Cisco组建中小型企业网络实例

组建中小型网络1、Vlan信息1VlanID网络地址名称描述1172.16.10.0/24无本地vlan2172.16.20.0/24yfzx研发中心3172.16.30.0/24zbb质保部4172.16.40.0/24zzb制造部5172.16.50.0/24sbb设备部6172.16.60.0/24cgb采购部7172.16.70.0/24xsb销售部8172.16.80.0/24cwb财务部9172.16.90.0/24glb管理部100172.16.100.0/24zjb总经办VTP2、信息 IP、设备3地址分配交换机、路由器详细配置 1．2IP地址设置#intF0/0config）2600-R-1（221.215.31.129255.255.255.02600-R-1(config-if)#ipadd2600-R-1(config-if)#noshutdown设备名称----------------------------------DomainPrunningPasswordMode3550-S-12600-R-1（config-ifvtp1#intF0/1）Enable123Server2950-S-12600-R-1(config-if)#ipaddvtp1Enable192.168.1.1255.255.255.0123Client2600-R-1(config-if)#noshutdown2950-S-23550-S-1(config)#intF0/1vtp1Enable123Client2950-S-33550-S-1(config-vtp1if)#noswitchport……….路由端口Enable123Client2950-S-43550-S-1(config-if)#ipaddvtp1Enable192.168.1.2255.255.255.0123Clientvlan3550-S-1(config)#intvlan1……………..管理255.255.255.03550-S-1(config-if)#ipadd172.16.10.1if)#intvlan2……………研发中心3550-S-1(config-255.255.255.03550-S-1(config-if)#ipadd172.16.20.1设备名称 设备名称Enable2950-S-3Clientvtp1123Enable2950-S-4vtp1Client123接口DomainIP地址PrunningPassword描述Mode2600-R-13550-S-12950-S-1F0/0vtp1221.215.31.129/29Enable123WANServerF0/1vtp1192.168.1.1/24Enable123-Client3550-S-12950-S-2F0/1vtp1192.168.1.2/24Enable1233L-SwitchClient2．(config-if)3550-S-1 intvlan3……………质保部(config-if)3550-S-1 255.255.255.0172.16.30.1ipadd(config-if)3550-S-1 intvlan4……………制造部(config-if)3550-S-1 255.255.255.0ipadd172.16.40.1(config-if)3550-S-1 intvlan5……………设备部(config-if)3550-S-1 255.255.255.0ipadd172.16.50.1(config-if)3550-S-1 intvlan6……………采购部(config-if)3550-S-1 255.255.255.0ipadd172.16.60.1(config-if)3550-S-1 intvlan7……………销售部(config-if)3550-S-1 255.255.255.0172.16.70.1ipadd(config-if)3550-S-1 intvlan8……………财务部(config-if)3550-S-1 255.255.255.0172.16.80.1ipadd(config-if)3550-S-1 intvlan9……………管理部(config-if)3550-S-1 255.255.255.0172.16.90.1ipadd(config-if)3550-S-1 intvlan100…………总经办(config-if)3550-S-1 255.255.255.0172.16.100.1ipadd配置VTP3550-S-1#vlandatabase3550-S-1(vlan)#vtpdomainvtp13550-S-1(vlan)#vtpserver3550-S-1(vlan)#vtppassword1233550-S-1(vlan)#vtppruning……………………………..修剪3550-S-1(vlan)#vlan2nameyfzx………………………..研发中心3550-S-1(vlan)#vlan3namezbb………………………..质保部3550-S-1(vlan)#vlan4namezzb…………………………制造部1(vlan)#vlan5namesbb…………………………设备部3550-S-1(vlan)#vlan6namecgb…………………………采购部3550-S-销售部3550-S-1(vlan)#vlan7namexsb……………………… #vlan8namexsb………………………...财务部3550-S-1(vlan)…………………………管理部3550-S-1(vlan)#vlan9namexsb-----------------------------------------------------------2950-S-1(vlan)#vtpdomainvtp1)(配置修改编号清零2950-S-1(vlan)#vtptran…………………透明模式客户模式2950-S-1(vlan)#vtpclient2950-S-1(vlan)#vtppassword1232950-S-2(vlan)#vtpdomainvtp1)配置修改编号清零2(vlan)#vtptran…………………透明模式(2950-S-客户模式2950-S-2(vlan)#vtpclient2950-S-2(vlan)#vtppassword1232950-S-3(vlan)#vtpdomainvtp1)(3(vlan)#vtptran…………………透明模式配置修改编号清零2950-S-客户模式2950-S-3(vlan)#vtpclient3． 2950-S-3password123(vlan)#vtp2950-S-4domainvtp1(vlan)#vtp2950-S-4tran…………………透明模式(#vtp配置修改编号清零(vlan))客户模式client2950-S-4#vtp(vlan)password123#vtp2950-S-4(vlan)3．路由配置2600-R-1（config）#iproute0.0.0.00.0.0.0f0/2……………...缺省路由2600-R-1（config）#iproute192.168.0.0255.255.0.0192.168.1.23550-R-1(config)#iproute0.0.0.00.0.0.0192.168.1.1 4．5．NAT2600-R-1（config）#access-list101permitip192.168.0.00.0.255.255192.168.0.00.0.255.255……………………………...内部局部地址2600-R-1（config）#ipnatpoolWAN221.215.31.131221.215.31.134prefix-len29………………………………定义合法IP地址池2600-R-1（config）#ipnatinsidesourlist101poolWAN……….实现地址转换2600-R-1（config）#intf0/12600-R-1（config-if）#ipnatinside………………………….定义NATinside2600-R-1（config）#intf0/02600-R-1（config-if）#ipnatoutside………………………..定义NAToutside端口Vlan流量控制制造部、设备部vlan实现互访，禁止访问其它部门vlan制造部、设备部上班时间禁止访问internet(8:00-12:002:00-6:00)研发中心、质保部vlan实现互访，禁止访问其它部门vlan财务部vlan实现与采购部、销售部vlan的单向访问总经办vlan实现与财务部、管理部vlan的单向访问管理部vlan禁止访问其它部门vlan各部门vlan都能访问服务器区3550-S-1(config)#time-rangerestrict3550-S-1(config-time-range)#periodicdailystart12:00to2:00……….设置时间范围3550-S-1(config)#ipaccess-listextendyfzx……….研发中心ACL3550-S-1(config-ext-nacl)#permitipany172.16.20.00.0.0.255…...….访问质保部4．3550-S-1(config-ext-nacl)#permitipany172.16.100.00.0.0.255………访问服务器区3550-S-1(config-ext-nacl)#denyipany192.168.0.00.0.255.255……….禁止访问其它部门3550-S-1(config-ext-nacl)#permitipanyany3550-S-1(config)#ipaccess-listextendzbb……….质保部ACL3550-S-1(config-ext-nacl)#permitipany172.16.10.00.0.0.255…...….访问研发中心3550-S-1(config-ext-nacl)#permitipany172.16.100.00.0.0.255………访问服务器区3550-S-1(config-ext-nacl)#denyipany192.168.0.00.0.255.255……….禁止访问其它部门3550-S-1(config-ext-nacl)#permitipanyany-------------------------------------------------------------------------------------------3550-S-1(config)#ipaccess-listextendzzb……….制造部ACL3550-S-1(config-ext-nacl)#permitipany172.16.40.00.0.0.255…...….访问设备部3550-S-1(config-ext-nacl)#permitipany172.16.100.00.0.0.255………访问服务器区3550-S-1(config-ext-nacl)#denyipany192.168.0.00.0.255.255……….禁止访问其它部门3550-S-1(config-ext-nacl)#permitipanyanytime-rangerestrict……….上班时间禁止上网3550-S-1(config)#ipaccess-listextendsbb……….设备部ACL3550-S-1(config-ext-nacl)#permitipany172.16.30.00.0.0.255…...….访问制造部3550-S-1(config-ext-nacl)#permitipany172.16.100.00.0.0.255………访问服务器区3550-S-1(config-ext-nacl)#denyipany192.168.0.00.0.255.255……….禁止访问其它部门3550-S-1(config-ext-nacl)#permitipanyany-----------------------------------------------------------------------------------------3550-S-1(config)#ipaccess-listextendcgb……….采购部ACL3550-S-1(config-ext-nacl)#evaluatecwb-cgb…..计算匹配自反ACL3550-S-1(config-ext-nacl)#permitipany172.16.100.00.0.0.255………访问服务器区3550-S-1(config-ext-nacl)#denyipany192.168.0.00.0.255.2555．3550-S-1(config-ext-nacl)#permitipanyany----------------------------------------------------------------------------3550-S-1(config)#ipaccess-listextendxsb……….销售部ACL3550-S-1(config-ext-nacl)#evaluatecwb-xsb…..计算匹配自反ACL3550-S-1(config-ext-nacl)#permitipany172.16.100.00.0.0.255………访问服务器区3550-S-1(config-ext-nacl)#denyipany192.168.0.00.0.255.2553550-S-1(config-ext-nacl)#permitipanyany---------------------------------------------------------------------------------------3550-S-1(config)#ipaccess-listextendcwb……….财务部ACL3550-S-1(config-ext-nacl)#permintipany172.16.60.00.0.0.255reflectcwb-cgb………...创建自反ACLcwb-cgb3550-S-1(config-ext-nacl)#permintipany172.16.70.00.0.0.255reflectcwb-xsb………...创建自反ACLcwb-xsb3550-S-1(config-ext-nacl)#evaluatezjb-cwb…..计算匹配自反ACL3550-S-1(config-ext-nacl)#permitipany172.16.100.00.0.0.255………访问服务器区3550-S-1(config-ext-nacl)#denyipany192.168.0.00.0.255.255……….禁止访问其它部门3550-S-1(config-ext-nacl)#permitipanyany--------------------------------------------------------------------------------------------------3550-S-1(config)#ipaccess-listextendcwb……….管理部ACL3550-S-1(config-ext-nacl)#evaluatezjb-glb…..计算匹配自反ACL3550-S-1(config-ext-nacl)#permitipany172.16.100.00.0.0.255………访问服务器区3550-S-1(config-ext-nacl)#denyipany192.168.0.00.0.255.255……….禁止访问其它部门3550-S-1(config-ext-nacl)#permitipanyany----------------------------------------------------------------------------------------------------3550-S-1(config)#ipaccess-listextendzjb……….总经办ACL3550-S-1(config-ext-nacl)#permintipany172.16.80.00.0.0.255reflectzjb-cwb………...创建自反ACLzjb-cwb3550-S-1(config-ext-nacl)#permintipany172.16.90.00.0.0.255reflectzjb-glb………...创建自反ACLzjb-glb3550-S-1(config-ext-nacl)#permitipany172.16.100.00.0.0.2556．………访问服务器区3550-S-1(config-ext-nacl)#denyipany192.168.0.00.0.255.255……….禁止访问其它部门3550-S-1(config-ext-nacl)#permitipanyanyACL应用：3550-S-1 3550-S-1(config)#intvlan2      …………..研发中心3550-S-1(config-if)#ipaccess-groupyfzxin3550-S-1(config)#intvlan3      …………..质保部3550-S-1(config-if)#ipaccess-groupzbbin3550-S-1(config)#intvlan4      ……………制造部(config-if)#ipaccess-groupzzbin…(略)附：关键字established的ACL应用(单向访问)3550-S-1(config)#ipaccess-listextendcgb……….采购部ACL3550-S-1(config-ext-nacl)#permitipany172.16.80.00.0.0.0.255estab3550-S-1(config-ext-nacl)#permitipany172.16.100.00.0.0.255………访问服务器区3550-S-1(config-ext-nacl)#denyipany192.168.0.00.0.255.2553550-S-1(config-ext-nacl)#permitipanyany3550-S-1(config)#ipaccess-listextendxsb……….销售部ACL3550-S-1(config-ext-nacl)#permitipany172.16.80.00.0.0.0.255estab3550-S-1(config-ext-nacl)#permitipany172.16.100.00.0.0.255………访问服务器区3550-S-1(config-ext-nacl)#denyipany192.168.0.00.0.255.2553550-S-1(config-ext-nacl)#permitipanyany1、Vlan信息7网络地址名称描述VlanID无本地vlan172.16.10.0/241研发中心yfzx2172.16.20.0/24VTP2、信息 IP、设备3交换机、路由器详细配置地址分配  ．18 IP地址设置）#intF0/0（config2600-R-1质保部zbb3172.16.30.0/24221.215.31.129255.255.255.02600-R-1(config-if)#ipadd制造部zzb4172.16.40.0/24设备部sbb5172.16.50.0/24采购部cgb172.16.60.0/246销售部xsb7172.16.70.0/24财务部cwb172.16.80.0/248管理部glb9172.16.90.0/24总经办zjb100172.16.100.0/24IP描述接口 设备名称地址F0/0WAN221.215.31.129/292600-R-1-192.168.1.1/24F0/13L-Switch192.168.1.2/243550-S-1F0/12600-R-1(config-if)#noshutdown----------------------------------2600-R-1（config-if）#intF0/12600-R-1(config-if)#ipadd192.168.1.1255.255.255.02600-R-1(config-if)#noshutdown3550-S-1(config)#intF0/13550-S-1(config-if)#noswitchport……….路由端口3550-S-1(config-if)#ipadd192.168.1.2255.255.255.03550-S-1(config)#intvlan1……………..管理vlan3550-S-1(config-if)#ipadd192.168.10.1255.255.255.03550-S-1(config-if)#intvlan2……………研发中心3550-S-1(config-if)#ipadd192.168.20.1255.255.255.03550-S-1(config-if)#intvlan3……………质保部3550-S-1(config-if)#ipadd192.168.30.1255.255.255.03550-S-1(config-if)#intvlan4……………制造部3550-S-1(config-if)#ipadd192.168.40.1255.255.255.03550-S-1(config-if)#intvlan5……………设备部3550-S-1(config-if)#ipadd192.168.50.1255.255.255.03550-S-1(config-if)#intvlan6……………采购部3550-S-1(config-if)#ipadd192.168.60.1255.255.255.03550-S-1(config-if)#intvlan7……………销售部3550-S-1(config-if)#ipadd192.168.70.1255.255.255.03550-S-1(config-if)#intvlan8……………财务部3550-S-1(config-if)#ipadd192.168.80.1255.255.255.03550-S-1(config-if)#intvlan9……………管理部3550-S-1(config-if)#ipadd192.168.90.1255.255.255.03550-S-1(config-if)#intvlan100…………总经办3550-S-1(config-if)#ipadd192.168.100.1255.255.255.0 2．9VTP配置#vlandatabaseconfig）3550-S-1（3550-S-1(vlan)#vtpdomainvtp13550-S-1(vlan)#vtpserver3550-S-1(vlan)#vtppassword123vtppruning……………………………..修剪3550-S-1(vlan)#1(vlan)#vlan2nameyfzx………………………..研发中心3550-S-3550-S-1(vlan)#vlan3namezbb………………………....质保部1(vlan)#vlan4namezzb…………………………制造部3550-S-1(vlan)#vlan5namesbb…………………………设备部3550-S-3550-S-1(vlan)#vlan6namecgb…………………………采购部3550-S-1(vlan)#vlan7namexsb…………………………销售部3550-S-1(vlan)#vlan8namexsb……………………….....财务部1(vlan)#vlan9namexsb…………………………管理部3550-S------------------------------------------------------------2950-S-1(vlan)#vtpdomainvtp12950-S-1(vlan)#vtptran…………………透明模式(配置修改编号清零)客户模式2950-S-1(vlan)#vtpclient2950-S-1(vlan)#vtppassword1232950-S-2(vlan)#vtpdomainvtp12950-S-2(vlan)#vtptran…………………透明模式(配置修改编号清零)客户模式2950-S-2(vlan)#vtpclient2950-S-2(vlan)#vtppassword1232950-S-3(vlan)#vtpdomainvtp12950-S-3(vlan)#vtptran…………………透明模式(配置修改编号清零)客户模式2950-S-3(vlan)#vtpclient2950-S-3(vlan)#vtppassword1232950-S-4(vlan)#vtpdomainvtp12950-S-4(vlan)#vtptran…………………透明模式(配置修改编号清零)客户模式2950-S-4(vlan)#vtpclient2950-S-4(vlan)#vtppassword1233．路由配置2600-R-1（config）#iproute0.0.0.00.0.0.0f0/2……………...缺省路由2600-R-1（config）#iproute192.168.0.0255.255.0.0192.168.1.23550-R-1(config)#iproute0.0.0.00.0.0.0192.168.1.1 ．45．NAT2600-R-1（config）#access-list101permitip192.168.0.00.0.255.255192.168.0.00.0.255.255……………………………...内部局部地址2600-R-1（config）#ipnatpoolWAN221.215.31.131221.215.31.134prefix-len29………………………………定义合法IP地址池2600-R-1（config）#ipnatinsidesourlist101poolWAN……….实现地址转换2600-R-1（config）#intf0/12600-R-1（config-if）#ipnatinside………………………….定义NATinside2600-R-1（config）#intf0/02600-R-1（config-if）#ipnatoutside………………………..定义NAToutside端口Vlan流量控制制造部、设备部vlan实现互访，禁止访问其它部门vlan制造部、设备部上班时间禁止访问internet(8:00-12:002:00-6:00)研发中心、质保部vlan实现互访，禁止访问其它部门vlan财务部vlan实现与采购部、销售部vlan的单向访问10．总经办vlan实现与财务部、管理部vlan的单向访问管理部vlan禁止访问其它部门vlan各部门vlan都能访问服务器区3550-S-1(config)#time-rangerestrict3550-S-1(config-time-range)#periodicdailystart12:00to2:00……….设置时间范围3550-S-1(config)#ipaccess-listextendyfzx……….研发中心ACL3550-S-1(config-ext-nacl)#permitipany172.16.20.00.0.0.255…...….访问质保部3550-S-1(config-ext-nacl)#permitipany172.16.100.00.0.0.255………访问服务器区3550-S-1(config-ext-nacl)#denyipany192.168.0.00.0.255.255……….禁止访问其它部门3550-S-1(config-ext-nacl)#permitipanyany3550-S-1(config)#ipaccess-listextendzbb……….质保部ACL3550-S-1(config-ext-nacl)#permitipany172.16.10.00.0.0.255…...….访问研发中心3550-S-1(config-ext-nacl)#permitipany172.16.100.00.0.0.255………访问服务器区3550-S-1(config-ext-nacl)#denyipany192.168.0.00.0.255.255……….禁止访问其它部门3550-S-1(config-ext-nacl)#permitipanyany-------------------------------------------------------------------------------------------3550-S-1(config)#ipaccess-listextendzzb……….制造部ACL3550-S-1(config-ext-nacl)#permitipany172.16.40.00.0.0.255…...….访问设备部3550-S-1(config-ext-nacl)#permitipany172.16.100.00.0.0.255………访问服务器区3550-S-1(config-ext-nacl)#denyipany192.168.0.00.0.255.255……….禁止访问其它部门3550-S-1(config-ext-nacl)#permitipanyanytime-rangerestrict……….上班时间禁止上网3550-S-1(config)#ipaccess-listextendsbb……….设备部ACL3550-S-1(config-ext-nacl)#permitipany172.16.30.00.0.0.255…...….访问制造部3550-S-1(config-ext-nacl)#permitipany172.16.100.00.0.0.255………访问服务器区11．3550-S-1(config-ext-nacl)#denyipany192.168.0.00.0.255.255……….禁止访问其它部门3550-S-1(config-ext-nacl)#permitipanyany-----------------------------------------------------------------------------------------3550-S-1(config)#ipaccess-listextendcgb……….采购部ACL3550-S-1(config-ext-nacl)#evaluatecwb-cgb…..计算匹配自反ACL3550-S-1(config-ext-nacl)#permitipany172.16.100.00.0.0.255………访问服务器区3550-S-1(config-ext-nacl)#denyipany192.168.0.00.0.255.2553550-S-1(config-ext-nacl)#permitipanyany----------------------------------------------------------------------------3550-S-1(config)#ipaccess-listextendxsb……….销售部ACL3550-S-1(config-ext-nacl)#evaluatecwb-xsb…..计算匹配自反ACL3550-S-1(config-ext-nacl)#permitipany172.16.100.00.0.0.255………访问服务器区3550-S-1(config-ext-nacl)#denyipany192.168.0.00.0.255.2553550-S-1(config-ext-nacl)#permitipanyany---------------------------------------------------------------------------------------3550-S-1(config)#ipaccess-listextendcwb……….财务部ACL3550-S-1(config-ext-nacl)#permintipany172.16.60.00.0.0.255reflectcwb-cgb………...创建自反ACLcwb-cgb3550-S-1(config-ext-nacl)#permintipany172.16.70.00.0.0.255reflectcwb-xsb………...创建自反ACLcwb-xsb3550-S-1(config-ext-nacl)#evaluatezjb-cwb…..计算匹配自反ACL3550-S-1(config-ext-nacl)#permitipany172.16.100.00.0.0.255………访问服务器区3550-S-1(config-ext-nacl)#denyipany192.168.0.00.0.255.255……….禁止访问其它部门3550-S-1(config-ext-nacl)#permitipanyany--------------------------------------------------------------------------------------------------3550-S-1(config)#ipaccess-listextendcwb……….管理部ACL3550-S-1(config-ext-nacl)#evaluatezjb-glb…..计算匹配自反ACL3550-S-1(config-ext-nacl)#permitipany172.16.100.00.0.0.255………访问服务器区3550-S-1(config-ext-nacl)#denyipany192.168.0.00.0.255.255……….禁止访问其它部门3550-S-1(config-ext-nacl)#permitipanyany12．----------------------------------------------------------------------------------------------------3550-S-1(config)#ipaccess-listextendzjb……….总经办ACL3550-S-1(config-ext-nacl)#permintipany172.16.80.00.0.0.255reflectzjb-cwb………...创建自反ACLzjb-cwb3550-S-1(config-ext-nacl)#permintipany172.16.90.00.0.0.255reflectzjb-glb………...创建自反ACLzjb-glb3550-S-1(config-ext-nacl)#permitipany172.16.100.00.0.0.255………访问服务器区3550-S-1(config-ext-nacl)#denyipany192.168.0.00.0.255.255……….禁止访问其它部门3550-S-1(config-ext-nacl)#permitipanyanyACL应用：3550-S-13550-S-1(config)#intvlan2      …………..研发中心3550-S-1(config-if)#ipaccess-groupyfzxin3550-S-1(config)#intvlan3      …………..质保部3550-S-1(config-if)#ipaccess-groupzbbin3550-S-1(config)#intvlan4      ……………制造部(config-if)#ipaccess-groupzzbin…(略)附：关键字established的ACL应用(单向访问)