注：该文章最终归属权为博客：等不到释怀
！！！未经允许请勿转载！！！
目录
前言介绍(未经允许禁止转发任何内容)
该网络运用到的技术主要有vlan划分、链路聚合、MSTP、VRRP、DHCP、OSPF、AC+AP、ACL、双击热备、sham-link、策略路由、NAT、SLB、路由引入和IPSec VPN等技术。非常适合适用于校园、企业、园区和基于IPSec技术网络的小伙伴使用，还可适用于毕设，课设，园区网络的实现等等场景！
一、 设计思路
设计要求：
- 完成服务器、防火墙、路由器相应的接口地址的配置
- 合理规划地址且让相应地址可读性强和容易记忆
- 核心交换机配置Eth-Trunk链路捆绑来提高链路的冗余
- 根据不同的地域划分多个不同的vlan,减小广播域大小，提高网络的可靠性和安全性
- 配置MSTP+VRRP,同时实现冗余，划分实例，让不同的vlan优先选择相应的交换机，并减少stp震荡
- DHCP中继使得所有的有线用户和无线用户均是自动获取地址
- 内网内运行OSPF路由
- 服务器区域配置SLB能够确保在部分服务器出现故障时，其他服务器能够继续提供服务，从而增强系统的可用性
- 配置双击热备份实现在主设备故障时无缝切换到备用设备的高可用性技术
- 配置NAT实现用户可以访问公网
- 通过NATserver地址映射将服务器地址伪装为12.1.1.1
- 策略路由实现增强路由选择的灵活性和可控性，提高链路的利用效率
- 配置ACL使得分部/分校区的技术部只能总部/总校区的技术部访问
- 所有用户都可通过域名（30.1.1.200）访问www.baidu.com
- 总校区/总部与总校区/分部之间建立一条IPsecVPN使其互通
该topo图中防火墙使用的是USG6000V防火墙，topo图就是如下，相应的地址规划表在图中标明了。
防火墙账户：admin 密码：Huawei@123
无线用户密码：www.lsy.com
二、地址规划表
三、基于华为Ensp的校园/企业网的网络设计（可以不看）
插曲部分： 基于华为Ensp的校园/企业网的网络设计 如下图所示（查看详情可点击进入查看详细的介绍和阅读）
其运用到的技术还有VLAN划分、三层架构、MSTP+VRRP、链路聚合、DHCP、WLAN(无线局域网)、OSPF、双击热备、IPSec VPN、单臂路由、DHCP技术等一系列，非常适合于基于IPSec VPN技术的课设，当然该场景也适用于毕业设计、校园网络规划和企业网络等。
四、详细配置步骤（跟着一步一步走）
一、总公司配置
1、VLAN划分
SW2:
sys
sysname Master
vlan batch 10 20 30 40 50 60 70 80 100 200
vlan batch 300 400 500 600 700 800 1000 to 1001 1111 2000
interface GigabitEthernet0/0/1
port link-type access
port default vlan 1000
interface GigabitEthernet0/0/3
port link-type trunk
port trunk allow-pass vlan 2 to 4094
interface GigabitEthernet0/0/5
port link-type trunk
port trunk allow-pass vlan 2 to 4094
interface GigabitEthernet0/0/6
port link-type trunk
port trunk allow-pass vlan 2 to 4094
interface GigabitEthernet0/0/7
port link-type trunk
port trunk allow-pass vlan 2 to 4094
interface GigabitEthernet0/0/8
port link-type trunk
port trunk allow-pass vlan 2 to 4094
interface GigabitEthernet0/0/9
port link-type trunk
port trunk allow-pass vlan 2 to 4094
interface GigabitEthernet0/0/10
port link-type trunk
port trunk allow-pass vlan 2 to 4094
interface GigabitEthernet0/0/18
port link-type trunk
port trunk allow-pass vlan 2 to 4094
interface GigabitEthernet0/0/20
port link-type trunk
port trunk allow-pass vlan 2 to 4094
interface GigabitEthernet0/0/21
port link-type access
port default vlan 1122
interface GigabitEthernet0/0/22
port link-type trunk
port trunk allow-pass vlan 2 to 4094
interface GigabitEthernet0/0/23
port link-type trunk
port trunk allow-pass vlan 2 to 4094
------------------------------------
SW3:
sys
sysname Backup
vlan batch 10 20 30 40 50 60 70 80 100 200
vlan batch 300 400 500 600 700 800 1000 to 1001 1111 2000
interface GigabitEthernet0/0/1
port link-type access
port default vlan 1000
interface GigabitEthernet0/0/5
port link-type trunk
port trunk allow-pass vlan 2 to 4094
interface GigabitEthernet0/0/6
port link-type trunk
port trunk allow-pass vlan 2 to 4094
interface GigabitEthernet0/0/7
port link-type trunk
port trunk allow-pass vlan 2 to 4094
interface GigabitEthernet0/0/8
port link-type trunk
port trunk allow-pass vlan 2 to 4094
interface GigabitEthernet0/0/9
port link-type trunk
port trunk allow-pass vlan 2 to 4094
interface GigabitEthernet0/0/10
port link-type trunk
port trunk allow-pass vlan 2 to 4094
interface GigabitEthernet0/0/17
port link-type trunk
port trunk allow-pass vlan 2 to 4094
interface GigabitEthernet0/0/19
port link-type trunk
port trunk allow-pass vlan 2 to 4094
interface GigabitEthernet0/0/21
port link-type trunk
port trunk allow-pass vlan 2 to 4094
interface GigabitEthernet0/0/22
port link-type trunk
port trunk allow-pass vlan 2 to 4094
interface GigabitEthernet0/0/23
port link-type access
------------------------------------
SW4:
sys
sysname JieRu-1
vlan batch 100 200 300 400 500 600 700 800 1111 2000
interface GigabitEthernet0/0/1
port link-type access
port default vlan 100
interface GigabitEthernet0/0/2
port link-type access
port default vlan 100
interface GigabitEthernet0/0/22
port link-type trunk
port trunk allow-pass vlan 2 to 4094
interface GigabitEthernet0/0/23
port link-type trunk
port trunk allow-pass vlan 2 to 4094
interface GigabitEthernet0/0/24
port link-type trunk
port trunk pvid vlan 2000
port trunk allow-pass vlan 2 to 4094
------------------------------------
SW6:
sys
sysname JieRu-2
vlan batch 100 200 300 400 500 600 700 800 1111 2000
interface GigabitEthernet0/0/1
port link-type access
port default vlan 200
interface GigabitEthernet0/0/2
port link-type access
port default vlan 200
interface GigabitEthernet0/0/21
port link-type trunk
port trunk allow-pass vlan 2 to 4094
interface GigabitEthernet0/0/22
port link-type trunk
port trunk allow-pass vlan 2 to 4094
interface GigabitEthernet0/0/24
port link-type trunk
port trunk pvid vlan 2000
port trunk allow-pass vlan 2 to 4094
------------------------------------
SW7:
sys
sysname JieRu-3
vlan batch 300 1111 2000
interface GigabitEthernet0/0/1
port link-type access
port default vlan 300
interface GigabitEthernet0/0/2
port link-type access
port default vlan 300
interface GigabitEthernet0/0/19
port link-type trunk
port trunk allow-pass vlan 2 to 4094
interface GigabitEthernet0/0/20
port link-type trunk
port trunk allow-pass vlan 2 to 4094
interface GigabitEthernet0/0/24
port link-type trunk
port trunk pvid vlan 2000
port trunk allow-pass vlan 2 to 4094
------------------------------------
SW8:
sys
sysname JieRu-4
vlan batch 400 1111 2000
interface GigabitEthernet0/0/1
port link-type access
port default vlan 400
interface GigabitEthernet0/0/2
port link-type access
port default vlan 400
interface GigabitEthernet0/0/17
port link-type trunk
port trunk allow-pass vlan 2 to 4094
interface GigabitEthernet0/0/18
port link-type trunk
port trunk allow-pass vlan 2 to 4094
interface GigabitEthernet0/0/24
port link-type trunk
port trunk pvid vlan 2000
port trunk allow-pass vlan 2 to 4094
------------------------------------
SW11:
sys
sysname Huawei
vlan batch 500 1111 2000
interface GigabitEthernet0/0/1
port link-type access
port default vlan 500
interface GigabitEthernet0/0/9
port link-type trunk
port trunk allow-pass vlan 2 to 4094
interface GigabitEthernet0/0/10
port link-type trunk
port trunk allow-pass vlan 2 to 4094
interface GigabitEthernet0/0/24
port link-type trunk
port trunk pvid vlan 2000
port trunk allow-pass vlan 2 to 4094
------------------------------------
SW12:
sys
sysname Huawei
vlan batch 600 1111 2000
interface GigabitEthernet0/0/1
port link-type access
port default vlan 600
interface GigabitEthernet0/0/7
port link-type trunk
port trunk allow-pass vlan 2 to 4094
interface GigabitEthernet0/0/8
port link-type trunk
port trunk allow-pass vlan 2 to 4094
interface GigabitEthernet0/0/9
port link-type trunk
port trunk allow-pass vlan 2 to 4094
interface GigabitEthernet0/0/24
port link-type trunk
port trunk pvid vlan 2000
port trunk allow-pass vlan 2 to 4094
------------------------------------ 2、链路聚合
SW2:
interface Eth-Trunk1
port link-type trunk
port trunk allow-pass vlan 2 to 4094
trunkport g0/0/2
trunkport g0/0/24
------------------------------------
SW3:
interface Eth-Trunk1
port link-type trunk
port trunk allow-pass vlan 2 to 4094
trunkport g0/0/2
trunkport g0/0/24
------------------------------------ 3、MSTP生成树
SW2:
stp region-configuration
region-name HW
instance 1 vlan 100 200 300 700
instance 2 vlan 400 500 600
active region-configuration
stp instance 0 root primary
stp instance 1 root primary
stp instance 2 root secondary
------------------------------------
SW3:
stp region-configuration
region-name HW
instance 1 vlan 100 200 300 700
instance 2 vlan 400 500 600
active region-configuration
stp instance 1 root secondary
stp instance 2 root primary
------------------------------------
SW4:
stp region-configuration
region-name HW
instance 1 vlan 100 200 300 700
instance 2 vlan 400 500 600
active region-configuration
------------------------------------
SW6:
stp region-configuration
region-name HW
instance 1 vlan 100 200 300 700
instance 2 vlan 400 500 600
active region-configuration
------------------------------------
SW7:
stp region-configuration
region-name HW
instance 1 vlan 100 200 300 700
instance 2 vlan 400 500 600
active region-configuration
------------------------------------
SW8:
stp region-configuration
region-name HW
instance 1 vlan 100 200 300 700
instance 2 vlan 400 500 600
active region-configuration
------------------------------------
SW11:
stp region-configuration
region-name HW
instance 1 vlan 100 200 300 700
instance 2 vlan 400 500 600
active region-configuration
------------------------------------
SW12:
stp region-configuration
region-name HW
instance 1 vlan 100 200 300 700
instance 2 vlan 400 500 600
active region-configuration
------------------------------------ 4、VRRP网关冗余
SW2:
vlan 1122
description To-Server
interface Vlanif100
ip address 192.168.1.252 255.255.255.0
vrrp vrid 1 virtual-ip 192.168.1.254
vrrp vrid 1 priority 110
dhcp select global
interface Vlanif200
ip address 192.168.2.252 255.255.255.0
vrrp vrid 1 virtual-ip 192.168.2.254
vrrp vrid 1 priority 110
dhcp select global
interface Vlanif300
ip address 192.168.3.252 255.255.255.0
vrrp vrid 1 virtual-ip 192.168.3.254
vrrp vrid 1 priority 110
dhcp select global
interface Vlanif400
ip address 172.16.1.252 255.255.255.0
vrrp vrid 1 virtual-ip 172.16.1.254
dhcp select global
interface Vlanif500
ip address 172.16.2.252 255.255.255.0
vrrp vrid 1 virtual-ip 172.16.2.254
dhcp select global
interface Vlanif600
ip address 172.16.3.252 255.255.255.0
vrrp vrid 1 virtual-ip 172.16.3.254
dhcp select global
interface Vlanif700
ip address 172.16.4.252 255.255.255.0
vrrp vrid 1 virtual-ip 172.16.4.254
dhcp select global
interface Vlanif1000
ip address 10.1.1.100 255.255.255.0
ip address 20.1.1.100 255.255.255.0 sub
interface Vlanif1111
ip address 192.168.111.252 255.255.255.0
vrrp vrid 1 virtual-ip 192.168.111.254
vrrp vrid 1 priority 110
dhcp select global
interface Vlanif1122
ip address 30.1.1.1 255.255.255.0
------------------------------------
SW3:
interface Vlanif1 //方便后面做网管区域
ip address 66.66.66.254 255.255.255.0
interface Vlanif100
ip address 192.168.1.253 255.255.255.0
vrrp vrid 1 virtual-ip 192.168.1.254
dhcp select global
interface Vlanif200
ip address 192.168.2.253 255.255.255.0
vrrp vrid 1 virtual-ip 192.168.2.254
dhcp select global
interface Vlanif300
ip address 192.168.3.253 255.255.255.0
vrrp vrid 1 virtual-ip 192.168.3.254
dhcp select global
interface Vlanif400
ip address 172.16.1.253 255.255.255.0
vrrp vrid 1 virtual-ip 172.16.1.254
vrrp vrid 1 priority 110
dhcp select global
interface Vlanif500
ip address 172.16.2.253 255.255.255.0
vrrp vrid 1 virtual-ip 172.16.2.254
vrrp vrid 1 priority 110
dhcp select global
interface Vlanif600
ip address 172.16.3.253 255.255.255.0
vrrp vrid 1 virtual-ip 172.16.3.254
vrrp vrid 1 priority 110
dhcp select global
interface Vlanif700
ip address 172.16.4.253 255.255.255.0
vrrp vrid 1 virtual-ip 172.16.4.254
vrrp vrid 1 priority 110
dhcp select global
interface Vlanif1000
ip address 10.1.1.200 255.255.255.0
ip address 20.1.1.200 255.255.255.0 sub
interface Vlanif1111
ip address 192.168.111.253 255.255.255.0
vrrp vrid 1 virtual-ip 192.168.111.254
dhcp select global
------------------------------------5、DHCP中继
SW2:
ip pool vlan100
gateway-list 192.168.1.254
network 192.168.1.0 mask 255.255.255.0
excluded-ip-address 192.168.1.252 192.168.1.253
dns-list 30.1.1.100
ip pool vlan200
gateway-list 192.168.2.254
network 192.168.2.0 mask 255.255.255.0
excluded-ip-address 192.168.2.252 192.168.2.253
dns-list 30.1.1.100
ip pool vlan300
gateway-list 192.168.3.254
network 192.168.3.0 mask 255.255.255.0
excluded-ip-address 192.168.3.252 192.168.3.253
dns-list 30.1.1.100
ip pool vlan400
gateway-list 172.16.1.254
network 172.16.1.0 mask 255.255.255.0
excluded-ip-address 172.16.1.252 172.16.1.253
dns-list 30.1.1.100
ip pool vlan500
gateway-list 172.16.2.254
network 172.16.2.0 mask 255.255.255.0
excluded-ip-address 172.16.2.252 172.16.2.253
dns-list 30.1.1.100
ip pool vlan600
gateway-list 172.16.3.254
network 172.16.3.0 mask 255.255.255.0
excluded-ip-address 172.16.3.252 172.16.3.253
dns-list 30.1.1.100
ip pool vlan700
gateway-list 172.16.4.254
network 172.16.4.0 mask 255.255.255.0
excluded-ip-address 172.16.4.252 172.16.4.253
dns-list 30.1.1.100
ip pool vlan1111
gateway-list 192.168.111.254
network 192.168.111.0 mask 255.255.255.0
dns-list 30.1.1.100
------------------------------------
SW3:
ip pool vlan100
gateway-list 192.168.1.254
network 192.168.1.0 mask 255.255.255.0
excluded-ip-address 192.168.1.252 192.168.1.253
dns-list 30.1.1.100
ip pool vlan200
gateway-list 192.168.2.254
network 192.168.2.0 mask 255.255.255.0
excluded-ip-address 192.168.2.252 192.168.2.253
dns-list 30.1.1.100
ip pool vlan300
gateway-list 192.168.3.254
network 192.168.3.0 mask 255.255.255.0
excluded-ip-address 192.168.3.252 192.168.3.253
dns-list 30.1.1.100
ip pool vlan400
gateway-list 172.16.1.254
network 172.16.1.0 mask 255.255.255.0
excluded-ip-address 172.16.1.252 172.16.1.253
dns-list 30.1.1.100
ip pool vlan500
gateway-list 172.16.2.254
network 172.16.2.0 mask 255.255.255.0
excluded-ip-address 172.16.2.252 172.16.2.253
dns-list 30.1.1.100
ip pool vlan600
gateway-list 172.16.3.254
network 172.16.3.0 mask 255.255.255.0
excluded-ip-address 172.16.3.252 172.16.3.253
dns-list 30.1.1.100
ip pool vlan700
gateway-list 172.16.4.254
network 172.16.4.0 mask 255.255.255.0
excluded-ip-address 172.16.4.252 172.16.4.253
dns-list 30.1.1.100
------------------------------------6、OSPF路由
SW2:
ospf 1
area 0.0.0.0
network 0.0.0.0 255.255.255.255
ip route-static 0.0.0.0 0.0.0.0 10.1.1.254 //宣告路由
------------------------------------
SW3:
ospf 1
area 0.0.0.0
network 0.0.0.0 255.255.255.255
ip route-static 0.0.0.0 0.0.0.0 20.1.1.254
------------------------------------
AR9（网管区域）:
interface GigabitEthernet0/0/0
ip address 66.66.66.66 255.255.255.0 //前面忘了配置
ospf 1
area 0.0.0.0
network 0.0.0.0 255.255.255.255
------------------------------------7、WLAN无线局域网
AC1:
vlan batch 1111 2000
ip pool ap
gateway-list 100.100.100.1
network 100.100.100.0 mask 255.255.255.0
dns-list 30.1.1.100
interface Vlanif2000
ip address 100.100.100.1 255.255.255.0
dhcp select global
interface GigabitEthernet0/0/1
port link-type trunk
port trunk allow-pass vlan 2 to 4094
interface GigabitEthernet0/0/7
undo negotiation auto
duplex half
interface GigabitEthernet0/0/8
undo negotiation auto
duplex half
wlan
traffic-profile name default
security-profile name WLAN
security wpa-wpa2 psk pass-phrase www.lsy.com aes
security-profile name default
security-profile name default-wds
security-profile name default-mesh
ssid-profile name WLAN
ssid WLAN
ssid-profile name default
vap-profile name default
vap-profile name WLAN-vlan100
service-vlan vlan-id 1111
security-profile WLAN
wds-profile name default
mesh-handover-profile name default
mesh-profile name default
regulatory-domain-profile name default
air-scan-profile name default
rrm-profile name default
radio-2g-profile name default
radio-5g-profile name default
wids-spoof-profile name default
wids-profile name default
wireless-access-specification
ap-system-profile name default
port-link-profile name default
wired-port-profile name default
serial-profile name preset-enjoyor-toeap
ap-group name default
ap-group name ap-group
radio 0
vap-profile WLAN-vlan100 wlan 1
radio 1
vap-profile WLAN-vlan100 wlan 1
radio 2
vap-profile WLAN-vlan100 wlan 1
ap-id 1 type-id 69 ap-mac 00e0-fcef-0d80 ap-sn 210235448310A860CC25
ap-name ap1
ap-group ap-group
ap-id 2 type-id 69 ap-mac 00e0-fc14-3ba0 ap-sn 2102354483107A379477
ap-name ap2
ap-group ap-group
ap-id 3 type-id 69 ap-mac 00e0-fc0b-1210 ap-sn 210235448310F620D318
ap-name ap3
ap-group ap-group
ap-id 4 type-id 69 ap-mac 00e0-fc34-1340 ap-sn 2102354483109E68B84F
ap-name ap4
ap-group ap-group
ap-id 5 type-id 69 ap-mac 00e0-fc28-40e0 ap-sn 2102354483101A74AC48
ap-name ap5
ap-group ap-group
ap-id 6 type-id 69 ap-mac 00e0-fcec-2cd0 ap-sn 210235448310D759891E
ap-name ap6
ap-group ap-group
ap-id 7 type-id 69 ap-mac 00e0-fc4c-78d0 ap-sn 2102354483104B14E916
ap-name ap7
ap-group ap-group
provision-ap
------------------------------------8、防火墙基本配置
FW1:
admin
Admin@123
Y
Admin@123
Huawei@123
Huawei@123
sys
sysname FW1
interface GigabitEthernet0/0/0
ip binding vpn-instance default
ip address 192.168.0.1 255.255.255.0
interface GigabitEthernet1/0/0
ip address 111.1.1.1 255.255.255.0
ip address 60.1.1.1 255.255.255.0 sub
service-manage http permit
service-manage https permit
service-manage ping permit
service-manage ssh permit
service-manage snmp permit
service-manage telnet permit
interface GigabitEthernet1/0/1
ip address 10.1.1.1 255.255.255.0
ip address 20.1.1.1 255.255.255.0 sub
vrrp vrid 1 virtual-ip 10.1.1.254 active
vrrp vrid 2 virtual-ip 20.1.1.254 standby
service-manage http permit
service-manage https permit
service-manage ping permit
service-manage ssh permit
service-manage snmp permit
service-manage telnet permit
interface GigabitEthernet1/0/6
ip address 1.1.1.1 255.255.255.252
service-manage http permit
service-manage https permit
service-manage ping permit
service-manage ssh permit
service-manage snmp permit
service-manage telnet permit
qui
firewall zone trust
set priority 85
add interface GigabitEthernet0/0/0
add interface GigabitEthernet1/0/1
firewall zone untrust
set priority 5
add interface GigabitEthernet1/0/0
firewall zone dmz
set priority 50
add interface GigabitEthernet1/0/6
security-policy
default action permit
------------------------------------
FW2:
admin
Admin@123
Y
Admin@123
Huawei@123
Huawei@123
sys
sysname FW2
interface GigabitEthernet0/0/0
ip binding vpn-instance default
ip address 192.168.0.1 255.255.255.0
interface GigabitEthernet1/0/0
ip address 111.1.1.2 255.255.255.0
ip address 60.1.1.2 255.255.255.0 sub
service-manage http permit
service-manage https permit
service-manage ping permit
service-manage ssh permit
service-manage snmp permit
service-manage telnet permit
interface GigabitEthernet1/0/1
ip address 10.1.1.2 255.255.255.0
ip address 20.1.1.2 255.255.255.0 sub
vrrp vrid 1 virtual-ip 10.1.1.254 standby
vrrp vrid 2 virtual-ip 20.1.1.254 active
service-manage http permit
service-manage https permit
service-manage ping permit
service-manage ssh permit
service-manage snmp permit
service-manage telnet permit
interface GigabitEthernet1/0/6
ip address 1.1.1.2 255.255.255.252
service-manage http permit
service-manage https permit
service-manage ping permit
service-manage ssh permit
service-manage snmp permit
service-manage telnet permit
qui
firewall zone trust
set priority 85
add interface GigabitEthernet0/0/0
add interface GigabitEthernet1/0/1
firewall zone untrust
set priority 5
add interface GigabitEthernet1/0/0
firewall zone dmz
set priority 50
add interface GigabitEthernet1/0/6
security-policy
default action permit
------------------------------------
FW3（服务器防火墙）:
admin
Admin@123
Y
Admin@123
Huawei@123
Huawei@123
sys
sysname USG6000V1
interface GigabitEthernet0/0/0
ip binding vpn-instance default
ip address 192.168.0.1 255.255.255.0
interface GigabitEthernet1/0/0
ip address 100.1.1.254 255.255.255.0
ip address 100.2.1.254 255.255.255.0 sub
service-manage http permit
service-manage https permit
service-manage ping permit
service-manage ssh permit
service-manage snmp permit
service-manage telnet permit
interface GigabitEthernet1/0/6
ip address 30.1.1.2 255.255.255.0
service-manage http permit
service-manage https permit
service-manage ping permit
service-manage ssh permit
service-manage snmp permit
service-manage telnet permit
qui
firewall zone trust
set priority 85
add interface GigabitEthernet0/0/0
firewall zone untrust
set priority 5
add interface GigabitEthernet1/0/6
firewall zone dmz
set priority 50
add interface GigabitEthernet1/0/0
security-policy
default action permit
------------------------------------9、ACL访问控制
FW1:
acl number 3000
rule 10 permit ip source 192.168.1.0 0.0.0.255 destination 192.168.255.0 0.0.0.255
rule 30 permit ip source 30.0.0.0 0.255.255.255 destination 192.168.255.0 0.0.0.255
------------------------------------
FW2:
acl number 3000
rule 10 permit ip source 192.168.1.0 0.0.0.255 destination 192.168.255.0 0.0.0.255
rule 30 permit ip source 30.0.0.0 0.255.255.255 destination 192.168.255.0 0.0.0.255
------------------------------------
SW4:
acl number 3000
rule 10 permit ip source 172.16.4.0 0.0.0.255
rule 100 deny ip
------------------------------------10、双击热备
FW1:
hrp enable
hrp interface GigabitEthernet1/0/6 remote 1.1.1.2
hrp mirror session enable
hrp track interface GigabitEthernet1/0/0
------------------------------------
FW2:
hrp enable
hrp interface GigabitEthernet1/0/6 remote 1.1.1.1
hrp mirror session enable
hrp track interface GigabitEthernet1/0/0
------------------------------------ 11、sham-link
FW1:
ip-link check enable
ip-link name pbr_1
destination 60.1.1.100 interface GigabitEthernet1/0/0 mode icmp next-hop 60.1.1.100
ip-link name pbr_2
destination 111.1.1.100 interface GigabitEthernet1/0/0 mode icmp next-hop 111.1.1.100
------------------------------------
FW2:
ip-link check enable
ip-link name pbr_1
destination 60.1.1.100 interface GigabitEthernet1/0/0 mode icmp next-hop 60.1.1.100
ip-link name pbr_2
destination 111.1.1.100 interface GigabitEthernet1/0/0 mode icmp next-hop 111.1.1.100
------------------------------------12、策略路由&OSPF
FW1:
policy-based-route
rule name ISP-1 1
description To-LianTong
source-zone trust
source-address 192.168.0.0 mask 255.255.0.0
track ip-link pbr_1
action pbr next-hop 60.1.1.100
rule name ISP-2 2
description To-YiDong
source-zone trust
source-address 172.16.0.0 mask 255.255.0.0
track ip-link pbr_2
action pbr next-hop 111.1.1.100
q
ospf 1
area 0.0.0.0
network 10.1.1.0 0.0.0.255
network 20.1.1.0 0.0.0.255
ip route-static 0.0.0.0 0.0.0.0 60.1.1.100
ip route-static 0.0.0.0 0.0.0.0 111.1.1.100
------------------------------------
FW2:
policy-based-route
rule name ISP-1 1
description To-LianTong
source-zone trust
source-address 192.168.0.0 mask 255.255.0.0
track ip-link pbr_1
action pbr next-hop 60.1.1.100
rule name ISP-2 2
description To-YiDong
source-zone trust
source-address 172.16.0.0 mask 255.255.0.0
track ip-link pbr_2
action pbr next-hop 111.1.1.100
q
ospf 1
default-route-advertise
area 0.0.0.0
network 10.1.1.0 0.0.0.255
network 20.1.1.0 0.0.0.255
ip route-static 0.0.0.0 0.0.0.0 60.1.1.100 track ip-link pbr_1
ip route-static 0.0.0.0 0.0.0.0 111.1.1.100
------------------------------------
FW3:
ip route-static 0.0.0.0 0.0.0.0 30.1.1.1
------------------------------------13、NAT策略
FW1:
nat-policy
rule name IPSEC-VPN
source-zone trust
destination-zone untrust
source-address 172.16.0.0 0.0.255.255
source-address 192.168.1.0 0.0.0.255
source-address 192.168.2.0 0.0.0.255
source-address 192.168.3.0 0.0.0.255
source-address 30.1.1.0 0.0.0.255
destination-address 192.168.255.0 0.0.0.255
action no-nat
rule name ISP1
source-zone trust
destination-zone untrust
source-address 192.168.0.0 mask 255.255.0.0
action source-nat easy-ip
rule name ISP2
source-zone trust
destination-zone untrust
source-address 172.16.0.0 mask 255.255.0.0
action source-nat easy-ip
nat address-group ISP1 0
mode pat
section 0 60.1.1.10 60.1.1.10
nat address-group ISP2 1
mode pat
section 0 111.1.1.10 111.1.1.10
nat server NAT-Server global 60.1.1.111 inside 30.1.1.200
nat server NAT-Server2 global 111.1.1.111 inside 30.1.1.200 no-reverse
------------------------------------
FW2:
nat-policy
rule name IPSEC-VPN
source-zone trust
destination-zone untrust
source-address 172.16.0.0 0.0.255.255
source-address 192.168.1.0 0.0.0.255
source-address 192.168.2.0 0.0.0.255
source-address 192.168.3.0 0.0.0.255
source-address 30.1.1.0 0.0.0.255
destination-address 192.168.255.0 0.0.0.255
action no-nat
rule name ISP1
source-zone trust
destination-zone untrust
source-address 192.168.0.0 mask 255.255.0.0
action source-nat easy-ip
rule name ISP2
source-zone trust
destination-zone untrust
source-address 172.16.0.0 mask 255.255.0.0
action source-nat easy-ip
nat address-group ISP1 0
mode pat
section 0 60.1.1.10 60.1.1.10
nat address-group ISP2 1
mode pat
section 0 111.1.1.10 111.1.1.10
nat server NAT-Server global 60.1.1.111 inside 30.1.1.200
nat server NAT-Server2 global 111.1.1.111 inside 30.1.1.200 no-reverse
------------------------------------14、SLB
该部分我就不放在文章里了，这部分
主要配置了虚拟服务地址，相信
会做的这部分肯定也没问题，小白
的话可能就有些困难了。
因为部分资源是有偿的，要收取一些费用
所以请大家谅解，下载下来的
资源都是每一步的配置都有的。
15、IPSec VPN
该部分我就不放在文章里了，这部分
主要配置了总部/总校区FW1和FW2以及
分部/分校区IPsecVPN的配置，相信
会做的这部分肯定也没问题，小白
的话可能就有些困难了。
因为部分资源是有偿的，要收取一些费用
所以请大家谅解，下载下来的
资源都是每一步的配置都有的。
二、运营商配置
1、联通区域
AR1:
sys
sysname AR1
interface GigabitEthernet0/0/0
ip address 60.1.1.100 255.255.255.0
interface GigabitEthernet0/0/1
ip address 13.1.1.1 255.255.255.0
interface LoopBack0
ip address 1.1.1.1 255.255.255.255
ospf 1
area 0.0.0.0
network 0.0.0.0 255.255.255.255
------------------------------------
AR3:
sysname AR3
interface GigabitEthernet0/0/0
ip address 35.1.1.3 255.255.255.0
interface GigabitEthernet0/0/1
ip address 13.1.1.3 255.255.255.0
interface LoopBack0
ip address 3.3.3.3 255.255.255.255
ospf 1
area 0.0.0.0
network 0.0.0.0 255.255.255.255
------------------------------------ 2、电信区域
AR2:
sysname AR2
interface GigabitEthernet0/0/0
ip address 111.1.1.100 255.255.255.0
interface GigabitEthernet0/0/1
ip address 24.1.1.2 255.255.255.0
interface LoopBack0
ip address 2.2.2.2 255.255.255.255
ospf 1
area 0.0.0.0
network 0.0.0.0 255.255.255.255
------------------------------------
AR4:
sysname AR4
interface GigabitEthernet0/0/0
ip address 111.1.2.100 255.255.255.0
interface GigabitEthernet0/0/1
ip address 24.1.1.4 255.255.255.0
interface GigabitEthernet0/0/2
ip address 45.1.1.4 255.255.255.0
interface LoopBack0
ip address 4.4.4.4 255.255.255.255
ospf 1
area 0.0.0.0
network 0.0.0.0 255.255.255.255
------------------------------------3、出口路由
AR5:
sys
sysname AR5
interface GigabitEthernet0/0/0
ip address 35.1.1.5 255.255.255.0
interface GigabitEthernet0/0/2
ip address 45.1.1.5 255.255.255.0
interface LoopBack0
ip address 5.5.5.5 255.255.255.255
interface LoopBack100
ip address 8.8.8.8 255.255.255.255
ospf 1
area 0.0.0.0
network 0.0.0.0 255.255.255.255
------------------------------------三、分公司配置
1、分部VLAN划分
SW16:
sys
sysname Huawei
vlan batch 19 192 2000
interface GigabitEthernet0/0/1
port link-type trunk
port trunk allow-pass vlan 2 to 4094
interface GigabitEthernet0/0/2
port link-type trunk
port trunk allow-pass vlan 2 to 4094
interface GigabitEthernet0/0/3
port link-type access
port default vlan 2000
interface GigabitEthernet0/0/24
port link-type trunk
port trunk allow-pass vlan 2 to 4094
------------------------------------
SW17:
sys
sysname Huawei
vlan batch 192 1000
interface GigabitEthernet0/0/1
port link-type trunk
port trunk allow-pass vlan 2 to 4094
interface GigabitEthernet0/0/2
port link-type trunk
port trunk allow-pass vlan 2 to 4094
interface GigabitEthernet0/0/3
port link-type access
port default vlan 1000
interface GigabitEthernet0/0/24
port link-type trunk
port trunk allow-pass vlan 2 to 4094
------------------------------------
SW18:
sys
sysname Huawei
vlan batch 192
interface Ethernet0/0/1
port link-type access
port default vlan 192
interface GigabitEthernet0/0/1
port link-type trunk
port trunk allow-pass vlan 2 to 4094
interface GigabitEthernet0/0/2
port link-type trunk
port trunk allow-pass vlan 2 to 4094
------------------------------------
SW19:
sys
sysname Huawei
vlan batch 192
interface Ethernet0/0/1
port link-type access
port default vlan 192
interface GigabitEthernet0/0/1
port link-type trunk
port trunk allow-pass vlan 2 to 4094
interface GigabitEthernet0/0/2
port link-type trunk
port trunk allow-pass vlan 2 to 4094
------------------------------------2、分部VRRP&DHCP
SW16:
dh en
interface Vlanif192
ip address 192.168.255.253 255.255.255.0
vrrp vrid 1 virtual-ip 192.168.255.254
dhcp select interface
dhcp server dns-list 30.1.1.100
interface Vlanif2000
ip address 50.1.1.2 255.255.255.0
------------------------------------
SW17:
interface Vlanif192
ip address 192.168.255.252 255.255.255.0
vrrp vrid 1 virtual-ip 192.168.255.254
vrrp vrid 1 priority 110
dhcp select interface
dhcp server dns-list 30.1.1.100
interface Vlanif1000
ip address 40.1.1.2 255.255.255.0
------------------------------------3、分部OSPF路由
SW16:
ip route-static 0.0.0.0 0.0.0.0 50.1.1.1
------------------------------------
SW17:
ip route-static 0.0.0.0 0.0.0.0 40.1.1.1
------------------------------------
FW5:
ip route-static 0.0.0.0 0.0.0.0 111.1.2.100
ip route-static 192.168.255.0 255.255.255.0 40.1.1.2
ip route-static 192.168.255.0 255.255.255.0 50.1.1.2
------------------------------------4、分部防火墙基本配置
FW5:
interface GigabitEthernet0/0/0
ip binding vpn-instance default
ip address 192.168.0.1 255.255.255.0
interface GigabitEthernet1/0/0
ip address 40.1.1.1 255.255.255.0
service-manage http permit
service-manage https permit
service-manage ping permit
service-manage ssh permit
service-manage snmp permit
service-manage telnet permit
interface GigabitEthernet1/0/1
ip address 50.1.1.1 255.255.255.0
service-manage http permit
service-manage https permit
service-manage ping permit
service-manage ssh permit
service-manage snmp permit
service-manage telnet permit
interface GigabitEthernet1/0/6
ip address 111.1.2.200 255.255.255.0
service-manage http permit
service-manage https permit
service-manage ping permit
service-manage ssh permit
service-manage snmp permit
service-manage telnet permit
firewall zone trust
set priority 85
add interface GigabitEthernet0/0/0
add interface GigabitEthernet1/0/0
add interface GigabitEthernet1/0/1
firewall zone untrust
set priority 5
add interface GigabitEthernet1/0/6
security-policy
default action permit
------------------------------------5、分部NAT策略
FW5:
nat-policy
rule name IPSEC-VPN
source-zone trust
destination-zone untrust
source-address 192.168.255.0 0.0.0.255
destination-address 172.16.0.0 0.0.255.255
destination-address 192.168.1.0 0.0.0.255
destination-address 192.168.2.0 0.0.0.255
destination-address 192.168.3.0 0.0.0.255
destination-address 30.1.1.0 0.0.0.255
action no-nat
rule name Easy-ip
source-zone trust
destination-zone untrust
source-address 192.168.255.0 0.0.0.255
action source-nat easy-ip
------------------------------------ 6、分部ACL访问控制
FW5:
acl number 3000
rule 10 permit ip source 192.168.255.0 0.0.0.255 destination 192.168.1.0 0.0.0.255
rule 30 permit ip source 192.168.255.0 0.0.0.255 destination 30.0.0.0 0.255.255.255
------------------------------------ 
扫一扫
6528
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
