.9.xx.254Domain-name: 并在core-1,core-2的VLAN接口上启用DHCP广播重定向功能,从定向到R1这台DHCP Server,使dhcp server能够正常为PC提供IP地址服务//默认arp 请求只会发到core的下层接口,使用ip helper-address **来实现广播重定向R1(config)#ip dhcp pool testnetwork 10.9.64.0 255.255.255.0dns-server 10.9.100.3default-router 10.9.64.254domain-name exitip dhcp pool test1network 10.9.65.0 255.255.255.0dns-server 10.9.100.3default-router 10.9.65.254domain-name exitip dhcp pool test2network 10.9.66.0 255.255.255.0dns-server 10.9.100.3default-router 10.9.66.254domain-name exitip dhcp pool test3network 10.9.67.0 255.255.255.0dns-server 10.9.100.3default-router 10.9.67.254domain-name exitip dhcp excluded-address 10.9.64.201 10.9.64.254ip dhcp excluded-address 10.9.64.1 10.9.64.10ip dhcp excluded-address 10.9.65.201 10.9.65.254ip dhcp excluded-address 10.9.65.1 10.9.65.10ip dhcp excluded-address 10.9.66.201 10.9.66.254ip dhcp excluded-address 10.9.66.1 10.9.66.10ip dhcp excluded-address 10.9.67.201 10.9.67.254ip dhcp excluded-address 10.9.67.1 10.9.67.10Core1(config)#int vlan 64Core1(config-if)#ip helper-address 10.9.96.9Core1(config-if)#exitCore1(config)#int vlan 65Core1(config-if)#ip helper-address 10.9.96.9Core1(config-if)#exitCore1(config)#int vlan 66Core1(config-if)#ip helper-address 10.9.96.9Core1(config-if)#exitCore1(config)#int vlan 67Core1(config-if)#ip helper-address 10.9.96.9Core1(config-if)#exitCore2(config)#int vlan 64Core2(config-if)#ip helper-address 10.9.96.5Core2(config-if)#exitCore2(config)#int vlan 65Core2(config-if)#ip helper-address 10.9.96.5Core2(config-if)#exitCore2(config)#int vlan 66Core2(config-if)#ip helper-address 10.9.96.5Core2(config-if)#exitCore2(config)#int vlan 67Core2(config-if)#ip helper-address 10.9.96.511) 启用sw1 vlan 64-67的ip dhcp snooping功能,并只允许F0/23-24的dhcp reply数据包.Ip dhcp snoopingsw1(config)#ip dhcp snooping vlan 64sw1(config)#ip dhcp snooping vlan 65sw1(config)#ip dhcp snooping vlan 66sw1(config)#ip dhcp snooping vlan 67int range fa0/23 -24ip dhcp snooping trust12) 测试core-1或者core-2断电时,网络可以正常运行.。