1、 在core-1上增加vlan64,65,66,67,95 在core-2,edge-sw,SF-SW学到vlan信息后,把所有交换机的vtp模式设置成transparent.Core1(config)#vtp domain step_labCore1(config)#vtp mode serverCore1(config)#vlan 64,65,66,67,95Core1(config)#vtp mode transparent3) 设置Core-1为vlan1,64,65的STP主根,为vlan66,67,95的备份STP根. 设置Core-2为vlan66,67,95的STP主根,为vl
2、an1,64,65的备份STP根.Core1(config)#spanning-tree vlan 1,64,65 root primary Core1(config)#spanning-tree vlan 66,67,95 root secondary Core2(config)#spanning-tree vlan 1,64,65 root secondary Core2(config)#spanning-tree vlan 66,67,95 root primary4) core-1的1-5 port划分到vlan 64 core-1的6-10 port划分到vlan 65 core-1
3、的11-15 port划分到vlan 66 core-1的16-20 port划分到vlan 67 把这些port设置成生成树快速转发模式,启用bpduguard,并测试.启用vlan64,65 port的port-security功能,限制每个port只能学习5个mac地址.Core1(config)#int range fa0/1-5Core1(config-if-range)#switchport access vlan 64Core1(config-if-range)#switchport mode accessCore1(config)#int range fa0/6-10Core1
4、(config-if-range)#switchport access vlan 65Core1(config)#int range fa0/11-15Core1(config-if-range)#switchport access vlan 66Core1(config)#int range fa0/16-20Core1(config-if-range)#switchport access vlan 67Core1(config)#int range fa0/1-20Core1(config-if-range)#spanning-tree portfastCore1(config-if-ra
5、nge)#spanning-tree bpduguard enableCore1(config)#int range fa0/1-10Core1(config-if-range)#switchport port-security maximum 55) core-2的1-5 port划分到vlan 64 core-2的6-10 port划分到vlan 65 core-2的11-15 port划分到vlan 66 core-2的16-20 port划分到vlan 67 把这些port设置成生成树快速转发模式,禁止这些port收发BPDU信息,并测试. 设置这些port只接收1M/s的broadc
6、ast数据包,2M/s的multicast数据包. int range fa0/1-5switchport access vlan 64switchport mode accessint range fa0/6-10switchport access vlan 65int range fa0/11-15switchport access vlan 66int range fa0/16-20switchport access vlan 67Core2(config)#int range fa0/1-20Core2(config-if-range)#spanning-tree portfastCo
7、re2(config-if-range)#spanning-tree bpduguard enableCore2(config-if-range)#storm-control broadcast level pps 1mCore2(config-if-range)#storm-control multicast level pps 2m6) 设置vlan ip address: core-1 vlan64: 10.9.64.253/24 core-1 vlan65: 10.9.65.253/24 core-1 vlan66: 10.9.66.253/24 core-1 vlan67: 10.9
8、.67.253/24 core-1 vlan95: 10.9.95.253/24 core-1 loopback0: 10.9.100.1/32 core-1与R1互联的接口: 10.9.96.10/30int vlan 64no shutip add 10.9.64.253 255.255.255.0int vlan 65ip add 10.9.65.253 255.255.255.0int vlan 66ip add 10.9.66.253 255.255.255.0int vlan 67ip add 10.9.67.253 255.255.255.0int vlan 95ip add 1
9、0.9.95.253 255.255.255.0int loopback 0ip add 10.9.100.1 255.255.255.255int fa0/3no switchportip add 10.9.96.10 255.255.255.252 core-2 vlan64: 10.9.64.252/24 core-2 vlan65: 10.9.65.252/24 core-2 vlan66: 10.9.66.252/24 core-2 vlan67: 10.9.67.252/24 core-2 vlan95: 10.9.95.252/24 core-2 loopback0: 10.9.
10、100.2/32 core-2与R1互联的接口: 10.9.96.6/30ip add 10.9.64.252 255.255.255.0ip add 10.9.65.252 255.255.255.0ip add 10.9.66.252 255.255.255.0ip add 10.9.67.252 255.255.255.0ip add 10.9.95.252 255.255.255.0ip add 10.9.100.2 255.255.255.255int fa0/4ip add 10.9.96.6 255.255.255.252sw2 vlan95: 10.9.95.1/24,缺省网关
11、为10.9.95.254,测试可以相互ping通.ip add 10.9.95.1 255.255.255.0 exitip default-gateway 10.9.95.254 sw1 vlan95:10.9.95.2/24,缺省网关为10.9.95.254,测试可以相互ping通.ip add 10.9.95.2 255.255.255.0 7) sw2上启用uplinkfast,并验证.sw2(config)#spanning-tree uplinkfast8) Core-1与Core-2的每个vlan接口都做HSRP, core-1设置成vlan64,65主用设备. core-2设置
12、成vlan66,67,95主用设备.虚拟的IP地址为:10.9.xx.254/24,xx为vlan NO.Core1(config)#int vlan 64Core1(config-if)#standby 1 ip 10.9.64.254 Core1(config-if)#standby 1 priority 105 Core1(config-if)#standby 1 preemptCore1(config-if)#standby 1 track fastEthernet 0/3 20Core1(config-if)#exitCore1(config)#int vlan 65Core1(co
13、nfig-if)#standby 1 ip 10.9.65.254 Core1(config)#int vlan 66Core1(config-if)#standby 1 ip 10.9.66.254 Core1(config)#int vlan 67Core1(config-if)#standby 1 ip 10.9.67.254 Core1(config)#int vlan 95Core1(config-if)#standby 1 ip 10.9.95.254 Core2中:standby 1 ip 10.9.66.254 standby 1 priority 105 standby 1
14、preemptstandby 1 track fastEthernet 0/4 20standby 1 ip 10.9.67.254 standby 1 ip 10.9.95.254standby 1 ip 10.9.64.254 standby 1 ip 10.9.65.254 9) 设置R1:F0/0:10.9.96.9/30 F0/1:10.9.96.5/30 loopback0:10.9.100.3/32 R1,core-1,core-2启用eigrp路由协议,使所有网络互通,并验证.int fa0/0ip add 10.9.96.9 255.255.255.252int fa0/1i
15、p add 10.9.96.5 255.255.255.252ip add 10.9.100.3 255.255.255.255router eigrp 100network 10.0.0.0 no auto-summaryCore1(config-router)#ip routing Core1(config-router)#router eigrp 100Core1(config-router)#network 10.0.0.0 Core1(config-router)#no auto-summaryCore2(config)#ip routing Core2(config)#router
16、 eigrp 100Core2(config-router)#network 10.0.0.0 Core2(config-router)#no auto-summary10) R1上启用dhcp server功能,为以下网段提供dhcp服务: 10.9.64.0/24 10.9.65.0/24 10.9.66.0/24 10.9.67.0/24 分配10.9.xx.11-10.9.xx.200,xx为vlan NO DNS server: 10.9.100.3 Default-gateway: 10.9.xx.254 Domain-name: 并在core-1,core-2的VLAN接口上启用
17、DHCP广播重定向功能,从定向到R1这台DHCP Server,使dhcp server能够正常为PC提供IP地址服务/默认arp请求只会发到core的下层接口,使用ip helper-address *来实现广播重定向R1(config)#ip dhcp pool testnetwork 10.9.64.0 255.255.255.0dns-server 10.9.100.3default-router 10.9.64.254 domain-name ip dhcp pool test1network 10.9.65.0 255.255.255.0default-router 10.9.65
18、.254 ip dhcp pool test2network 10.9.66.0 255.255.255.0default-router 10.9.66.254 ip dhcp pool test3network 10.9.67.0 255.255.255.0default-router 10.9.67.254 ip dhcp excluded-address 10.9.64.201 10.9.64.254ip dhcp excluded-address 10.9.64.1 10.9.64.10ip dhcp excluded-address 10.9.65.201 10.9.65.254ip
19、 dhcp excluded-address 10.9.65.1 10.9.65.10ip dhcp excluded-address 10.9.66.201 10.9.66.254ip dhcp excluded-address 10.9.66.1 10.9.66.10ip dhcp excluded-address 10.9.67.201 10.9.67.254ip dhcp excluded-address 10.9.67.1 10.9.67.10Core1(config-if)#ip helper-address 10.9.96.9 Core2(config)#int vlan 64C
20、ore2(config-if)#ip helper-address 10.9.96.5 Core2(config-if)#exitCore2(config)#int vlan 65Core2(config)#int vlan 66Core2(config)#int vlan 67Core2(config-if)#ip helper-address 10.9.96.511) 启用sw1 vlan 64-67的ip dhcp snooping功能,并只允许F0/23-24的dhcp reply数据包.Ip dhcp snooping sw1(config)#ip dhcp snooping vlan 64 sw1(config)#ip dhcp snooping vlan 65sw1(config)#ip dhcp snooping vlan 66sw1(config)#ip dhcp snooping vlan 67int range fa0/23 -24 ip dhcp snooping trust12) 测试core-1或者core-2断电时,网络可以正常运行.
copyright@ 2008-2022 冰豆网网站版权所有
经营许可证编号:鄂ICP备2022015515号-1