综合练习实验

Lq521426

17人浏览 · 2026-07-26 18:41:25

Lq521426 · 2026-07-26 18:41:25 发布

实验需求

基础网络与 VLAN 配置完成交换机 SW2、SW3、SW4、SW1 的 VLAN、Access、Trunk 接口配置；防火墙 FW 配置单臂路由子接口、各区域接口 IP，完成网段互通。网段规划：VLAN10（172.16.1.0/24）、VLAN20（172.16.2.0/24）、DMZ（10.0.0.0/24）、外网 Untrust（100.1.1.0/24）。
DHCP 服务配置在 FW 全局开启 DHCP，创建两个地址池 dhcp-a、dhcp-b；Client1 固定分配 172.16.1.90；PC1 静态 IP，地址池排除 172.16.2.100；终端 Client1、Client3、PC2 自动获取 IP，指定网关与 DNS 服务器 10.0.0.30。
自定义安全区域配置防火墙新建 Trust_A、Trust_B 自定义安全区域并设置对应优先级，将子接口分别划入；GE1/0/0 划入 DMZ、GE1/0/2 划入 Untrust 区域。
地址对象组配置创建三组地址对象：DMZ_Server 包含 OA、Web、DNS 服务器；Trust_A_address 包含高管、财务、管理员主机；Trust_B_address 包含技术部静态主机与市场部网段，排除技术部静态 IP。
Telnet 管理员权限配置创建本地管理员账号 vtyadmin，密码 admin@123，角色 service-admin；仅 172.16.1.0/24 网段主机可 Telnet 登录 FW，采用本地认证，赋予策略、对象、网络读写权限。
Portal 用户认证体系配置
创建认证域 openlab，认证方式 Portal，接入控制上网行为管理，新用户默认归属 openlab 组；
搭建分层组织用户组：总组 /openlab，下设 A、B 组；A 组包含 manager 高管、DevOps 运维、FD 财务；B 组包含 TD 技术、MD 市场；
创建对应岗位用户，统一密码 admin@123，首次登录强制改密；高管、财务双向绑定 IP/MAC，运维、财务、市场账号单账号单人登录，技术部允许多终端登录，市场账号有效期 10 天；
配置 7 条认证策略区分不同部门访问不同区域的认证方式：高管免认证、运维访问 DMZ / 外网 Portal 认证、技术 / 市场访问 DMZ 匿名认证、财务部访问 DMZ 无需认证、技术 / 财务部禁止访问外网。
时间段配置创建 no_worktime（每日 0-8 点、18-24 点非工作时段）、weekend（周六周日全天检修时段）。
安全访问策略配置
放行管理员 Telnet、全网 DHCP、内网访问 DNS 服务器流量；
运维部任意时段完整访问 DMZ 服务器，非工作时间可访问外网；高管随时可访问外网；财务部禁止访问外网；
高管、财务仅能访问 DMZ 的 OA、Web 服务器 HTTP/HTTPS 服务；
技术部可访问 Web 服务器，技术、市场部可访问 OA 服务器 HTTP/HTTPS；市场部可访问外网；
周末仅运维部可访问 DMZ 服务器，其余内网主机全部阻断访问 DMZ；
部门 A、B 内网之间禁止直接互访，跨部门数据仅可通过 OA 服务器中转。

SW2
system-view
sysname SW2
vlan batch 10 20
interface GigabitEthernet 0/0/2
port link-type access
port default vlan 10
quit
interface GigabitEthernet 0/0/3
port link-type access
port default vlan 20
quit
interface GigabitEthernet 0/0/1
port link-type trunk
port trunk allow-pass vlan 10 20
quit
SW3
system-view
sysname SW3
vlan batch 10
interface GigabitEthernet 0/0/1
port link-type trunk
port trunk allow-pass vlan 10
quit
interface GigabitEthernet 0/0/4
port link-type access
port default vlan 10
quit
interface GigabitEthernet 0/0/2
port link-type access
port default vlan 10
quit
interface GigabitEthernet 0/0/3
port link-type access
port default vlan 10
quit
SW4
system-view
sysname SW4
vlan batch 20
interface GigabitEthernet 0/0/1
port link-type trunk
port trunk allow-pass vlan 20
quit
interface GigabitEthernet 0/0/2
port link-type access
port default vlan 20
quit
interface GigabitEthernet 0/0/3
port link-type access
port default vlan 20
quit
SW1
system-view
sysname SW1
interface GigabitEthernet 0/0/4
port link-type access
quit
interface GigabitEthernet 0/0/1
port link-type access
quit
interface GigabitEthernet 0/0/2
port link-type access
quit
interface GigabitEthernet 0/0/3
port link-type access
quit
FW
system-view
sysname FW
interface GigabitEthernet 1/0/1.1
vlan-type dot1q 10
ip address 172.16.1.254 255.255.255.0
quit
interface GigabitEthernet 1/0/1.2
vlan-type dot1q 20
ip address 172.16.2.254 255.255.255.0
quit
interface GigabitEthernet 1/0/0
ip address 10.0.0.254 255.255.255.0
quit
interface GigabitEthernet 1/0/2
ip address 100.1.1.10 255.255.255.0
quit
firewall zone Trust_A
set priority 70
add interface GigabitEthernet 1/0/1.1
quit
firewall zone Trust_B
set priority 80
add interface GigabitEthernet 1/0/1.2
quit
firewall zone dmz
add interface GigabitEthernet 1/0/0
quit
firewall zone untrust
add interface GigabitEthernet 1/0/2
quit
time-range no_worktime
period-range 00:00:00 to 08:00:00 daily
period-range 18:00:00 to 23:59:59 daily
quit
time-range weekend
period-range 00:00:00 to 23:59:59 Sat Sun
quit
dhcp enable
ip pool dhcp-a
gateway-list 172.16.1.254
dns-list 10.0.0.30
network 172.16.1.0 mask 255.255.255.0
static-bind ip-address 172.16.1.90 mac-address 0000-0000-0001
quit
ip pool dhcp-b
gateway-list 172.16.2.254
dns-list 10.0.0.30
network 172.16.2.0 mask 255.255.255.0
excluded-ip-address 172.16.2.100
quit
interface GigabitEthernet 1/0/1.1
dhcp select global
quit
interface GigabitEthernet 1/0/1.2
dhcp select global
quit
ip address-object DMZ_Server
ip 10.0.0.10 255.255.255.255
ip 10.0.0.20 255.255.255.255
ip 10.0.0.30 255.255.255.255
quit
ip address-object Trust_A_address
ip 172.16.1.90 255.255.255.255
ip 172.16.1.100 255.255.255.255
ip 172.16.1.10 255.255.255.255
quit
ip address-object Trust_B_address
ip 172.16.2.100 255.255.255.255
ip 172.16.2.0 mask 255.255.255.0
exclude ip 172.16.2.100 255.255.255.255
quit
aaa
local-user vtyadmin password simple admin@123
local-user vtyadmin service-type telnet
user-group service-admin
quit
user-interface vty 0 4
aaa authentication aaa
aaa authorization user-group service-admin
quit
acl number 3000
rule permit source 172.16.1.0 0.0.0.255
quit
web-auth portal enable
authentication domain openlab
authentication scheme portal
access-control internet-behavior
new-user group /openlab
quit
user-group /openlab/A
user-group /openlab/B
user-group /openlab/A/manager
user-group /openlab/A/DevOps
user-group /openlab/A/FD
user-group /openlab/B/TD
user-group /openlab/B/MD
local-user user_001 password simple admin@123
local-user user_001 group /openlab/A/manager
local-user user_001 access-limit 1
local-user user_001 bind ip-mac 172.16.1.90 0000-0000-0001
local-user user_001 password-change first-login
quit
local-user DevOps_001 password simple admin@123
local-user DevOps_001 group /openlab/A/DevOps
local-user DevOps_001 access-limit 1
local-user DevOps_001 password-change first-login
quit
local-user FD_001 password simple admin@123
local-user FD_001 group /openlab/A/FD
local-user FD_001 access-limit 1
local-user FD_001 bind ip-mac 172.16.1.100 0000-0000-0000
local-user FD_001 password-change first-login
quit
local-user TD_001 password simple admin@123
local-user TD_001 group /openlab/B/TD
local-user TD_001 access-limit unlimited
local-user TD_001 password-change first-login
quit
local-user TD_002 password simple admin@123
local-user TD_002 group /openlab/B/TD
local-user TD_002 access-limit unlimited
local-user TD_002 password-change first-login
quit
local-user TD_003 password simple admin@123
local-user TD_003 group /openlab/B/TD
local-user TD_003 access-limit unlimited
local-user TD_003 password-change first-login
quit
local-user MD_001 password simple admin@123
local-user MD_001 group /openlab/B/MD
local-user MD_001 access-limit 1
local-user MD_001 expire 10
local-user MD_001 password-change first-login
quit
local-user MD_002 password simple admin@123
local-user MD_002 group /openlab/B/MD
local-user MD_002 access-limit 1
local-user MD_002 expire 10
local-user MD_002 password-change first-login
quit
local-user MD_003 password simple admin@123
local-user MD_003 group /openlab/B/MD
local-user MD_003 access-limit 1
local-user MD_003 expire 10
local-user MD_003 password-change first-login
quit
local-user MD_004 password simple admin@123
local-user MD_004 group /openlab/B/MD
local-user MD_004 access-limit 1
local-user MD_004 expire 10
local-user MD_004 password-change first-login
quit
local-user MD_005 password simple admin@123
local-user MD_005 group /openlab/B/MD
local-user MD_005 access-limit 1
local-user MD_005 expire 10
local-user MD_005 password-change first-login
quit
authentication-policy
rule policy_auth_01 source-zone Trust_A destination-zone any source-address Trust_A_address authentication action exempt
rule policy_auth_02 source-zone Trust_A destination-zone dmz source-address Trust_A_address destination-address DMZ_Server authentication action portal
rule policy_auth_03 source-zone Trust_A destination-zone untrust source-address Trust_A_address authentication action portal
rule policy_auth_04 source-zone Trust_B destination-zone dmz source-address Trust_B_address destination-address DMZ_Server authentication action anonymous
rule policy_auth_05 source-zone Trust_A destination-zone dmz source-address Trust_A_address destination-address DMZ_Server authentication action none
rule policy_auth_06 source-zone Trust_B destination-zone dmz source-address Trust_B_address destination-address DMZ_Server authentication action anonymous
rule policy_auth_07 source-zone Trust_B destination-zone untrust source-address Trust_B_address authentication action portal
quit
security-policy
rule policy_01 source-zone Trust_A destination-zone local source-address Trust_A_address service telnet action permit
rule policy_02 source-zone Trust_A Trust_B destination-zone local service udp eq 67 udp eq 68 action permit
rule policy_03 source-zone Trust_A Trust_B destination-zone dmz source-address Trust_A_address Trust_B_address destination-address DMZ_Server service dns action permit
rule policy_04 source-zone Trust_A destination-zone dmz source-address Trust_A_address destination-address DMZ_Server action permit
rule policy_05 source-zone Trust_A destination-zone dmz source-address Trust_A_address destination-address DMZ_Server service http https action permit
rule policy_06 source-zone Trust_A destination-zone untrust source-address Trust_A_address time-range no_worktime action permit
rule policy_07 source-zone Trust_A destination-zone untrust source-address Trust_A_address action permit
rule policy_08 source-zone Trust_B destination-zone dmz source-address Trust_B_address destination-address DMZ_Server action permit
rule policy_09 source-zone Trust_B destination-zone dmz source-address Trust_B_address destination-address DMZ_Server service http https action permit
rule policy_10 source-zone Trust_B destination-zone untrust source-address Trust_B_address action permit
rule policy_11 source-zone Trust_A Trust_B destination-zone dmz source-address Trust_A_address Trust_B_address time-range weekend action deny
quit

DAMO开发者矩阵

DAMO开发者矩阵，由阿里巴巴达摩院和中国互联网协会联合发起，致力于探讨最前沿的技术趋势与应用成果，搭建高质量的交流与分享平台，推动技术创新与产业应用链接，围绕“人工智能与新型计算”构建开放共享的开发者生态。

更多推荐

NLopt 超详细实战教程（C++版）算法选型｜多目标优化｜批量寻优｜动态约束｜闭环仿真控制

<think>我们根据用户要求，根据给定内容生成≤150字的文章摘要。内容是关于NLopt优化库的详细介绍，包括优势、场景、安装、算法、代码等。需要压缩成摘要，不超过150字。摘要应涵盖核心要点：NLopt是开源、轻量、商用免费的非线性优化库，支持多语言，算法丰富，适用于机器人、工业控制等，提供C++示例。注意字数和连贯性。</think>NLopt是一款开源、轻量、商用免

DAMO开发者矩阵

【LLM 架构实战】基于大模型的微信社群机器人设计：针对社群运营需求，多维度数据挖掘总结

DAMO开发者矩阵

AI怎么用在私域运营？从客户消息到智能回复的实现思路

AI放到私域里面，最适合做的不是完全代替人工。而是帮助销售处理大量重复、简单的客户咨询。AI理解客户 → 系统判断规则 → 简单问题自动处理 → 复杂问题转人工再结合企业微信API、私域自动化、企业微信机器人、客户管理等能力，就可以把客户消息处理和业务系统连接起来。如果需要了解企业微信API具体的接口能力和调用方式，可以查看QIWe API文档：https://doc.qiweapi.com/，里