思科模擬校園網(wǎng)構(gòu)建

1、.一、背景某學(xué)校校園網(wǎng)處于改造中，為保證部分網(wǎng)絡(luò)息安全，拒絕其他部門計(jì)算機(jī)訪問，通過在交換機(jī)使用虛擬局域網(wǎng)技術(shù)，實(shí)現(xiàn)部門間安全隔離。通過VLAN技術(shù)實(shí)現(xiàn)部門之間的安全隔離后，部門與部門之間無法訪問對(duì)方網(wǎng)絡(luò)，造成信息共享不方便。學(xué)校希望劃分虛擬網(wǎng)絡(luò)后，部門之間能有選擇實(shí)施通信，保證部門之間地網(wǎng)絡(luò)的安全連通.同時(shí)，實(shí)現(xiàn)不同校區(qū)網(wǎng)絡(luò)之間的互連互通。網(wǎng)絡(luò)中心通過路由器，連接到學(xué)校的公共服務(wù)器上，保證所有主機(jī)能夠連接到公共服務(wù)器。二、需求及分析需求1：保證部分網(wǎng)絡(luò)息安全，拒絕其他部門計(jì)算機(jī)訪問。分析1:使用VLAN技術(shù)劃分子網(wǎng)，實(shí)現(xiàn)各部門安全隔離。需求2: 部門之間能有選擇實(shí)施通信，保證部門之間地網(wǎng)絡(luò)的

2、安全連通。分析2: 各個(gè)VLAN間需要通過核心交換機(jī)進(jìn)行VLAN間路由，保證各個(gè)網(wǎng)段間能夠互相訪問。需求3: 實(shí)現(xiàn)不同校區(qū)網(wǎng)絡(luò)之間的互連互通。分析3:使用路由技術(shù)以不同校區(qū)主機(jī)。需求4:保證所有主機(jī)連接公共服務(wù)器。分析4:使用通過路由技術(shù)實(shí)現(xiàn)所有主機(jī)可連接到公共服務(wù)器。三、拓?fù)鋱D4、 技術(shù)實(shí)現(xiàn)1.IP地址劃分根據(jù)學(xué)校的部門數(shù)量劃分，將學(xué)校分為以下幾個(gè)VLAN:VLAN號(hào)VLAN名稱IP網(wǎng)段默認(rèn)網(wǎng)關(guān)對(duì)應(yīng)交換機(jī)說明VLAN 1 vlan10192.168.10.0/24192.168.10.1Switch0教務(wù)處 VLANVLAN 2 vlan20192.168.20.0/24192.168.20

3、.1Switch1教師宿舍 VLANVLAN 4vlan30192. 168.30.0/24192.168.30.1Switch2學(xué)生宿舍 VLANVLAN 5 vlan40192. 168.40.0/24192.168.40.1Switch3教學(xué)樓 VLANVLAN 6vlan50192. 168.50.0/24192.168.50.1Switch1實(shí)驗(yàn)室 VLAN主機(jī)名稱所屬單位IP地址默認(rèn)網(wǎng)關(guān)對(duì)應(yīng)交換機(jī)對(duì)應(yīng)接口01教務(wù)處192.168.10.2192.168.10.1Switch0Fa0/102教師宿舍192.168.20.2192.168.20.1Switch0Fa0/203教務(wù)處19

4、2.168.10.3192.168.10.1Switch1Fa0/104學(xué)生宿舍192.168.30.2192.168.30.1Switch2Fa0/105學(xué)生宿舍192.168.30.3192.168.30.1Switch2Fa0/206教學(xué)樓192.168.40.2192.168.40.1Switch3Fa0/107教學(xué)樓192.168.40.3192.168.40.1Switch3Fa0/208實(shí)驗(yàn)樓192.168.50.2192.168.50.1Switch4Fa0/109實(shí)驗(yàn)樓192.168.50.3192.168.50.1Switch4Fa0/210服務(wù)器192.168.92.21

5、92.168.92.1設(shè)備名稱端口名稱地址三級(jí)交換機(jī)1Fa0/5192.168.61.2/24三級(jí)交換機(jī)2Fa0/2192.168.52.2/24路由器R0Fa0/0192.168.61.1/24Se0/3/0192.168.70.1/24Se0/3/1192.168.80.1/24路由器R1Fa0/0192.168.52.1/24Se0/3/0192.168.70.2/24Se0/3/1192.168.90.1/24路由器R2Fa0/0192.168.92.1/24Se0/3/0192.168.80.2/24Se0/3/1192.168.90.2/242 配置(1) 二級(jí)交換機(jī)配置二級(jí)交換機(jī)

6、使用機(jī)型為2650-24，主要使用vlan技術(shù)實(shí)現(xiàn)劃分子網(wǎng)，已達(dá)到以下作用1.端口的分隔。即便在同一個(gè)交換機(jī)上，處于不同VLAN的端口也是不能通信的。這樣一個(gè)物理的交換機(jī)可以當(dāng)作多個(gè)邏輯的交換機(jī)使用。2.網(wǎng)絡(luò)的安全。不同VLAN不能直接通信，杜絕了廣播信息的不安全性。3.靈活的管理。更改用戶所屬的網(wǎng)絡(luò)不必?fù)Q端口和連線，只更改軟件配置就可以了。具體配置見下：Switch0配置：劃分vlan10和vlan20Switch>enSwitch*Switch* configure terimanalSwitch(config)*hostname Switch0Switch0(config)* vl

7、an 10Switch0(config-vlan)*exitSwitch0(config)*interface fastethernet 0/1Switch0(config-if)*switchport access vlan 10Switch0(config-if)*no shutdownSwitch0(config-if)*exitSwitch0(config)* vlan 20Switch0(config-vlan)*exitSwitch0(config)*interface fastethernet 0/2Switch0(config-if)*switchport access vla

8、n20Switch0(config-if)*no shutdownSwitch0(config-if)*exit設(shè)置trunk通道實(shí)現(xiàn)不同vlan連通Switch0(config)*interface fastethernet 0/3Switch0(config-if)*switchport mode trunkSwitch0(config-if)*exitSwitch0(config)*interface fastethernet 0/4Switch0(config-if)*switchport mode trunk使用”show vlan”命令查看VLAN配置信息Switch1配置：劃分v

9、lan10Switch>enSwitch*Switch* configure terimanalSwitch1(config)*hostname Switch1Switch1(config)* vlan 10Switch1(config-vlan)*exitSwitch1(config)*interface fastethernet 0/1Switch1(config-if)*switchport access vlan 10Switch1(config-if)*no shutdownSwitch1(config-if)*exit設(shè)置trunk通道實(shí)現(xiàn)不同vlan連通Switch1(co

10、nfig)*interface fastethernet 0/2Switch1(config-if)*switchport mode trunkSwitch1(config-if)*exitSwitch1(config)*interface fastethernet 0/3Switch1(config-if)*switchport mode trunkSwitch1(config-if)*exitSwitch2配置：劃分vlan30Switch>enSwitch*Switch* configure terimanalSwitch(config)*hostname Switch2Switc

11、h2(config)* vlan 30Switch2(config-vlan)*exitSwitch2(config)*interface fastethernet 0/1Switch2(config-if)*switchport access vlan 30Switch2(config-if)*no shutdownSwitch2(config-if)*exitSwitch2(config)*interface fastethernet 0/2Switch2(config-if)*switchport access vlan30Switch2(config-if)*no shutdownSw

12、itch2(config-if)*exit設(shè)置trunk通道實(shí)現(xiàn)不同vlan連通Switch2(config)*interface fastethernet 0/3Switch2(config-if)*switchport mode trunkSwitch2(config-if)*exitSwitch3配置：劃分vlan40Switch>enSwitch*Switch* configure terimanalSwitch(config)*hostname Switch3Switch3(config)* vlan 40Switch3(config-vlan)*exitSwitch3(con

13、fig)*interface fastethernet 0/1Switch3(config-if)*switchport access vlan 40Switch3(config-if)*no shutdownSwitch3(config-if)*exitSwitch3(config)*interface fastethernet 0/2Switch3(config-if)*switchport access vlan40Switch3(config-if)*no shutdownSwitch3(config-if)*exit設(shè)置trunk通道實(shí)現(xiàn)不同vlan連通Switch3(config)

14、*interface fastethernet 0/3Switch3(config-if)*switchport mode trunkSwitch3(config-if)*exitSwitch4配置：劃分vlan50Switch>enSwitch*Switch* configure terimanalSwitch(config)*hostname Switch4Switch4(config)* vlan 50Switch4(config-vlan)*exitSwitch4(config)*interface fastethernet 0/1Switch4(config-if)*switc

15、hport access vlan 50Switch4(config-if)*no shutdownSwitch4(config-if)*exitSwitch4(config)*interface fastethernet 0/2Switch4(config-if)*switchport access vlan50Switch4(config-if)*no shutdownSwitch4(config-if)*exit設(shè)置trunk通道實(shí)現(xiàn)不同vlan連通Switch4(config)*interface fastethernet 0/3Switch4(config-if)*switchpor

16、t mode trunkSwitch4(config-if)*exit(2) 三級(jí)交換機(jī)配置三級(jí)交換機(jī)使用3560-24PS型號(hào)，主要實(shí)現(xiàn)不同vlan主機(jī)信息互通以及連接路由具體配置如下：Switch3560配置：創(chuàng)建虛擬vlan，作為二層交換機(jī)上vlan對(duì)應(yīng)虛擬接口且配置子網(wǎng)地址，作為二層設(shè)備虛擬網(wǎng)關(guān)接口Switch>enSwitch*Switch* configure terimanalSwitch(config)*hostname Switch3560Switch3560(config)* vlan 10Switch3560(config-vlan)*exitSwitch3560(

17、config)* vlan 20Switch3560(config-vlan)*exitSwitch3560(config)* vlan 30Switch3560(config-vlan)*exitSwitch3560(config)* vlan 40Switch3560(config-vlan)*exitSwitch3560(config)*interface vlan 10Switch3560(config-if)*ip address 192.168.10.1 255.255.255.0Switch3560(config-if)*no shutdownSwitch3560(config-

18、if)*exitSwitch3560(config)*interface vlan 20Switch3560(config-if)*ip address 192.168.20.1 255.255.255.0Switch3560(config-if)*no shutdownSwitch3560(config-if)*exitSwitch3560(config)*interface vlan 30Switch3560(config-if)*ip address 192.168.30.1 255.255.255.0Switch3560(config-if)*no shutdownSwitch3560

19、(config-if)*exitSwitch3560(config)*interface vlan 40Switch3560(config-if)*ip address 192.168.40.1 255.255.255.0Switch3560(config-if)*no shutdownSwitch3560(config-if)*exit設(shè)置trunk通道實(shí)現(xiàn)不同vlan跨交換機(jī)通信Switch3560(config)*interface fa 0/1Switch3560(config-if)*switch mode trunkSwitch3560(config-if)*no shutdown

20、Switch3560(config-if)*exitSwitch3560(config)*interface fa 0/2Switch3560(config-if)*switch mode trunkSwitch3560(config-if)*no shutdownSwitch3560(config-if)*exitSwitch3560(config)*interface fa 0/3Switch3560(config-if)*switch mode trunkSwitch3560(config-if)*no shutdownSwitch3560(config-if)*exitSwitch35

21、60(config)*interface fa 0/4Switch3560(config-if)*switch mode trunkSwitch3560(config-if)*no shutdownSwitch3560(config-if)*exit給端口fa0/5設(shè)置地址以連接路由器Switch3560(config)*interface fa 0/5Switch3560(config-if)*no switchportSwitch3560(config-if)*ip address 192.168.61.2 255.255.255.0Switch3560(config-if)*no shu

22、tdownSwitch3560(config-if)*exit配置動(dòng)態(tài)路由以連接路由Switch3560(config)*router ripSwitch3560(configrouter)*version 2Switch3560(configrouter)*network192.168.10.0Switch3560(configrouter)*network192.168.20.0Switch3560(configrouter)*network192.168.30.0Switch3560(configrouter)*network192.168.40.0Switch3560(configro

23、uter)*network192.168.61.0Switch3560(configrouter)*no auto-summarySwitch3560(configrouter)*exit第二個(gè)Switch3560配置：創(chuàng)建虛擬vlan，作為二層交換機(jī)上vlan對(duì)應(yīng)虛擬接口且配置子網(wǎng)地址，作為二層設(shè)備虛擬網(wǎng)關(guān)接口Switch>enSwitch*Switch* configure terimanalSwitch(config)*hostname Switch3560Switch3560(config)* vlan 50Switch3560(config-vlan)*exitSwitch35

24、60(config)*interface vlan 50Switch3560(config-if)*ip address 192.168.50.1 255.255.255.0Switch3560(config-if)*no shutdownSwitch3560(config-if)*exit設(shè)置trunk通道實(shí)現(xiàn)不同vlan跨交換機(jī)通信Switch3560(config)*interface fa 0/1Switch3560(config-if)*switch mode trunkSwitch3560(config-if)*no shutdownSwitch3560(config-if)*ex

25、it給端口fa0/2設(shè)置地址以連接路由器Switch3560(config)*interface fa 0/2Switch3560(config-if)*no switchportSwitch3560(config-if)*ip address 192.168.52.2 255.255.255.0Switch3560(config-if)*no shutdownSwitch3560(config-if)*exit配置動(dòng)態(tài)路由以連接路由Switch3560(config)*router ripSwitch3560(configrouter)*version 2Switch3560(configr

26、outer)*network192.168.50.0Switch3560(configrouter)*network192.168.52.0Switch3560(configrouter)*no auto-summarySwitch3560(configrouter)*exit(3) 路由器配置路由器使用2811型號(hào)的路由器，加一個(gè)WIC-2T，主要為實(shí)現(xiàn)不同地區(qū)的信息連接以及連通服務(wù)器具體配置如下：Router0各個(gè)端口設(shè)置地址Router>enRouter*Router * configure terimanalRouter* (config)*hostname R0Router0*

27、 (config)*interface fa0/1Router0* (config-if)*ip address 192.168.61.1 255.255.255.0Router0* (config-if)*no shutdownRouter0* (config-if)*exitRouter0* (config)*interface Se0/3/0Router0* (config-if)*ip address 192.168.70.1 255.255.255.0Router0* (config-if)*no shutdownRouter0* (config-if)*exitRouter0* (

28、config)*interface Se0/3/1Router0* (config-if)*ip address 192.168.80.1 255.255.255.0Router0* (config-if)*no shutdownRouter0* (config-if)*exit設(shè)置路由Router0* (config)*router ripRouter0* (configrouter)*version 2Router0* (configrouter)*network192.168.61.0Router0* (configrouter)*network192.168.70.0Router0*

29、(configrouter)*network192.168.80.0Router0* (configrouter)*no auto-summaryRouter0* (configrouter)*exitRouter0* (config)*ip router 0.0.0.0 0.0.0.0 192.168.61.2Router0* (config)*exitRouter1Router>enRouter*Router * configure terimanalRouter* (config)*hostname R1Router1* (config)*interface fa0/1Router

30、1* (config-if)*ip address 192.168.52.1 255.255.255.0Router1* (config-if)*no shutdownRouter1* (config-if)*exitRouter1* (config)*interface Se0/3/0Router1* (config-if)*ip address 192.168.70.2 255.255.255.0Router1* (config-if)*no shutdownRouter1* (config-if)*exitRouter1* (config)*interface Se0/3/1Router

31、1* (config-if)*ip address 192.168.90.1 255.255.255.0Router1* (config-if)*no shutdownRouter1* (config-if)*exit設(shè)置路由Router1* (config)*router ripRouter1* (configrouter)*version 2Router1* (configrouter)*network192.168.52.0Router1* (configrouter)*network192.168.70.0Router1* (configrouter)*network192.168.90.0Router1* (configrouter)*no auto-summaryRouter1* (configrouter)*exitRouter1* (config)*ip router 0.0.0.0 0.0.0.0 19