hcia复习实验-优快云博客

一·网络拓扑图

二·划分网段-------vlsm

一共三个广播域，学校内网划分两个vlan，则一共四个广播域。

整个学校网络基于192.168.1.0/24划分，需要划分四个网段，两个pc，两个路由器

2的n次方个网段，需要从主机位借给网络位n位，被借位成为子网位

192.168.1. 00 000000/26 ----192.1681.0/26

192.168.1. 01 000000/26 ----192.168.1.64/26

192.168.1. 10 000000/26 ----192.168.1.128/26

192.168.1. 11 000000/26 ----192.168.1.192/26

网络位子网位主机位

三·配置

交换机配置vlan

[sw1]vlan batch 2 3

[sw1]int g 0/0/1

[sw1-GigabitEthernet0/0/1]port link-type access

[sw1-GigabitEthernet0/0/1]port default vlan 3

[sw1-GigabitEthernet0/0/1]int g 0/0/2

[sw1-GigabitEthernet0/0/2]port link-type access

[sw1-GigabitEthernet0/0/2]port default vlan 3

[sw1-GigabitEthernet0/0/2]int g 0/0/3

[sw1-GigabitEthernet0/0/3]port link-type access

[sw1-GigabitEthernet0/0/3]port default vlan 2

[sw1]int g 0/0/4

[sw1-GigabitEthernet0/0/4]port link-type trunk

[sw1-GigabitEthernet0/0/4]port trunk allow-pass vlan 2 3

路由器配置关于vlan23的子接口

[ar2]int g 0/0/0.2

[ar2-GigabitEthernet0/0/0.2]ip address 192.168.1.65 26

[AR2-GigabitEthernet0/0/0.2]dot1q termination vid 2 ---------- 剥掉vlan2 的标签

[AR2-GigabitEthernet0/0/0.2]int g 0/0/0.3

[AR2-GigabitEthernet0/0/0.3]ip address 192.168.1.1 26

[AR2-GigabitEthernet0/0/0.3]dot1q termination vid 3

[AR2-GigabitEthernet0/0/0.2]arp broadcast enable

[AR2-GigabitEthernet0/0/0.3]arp broadcast enable

PC2用dhcp配置

[AR2]dhcp enable

[AR2]ip pool vlan 3

[AR2-ip-pool-vlan3]network 192.168.1.0 mask 26

[AR2-ip-pool-vlan3]gateway-list 192.168.1.1

[AR2-ip-pool-vlan3]dns-list 100.1.1.1

[AR2-ip-pool-vlan3]excluded-ip-address 192.168.1.2 ----------- 排除PC1的ip地址

[AR2]int g 0/0/0.3

[AR2-GigabitEthernet0/0/0.3]dhcp select global

R2和R1之间使用浮动静态路由

[AR1-GigabitEthernet0/0/0]ip address 192.168.1.193 26

[AR1-GigabitEthernet0/0/2]ip address 192.168.1.129 26

[AR2-GigabitEthernet0/0/1]ip address 192.168.1.194 26

[AR2-GigabitEthernet0/0/2]ip address 192.168.1.130 26

[AR1]ip route-static 192.168.1.0 26 192.168.1.130
[AR1]ip route-static 192.168.1.0 26 192.168.1.194 preference 70

外网配置ip

[AR1-GigabitEthernet0/0/1]ip address 13.0.0.1 24

[AR3-GigabitEthernet0/0/0]ip address 13.0.0.3 24

[AR3-GigabitEthernet0/0/1]ip address 34.0.0.3 24

[AR3-GigabitEthernet0/0/2]ip address 35.0.0.3 24

[AR4-GigabitEthernet0/0/0]ip address 34.0.0.4 24

[AR4-GigabitEthernet0/0/1]ip address 100.1.1.254 24

[AR5-GigabitEthernet0/0/0]ip address 35.0.0.5 24

[AR5-GigabitEthernet0/0/1]ip address 56.0.0.5 24

[AR6-GigabitEthernet0/0/0]ip address 56.0.0.6 24

[AR6-GigabitEthernet0/0/1]ip address 172.16.1.254 24

[AR3]interface LoopBack 0
[AR3-LoopBack0]ip address 3.3.3.3 24 ----------环回

RIP

出口和入口都需要宣告

[AR3]rip 1

[AR3-rip-1]version 2

[AR3-rip-1]network 13.0.0.0

[AR3-rip-1]network 34.0.0.0

[AR3-rip-1]network 35.0.0.0

[AR3-rip-1]network 3.0.0.0

[AR4]rip 1

[AR4-rip-1]ver 2

[AR4-rip-1]network 34.0.0.0

[AR4-rip-1]network 100.0.0.0

[AR5]rip 1

[AR5-rip-1]ver 2

[AR5-rip-1]network 35.0.0.0

[AR5-rip-1]network 56.0.0.0

补缺省路由

[AR1]ip route-static 0.0.0.0 0 13.0.0.3

[AR2]ip route-static 0.0.0.0 0 192.168.1.129

[AR2]ip route-static 0.0.0.0 0 192.168.1.193 preference 70

ACL

[AR1]acl 2000

[AR1-acl-basic-2000]rule permit source 192.168.1.0 0.0.0.255

[AR1-GigabitEthernet0/0/1]nat outbound 2000

[AR6]acl 2000
[AR6-acl-basic-2000]rule permit source 172.16.1.0 0.0.0.255
[AR6-GigabitEthernet0/0/0]nat outbound 2000
[AR6-GigabitEthernet0/0/0]nat server protocol tcp global current-interface www i
nside 172.16.1.1 www

pc1可以访问3.3.3.3，平常不可以访问

[AR2]acl 3000
[AR2-acl-adv-3000]rule deny icmp source 192.168.1.62 0.0.0.0 destination 3.3.3.3
0.0.0.0
[AR2-acl-adv-3000]rule permit ip source any
[AR2-acl-adv-3000]q
[AR2]int g 0/0/0.3
[AR2-GigabitEthernet0/0/0.3]traffic-filter inbound acl 3000

Telnet

[AR1]telnet server enable

[AR1]user-interface vty 0 4

[AR1-ui-vty0-4]authentication-mode aaa

[AR1]aaa
[AR1-aaa]local-user hcip password cipher 123456
Info: Add a new user.
[AR1-aaa]local-user hcip service-type telnet
[AR1-aaa]local-user hcip privilege level 15