一、项目拓扑图：
二、项目要求：
组建公司内部网络，实现与分公司安全传输数据，包括Vtp、Vlan、Trunk、Stp、Hsrp、Ospf、VPN、上行速链路、上行速端口、以太通道。
三、配置文件：
Router1 E1/0 <----> Switch5 F0/0
Router1 E1/1 <----> Switch6 F0/0
Router1 S2/0 <----> Router2 S2/0
Router2 F0/0 <----> VPCS V0/9
Switch1 F0/1 <----> VPCS V0/2
Switch1 F0/2 <----> VPCS V0/1
Switch1 F0/3 <----> Switch3 F0/2
Switch1 F0/4 <----> Switch4 F0/2
Switch2 F0/1 <----> VPCS V0/4
Switch2 F0/2 <----> VPCS V0/3
Switch2 F0/3 <----> Switch3 F0/1
Switch2 F0/4 <----> Switch4 F0/1
Switch3 F0/3 <----> Switch4 F0/6
Switch3 F0/4 <----> Switch4 F0/5
Switch3 F0/5 <----> Switch6 F0/1
Switch3 F0/6 <----> Switch5 F0/1
Switch4 F0/3 <----> Switch6 F0/2
Switch4 F0/4 <----> Switch5 F0/2
四、配置过程：
配置S1：
Router>en
Router#config t
Router(config)#line console 0
Router(config-line)#exec-timeout 0 0
Router(config-line)#logging syn
Router(config-line)#exit
Router(config)#hostname S1
S1(config)#exit
VTP的配置
S1#vlan database
S1(vlan)#vtp domain gg
S1(vlan)#vtp password 123
S1(vlan)#vtp client
S1(vlan)#exit
S1#config t
Trunk
S1(config)#interface range f0/3 - 4
S1(config-if-range)#switchport mode trunk
S1(config-if-range)#exit
上行速链路
S1(config)#spanning-tree uplinkfast
上行速端口
S1(config)#interface range f0/1 -2
S1(config-if-range)#spanning-tree portfast
配置S2：
Router>en
Router#config t
Router(config)#line console 0
Router(config-line)#exec-timeout 0 0
Router(config-line)#logging syn
Router(config-line)#exit
Router(config)#hostname S2
S2(config)#exit
VTP的配置
S2#vlan database
S2(vlan)#vtp domain gg
S2(vlan)#vtp password 123
S2(vlan)#vtp client
S2(vlan)#exit
Trunk
S2#config t
S2(config)#interface range f0/3 - 4
S2(config-if-range)#switchport mode trunk
S2(config-if-range)#exit
上行速端口
S2(config)#interface range f0/1 - 2
S2(config-if-range)#spanning-tree portfast
S2(config-if-range)#exit
上行速链路
S2(config)#spanning-tree uplinkfast
S2(config)#exit
配置S3：
Router>en
Router#config t
Router(config)#no ip domain lookup
Router(config)#line console 0
Router(config-line)#exec-timeout 0 0
Router(config-line)#logging syn
Router(config-line)#exit
Router(config)#hostname S3
开启三层路由功能
S3(config)#ip routing
S3(config)#exit
VTP的配置
S3(vlan)#vtp domain gg
S3(vlan)#vtp password 123
S3(vlan)#vtp server
S3(vlan)#vlan 10
S3(vlan)#vlan 20
S3(vlan)#exit
S3#config t
封装dot1q并设置为Trunk
S3(config)#interface range f0/1 - 6
S3(config-if-range)#switchport trunk encapsulation dot1q
S3(config-if-range)#switchport mode trunk
S3(config-if-range)#exit
S3(config)#interface vlan 10
S3(config-if)#ip address 192.168.10.1 255.255.255.0
S3(config-if)#no shut
S3(config-if)#exit
S3(config)#interface vlan 20
S3(config-if)#ip address 192.168.20.1 255.255.255.0
S3(config-if)#no shut
S3(config-if)#exit
STP生成树的配置
S3(config)#spanning-tree vlan 10 root primary
S3(config)#spanning-tree vlan 20 root secondary
启动三层交换后，配置IP地址
S3(config)#interface f0/5
S3(config-if)#no switchport
S3(config-if)#ip address 192.168.1.10 255.255.255.0
S3(config-if)#no shut
S3(config-if)#exit
S3(config)#interface f0/6
S3(config-if)#no switchport
S3(config-if)#ip address 192.168.2.10 255.255.255.0
S3(config-if)#no shut
S3(config-if)#exit
配置OSPF
S3(config)#router ospf 10
S3(config-router)#network 192.168.10.0 0.0.0.255 area 0
S3(config-router)#network 192.168.20.0 0.0.0.255 area 0
S3(config-router)#network 192.168.1.0 0.0.0.255 area 0
S3(config-router)#network 192.168.2.0 0.0.0.255 area 0
S3(config-router)#exit
HSRP配置
S3(config)#interface vlan 10
S3(config-if)#standby 10 ip 192.168.10.254
S3(config-if)#standby 10 priority 110
S3(config-if)#exit
S3(config)#interface vlan 20
S3(config-if)#standby 20 ip 192.168.20.254
S3(config-if)#standby 20 priority 150
S3(config-if)#standby 20 preempt
S3(config-if)#exit
以太通道配置
S3(config)#interface range f0/3 -4
S3(config-if-range)#channel-group 1 mode on
S3(config-if-range)#exit
配置S4:
Router>en
Router#config t
Router(config)#no ip domain lookup
Router(config)#line console 0
Router(config-line)#exec-timeout 0 0
Router(config-line)#logging syn
Router(config-line)#exit
Router(config)#hostname S4
启动路由功能
S4(config)#ip routing
S4(config)#exit
VTP配置
S4#vlan database
S4(vlan)#vtp domain gg
S4(vlan)#vtp password 123
S4(vlan)#vtp server
S4(vlan)#exit
S4#config t
封装dot1q并设置为Trunk
S4(config)#interface range f0/1 - 6
S4(config-if-range)#switchport trunk encapsulation dot1q
S4(config-if-range)#switchport mode trunk
S4(config-if-range)#exit
给路由接口配置IP
S4(config)#interface vlan 10
S4(config-if)#ip address 192.168.10.2 255.255.255.0
S4(config-if)#no shut
S4(config-if)#exit
S4(config)#interface vlan 20
S4(config-if)#ip address 192.168.20.2 255.255.255.0
S4(config-if)#no shut
S4(config-if)#exit
S4(config)#interface f0/3
S4(config-if)#no switchport
S4(config-if)#ip address 192.168.2.11 255.255.255.0
S4(config-if)#no shut
S4(config-if)#exit
S4(config)#interface f0/4
S4(config-if)#no switchport
S4(config-if)#ip address 192.168.1.11 255.255.255.0
S4(config-if)#no shut
S4(config-if)#exit
配置OSPF
S4(config)#router ospf 10
S4(config-router)#network 192.168.10.0 0.0.0.255 area 0
S4(config-router)#network 192.168.20.0 0.0.0.255 area 0
S4(config-router)#network 192.168.2.0 0.0.0.255 area 0
S4(config-router)#network 192.168.1.0 0.0.0.255 area 0
S4(config-router)#exit
生成树的配置
S4(config)#spanning-tree vlan 10 root secondary
S4(config)#spanning-tree vlan 20 root primary
以太通道
S4(config)#interface range f0/5 -6
S4(config-if-range)#channel-group 1 mode on
S4(config-if-range)#exit
HSRP配置
S4(config)#interface vlan 10
S4(config-if)#standby 10 ip 192.168.10.254
S4(config-if)#standby 10 priority 150
S4(config-if)#standby 10 preempt
S4(config-if)#exit
S4(config)#interface vlan 20
S4(config-if)#standby 20 ip 192.168.20.254
S4(config-if)#standby 20 priority 110
S4(config-if)#exit
S4(config)#
配置R1:
Router>en
Router#config t
Router(config)#no ip domain lookup
Router(config)#line console 0
Router(config-line)#exec-timeout 0 0
Router(config-line)#logging syn
Router(config-line)#exit
Router(config)#hostname R1
R1(config)#interface e1/0
R1(config-if)#ip address 192.168.1.1 255.255.255.0
R1(config-if)#no shut
R1(config-if)#exit
R1(config)#interface e1/1
R1(config-if)#ip address 192.168.2.1 255.255.255.0
R1(config-if)#no shut
R1(config-if)#exit
R1(config)#interface s2/0
R1(config-if)#ip address 10.0.0.1 255.255.255.0
R1(config-if)#no shut
R1(config-if)#exit
配置OSPF
R1(config)#router ospf 10
R1(config-router)#network 192.168.1.0 0.0.0.255 area 0
R1(config-router)#network 192.168.2.0 0.0.0.255 area 0
R1(config-router)#network 10.0.0.0 0.0.0.255 area 1
R1(config-router)#exit
配置VPN
R1(config)#crypto isakmp enable
R1(config)#crypto isakmp policy 10
R1(config-isakmp)#hash md5
R1(config-isakmp)#authentication pre-share
R1(config-isakmp)#encryption aes
R1(config-isakmp)#group 2
R1(config-isakmp)#lifetime 10000
R1(config-isakmp)#exit
R1(config)#crypto isakmp key gg address 10.0.0.2
R1(config)#access-list 110 permit ip any any
R1(config)#crypto ipsec transform-set cc ah-md5-hmac esp-aes esp-md5-hmac
R1(cfg-crypto-trans)#exit
R1(config)#crypto map ee 10 ipsec-isakmp
R1(config-crypto-map)#match address 110
R1(config-crypto-map)#set peer 10.0.0.2
R1(config-crypto-map)#set transform-set cc
R1(config-crypto-map)#exit
R1(config)#interface s2/0
R1(config-if)#crypto map ee
配置R2
Router>en
Router#config t
Router(config)#no ip domain lookup
Router(config)#line console 0
Router(config-line)#exec-timeout 0 0
Router(config-line)#logging syn
Router(config-line)#exit
Router(config)#hostname R2
R2(config)#interface s1/0
R2(config-if)#ip address 10.0.0.2 255.255.255.0
R2(config-if)#no shut
R2(config-if)#exit
R2(config)#interface f0/0
R2(config-if)#ip address 172.16.1.1 255.255.255.0
R2(config-if)#no shut
R2(config-if)#exit
配置OSPF
R2(config)#router ospf 10
R2(config-router)#network 10.0.0.0 0.0.0.255 area 1
R2(config-router)#network 172.16.1.0 0.0.0.255 area 1
R2(config-router)#exit
配置VPN
R2(config)#crypto isakmp enable
R2(config)#crypto isakmp policy 10
R2(config-isakmp)#hash md5
R2(config-isakmp)#authentication pre-share
R2(config-isakmp)#encryption aes
R2(config-isakmp)#group 2
R2(config-isakmp)#lifetime 10000
R2(config-isakmp)#exit
R2(config)#crypto isakmp key gg address 10.0.0.1
R2(config)#access-list 110 permit ip any any
R2(config)#crypto ipsec transform-set cc ah-md5-hmac esp-aes esp-md5-hmac
R2(cfg-crypto-trans)#exit
R2(config)#crypto map ee 10 ipsec-isakmp
R2(config-crypto-map)#match address 110
R2(config-crypto-map)#set peer 10.0.0.1
R2(config-crypto-map)#set transform-set cc
R2(config-crypto-map)#exit
R2(config)#interface s1/0
R2(config-if)#crypto map ee
R2(config-if)#
五、总结：
经过以上配置 ， 可以满足项目要求。且都可正常通信。
京公网安备 11010802021500号