中小型企业网络设计(经典款)
公众号:驴毛小小 有配套视频讲解+设计文档
B站同名
规划说明
1.根据划分的部门需求,完成相应的VLAN划分
2.公司内部网络采用MSTP+VRRP技术实现vlan负载均衡
3.公司内网采用OSPF路由协议,选择最短路径优先转发,并与BFD联动,实现快速收敛。
4.各有线和无线用户终端采用DHCP获取IP地址,DHCP与其他服务器统一部署,需要通过汇聚层DHCP中继技术为各用户分配网关。
5.HJ1与HJ2,HX1和HX2之间配置链路聚合。
6.HX1和HX2以及防火墙之间配置OSPF路由协议。
7.HJ1和HJ2部署各接入层用户网关,网关采用VRRP协议冗余部署。
8.公司网络管理部分采用路由器代替,通过在防火墙、HX1和HX2上配置telnet协议,使得路由器可以通过用户名huawei,密码huawei@123远程登录。
9.公司部署会议服务器(组播服务器),便于各用户终端远程会议时使用。
10.部署FTP、HTTP等服务器,便于员工日常办公资料存储,文件共享等日常需要提供方便。
11.通过旁挂AC+AP组网方式,为各部门提供无线网络接入。
12.内网web服务器192.168.14.2映射公网地址为102.1.1.100提供给外网用户访问。
13.内网FTP服务器192.168.14.1映射公网地址为102.1.1.200提供给外网用户访问。
14.内网访问外网用户时,通过NAT技术,完成私网地址到公网地址转换,访问外网用户。
IP地址及vlan规划
部门 | IP地址及掩码 |
网关 |
VLAN DI |
人力资源部 | 192.168.10.0/24 | 192.168.10.254 | Vlan 10 |
研发部 | 192.168.11.0/24 | 192.168.11.254 | Vlan 11 |
销售部 | 192.168.12.0/24 | 192.168.12.254 | Vlan 12 |
财务部 | 192.168.13.0/24 | 192.168.13.254 | Vlan 13 |
服务器 | 192.168.14.0/24 | 192.168.14.254 | / |
DHCP自动获取IP地址
人力资源部
研发部
人力和研发互访
研发访问销售部
人力和财务互访
NAT验证
通过内网用户PC4访问外网时,在出口进行抓包。可以看到区访问公网地址的源地址已经转换为出口的公网地址。
内网访问FTP服务器
通过内网用户使用客户端,进行FTP服务器登录,可以看到服务器列表中出现txt文件,与服务器所添加的文件相同,成功登录服务器。
内网访问HTTP服务器
通过内网用户使用客户端,进行WEB服务器登录,可以看到服务器列表中出现如图所示界面,,与服务器所添加的文件相同,则成功登录服务器。
外网用户访问内网FTP服务器
外网用户访问HTTP服务器
Telnet验证
组播验证:
通过在PC侧进行抓包,可以看到大量的UDP报文
配置命令
SW1
sysname JR-SW1 //命名设备
vlan batch 10 to 100// 创建vlan
stp region-configuration //进入MSTP配置
region-name stp1 //配置域名
revision-level 76 //配置修订等级
instance 1 vlan 10 to 11 //进行实例映射
instance 2 vlan 12 to 13 99
active region-configuration //确认配置
interface Ethernet0/0/1 //进入接口
port link-type trunk //配置端口类型
port trunk pvid vlan 100 //打上PVID
port trunk allow-pass vlan 10 to 100 //允许vlan流量通过
#
interface Ethernet0/0/2
port link-type access //配置端口类型
port default vlan 10 //加入vlan
#
interface Ethernet0/0/3
port link-type access
port default vlan 10
#
interface GigabitEthernet0/0/1
port link-type trunk
port trunk allow-pass vlan 10 to 100
#
interface GigabitEthernet0/0/2
port link-type trunk
port trunk allow-pass vlan 10 to 100
SW2
sysname JR-SW2//命名设备
#
vlan batch 10 to 100
#
stp region-configuration
region-name stp1
revision-level 76
instance 1 vlan 10 to 11
instance 2 vlan 12 to 13 99
active region-configuration
interface Ethernet0/0/1
port link-type trunk
port trunk pvid vlan 100
port trunk allow-pass vlan 10 to 100
#
interface Ethernet0/0/2
port link-type access
port default vlan 11
#
interface Ethernet0/0/3
port link-type access
port default vlan 11
#
interface GigabitEthernet0/0/1
port link-type trunk
port trunk allow-pass vlan 10 to 100
#
interface GigabitEthernet0/0/2
port link-type trunk
port trunk allow-pass vlan 10 to 100
SW3
#
sysname JR-SW3
#
vlan batch 10 to 100
#
stp region-configuration
region-name stp1
revision-level 76
instance 1 vlan 10 to 11
instance 2 vlan 12 to 13 99
active region-configuration
interface Ethernet0/0/1
port link-type trunk
port trunk pvid vlan 100
port trunk allow-pass vlan 10 to 100
#
interface Ethernet0/0/2
port link-type access
port default vlan 12
#
interface Ethernet0/0/3
port link-type access
port default vlan 12
#
interface GigabitEthernet0/0/1
port link-type trunk
port trunk allow-pass vlan 10 to 100
#
interface GigabitEthernet0/0/2
port link-type trunk
port trunk allow-pass vlan 10 to 100
SW4
#
sysname JR-SW4
vlan batch 10 to 100
#
stp region-configuration
region-name stp1
revision-level 76
instance 1 vlan 10 to 11
instance 2 vlan 12 to 13 99
active region-configuration
#
interface Ethernet0/0/1
port link-type trunk
port trunk pvid vlan 100
port trunk allow-pass vlan 10 to 100
#
interface Ethernet0/0/2
port link-type access
port default vlan 13
#
interface Ethernet0/0/3
port link-type access
port default vlan 13
#
interface GigabitEthernet0/0/1
port link-type trunk
port trunk allow-pass vlan 10 to 100
#
interface GigabitEthernet0/0/2
port link-type trunk
port trunk allow-pass vlan 10 to 100
HJ1
#
sysname HJ1
#
vlan batch 10 to 100
stp region-configuration
region-name stp1
revision-level 76
instance 1 vlan 10 to 11
instance 2 vlan 12 to 13 99
active region-configuration
interface Eth-Trunk10 //创建聚合口
port link-type trunk //配置聚合口端口类型
port trunk allow-pass vlan 10 to 100 //允许vlan流量通过
#
interface GigabitEthernet0/0/1
eth-trunk 10 //将接口加入聚合口
#
interface GigabitEthernet0/0/2
eth-trunk 10
#
interface GigabitEthernet0/0/4
port link-type trunk
port trunk allow-pass vlan 10 to 100
#
interface GigabitEthernet0/0/5
port link-type trunk
port trunk allow-pass vlan 10 to 100
#
interface GigabitEthernet0/0/6
port link-type trunk
port trunk allow-pass vlan 10 to 100
#
interface GigabitEthernet0/0/7
port link-type trunk
port trunk allow-pass vlan 10 to 100
#
interface GigabitEthernet0/0/8
port link-type trunk
port trunk allow-pass vlan 10 to 100
#
interface GigabitEthernet0/0/9
port link-type trunk
port trunk allow-pass vlan 10 to 100
HJ2
sysname HJ2
#
vlan batch 10 to 100
#
stp region-configuration
region-name stp1
revision-level 76
instance 1 vlan 10 to 11
instance 2 vlan 12 to 13 99
active region-configuration
interface Eth-Trunk10
port link-type trunk
port trunk allow-pass vlan 10 to 100
#
interface GigabitEthernet0/0/1
eth-trunk 10
#
interface GigabitEthernet0/0/2
eth-trunk 10
#
interface GigabitEthernet0/0/4
port link-type trunk
port trunk allow-pass vlan 10 to 100
#
interface GigabitEthernet0/0/5
port link-type trunk
port trunk allow-pass vlan 10 to 100
#
interface GigabitEthernet0/0/6
port link-type trunk
port trunk allow-pass vlan 10 to 100
#
interface GigabitEthernet0/0/7
port link-type trunk
port trunk allow-pass vlan 10 to 100
#
interface GigabitEthernet0/0/8
port link-type trunk
port trunk allow-pass vlan 10 to 100
#
interface GigabitEthernet0/0/9
port link-type trunk
port trunk allow-pass vlan 10 to 100
HX1
sysname HX1
#
vlan batch 10 to 101
#
stp instance 1 root primary //HX1作为实例1的主用根桥
stp instance 2 root secondary //核心1作为实例2的备用根桥
#
multicast routing-enable// 使能组播功能
#
stp region-configuration
region-name stp1
revision-level 76
instance 1 vlan 10 to 11
instance 2 vlan 12 to 13 99
active region-configuration
local-user huawei password cipher huawei@123 //配置用户名和密码
local-user huawei privilege level 9 //配置优先级
local-user huawei service-type telnet//用户服务类型为telnet
#
interface Vlanif10
ip address 192.168.10.252 255.255.255.0
vrrp vrid 10 virtual-ip 192.168.10.254 / /配置VRRP协议
vrrp vrid 10 priority 120 //配置VRRP协议
vrrp vrid 10 track interface GigabitEthernet0/0/3 reduced 30//追踪上行接口,
igmp enable //使能IGMP协议
dhcp select relay //DHCP选择中继
dhcp relay server-ip 192.168.14.4 //指定DHCP服务器地址
#
interface Vlanif11
ip address 192.168.11.252 255.255.255.0
vrrp vrid 11 virtual-ip 192.168.11.254
vrrp vrid 11 priority 120
vrrp vrid 11 track interface GigabitEthernet0/0/3 reduced 30
igmp enable
dhcp select relay
dhcp relay server-ip 192.168.14.4
#
interface Vlanif12
ip address 192.168.12.252 255.255.255.0
vrrp vrid 12 virtual-ip 192.168.12.254
dhcp select relay
dhcp relay server-ip 192.168.14.4
#
interface Vlanif13
ip address 192.168.13.252 255.255.255.0
vrrp vrid 13 virtual-ip 192.168.13.254
dhcp select relay
dhcp relay server-ip 192.168.14.4
interface Vlanif99
ip address 192.168.99.252 255.255.255.0
vrrp vrid 99 virtual-ip 192.168.99.254
dhcp select relay
dhcp relay server-ip 192.168.14.4
interface Vlanif101
ip address 192.168.1.2 255.255.255.0
pim dm //打开组播路由协议
#
interface Eth-Trunk10
port link-type trunk
port trunk allow-pass vlan 10 to 100
#
interface GigabitEthernet0/0/1
port link-type trunk
port trunk allow-pass vlan 10 to 100
#
interface GigabitEthernet0/0/2
port link-type trunk
port trunk allow-pass vlan 10 to 100
#
interface GigabitEthernet0/0/3
port link-type access
port default vlan 101
#
interface GigabitEthernet0/0/4
port link-type trunk
port trunk allow-pass vlan 2 to 4094
#
interface GigabitEthernet0/0/22
eth-trunk 10
#
interface GigabitEthernet0/0/23
eth-trunk 10
#
interface GigabitEthernet0/0/24
eth-trunk 10
interface LoopBack0
ip address 3.3.3.3 255.255.255.255
#
ospf 1 //进入OSPF进程
area 0.0.0.0 //进入区域0
network 192.168.1.0 0.0.0.255 //宣告网段
network 192.168.11.0 0.0.0.255
network 192.168.12.0 0.0.0.255
network 192.168.13.0 0.0.0.255
network 192.168.10.0 0.0.0.255
network 192.168.99.0 0.0.0.255
HX2
#
sysname HX2
#
vlan batch 10 to 102
#
stp instance 1 root secondary
stp instance 2 root primary
#
multicast routing-enable
stp region-configuration
region-name stp1
revision-level 76
instance 1 vlan 10 to 11
instance 2 vlan 12 to 13 99
active region-configuration
local-user huawei password cipher huawei@123
local-user huawei privilege level 9
local-user huawei service-type telnet
#
interface Vlanif10
ip address 192.168.10.253 255.255.255.0
vrrp vrid 10 virtual-ip 192.168.10.254
igmp enable
dhcp select relay
dhcp relay server-ip 192.168.14.4
#
interface Vlanif11
ip address 192.168.11.253 255.255.255.0
vrrp vrid 11 virtual-ip 192.168.11.254
igmp enable
dhcp select relay
dhcp relay server-ip 192.168.14.4
#
interface Vlanif12
ip address 192.168.12.253 255.255.255.0
vrrp vrid 12 virtual-ip 192.168.12.254
vrrp vrid 12 priority 120
vrrp vrid 12 track interface GigabitEthernet0/0/3 reduced 30
igmp enable
dhcp select relay
dhcp relay server-ip 192.168.14.4
#
interface Vlanif13
ip address 192.168.13.253 255.255.255.0
vrrp vrid 13 virtual-ip 192.168.13.254
vrrp vrid 13 priority 120
vrrp vrid 13 track interface GigabitEthernet0/0/3 reduced 30
igmp enable
dhcp select relay
dhcp relay server-ip 192.168.14.4
#
interface Vlanif99
ip address 192.168.99.253 255.255.255.0
vrrp vrid 99 virtual-ip 192.168.99.254
vrrp vrid 99 priority 120
vrrp vrid 99 track interface GigabitEthernet0/0/3 reduced 30
dhcp select relay
dhcp relay server-ip 192.168.14.4
#
interface Vlanif102
ip address 192.168.2.2 255.255.255.0
pim dm
interface Eth-Trunk10
port link-type trunk
port trunk allow-pass vlan 10 to 100
#
interface GigabitEthernet0/0/1
port link-type trunk
port trunk allow-pass vlan 10 to 100
#
interface GigabitEthernet0/0/2
port link-type trunk
port trunk allow-pass vlan 10 to 100
#
interface GigabitEthernet0/0/3
port link-type access
port default vlan 102
#
interface GigabitEthernet0/0/22
eth-trunk 10
#
interface GigabitEthernet0/0/23
eth-trunk 10
interface LoopBack0
ip address 4.4.4.4 255.255.255.255
#
ospf 1
area 0.0.0.0
network 192.168.2.0 0.0.0.255
network 192.168.10.0 0.0.0.255
network 192.168.11.0 0.0.0.255
network 192.168.12.0 0.0.0.255
network 192.168.13.0 0.0.0.255
network 192.168.99.0 0.0.0.255