从0到1完成总部企业园区网搭建

企业园区网拓扑：

​拓扑下载地址：链接: https://pan.baidu.com/s/1sZSPkjOS0GZBWeCurlgdXQ 提取码: wb6k

企业园区网简介：

在公司Tiger-HQ中的PC-A和PC-B属于同一个IT部门，PC-C和PC-D属于同一个销售部门，PC-D可以视作一台打印机（IP地址固定）。

企业园区网的需求以及对应的解决方案：

一：公司Tiger-HQ需求

1.总部有两台3700系列接入交换机（SW5、SW6）分别连接主机PC-A、PC-C，PC-B、PC-D（打印机），其中PC-A、PC-B属于IT部门，PC-C、PC-D属于销售部门，出于管理以及安全层面，需要将两个部门划分至不同的子网。

解决方案：--通过静态VLAN的方式实现网络的二层隔离。

vlan10-->IT部门

vlan20-->Sales部门

<code>[SW5]vlan 10
[SW5-vlan10]description IT
[SW5-vlan10]quit

[SW5]vlan 20
[SW5-vlan20]description Sales
[SW5-vlan20]quit/<code>

<code>[SW6]vlan 10
[SW6-vlan10]description IT 

[SW6-vlan10]quit

[SW6-vlan10]vlan 20
[SW6-vlan20]description Sales
[SW6-vlan20]quit/<code>

<code>[SW1]vlan 10
[SW1-vlan10] description IT
[SW1-vlan10]quit

[SW1-vlan10]vlan 20
[SW1-vlan20] description Sales
[SW1-vlan20]quit/<code>

<code>[SW2]vlan 10
[SW2-vlan10] description IT
[SW2-vlan10]quit

[SW2-vlan10]vlan 20
[SW2-vlan20] description Sales
[SW2-vlan20]quit/<code>

​设备配置的检查：

​vlan和接口的绑定：

<code>[SW5]interface Eth0/0/1
[SW5-Ethernet0/0/1]port link-type access 
[SW5-Ethernet0/0/1]port default vlan 10
[SW5-Ethernet0/0/1]quit

[SW5]interface Eth0/0/2
[SW5-Ethernet0/0/2]port link-type access
[SW5-Ethernet0/0/2]port default vlan 20 
[SW5-Ethernet0/0/2]quit                 /<code>

<code>[SW6]interface Eth0/0/1
[SW6-Ethernet0/0/1]port link-type access
[SW6-Ethernet0/0/1]port default vlan 10
[SW6-Ethernet0/0/1]quit

[SW6]interface Eth0/0/2   
[SW6-Ethernet0/0/2]port link-type access
[SW6-Ethernet0/0/2]port default vlan 20
[SW6-Ethernet0/0/2]quit/<code>

​设备配置的检查：

​配置设备的环回口地址。

<code>[SW1]interface LoopBack 0
[SW1-LoopBack0]ip address 10.1.11.11 32
[SW1-LoopBack0]quit

[SW2]interface LoopBack 0
[SW2-LoopBack0]ip address 10.1.12.12 32
[SW2-LoopBack0]quit

[SW5]interface LoopBack 0
[SW5-LoopBack0]ip address 10.1.15.15 32
[SW5-LoopBack0]quit

[SW6]interface LoopBack 0
[SW6-LoopBack0]ip address 10.1.16.16 32
[SW6-LoopBack0]quit

[AR1]interface LoopBack 0
[AR1-LoopBack0]ip address 10.1.1.1 32
[AR1-LoopBack0]quit /<code>

​设备配置的检查：

​

2.总部的接入3700系列交换机(SW5,SW6)通过双上行链路连接到两台5700汇聚交换机(SW1,SW2),链路需要允许所有VLAN流量同时同行，考虑到未来可能添加思科交换机,需要使用兼容性最强的防环机制,并且保证IT部门]访问外网流量通过SW1做中转销售部访问外网流量通过SW2做中转,确保SW1,SW2之间相互备份, SW1不可用时,流量自动切换到SW2,SW2反之亦然。

解决方案：

<code>[SW1]interface GigabitEthernet 0/0/1
[SW1-GigabitEthernet0/0/1]port link-type trunk 
[SW1-GigabitEthernet0/0/1]port trunk allow-pass vlan all 
[SW1-GigabitEthernet0/0/1]quit

[SW1]interface GigabitEthernet 0/0/2
[SW1-GigabitEthernet0/0/2]port link-type trunk          
[SW1-GigabitEthernet0/0/2]port trunk allow-pass vlan all 
[SW1-GigabitEthernet0/0/2]quit/<code>

<code>[SW2]interface GigabitEthernet 0/0/1
[SW2-GigabitEthernet0/0/1]port link-type trunk
[SW2-GigabitEthernet0/0/1]port trunk allow-pass vlan all 
[SW2-GigabitEthernet0/0/1]quit

[SW2]interface GigabitEthernet 0/0/2
[SW2-GigabitEthernet0/0/2]port link-type trunk           
[SW2-GigabitEthernet0/0/2]port trunk allow-pass vlan all 
[SW2-GigabitEthernet0/0/2]quit                          /<code>

<code>[SW5]interface GigabitEthernet 0/0/1
[SW5-GigabitEthernet0/0/1]port link-type trunk
[SW5-GigabitEthernet0/0/1]port trunk allow-pass vlan all 
[SW5-GigabitEthernet0/0/1]quit

[SW5]interface GigabitEthernet 0/0/2 

[SW5-GigabitEthernet0/0/2]port link-type trunk   
[SW5-GigabitEthernet0/0/2]port trunk allow-pass vlan all 
[SW5-GigabitEthernet0/0/2]quit  /<code>

<code>[SW6]interface GigabitEthernet 0/0/1
[SW6-GigabitEthernet0/0/1]port link-type trunk
[SW6-GigabitEthernet0/0/1]port trunk allow-pass vlan all 
[SW6-GigabitEthernet0/0/1]quit

[SW6]interface GigabitEthernet 0/0/2
[SW6-GigabitEthernet0/0/2]port link-type trunk           
[SW6-GigabitEthernet0/0/2]port trunk allow-pass vlan all 
[SW6-GigabitEthernet0/0/2]quit/<code>

​设备配置的检查：

<code>[SW1]stp mode mstp  


[SW1]stp region-configuration 
[SW1-mst-region]region-name Tiger
[SW1-mst-region]revision-level 1
[SW1-mst-region]instance 10 vlan 10
[SW1-mst-region]instance 20 vlan 20
[SW1-mst-region]active region-configuration 
[SW1-mst-region]quit

[SW1]stp instance 10 root primary 
[SW1]stp instance 20 root secondary /<code>

<code>[SW2]stp mode mstp 

[SW2]stp region-configuration
[SW2-mst-region] region-name Tiger
[SW2-mst-region] revision-level 1
[SW2-mst-region] instance 10 vlan 10
[SW2-mst-region] instance 20 vlan 20
[SW2-mst-region] active region-configuration
[SW2-mst-region]quit

[SW2]stp instance 10 root secondary
[SW2]stp instance 20 root primary /<code>

<code>[SW5]stp mode mstp 

[SW5]stp region-configuration
[SW5-mst-region] region-name Tiger
[SW5-mst-region] revision-level 1
[SW5-mst-region] instance 10 vlan 10
[SW5-mst-region] instance 20 vlan 20
[SW5-mst-region] active region-configuration
[SW5-mst-region]quit/<code>

<code>[SW6]stp mode mstp 

[SW6]stp region-configuration
[SW6-mst-region] region-name Tiger
[SW6-mst-region] revision-level 1
[SW6-mst-region] instance 10 vlan 10
[SW6-mst-region] instance 20 vlan 20
[SW6-mst-region] active region-configuration
[SW6-mst-region]quit/<code>

​设备配置的检查：

​

​

3.SW1-SW2之间通过双线连接(G0/0/23-G0/0/24)，针对任何一个部门的流量需要通过两条链路完成负载均衡，使用最高效的负载均衡算法
实现链路带宽利用的最大化实现链路带宽利用的最大化。

解决方案：

两条链路完成负载均衡-->EtnerChannel

最高效的负载均衡算法-->S-D-IP

<code>[SW1]interface Eth-Trunk 12
[SW1-Eth-Trunk12]trunkport GigabitEthernet 0/0/23 to 0/0/24
[SW1-Eth-Trunk12]port link-type trunk 
[SW1-Eth-Trunk12]port trunk allow-pass vlan all  
[SW1-Eth-Trunk12]load-balance src-dst-ip 
[SW1-Eth-Trunk12]quit/<code>

<code>[SW2]interface Eth-Trunk 12
[SW2-Eth-Trunk12]trunkport GigabitEthernet 0/0/23 to 0/0/24
[SW2-Eth-Trunk12]port link-type trunk 
[SW2-Eth-Trunk12]port trunk allow-pass vlan all 
[SW2-Eth-Trunk12]load-balance src-dst-ip 
[SW2-Eth-Trunk12]quit/<code>

​设备配置的检查：

​

4.避免上下班高峰期工作主机频繁开关机导致网络拥塞通过相应技术解决TC-BPDU的发送为了避免错连导致临时环路启用相应保护技术。实现这些接口错连接交换机后自动进入error-disable状态，提高交换机连接路由器接口的收敛效率，

解决方案：

边缘端口：

1)一个网络设备连接很多主机，在公司上下班时，会有大量的主机开机关机，交换机的接口几乎同时up/down，对于运行生成树的交换机而言，相当于网络的拓扑发生了变化，就换产生TC-BPDU发生给其他交换机要重新进行网络的拓扑收敛，这样就会造成未知单播帧的泛洪，导致网络的拥塞。

2)起了该特性的接口就算运行生成树，接口的状态发生变更，交换机也不会认为这是拓扑发生了改变，交换机也不会产生TC-BPDU，就算收到了其他交换机发送的BPDU，这些边缘交换机的MAC地址表项，交换机也不会删除。

3)交换机连接PC的接口

接口视图下：stp edged-port enable

<code>[SW5]interface Eth0/0/1
[SW5-Ethernet0/0/1]stp edged-port enable 
[SW5-Ethernet0/0/1]quit

[SW5]interface Eth0/0/2   
[SW5-Ethernet0/0/2]stp edged-port enable
[SW5-Ethernet0/0/2]quit  

[SW5]stp bpdu-protection /<code>

<code>[SW6]interface Eth0/0/1
[SW6-Ethernet0/0/1]stp edged-port enable 
[SW6-Ethernet0/0/1]quit

[SW6]interface Eth0/0/2    

[SW6-Ethernet0/0/2]stp edged-port enable
[SW6-Ethernet0/0/2]quit      

[SW6]stp bpdu-protection        /<code>

​5.总部的部门之间的主机需要相互访问，汇聚交换机用作网关通过FHRP解决网关高可用性问题，FHRP应当呼应STP拓扑,保证节点访问网关时使用的是最优二层路径为提高网关效率,FHRP需要追踪本地上行接口状态当上行接口故障时,FHRP角色需要自动切换为保证切换平滑切换延迟为10秒。

解决方案：

<code>[SW1]vlan 111
[SW1-vlan111]description link-to-AR1
[SW1-vlan111]quit

[SW1]int Vlanif 111
[SW1-Vlanif111]ip add 10.1.111.11 24
[SW1-Vlanif111]quit


[SW1]interface GigabitEthernet 0/0/3
[SW1-GigabitEthernet0/0/3]port link-type access 
[SW1-GigabitEthernet0/0/3]port default vlan 111 
[SW1-GigabitEthernet0/0/3]quit 

[SW1]interface Vlanif 10
[SW1-Vlanif10]ip address 10.1.10.11 24
[SW1-Vlanif10]vrrp vrid 10 virtual-ip 10.1.10.1   
[SW1-Vlanif10]vrrp vrid 10 priority 105
[SW1-Vlanif10]vrrp vrid 10 authentication-mode md5 cisco  
[SW1-Vlanif10]vrrp vrid 10 track interface Vlanif 111 reduced 10
[SW1-Vlanif10]vrrp vrid 10 preempt-mode timer delay 10
[SW1-Vlanif10]quit

[SW1]interface Vlanif 20
[SW1-Vlanif20]ip address 10.1.20.11 24
[SW1-Vlanif20]vrrp vrid 20 virtual-ip 10.1.20.1
[SW1-Vlanif20]vrrp vrid 20 preempt-mode timer delay 10
[SW1-Vlanif20]vrrp vrid 20 authentication-mode md5 cisco 

[SW1-Vlanif20]quit /<code>

<code>[SW2]vlan 112
[SW2-vlan112]description link-to-AR
[SW2-vlan112]quit 

[SW2]interface Vlanif 112
[SW2-Vlanif112]ip address 10.1.112.12 24
[SW2-Vlanif112]quit

[SW2]interface GigabitEthernet 0/0/3
[SW2-GigabitEthernet0/0/3]port link-type access 
[SW2-GigabitEthernet0/0/3]port default vlan 112
[SW2-GigabitEthernet0/0/3]quit

[SW2]interface Vlanif 10
[SW2-Vlanif10]ip address 10.1.10.12 24
[SW2-Vlanif10]vrrp vrid 10 virtual-ip 10.1.10.1
[SW2-Vlanif10]vrrp vrid 10 preempt-mode timer delay 10
[SW2-Vlanif10]vrrp vrid 10 authentication-mode md5 cisco
[SW2-Vlanif10]quit

[SW2]interface Vlanif 20
[SW2-Vlanif20]ip address 10.1.20.12 24
[SW2-Vlanif20]vrrp vrid 20 virtual-ip 10.1.20.1
[SW2-Vlanif20]vrrp vrid 20 priority 105
[SW2-Vlanif20]vrrp vrid 20 preempt-mode timer delay 10
[SW2-Vlanif20]vrrp vrid 20 authentication-mode md5 cisco
[SW2-Vlanif20]vrrp vrid 20 track interface Vlanif 112 re
[SW2-Vlanif20]vrrp vrid 20 track interface Vlanif 112 reduced 10
[SW2-Vlanif20]quit /<code>

​设备配置的检查：

​

​

6.汇聚交换机连接边界路由器R1的链路使用接入链路划入VLAN 111以及112 ,通过启用SVI实现汇聚和边界的3层连接，运行OSPF实现内网连通性:使用Loopback0口地址做RID.为了加速收敛在点到点互联链路上不选举DR/BDR。

解决方案：

不选举DR/BDR-->点到点

<code>[AR1]interface GigabitEthernet 0/0/0
[AR1-GigabitEthernet0/0/0]ip address 10.1.111.1 24
[AR1-GigabitEthernet0/0/0]ospf network-type p2p
[AR1-GigabitEthernet0/0/0]quit 

[AR1]interface GigabitEthernet 0/0/1
[AR1-GigabitEthernet0/0/1]ip address 10.1.112.1 24 
[AR1-GigabitEthernet0/0/1]ospf network-type p2p
[AR1-GigabitEthernet0/0/1]quit 

[AR1]ospf 10 router-id 10.1.1.1
[AR1-ospf-10]area 0
[AR1-ospf-10-area-0.0.0.0]network 10.1.1.1 0.0.0.0
[AR1-ospf-10-area-0.0.0.0]network 10.1.111.1 0.0.0.0
[AR1-ospf-10-area-0.0.0.0]network 10.1.112.1 0.0.0.0
[AR1-ospf-10-area-0.0.0.0]quit
[AR1-ospf-10]quit/<code>

<code>[SW1]interface  Vlanif 111
[SW1-Vlanif111]ospf network-type p2p
[SW1-Vlanif111]quit 

[SW1]ospf 10 router-id 10.1.11.11
[SW1-ospf-10]area 0
[SW1-ospf-10-area-0.0.0.0]network 10.1.11.11 0.0.0.0
[SW1-ospf-10-area-0.0.0.0]network 10.1.10.11 0.0.0.0
[SW1-ospf-10-area-0.0.0.0]network 10.1.20.11 0.0.0.0
[SW1-ospf-10-area-0.0.0.0]network 10.1.111.11 0.0.0.0
[SW1-ospf-10-area-0.0.0.0]quit
[SW1-ospf-10]quit/<code>

<code>[SW2]interface Vlanif 112
[SW2-Vlanif112]ospf network-type p2p
[SW2-Vlanif112]quit 

[SW2]ospf 10 router-id 10.1.12.12
[SW2-ospf-10]area 0
[SW2-ospf-10-area-0.0.0.0]network 10.1.12.12 0.0.0.0
[SW2-ospf-10-area-0.0.0.0]network 10.1.10.12 0.0.0.0
[SW2-ospf-10-area-0.0.0.0]network 10.1.20.12 0.0.0.0
[SW2-ospf-10-area-0.0.0.0]network 10.1.112.12 0.0.0.0
[SW2-ospf-10-area-0.0.0.0]quit
[SW2-ospf-10]quit/<code>

​

​

​

​7.各部门主机需要动态获得IP地址,R1做Server,由于打印机需要日常访问因此需要保证其每次获职的地址一致在R1上配置实现。

解决方案：

DHCP Server和DHCP Client不在同一网段-->DHCP Relay

广播discover-->单播discover

<code>[AR1]dhcp enable 
           
[AR1]ip pool IT
[AR1-ip-pool-IT]network 10.1.10.0 mask 255.255.255.0
[AR1-ip-pool-IT]gateway-list 10.1.10.1
[AR1-ip-pool-IT]dns-list 10.1.10.1
[AR1-ip-pool-IT]domain-name Tiger.net
[AR1-ip-pool-IT]quit 

[AR1]ip pool Sales                       
[AR1-ip-pool-Sales]network 10.1.20.0 mask 255.255.255.0
[AR1-ip-pool-Sales]gateway-list 10.1.20.1              
[AR1-ip-pool-Sales]dns-list 10.1.20.1                  
[AR1-ip-pool-Sales]domain-name Tiger.net               
[AR1-ip-pool-Sales]static-bind ip-address 10.1.20.100 mac-address 5489-98BC-41BE 
[AR1-ip-pool-Sales]qui
[AR1-ip-pool-Sales]quit 

[AR1]interface GigabitEthernet 0/0/0
[AR1-GigabitEthernet0/0/0]dhcp select global 
[AR1-GigabitEthernet0/0/0]quit

[AR1]interface GigabitEthernet 0/0/1
[AR1-GigabitEthernet0/0/1]dhcp select global             
[AR1-GigabitEthernet0/0/1]quit  /<code>

<code>[SW1]interface Vlanif 10
[SW1-Vlanif10]dhcp select relay
[SW1-Vlanif10]dhcp relay server-ip 10.1.111.1 
[SW1-Vlanif10]quit 

[SW1]interface Vlanif 20
[SW1-Vlanif20]dhcp select relay       
[SW1-Vlanif20]dhcp relay server-ip 10.1.111.1
[SW1-Vlanif20]quit /<code>

<code>[SW2]interface Vlanif 10
[SW2-Vlanif10]dhcp select relay 
[SW2-Vlanif10]dhcp relay server-ip 10.1.112.1
[SW2-Vlanif10]quit

[SW2]interface Vlanif 20            
[SW2-Vlanif20]dhcp select relay              
[SW2-Vlanif20]dhcp relay server-ip 10.1.112.1
[SW2-Vlanif20]quit      /<code>

​

​

​

​

​

​

​

8.优化路由选择协议，使得交换机连接下游主机的接口不周期发送hello，R1和PC互访，往返流量使用相同路径。

解决方案：

被动接口-->passive掉

对称路由

<code>[AR1]ospf 10
[AR1-ospf-10]silent-interface LoopBack 0
[AR1-ospf-10]quit /<code>

<code>[SW1]ospf 10
[SW1-ospf-10]silent-interface loo 0 
[SW1-ospf-10]silent-interface Vlanif 10
[SW1-ospf-10]silent-interface Vlanif 20
[SW1-ospf-10]quit /<code>

<code>[SW2]ospf 10
[SW2-ospf-10]silent-interface LoopBack 0
[SW2-ospf-10]silent-interface vlan 10
[SW2-ospf-10]silent-interface vlan 20
[SW2-ospf-10]quit /<code>

<code>[SW1]interface Vlanif 20 
[SW1-Vlanif20]ospf cost 2
[SW1-Vlanif20]quit /<code>

<code>[SW2]interface Vlanif 10
[SW2-Vlanif10]ospf cost 2
[SW2-Vlanif10]quit /<code>

​设备配置的检查：

​

​PC-ASW1AR1：

​

​PC-CSW2AR1：

​

​本实验来自腾讯课堂辉哥课程的实验归纳。

未完，待续！

閱讀更多 InternetCafe 的文章

關鍵字: 园区 拓扑 链接