【无标题】

传奇屁王447

543人浏览 · 2026-04-08 23:10:26

传奇屁王447 · 2026-04-08 23:10:26 发布

需求--

1.所有PC均需要通过DHCP获取IP地址-地址池名称和设备VLAN一致，例如PC1-ip pool vlan10,其中只有业务B网络用户需要访问互联网web服务-需要DNS信息。
2.交换机配置VLAN需要遵循最小VLAN透传原则
3.利用OSPF协议使内外用户互相访问-全网可达（设备Router-ID需要手工配置，和设备编号一致，例如R1-RID：1.1.1.1），并采用精准宣告的方式进行宣告（例如：172.16.64.1/24接口，宣告：172.16.64.1 0.0.0.0）
4.内网全网可达，并且需要尽可能减小路由表条目数量（汇总采用精确汇总方式），能够利用缺省省去的配置可省略，防止环路，并且保障安全（在OSPF区域0需要配置认证-采用MD5认证，密码为123456），企业内网所有用户网段能够汇总都需要尽量汇总;OSPF网络用户终端不能收到OSPF协议报文。
5.内网所有用户均可访问互联网（边界路由器配置NAT），ACL采用基础ACL，编号为2000，R3-0/0/2接口不允许宣告在内网中（包含静态）。
6.test设备需要远程登陆到内网telnet-server设备,登录账号为 huawei 密码 123456，登录权限为最高。
7.不允许VLAN 40和VLAN 50 用户访问内网B业务，acl编号为2001（在R3设备0/0/0接口配置），不允许PC1访问PC5，ACL编号为3000。
8.R3-R4中间百兆链路作为备份链路，不允许正常情况下数据通过，需要降低优先级数值配置为100。
9.所有设备严格按照拓扑图标识进行配置，注意大小写。
10.图示中所有服务器和client设备均为体现需求，地址固定，不做更改，在配置时需求注意。clinet1用来模拟内网用户访问互联网（ISP-服务器），test设备用来测试互联网用户远程登陆内网telent-server主机。

。

一、企业A内网配置思路

1、配置IP地址

2、配置vlan技术

（1）创建vlan

（2）将接口加到相应vlan

（3）配置trunk链路，放行相应vlan

（4）配置单臂路由子接口

3、配置DHCP技术

（1）启动DHCP服务

（2）创建地址池

（3）在网关接口下发DHCP服务，是的PC获得IP地址

4、配置OSPF协议

（1）创建OSPF的协议进程，配置RID

（2）进入相应的area，network网段（接口地址）

（3）查看OSPF的邻居表、路由表。做全网通测试---ping测试

5、配置OSPF的区域汇总--ABR汇总，精简路由表的路由条目数量。

6、配置静态路由空接口防环

7、配置OPSF区域0的认证

8、配置easy ip 实现内网访问外网

9、让OSPF协议下发缺省，给内网路由器，保证内网设备访问外网

10、配置telnet服务器，配置NAT SERVER实现外网访问内网的服务

11、配置基础ACL和高级ACL实现访问控制

二、企业B内网配置思路

1、配置IP地址

2、配置vlan技术

3、配置DHCP技术，使得PC获得IP地址

4、配置静态路由协议，使得全网通（PING）

5、配置静态路由空接口防环

6、配置静态缺省保证内网设备访问

7、配置静态浮动路由，实现正常走千兆，千兆故障时，走百兆

三、公网通

1、配置IP地址

实验地址规划思路：总网段 172.16.0.0/17 OSPF 172.16.0.0/18 AREA 0 172.16.0.0/24 172.16.1.0/24 172.16.2.0/24 172.16.3.0/24 172.16.4.0/24 172.16.5.0/24 172.16.64.0/18-AREA 1 172.16.64.0/24 172.16.65.0/24 172.16.66.0/24 172.16.67.0/24 172.16.68.0/24 172.16.69.0/24 172.16.70.0/24 172.16.0.0/16 172.16.128.0/17 静态业务B 172.16.128.0/24 用户 172.16.128.0/25 172.16.128.128/25 链路 172.16.129.0/24 172.16.130.0/24 172.16.131.0/24 172.16.132.0/24 172.16.133.0/24 172.16.134.0/24 172.16.135.0/24 IP 地址规划总网段172.16.0.0/16 IP 地址即VLAN 规划表OSPF 内网 /172.16.0.0/17; 区域1-172.16.64.0/18, 区域0 172.16.0.0/1

PC1 PC2 10 20 172.16.64.0/24 172.16.64.254/24 172.16.64.1 (R1 0/0/1.1) 172.16.65.0/24 172.16.65.254/24 telnet server R1-R2 30 / 172.16.66.0/24 172.16.66.254/24 （手工配置） 172.16.65.1 (R1 0/0/1.2) 172.16.66.1 (R1 0/0/1.3) 172.16.67.0/24 PC3 PC4 40 50 172.16.0.0/24 R1-172.16.67.1/24 R2 172.16.67.2/24 172.16.0.254/24 / 172.16.0.1 (R2 0/0/1.1) 172.16.1.0/24 R2-R3 / 172.16.2.0/24 172.16.1.254/24 IP 地址即VLAN 规划表ISP 静态网络 /172.16.128.0/17 （VLAN 60/70 可汇总） DNS/client1 60 PC5 R3-R4 R3-R4 R4-R5 70 / 172.16.1.1 (R2 0/0/1.2) R2-172.16.2.1/24 R3 172.16.2.2/24 设备VALN 网段地址网关 172.16.128.0/25 172.16.128.128/25 千兆链路-172.16.129.0/24 百兆链 / / 路-172.16.130.0/24 172.16.131.0/24 DNS-172.16.128.126/25 client1-172.16.128.125/24 172.16.128.254/25 R3-172.16.129.1/24 R4 172.16.129.2/24 R3-172.16.130.1/24 R4 172.16.130.2/24 R4-172.16.131.1/24 R5 172.16.131.2/24 / 172.16.128.1 (R7-0/0/2.1) 172.16.128.129 (R7-0/0/2.2) / / / 设备VALN 网段地址网关 R4-R6 R5-R7 R6-R7 / / 172.16.132.0/24 172.16.133.0/24 R4-172.16.132.1/24 R6 172.16.132.2/24 / R5-172.16.133.1/24 R7 172.16.133.2/24 / 172.16.134.0/24 ISP 互联网出口区IP 地址规划： R6-172.16.134.1/24 R7 172.16.134.2/24 互联网-ISP 区域，不做 VLAN / / 要求，网段为 100.0.0.0/24 ，口0 /0/2-IP 地址为 100.0.0.1 ， test-IP 地址为 100.0.0.2 R3 出接，其余设备IP 地址符合网段要求即可。设备网段地址 R3 100.0.0.0/24 R3-100.0.0.1 test-IP-100.0.0.

[sw1]int g 0/0/2

[sw1-GigabitEthernet0/0/2]port link-type access

[sw1-GigabitEthernet0/0/2]port default vlan 10

[sw1-GigabitEthernet0/0/2]int g 0/0/3

[sw1-GigabitEthernet0/0/3]port link-type access

[sw1-GigabitEthernet0/0/3]port default vlan 20

[sw1-GigabitEthernet0/0/3]int g 0/0/4

[sw1-GigabitEthernet0/0/4]port link-type access

[sw1-GigabitEthernet0/0/4]port default vlan 30

[sw2]int g 0/0/2

[sw2-GigabitEthernet0/0/2]port link-type access

[sw2-GigabitEthernet0/0/2]port default vlan 40

[sw2-GigabitEthernet0/0/2]int g 0/0/3

[sw2-GigabitEthernet0/0/3]port link-type access

[sw2-GigabitEthernet0/0/3]port default vlan 50

[sw1-GigabitEthernet0/0/1]port link-type trunk

[sw1-GigabitEthernet0/0/1]port trunk allow-pass vlan 10 20 30

[sw2-GigabitEthernet0/0/3]int g 0/0/1

[sw2-GigabitEthernet0/0/1]port link-type trunk

[sw2-GigabitEthernet0/0/1]port trunk allow-pass vlan 40 50

[R1]int g 0/0/1.1

[R1-GigabitEthernet0/0/1.1]ip add 172.16.64.1 24

[R1-GigabitEthernet0/0/1.1]dot1q termination vid 10

[R1-GigabitEthernet0/0/1.1]arp broadcast enable

[R1-GigabitEthernet0/0/1.1]int g 0/0/1.2

[R1-GigabitEthernet0/0/1.2]dot1q termination vid 20

[R1-GigabitEthernet0/0/1.2]arp broadcast enable

[R1-GigabitEthernet0/0/1.2]ip add 172.16.65.1 24

[R1-GigabitEthernet0/0/1.2]dot1q termination vid 20

[R1-GigabitEthernet0/0/1.2]arp broadcast enable

Info: This interface has already been configured with ARP broadcast.

[R1-GigabitEthernet0/0/1.2]int g 0/0/1.3

[R1-GigabitEthernet0/0/1.3]ip add 172.16.66.1 24

[R1-GigabitEthernet0/0/1.3]dot1q termination vid 30

[R1-GigabitEthernet0/0/1.3]arp broadcast enable

[R2]int g 0/0/1.4

[R2-GigabitEthernet0/0/1.4]ip add 172.16.0.1 24

[R2-GigabitEthernet0/0/1.4]dot1q termination vid 40

[R2-GigabitEthernet0/0/1.4]arp broadcast enable

[R2-GigabitEthernet0/0/1.4]int g 0/0/1.5

[R2-GigabitEthernet0/0/1.5]dot1q termination vid 50

[R2-GigabitEthernet0/0/1.5]arp broadcast enable

[R2-GigabitEthernet0/0/1.5]ip add 172.16.1.1 24

[R2-GigabitEthernet0/0/1.5]

Apr 8 2026 14:49:30-08:00 R2 %%01IFNET/4/LINK_STATE(l)[3]:The line protocol IP

on the interface GigabitEthernet0/0/1.5 has entered the UP state.

[R2-GigabitEthernet0/0/1.5]dot1q termination vid 50

[R2-GigabitEthernet0/0/1.5]arp broadcast enable

DHCP

[R1]dhcp enable

[R1]ip pool vlan10

Info: It's successful to create an IP address pool.

[R1-ip-pool-vlan10]network 172.16.64.0 mask 24

[R1-ip-pool-vlan10]gateway

[R1-ip-pool-vlan10]gateway-list 172.16.64.1

[R1-ip-pool-vlan10]dns-list 8.8.8.8 114.114.114.114

[R1-ip-pool-vlan10]q

[R1]ip pool vlan20

Info: It's successful to create an IP address pool.

[R1-ip-pool-vlan20]network 172.16.65.0 mask 24

[R1-ip-pool-vlan20]gateway-list 172.16.65.1

[R1-ip-pool-vlan20]dns-list 8.8.8.8 114.114.114.114

[R1-ip-pool-vlan20]q

[R1]ip pool vlan30

Info: It's successful to create an IP address pool.

[R1-ip-pool-vlan30]network 172.16.66.0 mask 24

[R1-ip-pool-vlan30]gateway-list 172.16.66.1

[R1-ip-pool-vlan30]dns-list 8.8.8.8 114.114.114.114

[R1]int g 0/0/1.1

[R1-GigabitEthernet0/0/1.1]dhcp select global

[R1-GigabitEthernet0/0/1.1]q

[R1]int g 0/0/1.2

[R1-GigabitEthernet0/0/1.2]dhcp select global

[R1-GigabitEthernet0/0/1.2]q

[R1]int g 0/0/1.3

[R1-GigabitEthernet0/0/1.3]dhcp select global

[Huawei]dhcp enable

[Huawei]int g 0/0/0

[Huawei-GigabitEthernet0/0/0]ip add dhcp-alloc

OSPF

[R1]ospf 1 router-id 1.1.1.1

[R1-ospf-1]a 1

[R1-ospf-1-area-0.0.0.1]net

[R1-ospf-1-area-0.0.0.1]network 172.16.67.1 0.0.0.0

[R1-ospf-1-area-0.0.0.1]network 172.16.64.1 0.0.0.0

[R1-ospf-1-area-0.0.0.1]network 172.16.65.1 0.0.0.

[R1-ospf-1-area-0.0.0.1]network 172.16.66.1 0.0.0.0

[R1-ospf-1-area-0.0.0.1]network 172.16.65.1 0.0.0.0

[R1-ospf-1-area-0.0.0.1]q

[R2]ospf 2 router-id 2.2.2.2

[R2-ospf-2]a 0

[R2-ospf-2-area-0.0.0.0]net

[R2-ospf-2-area-0.0.0.0]q

[R2-ospf-2]undo a 0

[R2-ospf-2]a 1

[R2-ospf-2-area-0.0.0.1]net

[R2-ospf-2-area-0.0.0.1]network 172.16.67.2 0.0.0.0

[R2-ospf-2-area-0.0.0.1]a 0

[R2-ospf-2-area-0.0.0.0]network 172.16.2.1 0.0.0.0

[R2-ospf-2-area-0.0.0.0]network 172.16.0.1 0.0.0.0

[R2-ospf-2-area-0.0.0.0]network 172.16.1.1 0.0.0.0

[R3]ospf 3 rou

[R3]ospf 3 router-id 3.3.3.3

[R3-ospf-3]a 0

[R3-ospf-3-area-0.0.0.0]net

[R3-ospf-3-area-0.0.0.0]network 172.16.2.2 0.0.0.0

企业B

[R3] int g 0/0/1

[R3-GigabitEthernet0/0/1]ip add 172.16.129.1 24

[R3-GigabitEthernet0/0/1]int e 4/0/0

[R3-Ethernet4/0/0]ip add 172.16.130.1 24

[R4]int g 0/0/0

[R4-GigabitEthernet0/0/0]ip add 172.16.129.2 24

[R4-GigabitEthernet0/0/0]int e 4/0/0

[R4-Ethernet4/0/0]ip add 172.16.130.2 24

[R4-Ethernet4/0/0]int g 0/0/1

[R4-GigabitEthernet0/0/1]ip add 172.16.131.1 24

[R5]INT G 0/0/0

[R5-GigabitEthernet0/0/0]ip add 172.16.131.2 24

[R5-GigabitEthernet0/0/0]INT G 0/0/1

[R5-GigabitEthernet0/0/1]ip add 172.16.133.1 24

[R6]INt g 0/0/0

[R6-GigabitEthernet0/0/0]ip add 172.16.132.2 24

[R6-GigabitEthernet0/0/0]INt g 0/0/1

[R6-GigabitEthernet0/0/1]ip add 172.16.134.1 24

[R7]int g 0/0/2.6

[R7-GigabitEthernet0/0/2.6]ip add 172.16.128.1 25

[R7-GigabitEthernet0/0/2.6]int g 0/0/2.7

[R7-GigabitEthernet0/0/2.7]ip add 172.16.128.129 25

VLAN

[sm3]int g 0/0/3

[sm3-GigabitEthernet0/0/3]port link-type access

[sm3-GigabitEthernet0/0/3]port default vlan 60

[sm3-GigabitEthernet0/0/3]int g 0/0/4

[sm3-GigabitEthernet0/0/4]port link-type access

[sm3-GigabitEthernet0/0/4]port default vlan 60

[sm3-GigabitEthernet0/0/4]int g 0/0/2

[sm3-GigabitEthernet0/0/2]port link-type access

[sm3-GigabitEthernet0/0/2]port default vlan 70

[sm3-GigabitEthernet0/0/2]int g 0/0/1

[sm3-GigabitEthernet0/0/1]port link-type trunk

[sm3-GigabitEthernet0/0/1]port trunk allow-pass vlan 60 70

[R7]int g 0/0/2.6

[R7-GigabitEthernet0/0/2.6]dot1q termination vid 60

[R7-GigabitEthernet0/0/2.6]arp broadcast enable

[R7-GigabitEthernet0/0/2.6]int g 0/0/2.7

[R7-GigabitEthernet0/0/2.7]dot1q termination vid 70

[R7-GigabitEthernet0/0/2.7]arp broadcast enable

DHCP

[R7]dhcp enable

[R7]ip pool vlan60

Info: It's successful to create an IP address pool.

[R7-ip-pool-vlan60]q

[R7]undo ip pool vlan60

[R7]ip pool vlan70

Info: It's successful to create an IP address pool.

[R7-ip-pool-vlan70]network 172.16.128.128 mask 24

[R7-ip-pool-vlan70]gateway-list 172.16.128.129

[R7-ip-pool-vlan70]dns-list 8.8.8.8 114.114.114.114

[R7-ip-pool-vlan70]q

[R7]int g 0/0/2.7

[R7-GigabitEthernet0/0/2.7]dhcp select global

静态路由

[R3]ip rou

[R3]ip route

[R3]ip route-static 172.16.131.0 24 172.16.129.2

[R3]ip route-static 172.16.131.0 24 172.16.130.2

[R3]ip route-static 172.16.133.0 24 172.16.130.2

[R3]ip route-static 172.16.133.0 24 172.16.129.2

[R3]ip route-static 172.16.128.0 24 172.16.129.2

[R3]ip route-static 172.16.128.0 24 172.16.130.2

[R3]ip route-static 172.16.134.0 24 172.16.130.2

[R3]ip route-static 172.16.134.0 24 172.16.129.2

[R3]ip route-static 172.16.132.0 24 172.16.129.2

[R3]ip route-static 172.16.132.0 24 172.16.130.2

[R4]ip route-static 172.16.133.0 24 172.16.131.2

[R4]ip route-static 172.16.128.0 24 172.16.132.2

[R4]ip route-static 172.16.128.0 24 172.16.131.2

[R4]ip route-static 172.16.134.0 24 172.16.132.2

[R5]ip route-static 172.16.134.0 24 172.16.133.2

[R5]ip route-static 172.16.128.0 24 172.16.133.2

[R5]ip route-static 172.16.132.0 24 172.16.131.1

[R5]ip route-static 172.16.130.0 24 172.16.131.1

[R5]ip route-static 172.16.129.0 24 172.16.131.1

[R6]ip route-static 172.16.130.0 24 172.16.132.1

[R6]ip route-static 172.16.129.0 24 172.16.132.1

[R6]ip route-static 172.16.131.0 24 172.16.132.1

[R6]ip route-static 172.16.133.0 24 172.16.134.2

[R6]ip route-static 172.16.128.0 24 172.16.134.2

[R7]ip route-static 172.16.132.0 24 172.16.134.1

[R7]ip route-static 172.16.130.0 24 172.16.134.1

[R7]ip route-static 172.16.130.0 24 172.16.133.1

[R7]ip route-static 172.16.129.0 24 172.16.133.1

[R7]ip route-static 172.16.129.0 24 172.16.134.1

[R7]ip route-static 172.16.131.0 24 172.16.133.1

公网

[test]int g 0/0/0

[test-GigabitEthernet0/0/0]ip add 100.0.0.2 24

[R3]int g 0/0/2

[R3-GigabitEthernet0/0/2]ip add 100.0.0.1 24

汇总

[R2-ospf-2]a 1

[R2-ospf-2-area-0.0.0.1]abr

[R2-ospf-2-area-0.0.0.1]abr-summary 172.16.64.0 255.255.255.0

[R2-ospf-2-area-0.0.0.1]q

[R2-ospf-2]a 0

[R2-ospf-2-area-0.0.0.0]abr-summary 172.16.0.0 255.255.255.0

防环

[R2]ip rou

[R2]ip route

[R2]ip route-static 172.16.0.0 22 N

[R2]ip route-static 172.16.0.0 22 NULL 0

[R2]ip route-static 172.16.64.0 22 NULL 0

认证

[R2]int g 0/0/2

[Huawei-GigabitEthernet0/0/2]ospf au

[Huawei-GigabitEthernet0/0/2]ospf authentication-mode md5 1 ci

[Huawei-GigabitEthernet0/0/2]ospf authentication-mode md5 1 cipher 123456

[R3]int g 0/0/0

[Huawei-GigabitEthernet0/0/0]ospf authentication-mode md5 1 cipher 123456

[Huawei]acl 2000

[Huawei-acl-basic-2000]rule pe

[Huawei-acl-basic-2000]rule permit sou

[Huawei-acl-basic-2000]rule permit source 172.16.0.0 0.0.255.255

[Huawei-acl-basic-2000]q

[Huawei]int g 0/0/2

[Huawei-GigabitEthernet0/0/2]nat out

[Huawei-GigabitEthernet0/0/2]nat outbound 2000

Info: The NAT address pool is empty

[R3]OSPF 3

[R3-ospf-3]def

[R3-ospf-3]default

[R3-ospf-3]default-route-advertise always （强制下发缺省）

[R7]ip route-static 0.0.0.0 0 172.16.133.1

[R7]ip route-static 0.0.0.0 0 172.16.134.1

[R5]ip route-static 0.0.0.0 0 172.16.131.1

[R6]ip route-static 0.0.0.0 0 172.16.132.1

[R4]ip route-static 0.0.0.0 0 172.16.129.1

[R4]ip route-static 0.0.0.0 0 172.16.130.1

最后

？？？？？

啊？

Aaa：架构思想

[Huawei]telnet server enable

[Huawei-aaa]local-user xixixixixllllll privilege level 15

[Huawei-aaa]local-user xixixixixllllll password cipher 123456

[Huawei-aaa]local-user xixixixixllllll service-type telnet

[Huawei]user-interface vty 0 4

[Huawei-ui-vty0-4]authentication-mode aaa

PC1不访问PC5

ACL 3000

[R2]acl 2001

[R2-acl-basic-2001]rule deny sou

[R2-acl-basic-2001]rule deny source 172.16.0.0 0.0.0.255

[R2-acl-basic-2001]rule deny source 172.16.1.0 0.0.0.255

[R2-GigabitEthernet0/0/2]traffic-filter outbound acl 2001

[R1]acl 3000

[R1-acl-adv-3000]rule deny icmp source 172.16.64.254 0.0.0.0 des

[R1-acl-adv-3000]rule deny icmp source 172.16.64.254 0.0.0.0 destination 172.16.

128.254 0.0.0.0

[R1-GigabitEthernet0/0/0]traffic-filter outbound acl 3000

R3到R4百兆作备份

[R4]ip route-static 0.0.0.0 0 172.168.130.1 preference 100

[R3]]ip route-static 172.16.128.0 255.255.255.0 172.16.130.2 preference 100

[R3]]ip route-static 172.16.131.0 255.255.255.0 172.16.130.2 preference 100

[R3]]ip route-static 172.16.132.0 255.255.255.0 172.16.130.2 preference 100

[R3]]ip route-static 172.16.133.0 255.255.255.0 172.16.130.2 preference 100

[R3]]ip route-static 172.16.134.0 255.255.255.0 172.16.130.2 preference 100

DAMO开发者矩阵

DAMO开发者矩阵，由阿里巴巴达摩院和中国互联网协会联合发起，致力于探讨最前沿的技术趋势与应用成果，搭建高质量的交流与分享平台，推动技术创新与产业应用链接，围绕“人工智能与新型计算”构建开放共享的开发者生态。

更多推荐

Linux 实时优化：禁用休眠与锁定 CPU 高性能电源管理实战教程

DAMO开发者矩阵

AgentPR的实证：AI 涌入GitHub一年，到底做出多少产出？

作者把每个 PR 关联的 commit、review、评论和时间线事件全部拉通，通过 Codex、Claude、Copilot、bot、mergify 这类关键词把 Agent 和机器人账号剔除，剩下的去重后就是这个 PR 的真实人类参与者集合——谁 review 了、谁改了代码、谁点的 merge，都有据可查。另外，作者还通过 GitHub API 拉取了每个仓库的贡献者数量，把项目分成三档：小