三層架構實驗

題目要求：

根據圖片先在ensp上設計出拓撲：

分析部署思路，首先根據題目網段進行子網劃分，然后把簡單的一些要求先配置了，比如將sw1和sw2間鏈路合并，然后配置交換部分，如給每個交換機創建vlan1 2（vlan1默認存在，所以只需要創建vlan2），然后將交換機間介面調為trunk，然后將介面劃入vlan，再就是給每個交換機配置生成樹（STP），將vlan分別劃入不同的組里面，然后就是svi設定，給倆臺三層交換機分別設定vlan1和valn2的虛擬網關和備用網關vrrp（網關冗余）并設定優先級和上行鏈路追蹤，再就是給三層交換機開啟DHCP服務，最后再路由部分，使用ospf，將路由器設為area0，三層交換機部分設為area1，配置路由和預設，最后再給路由器開啟nat服務，可以連接外網就完成了，
1.子網劃分
題目給的網段是172.16.0.0/24，我們匯聚層，讓上倆個為三層交換機，2個vlan互為主備，下面倆個交換機為二層交換機，pc1 3在vlan1中，pc2 4在vlan中，所以：
我們可以給干路網段172.16.0.0/30
vlan1：172.16.2.0/24
vlan2：172.16.3.0/24
2.Eth-Trunk
將交換機sw1和交換機sw2之間的倆條線路合并，

[sw1]interface Eth-Trunk 0
[sw1]interface GigabitEthernet 0/0/1
[sw1-GigabitEthernet0/0/1]eth-trunk 0
Info: This operation may take a few seconds. Please wait for a moment...done.
[sw1]interface GigabitEthernet 0/0/2
[sw1-GigabitEthernet0/0/2]eth-trunk 0
Info: This operation may take a few seconds. Please wait for a moment...done.
[sw2]interface Eth-Trunk 0
[sw2]interface GigabitEthernet 0/0/1
[sw2-GigabitEthernet0/0/1]eth-trunk 0
Info: This operation may take a few seconds. Please wait for a moment...done
[sw2]interface GigabitEthernet 0/0/2
[sw2-GigabitEthernet0/0/2]eth-trunk 0
Info: This operation may take a few seconds. Please wait for a moment...done.

3.創建vlan，劃分介面，交換機鏈路全為trunk
vlan1默認存在，默認通過，不需要創建和劃分trunk，sw3 4和電腦連接鏈路為access，

[sw1]vlan 2
[sw2]vlan 2
[sw3]vlan 2
[sw4]vlan 2
[sw1]interface Eth-Trunk 0
[sw1-Eth-Trunk0]port link-type trunk 
[sw1-Eth-Trunk0]port trunk allow-pass vlan 2
[sw1]interface GigabitEthernet 0/0/4
[sw1-GigabitEthernet0/0/4]port link-type trunk 
[sw1-GigabitEthernet0/0/4]port trunk allow-pass vlan 2
[sw1]interface GigabitEthernet 0/0/5
[sw1-GigabitEthernet0/0/5]port link-type trunk 
[sw1-GigabitEthernet0/0/5]port trunk allow-pass vlan 2
[sw2]interface Eth-Trunk 0
[sw2-Eth-Trunk0]port link-type trunk
[sw2-Eth-Trunk0]port trunk allow-pass vlan 2
[sw2]interface GigabitEthernet 0/0/4
[sw2-GigabitEthernet0/0/4]port link-type trunk 
[sw2-GigabitEthernet0/0/4]port trunk allow-pass vlan 2
[sw2]interface GigabitEthernet 0/0/5
[sw2-GigabitEthernet0/0/5]port link-type trunk 
[sw2-GigabitEthernet0/0/5]port trunk allow-pass vlan 2
[sw3]interface Eth0/0/3
[sw3-Ethernet0/0/3]port link-type access 
[sw3-Ethernet0/0/3]port default vlan 2
[sw3]interface Eth 0/0/1
[sw3-Ethernet0/0/1]port link-type trunk 
[sw3-Ethernet0/0/1]port trunk allow-pass vlan 2
[sw3]interface Eth 0/0/4
[sw3-Ethernet0/0/4]port link-type trunk 
[sw3-Ethernet0/0/4]port trunk allow-pass vlan 2
[sw4]interface Eth 0/0/3
[sw4-Ethernet0/0/3]port link-type access 
[sw4-Ethernet0/0/3]port default vlan 2
[sw4]interface Eth 0/0/1
[sw4-Ethernet0/0/1]port link-type trunk 
[sw4-Ethernet0/0/1]port trunk allow-pass vlan 2
[sw4]interface Eth 0/0/4
[sw4-Ethernet0/0/4]port link-type trunk
[sw4-Ethernet0/0/4]port trunk allow-pass vlan 2

4.生成樹（STP）的設定，且sw1為vlan1（組1）中sw1給根網橋，sw2為備用，vlan2（組2）中，sw2為根網橋，sw1為備用

[sw1]stp enable
[sw1]stp mode mstp 
[sw1]stp region-configuration
[sw1-mst-region]region-name redhat
[sw1-mst-region]instance 1 vlan 1
[sw1-mst-region]instance 2 vlan 2
[sw1-mst-region]active region-configuration 
Info: This operation may take a few seconds. Please wait for a moment...done.

[sw2]stp enable
[sw2]stp mode mstp 
[sw2]stp region-configuration	
[sw2-mst-region]region-name redhat	
[sw2-mst-region]instance 1 vlan 1
[sw2-mst-region]instance 2 vlan 2	
[sw2-mst-region]active region-configuration 
Info: This operation may take a few seconds. Please wait for a moment...done.

[sw3]stp enable
[sw3]stp mode mstp 	
[sw3]stp region-configuration
[sw3-mst-region]region-name redhat	
[sw3-mst-region]instance 1 vlan 1	
[sw3-mst-region]instance 2 vlan 2
[sw3-mst-region]active region-configuration 
Info: This operation may take a few seconds. Please wait for a moment...done.

[sw4]stp enable
[sw4]stp mode mstp 
[sw4]stp region-configuration
[sw4-mst-region]region-name redhat	
[sw4-mst-region]instance 1 vlan 1
[sw4-mst-region]instance 2 vlan 2
[sw4-mst-region]active region-configuration 
Info: This operation may take a few seconds. Please wait for a moment...done.

[sw1]stp instance 1 root
[sw1]stp instance 2 root secondary 
[sw2]stp instance 2 root
[sw2]stp instance 1 root secondary 

然后我們可以將二層交換機sw3 4的stp加速開啟（stp edged-port）

[sw3]interface Eth 0/0/2	
[sw3-Ethernet0/0/2]stp edged-port enable 
[sw3-Ethernet0/0/2]quit	
[sw3]interface Eth 0/0/3
[sw3-Ethernet0/0/3]stp edged-port enable 

[sw4]interface Eth 0/0/2
[sw4-Ethernet0/0/2]stp edged-port enable 
[sw4-Ethernet0/0/2]quit	
[sw4]interface Eth 0/0/3
[sw4-Ethernet0/0/3]stp edged-port enable 
[sw4-Ethernet0/0/3]quit

5.三層交換機虛擬網關（SVI）和備用網關冗余（vrrp）的創建
在三層交換機中，給sw1和sw2的valn1和vlan2分別設定網關，并且在sw1上vlan1為主，vlan2為備，在sw2上vlan2為主，vlan1為備，并且在設定vrrp的時候進行上行鏈路追蹤，優先級降10，

[sw1]interface Vlanif 1	
[sw1-Vlanif1]ip address 172.16.2.253 24
[sw1]interface Vlanif 2
[sw1-Vlanif2]ip address 172.16.3.253 24

[sw2]interface Vlanif 1
[sw2-Vlanif1]ip address 172.16.2.254 24
[sw2]interface Vlanif 2
[sw2-Vlanif2]ip address 172.16.3.254 24

[sw1]interface Vlanif 1
[sw1-Vlanif1]vrrp vrid 1 virtual-ip 172.16.2.250
[sw1-Vlanif1]vrrp vrid 1 priority 101
[sw1-Vlanif1]vrrp vrid 1 track interface GigabitEthernet 0/0/3 reduced 10
[sw1]interface Vlanif 2
[sw1-Vlanif2]vrrp vrid 1 virtual-ip 172.16.3.250

[sw2]interface Vlanif 2
[sw2-Vlanif2]vrrp vrid 1 virtual-ip 172.16.3.250
[sw2-Vlanif2]vrrp vrid 1 priority 101
[sw2-Vlanif2]vrrp vrid 1 track interface GigabitEthernet 0/0/3 reduced 10
[sw2]interface Vlanif 1
[sw2-Vlanif1]vrrp vrid 1 virtual-ip 172.16.2.250

6.開啟DHCP

[sw1]dhcp enable 
Info: The operation may take a few seconds. Please wait for a moment.done.
[sw1]ip pool 1
Info:It's successful to create an IP address pool.
[sw1-ip-pool-1]network 172.16.2.0 mask 255.255.255.0
[sw1-ip-pool-1]gateway-list 172.16.2.250
[sw1-ip-pool-1]dns-list 114.114.114.114
[sw1]ip pool 2
Info:It's successful to create an IP address pool.
[sw1-ip-pool-2]network 172.16.3.0 mask 255.255.255.0
[sw1-ip-pool-2]gateway-list 172.16.3.250
[sw1-ip-pool-2]dns-list 114.114.114.114
[sw1]interface Vlanif 1
[sw1-Vlanif1]dhcp select global
[sw1]interface Vlanif 2
[sw1-Vlanif2]dhcp select global 

[sw2]dhcp enable 
Info: The operation may take a few seconds. Please wait for a moment.done.
[sw2]ip pool 1
Info:It's successful to create an IP address pool.
[sw2-ip-pool-1]network 172.16.2.0 mask 24
[sw2-ip-pool-1]gateway-list 172.16.2.250
[sw2-ip-pool-1]dns-list 114.114.114.114
[sw2]ip pool 2
Info:It's successful to create an IP address pool.
[sw2-ip-pool-2]network 172.16.3.0 mask 24
[sw2-ip-pool-2]gateway-list 172.16.3.250
[sw2-ip-pool-2]dns-list 114.114.114.114
[sw2]interface Vlanif 1
[sw2-Vlanif1]dhcp select global 
[sw2]interface Vlanif 2
[sw2-Vlanif2]dhcp select global 

然后到pc上開啟dhcp服務，用ipconfig命令獲取ipv4地址，

7.路由配置
1.首先給r1和isp介面配置地址

[r1]interface GigabitEthernet 0/0/0
[r1-GigabitEthernet0/0/0]ip address 172.16.0.1 30
[r1]interface GigabitEthernet 0/0/1
[r1-GigabitEthernet0/0/1]ip address 172.16.0.5 30
[r1]interface GigabitEthernet 0/0/2
[r1-GigabitEthernet0/0/2]ip address 12.12.1.1 24

[isp]interface GigabitEthernet 0/0/0
[isp-GigabitEthernet0/0/0]ip address 12.12.1.2 24
[isp]interface LoopBack 1
[isp-LoopBack1]ip address 12.1.1.1 24

2.然后就是三層交換機sw1 2和路由器r1之間的介面了，這里我們說一下，由于三層介面不支持 undo portswitch 所以我們用vlan代替，

[sw1]interface Vlanif 111
[sw1-Vlanif111]ip address 172.16.0.2 30
[sw1]interface GigabitEthernet 0/0/3
[sw1-GigabitEthernet0/0/3]port link-type access
[sw1-GigabitEthernet0/0/3]port default vlan 111
[sw1-GigabitEthernet0/0/3]stp edged-port enable

[sw2]interface Vlanif 222
[sw2-Vlanif222]ip address 172.16.0.6 30
[sw2]interface GigabitEthernet 0/0/3
[sw2-GigabitEthernet0/0/3]port link-type access 
[sw2-GigabitEthernet0/0/3]port default vlan 222
[sw2-GigabitEthernet0/0/3]stp edged-port enable

3.再然后就是ospf的配置
我們將路由器部分劃為區域0，三層交換機部分劃為區域1.

[sw1]ospf 1 router-id 1.1.1.1
[sw1-ospf-1]area 0
[sw1-ospf-1-area-0.0.0.0]network 172.16.0.2 0.0.0.0
[sw1-ospf-1]area 1
[sw1-ospf-1-area-0.0.0.1]network 172.16.2.0 0.0.0.255
[sw1-ospf-1-area-0.0.0.1]network 172.16.3.0 0.0.0.255
[sw1-ospf-1-area-0.0.0.1]abr-summary 172.16.2.0 255.255.224.0

[sw2]ospf 1 router-id 2.2.2.2
[sw2-ospf-1]area 0
[sw2-ospf-1-area-0.0.0.0]network 172.16.0.6 0.0.0.0
[sw2-ospf-1]area 1
[sw2-ospf-1-area-0.0.0.1]network 172.16.2.0 0.0.0.255
[sw2-ospf-1-area-0.0.0.1]network 172.16.3.0 0.0.0.255
[sw2-ospf-1-area-0.0.0.1]abr-summary 172.16.2.0 255.255.254.0

[r1]ospf 1 router-id 3.3.3.3
[r1-ospf-1]area 0
[r1-ospf-1-area-0.0.0.0]network 172.16.0.0 0.0.255.255

4.優化，由于sw1和sw2的只能有vlan1有鄰居關系，所以要沉默vlan2和下行倆個介面，

[sw1]ospf 1
[sw1-ospf-1]silent-interface Vlanif 2
[sw1-ospf-1]silent-interface GigabitEthernet 0/0/4
[sw1-ospf-1]silent-interface GigabitEthernet 0/0/5

[sw2]ospf 1
[sw2-ospf-1]silent-interface Vlanif 2
[sw2-ospf-1]silent-interface GigabitEthernet 0/0/4
[sw2-ospf-1]silent-interface GigabitEthernet 0/0/5

5.這些做完之后就是預設路由了（還需給sw1 2上配置空介面，防止路由黑洞）

[sw1]ip route-static 0.0.0.0 0 12.1.1.2
[sw1]ospf 1
[sw1-ospf-1]default-route-advertise  //下發路由

[sw1]ip route-static 172.16.2.0 23 NULL 0
[sw2]ip route-static 172.16.2.0 23 NULL 0

8.NAT的配置
為了可以isp上網，我們要給路由器r1連接isp的介面配置NAT，

[r1]acl 2000
[r1-acl-basic-2000]rule permit source 172.16.0.0 0.0.255.255
[r1]interface GigabitEthernet 0/0/2
[r1-GigabitEthernet0/0/2]nat outbound 2000

到這里我們的三層架構實驗也算是完成了，