|
本帖最后由 Alice、袜 于 2010-8-4 19:43 编辑
项目拓扑:见上图
项目需求: - 学生电脑有30台电脑,教工宿舍所有的电脑加在一起总共有10台电脑左右,另外还有2台PC服务器
- 学校向电信申请了2个静态的公网IP,带宽是10M
- 学校用户的ip地址采用DHCP获取,2台PC服务器采用静态设置IP地址
- 内网的用户能够上Internet
- 学校目前有个WEB主页挂在其中一台PC服务器上
- 学校有一些外聘的老师,要求他们在家里也能访问校园内部的资源
- 要求学生的电脑在晚上22点到第二天的7点不能上Internet
- 要求内网的设备能够通过远程管理
- 要求尽量使得学生电脑和教工电脑分开
- 学生需要上Cernet网络
地址规划:
注:拓扑中 PC3为测试PC,用真机接入;Server2为PPTP VPN服务器,使用windows2003操作系统服务器.
主要配置:
学生用户群配置(以路由模拟)
-
- PC1#show run
- Building configuration...
- Current configuration : 727 bytes
- !
- version 12.2
- service timestamps debug datetime msec
- service timestamps log datetime msec
- no service password-encryption
- !
- hostname PC1
- !
- logging queue-limit 100
- !
- ip subnet-zero
- no ip routing
- no ip domain lookup
- !
- !
- !
- !
- interface Ethernet0 //地址采用DHCP获取
- ip address dhcp
- no ip route-cache
- no ip mroute-cache
- !
- interface Ethernet1
- no ip address
- no ip route-cache
- no ip mroute-cache
- !
- interface Serial0
- no ip address
- no ip route-cache
- no ip mroute-cache
- shutdown
- !
- interface Serial1
- no ip address
- no ip route-cache
- no ip mroute-cache
- shutdown
- !
- ip default-gateway 192.168.10.254
- ip http server
- ip classless
- !
- !
- !
- !
- !
- line con 0
- exec-timeout 0 0
- logging synchronous
- line aux 0
- line vty 0 4
- password spoto
- login
- !
- end
复制代码
教师用户群配置(以路由器模拟):
-
- PC2#show run
- Building configuration...
- Current configuration : 697 bytes
- !
- version 12.2
- service timestamps debug datetime msec
- service timestamps log datetime msec
- no service password-encryption
- !
- hostname PC2
- !
- logging queue-limit 100
- !
- ip subnet-zero
- no ip routing
- no ip domain lookup
- !
- !
- !
- !
- interface Ethernet0 //使用DHCP获取IP地址
- ip address dhcp
- no ip route-cache
- no ip mroute-cache
- !
- interface Ethernet1
- no ip address
- no ip route-cache
- no ip mroute-cache
- shutdown
- !
- interface Serial0
- no ip address
- no ip route-cache
- no ip mroute-cache
- shutdown
- !
- interface Serial1
- no ip address
- no ip route-cache
- no ip mroute-cache
- shutdown
- !
- ip default-gateway 192.168.20.254
- ip http server
- ip classless
- !
- !
- !
- !
- !
- line con 0
- exec-timeout 0 20
- line aux 0
- line vty 0 4
- password spoto
- login
- !
- End
复制代码
学生用户群接入交换机配置:
-
- SW1#show run
- Building configuration...
- Current configuration : 1165 bytes
- !
- version 12.1
- no service pad
- service timestamps debug uptime
- service timestamps log uptime
- no service password-encryption
- !
- hostname SW1
- !
- !
- ip subnet-zero
- !
- no ip domain-lookup
- !
- spanning-tree mode pvst
- no spanning-tree optimize bpdu transmission
- spanning-tree extend system-id
- !
- !
- !
- !
- interface FastEthernet0/1 //学生用户划入Vlan10
- switchport access vlan 10
- !
- interface FastEthernet0/2
- !
- interface FastEthernet0/3
- !
- interface FastEthernet0/4
- !
- interface FastEthernet0/5
- !
- interface FastEthernet0/6
- !
- interface FastEthernet0/7
- !
- interface FastEthernet0/8
- !
- interface FastEthernet0/9
- !
- interface FastEthernet0/10
- !
- interface FastEthernet0/11
- !
- interface FastEthernet0/12
- !
- interface FastEthernet0/13
- !
- interface FastEthernet0/14
- !
- interface FastEthernet0/15
- !
- interface FastEthernet0/16
- !
- interface FastEthernet0/17
- !
- interface FastEthernet0/18
- !
- interface FastEthernet0/19
- !
- interface FastEthernet0/20
- !
- interface FastEthernet0/21
- !
- interface FastEthernet0/22
- !
- interface FastEthernet0/23
- !
- interface FastEthernet0/24 //连接核心交换机 使用trunk
- switchport mode trunk
- !
- interface Vlan1
- no ip address
- no ip route-cache
- shutdown
- !
- interface Vlan10 //远程管理地址
- ip address 192.168.10.253 255.255.255.0
- no ip route-cache
- !
- ip default-gateway 192.168.10.254
- ip http server
- !
- line con 0
- line vty 5 15 //远程管理密码
- password spoto
- login
- !
- !
- End
复制代码
教师用户群接入交换机配置:\
-
- SW2#show run
- Building configuration...
- Current configuration : 1231 bytes
- !
- version 12.1
- no service pad
- service timestamps debug uptime
- service timestamps log uptime
- no service password-encryption
- !
- hostname SW2
- !
- !
- ip subnet-zero
- !
- !
- spanning-tree mode pvst
- no spanning-tree optimize bpdu transmission
- spanning-tree extend system-id
- !
- !
- !
- !
- interface FastEthernet0/1 //教师用户划入VLAN20
- switchport access vlan 20
- !
- interface FastEthernet0/2
- !
- interface FastEthernet0/3
- !
- interface FastEthernet0/4
- !
- interface FastEthernet0/5
- !
- interface FastEthernet0/6
- !
- interface FastEthernet0/7
- !
- interface FastEthernet0/8
- !
- interface FastEthernet0/9
- !
- interface FastEthernet0/10
- !
- interface FastEthernet0/11
- !
- interface FastEthernet0/12
- !
- interface FastEthernet0/13
- !
- interface FastEthernet0/14
- !
- interface FastEthernet0/15
- !
- interface FastEthernet0/16
- !
- interface FastEthernet0/17
- !
- interface FastEthernet0/18
- !
- interface FastEthernet0/19
- !
- interface FastEthernet0/20
- !
- interface FastEthernet0/21
- !
- interface FastEthernet0/22
- !
- interface FastEthernet0/23
- !
- interface FastEthernet0/24 //连接核心交换机使用trunk
- switchport mode trunk
- !
- interface Vlan1
- no ip address
- no ip route-cache
- shutdown
- !
- interface Vlan20 //远程管理地址
- ip address 192.168.20.253 255.255.255.0
- no ip route-cache
- !
- ip default-gateway 192.168.20.254
- ip http server
- !
- line con 0 //远程登陆密码
- line vty 5 15
- password spoto
- login
- !
- !
- end
复制代码
核心三层交换机配置:
出口路由器配置:
-
- Gateway#show run
- Building configuration...
- Current configuration : 1651 bytes
- !
- version 12.3
- service timestamps debug datetime msec
- service timestamps log datetime msec
- no service password-encryption
- no service dhcp
- !
- hostname GW
- !
- boot-start-marker
- boot-end-marker
- !
- !
- memory-size iomem 10
- no aaa new-model
- ip subnet-zero
- ip cef
- !
- !
- !
- no ftp-server write-enable
- !
- !
- !
- !
- interface FastEthernet0/0 //开启对外端口
- no ip address
- duplex auto
- speed auto
- !
- interface FastEthernet0/0.1 //对外端口使用子端口
- encapsulation dot1Q 10
- ip address 215.1.1.1 255.255.255.0
- ip nat outside
- !
- interface FastEthernet0/0.2
- encapsulation dot1Q 20
- ip address 215.1.2.1 255.255.255.0
- ip nat outside
- !
- interface FastEthernet0/1 //接内网入口
- ip address 192.168.30.254 255.255.255.0
- ip nat inside
- ip policy route-map spoto //路由策略
- duplex auto
- speed auto
- !
- interface Serial1/0
- no ip address
- shutdown
- !
- interface Serial1/1
- no ip address
- shutdown
- !
- interface Serial1/2
- no ip address
- shutdown
- !
- interface Serial1/3
- no ip address
- shutdown
- !
- ip nat inside source list 1 interface FastEthernet0/0.1 overload //PAT
- ip nat inside source list 2 interface FastEthernet0/0.2 overload //PAT
- ip nat inside source static tcp 10.1.1.1 1723 interface FastEthernet0/0.2 1723 //PPTP映射
- ip nat inside source static tcp 10.1.1.1 80 111.1.1.1 80 //WEB服务器映射
- ip classless
- ip route 0.0.0.0 0.0.0.0 215.1.2.254 //对外默认路由到internet
- ip route 1.1.1.0 255.255.255.0 215.1.1.254 //访问校园网资源通过cernet
- ip route 10.0.0.0 255.0.0.0 192.168.30.1 //对内路由
- ip route 192.168.10.0 255.255.255.0 192.168.30.1 //对用户组的细路由
- ip route 192.168.20.0 255.255.255.0 192.168.30.1
- ip http server
- !
- access-list 1 permit any //PAT列表
- access-list 2 permit any
- access-list 3 permit 192.168.10.0 0.0.0.255 //路由策略对象为学生用户组
- route-map spoto permit 10 //策略
- match ip address 3
- match interface FastEthernet0/0.1
- set ip next-hop 215.1.1.254 //只走cernet
- !
- !
- line con 0
- logging synchronous
- line aux 0
- line vty 0 4 //远程登陆密码
- password spoto
- login
- !
- !
- end
复制代码
对外路由所属交换机(负责单臂路由,路由器一般只有内外2个口,所以接入2个网络需要用单臂路由):
运营商ISP1配置:
-
- ISP1#show run
- Building configuration...
- Current configuration : 691 bytes
- !
- version 12.2
- service timestamps debug uptime
- service timestamps log uptime
- service password-encryption
- !
- hostname ISP1
- !
- !
- ip subnet-zero
- no ip domain-lookup
- !
- !
- !
- !
- !
- interface Ethernet0
- ip address 215.1.2.254 255.255.255.0
- !
- interface Ethernet1
- ip address 211.1.1.254 255.255.255.0
- !
- interface Serial0
- ip address 215.1.3.1 255.255.255.0
- no fair-queue
- clock rate 64000
- !
- interface Serial1
- no ip address
- shutdown
- !
- router ospf 1
- log-adjacency-changes
- redistribute static metric-type 1 subnets //静态路由重发布
- network 211.1.1.0 0.0.0.255 area 0
- network 215.1.2.0 0.0.0.255 area 0
- network 215.1.3.0 0.0.0.255 area 0
- !
- ip route 111.1.1.1 255.255.255.255 Ethernet0 //通往web服务器静态路由
- !
- !
- ip classless
- ip http server
- !
- !
- line con 0
- exec-timeout 0 0
- logging synchronous
- line aux 0
- line vty 0 4
- password spoto
- login
- !
- end
复制代码
运营商ISP2配置:
-
- ISP2#show run
- Building configuration...
- Current configuration : 610 bytes
- !
- version 12.2
- service timestamps debug uptime
- service timestamps log uptime
- no service password-encryption
- !
- hostname ISP2
- !
- !
- ip subnet-zero
- no ip domain-lookup
- !
- !
- !
- !
- !
- interface Ethernet0
- ip address 215.1.4.254 255.255.255.0
- !
- interface Ethernet1
- no ip address
- shutdown
- !
- interface Serial0
- ip address 215.1.3.254 255.255.255.0
- !
- interface Serial1
- no ip address
- shutdown
- !
- router ospf 1
- log-adjacency-changes
- network 215.1.3.0 0.0.0.255 area 0
- network 215.1.4.0 0.0.0.255 area 0
- !
- ip classless
- no ip http server
- !
- !
- line con 0
- exec-timeout 0 0
- logging synchronous
- line aux 0
- line vty 0 4
- password spoto
- login
- !
- End
复制代码
Cernet配置:
-
- Cernet#show run
- Building configuration...
- Current configuration : 744 bytes
- !
- version 12.2
- service timestamps debug datetime msec
- service timestamps log datetime msec
- no service password-encryption
- !
- hostname Cernet
- !
- logging queue-limit 100
- !
- ip subnet-zero
- no ip domain lookup
- !
- !
- !
- !
- interface Loopback0
- ip address 1.1.1.1 255.255.255.255
- !
- interface Ethernet0
- ip address 215.1.1.254 255.255.255.0
- !
- interface Ethernet1
- ip address 211.1.1.1 255.255.255.0
- !
- interface Serial0
- no ip address
- shutdown
- !
- interface Serial1
- no ip address
- shutdown
- !
- router ospf 1
- log-adjacency-changes
- network 1.1.1.0 0.0.0.255 area 0
- network 211.1.1.0 0.0.0.255 area 0
- network 215.1.1.0 0.0.0.255 area 0
- !
- no ip http server
- ip classless
- !
- !
- !
- !
- !
- line con 0
- exec-timeout 0 0
- logging synchronous
- line aux 0
- line vty 0 4
- password spoto
- login
- !
- end
复制代码
Server1配置DHCP/NTP:
-
- SERVER1#show run
- Building configuration...
- Current configuration : 1084 bytes
- !
- version 12.2
- service timestamps debug uptime
- service timestamps log uptime
- no service password-encryption
- !
- hostname SERVER1
- !
- !
- ip subnet-zero
- no ip routing
- ip dhcp ping packets 0
- !
- ip dhcp pool test10 //VLAN10地址池
- network 192.168.10.0 255.255.255.0
- default-router 192.168.10.254
- dns-server 218.85.157.99
- lease infinite
- !
- ip dhcp pool test20 //VLAN20地址池
- network 192.168.20.0 255.255.255.0
- dns-server 218.85.157.99
- lease infinite
- !
- !
- !
- !
- interface Ethernet0
- ip address 10.0.0.1 255.255.255.0
- no ip route-cache
- !
- interface Ethernet1
- no ip address
- no ip route-cache
- shutdown
- !
- interface Serial0
- no ip address
- encapsulation frame-relay IETF
- no ip route-cache
- shutdown
- frame-relay lmi-type ansi
- !
- interface Serial1
- no ip address
- no ip route-cache
- shutdown
- !
- ip default-gateway 10.0.0.254
- ip classless
- no ip http server
- ip pim bidir-enable
- !
- !
- !
- line con 0
- line aux 0
- line vty 0 4
- password spoto
- login
- !
- ntp master //时间服务器
- !
- end
复制代码
PPTP服务器(windows2003配置):
心得体会:
这次项目演练在真机上做的..
让我们知道了真机上会有更多不可避免的问题,例如线的问题,电源的问题,还有团队合作的兼容性等.
比起虚拟机上鼠标一点就联通来说,真机有着更多细微的故障点.
从中我们也学习到了很多.
这次成为实战演练,那也加入了演示PPT的环节,
所以PPT和WORD文档都要做的漂亮,
让客户接受才是目的,实施过程反而是次要的了.
这点我们做的不好,所以我们小组输了这次.
但是下次我们会努力的.
文中可能配置会有小错误,希望看到的小盆友能提出来~
在SPOTO,我们共同进步. |
本帖子中包含更多资源
您需要 登录 才可以下载或查看,没有账号?立即注册
x
|