目录
拓扑图：
配置要求：
(1)该企业内网S1和S2核心交换机互为备份，实现链路聚合，设备冗余设计，核心交换机通过路由器R1与互联网连通。
(2)路由器R1与路由器R2通过PPP链路连接，启用PPP协议的CHAP认证功能，路由器R2为认证方，路由器R1被认证方，用户名使用路由器名称，认证加密类型密钥为：123456。
(3)路由器R1与路由器R2之间不配置路由协议，可通过默认路由配置实现网络通信。
(4)路由器R1上配置NAT地址转换，使内部计算机能访问互联网服务器Server1。
(5)所有VLAN的网关在核心交换机上实现，S1和S2核心交换机与路由器R1通过OSPF实现路由互通，认证模式和秘钥采用md51 ciper gd。
(6)在S1和S2核心交换机上分别配置DHCP服务，实现高可用的DHCP服务器双机热备，使得客户端都可以动态获取正确的IP地址。
(7)在S1和S2核心交换机启用VRRP协议，并且配置使VLAN61、VLAN62数据流默认通过S1转发，VLAN63、VLAN64数据流默认通过S2转发。
(8)整个网络启用MSTP多生成树，设置S1作为生成树实例1的根，配置VLAN61、VLAN62参与生成树实例1，配置S2作为生成树实例2的根，配置VLAN63、VLAN64参与生成树实例2。
(9)S3、S4和S5交换机作为接入层交换机，分别连接VLAN61、VLAN62、VLAN63、VLAN64虚拟局域网。
任务实施：
tips1：虚线serial需在路由器设置里将2SA拖入最后一块即可相连
tips2：统一在所有交换机、路由器关闭信息通知中心以防干扰操作
sys
un in en步骤一：交换机的基础配置
S3
v b 61 to 64 //批量创建vlan61-64
int e0/0/1
p l a
p d v 61
int e0/0/2
p l a
p d v 61
int g0/0/1 //配置g0/0/1为Trunk端口
p l t
p t a v 61 to 64 //允许vlan61-64通过
int g0/0/2
p l t
p t a v 61 to 64S4
v b 61 to 64
int e0/0/1
p l a
p d v 62
int g0/0/1
p l t
p t a v 61 to 64
int g0/0/2
p l t
p t a v 61 to 64S5
v b 61 to 64
int e0/0/1
p l a
p d v 63
int e0/0/2
p l a
p d v 64
int g0/0/1
p l t
p t a v 61 to 64
int g0/0/2
p l t
p t a v 61 to 64S1
v b 61 to 64 111
int g0/0/24
p l a
p d v 111
int g0/0/1
p l t
p t a v 61 to 64
int g0/0/2
p l t
p t a v 61 to 64
int g0/0/3
p l t
p t a v 61 to 64
q
int v 61
ip add 10.10.61.252 255.255.255.0
int v 62
ip add 10.10.62.252 255.255.255.0
int v 63
ip add 10.10.63.252 255.255.255.0
int v 64
ip add 10.10.64.252 255.255.255.0
int v 111
ip add 10.10.111.2 255.255.255.252
qS2
v b 61 to 64 112
int g0/0/24
p l a
p d v 112
int g0/0/1
p l t
p t a v 61 to 64
int g0/0/2
p l t
p t a v 61 to 64
int g0/0/3
p l t
p t a v 61 to 64
q
int v 1
ip add 10.10.101.254 255.255.255.0
int v 61
ip add 10.10.61.253 255.255.255.0
int v 62
ip add 10.10.62.253 255.255.255.0
int v 63
ip add 10.10.63.253 255.255.255.0
int v 64
ip add 10.10.64.253 255.255.255.0
int v 112
ip add 10.10.112.2 255.255.255.252
q步骤二：交换机的eth-trunk配置
S1
int e 1
p l t
p t a v 61 to 64
q
int g0/0/21
eth-trunk 1
q
int g0/0/22
eth-trunk 1
qS2
int e 1
p l t
p t a v 61 to 64
q
int g0/0/21
eth-trunk 1
q
int g0/0/22
eth-trunk 1
q步骤三：交换机的MSTP
所有交换机
stp mode mstpS1
stp instance 1 priority 0
stp instance 2 priority 4096
stp region-configuration
region-name test
revision-level 1
instance 1 vlan 61 to 62
instance 2 vlan 63 to 64
active region-configuration
qS2
stp instance 1 priority 4096
stp instance 2 priority 0
stp region-configuration
region-name test
revision-level 1
instance 1 vlan 61 to 62
instance 2 vlan 63 to 64
active region-configuration
qS3
stp region-configuration
region-name test
revision-level 1
instance 1 vlan 61 to 62
instance 2 vlan 63 to 64
active region-configuration
return
saveS4
stp region-configuration
region-name test
revision-level 1
instance 1 vlan 61 to 62
instance 2 vlan 63 to 64
active region-configuration
return
saveS5
stp region-configuration
region-name test
revision-level 1
instance 1 vlan 61 to 62
instance 2 vlan 63 to 64
active region-configuration
return
save步骤四：在交换机上配置DHCP给有线客户端使用
S1
dhcp enable
ip pool vlan61
net 10.10.61.0 mask 255.255.255.0
excluded-ip-address 10.10.61.252 10.10.61.253
gateway-list 10.10.61.254
dns-list 114.114.114.114
q
ip pool vlan62
net 10.10.62.0 mask 255.255.255.0
excluded-ip-address 10.10.62.252 10.10.62.253
gateway-list 10.10.62.254
dns-list 114.114.114.114
q
ip pool vlan63
net 10.10.63.0 mask 255.255.255.0
excluded-ip-address 10.10.63.252 10.10.63.253
gateway-list 10.10.63.254
dns-list 114.114.114.114
q
ip pool vlan64
net 10.10.64.0 mask 255.255.255.0
excluded-ip-address 10.10.64.252 10.10.64.253
gateway-list 10.10.64.254
dns-list 114.114.114.114
qS2
dhcp enable
ip pool vlan61
net 10.10.61.0 mask 255.255.255.0
excluded-ip-address 10.10.61.252 10.10.61.253
gateway-list 10.10.61.254
dns-list 114.114.114.114
q
ip pool vlan62
net 10.10.62.0 mask 255.255.255.0
excluded-ip-address 10.10.62.252 10.10.62.253
gateway-list 10.10.62.254
dns-list 114.114.114.114
q
ip pool vlan63
net 10.10.63.0 mask 255.255.255.0
excluded-ip-address 10.10.63.252 10.10.63.253
gateway-list 10.10.63.254
dns-list 114.114.114.114
q
ip pool vlan64
net 10.10.64.0 mask 255.255.255.0
excluded-ip-address 10.10.64.252 10.10.64.253
gateway-list 10.10.64.254
dns-list 114.114.114.114
q步骤五：交换机的VRRP配置
S1
int v 61
vrrp vrid 61 virtual-ip 10.10.61.254
vrrp vrid 61 priority 120
vrrp vrid 61 track interface GigabitEthernet0/0/24 reduced 30
dhcp select global
q
int v 62
vrrp vrid 62 virtual-ip 10.10.62.254
vrrp vrid 62 priority 120
vrrp vrid 62 track interface GigabitEthernet0/0/24 reduced 30
dhcp select global
q
int v 63
vrrp vrid 63 virtual-ip 10.10.63.254
dhcp select global
q
int v 64
vrrp vrid 64 virtual-ip 10.10.64.254
dhcp select global
qS2
int v 61
vrrp vrid 61 virtual-ip 10.10.61.254
dhcp select global
q
int v 62
vrrp vrid 62 virtual-ip 10.10.62.254
dhcp select global
q
int v 63
vrrp vrid 63 virtual-ip 10.10.63.254
vrrp vrid 63 priority 120
vrrp vrid 63 track interface GigabitEthernet0/0/24 reduced 30
dhcp select global
q
int v 64
vrrp vrid 64 virtual-ip 10.10.64.254
vrrp vrid 64 priority 120
vrrp vrid 64 track interface GigabitEthernet0/0/24 reduced 30
dhcp select global
q步骤六：交换机的路由配置
S1
ospf
area 0
authentication-mode md5 1 cipher gd //设置ospf验证算法为md5密码为gd
net 10.10.111.0 0.0.0.3
net 10.10.61.0 0.0.0.255
net 10.10.62.0 0.0.0.255
net 10.10.63.0 0.0.0.255
net 10.10.64.0 0.0.0.255
qS2
ospf
area 0
authentication-mode md5 1 cipher gd //设置ospf验证算法为md5密码为gd
net 10.10.112.0 0.0.0.3
net 10.10.61.0 0.0.0.255
net 10.10.62.0 0.0.0.255
net 10.10.63.0 0.0.0.255
net 10.10.64.0 0.0.0.255
q步骤七：路由器的基本配置
R1
int g0/0/0
ip add 10.10.111.1 255.255.255.252
q
int g0/0/1
ip add 10.10.112.1 255.255.255.252
q
int s1/0/0
ip add 11.11.11.1 255.255.255.252
q
R2
int s1/0/0
ip add 11.11.11.2 255.255.255.252
q
int g0/0/0
ip add 20.20.20.254 24
q步骤八：路由器的PPP配置
R1（PPP被认证方）
int s1/0/0
ppp chap user R1 //配置认证账号为R1
ppp chap password cipher 123456 //配置认证账号密码为123456
R2（PPP认证方）
int s1/0/0
ppp authentication-mode chap //设置ppp的认证模式为chap
q
aaa
local-user R1 password cipher 123456 //添加ppp认证账号和密码
local-user R1 service-type ppp
return
save步骤九：路由器的路由和nat配置
R1
ip route-static 0.0.0.0 0 Serial 1/0/0 //配置默认路由指向出口
ospf
area 0
authentication-mode md5 1 cipher gd
net 10.10.111.0 0.0.0.3 //配置内网互联网段
net 10.10.112.0 0.0.0.3
q
default-route-advertise always //宣告缺省路由
q
acl 2000
rule permit source 10.10.0.0 0.0.255.255 //配置进行NAT转换的ACL
q
int s1/0/0
nat outbound 2000
return
save实验验证：
1、在S3上查看实例一和实例二的stp如下图
2、查看S1与S2的VRRP
3、PC1-4可以自动获取IP
4、给客户端配61网段ip后，尝试获取服务器web，成功，如下图
扫一扫
1万+
到【灌水乐园】发言
