实验5城域网互联网络综合实验.docx
实验五 城域网互联网络综合实验【实验名称】 城域网互联网络综合实验【实验原型】 某教育城域网全网建设（采用设备： RG-WALL1000千兆防火墙、RG-S6810E、RG-S3550-12SFP/GT全千兆三层路由交换机、RG-S2126G/50G千兆安全智能堆叠交换机、RG-R3662模块化路由器）【实验目的】 在实验室环境根据具体真实网络建设搭建模拟环境进行综合应用实验，指导学员如何规划实施大型城域网互联网络建设规划【预备知识】 交换路由基础，静态路由、路由备份、生成树协议、802.1QVlan、Vlan三层路由、NAT、ACL访问控制、安全控制等【背景描述】 某省现有中学85所，随着教育信息化的逐步深入，教育城域网的建设成为该“校校通”工程的重点，同时，教育城域网也成为实现远程教学、多媒体教学及教学资源共享的关键。建设教育城域网，该省希望通过网络建立教学辅助系统，为课堂教学提供丰富的实时音频、视频素材；同时，搭建起远程交互教学、函授教育课程管理硬件平台。因此，希望网络建成后，不仅要满足当前的业务需求，同时系统还要具备良好的可扩展性，能适应未来业务的发展和智能升级。在规划方面主要提出了两个方面的要求：首先，作为连接全省85所中学的基础网络，教育城域网要满足音频、视频等网络应用。所以需要网络提供端到端的服务质量管理保障技术来实现教育城域网IP电话、VOD、多媒体数据传输等应用的网络服务质量的保障QoS服务。对于各地市教育局连接省局要增加2M备份线路。另外，城域网建设要经济实用，具有较高的性价比，并能够充分满足未来网络承载业务的不断扩大。建设后的网络拓朴如下：【实现功能】 实现各地市内部网络VLAN划分，VLAN三层路由功能；防病毒攻击防护、防扫描攻击；出口实现地址转换、与省网核心设备互联互通；各地市之间网络互联互通；路由备份线路备份；启用生成树协议避免环路。【实验拓扑】 【实验设备】 核心设备：S68系列（或S65/S35系列设备）1台， R3662一台； 接入设备： S3550-24 2台；S2126G二层交换机4台；R2624 四台；C2635C、C2635T各两根 实验PC：7台；【实验步骤】 实验配置分为：（以下配置默认在全局配置模式下进行 ）。第一步：网络设备的基本配置；第二步：NAT配置 第三步：备分链路配置第四步：ospf配置及其测试；第一步 网络设备的基本配置(1) R2624-A基本配置hostname "R2624-A" /设置交换机名称为R2624-A!ip subnet-zero !interface FastEthernet0 ip address 10.0.0.5 255.255.255.252 /配置端口0的IP地址!interface FastEthernet3 ip address 192.168.0.1 255.255.255.0 /配置端口3的IP地址 ! line con 0line aux 0line vty 0 4 password 111 /设置TELNET登陆密码 login!endR2624-B、R2624-C、R2624-D的配置与其类似，在此略过。(2) S6806E基本配置hostname S6806E /设置交换机名称为S6806Evlan 1!interface FastEthernet 0/1 no switchport /设置端口1为三层端口 ip address 10.0.0.6 255.255.255.252 /设置端口1的IP地址!interface FastEthernet 0/2 no switchport ip address 10.0.0.10 255.255.255.252 /设置端口2的IP地址!interface FastEthernet 0/3 no switchport ip address 10.0.0.14 255.255.255.252 /设置端口3的IP地址! interface FastEthernet 0/4 no switchport ip address 10.0.0.18 255.255.255.252 /设置端口4的IP地址!interface FastEthernet 0/5 no switchport ip address 10.0.0.21 255.255.255.252 /设置端口5的IP地址!(3) R3642-A基本配置hostname "R3642-A" /设置交换机名称为R3642-A!ip subnet-zero!interface FastEthernet0 ip address 10.0.0.22 255.255.255.252 /设置端口0的IP地址!interface FastEthernet1 ip address 202.198.196.9 255.255.255.252 /设置端口1的IP地址!interface FastEthernet2 ip address 202.198.196.5 255.255.255.252 /设置端口2的IP地址 !line con 0line aux 0line vty 0 4 password 111 /设置TELNET登陆密码 login!End第二步 NAT配置R2624-A上面的NAT配置interface FastEthernet0 ip address 10.0.0.5 255.255.255.252 ip nat outside /设置NAT出口地址，连接外部网络!interface FastEthernet3 ip address 192.168.0.1 255.255.255.0 ip nat inside /设置NAT入口地址，连接内部网络 !ip nat inside source list 10 interface FastEthernet0 overload /采取NAPT的方式，即多个内部地址复用一个外部IP地址access-list 10 permit any /设置本地地址访问列表第三步 设置备分链路在R3642上的配置interface FastEthernet1 ip address 202.198.196.9 255.255.255.252 ip ospf cost 50 /设置OSPF路由链路代价!interface FastEthernet2 ip address 202.198.196.5 255.255.255.252 ip ospf cost 50 /设置OSPF路由链路代价在R2624C 上的配置interface FastEthernet1 ip address 202.198.196.10 255.255.255.252 ip ospf cost 50 /设置OSPF路由链路代价在R2624D上的配置interface FastEthernet1 ip address 202.198.196.6 255.255.255.252 ip ospf cost 50 /设置OSPF路由链路代价在正常情况下，从R2624-D到R2624-A的路由是：R2624-D#traceroute 10.0.0.5Type escape sequence to abort.Tracing the route to 10.0.0.5 1 10.0.0.18 0 msec 0 msec 0 msec2 10.0.0.5 0 msec 0 msec * 一共为两跳。当主链路断开的情况下，会自动采用备分链路，其路由变化为：R2624-D#traceroute 10.0.0.5Type escape sequence to abort.Tracing the route to 10.0.0.5 1 202.198.196.5 0 msec 0 msec 0 msec 2 10.0.0.21 0 msec 0 msec 0 msec 3 10.0.0.5 0 msec 0 msec * R2624-D#从路由器R2624-C也可以看出，正常情况下，它到R2624-A的路由是两跳R2624-C#traceroute 10.0.0.5Type escape sequence to abort.Tracing the route to 10.0.0.5 1 10.0.0.14 0 msec 0 msec 0 msec2 10.0.0.5 4 msec 0 msec * 当主链路断开后，从备分链路走，路由变为三跳：R2624-C#traceroute 10.0.0.5Type escape sequence to abort.Tracing the route to 10.0.0.5 1 202.198.196.9 0 msec 0 msec 4 msec 2 10.0.0.21 0 msec 0 msec 0 msec 3 10.0.0.5 0 msec 0 msec * 第四步 设置OSPF路由在R2624A上的配置router ospf 1 /启用OSPF路由协议 network 10.0.0.0 0.255.255.255 area 0 /公布本机路由信息R2624-B的配置与其类似，在此略过。在R2624C上的配置router ospf 1 /启用OSPF路由协议 network 10.0.0.0 0.255.255.255 area 0 /公布本机路由信息 network 202.198.196.0 0.0.0.255 area 0R2624-D的配置与其类似，在此略过。在S6806E上的配置router ospf /启用OSPF路由协议area 0.0.0.0 /区域0network 10.0.0.0 255.0.0.0 area 0.0.0.0 /公布本机路由信息以下是各个设备的OSPF路由信息：S6806E#sh ip route Type: C - connected, S - static, R - RIP, O - OSPF, IA - OSPF inter area N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2 E1 - OSPF external type 1, E2 - OSPF external type 2Type Destination IP Next hop Interface Distance Metric Status- - - - - - -O E2 0.0.0.0/0 10.0.0.22 Fa0/5 110 1 ActiveC 10.0.0.4/30 0.0.0.0 Fa0/1 0 0 ActiveC 10.0.0.8/30 0.0.0.0 Fa0/2 0 0 ActiveC 10.0.0.12/30 0.0.0.0 Fa0/3 0 0 ActiveC 10.0.0.16/30 0.0.0.0 Fa0/4 0 0 ActiveC 10.0.0.20/30 0.0.0.0 Fa0/5 0 0 ActiveO 202.198.196.4/30 10.0.0.22 Fa0/5 110 51 ActiveO 202.198.196.8/30 10.0.0.13 Fa0/3 110 51 ActiveS6806E#sh ip ospf nei Neighbor ID Pri State DeadTime Address Interface- - - - - -192.168.0.1 1 full/BDR 00:00:33 10.0.0.5 Fa0/1 192.168.0.1 1 full/BDR 00:00:32 10.0.0.9 Fa0/2 192.168.0.1 1 full/DR 00:00:38 10.0.0.13 Fa0/3 192.168.0.1 1 full/DR 00:00:30 10.0.0.17 Fa0/4 202.198.196.9 1 full/BDR 00:00:32 10.0.0.22 Fa0/5 R3642-A#sh ip route Codes: C - connected, S - static, R - RIP O - OSPF, IA - OSPF inter area E1 - OSPF external type 1, E2 - OSPF external type 2Gateway of last resort is not set 10.0.0.0/30 is subnetted, 5 subnetsO 10.0.0.8 110/2 via 10.0.0.21, 00:00:03, FastEthernet0O 10.0.0.12 110/2 via 10.0.0.21, 00:00:03, FastEthernet0O 10.0.0.4 110/2 via 10.0.0.21, 00:00:03, FastEthernet0O 10.0.0.16 110/2 via 10.0.0.21, 00:00:03, FastEthernet0C 10.0.0.20 is directly connected, FastEthernet0 202.198.196.0/30 is subnetted, 2 subnetsC 202.198.196.8 is directly connected, FastEthernet1C 202.198.196.4 is directly connected, FastEthernet2R3642-A#R3642-A#sh ip ospf neiNeighbor ID Pri State Dead Time Address Interface10.0.0.21 1 FULL/DR 00:00:39 10.0.0.21 FastEthernet0192.168.0.1 1 FULL/BDR 00:00:38 202.198.196.10 FastEthernet1192.168.0.1 1 FULL/BDR 00:00:39 202.198.196.6 FastEthernet2R2624-A#sh ip routeCodes: C - connected, S - static, R - RIP O - OSPF, IA - OSPF inter area E1 - OSPF external type 1, E2 - OSPF external type 2Gateway of last resort is 10.0.0.6 to network 0.0.0.0 10.0.0.0/30 is subnetted, 3 subnetsO 10.0.0.8 110/2 via 10.0.0.6, 00:06:24, FastEthernet0C 10.0.0.4 is directly connected, FastEthernet0O 10.0.0.20 110/2 via 10.0.0.6, 00:06:24, FastEthernet0C 192.168.0.0/24 is directly connected, FastEthernet3 202.198.196.0/30 is subnetted, 2 subnetsO 202.198.196.8 110/52 via 10.0.0.6, 00:06:24, FastEthernet0O 202.198.196.4 110/52 via 10.0.0.6, 00:06:24, FastEthernet0S* 0.0.0.0/0 1/0 via 10.0.0.6R2624-A#R2624-A#sh ip ospf neiNeighbor ID Pri State Dead Time Address Interface10.0.0.21 1 FULL/DR 00:00:37 10.0.0.6 FastEthernet0R2624-A#R2624-C#sh ip routeCodes: C - connected, S - static, R - RIP O - OSPF, IA - OSPF inter area E1 - OSPF external type 1, E2 - OSPF external type 2Gateway of last resort is 10.0.0.14 to network 0.0.0.0 10.0.0.0/30 is subnetted, 4 subnetsO 10.0.0.8 110/2 via 10.0.0.14, 00:04:02, FastEthernet0C 10.0.0.12 is directly connected, FastEthernet0O 10.0.0.4 110/2 via 10.0.0.14, 00:04:02, FastEthernet0O 10.0.0.20 110/2 via 10.0.0.14, 00:04:02, FastEthernet0C 192.168.0.0/24 is directly connected, FastEthernet3 202.198.196.0/30 is subnetted, 2 subnetsC 202.198.196.8 is directly connected, FastEthernet1O 202.198.196.4 110/52 via 10.0.0.14, 00:04:02, FastEthernet0S* 0.0.0.0/0 1/0 via 10.0.0.14R2624-C#sh ip ospf neiNeighbor ID Pri State Dead Time Address Interface10.0.0.21 1 FULL/BDR 00:00:38 10.0.0.14 FastEthernet0202.198.196.9 1 FULL/DR 00:00:39 202.198.196.9 FastEthernet1R2624-C#【问题与思考】1、 熟悉NAT的原理2、 熟悉OSPF路由协议原理【参考配置】(1) R2624-A的参考配置R2624-A#sh runBuilding configuration.Current configuration:!version 6.14(2)!hostname "R2624-A"!enable password 111!ip subnet-zero!interface FastEthernet0 ip address 10.0.0.5 255.255.255.252 ip nat outside!interface FastEthernet1 no ip address shutdown!interface FastEthernet2 no ip address shutdown!interface FastEthernet3 ip address 192.168.0.1 255.255.255.0 ip nat inside!interface Serial0 no ip address shutdown!interface Serial1 no ip address shutdown!router ospf 1 network 10.0.0.0 0.255.255.255 area 0!ip nat inside source list 10 interface FastEthernet0 overloadip classlessip route 0.0.0.0 0.0.0.0 10.0.0.6access-list 10 permit any! line con 0line aux 0line vty 0 4 password 111 login!end(2) R2624-B的参考配置R2624-B#R2624-B#sh runBuilding configuration.Current configuration:!hostname "R2624-B"!enable password 111!ip subnet-zero!interface FastEthernet0 ip address 10.0.0.9 255.255.255.252 ip nat outside!interface FastEthernet1 no ip address shutdown!interface FastEthernet2 no ip address shutdown!interface FastEthernet3 ip address 192.168.0.1 255.255.255.0 ip nat inside!interface Serial0 no ip address shutdown!interface Serial1 no ip address shutdown!router ospf 1 network 10.0.0.0 0.255.255.255 area 0!ip nat inside source list 10 interface FastEthernet0 overloadip classlessip route 0.0.0.0 0.0.0.0 10.0.0.10access-list 10 permit any!line con 0line 1 8line aux 0line vty 0 4 password 111 login!end(3) R2624-C的参考配置R2624-C#R2624-C#sh runBuilding configuration.Current configuration:!version 6.14(2)!hostname "R2624-C"!enable password 111!ip subnet-zero!interface FastEthernet0 ip address 10.0.0.13 255.255.255.252 ip nat outside!interface FastEthernet1 ip address 202.198.196.10 255.255.255.252 ip ospf cost 50!interface FastEthernet2 no ip address shutdown!interface FastEthernet3 ip address 192.168.0.1 255.255.255.0 ip nat inside!interface Serial0 no ip address shutdown!interface Serial1 no ip address shutdown!router ospf 1 network 10.0.0.0 0.255.255.255 area 0 network 202.198.196.0 0.0.0.255 area 0!ip nat inside source list 10 interface FastEthernet0 overloadip classlessip route 0.0.0.0 0.0.0.0 10.0.0.14access-list 10 permit any!line con 0line aux 0line vty 0 4 password 111 login!end(4) R2624-D的参考配置R2624-D#sh run Building configuration.Current configuration:!version 6.14(2)!hostname "R2624-D"!aaa new-modelenable password 111!ip subnet-zero!interface FastEthernet0 ip address 10.0.0.17 255.255.255.252 ip nat outside!interface FastEthernet1 ip address 202.198.196.6 255.255.255.252 ip ospf cost 50!interface FastEthernet2 no ip address shutdown!interface FastEthernet3 ip address 192.168.0.1 255.255.255.0 ip nat inside!interface Serial0 no ip address shutdown!interface Serial1 no ip address shutdown!router ospf 1 network 10.0.0.0 0.255.255.255 area 0 network 202.198.196.0 0.0.0.255 area 0!ip nat inside source list 10 interface FastEthernet0 overloadip classlessip route 0.0.0.0 0.0.0.0 10.0.0.18access-list 10 permit any!line con 0line aux 0line vty 0 4 password 111!end(5) R3642A的参考配置R3642-A#R3642-A#sh runBuilding configuration.Current configuration:!version 6.14(2)!hostname "R3642-A"!enable password 111!ip subnet-zero!interface FastEthernet0 ip address 10.0.0.22 255.255.255.252!interface FastEthernet1 ip address 202.198.196.9 255.255.255.252 ip ospf cost 50!interface FastEthernet2 ip address 202.198.196.5 255.255.255.252 ip ospf cost 50!interface FastEthernet3 no ip address shutdown!interface Serial0 no ip address shutdown!interface Serial1 no ip address shutdown!router ospf 1 network 10.0.0.0 0.255.255.255 area 0 network 202.198.196.0 0.0.0.255 area 0 default-information originate always!ip classless!line con 0line aux 0line vty 0 4 password 111 login!end(6) S6806E的参考配置S6806E#sh runBuilding configuration.Current configuration : 679 bytes!version 1.0!hostname S6806Evlan 1!enable secret level 1 5 #wNq&#Z1qIOrJ%(8qMpK*.tqxB"/7enable secret level 15 5 #dhl&-8qaein'.tqbfjo+/7qcgkE,1u!interface FastEthernet 0/1 no switchport ip address 10.0.0.6 255.255.255.252 !interface FastEthernet 0/2 no switchport ip address 10.0.0.10 255.255.255.252 !interface FastEthernet 0/3 no switchport ip address 10.0.0.14 255.255.255.252 ! interface FastEthernet 0/4 no switchport ip address 10.0.0.18 255.255.255.252 !interface FastEthernet 0/5 no switchport ip address 10.0.0.21 255.255.255.252 !router ospfarea 0.0.0.0network 10.0.0.0 255.0.0.0 area 0.0.0.0!end
