1、第二章 搭建交換式企業網學習目標 1 交換技術 2路由技術 3安全管理 4服務配置 5WAN技術網絡拓撲Network topology 交換分支配置示例11在路由器DS-1上配置HSRP（以VLAN10為例）DS-1(config)#interface vlan 10DS-1(config-if)#standby 10 ip 54DS-1(config-if)#standby 10 priority 105DS-1(config-if)#standby 10 preempt在路由器DS-2上配置HSRP（以VLAN10為例）DS-2(config)#interface vlan 10DS-2

2、(config-if)#standby 10 ip 54DS-2(config-if)#standby 10 preempt在路由器DS-2上查看HSRP的相關信息DS-2#show standby brief P indicates configured to preempt. |Interface Grp Pri P State Active Standby Virtual IPVl10 10 100 P Standby 53 local 54Vl20 20 105 P Active local 53 54Vl30 30 100 P Standby 53 local 54Vl40 40 1

3、05 P Active local 53 54Vl101 101 100 P Standby 53 local 54 交換分支配置示例11在交換機AS-4上配置PVSTAS-4(config)#spanning-tree mode pvstAS-4(config)#spanning-tree vlan 4,5 root primaryAS-4(config)#spanning-tree vlan 6,7 root secondary在交換機AS-5上配置PVSTAS-5(config)#spanning-tree mode pvstAS-5(config)#spanning-tree vlan

4、 4,5 root secondaryAS-5(config)#spanning-tree vlan 6,7 root primary 交換分支配置示例11在AS-1交換機上配置VTP服務器 AS-1(config-if-range)#vlan 10 AS-1(config-vlan)#name BM1 AS-1(config)#vtp domain 17net1.ytvcAS-1(config)#vtp version 2AS-1(config)#vtp mode serverAS-1(config)#vtp password 17net1 在路由器AS-2上配置VTP客戶端AS-2(con

5、fig)#vtp domain 17net1.ytvcAS-2(config)#vtp version 2AS-2(config)#vtp mode clientAS-2(config)#vtp password 17net1 在二層交換機AS-1上查看VTP服務器端狀態信息AS-1#show vtp status VTP Version : 2Configuration Revision : 11Maximum VLANs supported locally : 255Number of existing VLANs : 10VTP Operating Mode : ServerVTP Do

6、main Name : 17net1.ytvcVTP Pruning Mode : DisabledVTP V2 Mode : EnabledVTP Traps Generation : DisabledMD5 digest : 0 x9F 0 xF7 0 x15 0 xF2 0 x67 0 x62 0 x4F 0 x4A Configuration last modified by at 3-1-93 01:16:57 路由分支配置示例12在路由器Router-Edge上配置靜態路由Router-Edge(config)#ip route Router-Edge(config)#ip rou

7、te Router-Edge(config)#ip route serial 0/2/0在路由器DS-1上配置靜態默認路由DS-1(config)#ip route 在路由器DS-2上配置靜態默認路由DS-2(config)#ip route 在路由器WJ-R上配置靜態默認路由WJ-R(config)#ip route 安全管理配置示例13PC11訪問FTP服務器C:ftp 52Trying to connect.52%Error opening 52/ (Timed out)(Disconnecting from ftp server)C:FTP服務器安全Router-Edge(config

8、)#ip access-list extended denyFTPRouter-Edge(config-ext-nacl)#deny ip 55 host 52Router-Edge(config-ext-nacl)#deny ip 55 host 52Router-Edge(config-ext-nacl)#permit ip any anyRouter-Edge(config)#interface vlan 200Router-Edge(config-if)#ip access-group denyFTP outPC31訪問FTP服務器,并下載文件C:ftp 52Trying to con

9、nect.52Connected to 52220- Welcome to PT Ftp serverUsername:cisco331- Username ok, need passwordPassword:230- Logged in(passive mode On)ftpftpget vlan.dat-AS1Reading file vlan.dat-AS1 from 52: File transfer in progress.Transfer complete - 856 bytes856 bytes copied in 0 secs 安全管理配置示例13DS-1設備VTY訪問限制DS

10、-1(config)#access-list 1 permit 55DS-1(config)#line vty 0 2DS-1(config-line)#access-class 1 inPC11遠程登錄DS-1設備C:telnet Trying .OpenConnection to closed by foreign hostC:PC41遠程登錄DS-1C:telnet Trying .OpenUser Access VerificationUsername: srkPassword: DS-1 服務配置示例14在路由器DS-1上配置DHCP服務 DS-1(config)#ip dhcp e

11、xcluded-address 01 54 DS-1(config)#ip dhcp pool VLAN10DS-1(dhcp-config)#network DS-1(dhcp-config)#default-router 54DS-1(dhcp-config)#dns-server 52在三層交換機WJ-R上配置DHCP中繼（中繼DHCP服務器地址池）WJ-R(config)#interface GigabitEthernet 0/0.5WJ-R(config-subif)#ip helper-address 53WJ-R(config-subif)#interface GigabitEt

12、hernet 0/0.6WJ-R(config-subif)#ip helper-address 53 服務配置示例14在交換機AS-1上創建用戶名、密碼AS-1enablePassword: AS-1#configure terminalAS-1(config)#ip ftp username ciscoAS-1(config)#ip ftp password cisco在交換機AS-1上將文件備份到FTP服務器AS-1#copy startup-config ftpAddress or name of remote host ? 52Destination filename AS-1-co

13、nfg? Writing startup-config.OK - 1996 bytes1996 bytes copied in 0.023 secs (86000 bytes/sec) WAN技術配置示例15 在WJ-R路由器上配置NAT及靜態地址映射WJ-R(config)#access-list 88 permit 55WJ-R(config)#ip nat inside source list 88 interface GigabitEthernet 0/0/0 overloadWJ-R(config)#interface GigabitEthernet 0/0/0WJ-R(config

14、-if)#ip nat outsideWJ-R(config-if)#interface GigabitEthernet 0/0.4WJ-R(config-subif)#ip nat insideWJ-R(config-subif)#interface GigabitEthernet 0/0.5WJ-R(config-subif)#ip nat insideWJ-R(config-subif)#interface GigabitEthernet 0/0.6WJ-R(config-subif)#ip nat insideWJ-R(config-subif)#interface GigabitEt

15、hernet 0/0.7WJ-R(config-subif)#ip nat inside WAN技術配置示例15在路由器Router-Edge上配置PPP協議Router-Edge(config)#username ISP-1 password ciscoRouter-Edge(config)#interface Serial0/2/0Router-Edge(config-if)#encapsulation pppRouter-Edge(config-if)#ppp authentication chap在路由器ISP-1上配置PPP協議ISP-1(config)#username Route

16、r-Edge password ciscoISP-1(config)#interface Serial0/0/0ISP-1(config-if)#encapsulation pppISP-1(config-if)#ppp authentication chap WAN技術配置示例15在路由器Router-Edge配置Tunnel隧道Router-Edge(config)#interface Tunnel0Router-Edge(config-if)#ip address 52Router-Edge(config-if)#tunnel source Serial0/2/0Router-Edge(config-if)#tunnel destination 在路由器Router-Edge配置靜態路由Router-Edge(config)#ip route Router-Edge(config)#ip route Router-