從0到1完成總部企業園區網搭建

企業園區網拓撲：

​拓撲下載地址：鏈接: https://pan.baidu.com/s/1sZSPkjOS0GZBWeCurlgdXQ 提取碼: wb6k

企業園區網簡介：

在公司Tiger-HQ中的PC-A和PC-B屬於同一個IT部門，PC-C和PC-D屬於同一個銷售部門，PC-D可以視作一臺打印機（IP地址固定）。

企業園區網的需求以及對應的解決方案：

一：公司Tiger-HQ需求

1.總部有兩臺3700系列接入交換機（SW5、SW6）分別連接主機PC-A、PC-C，PC-B、PC-D（打印機），其中PC-A、PC-B屬於IT部門，PC-C、PC-D屬於銷售部門，出於管理以及安全層面，需要將兩個部門劃分至不同的子網。

解決方案：--通過靜態VLAN的方式實現網絡的二層隔離。

vlan10-->IT部門

vlan20-->Sales部門

<code>[SW5]vlan 10
[SW5-vlan10]description IT
[SW5-vlan10]quit

[SW5]vlan 20
[SW5-vlan20]description Sales
[SW5-vlan20]quit/<code>

<code>[SW6]vlan 10
[SW6-vlan10]description IT 

[SW6-vlan10]quit

[SW6-vlan10]vlan 20
[SW6-vlan20]description Sales
[SW6-vlan20]quit/<code>

<code>[SW1]vlan 10
[SW1-vlan10] description IT
[SW1-vlan10]quit

[SW1-vlan10]vlan 20
[SW1-vlan20] description Sales
[SW1-vlan20]quit/<code>

<code>[SW2]vlan 10
[SW2-vlan10] description IT
[SW2-vlan10]quit

[SW2-vlan10]vlan 20
[SW2-vlan20] description Sales
[SW2-vlan20]quit/<code>

​設備配置的檢查：

​vlan和接口的綁定：

<code>[SW5]interface Eth0/0/1
[SW5-Ethernet0/0/1]port link-type access 
[SW5-Ethernet0/0/1]port default vlan 10
[SW5-Ethernet0/0/1]quit

[SW5]interface Eth0/0/2
[SW5-Ethernet0/0/2]port link-type access
[SW5-Ethernet0/0/2]port default vlan 20 
[SW5-Ethernet0/0/2]quit                 /<code>

<code>[SW6]interface Eth0/0/1
[SW6-Ethernet0/0/1]port link-type access
[SW6-Ethernet0/0/1]port default vlan 10
[SW6-Ethernet0/0/1]quit

[SW6]interface Eth0/0/2   
[SW6-Ethernet0/0/2]port link-type access
[SW6-Ethernet0/0/2]port default vlan 20
[SW6-Ethernet0/0/2]quit/<code>

​設備配置的檢查：

​配置設備的環回口地址。

<code>[SW1]interface LoopBack 0
[SW1-LoopBack0]ip address 10.1.11.11 32
[SW1-LoopBack0]quit

[SW2]interface LoopBack 0
[SW2-LoopBack0]ip address 10.1.12.12 32
[SW2-LoopBack0]quit

[SW5]interface LoopBack 0
[SW5-LoopBack0]ip address 10.1.15.15 32
[SW5-LoopBack0]quit

[SW6]interface LoopBack 0
[SW6-LoopBack0]ip address 10.1.16.16 32
[SW6-LoopBack0]quit

[AR1]interface LoopBack 0
[AR1-LoopBack0]ip address 10.1.1.1 32
[AR1-LoopBack0]quit /<code>

​設備配置的檢查：

​

2.總部的接入3700系列交換機(SW5,SW6)通過雙上行鏈路連接到兩臺5700匯聚交換機(SW1,SW2),鏈路需要允許所有VLAN流量同時同行，考慮到未來可能添加思科交換機,需要使用兼容性最強的防環機制,並且保證IT部門]訪問外網流量通過SW1做中轉銷售部訪問外網流量通過SW2做中轉,確保SW1,SW2之間相互備份, SW1不可用時,流量自動切換到SW2,SW2反之亦然。

解決方案：

<code>[SW1]interface GigabitEthernet 0/0/1
[SW1-GigabitEthernet0/0/1]port link-type trunk 
[SW1-GigabitEthernet0/0/1]port trunk allow-pass vlan all 
[SW1-GigabitEthernet0/0/1]quit

[SW1]interface GigabitEthernet 0/0/2
[SW1-GigabitEthernet0/0/2]port link-type trunk          
[SW1-GigabitEthernet0/0/2]port trunk allow-pass vlan all 
[SW1-GigabitEthernet0/0/2]quit/<code>

<code>[SW2]interface GigabitEthernet 0/0/1
[SW2-GigabitEthernet0/0/1]port link-type trunk
[SW2-GigabitEthernet0/0/1]port trunk allow-pass vlan all 
[SW2-GigabitEthernet0/0/1]quit

[SW2]interface GigabitEthernet 0/0/2
[SW2-GigabitEthernet0/0/2]port link-type trunk           
[SW2-GigabitEthernet0/0/2]port trunk allow-pass vlan all 
[SW2-GigabitEthernet0/0/2]quit                          /<code>

<code>[SW5]interface GigabitEthernet 0/0/1
[SW5-GigabitEthernet0/0/1]port link-type trunk
[SW5-GigabitEthernet0/0/1]port trunk allow-pass vlan all 
[SW5-GigabitEthernet0/0/1]quit

[SW5]interface GigabitEthernet 0/0/2 

[SW5-GigabitEthernet0/0/2]port link-type trunk   
[SW5-GigabitEthernet0/0/2]port trunk allow-pass vlan all 
[SW5-GigabitEthernet0/0/2]quit  /<code>

<code>[SW6]interface GigabitEthernet 0/0/1
[SW6-GigabitEthernet0/0/1]port link-type trunk
[SW6-GigabitEthernet0/0/1]port trunk allow-pass vlan all 
[SW6-GigabitEthernet0/0/1]quit

[SW6]interface GigabitEthernet 0/0/2
[SW6-GigabitEthernet0/0/2]port link-type trunk           
[SW6-GigabitEthernet0/0/2]port trunk allow-pass vlan all 
[SW6-GigabitEthernet0/0/2]quit/<code>

​設備配置的檢查：

<code>[SW1]stp mode mstp  


[SW1]stp region-configuration 
[SW1-mst-region]region-name Tiger
[SW1-mst-region]revision-level 1
[SW1-mst-region]instance 10 vlan 10
[SW1-mst-region]instance 20 vlan 20
[SW1-mst-region]active region-configuration 
[SW1-mst-region]quit

[SW1]stp instance 10 root primary 
[SW1]stp instance 20 root secondary /<code>

<code>[SW2]stp mode mstp 

[SW2]stp region-configuration
[SW2-mst-region] region-name Tiger
[SW2-mst-region] revision-level 1
[SW2-mst-region] instance 10 vlan 10
[SW2-mst-region] instance 20 vlan 20
[SW2-mst-region] active region-configuration
[SW2-mst-region]quit

[SW2]stp instance 10 root secondary
[SW2]stp instance 20 root primary /<code>

<code>[SW5]stp mode mstp 

[SW5]stp region-configuration
[SW5-mst-region] region-name Tiger
[SW5-mst-region] revision-level 1
[SW5-mst-region] instance 10 vlan 10
[SW5-mst-region] instance 20 vlan 20
[SW5-mst-region] active region-configuration
[SW5-mst-region]quit/<code>

<code>[SW6]stp mode mstp 

[SW6]stp region-configuration
[SW6-mst-region] region-name Tiger
[SW6-mst-region] revision-level 1
[SW6-mst-region] instance 10 vlan 10
[SW6-mst-region] instance 20 vlan 20
[SW6-mst-region] active region-configuration
[SW6-mst-region]quit/<code>

​設備配置的檢查：

​

​

3.SW1-SW2之間通過雙線連接(G0/0/23-G0/0/24)，針對任何一個部門的流量需要通過兩條鏈路完成負載均衡，使用最高效的負載均衡算法
實現鏈路帶寬利用的最大化實現鏈路帶寬利用的最大化。

解決方案：

兩條鏈路完成負載均衡-->EtnerChannel

最高效的負載均衡算法-->S-D-IP

<code>[SW1]interface Eth-Trunk 12
[SW1-Eth-Trunk12]trunkport GigabitEthernet 0/0/23 to 0/0/24
[SW1-Eth-Trunk12]port link-type trunk 
[SW1-Eth-Trunk12]port trunk allow-pass vlan all  
[SW1-Eth-Trunk12]load-balance src-dst-ip 
[SW1-Eth-Trunk12]quit/<code>

<code>[SW2]interface Eth-Trunk 12
[SW2-Eth-Trunk12]trunkport GigabitEthernet 0/0/23 to 0/0/24
[SW2-Eth-Trunk12]port link-type trunk 
[SW2-Eth-Trunk12]port trunk allow-pass vlan all 
[SW2-Eth-Trunk12]load-balance src-dst-ip 
[SW2-Eth-Trunk12]quit/<code>

​設備配置的檢查：

​

4.避免上下班高峰期工作主機頻繁開關機導致網絡擁塞通過相應技術解決TC-BPDU的發送為了避免錯連導致臨時環路啟用相應保護技術。實現這些接口錯連接交換機後自動進入error-disable狀態，提高交換機連接路由器接口的收斂效率，

解決方案：

邊緣端口：

1)一個網絡設備連接很多主機，在公司上下班時，會有大量的主機開機關機，交換機的接口幾乎同時up/down，對於運行生成樹的交換機而言，相當於網絡的拓撲發生了變化，就換產生TC-BPDU發生給其他交換機要重新進行網絡的拓撲收斂，這樣就會造成未知單播幀的泛洪，導致網絡的擁塞。

2)起了該特性的接口就算運行生成樹，接口的狀態發生變更，交換機也不會認為這是拓撲發生了改變，交換機也不會產生TC-BPDU，就算收到了其他交換機發送的BPDU，這些邊緣交換機的MAC地址表項，交換機也不會刪除。

3)交換機連接PC的接口

接口視圖下：stp edged-port enable

<code>[SW5]interface Eth0/0/1
[SW5-Ethernet0/0/1]stp edged-port enable 
[SW5-Ethernet0/0/1]quit

[SW5]interface Eth0/0/2   
[SW5-Ethernet0/0/2]stp edged-port enable
[SW5-Ethernet0/0/2]quit  

[SW5]stp bpdu-protection /<code>

<code>[SW6]interface Eth0/0/1
[SW6-Ethernet0/0/1]stp edged-port enable 
[SW6-Ethernet0/0/1]quit

[SW6]interface Eth0/0/2    

[SW6-Ethernet0/0/2]stp edged-port enable
[SW6-Ethernet0/0/2]quit      

[SW6]stp bpdu-protection        /<code>

​5.總部的部門之間的主機需要相互訪問，匯聚交換機用作網關通過FHRP解決網關高可用性問題，FHRP應當呼應STP拓撲,保證節點訪問網關時使用的是最優二層路徑為提高網關效率,FHRP需要追蹤本地上行接口狀態當上行接口故障時,FHRP角色需要自動切換為保證切換平滑切換延遲為10秒。

解決方案：

<code>[SW1]vlan 111
[SW1-vlan111]description link-to-AR1
[SW1-vlan111]quit

[SW1]int Vlanif 111
[SW1-Vlanif111]ip add 10.1.111.11 24
[SW1-Vlanif111]quit


[SW1]interface GigabitEthernet 0/0/3
[SW1-GigabitEthernet0/0/3]port link-type access 
[SW1-GigabitEthernet0/0/3]port default vlan 111 
[SW1-GigabitEthernet0/0/3]quit 

[SW1]interface Vlanif 10
[SW1-Vlanif10]ip address 10.1.10.11 24
[SW1-Vlanif10]vrrp vrid 10 virtual-ip 10.1.10.1   
[SW1-Vlanif10]vrrp vrid 10 priority 105
[SW1-Vlanif10]vrrp vrid 10 authentication-mode md5 cisco  
[SW1-Vlanif10]vrrp vrid 10 track interface Vlanif 111 reduced 10
[SW1-Vlanif10]vrrp vrid 10 preempt-mode timer delay 10
[SW1-Vlanif10]quit

[SW1]interface Vlanif 20
[SW1-Vlanif20]ip address 10.1.20.11 24
[SW1-Vlanif20]vrrp vrid 20 virtual-ip 10.1.20.1
[SW1-Vlanif20]vrrp vrid 20 preempt-mode timer delay 10
[SW1-Vlanif20]vrrp vrid 20 authentication-mode md5 cisco 

[SW1-Vlanif20]quit /<code>

<code>[SW2]vlan 112
[SW2-vlan112]description link-to-AR
[SW2-vlan112]quit 

[SW2]interface Vlanif 112
[SW2-Vlanif112]ip address 10.1.112.12 24
[SW2-Vlanif112]quit

[SW2]interface GigabitEthernet 0/0/3
[SW2-GigabitEthernet0/0/3]port link-type access 
[SW2-GigabitEthernet0/0/3]port default vlan 112
[SW2-GigabitEthernet0/0/3]quit

[SW2]interface Vlanif 10
[SW2-Vlanif10]ip address 10.1.10.12 24
[SW2-Vlanif10]vrrp vrid 10 virtual-ip 10.1.10.1
[SW2-Vlanif10]vrrp vrid 10 preempt-mode timer delay 10
[SW2-Vlanif10]vrrp vrid 10 authentication-mode md5 cisco
[SW2-Vlanif10]quit

[SW2]interface Vlanif 20
[SW2-Vlanif20]ip address 10.1.20.12 24
[SW2-Vlanif20]vrrp vrid 20 virtual-ip 10.1.20.1
[SW2-Vlanif20]vrrp vrid 20 priority 105
[SW2-Vlanif20]vrrp vrid 20 preempt-mode timer delay 10
[SW2-Vlanif20]vrrp vrid 20 authentication-mode md5 cisco
[SW2-Vlanif20]vrrp vrid 20 track interface Vlanif 112 re
[SW2-Vlanif20]vrrp vrid 20 track interface Vlanif 112 reduced 10
[SW2-Vlanif20]quit /<code>

​設備配置的檢查：

​

​

6.匯聚交換機連接邊界路由器R1的鏈路使用接入鏈路劃入VLAN 111以及112 ,通過啟用SVI實現匯聚和邊界的3層連接，運行OSPF實現內網連通性:使用Loopback0口地址做RID.為了加速收斂在點到點互聯鏈路上不選舉DR/BDR。

解決方案：

不選舉DR/BDR-->點到點

<code>[AR1]interface GigabitEthernet 0/0/0
[AR1-GigabitEthernet0/0/0]ip address 10.1.111.1 24
[AR1-GigabitEthernet0/0/0]ospf network-type p2p
[AR1-GigabitEthernet0/0/0]quit 

[AR1]interface GigabitEthernet 0/0/1
[AR1-GigabitEthernet0/0/1]ip address 10.1.112.1 24 
[AR1-GigabitEthernet0/0/1]ospf network-type p2p
[AR1-GigabitEthernet0/0/1]quit 

[AR1]ospf 10 router-id 10.1.1.1
[AR1-ospf-10]area 0
[AR1-ospf-10-area-0.0.0.0]network 10.1.1.1 0.0.0.0
[AR1-ospf-10-area-0.0.0.0]network 10.1.111.1 0.0.0.0
[AR1-ospf-10-area-0.0.0.0]network 10.1.112.1 0.0.0.0
[AR1-ospf-10-area-0.0.0.0]quit
[AR1-ospf-10]quit/<code>

<code>[SW1]interface  Vlanif 111
[SW1-Vlanif111]ospf network-type p2p
[SW1-Vlanif111]quit 

[SW1]ospf 10 router-id 10.1.11.11
[SW1-ospf-10]area 0
[SW1-ospf-10-area-0.0.0.0]network 10.1.11.11 0.0.0.0
[SW1-ospf-10-area-0.0.0.0]network 10.1.10.11 0.0.0.0
[SW1-ospf-10-area-0.0.0.0]network 10.1.20.11 0.0.0.0
[SW1-ospf-10-area-0.0.0.0]network 10.1.111.11 0.0.0.0
[SW1-ospf-10-area-0.0.0.0]quit
[SW1-ospf-10]quit/<code>

<code>[SW2]interface Vlanif 112
[SW2-Vlanif112]ospf network-type p2p
[SW2-Vlanif112]quit 

[SW2]ospf 10 router-id 10.1.12.12
[SW2-ospf-10]area 0
[SW2-ospf-10-area-0.0.0.0]network 10.1.12.12 0.0.0.0
[SW2-ospf-10-area-0.0.0.0]network 10.1.10.12 0.0.0.0
[SW2-ospf-10-area-0.0.0.0]network 10.1.20.12 0.0.0.0
[SW2-ospf-10-area-0.0.0.0]network 10.1.112.12 0.0.0.0
[SW2-ospf-10-area-0.0.0.0]quit
[SW2-ospf-10]quit/<code>

​

​

​

​7.各部門主機需要動態獲得IP地址,R1做Server,由於打印機需要日常訪問因此需要保證其每次獲職的地址一致在R1上配置實現。

解決方案：

DHCP Server和DHCP Client不在同一網段-->DHCP Relay

廣播discover-->單播discover

<code>[AR1]dhcp enable 
           
[AR1]ip pool IT
[AR1-ip-pool-IT]network 10.1.10.0 mask 255.255.255.0
[AR1-ip-pool-IT]gateway-list 10.1.10.1
[AR1-ip-pool-IT]dns-list 10.1.10.1
[AR1-ip-pool-IT]domain-name Tiger.net
[AR1-ip-pool-IT]quit 

[AR1]ip pool Sales                       
[AR1-ip-pool-Sales]network 10.1.20.0 mask 255.255.255.0
[AR1-ip-pool-Sales]gateway-list 10.1.20.1              
[AR1-ip-pool-Sales]dns-list 10.1.20.1                  
[AR1-ip-pool-Sales]domain-name Tiger.net               
[AR1-ip-pool-Sales]static-bind ip-address 10.1.20.100 mac-address 5489-98BC-41BE 
[AR1-ip-pool-Sales]qui
[AR1-ip-pool-Sales]quit 

[AR1]interface GigabitEthernet 0/0/0
[AR1-GigabitEthernet0/0/0]dhcp select global 
[AR1-GigabitEthernet0/0/0]quit

[AR1]interface GigabitEthernet 0/0/1
[AR1-GigabitEthernet0/0/1]dhcp select global             
[AR1-GigabitEthernet0/0/1]quit  /<code>

<code>[SW1]interface Vlanif 10
[SW1-Vlanif10]dhcp select relay
[SW1-Vlanif10]dhcp relay server-ip 10.1.111.1 
[SW1-Vlanif10]quit 

[SW1]interface Vlanif 20
[SW1-Vlanif20]dhcp select relay       
[SW1-Vlanif20]dhcp relay server-ip 10.1.111.1
[SW1-Vlanif20]quit /<code>

<code>[SW2]interface Vlanif 10
[SW2-Vlanif10]dhcp select relay 
[SW2-Vlanif10]dhcp relay server-ip 10.1.112.1
[SW2-Vlanif10]quit

[SW2]interface Vlanif 20            
[SW2-Vlanif20]dhcp select relay              
[SW2-Vlanif20]dhcp relay server-ip 10.1.112.1
[SW2-Vlanif20]quit      /<code>

​

​

​

​

​

​

​

8.優化路由選擇協議，使得交換機連接下游主機的接口不周期發送hello，R1和PC互訪，往返流量使用相同路徑。

解決方案：

被動接口-->passive掉

對稱路由

<code>[AR1]ospf 10
[AR1-ospf-10]silent-interface LoopBack 0
[AR1-ospf-10]quit /<code>

<code>[SW1]ospf 10
[SW1-ospf-10]silent-interface loo 0 
[SW1-ospf-10]silent-interface Vlanif 10
[SW1-ospf-10]silent-interface Vlanif 20
[SW1-ospf-10]quit /<code>

<code>[SW2]ospf 10
[SW2-ospf-10]silent-interface LoopBack 0
[SW2-ospf-10]silent-interface vlan 10
[SW2-ospf-10]silent-interface vlan 20
[SW2-ospf-10]quit /<code>

<code>[SW1]interface Vlanif 20 
[SW1-Vlanif20]ospf cost 2
[SW1-Vlanif20]quit /<code>

<code>[SW2]interface Vlanif 10
[SW2-Vlanif10]ospf cost 2
[SW2-Vlanif10]quit /<code>

​設備配置的檢查：

​

​PC-ASW1AR1：

​

​PC-CSW2AR1：

​

​本實驗來自騰訊課堂輝哥課程的實驗歸納。

未完，待續！

閱讀更多 InternetCafe 的文章

關鍵字: 思科系統 打印機 園區