整體規(guī)劃

采用三層網(wǎng)絡(luò)結(jié)構(gòu)，核心、匯聚三層互聯(lián)，堆疊采用40G網(wǎng)絡(luò)，匯聚10G，接入1G，網(wǎng)關(guān)下放到匯聚，交換機(jī)采用獨(dú)立管理VLAN，模擬某工廠真實(shí)網(wǎng)絡(luò)情況。

功能實(shí)現(xiàn)

1、核心、匯聚堆疊，動態(tài)端口聚合

2、配置DHCP服務(wù)器為多個VLAN服務(wù)

3、靜態(tài)路由與OSPF配置

4、外網(wǎng)NAT訪問實(shí)現(xiàn)

5、接入交換機(jī)Telnet、管理IP實(shí)現(xiàn)

6、SNMP網(wǎng)管服務(wù)部署

7、監(jiān)控攝像頭隔離

8、DHCP仿冒防御

9、端口隔離

項目文件分享

模擬器為H3C官方HCL模擬器，安裝并導(dǎo)入即可

?下載

配置詳情

1、設(shè)置固定IP，配置主機(jī)名

如圖片所示

2、核心堆疊，采用40G口堆疊

核心1

<hexin1>sys

System View: return to User View with Ctrl+Z.

[hexin1]int range FortyGigE 1/0/53 to FortyGigE 1/0/54

[hexin1-if-range]shu

[hexin1-if-range]quit

[hexin1]irf member 1 priority 32

[hexin1]irf-port 1/1

[hexin1-irf-port1/1]port group interface FortyGigE 1/0/53

[hexin1-irf-port1/1]port group interface FortyGigE 1/0/54

[hexin1-irf-port1/1]quit

[hexin1]irf-port-configuration active

[hexin1]int range FortyGigE 1/0/53 to FortyGigE 1/0/54

[hexin1-if-range]un sh

[hexin1-if-range]save

核心2

[hexin2]sys

[hexin2]irf member 1 renumber 2

Renumbering the member ID may result in configuration change or loss. Continue?[Y/N]:y

[hexin2]quit

<hexin2>reboot

<hexin2>sys

System View: return to User View with Ctrl+Z.

[hexin2]interface range FortyGigE 2/0/53 to FortyGigE 2/0/54

[hexin2-if-range]shu

[hexin2-if-range]quit

[hexin2]irf member 2 priority 1

[hexin2]irf-port 2/2

[hexin2-irf-port2/2]port group interface FortyGigE 2/0/53

[hexin2-irf-port2/2]port group interface FortyGigE 2/0/54

[hexin2-irf-port2/2]qui

[hexin2]irf-port-configuration? active

[hexin2]interface range FortyGigE 2/0/53 to FortyGigE 2/0/54

[hexin2-if-range]un sh

[hexin2-if-range]quit

[hexin2]save

連接堆疊線后，機(jī)器自動重啟，此時兩臺交換機(jī)終端都會顯示為?hexin1

3、車間匯聚堆疊，采用40G口

步驟與核心相同，堆疊后兩臺終端都會顯示為?chejianhuiju1

4、按圖片為交換機(jī)配置IP和VLAN，三層采用路由模式，匯聚下聯(lián)trunk，接入上聯(lián)trunk，下聯(lián)對應(yīng)vlan

車間匯聚做端口聚合

[chejianhuiju1]vlan 1004

[chejianhuiju1-vlan1004]int vlan 1004

[chejianhuiju1-Vlan-interface1004]ip add 10.0.4.254 24

[chejianhuiju1-Vlan-interface1004]quit

[chejianhuiju1]int Bridge-Aggregation 1

[chejianhuiju1-Bridge-Aggregation1]link-aggregation mode dynamic

[chejianhuiju1-Bridge-Aggregation1]quit

[chejianhuiju1]int g1/0/1

[chejianhuiju1-GigabitEthernet1/0/1]port link-aggregation group 1

[chejianhuiju1-GigabitEthernet1/0/1]int g2/0/1

[chejianhuiju1-GigabitEthernet2/0/1]port link-aggregation group 1

[chejianhuiju1-GigabitEthernet2/0/1]dis link-aggregation verbose

? GE1/0/1? ? ? ? ? ? 0? ? ? 32768? ? 0? ? ? ? 0x8000, 0000-0000-0000 {EF}

? GE2/0/1? ? ? ? ? ? 0? ? ? 32768? ? 0? ? ? ? 0x8000, 0000-0000-0000 {EF}

[chejianhuiju1-GigabitEthernet2/0/1]vlan 1004

[chejianhuiju1-vlan1004]port Bridge-Aggregation 1

[chejianhuiju1]int Bridge-Aggregation 1

[chejianhuiju1-Bridge-Aggregation1]port link-type trunk

[chejianhuiju1-Bridge-Aggregation1]port trunk permit vlan all

[chejianhuiju1-Bridge-Aggregation1]save

驗證生產(chǎn)設(shè)備，ping 10.0.20.4 10.0.50.5 10.0.4.254 都通

5、配置OSPF，實(shí)現(xiàn)車間、辦公、生產(chǎn)服務(wù)器、基礎(chǔ)服務(wù)器互通

配置核心

<hexin1>sys

System View: return to User View with Ctrl+Z.

[hexin1]ospf

[hexin1-ospf-1]area 0

[hexin1-ospf-1-area-0.0.0.0]netwo

[hexin1-ospf-1-area-0.0.0.0]network 10.0.70.0 0.0.0.255

[hexin1-ospf-1-area-0.0.0.0]network 10.0.40.0 0.0.0.255

[hexin1-ospf-1-area-0.0.0.0]network 10.0.60.0 0.0.0.255

[hexin1-ospf-1-area-0.0.0.0]network 10.0.30.0 0.0.0.255

[hexin1-ospf-1-area-0.0.0.0]network 10.0.50.0 0.0.0.255

[hexin1-ospf-1-area-0.0.0.0]quit

配置車間匯聚

<chejianhuiju1>sys

System View: return to User View with Ctrl+Z.

[chejianhuiju1]ospf

[chejianhuiju1-ospf-1]area 0

[chejianhuiju1-ospf-1-area-0.0.0.0]network 10.0.4.0 0.0.0.255

[chejianhuiju1-ospf-1-area-0.0.0.0]network 10.0.20.0 0.0.0.255

[chejianhuiju1-ospf-1-area-0.0.0.0]network 10.0.50.0 0.0.0.255

[chejianhuiju1-ospf-1-area-0.0.0.0]quit

生產(chǎn)設(shè)備ping核心通，其他配置類似。

6、配置DHCP服務(wù)器

使用三層交換機(jī)搭建DHCP服務(wù)器，ping測試

[H3C]hostname dhcp

[dhcp]int g1/0/1

[dhcp-GigabitEthernet1/0/1]port link-mode route

[dhcp-GigabitEthernet1/0/1]ip add 10.0.0.1 24

[dhcp-GigabitEthernet1/0/1]save

[dhcp-GigabitEthernet1/0/1]quit

[dhcp]ip route-static 0.0.0.0 0 10.0.0.254

[dhcp]ping 10.0.0.254

Ping 10.0.0.254 (10.0.0.254): 56 data bytes, press CTRL_C to break

56 bytes from 10.0.0.254: icmp_seq=0 ttl=255 time=0.000 ms

創(chuàng)建DHCP池

[dhcp]dhcp enable

dhcp server ip-pool bangong

gateway-list 10.0.3.254

network 10.0.3.0 mask 255.255.255.0

address range 10.0.3.100 10.0.3.200

dns-list 8.8.8.8

expired day 3

#

dhcp server ip-pool wuxian

gateway-list 10.0.2.254

network 10.0.2.0 mask 255.255.255.0

address range 10.0.2.150 10.0.2.200

dns-list 114.114.114.114

expired day 3

#

沿途匯聚、核心都要開啟DHCP中繼，二層只要有對應(yīng)VLAN并trunk即可。

[jichuhuiju]dhcp enable

#

interface Vlan-interface1002

dhcp select relay

dhcp relay server-address 10.0.0.1

#

interface Vlan-interface1003

dhcp select relay

dhcp relay server-address 10.0.0.1

#

查看客戶端IP，成功獲取IP

[dhcp]display dhcp server ip-in-use

IP address? ? ? Client identifier/? ? Lease expiration? ? ? Type

? ? ? ? ? ? ? ? Hardware address

10.0.2.150? ? ? 0038-6163-312e-3334-? Jun 26 20:35:43 2021? Auto(C)

? ? ? ? ? ? ? ? 3266-2e31-3730-362d-

? ? ? ? ? ? ? ? 4745-302f-302f-31

10.0.3.100? ? ? 0038-6137-362e-3466-? Jun 28 20:35:31 2021? Auto(C)

? ? ? ? ? ? ? ? 3864-2e31-3230-362d-

? ? ? ? ? ? ? ? 4745-302f-302f-31

7、配置專線，僅辦公和無線可以訪問

辦公匯聚、無線匯聚、核心、專線靜態(tài)路由

[wuxianhuiju] ip route-static 10.1.0.0 24 10.0.60.10

[hexin1]ip route-static 10.1.0.0 24 10.0.90.18

[zhuanxianwangguan]ip route-static 10.0.2.0 24 10.0.90.15

測試辦公和無線都可以訪問專線IP10.1.0.2

8、配置辦公和無線能訪問外網(wǎng)，但外網(wǎng)無法直接訪問內(nèi)網(wǎng)

辦公匯聚、無線匯聚、核心默認(rèn)路由，外網(wǎng)網(wǎng)關(guān)靜態(tài)路由

[bangonghuiju]ip route-static 0.0.0.0 0 10.0.30.6

[wuxianhuiju]ip route-static 0.0.0.0 0 10.0.60.10

[hexin1]ip route-static 0.0.0.0 0 10.0.10.1

[waibuwangguan]ip route-static 10.0.3.0 24 10.0.10.2

[waibuwangguan]ip route-static 10.0.2.0 24 10.0.10.2

配置最簡單NAT訪問方式Easy IP

[waibuwangguan]acl basic 200

[waibuwangguan-acl-ipv4-basic-2000]rule 0 permit source 10.0.2.0 0.0.0.255

[waibuwangguan-acl-ipv4-basic-2000]acl basic 2001

[waibuwangguan-acl-ipv4-basic-2001]rule 0 permit source 10.0.3.0 0.0.0.255

[waibuwangguan-acl-ipv4-basic-2001]quit

[waibuwangguan]int g0/0

[waibuwangguan-GigabitEthernet0/0]nat outbound 2001

[waibuwangguan-GigabitEthernet0/0]nat outbound 2000

辦公和無線ping外網(wǎng)1.1.1.2通，外網(wǎng)ping內(nèi)網(wǎng)不通

9、POE供電

受模擬器限制無法實(shí)現(xiàn)，實(shí)際在無線接入執(zhí)行?poe enable?即可

10、辦公人員通過telnet遠(yuǎn)程管理車間接入交換機(jī)

車間匯聚創(chuàng)建管理vlan2000

[chejianhuiju1]vlan 2000

[chejianhuiju1-vlan2000]int vlan 2000

[chejianhuiju1-Vlan-interface2000]ip add 192.168.1.254 24

車間接入創(chuàng)建管理vlan，開啟telnet服務(wù)，設(shè)置默認(rèn)路由

<chejianjieru>sys

System View: return to User View with Ctrl+Z.

[chejianjieru]vlan 2000

[chejianjieru-vlan2000]int vlan 2000

[chejianjieru-Vlan-interface2000]ip add 192.168.1.2 24

[chejianjieru-Vlan-interface2000]quit

[chejianjieru]user-interface vty 0 4

[chejianjieru-line-vty0-4]authentication-mode scheme

[chejianjieru-line-vty0-4]quit

[chejianjieru]local-user admin

New local user added.

[chejianjieru-luser-manage-admin]password simple 123456

[chejianjieru-luser-manage-admin]authorization-attribute user-role level-15

[chejianjieru-luser-manage-admin]service-type telnet

[chejianjieru-luser-manage-admin]quit

[chejianjieru]telnet server enable

[chejianjieru]save

[chejianjieru]ip route-static 0.0.0.0 0 192.168.1.254

核心添加靜態(tài)路由

[hexin1]ip route-static 192.168.1.0 24 10.0.20.4

辦公人員遠(yuǎn)程telnet

<bangonghuiju>telnet 192.168.1.2

Trying 192.168.1.2 ...

Press CTRL+K to abort

Connected to 192.168.1.2 ...

******************************************************************************

* Copyright (c) 2004-2017 New H3C Technologies Co., Ltd. All rights reserved.*

* Without the owner's prior written consent,? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? *

* no decompiling or reverse-engineering shall be allowed.? ? ? ? ? ? ? ? ? ? *

******************************************************************************

login: admin

Password:

<chejianjieru>

11、配置snmp網(wǎng)絡(luò)管理協(xié)議

配置向10.0.0.1發(fā)送設(shè)備信息

snmp-agent

snmp-agent community write private

snmp-agent community read public

snmp-agent sys-info version all

snmp-agent target-host trap address udp-domain 10.0.0.1 params securityname public v2c

12、配置監(jiān)控網(wǎng)絡(luò)，辦公和無線可以訪問監(jiān)控服務(wù)器，不可訪問攝像頭，攝像頭僅與監(jiān)控服務(wù)器互相訪問

核心設(shè)置靜態(tài)路由，監(jiān)控匯聚設(shè)置默認(rèn)路由

[hexin1]ip route-static 10.0.5.0 24 10.0.80.17

[jiankonghuiju]ip route-static 0.0.0.0 0 10.0.80.16

在監(jiān)控匯聚上聯(lián)接口配置ACL規(guī)則，只允許訪問10.0.5.1發(fā)出，其他禁止，從而達(dá)到只允許監(jiān)控服務(wù)器被訪問的目的

[jiankonghuiju]acl basic 2000

[jiankonghuiju-acl-ipv4-basic-2000]rule 0 permit source 10.0.5.1 0

[jiankonghuiju-acl-ipv4-basic-2000]rule 1 deny

[jiankonghuiju-acl-ipv4-basic-2000]quit

[jiankonghuiju]int Ten-GigabitEthernet1/0/49

[jiankonghuiju-Ten-GigabitEthernet1/0/49]packet-filter 2000 outbound

測試辦公可以ping通10.0.5.1，不能ping通10.0.5.2

13、配置DHCP snooping，防止仿冒攻擊

全局開啟dhcp snooping，上聯(lián)端口啟用dhcp信任

[bangongjieru]dhcp snooping enable

[bangongjieru]interface GigabitEthernet1/0/2

[bangongjieru]dhcp snooping trust

14、配置端口隔離，減少接入傻瓜交換機(jī)造成的網(wǎng)絡(luò)風(fēng)暴，防御ARP攻擊

[H3C]port-isolate group 2

[H3C]int g1/0/1

[H3C-GigabitEthernet1/0/1]port-isolate enable group 2

[H3C-GigabitEthernet1/0/1]int g1/0/2

[H3C-GigabitEthernet1/0/2]port-isolate enable group 2

[H3C-GigabitEthernet1/0/2]quit

[H3C]dis port-isolate group 2

Port isolation group information:

Group ID: 2

Group members:

GigabitEthernet1/0/1? ? ? ? ? GigabitEthernet1/0/2

總結(jié)

爽