综合组网实验
一、概述
本次实验模拟学校实验室的网络环境，通过虚拟环境进行组网，通过vlan、路由、访问控制等，实现不同实验室之间的通信，并且可以通过ACL控制某一个实验室的网络通信，进行简单的组网分析
二、应用的网络知识
- Vlan
- Vlan间通信
- 静态路由
- 动态路由
- 链路聚合
- 链路备份
- Nat地址转换
- ACL访问控制
- DHCP
三、实验拓扑
四、实验分析
五、实验详细配置
1. LSW1的配置
1.1 划分vlan
- 将G0/0/1接口划入vlan201，G0/0/2接口划入vlan202
<Huawei>sys
Enter system view, return user view with Ctrl+Z.
[Huawei]vlan batch 201 202 20
Info: This operation may take a few seconds. Please wait for a moment...done.
[Huawei]q
//使用此命令可以关闭日志
<Huawei>undo terminal monitor
Info: Current terminal monitor is off.
<Huawei>sys
[Huawei]int g0/0/1
[Huawei-GigabitEthernet0/0/1]port link-type access
[Huawei-GigabitEthernet0/0/1]port default vlan 201
[Huawei-GigabitEthernet0/0/1]int g0/0/2
[Huawei-GigabitEthernet0/0/2]port link-type access
[Huawei-GigabitEthernet0/0/2]port default vlan 202
- vlan介绍可以参考：虚拟局域网
1.2 vlan间通信
- 配置命令
[Huawei]int vlanif 201
[Huawei-Vlanif201]ip address 10.1.1.1 24
[Huawei-Vlanif201]int vlanif 202
[Huawei-Vlanif202]ip add 10.1.2.1 24
//此处配置vlan20是为了保证与上层的通信
[Huawei]vlan 20
[Huawei]int vlanif 20
[Huawei-Vlanif20]ip add 192.168.2.2 24
- vlan间通信可参考：vlan间通信
1.3 链路聚合
为了保证LSW1与核心交换机之间的数据传输，在他们之间进行链路聚合，即将三条链路聚合为一两条逻辑链路Eth-Trunk1，从而保证他们之间数据的转发(此处采用的链路聚合模式为LACP模式)
- LACP模式：此模式下链路中有转发链路和备份链路，此处采用两条转发链路，一条备份链路
- 配置命令
[Huawei]int Eth-Trunk 1
//将模式改为lacp
[Huawei-Eth-Trunk1]mode lacp-static
[Huawei-Eth-Trunk1]trunkport g0/0/4
Info: This operation may take a few seconds. Please wait for a moment...done.
[Huawei-Eth-Trunk1]trunkport g0/0/5
Info: This operation may take a few seconds. Please wait for a moment...done.
[Huawei-Eth-Trunk1]trunkport g0/0/3
Info: This operation may take a few seconds. Please wait for a moment...done.
[Huawei-Eth-Trunk1]q
//改变优先级，优先级小越优先，默认值为32768，此处改为100，则LSW1端为主动方
[Huawei]lacp priority 100
[Huawei]int Eth-Trunk 1
//此命令表示LACP模式下有两条活跃链路，一条备份链路
[Huawei-Eth-Trunk1]max active-linknumber 2
- 通过命令查看链路聚合后的链路状态(此处查看到的效果需要对端及LSW3配置完成)
[Huawei]dis interface Eth-Trunk 1
Eth-Trunk1 current state : UP
Line protocol current state : UP
Description:
Switch Port, PVID : 1, Hash arithmetic : According to SIP-XOR-DIP,Maximal BW:
3G, Current BW: 2G, The Maximum Frame Length is 9216
IP Sending Frames' Format is PKTFMT_ETHNT_2, Hardware address is 4c1f-cc45-6681
Current system time: 2020-04-20 21:14:48-08:00
Input bandwidth utilization : 0%
Output bandwidth utilization : 0%
-----------------------------------------------------
PortName Status Weight
-----------------------------------------------------
GigabitEthernet0/0/3 UP 1
GigabitEthernet0/0/4 DOWN 1
GigabitEthernet0/0/5 UP 1
-----------------------------------------------------
The Number of Ports in Trunk : 3
The Number of UP Ports in Trunk : 2
1.4 配置DHCP
-
在vlanif接口中配置DHCP
-
配置命令
[Huawei]dhcp enable
[Huawei]int vlanif 201
[Huawei-Vlanif201]dhcp select interface
[Huawei-Vlanif201]int vlanif 202
[Huawei-Vlanif202]dhcp select interface
-
此处201教室可以分配的地址为10.1.1.0网段，202教室可以分配的地址是10.1.2.0网段
-
dhcp详细内容可以参考：DHCP协议分析
1.5 与上层核心交换机通信
- 将Eth-Trunk 1逻辑端口类型改为trunk，并且允许vlan 201 202 20 通过
- 配置命令
[Huawei]int Eth-Trunk 1
[Huawei-Eth-Trunk1]port link-type trunk
[Huawei-Eth-Trunk1]port trunk allow-pass vlan 201 202 20
- 对端端口的配置在LSW3的配置中介绍
1.6 路由配置
- 此处需要配置静态默认路由，保证可以与上层网段通信
- 配置命令
[Huawei]ip route-static 0.0.0.0 0.0.0.0 192.168.2.1
2. LSW3核心交换机的配置
2.1 划分vlan
-
将所有二楼的实验室划入vlan20
-
并且在此处配置链路聚合
-
配置命令
//此处创建三个vlan是为了保证与上层路由器和三楼所有主机的通信
[Huawei]vlan batch 20 30 100
Info: This operation may take a few seconds. Please wait for a moment...done.
[Huawei]int vlanif 20
[Huawei-Vlanif20]ip add 192.168.2.1 24
[Huawei]int vlanif 30
[Huawei-Vlanif30]ip add 192.168.3.1 24
//此处配置vlanif100是为了保证与上层的通信
[Huawei]int vlanif 100
[Huawei-Vlanif100]ip add 192.168.6.2 24
2.2 链路聚合
-
LSW3是LSW1的对端，我们将LSW1配置为了主动方，则LSW3为被动方
扫描二维码关注公众号，回复： 11001959 查看本文章
-
与二楼交换机通信的配置命令
[Huawei]int Eth-Trunk 2
[Huawei-Eth-Trunk2]mode lacp-static
[Huawei-Eth-Trunk2]trunkport g0/0/1
Info: This operation may take a few seconds. Please wait for a moment...done.
[Huawei-Eth-Trunk2]trunkport g0/0/7
Info: This operation may take a few seconds. Please wait for a moment...done.
[Huawei-Eth-Trunk2]trunkport g0/0/8
Info: This operation may take a few seconds. Please wait for a moment...done.
- 与三楼交换机通信的配置命令
//此处的链路聚合为手工负载分担
[Huawei]int Eth-Trunk 1
[Huawei-Eth-Trunk1]trunkport g0/0/5
Info: This operation may take a few seconds. Please wait for a moment...done.
[Huawei-Eth-Trunk1]trunkport g0/0/6
Info: This operation may take a few seconds. Please wait for a moment...done.
[Huawei-Eth-Trunk1]trunkport g0/0/2
Info: This operation may take a few seconds. Please wait for a moment...done.
- 查看链路聚合后的链路状态(不用配置)
[Huawei-Eth-Trunk1]dis eth-trunk 1
Eth-Trunk1's state information is:
WorkingMode: NORMAL Hash arithmetic: According to SIP-XOR-DIP
Least Active-linknumber: 1 Max Bandwidth-affected-linknumber: 8
Operate status: up Number Of Up Port In Trunk: 3
--------------------------------------------------------------------------------
PortName Status Weight
GigabitEthernet0/0/5 Up 1
GigabitEthernet0/0/6 Up 1
GigabitEthernet0/0/2 Up 1
- 此处我们可以看到三条链路都是up状态，即三条链路同时转发数据
2.3 与下层交换机通信
- 此处的原理即为vlan间通信
- 配置命令
//与二楼通信
[Huawei]int vlanif 20
[Huawei-Vlanif20]ip add 192.168.2.1 24
[Huawei]int Eth-Trunk 2
[Huawei-Eth-Trunk2]port link-type trunk
[Huawei-Eth-Trunk2]port trunk allow-pass vlan 201 202 20
[Huawei-Eth-Trunk2]q
//与三楼通信
[Huawei]int vlanif 30
[Huawei-Vlanif30]ip add 192.168.3.1 24
[Huawei]int Eth-Trunk 1
[Huawei-Eth-Trunk1]port link-type trunk
[Huawei-Eth-Trunk1]port trunk allow-pass vlan 301 302 30
[Huawei-Eth-Trunk1]q
2.4 与上层路由器通信
将所有的下层的vlan都统一汇聚为vlan100，从而与上层路由器进行通信
- 配置命令
//通过此逻辑地址与上层路由器进行通信
[Huawei]int vlanif 100
[Huawei-Vlanif100]ip add 192.168.6.2 24
[Huawei-Vlanif100]q
//与左侧路由器通信
[Huawei]int g0/0/3
[Huawei-GigabitEthernet0/0/3]port trunk allow-pass vlan 100
[Huawei-GigabitEthernet0/0/3]q
//与右侧路由器通信
[Huawei]int g0/0/4
[Huawei-GigabitEthernet0/0/4]port trunk allow-pass vlan 100
2.5 路由配置
- 此处需要配置默认路由保证与上层的通信
- 配置命令
[Huawei]ip route-static 0.0.0.0 0.0.0.0 192.168.6.1
3. AR2的配置
3.1 与下层通信
因为从LSW3发送的数据包它含有vlan标签，但是路由器不能处理带标签的数据帧，所以此处想到了通过单臂路由的方式去解决这以问题，及通过配置逻辑子接口，从而可以剥离vlan标签
- 详细介绍可以参考：vlan间通信中单臂路由部分
- 配置命令
[Huawei]int g0/0/0.1
[Huawei-GigabitEthernet0/0/0.1]ip add 192.168.6.1 24
[Huawei-GigabitEthernet0/0/0.1]dotlq termination vid 100
3.2 与上层通信
- 此处采用ospf协议
[Huawei]int g0/0/1
[Huawei-GigabitEthernet0/0/1]ip add 192.168.7.2 24
[Huawei-GigabitEthernet0/0/1]q
[Huawei]ospf
[Huawei-ospf-1]area 0
[Huawei-ospf-1-area-0.0.0.0]network 192.168.7.0 0.0.0.255
- ospf详细介绍可参考：ospf协议分析与配置
4. AR1的配置
4.1 Nat配置
- Nat协议可以保证内网与公网进行通信，此处不详细介绍
- 配置命令
//此处为可转换的的地址池
[Huawei]nat address-group 1 200.10.10.1 200.10.10.200
[Huawei]acl 2000
[Huawei-acl-basic-2000]rule 5 permit source 10.0.0.0 0.255.255.255
[Huawei-acl-basic-2000]q
[Huawei]int g0/0/0
[Huawei-GigabitEthernet0/0/0]nat outbound 2000 address-group 1 no-pat
4.2 路由配置
[Huawei]int g0/0/0
[Huawei-GigabitEthernet0/0/0]ip add 192.168.7.1 24
[Huawei-GigabitEthernet0/0/0]q
[Huawei]ospf
[Huawei-ospf-1]area 0
[Huawei-ospf-1-area-0.0.0.0]network 192.168.7.0 0.0.0.255
5. 访问控制
- 业务需要：使302教室不能访问其他网络，只能内部进行通信
- 通过访问控制列表进行实现
- 配置命令(在LSW2中配置)
//创建访问控制列表2000
[Huawei]acl 2000
[Huawei-acl-basic-2000]
//控制规则为拒绝源地址10.2.2.0网段，及302教室
[Huawei-acl-basic-2000]rule deny source 10.2.2.0 0.0.0.255
[Huawei-acl-basic-2000]q
//在链路聚合后的逻辑接口Eth-Trunk1中配置：在出方向上执行此规则
[Huawei]int Eth-Trunk 1
[Huawei-Eth-Trunk1]traffic-filter outbound acl 2000
6. 链路备份
在核心交换机与上层路由器进行通信时，为了防止左侧链路出现故障，从而配置右侧备份链路
- 配置命令
- AR3的配置
//此处配置的含义可以参考AR2的配置
[Huawei]int g0/0/0.1
[Huawei-GigabitEthernet0/0/0.1]ip add 192.168.6.3 24
[Huawei-GigabitEthernet0/0/0.1]dotlq termination vid 100
- LSW3的配置
//改变路由优先级，当左侧链路出现故障时，则会选择右侧链路
[Huawei]ip route-static 0.0.0.0 0.0.0.0 192.168.6.3 preference 70
- 同样AR3的G0/0/1接口需要配置ospf，此处不多赘述，配置命令可参考AR2的路由配置
7. 注意
以上配置只能保证二楼的所有主机正常通信，三楼的主机配置此处不多赘述。LSW2中vlan划分及通信可参考LSW1的配置，链路聚合可参考LSW3的配置
