詳細(xì)的HCIA-R&S實(shí)驗(yàn)筆記分享

ARP代理

實(shí)驗(yàn)：如下配置兩臺(tái)PC，要求實(shí)現(xiàn)兩臺(tái)PC的互相通信。

為PC各自配置IP，網(wǎng)關(guān)設(shè)置為G0/0/0口和G0/0/1接口的IP
配置AR3的接口IP，并開(kāi)啟相關(guān)的服務(wù)

[R1-GigabitEthernet0/0/0]undo?info?en??//不會(huì)提示信息
[R1-GigabitEthernet0/0/0]arp-proxy?enable??//開(kāi)啟ARP代理

[R1-GigabitEthernet0/0/1]arp-proxy?enable?
[R1-GigabitEthernet0/0/1]dis?ip?int?bri??//查看所有的接口信息，檢查IP地址是否配上以及接口是否雙up
Interface?????????????????????????IP?Address/Mask??????Physical???Protocol??
GigabitEthernet0/0/0??????????????192.168.10.254/24????up?????????up?????
GigabitEthernet0/0/1??????????????192.168.20.254/24????up?????????up?????
[R1-GigabitEthernet0/0/1]dis?arp?all??//查看ARP表項(xiàng)

#?在PC上做連通性測(cè)試

可以通過(guò)配置網(wǎng)關(guān)實(shí)現(xiàn)互通，網(wǎng)關(guān)地址為路由器與PC接口的IP

通過(guò)ARP代理實(shí)現(xiàn)互通，需要改變子網(wǎng)掩碼使不同網(wǎng)段的IP處于同一網(wǎng)段，如本題中的可以將子網(wǎng)掩碼修改為255.255.192.0，即可不通過(guò)網(wǎng)關(guān)實(shí)現(xiàn)互通

劃分VLAN

實(shí)驗(yàn)：如下圖配置PC的IP地址，需求相同VLAN可以互通，不同VLAN不能互通。

[SW1]dis?vlan??//查看VLAN
[SW1]vlan?batch?10?20??//創(chuàng)建VLAN10、VLAN20
[SW1]int?e0/0/2
[SW1-Ethernet0/0/2]port?link-type?access??//設(shè)置接口類型為Access
[SW1-Ethernet0/0/2]port?default?vlan?10??//默認(rèn)劃分進(jìn)VLAN10

#?同樣方法配置e0/0/3接口，劃分進(jìn)VLAN?20

[SW1]int?g0/0/1??//進(jìn)入g0/0/1接口
[SW1-GigabitEthernet0/0/1]port?link-type?trunk??//配置接口類型為T(mén)runk
[SW1-GigabitEthernet0/0/1]port?trunk?allow-pass?vlan?10?20??//設(shè)置允許通過(guò)的VLAN為10?20?，VLAN1默認(rèn)允許通過(guò)

#SW2相同的配置

#做連通性測(cè)試

hybrid

按照如下拓?fù)?，配置相關(guān)IP地址。需求：

不同樓層的HR部門(mén)和市場(chǎng)部門(mén)實(shí)現(xiàn)部門(mén)內(nèi)部通信

兩部門(mén)之間不允許通信

IT部門(mén)可以訪問(wèn)任意部門(mén)

[SW1]vlan?batch?10?20?30??//創(chuàng)建VLAN10、20、30
[SW1]dis?vlan??//查看是否創(chuàng)建
[SW1]int?e0/0/3??//進(jìn)入e0/0/3接口
[SW1-Ethernet0/0/3]port?hybrid?untagged?vlan?20?30??//設(shè)置允許通信的VLAN
[SW1-Ethernet0/0/3]port?hybrid?pvid?vlan?20??//設(shè)置PVID
[SW1-Ethernet0/0/3]dis?th??//查看當(dāng)前接口下的命令

#同樣方法配置e0/0/2接口
port?hybrid?pvid?vlan?10
port?hybrid?untagged?vlan?10?30

#配置e0/0/4接口
port?hybrid?pvid?vlan?30
port?hybrid?untagged?vlan?10?20?30

#配置e/0/1接口
port?hybrid?tagged?vlan?10?20?30
默認(rèn)PVID是VLAN?1

#SW2同樣的配置

#進(jìn)行連通性測(cè)試

VLAN間路由

單臂路由

把PC劃分到相應(yīng)的VLAN

把g0/0/1接口配置成trunk，并允許所有VLAN通過(guò)

配置路由器的子接口配置IP地址

子接口配置VLAN ID封裝（dot1q termination vid 10）

接口開(kāi)啟arp廣播（arp broadcast enable）

如下拓?fù)鋱D，為PC配置IP地址。配置單臂路由，實(shí)現(xiàn)PC間互通。

#先給PC配置相應(yīng)的IP地址，網(wǎng)關(guān)254

[SW1]vlan?batch?10?20?30??//創(chuàng)建VLAN
[SW1]dis?vlan??//查看VLAN是否創(chuàng)建成功
[SW1]int?g0/0/2??//進(jìn)入g0/0/2接口
[SW1-GigabitEthernet0/0/2]port?link-type?access??//配置接口類型為access
[SW1-GigabitEthernet0/0/2]port?default?vlan?10??//劃分默認(rèn)VLAN

#同樣的方法配置g0/0/3、g0/0/4接口

#配置trunk接口，并允許所有VLAN通過(guò)
[SW1]int?g0/0/1
[SW1-GigabitEthernet0/0/1]port?link-type?trunk??//配置接口類型為trunk???
[SW1-GigabitEthernet0/0/1]port?trunk?all?vlan?all??//允許所有VLAN通過(guò)

#在R1上配置子接口
[R1]int?g0/0/0.1??//配置子接口
[R1-GigabitEthernet0/0/0.1]ip?add?192.168.10.254?24??//為子接口配置IP
#同樣方法配置其他子接口
[R1]dis?ip?int?br??//查看所有接口詳細(xì)信息

#封裝VLAN號(hào)
[R1]int?g0/0/0.1
[R1-GigabitEthernet0/0/0.1]dot1q?termination?vid?10??//指定vid，即這個(gè)接口對(duì)應(yīng)的VLAN?ID
[R1-GigabitEthernet0/0/0.1]arp?broadcast?enable??//開(kāi)啟ARP的廣播功能

#同樣方法配置其他的子接口

#進(jìn)行連通性測(cè)試

三層交換

實(shí)驗(yàn)：如下拓?fù)鋱D，配置相應(yīng)IP地址。配置三層交換，使PC間互通。

[SW1]int?Vlanif?10??//創(chuàng)建VLAN10
[SW1-Vlanif10]ip?add?192.168.10.254?24??//配置IP地址
[SW1-Vlanif10]int?vlanif?20
[SW1-Vlanif20]ip?add?192.168.20.254?24
[SW1-Vlanif20]int?vlanif?30
[SW1-Vlanif30]ip?add?192.168.30.254?24

#進(jìn)行連通性測(cè)試

STP配置

SW1：4c1f-cc5c-74c7
SW2：4c1f-cc2d-7013
SW3：4c1f-cc80-7370
SW4：4c1f-cc6f-1691

選舉根橋

交換BPDU，比較BPDU，相同

比較MAC地址，SW2的MAC最小，選舉為根橋

選舉根端口

比較路徑開(kāi)銷，SW1在1號(hào)線路到達(dá)根橋路徑開(kāi)銷最小，所以SW1的1接口為RP（同理SW3的1接口、SW4的1接口都為RP）

如果路徑開(kāi)銷相同，比較BID（優(yōu)先級(jí)、MAC地址）

如果BID也相同，則比較PID（優(yōu)先級(jí)、端口號(hào)）

選舉指定端口

在網(wǎng)絡(luò)上（每條線路上）選舉指定端口

根橋開(kāi)銷為0，所以SW2的1、2、3接口都為DP

4號(hào)線路上走1、3線路開(kāi)銷相同，比較BID（優(yōu)先級(jí)、MAC地址），SW1的MAC地址小，則SW1的2接口為DP，SW3的3接口為AP

5號(hào)線路上走2、3線路開(kāi)銷相同，比較BID（優(yōu)先級(jí)、MAC地址），SW4的MAC地址小，則SW4的2接口為DP，SW3的2接口為AP

#?查看MAC地址
[SW1]dis?stp??//查看MAC地址

[SW1]dis?stp?bri??//查看SW1的STP
?MSTID??Port????????????????????????Role??STP?State?????Protection
???0????Ethernet0/0/1???????????????ROOT??FORWARDING??????NONE
???0????Ethernet0/0/2???????????????DESI??FORWARDING??????NONE
#?Ethernet0/0/1為RP，F(xiàn)ORWARDING為正常轉(zhuǎn)發(fā)數(shù)據(jù)，Ethernet0/0/2為DP

[SW2]dis?stp?bri??//查看SW2的STP
?MSTID??Port????????????????????????Role??STP?State?????Protection
???0????Ethernet0/0/1???????????????DESI??FORWARDING??????NONE
???0????Ethernet0/0/2???????????????DESI??FORWARDING??????NONE
???0????Ethernet0/0/3???????????????DESI??FORWARDING??????NONE
???0????Ethernet0/0/4???????????????DESI??FORWARDING??????NONE
???0????Ethernet0/0/5???????????????DESI??FORWARDING??????NONE

[SW3]dis?stp?bri??//查看SW3的STP
?MSTID??Port????????????????????????Role??STP?State?????Protection
???0????Ethernet0/0/1???????????????ROOT??FORWARDING??????NONE
???0????Ethernet0/0/2???????????????ALTE??DISCARDING??????NONE
???0????Ethernet0/0/3???????????????ALTE??DISCARDING??????NONE
#?Ethernet0/0/1為RP，數(shù)據(jù)正常轉(zhuǎn)發(fā)，Ethernet0/0/2和Ethernet0/0/3為AP，DISCARDING端口關(guān)閉，不轉(zhuǎn)發(fā)數(shù)據(jù)

[SW4]dis?stp?bri??//查看SW4的STP
?MSTID??Port????????????????????????Role??STP?State?????Protection
???0????Ethernet0/0/1???????????????ROOT??FORWARDING??????NONE
???0????Ethernet0/0/2???????????????DESI??FORWARDING??????NONE

拓展：使SW1為根橋，SW3位次根橋

[SW1]stp?root?primary??//使SW1成為主根橋
[SW1]dis?stp??//查看cost優(yōu)先級(jí)為0


[SW3]stp?root?secondary??//使SW3成為次根橋
[SW3]dis?stp??//查看cost優(yōu)先級(jí)為4096

#?增長(zhǎng)為12次方增長(zhǎng)，下一個(gè)是8192，一次類推

[SW1]int?e0/0/1
[SW1-Ethernet0/0/1]stp?cost????//修改接口開(kāi)銷
??INTEGER<1-200000000>??Port?path?cost
[SW1-Ethernet0/0/1]stp?cost?55

靜態(tài)路由協(xié)議

實(shí)驗(yàn)：如下拓?fù)洌凑請(qǐng)D上要求配置IP。

#?配置本地環(huán)回口地址
[R1]int?LoopBack?1
[R1-LoopBack1]ip?ad?4.4.4.4?32?

#?R1上的靜態(tài)路由配置
ip?route-static?2.2.2.2?255.255.255.255?192.168.12.2
ip?route-static?3.3.3.3?255.255.255.255?192.168.13.3
ip?route-static?4.4.4.4?255.255.255.255?192.168.12.2?preference?10
ip?route-static?4.4.4.4?255.255.255.255?192.168.13.3?preference?100
ip?route-static?192.168.24.0?255.255.255.0?192.168.12.2
ip?route-static?192.168.34.0?255.255.255.0?192.168.12.2

#?R2上的靜態(tài)路由配置
ip?route-static?1.1.1.1?255.255.255.255?192.168.12.1
ip?route-static?3.3.3.3?255.255.255.255?192.168.12.1
ip?route-static?4.4.4.4?255.255.255.255?192.168.24.4
ip?route-static?192.168.13.0?255.255.255.0?192.168.12.1
ip?route-static?192.168.34.0?255.255.255.0?192.168.24.4

#?R3上的靜態(tài)路由配置
ip?route-static?1.1.1.1?255.255.255.255?192.168.13.1
ip?route-static?2.2.2.2?255.255.255.255?192.168.13.1
ip?route-static?4.4.4.4?255.255.255.255?192.168.34.4
ip?route-static?192.168.12.0?255.255.255.0?192.168.13.1
ip?route-static?192.168.24.0?255.255.255.0?192.168.34.4

#?R4上的靜態(tài)路由配置
ip?route-static?1.1.1.1?255.255.255.255?192.168.34.3?preference?10
ip?route-static?2.2.2.2?255.255.255.255?192.168.24.2
ip?route-static?3.3.3.3?255.255.255.255?192.168.34.3
ip?route-static?192.168.12.0?255.255.255.0?192.168.34.3?preference?10
ip?route-static?192.168.12.0?255.255.255.0?192.168.24.2
ip?route-static?192.168.13.0?255.255.255.0?192.168.34.3?preference?10

#進(jìn)行連通性測(cè)試，Tracer跟蹤查看數(shù)據(jù)轉(zhuǎn)發(fā)路徑

save保存配置，重啟后配置依舊生效

用戶視圖下執(zhí)行reset saved-configuration（清空所有配置），然后reboot重啟

動(dòng)態(tài)路由協(xié)議

RIP配置

實(shí)驗(yàn)：如圖配置IP地址

#?配置環(huán)回接口地址與物理接口地址
[R1]int?LoopBack??1
[R1-LoopBack1]ip?ad?1.1.1.1?24?
[R1-LoopBack1]int?g0/0/0
[R1-GigabitEthernet0/0/0]ip?ad?12.1.1.1?24
#?相同方法配置其他路由器

#?配置RIP，對(duì)外宣告主網(wǎng)（宣告的為自身已知的主網(wǎng)）
[R1]rip?1
[R1-rip-1]network?1.0.0.0
[R1-rip-1]network?12.0.0.0
#相同方法配置其他路由器

#?連通性測(cè)試

#?配置RIP認(rèn)證方式
[R1]int?g0/0/0
[R1-GigabitEthernet0/0/0]rip?authentication-mode?simple?cipher?huawei
[R1-GigabitEthernet0/0/0]q
[R1]

RIP環(huán)路

網(wǎng)絡(luò)發(fā)生故障時(shí)，RIP網(wǎng)絡(luò)有可能會(huì)產(chǎn)生環(huán)路

環(huán)路避免：

水平分割：路由器從某個(gè)接口學(xué)到的路由，不會(huì)從該接口再發(fā)回給領(lǐng)居路由

毒性逆轉(zhuǎn)：路由從某個(gè)接口學(xué)到路由后，將該路由的跳數(shù)設(shè)置為16，并從原接收接口發(fā)回給領(lǐng)居路由器

觸發(fā)更新：當(dāng)路由信息發(fā)生變化時(shí)，立即向鄰居設(shè)備發(fā)送觸發(fā)更新報(bào)文（避免環(huán)路產(chǎn)生）

#?RIP配置
[R1]rip??//進(jìn)入RIP協(xié)議視圖
[R1-rip-1]version?2??//更改V2的版本
[R1-rip-1]network?10.0.0.0??//對(duì)外宣告主網(wǎng)

#?配置Metricin（度量值）
[R1]int?g0/0/0
[R1-GigabitEthernet0/0/0]rip?metricin?2??//更改進(jìn)接口的度量值
[R1-GigabitEthernet0/0/0]rip?metricout?2??//更改出接口的度量值

#?水平分割?&?毒性逆轉(zhuǎn)
[R1-GigabitEthernet0/0/0]rip?split-horizon??//配置水平分割，默認(rèn)開(kāi)啟
[R1-GigabitEthernet0/0/0]rip?poison-reverse??//配置毒性逆轉(zhuǎn)，默認(rèn)開(kāi)啟
#?當(dāng)兩個(gè)特性都配置時(shí)，只有毒性逆轉(zhuǎn)會(huì)生效

#?配置RIP報(bào)文的收發(fā)
[R1-GigabitEthernet0/0/0]undo?rip?output??//禁止發(fā)送RIP報(bào)文
[R1-GigabitEthernet0/0/0]undo?rip?input??//禁止接收RIP報(bào)文

#?抑制接口，命令優(yōu)先級(jí)大于rip?in/output
[R1]rip??//進(jìn)入接口視圖
[R1-rip-1]silent-interface?g0/0/0??//抑制接口，只接受RIP報(bào)文，不發(fā)送

OSPF

實(shí)驗(yàn)一：如圖配置IP，配置OSPF，要求R1、R2、R3互通。

#?R1
[R1]ospf?1??//指定OSPF的進(jìn)程號(hào)1???????????????
[R1-ospf-1]area?0??//進(jìn)入骨干區(qū)域
[R1-ospf-1-area-0.0.0.0]network?12.1.1.0?0.0.0.255??//宣告網(wǎng)段
[R1-ospf-1-area-0.0.0.0]net?1.1.1.1?0.0.0.0??//宣告精確地址
#?R2
[R2]ospf?1
[R2-ospf-1]area?0
[R2-ospf-1-area-0.0.0.0]net?2.2.2.2?0.0.0.0
[R2-ospf-1-area-0.0.0.0]net?12.1.1.2?0.0.0.0
[R2-ospf-1-area-0.0.0.0]net?23.1.1.2?
[R2-ospf-1-area-0.0.0.0]net?23.1.1.2?0.0.0.0

#?查看鄰居關(guān)系
[R1]dis?ospf?peer?bri??//查看鄰居關(guān)系

#?R3
[R3]ospf?
[R3-ospf-1]area?0
[R3-ospf-1-area-0.0.0.0]net?3.3.3.3?0.0.0.0
[R3-ospf-1-area-0.0.0.0]net?23.1.1.3?0.0.0.0
#?連通性測(cè)試

指定Router-id

#?如果沒(méi)有手動(dòng)指定router-id會(huì)自動(dòng)選取
[R2]router?id?12.1.1.2??//手動(dòng)指定Router-ID
reset?ospf?process??//重新啟動(dòng)OSPF進(jìn)程
[R2]dis?ospf?peer?bri??//查看鄰居關(guān)系，Router-ID變成了指定的12.1.1.2
[R2]dis?ospf?int?g0/0/0??//查看接口下的OSPF

OSPF單區(qū)域

如圖配置IP地址，需求使用OSPF配置，實(shí)現(xiàn)全網(wǎng)互通。

配置OSPF

#?R1
[R1]ospf?router-id?1.1.1.1??//手動(dòng)指定Router-id
[R1-ospf-1]area?0??//進(jìn)入骨干區(qū)域
[R1-ospf-1-area-0.0.0.0]net?1.1.1.1?0.0.0.0??//精確宣告1.1.1.1
[R1-ospf-1-area-0.0.0.0]net?172.16.1.254?0.0.0.0??//精確宣告172.16.1.254
[R1-ospf-1-area-0.0.0.0]net?172.16.13.1?0.0.0.0??//精確宣告172.16.13.1
[R1-ospf-1-area-0.0.0.0]net?172.16.12.1?0.0.0.0??//精確宣告172.16.12.1

#?R2
[R2]ospf?router-id?2.2.2.2
[R2-ospf-1]area?0
[R2-ospf-1-area-0.0.0.0]net?2.2.2.2?0.0.0.0
[R2-ospf-1-area-0.0.0.0]net?172.16.2.254?0.0.0.0?
[R2-ospf-1-area-0.0.0.0]net?172.16.23.2?0.0.0.0?
[R2-ospf-1-area-0.0.0.0]net?172.16.12.2?0.0.0.0

#?R3
[R3]ospf?router-id?3.3.3.3?
[R3-ospf-1]area?0
[R3-ospf-1-area-0.0.0.0]net?3.3.3.3?0.0.0.0
[R3-ospf-1-area-0.0.0.0]net?172.16.3.254?0.0.0.0
[R3-ospf-1-area-0.0.0.0]net?172.16.23.3?0.0.0.0
[R3-ospf-1-area-0.0.0.0]net?172.16.13.3?0.0.0.0

[R1]dis?cu?conf?ospf??//查看OSPF的所有配置
[R1]dis?ospf?peer?bri??//查看OSPF的鄰居狀態(tài)
[R1]dis?ip?routing-table?protocol?ospf??//查看OSPF學(xué)習(xí)到的路由表

#?連通性測(cè)試

OSPF多區(qū)域

OSPF多區(qū)域配置，需求全網(wǎng)互通

配置OSPF

#?R1
[R1]ospf?router-id?1.1.1.1??//手動(dòng)指定Router-id
[R1-ospf-1]area?0??//進(jìn)入骨干區(qū)域
[R1-ospf-1-area-0.0.0.0]net?1.1.1.1?0.0.0.0??//精確宣告1.1.1.1
[R1-ospf-1-area-0.0.0.0]net?172.16.1.254?0.0.0.0??//精確宣告172.16.1.254
[R1-ospf-1-area-0.0.0.0]net?172.16.13.1?0.0.0.0??//精確宣告172.16.13.1
[R1-ospf-1-area-0.0.0.0]net?172.16.12.1?0.0.0.0??//精確宣告172.16.12.1

#?R2
[R2]ospf?router-id?2.2.2.2
[R2-ospf-1]area?0
[R2-ospf-1-area-0.0.0.0]net?2.2.2.2?0.0.0.0
[R2-ospf-1-area-0.0.0.0]net?172.16.2.254?0.0.0.0?
[R2-ospf-1-area-0.0.0.0]net?172.16.23.2?0.0.0.0?
[R2-ospf-1-area-0.0.0.0]net?172.16.12.2?0.0.0.0
[R2-ospf-1-area-0.0.0.0]q
[R2-ospf-1]area?1
[R2-ospf-1-area-0.0.0.1]net?172.16.24.2?0.0.0.0

#?R3
[R3]ospf?router-id?3.3.3.3?
[R3-ospf-1]area?0
[R3-ospf-1-area-0.0.0.0]net?3.3.3.3?0.0.0.0
[R3-ospf-1-area-0.0.0.0]net?172.16.3.254?0.0.0.0
[R3-ospf-1-area-0.0.0.0]net?172.16.23.3?0.0.0.0
[R3-ospf-1-area-0.0.0.0]net?172.16.13.3?0.0.0.0
[R3-ospf-1-area-0.0.0.0]q
[R3-ospf-1]area?2
[R3-ospf-1-area-0.0.0.2]net?172.16.35.3?0.0.0.0

#?R4
[R4]ospf?1??//進(jìn)入OSPF進(jìn)程
[R4-ospf-1]area?1??//進(jìn)入?yún)^(qū)域1
[R4-ospf-1-area-0.0.0.1]net?4.4.4.4?0.0.0.0??//精確宣告IP地址
[R4-ospf-1-area-0.0.0.1]net?172.16.24.4?0.0.0.0

#?R5
[R5]ospf?1
[R5-ospf-1]area?2??//進(jìn)入?yún)^(qū)域2
[R5-ospf-1-area-0.0.0.2]net?5.5.5.5?0.0.0.0??//精確宣告
[R5-ospf-1-area-0.0.0.2]net?172.16.35.5?0.0.0.0

#?顯示當(dāng)前學(xué)習(xí)到的LSA信息
[R2]dis?ospf?lsdb??//查看連接的數(shù)據(jù)庫(kù)

#?連通性測(cè)試

OSPF開(kāi)銷&認(rèn)證

#?修改cost值
[R1]interface?GigabitEthernet?0/0/0
[R1-GigabitEthernet0/0/0]ospf?cost?20?

#?修改帶寬
[R1]ospf
[R1-ospf-1]bandwidth-reference?10000

#?基于接口認(rèn)證
[R1]interface?GigabitEthernet0/0/0
[R1-GigabitEthernet0/0/0]ospf?authentication-mode?md5?1?cipher?huawei

HDLC配置

如圖配置IP地址，使用HDLC接口調(diào)用配置接口。

#?R1修改端口協(xié)議
[R1]int?s1/0/0?
[R1-Serial1/0/0]link-protocol?hdlc???//修改為hdlc協(xié)議

#?R2修改端口協(xié)議
[R2]int?s1/0/0
[R2-Serial1/0/0]link-protocol?hdlc?

#?配置環(huán)回口地址
[R1]int?lo?1
[R1-LoopBack1]ip?ad?12.1.1.1?32??//配置環(huán)回口地址

[R1]int?s1/0/0
[R1-Serial1/0/0]ip?address?unnumbered?interface?LoopBack?1??//接口借用

#?添加靜態(tài)路由
[R1]ip?route-static?12.1.1.0?30?s1/0/0

#?連通性測(cè)試

PPP

PAP認(rèn)證

如圖拓?fù)?，配置IP地址，配置PPP的PAP認(rèn)證。

[R1]int?s1/0/0
[R1-Serial1/0/0]ppp?authentication-mode?pap??//PPP認(rèn)證模式修改為PAP

#?AAA認(rèn)證
[R1]aaa
[R1-aaa]local-user?bad?password?cipher?huawei123??//配置用戶名和密碼
[R1-aaa]local-user?bad?service-type?ppp??//配置用戶用于PPP

#?R2上配置
[R2]int?s1/0/0
[R2-Serial1/0/0]ppp?pap?local-user?bad?password?cipher?huawei123??//被認(rèn)證方認(rèn)證
#?連通性測(cè)試

Chap認(rèn)證

如圖配合IP地址，配置PPP的Chap認(rèn)證。

R1、R2配置接口IP地址

#?配置Chap認(rèn)證
[R1]int?s1/0/0
[R1-Serial1/0/0]ppp?authentication-mode?chap?

#?配置AAA認(rèn)證
[R1]aaa
[R1-aaa]local-user?bad?password?cipher?huawei123??//配置用戶名和密碼
[R1-aaa]local-user?bad?service-type?ppp??//配置用戶用于PPP

#?
[R2]int?s1/0/0?
[R2-Serial1/0/0]ppp?chap?user?bad
[R2-Serial1/0/0]ppp?chap?password?cipher?huawei123

#?連通性測(cè)試

PPPoE配置

PPPoE Server配置步驟

創(chuàng)建Dialer接口并通過(guò)配置IP地址

配置PAP認(rèn)證

綁定撥號(hào)接口

查看被分配的IP地址

如下拓?fù)?，配置PPPoE，使PC與PPPoE Server互通

PPPoE Server配置

#?創(chuàng)建并配置虛擬模板
[PPPoE?Server]int?Virtual-Template?1??//創(chuàng)建虛擬模板
[PPPoE?Server-Virtual-Template1]ip?ad?100.100.100.254?24??//虛擬模板配置IP地址
[PPPoE?Server-Virtual-Template1]ppp?ipcp?dns?8.8.8.8??//配置DNS

#?創(chuàng)建并配置地址池
[PPPoE?Server]ip?pool?pppoe??//創(chuàng)建地址池
[PPPoE?Server-ip-pool-pppoe]network?100.100.100.0?mask?24??//分配網(wǎng)段
[PPPoE?Server-ip-pool-pppoe]gateway-list?100.100.100.254??//設(shè)置網(wǎng)關(guān)

#?虛擬模板調(diào)用地址池并配置認(rèn)證
[PPPoE?Server]int?Virtual-Template?1??//進(jìn)入虛擬模板接口
[PPPoE?Server-Virtual-Template1]remote?address?pool?pppoe??//調(diào)用地址池
[PPPoE?Server-Virtual-Template1]ppp?authentication-mode?pap??//配置認(rèn)證模式

#?物理接口綁定虛擬模板接口
[PPPoE?Server]int?g0/0/0
[PPPoE?Server-GigabitEthernet0/0/0]pppoe-server?bind?virtual-template?1??//物理接口綁定虛擬模板

#?配置AAA認(rèn)證
[PPPoE?Server]aaa
[PPPoE?Server-aaa]local-user?bad?password?cipher?huawei123
[PPPoE?Server-aaa]local-user?bad?service-type?ppp

PPPoE Client配置

#?創(chuàng)建Dialer接口并通過(guò)配置IP地址
[PPPoE?Client]int?Dialer?1??//創(chuàng)建Dialer接口
[PPPoE?Client-Dialer1]dialer?user?bad??//指定Dialer用戶（可配可不配）
[PPPoE?Client-Dialer1]dialer?bundle?1??//接口綁定
[PPPoE?Client-Dialer1]ip?ad?ppp-negotiate??//通過(guò)鄰居分配獲得IP地址
[PPPoE?Client-Dialer1]ppp?ipcp?dns?request??//配置接受DNS服務(wù)器

#?配置PAP認(rèn)證
[PPPoE?Client-Dialer1]ppp?pap?local-user?bad?password?cipher?huawei123

#?綁定撥號(hào)接口
[PPPoE?Client]int?g0/0/1
[PPPoE?Client-GigabitEthernet0/0/1]pppoe-client?dial-bundle-number?1

#?查看被分配的IP地址，進(jìn)行連通性測(cè)試
[PPPoE?Client]ping?100.100.100.254

#?客戶端物理接口配置IP地址并配置靜態(tài)路由
[PPPoE?Client]ip?route-static?0.0.0.0?0?Dialer?1
[PPPoE?Client]int?g0/0/0
[PPPoE?Client-GigabitEthernet0/0/0]ip?ad?192.168.43.254?24

#?PPPoE服務(wù)器配置靜態(tài)路由（實(shí)際情況中無(wú)需配置靜態(tài)路由）
[PPPoE?Server]ip?route-static?0.0.0.0?0?100.100.100.253

#?PC上連通性測(cè)試

DHCP配置

如下拓?fù)?，配置DHCP，使PC1與PC2自動(dòng)獲取IP地址

配置接口地址池

配合全局地址池

配置DHCP，使兩臺(tái)PC獲得不同網(wǎng)段的IP地址

接口地址池

[DHCP?Server]dhcp?enable??//開(kāi)啟DHCP服務(wù)
[DHCP?Server]int?g0/0/0
[DHCP?Server-GigabitEthernet0/0/0]ip?ad?192.168.43.254?24??//配置地址
[DHCP?Server-GigabitEthernet0/0/0]dhcp?select?interface??//接口調(diào)用
[DHCP?Server-GigabitEthernet0/0/0]dhcp?server?dns-list?8.8.8.8??//配置DNS
[DHCP?Server-GigabitEthernet0/0/0]dhcp?server?excluded-ip-address?192.168.43.244?192.168.43.253??//不參與分配的IP地址
[DHCP?Server-GigabitEthernet0/0/0]dhcp?server?lease?day?3??//IP地址租約

#?PC使用DHCP獲取IP地址，查看IP地址

全局地址池

[DHCP?Server]dhcp?enable??//開(kāi)啟DHCP服務(wù)
[DHCP?Server]ip?pool?bad??//創(chuàng)建全局地址池
[DHCP?Server-ip-pool-bad]net?192.168.43.0?mask?24??//添加一個(gè)網(wǎng)段
[DHCP?Server-ip-pool-bad]gateway-list?192.168.43.254??//配置網(wǎng)關(guān)
[DHCP?Server-ip-pool-bad]dns-list?114.114.114.114??//配置DNS
[DHCP?Server-ip-pool-bad]excluded-ip-address?192.168.43.250?192.168.43.253??//不參與分配的IP地址
[DHCP?Server-ip-pool-bad]lease?day?5??//IP地址租約時(shí)間
[DHCP?Server-ip-pool-bad]dis?ip?pool??//查看地址池的相關(guān)信息

#?將接口使用本地地址池
[DHCP?Server]int?g0/0/0
[DHCP?Server-GigabitEthernet0/0/0]dhcp?select?global??//調(diào)用本地的地址池
[DHCP?Server-GigabitEthernet0/0/0]ip?ad?192.168.43.254?24??//接口添加IP地址（與地址池的地址同一網(wǎng)段）

#?PC查看獲取的IP地址

拓展：兩臺(tái)PC分配不同網(wǎng)段的IP（此處的配置是繼續(xù)上面的實(shí)驗(yàn)）

方法一：配置單臂路由，配置子接口

#?交換機(jī)上的配置
[SW1]vlan?10
[SW1-vlan10]vlan?20
[SW1-vlan20]int?g0/0/2?
[SW1-GigabitEthernet0/0/2]port?link-type?access?
[SW1-GigabitEthernet0/0/2]port?default?vlan?10
[SW1-GigabitEthernet0/0/2]int?g0/0/3
[SW1-GigabitEthernet0/0/3]port?link-type?access?
[SW1-GigabitEthernet0/0/3]port?default?vlan?20
[SW1-GigabitEthernet0/0/3]int?g0/0/1
[SW1-GigabitEthernet0/0/1]port?link-type?trunk?
[SW1-GigabitEthernet0/0/1]port?trunk?allow-pass?vlan?10?20

#?路由器上配置
[DHCP?Server]int?g0/0/0
[DHCP?Server-GigabitEthernet0/0/0]undo?dhcp?select?global??//刪除DHCP的配置
[DHCP?Server-GigabitEthernet0/0/0]undo?ip?add??//刪除IP地址

#?配置子接口
[DHCP?Server]int?g0/0/0.1
[DHCP?Server-GigabitEthernet0/0/0.1]dot1q?termination?vid?10??//封裝VLAN?ID
[DHCP?Server-GigabitEthernet0/0/0.1]arp?broadcast?enable??//開(kāi)啟ARP轉(zhuǎn)發(fā)
[DHCP?Server-GigabitEthernet0/0/0.1]ip?add?192.168.43.254?24??//配置IP地址
[DHCP?Server-GigabitEthernet0/0/0.1]int?g0/0/0.2
[DHCP?Server-GigabitEthernet0/0/0.2]dot1q?termination?vid?20
[DHCP?Server-GigabitEthernet0/0/0.2]arp?broadcast?enable?
[DHCP?Server-GigabitEthernet0/0/0.2]ip?add?192.168.53.254?24

#?查看地址池
[DHCP?Server]dis?ip?pool?

#?創(chuàng)建地址池
[DHCP?Server]ip?pool?boy
[DHCP?Server-ip-pool-boy]net?192.168.53.0?mask?24??//分配的網(wǎng)段
[DHCP?Server-ip-pool-boy]gateway-list?192.168.53.254??//網(wǎng)關(guān)
[DHCP?Server-ip-pool-boy]lease?day?3??//IP地址租約
[DHCP?Server-ip-pool-boy]dns-list?8.8.8.8??//DNS服務(wù)器
[DHCP?Server-ip-pool-boy]excluded-ip-address?192.168.53.200?192.168.53.253??//不參與分配的IP地址

#?查看地址池
[DHCP?Server]dis?ip?pool?

#?接口調(diào)用地址池
[DHCP?Server]int?g0/0/0.1
[DHCP?Server-GigabitEthernet0/0/0.1]dhcp?select?global??//調(diào)用全局地址池
[DHCP?Server-GigabitEthernet0/0/0.1]int?g0/0/0.2
[DHCP?Server-GigabitEthernet0/0/0.2]dhcp?select?global??//調(diào)用地址池

#?PC查看獲取的IP地址

方法二：DHCP中繼

#?配置DHCP中繼
[SW1]dhcp?enable??
[SW1]int?Vlanif?10
[SW1-Vlanif10]dhcp?select?relay?
[SW1-Vlanif10]dhcp?relay?server-ip?192.168.43.254??//DHCP服務(wù)器的出接口地址
[SW1-Vlanif10]q
[SW1]int?Vlanif?20
[SW1-Vlanif20]dhcp?select?relay?
[SW1-Vlanif20]dhcp?relay?server-ip?192.168.43.254

AAA

配置AAA步驟：

起aaa（aaa）

配置本地用戶和密碼（local-user bad password cipher huawei@123）

應(yīng)用的服務(wù)類型（local-user bad service-type telnet）

設(shè)置權(quán)限（local-user bad privilege level 5）

允許同時(shí)登錄的用戶數(shù)量（user-interface vty 0 4）

修改認(rèn)證模式（authentication-mode aaa）

配置Telnet和Stelnet登錄

[AC1]telnet?server?enable??//開(kāi)啟Telnet服務(wù)
[AC1]aaa??//配置aaa
[AC1-aaa]local-user?bad?password?cipher?huawei@123??//創(chuàng)建用戶并設(shè)置密碼
[AC1-aaa]local-user?bad?service-type?telnet??//設(shè)置賬戶類型
[AC1-aaa]local-user?bad?privilege?level?5??//設(shè)置等級(jí)
Warning:?This?operation?may?affect?online?users,?are?you?sure?to?change?the?user?privilege?level??[Y/N]y
[AC1-aaa]q

[AC1]user-interface?vty?0?4
[AC1-ui-vty0-4]protocol?inbound?all??//?允許登錄接入用戶類型的協(xié)議
[AC1-ui-vty0-4]authentication-mode?aaa??//修改aaa認(rèn)證模式
[AC1-ui-vty0-4]return

telnet?192.168.43.120??//Telnet登錄

Stelnet登錄

#?生本地rsa密鑰
[FWQ]rsa?local-key-pair?create??//創(chuàng)建密鑰
The?key?name?will?be:?Host
%?RSA?keys?defined?for?Host?already?exist.
Confirm?to?replace?them??(y/n)[n]:y??//y確認(rèn)
The?range?of?public?key?size?is?(512?~?2048).
NOTES:?If?the?key?modulus?is?greater?than?512,
???????It?will?take?a?few?minutes.
Input?the?bits?in?the?modulus[default?=?512]:512??//密鑰長(zhǎng)度
Generating?keys...

#?配置AAA認(rèn)證
[FWQ]aaa
[FWQ-aaa]local-user?bad?password?cipher?huawei@123??//創(chuàng)建用戶及密碼
[FWQ-aaa]local-user?bad?service-type?ssh??//配置用戶允許登錄方式
[FWQ-aaa]local-user?bad?privilege?level?5??//設(shè)置賬戶等級(jí)
[FWQ-aaa]q
[FWQ]user-interface?vty?0?4??//配置允許用戶登錄
[FWQ-ui-vty0-4]authentication-mode?aaa??//用戶登錄的方式
[FWQ-ui-vty0-4]protocol?inbound?ssh?//允許通過(guò)ssh登錄

#?在系統(tǒng)視圖下創(chuàng)建一個(gè)用戶，指定ssh登錄方式為密碼登錄
[FWQ]ssh?user?bad?authentication-type?password??//配置密碼登錄
[FWQ]stelnet?server?enable??//開(kāi)啟Stelnet服務(wù)

客戶端配置

#?開(kāi)啟首次認(rèn)證
[KH]ssh?client?first-time?enable?

#?Stelnet登錄
[KH]stelnet?2.2.2.29
Please?input?the?username:bad??//用戶名
Trying?2.2.2.29?...
Press?CTRL+K?to?abort
Connected?to?2.2.2.29?...
The?server?is?not?authenticated.?Continue?to?access?it??(y/n)[n]:y??//y確認(rèn)
Apr??2?2020?2028-08:00?KH?%%01SSH/4/CONTINUE_KEYEXCHANGE(l)[0]:The?server?had?not?been?authenticated?in?the?process?of?exchanging?keys.?When?deciding?whether?to?continue,?the?user?chose?Y.?
[KH]
Save?the?server's?public?key??(y/n)[n]:y??//y確認(rèn)
The?server's?public?key?will?be?saved?with?the?name?2.2.2.29.?Please?wait...

Apr??2?2020?2030-08:00?KH?%%01SSH/4/SAVE_PUBLICKEY(l)[1]:When?deciding?whether?to?save?the?server's?public?key?2.2.2.29,?the?user?chose?Y.?
[KH]
Enter?password:???//密碼

ACL配置

基本ACL配置

acl?2000
rule?deny?source?192.168.1.0?0.0.0.255
interface?GigabitEthernet?0/0/0
traffic-filter?outbound?acl?2000??//出方向調(diào)用2000規(guī)則

高級(jí)ACL配置

acl?3000
#?拒絕192.168.1.0網(wǎng)段主機(jī)訪問(wèn)172.16.10.1的FTP（21端口）
rule?deny?tcp?source?192.168.1.0?0.0.0.255?destination?172.16.10.1?0.0.0.0?destination-port?eq?21
#?拒絕192.168.2.0主機(jī)訪問(wèn)172.16.10.2的所有服務(wù)
rule?deny?tcp?source?192.168.2.0?0.0.0.255?destination?172.16.10.2?0.0.0.0?
rule?permit?ip??//允許其它，默認(rèn)為拒絕
traffic-filter?outbound?acl?3000??//接口出方向調(diào)用此ACL

實(shí)驗(yàn)：如下拓?fù)鋱D，配置IP地址，配置RIP，使PC間互通，通過(guò)配置ACL，阻止PC互通。

AR2上配置ACL

[AR2]acl?2000
[AR2-acl-basic-2000]rule?deny?source?192.168.1.0?0.0.0.255??//配置ACL
[AR2-acl-basic-2000]rule?permit??//放行其他的IP
[AR2-acl-basic-2000]q
[AR2]int?g0/0/0
[AR2-GigabitEthernet0/0/0]traffic-filter?inbound?acl?2000??//接口入方向調(diào)用ACL

ACL控制訪問(wèn)FTP服務(wù)器

[AR3]acl?3000??//配置ACL
#?禁止192.168.1.0訪問(wèn)192.168.2.100的FTP服務(wù)器
[AR3-acl-adv-3000]rule?deny?tcp?source?192.168.1.0?0.0.0.255?destination?192.168.2.100?0?destination-port?eq?21
[AR3-acl-adv-3000]q
[AR3]int?g0/0/0
[AR3-GigabitEthernet0/0/0]traffic-filter?inbound?acl?3000??//接口入方向調(diào)用ACL

NAT配置

如下拓?fù)?，完成相關(guān)IP地址配置，完成相關(guān)需求。

靜態(tài)NAT

[R1]int?g0/0/0
[R1-GigabitEthernet0/0/0]nat?static?global?202.169.10.3?inside?172.16.1.1??//建立公網(wǎng)地址與私網(wǎng)地址的映射關(guān)系

Easy IP

#?刪除靜態(tài)NAT
[R1]int?g0/0/0
[R1-GigabitEthernet0/0/0]undo?nat?static?global?202.169.10.3?inside?172.16.1.1

#?調(diào)用ACL
[R1]acl?2000??//配置ACL
[R1-acl-basic-2000]rule?permit??//配置允許所有通過(guò)
[R1-acl-basic-2000]q
[R1]int?g0/0/0
[R1-GigabitEthernet0/0/0]nat?outbound?2000??//接口調(diào)用ACL
[R1-GigabitEthernet0/0/0]q
[R1]dis?nat?outbound??//查看

動(dòng)態(tài)NAT

#?刪除Easy?IP配置
[R1]int?g0/0/0
[R1-GigabitEthernet0/0/0]undo?nat?outbound?2000
[R1-GigabitEthernet0/0/0]q
[R1]undo?acl?2000

#?創(chuàng)建公網(wǎng)地址池
#?創(chuàng)建名為1范圍為202.169.10.2-202.169.10.50的地址池
[R1]nat?address-group?1?202.169.10.2?202.169.10.50
#?創(chuàng)建名為2范圍為202.169.10.100-202.169.10.200的地址池
[R1]nat?address-group?2?202.169.10.100?202.169.10.200

#?配置ACL
[R1]acl?2000
[R1-acl-basic-2000]rule?permit?source?172.16.1.0?0.0.0.255
[R1-acl-basic-2000]q
[R1]acl?2001
[R1-acl-basic-2001]rule?permit?source?172.17.1.0?0.0.0.255

#?公網(wǎng)地址池調(diào)用ACL
[R1]int?g0/0/0
[R1-GigabitEthernet0/0/0]nat?outbound?2000?address-group?1?no-pat?
[R1-GigabitEthernet0/0/0]nat?outbound?2001?address-group?2?no-pat?

#?查看地址池
[R1]dis?nat?outbound?
?NAT?Outbound?Information:
?-----------------------------------------------------------------------
?Interface?????????????????????Acl?????Address-group/IP/Interface???Type
?-----------------------------------------------------------------------
?GigabitEthernet0/0/0?????????2000????????????????1???????????????no-pat
?GigabitEthernet0/0/0?????????2001????????????????2???????????????no-pat
?-----------------------------------------------------------------------
??Total?:?2

NAT Server

#?刪除動(dòng)態(tài)NAT配置
[R1]int?g0/0/0
[R1-GigabitEthernet0/0/0]undo?nat?outbound?2000?address-group?1?no-pat
[R1-GigabitEthernet0/0/0]undo?nat?outbound?2001?address-group?2?no-pat
[R1-GigabitEthernet0/0/0]q
[R1]undo?acl?2000
[R1]undo?acl?2001

#?重新配置ACL，并調(diào)用
[R1]acl?2000
[R1-acl-basic-2000]rule?permit?
[R1-acl-basic-2000]q
[R1]int?g0/0/0
[R1-GigabitEthernet0/0/0]nat?outbound?2000

配置NAT Server

#?配置ftp端口映射
[R1]int?g0/0/0
[R1-GigabitEthernet0/0/0]nat?server?protocol?tcp?global?current-interface?ftp?inside?172.16.1.3?ftp?

編輯：黃飛

閱讀全文

路由器(119112) 路由器(119112)
VLAN(37610) VLAN(37610)
三層交換(7188) 三層交換(7188)

評(píng)論

chinese直男口爆体育生外卖, 99久久er热在这里只有精品99, 又色又爽又黄18禁美女裸身无遮挡, gogogo高清免费观看日本电视,私密按摩师高清版在线,人妻视频毛茸茸,91论坛兴趣闲谈,欧美亚洲精品 8区,国产精品久久久久精品免费

搜索歷史

詳細(xì)的HCIA-R&S實(shí)驗(yàn)筆記分享

評(píng)論