網路安全基礎——HLCA綜合實驗

HLCA綜合實驗

一、實驗要求

二、實驗內容

1、進行IP地址規劃及拓撲搭建

2、進行劃分vlan

[Huawei]interface GigabitEthernet0/0/1.1
[Huawei-GigabitEthernet0/0/1.1]ip address 192.168.1.65 27
[Huawei-GigabitEthernet0/0/1.1]Q
[Huawei]interface GigabitEthernet 0/0/1.2
[Huawei-GigabitEthernet0/0/1.2]ip address 192.168.1.97 27

創建VLAN2、VLAN3，將HTTP服務器劃分到VLAN3，將兩臺pc劃分到VLAN2中；

示例LSW1：

[Huawei]vlan 2
[Huawei-vlan2]vlan 3
[Huawei-vlan3]q
[Huawei]interface Ethernet 0/0/2
[Huawei-Ethernet0/0/2]port link-type access
[Huawei-Ethernet0/0/2]port default vlan 2
[Huawei]interface Ethernet 0/0/3
[Huawei-Ethernet0/0/3]port link-type access
[Huawei-Ethernet0/0/3]port default vlan 2
[Huawei]interface Ethernet 0/0/4
[Huawei-Ethernet0/0/4]port link-type access
[Huawei-Ethernet0/0/4]port default vlan 3

3、在子介面上進行DHCP配置

示例R1：

[Huawei]dhcp enable
[Huawei]ip pool a
Info:It’s successful to create an IP address pool.
[Huawei-ip-pool-a]network 192.168.1.64 mask 27
[Huawei-ip-pool-a]gateway-list 192.168.1.65
[Huawei-ip-pool-a]dns-list 114.114.114.114 8.8.8.8

[Huawei]ip pool b
Info:It’s successful to create an IP address pool.
[Huawei-ip-pool-a]network 192.168.1.96 mask 27
[Huawei-ip-pool-a]gateway-list 192.168.1.97
[Huawei-ip-pool-a]dns-list 114.114.114.114 8.8.8.8

然后開啟DHCP服務：

[Huawei]interface GigabitEthernet0/0/1.1
[Huawei-GigabitEthernet0/0/1.1]dhcp select global
[Huawei]interface GigabitEthernet0/0/1.2
[Huawei-GigabitEthernet0/0/1.2]dhcp select global

R2也與R1同理，

4、對R1、R2上啟動OSPF協議

1、在R1上進行配置

[Huawei]ospf 1 router-id 192.168.1.1
[Huawei-ospf-1]area 0
[Huawei-ospf-1-area-0.0.0.0]network 192.168.1.0 0.0.0.255

2、在R2上進行配置

[R2]ospf 1 router-id 192.168.1.129
[R2-ospf-1]area 0
[R2-ospf-1-area-0.0.0.0]network 192.168.1.0 0.0.0.255

5、進行trunk干道配置

[LSW1]interface Ethernet 0/0/1
[LSW1-Ethernet0/0/1]port link-type trunk
[LSW1-Ethernet0/0/1]port trunk allow-pass vlan all
[LSW2]interface GigabitEthernet 0/0/1
[LSW2-GigabitEthernet0/0/1]port link-type trunk
[LSW2-GigabitEthernet0/0/1]port trunk allow-pass vlan all

配置到現在讓pc1能夠Ping通pc3、pc4.

6、在路由器上設定telent登錄

示例R1：

[r1]aaa
[r1-aaa]local-user chen privilege level 15 password cipher 123456
[r1-aaa]local-user chen service-type telnet
[r1]user-interface vty 0 4
[r1-ui-vty0-4]authentication-mode aaa

示例R2：

[r2]aaa
[r2-aaa]local-user yu privilege level 15 password cipher 123456
[r2-aaa]local-user yu service-type telnet
[r2]user-interface vty 0 4
[r2-ui-vty0-4]authentication-mode aaa

然后在R1上設定策略

[r1-acl-adv-3001]rule deny tcp source 192.168.1.93 0 destination 192.168.1.1 0 destination-port eq 23
[r1-acl-adv-3001]rule deny tcp source 192.168.1.93 0 destination 192.168.1.65 0 destination-port eq 23
[r1-acl-adv-3001]rule deny tcp source 192.168.1.93 0 destination 192.168.1.97 0 destination-port eq 23

在介面上呼叫這個命令

[r1-GigabitEthernet0/0/1]traffic-filter inbound acl 3000

7、由公有IP12.1.1.1令pc1–4可以訪問pc5

[r2-acl-basic-2000]rule permit source 192.168.0.0 0.0.255.255
[r2]interface GigabitEthernet 0/0/2
[r2-GigabitEthernet0/0/2]nat outbound 2000

然后在R2上寫一條預設路由

[r2]ip route-static 0.0.0.0 0.0.0.0 1.1.1.0

三、通過client去訪問HTTP和server

HTTP配置如下：

DNS配置如下：


在內網中的服務器進行埠映射；

在示例r2上配置如下：

[r2-GigabitEthernet0/0/2]nat static protocol tcp global current-interface 80 inside 192.168.1.98 80
Warning:The port 80 is well-known port. If you continue it may cause function failure.
Are you sure to continue?[Y/N]:y

實驗結束