總分部網(wǎng)絡綜合實驗（NAT+Telnet + 服務器訪問）)
實驗需求總分部出口路由器配置 NAT內(nèi)網(wǎng) PC 可 ping 通對端外網(wǎng)接口總分部、互聯(lián)網(wǎng)用戶均可訪問內(nèi)網(wǎng) WEB 服務器網(wǎng)管 VLAN20010.1.200.0/24模擬網(wǎng)管設備 Telnet 管理接入、匯聚、核心交換機。IPVLAN 規(guī)劃表格設備VLANIP 地址網(wǎng)關(guān)PC1VLAN11172.16.1.253/24172.16.1.254PC2VLAN12172.16.2.253/24172.16.2.254Server1 (內(nèi)部服務器)VLAN13172.16.3.253/24172.16.3.254AR1 模擬網(wǎng)管VLAN14172.16.4.253/24172.16.4.254PC4VLAN15172.16.5.253/24172.16.5.254Client1VLAN16172.16.6.253/24172.16.6.254SW?ACC 接入VLAN200 管理10.1.200.1/24-SW?AGG1 匯聚VLAN200 管理10.1.200.2/24-SW?CORE1 核心VLAN200 管理10.1.200.254/24-核心互聯(lián) VLAN100VLAN100172.16.100.0/24-核心互聯(lián) VLAN101VLAN101172.16.101.0/24-外網(wǎng)AR2 總部出口外網(wǎng)202.96.10.0/24AR5 分部出口外網(wǎng)202.96.20.0/24ISP1202.96.10.2、202.96.20.1、113.100.10.11、接入交換機 SW?ACCsysname SW-ACC vlan batch 11 12 200 #PC1 interface Ethernet0/0/1 port link-type access port default vlan 11 #PC2 interface Ethernet0/0/2 port link-type access port default vlan 12 #上聯(lián)匯聚Trunk interface GigabitEthernet0/0/1 port link-type trunk port trunk allow-pass vlan 11 12 200 #管理VLANIF200 interface Vlanif200 ip address 10.1.200.1 255.255.255.0 #默認路由指向匯聚管理地址 ip route-static 0.0.0.0 0.0.0.0 10.1.200.2 #Telnet AAA配置 aaa local-user admin password cipher 123456 local-user admin privilege level 15 local-user admin service-type telnet quit user-interface vty 0 4 authentication-mode aaa quit2、匯聚交換機 SW?AGG1sysname SW-AGG1 vlan batch 11 12 200 100 #下聯(lián)接入Trunk interface GigabitEthernet0/0/2 port link-type trunk port trunk allow-pass vlan 11 12 200 #上聯(lián)核心Trunk interface GigabitEthernet0/0/1 port link-type trunk port trunk allow-pass vlan 11 12 100 200 #業(yè)務網(wǎng)關(guān) interface Vlanif11 ip address 172.16.1.254 255.255.255.0 interface Vlanif12 ip address 172.16.2.254 255.255.255.0 interface Vlanif100 ip address 172.16.100.1 255.255.255.0 #管理VLANIF200 interface Vlanif200 ip address 10.1.200.2 255.255.255.0 #路由 ip route-static 0.0.0.0 0.0.0.0 172.16.100.2 ip route-static 10.1.200.254 255.255.255.255 172.16.100.2 #Telnet AAA aaa local-user admin password cipher 123456 local-user admin privilege level 15 local-user admin service-type telnet quit user-interface vty 0 4 authentication-mode aaa quit3、核心交換機 SW?CORE1sys sysname SW-CORE1 vlan batch 11 12 13 14 100 101 200 #下聯(lián)匯聚Trunk interface GigabitEthernet0/0/1 port link-type trunk port trunk allow-pass vlan 11 12 100 200 #連接AR1模擬網(wǎng)管路由器 interface GigabitEthernet0/0/19 port link-type trunk port trunk allow-pass vlan 14 #接入內(nèi)部服務器Server1 interface GigabitEthernet0/0/0 port link-type access port default vlan 13 #上聯(lián)總部出口AR2 interface GigabitEthernet0/0/3 port link-type access port de vlan 101 #VLANIF網(wǎng)關(guān) interface Vlanif11 ip address 172.16.1.254 255.255.255.0 interface Vlanif12 ip address 172.16.2.254 255.255.255.0 interface Vlanif13 ip address 172.16.3.254 255.255.255.0 interface Vlanif14 ip address 172.16.4.254 255.255.255.0 interface Vlanif100 ip address 172.16.100.2 255.255.255.0 interface Vlanif101 ip address 172.16.101.2 255.255.255.0 interface Vlanif200 ip address 10.1.200.254 255.255.255.0 #靜態(tài)路由 ip route-static 172.16.1.0 255.255.255.0 172.16.100.1 ip route-static 172.16.2.0 255.255.255.0 172.16.100.1 ip route-static 0.0.0.0 0.0.0.0 172.16.101.1 #Telnet AAA aaa local-user admin password cipher 123456 local-user admin privilege level 15 local-user admin service-type telnet quit user-interface vty 0 4 authentication-mode aaa quit4、AR1模擬網(wǎng)管路由器sys sysname AR1 interface GigabitEthernet0/0/1 #不考慮子接口的情況下 ip address 172.16.4.253 24 #訪問網(wǎng)管VLAN200 ip route-static 10.1.200.0 255.255.255.0 172.16.4.2545、AR2總部出口路由器NAT 服務器映射sysname AR2 #對接核心交換機 interface GigabitEthernet0/0/1 ip address 172.16.101.1 255.255.255.0 #對接ISP1外網(wǎng)口 interface GigabitEthernet0/0/0 ip address 202.96.10.1 255.255.255.0 #NAT感興趣流整個企業(yè)內(nèi)網(wǎng)網(wǎng)段 acl number 3000 rule permit ip source 172.16.0.0 0.0.255.255 #NAT地址池 nat address-group 1 202.96.10.10 202.96.10.20 interface GigabitEthernet0/0/0 nat outbound 3000 address-group 1 no-pat #NAT Server外網(wǎng)訪問內(nèi)部服務器Server1 172.16.3.253 nat server protocol tcp global 202.96.10.30 80 inside 172.16.3.253 80 #路由 ip route-static 172.16.0.0 255.255.0.0 172.16.101.2 ip route-static 0.0.0.0 0.0.0.0 202.96.10.26、ISP1 運營商路由器sysname ISP1 interface GigabitEthernet0/0/0 ip address 202.96.10.2 255.255.255.0 interface GigabitEthernet0/0/2 ip address 202.96.20.1 255.255.255.0 interface GigabitEthernet0/0/1 ip address 113.100.10.1 255.255.255.0 #回指企業(yè)內(nèi)網(wǎng)路由 ip route-static 172.16.0.0 255.255.0.0 202.96.10.17、AR5分部出口路由器NATsysname AR5 #對接ISP1 interface GigabitEthernet0/0/0 ip address 202.96.20.2 255.255.255.0 #對接分部交換機LSW3 interface GigabitEthernet0/0/1 ip address 172.16.5.254 255.255.255.0 acl number 3000 rule permit ip source 172.16.5.0 0.0.0.255 rule permit ip source 172.16.6.0 0.0.0.255 nat address-group 1 202.96.20.10 202.96.20.20 interface GigabitEthernet0/0/0 nat outbound 3000 address-group 1 no-pat #路由 ip route-static 0.0.0.0 0.0.0.0 202.96.20.1 ip route-static 172.16.0.0 255.255.0.0 202.96.20.18、SW3 分部交換機sys sysname SW3 vlan batch 15 16 #PC4 interface g0/0/1 port link-type access port default vlan 15 #Client1 interface g0/0/2 port link-type access port default vlan 16 #上聯(lián)AR5分部出口 interface g0/0/19 port link-type trunk port trunk allow-pass vlan 15 16 interface Vlanif15 ip address 172.16.5.254 255.255.255.0 interface Vlanif16 ip address 172.16.6.254 255.255.255.09、ISP2 互聯(lián)網(wǎng)路由器可選sysname ISP2 interface GigabitEthernet0/0/0 ip address 113.100.10.2 255.255.255.0 interface GigabitEthernet0/0/2 ip address 113.100.30.254 255.255.255.0 interface GigabitEthernet0/0/1 ip address 113.100.20.254 255.255.255.0 ip route-static 0.0.0.0 0.0.0.0 113.100.10.1?實驗驗證Telnet 網(wǎng)管測試AR1172.16.4.253執(zhí)行telnet 10.1.200.1賬號admin密碼123456依次登錄接入、匯聚、核心交換機。SW-ACCSW-AGG1SW-CORE1NAT 互通測試總部 PC1 ping 分部外網(wǎng)口202.96.20.2分部 PC4 ping 總部外網(wǎng)口202.96.10.1通表示 NAT 配置正常。WEB 服務器訪問內(nèi)網(wǎng) PC 直接訪問172.16.3.253互聯(lián)網(wǎng) PC 訪問公網(wǎng)映射地址202.96.10.30分部 PC4 也可以訪問內(nèi)網(wǎng)服務器。注意點路由器二層口命令portlink?mode layer2eNSP 中 AR 系列路由器接口切換二層模式no?pat 為多地址 NAT也可替換為 easy?ipTelnet 明文不安全生產(chǎn)環(huán)境替換 SSHPC 和服務器關(guān)閉防火墻開啟 HTTP 服務。 華為 eNSP 大型企業(yè)總分部網(wǎng)絡綜合實驗（NAT+Telnet + 服務器訪問）
實驗需求總分部出口路由器配置 NAT內(nèi)網(wǎng) PC 可 ping 通對端外網(wǎng)接口總分部、互聯(lián)網(wǎng)用戶均可訪問內(nèi)網(wǎng) WEB 服務器網(wǎng)管 VLAN20010.1.200.0/24模擬網(wǎng)管設備 Telnet 管理接入、匯聚、核心交換機。IPVLAN 規(guī)劃表格設備VLANIP 地址網(wǎng)關(guān)PC1VLAN11172.16.1.253/24172.16.1.254PC2VLAN12172.16.2.253/24172.16.2.254Server1 (內(nèi)部服務器)VLAN13172.16.3.253/24172.16.3.254AR1 模擬網(wǎng)管VLAN14172.16.4.253/24172.16.4.254PC4VLAN15172.16.5.253/24172.16.5.254Client1VLAN16172.16.6.253/24172.16.6.254SW?ACC 接入VLAN200 管理10.1.200.1/24-SW?AGG1 匯聚VLAN200 管理10.1.200.2/24-SW?CORE1 核心VLAN200 管理10.1.200.254/24-核心互聯(lián) VLAN100VLAN100172.16.100.0/24-核心互聯(lián) VLAN101VLAN101172.16.101.0/24-外網(wǎng)AR2 總部出口外網(wǎng)202.96.10.0/24AR5 分部出口外網(wǎng)202.96.20.0/24ISP1202.96.10.2、202.96.20.1、113.100.10.11、接入交換機 SW?ACCsysname SW-ACC vlan batch 11 12 200 #PC1 interface Ethernet0/0/1 port link-type access port default vlan 11 #PC2 interface Ethernet0/0/2 port link-type access port default vlan 12 #上聯(lián)匯聚Trunk interface GigabitEthernet0/0/1 port link-type trunk port trunk allow-pass vlan 11 12 200 #管理VLANIF200 interface Vlanif200 ip address 10.1.200.1 255.255.255.0 #默認路由指向匯聚管理地址 ip route-static 0.0.0.0 0.0.0.0 10.1.200.2 #Telnet AAA配置 aaa local-user admin password cipher 123456 local-user admin privilege level 15 local-user admin service-type telnet quit user-interface vty 0 4 authentication-mode aaa quit2、匯聚交換機 SW?AGG1sysname SW-AGG1 vlan batch 11 12 200 100 #下聯(lián)接入Trunk interface GigabitEthernet0/0/2 port link-type trunk port trunk allow-pass vlan 11 12 200 #上聯(lián)核心Trunk interface GigabitEthernet0/0/1 port link-type trunk port trunk allow-pass vlan 11 12 100 200 #業(yè)務網(wǎng)關(guān) interface Vlanif11 ip address 172.16.1.254 255.255.255.0 interface Vlanif12 ip address 172.16.2.254 255.255.255.0 interface Vlanif100 ip address 172.16.100.1 255.255.255.0 #管理VLANIF200 interface Vlanif200 ip address 10.1.200.2 255.255.255.0 #路由 ip route-static 0.0.0.0 0.0.0.0 172.16.100.2 ip route-static 10.1.200.254 255.255.255.255 172.16.100.2 #Telnet AAA aaa local-user admin password cipher 123456 local-user admin privilege level 15 local-user admin service-type telnet quit user-interface vty 0 4 authentication-mode aaa quit3、核心交換機 SW?CORE1sys sysname SW-CORE1 vlan batch 11 12 13 14 100 101 200 #下聯(lián)匯聚Trunk interface GigabitEthernet0/0/1 port link-type trunk port trunk allow-pass vlan 11 12 100 200 #連接AR1模擬網(wǎng)管路由器 interface GigabitEthernet0/0/19 port link-type trunk port trunk allow-pass vlan 14 #接入內(nèi)部服務器Server1 interface GigabitEthernet0/0/0 port link-type access port default vlan 13 #上聯(lián)總部出口AR2 interface GigabitEthernet0/0/3 port link-type access port de vlan 101 #VLANIF網(wǎng)關(guān) interface Vlanif11 ip address 172.16.1.254 255.255.255.0 interface Vlanif12 ip address 172.16.2.254 255.255.255.0 interface Vlanif13 ip address 172.16.3.254 255.255.255.0 interface Vlanif14 ip address 172.16.4.254 255.255.255.0 interface Vlanif100 ip address 172.16.100.2 255.255.255.0 interface Vlanif101 ip address 172.16.101.2 255.255.255.0 interface Vlanif200 ip address 10.1.200.254 255.255.255.0 #靜態(tài)路由 ip route-static 172.16.1.0 255.255.255.0 172.16.100.1 ip route-static 172.16.2.0 255.255.255.0 172.16.100.1 ip route-static 0.0.0.0 0.0.0.0 172.16.101.1 #Telnet AAA aaa local-user admin password cipher 123456 local-user admin privilege level 15 local-user admin service-type telnet quit user-interface vty 0 4 authentication-mode aaa quit4、AR1模擬網(wǎng)管路由器sys sysname AR1 interface GigabitEthernet0/0/1 #不考慮子接口的情況下 ip address 172.16.4.253 24 #訪問網(wǎng)管VLAN200 ip route-static 10.1.200.0 255.255.255.0 172.16.4.2545、AR2總部出口路由器NAT 服務器映射sysname AR2 #對接核心交換機 interface GigabitEthernet0/0/1 ip address 172.16.101.1 255.255.255.0 #對接ISP1外網(wǎng)口 interface GigabitEthernet0/0/0 ip address 202.96.10.1 255.255.255.0 #NAT感興趣流整個企業(yè)內(nèi)網(wǎng)網(wǎng)段 acl number 3000 rule permit ip source 172.16.0.0 0.0.255.255 #NAT地址池 nat address-group 1 202.96.10.10 202.96.10.20 interface GigabitEthernet0/0/0 nat outbound 3000 address-group 1 no-pat #NAT Server外網(wǎng)訪問內(nèi)部服務器Server1 172.16.3.253 nat server protocol tcp global 202.96.10.30 80 inside 172.16.3.253 80 #路由 ip route-static 172.16.0.0 255.255.0.0 172.16.101.2 ip route-static 0.0.0.0 0.0.0.0 202.96.10.26、ISP1 運營商路由器sysname ISP1 interface GigabitEthernet0/0/0 ip address 202.96.10.2 255.255.255.0 interface GigabitEthernet0/0/2 ip address 202.96.20.1 255.255.255.0 interface GigabitEthernet0/0/1 ip address 113.100.10.1 255.255.255.0 #回指企業(yè)內(nèi)網(wǎng)路由 ip route-static 172.16.0.0 255.255.0.0 202.96.10.17、AR5分部出口路由器NATsysname AR5 #對接ISP1 interface GigabitEthernet0/0/0 ip address 202.96.20.2 255.255.255.0 #對接分部交換機LSW3 interface GigabitEthernet0/0/1 ip address 172.16.5.254 255.255.255.0 acl number 3000 rule permit ip source 172.16.5.0 0.0.0.255 rule permit ip source 172.16.6.0 0.0.0.255 nat address-group 1 202.96.20.10 202.96.20.20 interface GigabitEthernet0/0/0 nat outbound 3000 address-group 1 no-pat #路由 ip route-static 0.0.0.0 0.0.0.0 202.96.20.1 ip route-static 172.16.0.0 255.255.0.0 202.96.20.18、SW3 分部交換機sys sysname SW3 vlan batch 15 16 #PC4 interface g0/0/1 port link-type access port default vlan 15 #Client1 interface g0/0/2 port link-type access port default vlan 16 #上聯(lián)AR5分部出口 interface g0/0/19 port link-type trunk port trunk allow-pass vlan 15 16 interface Vlanif15 ip address 172.16.5.254 255.255.255.0 interface Vlanif16 ip address 172.16.6.254 255.255.255.09、ISP2 互聯(lián)網(wǎng)路由器可選sysname ISP2 interface GigabitEthernet0/0/0 ip address 113.100.10.2 255.255.255.0 interface GigabitEthernet0/0/2 ip address 113.100.30.254 255.255.255.0 interface GigabitEthernet0/0/1 ip address 113.100.20.254 255.255.255.0 ip route-static 0.0.0.0 0.0.0.0 113.100.10.1?實驗驗證Telnet 網(wǎng)管測試AR1172.16.4.253執(zhí)行telnet 10.1.200.1賬號admin密碼123456依次登錄接入、匯聚、核心交換機。SW-ACCSW-AGG1SW-CORE1NAT 互通測試總部 PC1 ping 分部外網(wǎng)口202.96.20.2分部 PC4 ping 總部外網(wǎng)口202.96.10.1通表示 NAT 配置正常。WEB 服務器訪問內(nèi)網(wǎng) PC 直接訪問172.16.3.253互聯(lián)網(wǎng) PC 訪問公網(wǎng)映射地址202.96.10.30分部 PC4 也可以訪問內(nèi)網(wǎng)服務器。注意點路由器二層口命令portlink?mode layer2eNSP 中 AR 系列路由器接口切換二層模式no?pat 為多地址 NAT也可替換為 easy?ipTelnet 明文不安全生產(chǎn)環(huán)境替換 SSHPC 和服務器關(guān)閉防火墻開啟 HTTP 服務。