中小公司网络规划与设计（三层）
目录
3-2. 核心交换机 (S5735S-S24T4S-XA) 配置
一 、设计需求
1.当前环境
30人左右，20余台网络设备（含5台服务器），另有座机电话、监控摄像头若干，防火墙为Huawei USG6310E，核心交换机为S5735S-S24T4S-XA（待采购），接入交换机三台（Huawei S5700s-52P-LI-AC两台、TP-LINK TL-2218P一台）。一条外网专线、一条普通宽带。
2.需求
以三层互联方案为准则，设计三个网段，可互访， 服务器访问外部走外网专线，办公访问互联网走普通宽带，内部用户可通过外网访问内部服务器。
|
192.168.101.1/24 |
服务器 vlan10 |
|
192.168.102.1/24 |
办公 vlan20 |
|
192.168.103.1/24 |
座机电话、摄像头等 vlan30 |
|
192.168.100.1/30 |
防火墙与核心交换机互联地址 |
|
111.47.24.69~76 |
外网专线 |
二、网络拓扑图
网络架构总览
[ 互联网 ]
|
[ 电信专线 ] [ 普通宽带 ]
| |
+---------------+-------------+
| 华为USG防火墙 | <-- 安全网关、流量分流、NAT
| 功能：1. 双ISP接入管理 | 2. 策略路由(服务器走专线)| 3. 安全策略 enforcement|
| 4. NAT地址转换 | 5. VPN接入 |
+--------------+------------+
| (三层接口)
+--------------+--------------+
| 核心交换机 |<-- 网络核心、三层路由
| 功能：1. 所有VLAN网关 | 2. VLAN间路由 | 3. 策略路由重定向 | 4. PoE供电 | 5. DHCP服务 |
+--------------+--------------+
| (Trunk，携带VLAN 10,20,30)
+-------------------------+---------------------------+
| | |
[接入交换机A] [接入交换机B] [服务器交换机]
| 功能： | 功能： |
| 1. VLAN接入 | 1. 服务器专用接入 |
| 2. PoE供电 | 2. 端口隔离 |
| 3. Voice VLAN支持 | 3. 高带宽保证 |
(Trunk) (Trunk) (Access)
PC（Vlan20）电话/IPC（Vlan30） 服务器（vlan10）
三、网络配置方案
三层互联方案，节点网络设备配置如下：
3-1. 华为防火墙 (USG6600系列) 配置
sysname USG-Firewall
# 1. 接口配置
interface GigabitEthernet 1/0/1 # 电信专线
description To_ChinaTelecom_Leased_Line
ip address 110.110.110.110 255.255.255.248 # 电信公网IP
service-manage ping permit
security-zone untrust
interface GigabitEthernet 1/0/2 # 普通宽带
description To_Internet_Broadband
ip address dhcp-alloc
service-manage ping permit
security-zone untrust
interface GigabitEthernet 1/0/0 # 连接核心交换机
description Link_to_Core_Switch
ip address 192.168.100.1 255.255.255.252
service-manage ping permit
security-zone trust
# 2. 回程路由配置
ip route-static 192.168.101.0 255.255.255.0 192.168.100.2
ip route-static 192.168.102.0 255.255.255.0 192.168.100.2
ip route-static 192.168.103.0 255.255.255.0 192.168.100.2
# 3. 策略路由 - 服务器走专线
acl number 3001
rule 5 permit ip source 192.168.102.0 0.0.0.255 # 服务器网段
policy-based-route PBR_Server permit node 10
if-match acl 3001
apply output-interface GigabitEthernet 1/0/1 # 指向专线
# 在信任区域接口应用策略路由
interface GigabitEthernet 1/0/0
ip policy-based-route PBR_Server
# 4. NAT配置
nat address-group CT_Line 0
mode pat
section 0 110.110.110.110 110.110.110.110 # 专线公网IP
nat-policy
rule name SERVER-OUTBOUND
source-zone trust
destination-zone untrust
source-address 192.168.102.0 mask 255.255.255.0
action source-nat address-group CT_Line
rule name OFFICE-OUTBOUND
source-zone trust
destination-zone untrust
action source-nat easy-ip GigabitEthernet 1/0/2
# 5. 安全策略配置
security-policy
# 允许内部访问外部
rule name "Trust-to-Untrust"
source-zone trust
destination-zone untrust
action permit
# 允许外部访问Web服务器
rule name "Untrust-to-WebServer"
source-zone untrust
destination-zone trust
destination-address 192.168.102.10 mask 255.255.255.255
service http https
action permit
# 允许外部访问其他服务器（按需开放）
rule name "Untrust-to-AppServer"
source-zone untrust
destination-zone trust
destination-address 192.168.102.11 mask 255.255.255.255
service tcp destination 8080 8081 # 应用端口
action permit
# 允许网段间互访
rule name "Inter-VLAN-Communication"
source-zone trust
destination-zone trust
action permit
# 6. 管理配置
local-user admin
password cipher YourAdminPassword123
service-type http https ssh
level 15
ssh user admin authentication-type password
stelnet server enable
3-2. 核心交换机 (S5735S-S24T4S-XA) 配置
sysname Core-Switch
# 1. 创建VLAN
vlan batch 10 20 30
# 2. 接口配置
# 连接防火墙的接口
interface 10GE 1/0/1
description To_Firewall_USG
ip address 192.168.100.2 255.255.255.252
# 连接接入交换机的Trunk口
interface 10GE 1/0/2
description To_Access_Switch_1
port link-type trunk
port trunk allow-pass vlan 10 30
interface 10GE 1/0/3
description To_Access_Switch_2
port link-type trunk
port trunk allow-pass vlan 10 30
# 连接服务器交换机的接口
interface GigabitEthernet 0/0/1
description To_Server_Switch
port link-type access
port default vlan 20
# 3. VLAN接口配置（各网段网关）
interface Vlanif10
description Office_VLAN
ip address 192.168.101.1 255.255.255.0
interface Vlanif20
description Server_VLAN
ip address 192.168.102.1 255.255.255.0
interface Vlanif30
description VoIP_IoT_VLAN
ip address 192.168.103.1 255.255.255.0
# 4. 路由配置
ip route-static 0.0.0.0 0.0.0.0 192.168.100.1
# 5. DHCP配置（为办公和IoT网段分配IP）
dhcp enable
#
interface Vlanif10
dhcp select interface
dhcp server gateway-list 192.168.101.1
dhcp server dns-list 223.5.5.5 114.114.114.114
dhcp server excluded-ip-address 192.168.101.1 192.168.101.50 # 保留前50个IP
interface Vlanif30
dhcp select interface
dhcp server gateway-list 192.168.103.1
dhcp server dns-list 223.5.5.5 114.114.114.114
dhcp server excluded-ip-address 192.168.103.1 192.168.103.10
# 6. 管理配置
telnet server enable
ssh server enable
user-interface vty 0 4
authentication-mode aaa
user privilege level 3
protocol inbound ssh telnet
local-user admin
password cipher YourSwitchPassword123
service-type ssh telnet http https
level 15
3-3. 接入交换机 (S5700) 配置
sysname Access-Switch-1
# 1. 创建VLAN
vlan batch 10 30
# 2. 上联口配置
interface 10GE 1/0/1
description Uplink_to_Core_Switch
port link-type trunk
port trunk allow-pass vlan 10 30
# 3. 用户端口配置
# 纯PC端口
interface GigabitEthernet 0/0/1
description PC-01
port link-type access
port default vlan 10
interface GigabitEthernet 0/0/2
description PC-02
port link-type access
port default vlan 10
# IP电话+PC端口（关键配置）华为交换机的Hybrid模式完美解决这个问题
interface GigabitEthernet 0/0/3
description IP-Phone+PC-01
port link-type hybrid
port hybrid pvid vlan 30 # 默认PVID为语音VLAN
port hybrid untagged vlan 10 # PC数据不带标签发送
port hybrid tagged vlan 30 # 语音流量带标签发送
voice-vlan 30 enable # 启用Voice VLAN
poe enable
interface GigabitEthernet 0/0/4
description IP-Phone+PC-02
port link-type hybrid
port hybrid pvid vlan 30
port hybrid untagged vlan 10
port hybrid tagged vlan 30
voice-vlan 30 enable
poe enable
# 纯IP电话端口
interface GigabitEthernet 0/0/5
description IP-Phone-03
port link-type access
port default vlan 30
poe enable
# 监控摄像头端口
interface GigabitEthernet 0/0/6
description Camera-01
port link-type access
port default vlan 30
poe enable
interface GigabitEthernet 0/0/7
description Camera-02
port link-type access
port default vlan 30
poe enable
# 无线AP端口
interface GigabitEthernet 0/0/8
description Wireless-AP
port link-type access
port default vlan 10
poe enable
# 4. 管理配置
interface Vlanif10
ip address 192.168.101.100 255.255.255.0 # 管理IP
ip route-static 0.0.0.0 0.0.0.0 192.168.101.1
telnet server enable
local-user admin
password cipher YourAccessSwitchPassword123
service-type ssh telnet
level 15
3-4. 服务器交换机 (S5700) 配置
sysname Server-Switch
# 1. 创建VLAN
vlan 20
# 2. 上联口配置
interface 10GE 1/0/1
description Uplink_to_Core_Switch
port link-type access
port default vlan 20
# 3. 服务器端口配置
interface GigabitEthernet 0/0/1
description Web-Server
port link-type access
port default vlan 20
interface GigabitEthernet 0/0/2
description App-Server
port link-type access
port default vlan 20
interface GigabitEthernet 0/0/3
description NAS-Storage
port link-type access
port default vlan 20
interface GigabitEthernet 0/0/4
description Database-Server
port link-type access
port default vlan 20
# 4. 管理配置
interface Vlanif20
ip address 192.168.102.100 255.255.255.0 # 管理IP
ip route-static 0.0.0.0 0.0.0.0 192.168.102.1
telnet server enable
local-user admin
password cipher YourServerSwitchPassword123
service-type ssh telnet
level 15
3-5. 服务器网络配置示例
Web服务器 (192.168.102.10)
# Linux示例
IP地址: 192.168.102.10
子网掩码: 255.255.255.0
网关: 192.168.102.1
DNS: 223.5.5.5, 114.114.114.114
NAS存储服务器 (192.168.102.30)
# 群晖/QNAP示例
IP地址: 192.168.102.30
子网掩码: 255.255.255.0
网关: 192.168.102.1
DNS: 223.5.5.5, 114.114.114.114
3-6. 配置验证命令
3-6-1.防火墙验证
display ip routing-table # 查看路由表
display security-policy rule # 查看安全策略
display nat-policy # 查看NAT策略
display session table # 查看会话表
3-6-2.核心交换机验证
display ip routing-table # 查看路由表
display vlan # 查看VLAN信息
display interface brief # 查看接口状态
display dhcp server free-ip # 查看DHCP地址池
3-6-3.接入交换机验证
display vlan # 查看VLAN信息
display interface brief # 查看接口状态
display poe power-state # 查看PoE供电状态
这个配置提供了完整的三层互联方案，确保了网络的稳定性、安全性和可管理性。所有密码请在实际部署时更改为强密码。
DAMO开发者矩阵，由阿里巴巴达摩院和中国互联网协会联合发起，致力于探讨最前沿的技术趋势与应用成果，搭建高质量的交流与分享平台，推动技术创新与产业应用链接，围绕“人工智能与新型计算”构建开放共享的开发者生态。
更多推荐
5
0- 0
已为社区贡献1条内容
所有评论(0)