ABC网络工程项目实施文档Word文件下载.docx

1、S-2950-01（config）#VLAN 10S-2950-01（config-vlan）#name OAS-2950-01（config-vlan）#VLAN 20S-2950-01（config-vlan）#name ServerS-2950-02（config）#VLAN 10S-2950-02（config-vlan）#name OAS-2950-02（config-vlan）#VLAN 20S-2950-02（config-vlan）#name Server1.2 STP配置步骤1、配置trunk端口S-3560-01（config）#int range fa0/23-24S-3

2、560-01（config-if-range）#switchport trunk encapsulation dot1qS-3560-01（config-if-range）#switchport mode trunkS-3560-01（config-if-range）#switchport trunk allowed vlan 10,20S-3560-01（config）#int range fa0/1-23560-02配置S-3560-02（config）#int range fa0/23-24S-3560-02（config-if-range）#switchport trunk encap

3、sulation dot1qS-3560-02（config-if-range）#switchport mode trunkS-3560-02（config-if-range）#switchport trunk allowed vlan 10,20S-3560-02（config）#int range fa0/1-22950-1配置S-2950-01（config）#int range fa0/1-2S-2950-01（config-if-range）#switchport mode trunkS-2950-01（config-if-range）#switchport trunk allowe

4、d vlan 10,20S-2950-02（config）#int range fa0/1-2S-2950-02（config-if-range）#switchport mode trunkS-2950-02（config-if-range）#switchport trunk allowed vlan 10,20步骤2、配置STP生成树S-3560-01（config）#spanning-tree vlan 10 root primary S-3560-01（config）#spanning-tree vlan 20 root secondaryS-3560-02（config）#spanni

5、ng-tree vlan 10 root secondaryS-3560-02（config）#spanning-tree vlan 20 root primary1.3 EtherChannel配置创建逻辑接口：S-3560-01（config）#int port-channel 1S-3560-01（config-if）#switchport trunk encapsulation dot1qS-3560-01（config-if）#switchport mode trunkS-3560-01（config-if）#switchport trunk allowed vlan 10,20将逻

6、辑接口与物理接口绑定：S-3560-01（config-if-range）#channel-protocol lacpS-3560-01（config-if-range）#channel-group 1 mode active逻辑接口流量负载均衡：S-3560-01（config）#port-channel load-balance src-dst-ipS-3560-02（config）#interface port-channel 1 vlan 20 root primaryS-3560-02（config-if）#switchport trunk encapsulation dot1qS-

7、3560-02（config-if）#switchport mode trunkS-3560-02（config-if）#switchport trunk allowed vlan 10,201.4 HSRP配置VLAN10、20 地址配置：S-3560-01（config）#int vlan 10S-3560-01（config-if）#ip add 10.0.10.2 255.255.255.0S-3560-01（config-if）#no shutS-3560-01（config-if）#int vlan 20S-3560-01（config-if）#ip add 10.0.20.2 2

8、55.255.255.0HSRP浮动地址、优先级等信息配置：S-3560-01（config-if）#standby 10 ip 10.0.10.1S-3560-01（config-if）#standby 10 priority 150S-3560-01（config-if）#standby 10 preemptS-3560-01（config-if）#standby 20 ip 10.0.20.1S-3560-01（config-if）#standby 20 priority 140S-3560-01（config-if）#standby 20 preemptS-3560-01（config

9、-if）#ip add 10.0.10.3 255.255.255.0S-3560-01（config-if）#ip add 10.0.20.3 255.255.255.0S-3560-02（config-if）#int vlan 10S-3560-02（config-if）#standby 10 ip 10.0.10.1 S-3560-02（config-if）#standby 10 priority 140S-3560-02（config-if）#standby 10 preemptS-3560-02（config-if）#int vlan 20S-3560-02（config-if）#s

10、tandby 20 ip 10.0.20.1S-3560-02（config-if）#standby 20 priority 150S-3560-02（config-if）#standby 20 preempt1.5 二层交换配置 S-2950-01（config）#int range fa0/11-12S-2950-01（config-if-range）#switchport mode accessS-2950-01（config-if-range）#switchport access vlan 10S-2950-01（config-if-range）#spanning-tree portf

11、astS-2950-02（config）#int range fa0/11-12S-2950-02（config-if-range）#switchport mode accessS-2950-02（config-if-range）#switchport access vlan 20S-2950-02（config-if-range）#spanning-tree portfast1.6 PC机配置IP并测试网关通畅性能PC1配置PC2配置测试结果1.7 路由配置S-3560-01（config）#ip routingS-3560-02（config）#ip routing1.8 测试Part2

12、路由器配置Router（config）#hostname ISP-DianXin-2811-01ISP-DianXin-2811-01（config）#ISP-DianXin-2811-01（config）#int fa0/0ISP-DianXin-2811-01（config-if）#ip add 220.0.0.2 255.255.255.248ISP-DianXin-2811-01（config-if）#no shutISP-DianXin-2811-01（config）#int fa0/1ISP-DianXin-2811-01（config-if）#ip add 130.0.0.2 2

13、55.255.255.252ISP-DianXin-2811-01（config）#int fa1/0ISP-DianXin-2811-01（config-if）#ip add 121.0.0.1 255.255.255.0Part3 防火墙配置基础配置ASA5505-01ASA5505-02设置主机名ciscoasa#conf tciscoasa（config）#hostname HQ-BeiJing-ASA5505-01HQ-BeiJing-ASA5505-01（config）#清除原有VLAN配置HQ-BeiJing-ASA5505-01（config）#int vlan 1HQ-Bei

14、Jing-ASA5505-01（config-if）#no nameifHQ-BeiJing-ASA5505-01（config-if）#no security-levelHQ-BeiJing-ASA5505-01（config-if）#no ip addHQ-BeiJing-ASA5505-01（config）#int vlan 2配置VLAN数据HQ-BeiJing-ASA5505-01（config-if）#int vlan 10HQ-BeiJing-ASA5505-01（config-if）#nameif outsideHQ-BeiJing-ASA5505-01（config-if）#

15、security-level 0HQ-BeiJing-ASA5505-01（config-if）#ip add 220.0.0.1 255.255.255.248HQ-BeiJing-ASA5505-01（config-if）#HQ-BeiJing-ASA5505-01（config-if）#int vlan 20HQ-BeiJing-ASA5505-01（config-if）#nameif insideHQ-BeiJing-ASA5505-01（config-if）#security-level 100HQ-BeiJing-ASA5505-01（config-if）#ip add 10.0.

16、0.1 255.255.255.0HQ-BeiJing-ASA5505-01（config-if）#no shutHQ-BeiJing-ASA5505-01（config-if）#int vlan 30HQ-BeiJing-ASA5505-01（config-if）#no forward interface vlan 20HQ-BeiJing-ASA5505-01（config-if）#nameif dmzHQ-BeiJing-ASA5505-01（config-if）#security-level 50HQ-BeiJing-ASA5505-01（config-if）#ip add 172.1

17、6.10.1 255.255.255.0VLAN与端口绑定HQ-BeiJing-ASA5505-01（config-if）#int eth0/0HQ-BeiJing-ASA5505-01（config-if）#switchport access vlan 10HQ-BeiJing-ASA5505-01（config-if）#int eth0/1HQ-BeiJing-ASA5505-01（config-if）#switchport access vlan 20HQ-BeiJing-ASA5505-01（config-if）#int eth0/2HQ-BeiJing-ASA5505-01（conf

18、ig-if）#switchport access vlan 30配置静态路由HQ-BeiJing-ASA5505-01（config）#route outside 130.0.0.0 255.255.255.252 220.0.0.2ciscoasa（config）#hostname Branch-NanJing-ASA5505-02Branch-NanJing-ASA5505-02 （config）#Branch-NanJing-ASA5505-02（config）#int vlan 1Branch-NanJing-ASA5505-02（config-if）#no nameifBranch-

19、NanJing-ASA5505-02（config-if）#no security-levelBranch-NanJing-ASA5505-02（config-if）#no ip addBranch-NanJing-ASA5505-02（config）#int vlan 2Branch-NanJing-ASA5505-02（config）#int vlan 10Branch-NanJing-ASA5505-02（config-if）#name outsideBranch-NanJing-ASA5505-02（config-if）#security-level 0Branch-NanJing-A

20、SA5505-02（config-if）#ip add 130.0.0.1 255.255.255.252Branch-NanJing-ASA5505-02（config-if）#no shutBranch-NanJing-ASA5505-02（config-if）#Branch-NanJing-ASA5505-02（config-if）#int vlan 20Branch-NanJing-ASA5505-02（config-if）#name insideINFO: Security level for inside set to 100 by default.Branch-NanJing-A

21、SA5505-02（config-if）#security-level 100Branch-NanJing-ASA5505-02（config-if）#ip add 10.0.30.1 255.255.255.0Branch-NanJing-ASA5505-02（config）#int eth0/0Branch-NanJing-ASA5505-02（config-if）#switchport access vlan 10Branch-NanJing-ASA5505-02（config-if）#int eth0/1Branch-NanJing-ASA5505-02（config-if）#swit

22、chport access vlan 20Branch-NanJing-ASA5505-02（config）#route outside 220.0.0.0 255.255.255.248 130.0.0.2防火墙配置策略配置1、dmz区web服务器静态映射HQ-BeiJing-ASA5505-01（config）#object network 172.16.10.11/32-WebServerHQ-BeiJing-ASA5505-01（config-network-object）#host 172.16.10.11HQ-BeiJing-ASA5505-01（config-network-ob

23、ject）#nat （dmz,outside） static 220.0.0.32、定义ACL访问控制列表，放行外网进入ASA访问Web服务器的流量HQ-BeiJing-ASA5505-01（config）#access-list Access-DMZ-Server permit icmp any object 172.16.10.11/32-WebServerHQ-BeiJing-ASA5505-01（config）#access-group Access-DMZ-Server out interface dmz3、定义dmz区其他服务器的动态映射HQ-BeiJing-ASA5505-01（

24、config）#object network 172.16.10.0/24-DMZ-ServerHQ-BeiJing-ASA5505-01（config-network-object）#subnet 172.16.10.0 255.255.255.0HQ-BeiJing-ASA5505-01（config-network-object）#nat （dmz,outside） dynamic interface4、定义ACL访问控制列表，放行外网进入ASA访问DMZ其他服务器的流量HQ-BeiJing-ASA5505-01（config）#access-list Access-DMZ-Server

25、 permit icmp any object 172.16.10.0/24-DMZ-Server说明：access-group和前面一样，不用再定义5、inside区内网地址IP映射HQ-BeiJing-ASA5505-01（config）#object network 10.0.0.0/24HQ-BeiJing-ASA5505-01（config-network-object）#subnet 10.0.0.0 255.255.255.0HQ-BeiJing-ASA5505-01（config-network-object）#nat （inside,outside） dynamic interface6、3560配置缺省网关S-3560-02（config）#ip route 0.0.0.0 0.0.0.0 10.