• H3C opsf/rip/ftp/telent/nat/acl综合

    实验拓扑

    拓扑下载

    https://sharewh2.xuexi365.com/share/84b85b32-acb7-4f62-a389-6188680a19f3?t=3

    图 1-1

    注：如无特别说明，描述中的 R1 或 SW1 对应拓扑中设备名称末尾数字为 1 的设备，R2 或 SW2 对应拓扑中设备名称末尾数字为 2 的设备，以此类推；另外，同一网段中，IP 地址的主机位为其设备编号，如 R3 的 g0/0 接口若在 192.168.1.0/24 网段，则其 IP 地址为 192.168.1.3/24，以此类推

    实验需求

    1. 按照图示配置IP地址；修改名称，配置ospf的路由器都需要配置环回口

    2. 按照图示区域划分配置对应的动态路由协议，将所有环回口宣告进OSPF中，

    3. 将所有环回口宣告进OSPF中，将rip路由引入ospf中，ospf路由引入rip中；

    4. 要求实现内网全网互通；

    5. 要求内网部分通过使用静态路由打通,内部网络要想访问外网，所以需要通过NAT技术实现；

    7. 要求内部设备可以ping通外部网络；

    8. 要求在R1上配置FTP服务，测试时可以使所有设备均可登录访问；

    9. 要求在R4上配置Telnet服务，测试时可以使所有内网设备均可登录访问管理；

    10.要求通过配置ACL策略使R5不能访问R1的ftp服务，其他内网设备不受影响；

    11.要求你通过配置ACL策略使R2不能访问R4的Telnet服务，其他内网设备不受影响；

    12.要求R6不能ping通R1的所有网段路由，其他内网网段不受影响；

    13.要求R1不能ping通R6的所有业务IP地址包括环回口地址，其他内网地址不受影响；

    14.要求R7不允许访问R1的FTP服务和telnet服务；

    实验解法

    15，按照图示配置IP地址；修改名称,配置ospf的路由器都需要配置环回口

    R1

    1. <H3C>sys
    2. System View: return to User View with Ctrl+Z.
    3. [H3C]sysn r1
    4. [r1]int g0/0
    5. [r1-GigabitEthernet0/0]ip add 172.16.1.1 24
    6. [r1-GigabitEthernet0/0]int g0/2
    7. [r1-GigabitEthernet0/2]ip add 100.1.1.1 24
    8. [r1]int loo 0
    9. [r1-LoopBack0]ip add 1.1.1.1 32

    R2

    1. <H3C>sys
    2. System View: return to User View with Ctrl+Z.
    3. [H3C]sysn r2
    4. [r2-GigabitEthernet0/1]int g0/0
    5. [r2-GigabitEthernet0/0]ip add 172.16.1.2 24
    6. [r2-GigabitEthernet0/0]int g0/1
    7. [r2-GigabitEthernet0/1]ip add 172.16.2.2 24
    8. [r2-GigabitEthernet0/1]int g0/2
    9. [r2-GigabitEthernet0/2]ip add 172.16.3.2 24
    10. [r2]int loo 0
    11. [r2-LoopBack0]ip add 2.2.2.2 32

    R3

    1. <H3C>sys
    2. System View: return to User View with Ctrl+Z.
    3. [H3C]sysn r3
    4. [r3-GigabitEthernet0/0]int g0/1
    5. [r3-GigabitEthernet0/1]ip add 172.16.2.3 24
    6. [r3-GigabitEthernet0/1]int g0/2
    7. [r3-GigabitEthernet0/2]ip add 172.16.4.3 24
    8. [r3-GigabitEthernet0/2]int g5/0
    9. [r3-GigabitEthernet5/0]ip add 192.168.5.3 24
    10. [r3-GigabitEthernet5/0]int g5/1
    11. [r3-GigabitEthernet5/1]ip add 100.3.3.3 24
    12. [r3]int loo 0
    13. [r3-LoopBack0]ip add 3.3.3.3 32

    R4

    1. <H3C>sys
    2. System View: return to User View with Ctrl+Z.
    3. [H3C]sysn r4
    4. [r4]int g0/0
    5. [r4-GigabitEthernet0/0]ip add 192.168.2.4 24
    6. [r4-GigabitEthernet0/0]int g0/1
    7. [r4-GigabitEthernet0/1]ip add 192.168.1.4 24
    8. [r4]int loo 0
    9. [r4-LoopBack0]ip add 4.4.4.4 32

    R5

    1. <H3C>sys
    2. System View: return to User View with Ctrl+Z.
    3. [H3C]sysn r5
    4. [r5]int g0/0
    5. [r5-GigabitEthernet0/0]ip add 172.16.5.5 24
    6. [r5-GigabitEthernet0/0]int g0/1
    7. [r5-GigabitEthernet0/1]ip add 192.168.5.5 24
    8. [r5-GigabitEthernet0/1]int g0/2
    9. [r5-GigabitEthernet0/2]ip add 192.168.3.5 24
    10. [r5-GigabitEthernet0/2]int g5/0
    11. [r5-GigabitEthernet5/0]ip add 192.168.1.5 24
    12. [r5-GigabitEthernet5/0]int g5/1
    13. [r5-GigabitEthernet5/1]ip add 100.4.4.5 24
    14. [r5]int loo 0
    15. [r5-LoopBack0]ip add 5.5.5.5 32

    R6

    1. <H3C>sys
    2. System View: return to User View with Ctrl+Z.
    3. [H3C]sysn r6
    4. [r6]int g0/0
    5. [r6-GigabitEthernet0/0]ip add 172.16.3.6 24
    6. [r6-GigabitEthernet0/0]int g0/1
    7. [r6-GigabitEthernet0/1]ip add 172.16.4.6 24
    8. [r6-GigabitEthernet0/1]int g0/2
    9. [r6-GigabitEthernet0/2]ip add 172.16.5.6 24
    10. [r6-GigabitEthernet0/2]int g5/0
    11. [r6-GigabitEthernet5/0]ip add 192.168.4.6 24
    12. [r6]int loo 0
    13. [r6-LoopBack0]ip add 6.6.6.6 32

    R7

    1. <H3C>sys
    2. System View: return to User View with Ctrl+Z.
    3. [H3C]sysn r7
    4. [r7]int g0/0
    5. [r7-GigabitEthernet0/0]ip add 192.168.3.4 24
    6. [r7-GigabitEthernet0/0]int g0/1
    7. [r7-GigabitEthernet0/1]ip add 192.168.4.7 24
    8. [r7-GigabitEthernet0/1]int g0/2
    9. [r7-GigabitEthernet0/2]ip add 192.168.2.7 24
    10. [r7]int loo 0
    11. [r7-LoopBack0]ip add 7.7.7.7 32

    R8

    1. <H3C>sys
    2. System View: return to User View with Ctrl+Z.
    3. [H3C]sysn r8
    4. [r8]int g0/0
    5. [r8-GigabitEthernet0/0]ip add 100.3.3.8 24
    6. [r8-GigabitEthernet0/0]int g0/1
    7. [r8-GigabitEthernet0/1]ip add 100.1.1.8 24
    8. [r8-GigabitEthernet0/1]int g0/2
    9. [r8-GigabitEthernet0/2]ip add 100.4.4.8 24
    10. [r8-GigabitEthernet0/2]int g5/0
    11. [r8-GigabitEthernet5/0]ip add 100.5.5.8 24
    12. [r8]int loo 0
    13. [r8-LoopBack0]ip add 8.8.8.8 32

    SW1（100.5.5.0为vlan10-----192.168.100.0为vlan20）

    1. <H3C>sys
    2. System View: return to User View with Ctrl+Z.
    3. [H3C]sys sw1
    4. [sw1]vlan 10
    5. [sw1-vlan10]port g1/0/1
    6. [sw1-vlan10]vlan 20
    7. [sw1-vlan20]port g1/0/2
    8. [sw1-vlan20]int vlan 10
    9. [sw1-Vlan-interface10]ip add 100.5.5.10 24
    10. [sw1-Vlan-interface10]int vlan 20
    11. [sw1-Vlan-interface20]ip add 192.168.100.254 24

    PC10


     

    16，按照图示区域划分配置对应的动态路由协议,将所有环回口宣告进OSPF中，

    R1

    1. [r1]ospf rou 1.1.1.1
    2. [r1-ospf-1]a 0
    3. [r1-ospf-1-area-0.0.0.0]netw 172.16.1.0 0.0.0.255
    4. [r1-ospf-1-area-0.0.0.0]netw 100.1.1.0 0.0.0.255
    5. [r1-ospf-1-area-0.0.0.0]netw 1.1.1.1 0.0.0.0

    R2

    1. [r2]ospf rou 2.2.2.2
    2. [r2-ospf-1]a 0
    3. [r2-ospf-1-area-0.0.0.0]netw 172.16.1.0 0.0.0.255
    4. [r2-ospf-1-area-0.0.0.0]netw 172.16.2.0 0.0.0.255
    5. [r2-ospf-1-area-0.0.0.0]netw 172.16.3.0 0.0.0.255
    6. [r2-ospf-1-area-0.0.0.0]netw 2.2.2.2 0.0.0.0

    R3

    1. [r3]ospf rou 3.3.3.3
    2. [r3-ospf-1]a 0
    3. [r3-ospf-1-area-0.0.0.0]netw 172.16.2.0 0.0.0.255
    4. [r3-ospf-1-area-0.0.0.0]netw 100.3.3.0 0.0.0.255
    5. [r3-ospf-1-area-0.0.0.0]netw 3.3.3.3 0.0.0.0
    6. [r3-ospf-1-area-0.0.0.0]rip
    7. [r3-rip-1]ver 2
    8. [r3-rip-1]undo sum
    9. [r3-rip-1]netw 172.16.4.0
    10. [r3-rip-1]netw 192.168.5.0

    R4

    1. [r4]ospf rou 4.4.4.4
    2. [r4-ospf-1]a 0
    3. [r4-ospf-1-area-0.0.0.0]netw 192.168.2.0 0.0.0.255
    4. [r4-ospf-1-area-0.0.0.0]netw 192.168.1.0 0.0.0.255
    5. [r4-ospf-1-area-0.0.0.0]netw 4.4.4.4 0.0.0.0

    R5

    1. [r5]ospf rou 5.5.5.5
    2. [r5-ospf-1]a 0
    3. [r5-ospf-1-area-0.0.0.0]netw 192.168.3.0 0.0.0.255
    4. [r5-ospf-1-area-0.0.0.0]netw 192.168.1.0 0.0.0.255
    5. [r5-ospf-1-area-0.0.0.0]netw 5.5.5.5 0.0.0.0
    6. [r5-ospf-1-area-0.0.0.0]rip
    7. [r5-rip-1]undo sum
    8. [r5-rip-1]ver 2
    9. [r5-rip-1]netw 100.4.4.0
    10. [r5-rip-1]netw 192.168.5.0
    11. [r5-rip-1]netw 172.16.5.0

    R6

    1. [r6]rip
    2. [r6-rip-1]ver 2
    3. [r6-rip-1]undo sum
    4. [r6-rip-1]netw 172.16.4.0
    5. [r6-rip-1]netw 172.16.3.0
    6. [r6-rip-1]netw 192.168.4.0
    7. [r6-rip-1]netw 6.6.6.6

    R7

    1. [r7]ospf rou 7.7.7.7
    2. [r7-ospf-1]a 0
    3. [r7-ospf-1-area-0.0.0.0]netw 192.168.3.0 0.0.0.255
    4. [r7-ospf-1-area-0.0.0.0]netw 192.168.4.0 0.0.0.255
    5. [r7-ospf-1-area-0.0.0.0]netw 192.168.2.0 0.0.0.255
    6. [r7-ospf-1-area-0.0.0.0]netw 7.7.7.7 0.0.0.0

    R8

    1. [r8]ospf rou 8.8.8.8
    2. [r8-ospf-1]a 0
    3. [r8-ospf-1-area-0.0.0.0]netw 100.1.1.0 0.0.0.255
    4. [r8-ospf-1-area-0.0.0.0]netw 100.3.3.0 0.0.0.255
    5. [r8-ospf-1-area-0.0.0.0]netw 8.8.8.8 0.0.0.0
    6. [r8-ospf-1-area-0.0.0.0]rip
    7. [r8-rip-1]ver 2
    8. [r8-rip-1]undo sum
    9. [r8-rip-1]netw 100.4.4.0

    17，将rip路由引入ospf中，ospf路由引入rip中；

    R3

    1. [r3]ospf
    2. [r3-ospf-1]import-route rip
    3. [r3-ospf-1]rip
    4. [r3-rip-1]import-rou ospf

    R5

    1. [r5]ospf
    2. [r5-ospf-1]import-route rip
    3. [r5-ospf-1]rip
    4. [r5-rip-1]import-route ospf

    R8

    1. [r8]ospf
    2. [r8-ospf-1]import-rou rip
    3. [r8-ospf-1]rip
    4. [r8-rip-1]import-rou ospf

    18，要求实现内网全网互通；

    解析：使用ping -r路径跟踪查询每一跳是否转发有路径返回即可测试内部网段全通过使用R1pingR4环回口地址

    <r1>ping -r 4.4.4.4

    19，内网路由器使用静态路由打通外网电脑,内部网络要想访问外网网段，用ospf下发出口缺省地址，R5跨区域需要引入直连与ospf中引入缺省地址进行转发，所以需要通过NAT技术实现；

    R8

    1. [r8]ip route-sta 0.0.0.0 0 100.5.5.10
    2. [r8]acl ba 2000
    3. [r8-acl-ipv4-basic-2000]rule per so an
    4. [r8-acl-ipv4-basic-2000]int g5/0
    5. [r8-GigabitEthernet5/0]nat out 2000
    6. [r8]ospf
    7. [r8-ospf-1]default-route-advertise

    R5

    1. [r5-ospf-1]rip
    2. [r5-rip-1]im
    3. [r5-rip-1]import-route direct
    4. [r5]ospf
    5. [r5-ospf-1]default-route-advertise

    20，要求内部设备可以ping通外部网络；

    R7

    <r7>ping -r 192.168.100.1

    21，要求在R1上配置FTP服务，测试时可以使所有设备均可登录访问,真实设备需要至少10位数的密码。

    R1

    1. [r1]ftp server enable
    2. [r1]local-user yong
    3. New local user added.
    4. [r1-luser-manage-yong] password simple zxcvbnm123
    5. Invalid password composition. The new password must contain at least 2 types and at least 1 characters for each type.
    6. [r1-luser-manage-yong] service-type ftp
    7. [r1-luser-manage-yong] authorization-attribute work-directory flash:/
    8. [r1-luser-manage-yong] authorization-attribute user-role network-admin                   可操作系统所有资源与权限

    22，要求在R4上配置Telnet服务，测试时可以使所有内网设备均可登录访问管理，明文在网络中传输密码，真实设备严谨使用。

    R4

    1. [r4]telnet server enable
    2. [r4]local-user yong
    3. [r4-luser-manage-yong] password simple zxcvbnm123
    4. [r4-luser-manage-yong] service-type telnet
    5. [r4-luser-manage-yong] authorization-attribute user-role network-admin                           可操作系统所有资源与权限

    23，要求通过配置ACL策略使R5不能访问R1的ftp服务，其他内网设备不受影响；

    R5(直接复制可能报错)

    1. acl ad 3000
    2. rule deny tcp source 100.4.4.5 0 destination 100.2.2.1 0 destination-port range ftp-data ftp
    3. rule deny tcp source 192.168.5.5 0 destination 100.2.2.1 0 destination-port range ftp-data ftp
    4. rule deny tcp source 172.16.5.5 0 destination 100.2.2.1 0 destination-port range ftp-data ftp
    5. rule deny tcp source 192.168.1.5 0 destination 100.2.2.1 0 destination-port range ftp-data ftp
    6. rule deny tcp source 192.168.3.5 0 destination 100.2.2.1 0 destination-port range ftp-data ftp
    7. rule deny tcp source 5.5.5.5 0 destination 100.2.2.1 0 destination-port range ftp-data ftp
    8. rule deny tcp source 100.4.4.5 0 destination 177.16.1.1 0 destination-port range ftp-data ftp
    9. rule deny tcp source 192.168.5.5 0 destination 177.16.1.1 0 destination-port range ftp-data ftp
    10. rule deny tcp source 172.16.5.5 0 destination 177.16.1.1 0 destination-port range ftp-data ftp
    11. rule deny tcp source 192.168.1.5 0 destination 177.16.1.1 0 destination-port range ftp-data ftp
    12. rule deny tcp source 192.168.3.5 0 destination 177.16.1.1 0 destination-port range ftp-data ftp
    13. rule deny tcp source 5.5.5.5 0 destination 177.16.1.1 0 destination-port range ftp-data ftp
    14. rule deny tcp source 100.4.4.5 0 destination 1.1.1.1 0 destination-port range ftp-data ftp
    15. rule deny tcp source 192.168.5.5 0 destination 1.1.1.1 0 destination-port range ftp-data ftp
    16. rule deny tcp source 172.16.5.5 0 destination 1.1.1.1 0 destination-port range ftp-data ftp
    17. rule deny tcp source 192.168.1.5 0 destination 1.1.1.1 0 destination-port range ftp-data ftp
    18. rule deny tcp source 192.168.3.5 0 destination 1.1.1.1 0 destination-port range ftp-data ftp
    19. rule deny tcp source 5.5.5.5 0 destination 1.1.1.1 0 destination-port range ftp-data ftp
    20. int range g0/0 to g0/1
    21. packet-filter 3000 outbound
    22. int g5/1
    23. packet-filter 3000 outbound

    24，要求你通过配置ACL策略使R2不能访问R4的Telnet服务，其他内网设备不受影响；

    R2

    1. acl ad 3000
    2. rule deny tcp source 172.16.0.0 0.0.255.255 destination 192.168.0.0 0.0.255.255 destination-port eq telnet
    3. int ran g0/0 to g0/2
    4. packet-filter 3000 outbound

    25，要求R6不能ping通R1的所有网段路由，其他内网网段不受影响；

    R6

    1. acl advanced 3000
    2. rule 0 deny icmp source 192.168.2.6 0 destination 100.1.1.1 0
    3. rule 5 deny icmp source 192.168.2.6 0 destination 100.2.2.1 0
    4. rule 10 deny icmp source 192.168.2.6 0 destination 172.16.1.1 0
    5. rule 15 deny icmp source 192.168.3.6 0 destination 100.2.2.1 0
    6. rule 20 deny icmp source 192.168.3.6 0 destination 100.1.1.1 0
    7. rule 25 deny icmp source 192.168.3.6 0 destination 172.16.1.1 0
    8. rule 30 deny icmp source 192.168.4.6 0 destination 172.16.1.1 0
    9. rule 35 deny icmp source 192.168.4.6 0 destination 100.1.1.1 0
    10. rule 40 deny icmp source 192.168.4.6 0 destination 100.2.2.1 0
    11. int ran g0/0 to g0/2
    12. packet-filter 3000 outbound

    26，要求R1不能ping通R6的所有业务IP地址包括环回口地址，其他内网地址不受影响；

    R6

    1. acl advanced 3000
    2. rule deny icmp source 100.1.1.1 0 destination 6.6.6.6 0
    3. rule deny icmp source 100.2.2.1 0 destination 6.6.6.6 0
    4. rule deny icmp source 172.16.1.1 0 destination 6.6.6.6 0
    5. int ran g0/0 to g0/2
    6. packet-filter 3000 inb

    27，要求R7不允许访问R1的FTP服务和telnet服务；

    ​R7

    1. acl ad 3000
    2. rule  deny tcp source 192.168.3.4 0 destination 172.16.1.1 0 destination-port range telnet ftp
    3. rule  deny tcp source 192.168.4.7 0 destination 172.16.1.1 0 destination-port range telnet ftp
    4. rule  deny tcp source 192.168.2.7 0 destination 172.16.1.1 0 destination-port range telnet ftp
    5. rule  deny tcp source 7.7.7.7 0 destination 172.16.1.1 0 destination-port range telnet ftp
    6. rule  deny tcp source 192.168.3.4 0 destination 100.1.1.1 0 destination-port range telnet ftp
    7. rule  deny tcp source 192.168.4.7 0 destination 100.1.1.1 0 destination-port range telnet ftp
    8. rule  deny tcp source 192.168.2.7 0 destination 100.1.1.1 0 destination-port range telnet ftp
    9. rule  deny tcp source 7.7.7.7 0 destination 100.1.1.1 0 destination-port range telnet ftp
    10. rule  deny tcp source 192.168.3.4 0 destination 1.1.1.1 0 destination-port range telnet ftp
    11. rule  deny tcp source 192.168.4.7 0 destination 1.1.1.1 0 destination-port range telnet ftp
    12. rule  deny tcp source 192.168.2.7 0 destination 1.1.1.1 0 destination-port range telnet ftp
    13. rule  deny tcp source 7.7.7.7 0 destination 1.1.1.1 0 destination-port range telnet ftp
    14. int ran g0/0 to g0/1
    15. packet-filter 3000 out
  • 相关阅读:
    EasyRecovery16免费版使用人数很多的数据恢复软件
    JDK8中HashMap底层源码解析-treeifyBin和splite方法
    AUTOSAR通信篇 - CAN网络通信（七：Nm）
    AIOps探索 | 应急处置中排障的降本增效方法探索（上）
    计算机网络面试题
    ros缺少xacro的包
    Python每日一练（牛客数据分析篇新题库）——第37天：合并
    python 实现 rsa 加密
    设计模式学习笔记（十三）组合模式及其在树形结构中的应用
    Pandas读取文件性能优化 Tricks
  • 原文地址：https://blog.csdn.net/h320758724/article/details/128106688