Cisco组建中小型企业网络实例

组建中小型网络
1、Vlan 信息 1
VTP 2、信息 IP 、设备3 地址分配交换机、路由器详细配置 1．2
IP 地址设置# int F0/0
config）2600-R-1（ 221.215.31.129 255.255.255.0 2600-R-1 (config-if) #ip
3550-S-1 (config-if) # ip add 172.16.10.1 if) # int vlan 2……………研发中心3550-S-1 (config- 255.255.255.0
2． (config-if) 3550-S-1 int vlan 3……………质保部(config-if)
3550-S-1 255.255.255.0 172.16.30.1ip add(config-if) 3550-S-1 int vlan 4……………制造部(config-if) 3550-S-1 255.255.255.0 ip add
172.16.40.1(config-if) 3550-S-1 int vlan 5……………设备部(config-if) 3550-S-1 255.255.255.0 ip add 172.16.50.1(config-if) 3550-S-1 int vlan 6……………采购部(config-if) 3550-S-1 255.255.255.0 ip add
172.16.60.1(config-if) 3550-S-1 int vlan 7……………销售部(config-if) 3550-S-1 255.255.255.0 172.16.70.1ip add(config-if) 3550-S-1 int vlan 8……………财务部(config-if) 3550-S-1 255.255.255.0
172.16.80.1ip add(config-if) 3550-S-1 int vlan 9……………管理部(config-if) 3550-S-1 255.255.255.0 172.16.90.1ip
add(config-if)3550-S-1 int vlan 100…………总经办(config-if)3550-S-1 255.255.255.0 172.16.100.1ip add 配置VTP
3550-S-1 # vlan database
3550-S-1 (vlan) # vtp domain vtp1
3550-S-1 (vlan) # vtp server
3550-S-1 (vlan) # vtp password 123
3550-S-1 (vlan) # vtp pruning……………………………..修剪 3550-S-1 (vlan) # vlan 2 name yfzx………………………..研发中心 3550-S-1 (vlan) # vlan 3 name zbb………………………..质保部 3550-S-1 (vlan) # vlan 4 name zzb…………………………制造部 1 (vlan) # vlan 5 name sbb…………………………设备部3550-S- 1 (vlan) # vlan 6 name cgb…………………………采购部3550-S- 销售部3550-S-1 (vlan) # vlan 7 name xsb………………………
# vlan 8 name xsb………………………...财务部3550-S-1 (vlan) …………………………管理部3550-S-1 (vlan) # vlan 9 name
xsb-----------------------------------------------------------
2950-S-1 (vlan) #vtp domain vtp1
)(配置修改编号清零2950-S-1 (vlan) #vtp tran…………………透明模式客户模式2950-S-1 (vlan) #vtp client
2950-S-1 (vlan) #vtp password 123
2950-S-2 (vlan) #vtp domain vtp1
)配置修改编号清零2 (vlan) #vtp tran…………………透明模式(2950-S-客户模式2950-S-2 (vlan) #vtp client
2950-S-2 (vlan) #vtp password 123
2950-S-3 (vlan) #vtp domain vtp1
)(3 (vlan) #vtp tran…………………透明模式配置修改编号清零2950-S-客
户模式2950-S-3 (vlan) #vtp client 3． 2950-S-3 password 123 (vlan) #vtp
2950-S-4 domain vtp1
(vlan) #vtp 2950-S-4 tran…………………透明模式(#vtp 配置修改编号清零
(vlan) )客户模式client
2950-S-4 #vtp (vlan)
password 123
#vtp 2950-S-4
(vlan)
3．路由配置
2600-R-1（config）# ip route 0.0.0.0 0.0.0.0 f0/2……………...缺省路由2600-R-1（config）# ip route 192.168.0.0 255.255.0.0 192.168.1.2 3550-R-1 (config) # ip route 0.0.0.0 0.0.0.0 192.168.1.1 4．5． NAT 2600-R-1（config）# access-list 101 permit ip 192.168.0.0
0.0.255.255 192.168.0.0
0.0.255.255……………………………...内部局部地址
2600-R-1（config）# ip nat pool WAN 221.215.31.131
221.215.31.134 prefix-len 29 ………………………………定义合法 IP 地址池
2600-R-1（config）# ip nat inside sour list 101 pool WAN ……….实现
地址转换
2600-R-1（config）# int f0/1
2600-R-1（config-if）#ip nat inside………………………….定义 NAT inside 2600-R-1（config）# int f0/0
2600-R-1（config-if）# ip nat outside………………………..定义 NAT outside 端口
Vlan 流量控制
制造部、设备部 vlan 实现互访，禁止访问其它部门 vlan
制造部、设备部上班时间禁止访问 internet(8:00-12:00 2:00-6:00)
研发中心、质保部 vlan 实现互访，禁止访问其它部门 vlan
财务部 vlan 实现与采购部、销售部 vlan 的单向访问
总经办 vlan 实现与财务部、管理部 vlan 的单向访问
管理部 vlan 禁止访问其它部门 vlan
各部门 vlan 都能访问服务器区
3550-S-1(config) # time-range restrict
3550-S-1(config-time-range) # periodic daily start 12:00 to 2:00 ……….设置时间范围
3550-S-1 (config) # ip access-list extend yfzx……….研发中心 ACL 3550-S-1 (config-ext-nacl) # permit ip any 172.16.20.0
0.0.0.255
…...….访问质保部4．
3550-S-1 (config-ext-nacl) # permit ip any 172.16.100.0 0.0.0.255 ………访问服务器区
3550-S-1 (config-ext-nacl) # deny ip any 192.168.0.0 0.0.255.255 ……….禁止访问其它部门
3550-S-1 (config-ext-nacl) # permit ip any any
3550-S-1 (config) # ip access-list extend zbb……….质保部 ACL
3550-S-1 (config-ext-nacl) # permit ip any 172.16.10.0
0.0.0.255
…...….访问研发中心
3550-S-1 (config-ext-nacl) # permit ip any 172.16.100.0 0.0.0.255 ………访问服务器区
3550-S-1 (config-ext-nacl) # deny ip any 192.168.0.0 0.0.255.255 ……….禁止访问其它部门
3550-S-1 (config-ext-nacl) # permit ip any any
----------------------------------------------------------------------------
---------------
3550-S-1 (config) # ip access-list extend zzb……….制造部 ACL
3550-S-1 (config-ext-nacl) # permit ip any 172.16.40.0
0.0.0.255
…...….访问设备部
3550-S-1 (config-ext-nacl) # permit ip any 172.16.100.0 0.0.0.255 ………访问服务器区
3550-S-1 (config-ext-nacl) # deny ip any 192.168.0.0 0.0.255.255 ……….禁止访问其它部门
3550-S-1 (config-ext-nacl) # permit ip any any time-range restrict ……….上班时间禁止上网
3550-S-1 (config) # ip access-list extend sbb……….设备部 ACL
3550-S-1 (config-ext-nacl) # permit ip any 172.16.30.0 0.0.0.255 …...….访问制造部
3550-S-1 (config-ext-nacl) # permit ip any 172.16.100.0 0.0.0.255 ………访问服务器区
3550-S-1 (config-ext-nacl) # deny ip any 192.168.0.0 0.0.255.255 ……….禁止访问其它部门
3550-S-1 (config-ext-nacl) # permit ip any any
----------------------------------------------------------------------------
-------------
3550-S-1 (config) # ip access-list extend cgb……….采购部 ACL
3550-S-1 (config-ext-nacl) # evaluate cwb-cgb …..计算匹配自反 ACL 3550-S-1 (config-ext-nacl) # permit ip any 172.16.100.0 0.0.0.255 ………访问服务器区
3550-S-1 (config-ext-nacl) #deny ip any 192.168.0.0 0.0.255.255
5．
3550-S-1 (config-ext-nacl) #permit ip any any
------------------------------------------------------------------------
----
3550-S-1 (config) # ip access-list extend xsb……….销售部 ACL
3550-S-1 (config-ext-nacl) # evaluate cwb-xsb …..计算匹配自反 ACL 3550-S-1 (config-ext-nacl) # permit ip any 172.16.100.0 0.0.0.255 ………访问服务器区
3550-S-1 (config-ext-nacl) #deny ip any 192.168.0.0 0.0.255.255
3550-S-1 (config-ext-nacl) #permit ip any any
--------------------------------------------------------------------------
-------------
3550-S-1 (config) # ip access-list extend cwb……….财务部 ACL
3550-S-1 (config-ext-nacl) # permint ip any 172.16.60.00.0.0.255 reflect cwb-cgb ………...创建自反 ACL cwb-cgb
3550-S-1 (config-ext-nacl) # permint ip any 172.16.70.00.0.0.255 reflect cwb-xsb ………...创建自反 ACL cwb-xsb
3550-S-1 (config-ext-nacl) # evaluate zjb-cwb …..计算匹配自反 ACL 3550-S-1 (config-ext-nacl) # permit ip any 172.16.100.0 0.0.0.255 ………访问服务器区
3550-S-1 (config-ext-nacl) # deny ip any 192.168.0.0 0.0.255.255 ……….禁止访问其它部门
3550-S-1 (config-ext-nacl) # permit ip any any
----------------------------------------------------------------------------
----------------------
3550-S-1 (config) # ip access-list extend cwb……….管理部 ACL
3550-S-1 (config-ext-nacl) # evaluate zjb-glb …..计算匹配自反 ACL 3550-S-1 (config-ext-nacl) # permit ip any 172.16.100.0 0.0.0.255 ………访问服务器区
3550-S-1 (config-ext-nacl) # deny ip any 192.168.0.0 0.0.255.255 ……….禁止访问其它部门
3550-S-1 (config-ext-nacl) # permit ip any any
----------------------------------------------------------------------------
------------------------
3550-S-1 (config) # ip access-list extend zjb……….总经办 ACL
3550-S-1 (config-ext-nacl) # permint ip any 172.16.80.00.0.0.255 reflect zjb-cwb ………...创建自反 ACL zjb-cwb
3550-S-1 (config-ext-nacl) # permint ip any 172.16.90.00.0.0.255 reflect zjb-glb ………...创建自反 ACL zjb-glb
3550-S-1 (config-ext-nacl) # permit ip any 172.16.100.0 0.0.0.255 6．
………访问服务器区
3550-S-1 (config-ext-nacl) # deny ip any 192.168.0.0 0.0.255.255 ……….禁止访问其它部门
3550-S-1 (config-ext-nacl) # permit ip any any
ACL 应用：3550-S-1
3550-S-1 (config) # int vlan 2 …………..研发中心
3550-S-1 (config-if) #ip access-group yfzx in
3550-S-1 (config) # int vlan 3 …………..质保部
3550-S-1 (config-if) #ip access-group zbb in
3550-S-1 (config) # int vlan 4 ……………制造部
(config-if) #ip access-group zzb in…(略)
附：关键字 established 的 ACL 应用(单向访问)
3550-S-1 (config) # ip access-list extend cgb……….采购部 ACL
3550-S-1 (config-ext-nacl) # permit ip any 172.16.80.0 0.0.0.0.255 estab
3550-S-1 (config-ext-nacl) # permit ip any 172.16.100.0 0.0.0.255
………访问服务器区
3550-S-1 (config-ext-nacl) #deny ip any 192.168.0.0 0.0.255.255
3550-S-1 (config-ext-nacl) #permit ip any any
3550-S-1 (config) # ip access-list extend xsb……….销售部 ACL
3550-S-1 (config-ext-nacl) # permit ip any 172.16.80.0 0.0.0.0.255 estab
3550-S-1 (config-ext-nacl) # permit ip any 172.16.100.0 0.0.0.255 ………访问服务器区
3550-S-1 (config-ext-nacl) #deny ip any 192.168.0.0 0.0.255.255
3550-S-1 (config-ext-nacl) #permit ip any any
1、Vlan 信息 7网络地址名称描述Vlan ID
无本地 vlan 172.16.10.0/24 1
研发中心 yfzx
2
172.16.20.0/24
VTP 2、信息 IP 、设备3交换机、路由器详细配置地址分配．18
IP 地址设置）# int F0/0 （config2600-R-1
质保部zbb
3 172.16.30.0/2
4 221.215.31.129 255.255.255.0
2600-R-1 (config-if) #ip add制造部zzb
4 172.16.40.0/24
设备部sbb 5 172.16.50.0/24
采购部cgb 172.16.60.0/24 6
销售部xsb 7 172.16.70.0/24
财务部cwb 172.16.80.0/24 8
管理部glb 9 172.16.90.0/24
总经办zjb
100
172.16.100.0/24
IP描述接口设备名称地址
F0/0 WAN 221.215.31.129/29 2600-R-1 - 192.168.1.1/24 F0/1
3L-Switch
192.168.1.2/24
3550-S-1
F0/1
2600-R-1 (config-if) #no shutdown
----------------------------------
2600-R-1（config-if）# int F0/1
2600-R-1 (config-if) #ip add 192.168.1.1 255.255.255.0
2600-R-1 (config-if) #no shutdown
3550-S-1 (config) # int F0/1
3550-S-1 (config-if) # no switchport……….路由端口
3550-S-1 (config-if) # ip add 192.168.1.2 255.255.255.0
3550-S-1 (config) # int vlan 1 ……………..管理 vlan
3550-S-1 (config-if) # ip add 192.168.10.1 255.255.255.0
3550-S-1 (config-if) # int vlan 2……………研发中心
3550-S-1 (config-if) # ip add 192.168.20.1 255.255.255.0
3550-S-1 (config-if) # int vlan 3……………质保部
3550-S-1 (config-if) # ip add 192.168.30.1 255.255.255.0
3550-S-1 (config-if) # int vlan 4……………制造部
3550-S-1 (config-if) # ip add 192.168.40.1 255.255.255.0
3550-S-1 (config-if) # int vlan 5……………设备部
3550-S-1 (config-if) # ip add 192.168.50.1 255.255.255.0
3550-S-1 (config-if) # int vlan 6……………采购部
3550-S-1 (config-if) # ip add 192.168.60.1 255.255.255.0
3550-S-1 (config-if) # int vlan 7……………销售部
3550-S-1 (config-if) # ip add 192.168.70.1 255.255.255.0
3550-S-1 (config-if) # int vlan 8……………财务部
3550-S-1 (config-if) # ip add 192.168.80.1 255.255.255.0
3550-S-1 (config-if) # int vlan 9……………管理部
3550-S-1 (config-if) # ip add 192.168.90.1 255.255.255.0
3550-S-1 (config-if) # int vlan 100…………总经办
3550-S-1 (config-if) # ip add192.168.100.1255.255.255.0 2．9 VTP 配置# vlan database config）3550-S-1（3550-S-1 (vlan) # vtp domain vtp1
3550-S-1 (vlan) # vtp server
3550-S-1 (vlan) # vtp password 123
vtp pruning……………………………..修剪3550-S-1 (vlan) #
1 (vlan) # vlan
2 name yfzx………………………..研发中心3550-S- 3550-S-1 (vlan) # vlan
3 name zbb………………………....质保部 1 (vlan) # vlan
4 name zzb…………………………制造部3550-S- 1 (vlan) # vlan
5 name sbb…………………………设备部3550-S- 3550-S-1 (vlan) # vlan
6 name cgb…………………………采购部 3550-S-1 (vlan) # vlan
7 name xsb…………………………销售部 3550-S-1 (vlan) # vlan
8 name xsb……………………….....财务部 1 (vlan) # vlan
9 name xsb…………………………管理部
3550-S----------------------------------------------------------
--
2950-S-1 (vlan) #vtp domain vtp1
2950-S-1 (vlan) #vtp tran…………………透明模式(配置修改编号清零)客户模式2950-S-1 (vlan) #vtp client
2950-S-1 (vlan) #vtp password 123
2950-S-2 (vlan) #vtp domain vtp1
2950-S-2 (vlan) #vtp tran…………………透明模式(配置修改编号清零)客户模式2950-S-2 (vlan) #vtp client
2950-S-2 (vlan) #vtp password 123
2950-S-3 (vlan) #vtp domain vtp1
2950-S-3 (vlan) #vtp tran…………………透明模式(配置修改编号清零)客户模式2950-S-3 (vlan) #vtp client
2950-S-3 (vlan) #vtp password 123
2950-S-4 (vlan) #vtp domain vtp1
2950-S-4 (vlan) #vtp tran…………………透明模式(配置修改编号清零)客户模式2950-S-4 (vlan) #vtp client
2950-S-4 (vlan) #vtp password 123
3．路由配置
2600-R-1（config）# ip route 0.0.0.0 0.0.0.0 f0/2……………...缺省路由2600-R-1（config）# ip route 192.168.0.0 255.255.0.0 192.168.1.2
3550- R -1 (config) # ip route 0.0.0.0 0.0.0.0 192.168.1.1 ．45． NAT 2600-R-1（config）# access-list 101 permit ip 192.168.0.0
0.0.255.255 192.168.0.0
0.0.255.255……………………………...内部局部地址
2600-R-1（config）# ip nat pool WAN 221.215.31.131
221.215.31.134 prefix-len 29 ………………………………定义合法 IP 地址池
2600-R-1（config）# ip nat inside sour list 101 pool WAN ……….实现
地址转换
2600-R-1（config）# int f0/1
2600-R-1（config-if）#ip nat inside………………………….定义 NAT inside 2600-R-1（config）# int f0/0
2600-R-1（config-if）# ip nat outside………………………..定义 NAT outside 端口
Vlan流量控制
制造部、设备部 vlan 实现互访，禁止访问其它部门 vlan
制造部、设备部上班时间禁止访问 internet(8:00-12:00 2:00-6:00)
研发中心、质保部 vlan 实现互访，禁止访问其它部门 vlan
财务部 vlan 实现与采购部、销售部 vlan 的单向访问10．
总经办 vlan 实现与财务部、管理部 vlan 的单向访问
管理部 vlan 禁止访问其它部门 vlan
各部门 vlan 都能访问服务器区
3550-S-1(config) # time-range restrict
3550-S-1(config-time-range) # periodic daily start 12:00 to 2:00 ……….设置时间范围
3550-S-1 (config) # ip access-list extend yfzx……….研发中心 ACL 3550-S-1 (config-ext-nacl) # permit ip any 172.16.20.0
0.0.0.255
…...….访问质保部
3550-S-1 (config-ext-nacl) # permit ip any 172.16.100.0 0.0.0.255 ………访问服务器区
3550-S-1 (config-ext-nacl) # deny ip any 192.168.0.0 0.0.255.255 ……….禁止访问其它部门
3550-S-1 (config-ext-nacl) # permit ip any any
3550-S-1 (config) # ip access-list extend zbb……….质保部 ACL 3550-S-1 (config-ext-nacl) # permit ip any 172.16.10.0
0.0.0.255
…...….访问研发中心
3550-S-1 (config-ext-nacl) # permit ip any 172.16.100.0 0.0.0.255 ………访问服务器区
3550-S-1 (config-ext-nacl) # deny ip any 192.168.0.0 0.0.255.255 ……….禁止访问其它部门
3550-S-1 (config-ext-nacl) # permit ip any any
----------------------------------------------------------------------------
---------------
3550-S-1 (config) # ip access-list extend zzb……….制造部 ACL 3550-S-1 (config-ext-nacl) # permit ip any 172.16.40.0
0.0.0.255
…...….访问设备部
3550-S-1 (config-ext-nacl) # permit ip any 172.16.100.0 0.0.0.255 ………访问服务器区
3550-S-1 (config-ext-nacl) # deny ip any 192.168.0.0 0.0.255.255 ……….禁止访问其它部门
3550-S-1 (config-ext-nacl) # permit ip any any time-range restrict ……….上班时间禁止上网
3550-S-1 (config) # ip access-list extend sbb……….设备部 ACL 3550-S-1 (config-ext-nacl) # permit ip any 172.16.30.0 0.0.0.255 …...….访问制造部
3550-S-1 (config-ext-nacl) # permit ip any 172.16.100.0 0.0.0.255 ………访问服务器区11．
3550-S-1 (config-ext-nacl) # deny ip any 192.168.0.0 0.0.255.255 ……….禁止访问其它部门
3550-S-1 (config-ext-nacl) # permit ip any any
----------------------------------------------------------------------------
-------------
3550-S-1 (config) # ip access-list extend cgb……….采购部 ACL
3550-S-1 (config-ext-nacl) # evaluate cwb-cgb …..计算匹配自反 ACL 3550-S-1 (config-ext-nacl) # permit ip any 172.16.100.0 0.0.0.255 ………访问服务器区
3550-S-1 (config-ext-nacl) #deny ip any 192.168.0.0 0.0.255.255
3550-S-1 (config-ext-nacl) #permit ip any any
------------------------------------------------------------------------
----
3550-S-1 (config) # ip access-list extend xsb……….销售部 ACL
3550-S-1 (config-ext-nacl) # evaluate cwb-xsb …..计算匹配自反 ACL 3550-S-1 (config-ext-nacl) # permit ip any 172.16.100.0 0.0.0.255 ………访问服务器区
3550-S-1 (config-ext-nacl) #deny ip any 192.168.0.0 0.0.255.255
3550-S-1 (config-ext-nacl) #permit ip any any
--------------------------------------------------------------------------
-------------
3550-S-1 (config) # ip access-list extend cwb……….财务部 ACL
3550-S-1 (config-ext-nacl) # permint ip any 172.16.60.00.0.0.255 reflect cwb-cgb ………...创建自反 ACL cwb-cgb
3550-S-1 (config-ext-nacl) # permint ip any 172.16.70.00.0.0.255 reflect cwb-xsb ………...创建自反 ACL cwb-xsb
3550-S-1 (config-ext-nacl) # evaluate zjb-cwb …..计算匹配自反 ACL 3550-S-1 (config-ext-nacl) # permit ip any 172.16.100.0 0.0.0.255 ………访问服务器区
3550-S-1 (config-ext-nacl) # deny ip any 192.168.0.0 0.0.255.255 ……….禁止访问其它部门
3550-S-1 (config-ext-nacl) # permit ip any any
---------------------------------------------------------------
-------------
----------------------
3550-S-1 (config) # ip access-list extend cwb……….管理部 ACL
3550-S-1 (config-ext-nacl) # evaluate zjb-glb …..计算匹配自反 ACL 3550-S-1 (config-ext-nacl) # permit ip any 172.16.100.0 0.0.0.255 ………访问服务器区
3550-S-1 (config-ext-nacl) # deny ip any 192.168.0.0 0.0.255.255 ……….禁止访问其它部门
3550-S-1 (config-ext-nacl) # permit ip any any
12．----------------------------------------------------------------------------
------------------------
3550-S-1 (config) # ip access-list extend zjb……….总经办 ACL
3550-S-1 (config-ext-nacl) # permint ip any 172.16.80.00.0.0.255 reflect zjb-cwb ………...创建自反 ACL zjb-cwb
3550-S-1 (config-ext-nacl) # permint ip any 172.16.90.00.0.0.255 reflect zjb-glb ………...创建自反 ACL zjb-glb
3550-S-1 (config-ext-nacl) # permit ip any 172.16.100.0 0.0.0.255 ………访问服务器区
3550-S-1 (config-ext-nacl) # deny ip any 192.168.0.0 0.0.255.255 ……….禁止访问其它部门
3550-S-1 (config-ext-nacl) # permit ip any any
ACL 应用：3550-S-1
3550-S-1 (config) # int vlan 2 …………..研发中心
3550-S-1 (config-if) #ip access-group yfzx in
3550-S-1 (config) # int vlan 3 …………..质保部
3550-S-1 (config-if) #ip access-group zbb in
3550-S-1 (config) # int vlan 4 ……………制造部
(config-if) #ip access-group zzb in…(略)
附：关键字 established 的 ACL 应用(单向访问)
3550-S-1 (config) # ip access-list extend cgb……….采购部 ACL
3550-S-1 (config-ext-nacl) # permit ip any 172.16.80.0 0.0.0.0.255 estab
3550-S-1 (config-ext-nacl) # permit ip any 172.16.100.0 0.0.0.255 ………访问服务器区
3550-S-1 (config-ext-nacl) #deny ip any 192.168.0.0 0.0.255.255
3550-S-1 (config-ext-nacl) #permit ip any any
3550-S-1 (config) # ip access-list extend xsb……….销售部 ACL
3550-S-1 (config-ext-nacl) # permit ip any 172.16.80.0 0.0.0.0.255
estab
3550-S-1 (config-ext-nacl) # permit ip any 172.16.100.0 0.0.0.255 ………访问服务器区
3550-S-1 (config-ext-nacl) #deny ip any 192.168.0.0 0.0.255.255 3550-S-1 (config-ext-nacl) #permit ip any any
13。