当前位置： 首页 > news >正文

CCNP综合实验2

news 来源：原创 2024/4/27 14:10:01

CCNP 综合实验2
 Top:
 

网络配置需求：
1，         sw1与 sw2核心交换机之前用VRRP虚拟网关冗余协议来做网关冗余与负载均衡，vlan20走SW1,VLAN30走SW2。
2，         SW3与 SW4之间做负载均衡，VLAN20流量走上面，VLAN30走下面
3，         企业内网出口通过 R17为默认主出口，如果主出口DOWN掉后可以切换掉OA出往外网，保证整个企业网络的高可用性与可靠性
4，         核心与 OA网络路由协议使用OSPF，区域可以都使用主干区域
5，         服务器区域有 HTTP，DNS等服务器，外网只能访问HTTP服务，允许PING服务器，除此之外，外部网络流量一律deny .
6，         保证内网与外网的上网需求，保证 OA企业办公网络能访问服务器与内网的所有服务。
7，         在 R17出口路由器上，做一些基本的IOS防火墙设置，减弱外部网络发起的一些DDOS分布式拒绝服务攻击。
8，         申请了三个公网地址， 202.103.78.7用于默认主出口路由器上出接口地址，把内网做PAT，服务器做静态NAT，地址是202.103.78.100.
配置如下：
SW1:
hostname sw1
ip cef
track 1 interface Ethernet2/1 line-protocol
 delay down 4
!
track 2 interface Ethernet2/0 line-protocol
 delay down 4
interface Serial0/0
 ip address 192.168.40.1 255.255.255.252
 serial restart-delay 0
interface FastEthernet1/0
 switchport mode trunk
!
interface FastEthernet1/1
 switchport mode trunk
!
interface Ethernet2/0
 ip address 192.168.40.9 255.255.255.252
 half-duplex
!
interface Ethernet2/1
 ip address 192.168.40.13 255.255.255.252
 half-duplex
interface Vlan20
 ip address 192.168.20.1 255.255.255.0
 ip helper-address 17.7.7.7
 vrrp 1 ip 192.168.20.100
 vrrp 1 timers advertise 4
 vrrp 1 priority 200
 vrrp 1 track 1 decrement 120
 vrrp 1 track 2 decremetn 120
!
interface Vlan30
 ip address 192.168.30.1 255.255.255.0
 ip helper-address 17.7.7.7
 vrrp 2 ip 192.168.30.100
 vrrp 2 timers advertise 4
!
router ospf 1
 log-adjacency-changes
 network 0.0.0.0 255.255.255.255 area 0
!
ip http server
 
SW2:
sw2#show run
hostname sw2
ip cef
track 1 interface Ethernet2/1 line-protocol
 delay down 4
!
track 2 interface Ethernet2/0 line-protocol
 delay down 4
interface Serial0/0
 ip address 192.168.40.5 255.255.255.252
 serial restart-delay 0
interface FastEthernet1/1
 switchport mode trunk
!
interface FastEthernet1/2
 switchport mode trunk
!
interface Ethernet2/0
 ip address 192.168.40.21 255.255.255.252
 half-duplex
!
interface Ethernet2/1
 ip address 192.168.40.17 255.255.255.252
 half-duplex
interface Vlan20
 ip address 192.168.20.2 255.255.255.0
 ip helper-address 17.7.7.7
 vrrp 1 ip 192.168.20.100
 vrrp 1 timers advertise 4
!
interface Vlan30
 ip address 192.168.30.2 255.255.255.0
 ip helper-address 17.7.7.7
 vrrp 2 ip 192.168.30.100
 vrrp 2 timers advertise 4
 vrrp 2 priority 200
 vrrp 2 track 1 decrement 120
 vrrp 2 track 2 decrement 120
!
router ospf 1
 log-adjacency-changes
 network 0.0.0.0 255.255.255.255 area 0
!
ip http server
  
SW3:
sw3# show run
hostname sw3
ip cef
interface FastEthernet1/0
 switchport access vlan 20
!
interface FastEthernet1/1
 switchport mode trunk
!
interface FastEthernet1/2
 switchport mode trunk
!
interface FastEthernet1/3
 switchport mode trunk
 spanning-tree vlan 20 port-priority 40
!
interface FastEthernet1/4
 switchport mode trunk
 spanning-tree vlan 30 port-priority 40
end
SW4:
sw4#show run
hostname sw4
ip cef
!
interface FastEthernet1/0
 switchport access vlan 30
!
interface FastEthernet1/1
 switchport mode trunk
!
interface FastEthernet1/2
 switchport mode trunk
!
interface FastEthernet1/3
 switchport mode trunk
 spanning-tree vlan 20 port-priority 40
!
interface FastEthernet1/4
 switchport mode trunk
 spanning-tree vlan 30 port-priority 40
!
ip http server
 
PC1:
pc1#show run
hostname pc1
no ip routing
no ip cef
ip domain name www.pc1.com
interface Ethernet2/0
 ip address dhcp
 no ip route-cache
 half-duplex
ip http server
no cdp run
end
PC2：
pc2#show run
hostname pc2
no ip routing
no ip cef
ip domain name www.pc2.com
interface Ethernet0/0
 ip address dhcp
ip http server
SERVER：
r7#
hostname r7
ip cef
ip domain name zengfei.com
ip host www.zengfei.com 17.7.7.7
ip host www.pc1.com 192.168.20.3
ip host www.pc2.com 192.168.30.3
no ip dhcp use vrf connected
!
ip dhcp pool cisco
   network 192.168.20.0 255.255.255.0
   default-router 192.168.20.100
   dns-server 17.7.7.7
   lease 2
!
ip dhcp pool san
   network 192.168.30.0 255.255.255.0
   default-router 192.168.30.100
   dns-server 17.7.7.7
   domain-name pc2.com
   lease 2
username cisco password 0 cisco
interface Loopback0
 ip address 17.7.7.7 255.255.255.0
!
interface Serial0/0
 ip address 192.168.40.2 255.255.255.252
 serial restart-delay 0
!
interface Serial0/1
 ip address 192.168.40.6 255.255.255.252
 serial restart-delay 0
router ospf 1
 log-adjacency-changes
 network 0.0.0.0 255.255.255.255 area 0
ip http server
line con 0
line aux 0
line vty 0 4
 privilege level 5
 no login
!
!
end
R8:
R8#show run
hostname R8
ip cef
interface Ethernet0/0
 ip address 192.168.40.10 255.255.255.252
interface Ethernet0/2
 ip address 192.168.40.18 255.255.255.252
 half-duplex
interface Serial2/0
 ip address 192.168.40.25 255.255.255.252
 encapsulation frame-relay
 ip ospf network point-to-multipoint
 serial restart-delay 0
router ospf 1
 log-adjacency-changes
 network 0.0.0.0 255.255.255.255 area 0
R9:
R9#show run
hostname R9
ip cef
frame-relay switching
interface Serial2/0
 no ip address
 encapsulation frame-relay
 serial restart-delay 0
 clock rate 64000
 frame-relay intf-type dce
 frame-relay route 108 interface Serial2/1 810
interface Serial2/1
 no ip address
 encapsulation frame-relay
 serial restart-delay 0
 clock rate 64000
 frame-relay intf-type dce
 frame-relay route 810 interface Serial2/0 108
R10:
R10#show run
hostname R10
ip cef
no ip domain lookup
interface Loopback0
 ip address 10.10.10.10 255.255.255.0
!
interface Ethernet0/0
 ip address 202.103.77.10 255.255.255.0
 ip nat outside
 ip virtual-reassembly
 half-duplex
!
interface Serial2/0
 ip address 192.168.40.26 255.255.255.252
 ip nat inside
 ip virtual-reassembly
 encapsulation frame-relay
 ip ospf network point-to-multipoint
 serial restart-delay 0
router ospf 1
 log-adjacency-changes
 network 10.10.10.0 0.0.0.255 area 0
 network 192.168.40.24 0.0.0.3 area 0
 default-information originate always metric 3
no ip http server
ip route 0.0.0.0 0.0.0.0 Ethernet0/0
ip nat inside source list 101 interface Ethernet0/0 overload
ip nat inside source static 17.7.7.7 202.103.78.100
access-list 101 permit ip 192.168.0.0 0.0.255.255 any
R17
hostname r17
!
ip cef
no ip domain lookup
ip inspect max-incomplete high 600
ip inspect tcp finwait-time 40
ip inspect tcp synwait-time 4
ip inspect name CBAC tcp
ip inspect name CBAC icmp
ip inspect name CBAC udp
interface FastEthernet0/0
 ip address 192.168.40.14 255.255.255.252
 ip nat inside
 ip virtual-reassembly
 duplex half
!
interface FastEthernet1/0
 ip address 192.168.40.22 255.255.255.252
 ip nat inside
 ip virtual-reassembly
 duplex half
!
interface Ethernet2/0
 ip address 202.103.78.7 255.255.255.0
 ip access-group 102 in
 ip nat outside
 ip inspect CBAC out
 ip virtual-reassembly
 rate-limit input 8000 1500 3000 conform-action transmit exceed-action drop
router ospf 1
 log-adjacency-changes
 network 192.168.40.12 0.0.0.3 area 0
 network 192.168.40.20 0.0.0.3 area 0
 default-information originate
ip classless
ip route 0.0.0.0 0.0.0.0 Ethernet2/0
ip http server
ip nat inside source list 101 interface Ethernet2/0 overload
ip nat inside source static 17.7.7.7 202.103.78.100
access-list 101 permit ip 192.168.0.0 0.0.255.255 any
access-list 102 permit tcp any host 202.103.78.100 eq www
access-list 102 permit icmp any any
access-list 102 deny    ip any any
no cdp run
end
R12:
R12#show run
hostname R12
ip cef
interface FastEthernet0/0
 ip address 202.103.77.12 255.255.255.0
interface FastEthernet1/0
 ip address 202.103.78.8 255.255.255.0
interface FastEthernet2/0
 ip address 202.103.79.12 255.255.255.0
ip http server
ip route 13.13.13.0 255.255.255.0 FastEthernet2/0
R13:
r13#show run
hostname r13
ip cef
username cisco password 0 cisco
interface Loopback0
 ip address 13.13.13.13 255.255.255.0
interface FastEthernet0/0
 ip address 202.103.79.13 255.255.255.0
 duplex auto
 speed auto
ip route 0.0.0.0 0.0.0.0 FastEthernet0/0
end
 
需求测试部分：
1， DHCP：
   
PC1:show ip interface brief
    Ethernet2/0                192.168.20.3    YES DHCP   up                    up 
PC2： Ethernet0/0                192.168.30.3    YES DHCP   up                    up 
 
2，全网 ping:
pc2#ping 192.168.30.100
 
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.30.100, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 76/325/1092 ms
pc2#ping 192.168.20.3
 
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.20.3, timeout is 2 seconds:
.!!!!
pc2#ping 13.13.13.13
 
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 13.13.13.13, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 244/382/488 ms
pc2#
PC1:
pc1#ping 192.168.20.100
 
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.20.100, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 92/312/1128 ms
pc1#ping 192.168.30.3
 
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.30.3, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 148/229/456 ms
pc1#ping 13.13.13.13
 
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 13.13.13.13, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 428/484/544 ms
pc1#
 
VRRP测试：
sw1#show vrrp brief
Interface           Grp Pri Time Own Pre State   Master addr     Group addr
Vl20                1   200 12218      Y Master 192.168.20.1    192.168.20.100
Vl30                2   100 12609      Y Backup 192.168.30.2    192.168.30.100
sw1#
 
sw2#show vrrp brief
Interface           Grp Pri Time Own Pre State   Master addr     Group addr
Vl20                1   100 12609      Y Backup 192.168.20.1    192.168.20.100
Vl30                2   200 12531      Y Master 192.168.30.2    192.168.30.100
sw2#
 
交换机间的负载均衡：
PC1：
         
VLAN20
 Spanning tree enabled protocol ieee
 Root ID     Priority    32768
             Address     cc05.0a04.0001
             Cost        19
             Port        42 (FastEthernet1/1)
             Hello Time   2 sec Max Age 20 sec Forward Delay 15 sec
 
 Bridge ID Priority     32768
             Address     cc07.0a04.0001
             Hello Time   2 sec Max Age 20 sec Forward Delay 15 sec
             Aging Time 300
 
Interface                                    Designated
Name                  Port ID Prio Cost Sts Cost Bridge ID            Port ID
-------------------- ------- ---- ----- --- ----- -------------------- -------
FastEthernet1/1       128.42   128    19 FWD     0 32768 cc05.0a04.0001 128.43
FastEthernet1/2       128.43   128    19 BLK    19 32768 cc06.0a04.0001 128.43
 
         
VLAN30
 Spanning tree enabled protocol ieee
 Root ID     Priority    32768
             Address     cc05.0a04.0002
             Cost        19
             Port        42 (FastEthernet1/1)
             Hello Time   2 sec Max Age 20 sec Forward Delay 15 sec
 
 Bridge ID Priority     32768
             Address     cc07.0a04.0002
             Hello Time   2 sec Max Age 20 sec Forward Delay 15 sec
             Aging Time 300
 
Interface                                    Designated
Name                  Port ID Prio Cost Sts Cost Bridge ID            Port ID
-------------------- ------- ---- ----- --- ----- -------------------- -------
FastEthernet1/1       128.42   128    19 FWD     0 32768 cc05.0a04.0002 128.43
FastEthernet1/2       128.43   128    19 BLK    19 32768 cc06.0a04.0002 128.43
NAT测试：
r11#
*Apr 22 18:05:55.562: NAT*: s=17.7.7.7->202.103.78.100, d=13.13.13.13 [122]
*Apr 22 18:05:55.918: NAT*: s=13.13.13.13, d=202.103.78.100->17.7.7.7 [122]
 
r11#
*Apr 22 18:06:21.326: NAT*: s=13.13.13.13, d=202.103.78.7->192.168.40.2 [130]
*Apr 22 18:06:21.394: NAT*: s=192.168.40.2->202.103.78.7, d=13.13.13.13 [131]
*Apr 22 18:06:21.546: NAT*: s=13.13.13.13, d=202.103.78.7->192.168.40.2 [131]
r11#
 
内网出口备份测试：
默认出口正常：
pc2#traceroute 13.13.13.13
 
Type escape sequence to abort.
Tracing the route to 13.13.13.13
 
 1 192.168.30.2 276 msec 156 msec 152 msec
 2 192.168.40.22 144 msec 208 msec 156 msec
 3 202.103.78.8 476 msec 584 msec 364 msec
 4 202.103.79.13 300 msec 692 msec *
默认出口 DOWN掉后，是否会从OA网络走？
pc2#traceroute 13.13.13.13
 
Type escape sequence to abort.
Tracing the route to 13.13.13.13
 
 1 192.168.30.2 164 msec 156 msec 136 msec
 2 192.168.40.18 208 msec 216 msec 140 msec
 3 192.168.40.26 300 msec 592 msec 408 msec
 4 *
    202.103.77.12 476 msec 584 msec
 5 202.103.79.13 792 msec 620 msec 384 msec
pc2#
内网访问 OA网络使用明细路由：
 
     17.0.0.0/32 is subnetted, 1 subnets
O        17.7.7.7 [110/65] via 192.168.40.6, 00:22:15, Serial0/0
O        192.168.40.25/32 [110/10] via 192.168.40.18, 00:23:05, Ethernet2/1
O        192.168.40.26/32 [110/74] via 192.168.40.18, 00:23:05, Ethernet2/1
外网用户只能访问 HTTP测试（准予PING）：
r13#connect 202.103.78.100
Trying 202.103.78.100 ...
% Destination unreachable; gateway or host down
 
r13#connect 202.103.78.100 www
Trying 202.103.78.100, 80 ... Open
^C
 
HTTP/1.1 400 Bad Request
Date: Fri, 01 Mar 2002 07:04:31 GMT
Server: cisco-IOS
Accept-Ranges: none
 
400 Bad Request
 
[Connection to 202.103.78.100 closed by foreign host]
r13#ping 202.103.78.100
 
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 202.103.78.100, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 248/434/604 ms
r13#
OA用户是否能够全部访问内网的服务：
R10#ping 17.7.7.7
 
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 17.7.7.7, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 240/316/384 m
 
R10#telnet 17.7.7.7
Trying 17.7.7.7 ... Open
 
r7#exit
 
[Connection to 17.7.7.7 closed by foreign host]
R10#coon           
R10#connet
R10#con   
R10#connect 17.7.7.7 www
Trying 17.7.7.7, 80 ... Open
^C
HTTP/1.1 400 Bad Request
Date: Fri, 01 Mar 2002 07:05:58 GMT
Server: cisco-IOS
Accept-Ranges: none
 
400 Bad Request
 
[Connection to 17.7.7.7 closed by foreign host]
R10#
限制外网不影响内网用户正常访问外网：
pc2#ping 13.13.13.13
 
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 13.13.13.13, timeout is 2 seconds:
.!!!!
Success rate is 80 percent (4/5), round-trip min/avg/max = 216/322/400 ms
pc2#telnet 13.13.13.13
Trying 13.13.13.13 ... Open
 
 
Password required, but none set
 
[Connection to 13.13.13.13 closed by foreign host]
pc2#
pc2#connect 13.13.13.13 www
Trying 13.13.13.13, 80 ... Open
^C
 
HTTP/1.1 400 Bad Request
Date: Fri, 01 Mar 2002 04:55:01 GMT
Server: cisco-IOS
Accept-Ranges: none
 
400 Bad Request
 
[Connection to 13.13.13.13 closed by foreign host]
 
内部 HTTP服务器防DDOS攻击测试略。
DNS服务器测试由于 IOS的问题，我只能给出命令了：
ip dns server
ip domain name cisco.com
ip host www.pc1.com 192.168.20.3
ip host www.pc2.com 192.168.30.3
匆匆为之，如有不当之处，还望各位指点。
注意：可能在做 VRRP实验的时候，PC客户端有PING不通虚拟网关的现象，究竟是什么原因我也不是很清楚，时通时不通。解决方法，可以把VRRP通告计时器时候改长一点，或者在VLAN下做shut再no shutdown就可以了，估计应该在做主备角色状态转换时出现的问题，不知道在真机上面会出现此问题否。
 
 
  本文转自 Bruce_F5 51CTO博客，原文链接:http://blog.51cto.com/zenfei/551551


相关文章：

  • *1 计算机基础和操作系统基础及几大协议
  • 没有ARM开发板一样移植uboot并用SKYEYE仿真
  • 如何通过httpclient获取访问域名的真实ip
  • NET客户端js调用服务器端控件的方法
  • 4周第5次课 zip压缩工具 tar打包 打包并压缩
  • Windows Server 2008R2 漫游用户配置
  • 大规模中文概念图谱CN-Probase正式发布
  • Windows XP \Windows 2003启动过程的学习及故障分析处理(五)
  • Ural State University Internal Contest October'2000 Junior Session
  • 使用React、Node.js、MongoDB、Socket.IO开发一个角色投票应用的学习过程（一）
  • pythony读取xml
  • 配置DNS支持邮件服务器域名解析，支持别名，反向查找区
  • Flash正式成为Googel Chrome浏览器内置插件
  • mysql主从切换步骤
  • GIS软件开发工具包TatukGIS Developer Kernel更新至v11.9丨附下载
  • [deviceone开发]-do_Webview的基本示例
  • css系列之关于字体的事
  • eclipse的离线汉化
  • GitUp, 你不可错过的秀外慧中的git工具
  • JS函数式编程 数组部分风格 ES6版
  • js中的正则表达式入门
  • k个最大的数及变种小结
  • Laravel核心解读--Facades
  • select2 取值 遍历 设置默认值
  • text-decoration与color属性
  • Vue UI框架库开发介绍
  • vue从创建到完整的饿了么（11）组件的使用（svg图标及watch的简单使用）
  • 初探 Vue 生命周期和钩子函数
  • 飞驰在Mesos的涡轮引擎上
  • 服务器之间，相同帐号，实现免密钥登录
  • 基于Dubbo+ZooKeeper的分布式服务的实现
  • 基于OpenResty的Lua Web框架lor0.0.2预览版发布
  • 每天10道Java面试题，跟我走，offer有！
  • 模型微调
  • 算法-图和图算法
  • 新书推荐|Windows黑客编程技术详解
  • 一个SAP顾问在美国的这些年
  • 一个完整Java Web项目背后的密码
  • 用quicker-worker.js轻松跑一个大数据遍历
  • 最简单的无缝轮播
  • 大数据全解：定义、价值及挑战
  • ​软考-高级-信息系统项目管理师教程 第四版【第14章-项目沟通管理-思维导图】​
  • ( )的作用是将计算机中的信息传送给用户,计算机应用基础 吉大15春学期《计算机应用基础》在线作业二及答案...
  • （3）(3.2) MAVLink2数据包签名(安全)
  • （C语言）编写程序将一个4×4的数组进行顺时针旋转90度后输出。
  • （论文阅读30/100）Convolutional Pose Machines
  • （一）【Jmeter】JDK及Jmeter的安装部署及简单配置
  • （一）u-boot-nand.bin的下载
  • （转）visual stdio 书签功能介绍
  • (转载)微软数据挖掘算法:Microsoft 时序算法(5)
  • .Family_物联网
  • .NET BackgroundWorker
  • .NET 中选择合适的文件打开模式（CreateNew, Create, Open, OpenOrCreate, Truncate, Append）
  • @Autowired 与@Resource的区别
  • @SuppressWarnings(unchecked)代码的作用